@mcp-guardian/server - npm Package Compare versions

Comparing version

+3

-3

package.json

		{
		"name": "@mcp-guardian/server",
		"version": "4.1.1",
		"version": "4.1.2",
		"description": "Security, cost, and health governance proxy for MCP infrastructure — three-layer detection engine (regex + schema + LLM), monorepo, corpus, CI/CD",
		@@ -59,4 +59,4 @@ "type": "module",
		"dependencies": {
		"@mcp-guardian/core": "^4.1.1",
		"@mcp-guardian/plugin-sdk": "^4.1.1",
		"@mcp-guardian/core": "^4.1.2",
		"@mcp-guardian/plugin-sdk": "^4.1.2",
		"@modelcontextprotocol/sdk": "^1.25.2",
		@@ -63,0 +63,0 @@ "@opentelemetry/api": "^1.9.1",

+5

-5

SECURITY.md

		@@ -63,6 +63,6 @@ # Security Policy

		\| Alert \| Why it appears \| Mitigation in 4.1.1+ \|
		\| Alert \| Why it appears \| Mitigation in 4.1.2+ \|
		\|---\|---\|---\|
		\| Install scripts \| Older tarballs shipped `postinstall` / `prepack` in `package.json` \| Lifecycle scripts stripped at `prepack`; no code runs on `npm install` \|
		\| Manifest confusion \| 4.1.0 was published with unresolved `workspace:` deps and without `@mcp-guardian/core@4.1.x` \| Publish full chain via `./scripts/publish-npm-all.sh`; deps rewritten to `^4.1.1` \|
		\| Manifest confusion / InstallError \| 4.1.0–4.1.1 shipped unresolved `workspace:` deps (`EUNSUPPORTEDPROTOCOL`) \| Use @4.1.2+; publish via `./scripts/publish-npm-all.sh` (runs `validate-npm-pack.mjs`) \|
		\| Network access \| Proxy, CVE lookups (OSV/NVD), optional cloud observatory \| Required by design — see threat model above \|
		@@ -75,3 +75,3 @@ \| Shell access \| Policy engine detects shell injection; optional subprocess for MCP stdio servers \| Required by design — does not execute on install \|
		```bash
		npm install @mcp-guardian/server@latest
		npm install @mcp-guardian/server@4.1.2
		```
		@@ -82,4 +82,4 @@
		```bash
		npm pack --dry-run && tar -xOf mcp-guardian-server-*.tgz package/package.json \| jq '.scripts,.dependencies["@mcp-guardian/core"]'
		# Expect: scripts absent or empty; core dep "^4.1.1" not "workspace:..."
		node scripts/validate-npm-pack.mjs
		# Expect: OK @mcp-guardian/server@x.y.z; core dep "^x.y.z" not "workspace:..."
		```
		@@ -86,0 +86,0 @@

New alerts