844567585d* ci: set a least-privilege default GITHUB_TOKEN scope CodeQL alert #64 (`actions/missing-workflow-permissions`, medium) on `.github/workflows/main.yml`: no `permissions` block, so every job inherits the repository's default GITHUB_TOKEN scope, which is broader than anything here needs. It matters more than the severity suggests because this is the workflow that publishes to npm under OIDC — an over-permissioned token in a job that mints publish credentials is worth tightening before 2.0.0 ships (#1818). Adds a workflow-level `permissions: contents: read`. The `publish` and `publish-github-container-registry` jobs already declare their own blocks (`id-token: write` and friends) and are unaffected: job-level permissions override the workflow-level default outright rather than merging with it. The comment records that, since it means each publish job must keep listing every scope it needs — including `contents: read` — and a future edit that trims one "because it's inherited" would break the publish. Surfaced by the v2 tree swap (#1817): `main` had never scanned this workflow before. Pre-existing on `v2/main`, not introduced by that merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD * chore(deps): upgrade @hono/node-server to 2.0.12 Clears GHSA-frvp-7c67-39w9 (2 Dependabot alerts): path traversal in `serve-static` on Windows via an encoded backslash, affecting < 2.0.5. The Inspector's prod web server calls the flagged function directly (`clients/web/server/server.ts` mounts `serveStatic` at `/*`). Worth being precise about the actual exposure, since the summary line reads worse than the flaw is: `..` escapes remain blocked, so it only reaches files *inside* the configured root, by slipping past prefix-mounted middleware. Here `root` is the built SPA — everything in it is public by design — and the only prefix middleware (`/api/*`) is a separate route, not a subdirectory of that root. So there was no auth bypass and no arbitrary file read to fix; this is hygiene, not an incident. The 1.x → 2.x majors turn out to be a non-event for this codebase: v2 drops Node 18 (the repo already requires >=22.19.0) and removes the Vercel adapter (unused). `serve`, `serveStatic`, and `ServerType` — the entire import surface here, across the prod server and ~15 integration tests — are unchanged. `npm run validate` passes on all four clients. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
115 lines
5.3 KiB
JSON
115 lines
5.3 KiB
JSON
{
|
|
"name": "@modelcontextprotocol/inspector",
|
|
"version": "2.0.0",
|
|
"description": "The Model Context Protocol Inspector",
|
|
"keywords": [
|
|
"MCP",
|
|
"inspector"
|
|
],
|
|
"homepage": "https://github.com/modelcontextprotocol/inspector#readme",
|
|
"bugs": {
|
|
"url": "https://github.com/modelcontextprotocol/inspector/issues"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/modelcontextprotocol/inspector.git"
|
|
},
|
|
"license": "MIT",
|
|
"author": "The MCP Maintainers and Community",
|
|
"type": "module",
|
|
"bin": {
|
|
"mcp-inspector": "./clients/launcher/build/index.js"
|
|
},
|
|
"files": [
|
|
"clients/launcher/build",
|
|
"clients/web/build",
|
|
"clients/web/dist",
|
|
"clients/cli/build",
|
|
"clients/tui/build",
|
|
"scripts/install-clients.mjs"
|
|
],
|
|
"scripts": {
|
|
"web": "node clients/launcher/build/index.js --web",
|
|
"build:web:runner": "cd clients/web && npm run build:runner",
|
|
"web:dev": "npm run build:web:runner && node clients/launcher/build/index.js --web --dev",
|
|
"build": "npm run build:web && npm run build:cli && npm run build:tui && npm run build:launcher",
|
|
"build:cli": "cd clients/cli && npm run build",
|
|
"build:tui": "cd clients/tui && npm run build",
|
|
"build:web": "cd clients/web && npm run build",
|
|
"build:launcher": "cd clients/launcher && npm run build",
|
|
"ci": "npm run validate && npm run coverage && npm run verify:build-gate && npm run smoke && npm run ci:storybook",
|
|
"ci:storybook": "cd clients/web && npx playwright install chromium && npm run test:storybook",
|
|
"verify:build-gate": "node scripts/verify-build-gate.mjs",
|
|
"verify:typecheck-coverage": "node scripts/verify-typecheck-coverage.mjs",
|
|
"test:scripts": "node --test \"scripts/**/*.test.mjs\"",
|
|
"validate": "npm run verify:format-coverage && npm run verify:typecheck-coverage && npm run test:scripts && npm run validate:core && npm run validate:web && npm run validate:cli && npm run validate:tui && npm run validate:launcher",
|
|
"verify:format-coverage": "node scripts/verify-format-coverage.mjs",
|
|
"validate:core": "npm run format:check:core && npm run format:check:scripts && npm run format:check:shared && npm run lint:core && npm run lint:shared",
|
|
"lint:core": "eslint \"core/**/*.{ts,tsx}\"",
|
|
"lint:shared": "eslint \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts eslint.config.js",
|
|
"format:core": "prettier --write \"core/**/*.{ts,tsx}\"",
|
|
"format:check:core": "prettier --check \"core/**/*.{ts,tsx}\"",
|
|
"format:scripts": "prettier --write \"scripts/**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\"",
|
|
"format:check:scripts": "prettier --check \"scripts/**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\"",
|
|
"format:shared": "prettier --write \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts eslint.config.js",
|
|
"format:check:shared": "prettier --check \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts eslint.config.js",
|
|
"format": "npm run format:core && npm run format:scripts && npm run format:shared && cd clients/web && npm run format && cd ../cli && npm run format && cd ../tui && npm run format && cd ../launcher && npm run format",
|
|
"validate:cli": "cd clients/cli && npm run validate",
|
|
"validate:tui": "cd clients/tui && npm run validate",
|
|
"validate:web": "cd clients/web && npm run validate",
|
|
"validate:launcher": "cd clients/launcher && npm run validate",
|
|
"coverage": "npm run coverage:web && npm run coverage:cli && npm run coverage:tui && npm run coverage:launcher",
|
|
"coverage:cli": "cd clients/cli && npm run test:coverage",
|
|
"coverage:tui": "cd clients/tui && npm run test:coverage",
|
|
"coverage:web": "cd clients/web && npm run test:coverage",
|
|
"coverage:launcher": "cd clients/launcher && npm run test:coverage",
|
|
"smoke": "npm run smoke:launcher && npm run smoke:cli && npm run smoke:tui && npm run smoke:web && npm run smoke:web:browser",
|
|
"smoke:cli": "node scripts/smoke-cli.mjs",
|
|
"smoke:tui": "node scripts/smoke-tui.mjs",
|
|
"smoke:web": "node scripts/smoke-web.mjs",
|
|
"smoke:web:browser": "cd clients/web && npx playwright install chromium && node ../../scripts/smoke-web-browser.mjs",
|
|
"smoke:launcher": "node scripts/smoke-launcher.mjs",
|
|
"pack:verify": "node scripts/pack-and-verify.mjs",
|
|
"prepack": "npm run build",
|
|
"postinstall": "node scripts/install-clients.mjs"
|
|
},
|
|
"dependencies": {
|
|
"@hono/node-server": "^2.0.12",
|
|
"@modelcontextprotocol/client": "2.0.0-beta.5",
|
|
"@modelcontextprotocol/core": "2.0.0-beta.5",
|
|
"@modelcontextprotocol/ext-apps": "^1.7.4",
|
|
"@modelcontextprotocol/server": "2.0.0-beta.5",
|
|
"@modelcontextprotocol/server-legacy": "2.0.0-beta.5",
|
|
"@napi-rs/keyring": "^1.3.0",
|
|
"@vitejs/plugin-react": "^6.0.0",
|
|
"ajv": "^8.17.1",
|
|
"atomically": "^2.1.1",
|
|
"chokidar": "^4.0.3",
|
|
"commander": "^13.1.0",
|
|
"hono": "^4.12.18",
|
|
"ink": "^6.0.0",
|
|
"ink-form": "^2.0.1",
|
|
"ink-scroll-view": "^0.3.6",
|
|
"open": "^10.2.0",
|
|
"pino": "^9.14.0",
|
|
"react": "^19.2.4",
|
|
"undici": "^8.5.0",
|
|
"vite": "^8.0.0",
|
|
"yaml": "^2.9.0",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"overrides": {
|
|
"ink-select-input": "^6.2.0"
|
|
},
|
|
"engines": {
|
|
"node": ">=22.19.0"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.39.5",
|
|
"eslint": "^9.39.5",
|
|
"globals": "^17.7.0",
|
|
"prettier": "3.8.4",
|
|
"typescript": "~5.9.3",
|
|
"typescript-eslint": "^8.65.0"
|
|
}
|
|
}
|