loopback-mcp-server - npm Package Compare versions

Comparing version 0.9.3 to 0.9.4

CHANGELOG.md

@@ -8,2 +8,24 @@ # Changelog
 
+## [0.9.4] — 2026-08-02
+
+Ships the machine-path fix to adopters. Published 0.9.3 still writes a
+username-bearing absolute path into committed agent configs when `init` runs
+from an external checkout — the leak `dj-system` already shipped publicly —
+so source being fixed changed nothing until this release. Also carries the
+port-collision fix (0.9.3 exits 0 on a taken port, banner and all).
+
+### Fixed — `init` no longer writes this machine's absolute path into external repos' configs
+Onboarding an external repo from a stable local checkout wrote the checkout's
+absolute `dist/index.js` path — username included — into `.mcp.json`,
+`.codex/config.toml` and `.gemini/settings.json`. dj-system committed exactly
+that to a public repo (its PR #22), a config that works on one machine and
+breaks on every clone. The behaviour was deliberate back when nothing was
+published ("fast startup", fb_mrsuu878); it has been wrong since 0.9.0 hit
+npm. The stable-external branch of `serverCommand()` now emits
+`npx -y loopback-mcp-server` like the ephemeral branch; onboarding a repo the
+server lives in keeps the repo-relative `node ./dist/index.js`. `init-gate`
+now asserts the external renders are machine-path-free — previously it only
+checked the self-onboarded configs, so this exact leak had no failing gate.
+(fb_msc0vh4e)
+
 ## [0.9.3] — accuracy pass: a red CI nobody was watching, and docs nothing checked
@@ -10,0 +32,0 @@

dist/init.js

@@ -118,4 +118,8 @@ /**
  *   works on every clone and leaks no machine paths.
- * - Stable checkout elsewhere → absolute path (fast startup).
- * - Ephemeral npx run → `npx loopback-mcp-server` (the published package).
+ * - Everything else → `npx loopback-mcp-server` (the published package).
+ *
+ * A stable external checkout used to get its absolute path for fast startup —
+ * which wrote a username-bearing machine path into configs that get committed
+ * (dj-system shipped exactly that in a public repo). These files outlive the
+ * machine that ran init; portability beats cold-start speed.
  */
@@ -125,9 +129,9 @@ function serverCommand(cwd) {
     const ephemeral = entry.split(sep).includes("_npx");
-    if (ephemeral || !existsSync(entry))
-        return { command: "npx", args: ["-y", NPM_SPEC] };
-    const inside = relative(cwd, entry);
-    if (!inside.startsWith("..") && !isAbsolute(inside)) {
-        return { command: "node", args: [`./${inside.split(sep).join("/")}`] };
+    if (!ephemeral && existsSync(entry)) {
+        const inside = relative(cwd, entry);
+        if (!inside.startsWith("..") && !isAbsolute(inside)) {
+            return { command: "node", args: [`./${inside.split(sep).join("/")}`] };
+        }
     }
-    return { command: "node", args: [entry] };
+    return { command: "npx", args: ["-y", NPM_SPEC] };
 }
@@ -134,0 +138,0 @@ function readIfExists(path) {

dist/server.js

@@ -6,3 +6,3 @@ /** MCP server definition: nine loopback_* tools over the feedback store. */
 import { itemMarkdown, listMarkdown } from "./format.js";
-export const SERVER_VERSION = "0.9.3";
+export const SERVER_VERSION = "0.9.4";
 function ok(text, structured) {
@@ -9,0 +9,0 @@ return {

package.json

@@ -5,3 +5,3 @@ {
   "author": "Dikshant Joshi",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "files": [
@@ -8,0 +8,0 @@ "dist",

README.md

@@ -16,3 +16,8 @@ # Loopback
 [![CI](https://github.com/joshidikshant/loopback/actions/workflows/ci.yml/badge.svg)](https://github.com/joshidikshant/loopback/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/loopback-mcp-server)](https://www.npmjs.com/package/loopback-mcp-server)
+[![node](https://img.shields.io/node/v/loopback-mcp-server)](https://nodejs.org)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
+https://github.com/user-attachments/assets/77c24102-f6e8-44cf-8055-9e9415a4084e
+
 ![The loop, closed: a green verified pin on the form claude-code fixed (PR linked), an amber open pin on the AI answer, and the Loopback panel listing both](assets/loopback-widget-demo.png)
@@ -86,5 +91,20 @@
 Register the MCP server + instructions once per agent; after this, new projects
-are a two-minute `init`. All three are equal citizens — full per-agent pages in
-[`integrations/`](integrations/):
+are a two-minute `init`. The copy-paste version — Claude Code (`.mcp.json` in
+your project, or `~/.claude.json` for all projects):
 
+```json
+{
+  "mcpServers": {
+    "loopback": {
+      "command": "npx",
+      "args": ["-y", "loopback-mcp-server"]
+    }
+  }
+}
+```
+
+Codex and Gemini CLI take the same `command`/`args` in their own config — the
+server is the same binary over stdio. All three are equal citizens — full
+per-agent pages in [`integrations/`](integrations/):
+
 | Agent | MCP registration | Instructions/skill channel |
@@ -448,5 +468,7 @@ |---|---|---|
    (loads once you trust the repo); `init` also prints the global block.
-5. **`init` writes the local checkout's absolute path when stable, `npx
-   github:` otherwise** — fast startup for clones, zero-setup portability for
-   npx runs.
+5. **`init` writes a repo-relative path when the server lives inside the
+   onboarded repo, `npx loopback-mcp-server` everywhere else** — committed
+   configs must work on every clone; a machine path works on exactly one.
+   (Originally: absolute path for stable checkouts, `npx github:` for
+   ephemeral runs — both retired once the package was on npm.)
 6. **`/ingest` accepts unknown extra fields** (no `.strict()`) — older hubs
@@ -453,0 +475,0 @@ must not reject newer widgets; forward compatibility beats strictness at

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

859243

0.29%

Lines of code

6877

0.06%

Number of lines in readme file

528

4.35%

No dependency changes