844567585d* ci: set a least-privilege default GITHUB_TOKEN scope CodeQL alert #64 (`actions/missing-workflow-permissions`, medium) on `.github/workflows/main.yml`: no `permissions` block, so every job inherits the repository's default GITHUB_TOKEN scope, which is broader than anything here needs. It matters more than the severity suggests because this is the workflow that publishes to npm under OIDC — an over-permissioned token in a job that mints publish credentials is worth tightening before 2.0.0 ships (#1818). Adds a workflow-level `permissions: contents: read`. The `publish` and `publish-github-container-registry` jobs already declare their own blocks (`id-token: write` and friends) and are unaffected: job-level permissions override the workflow-level default outright rather than merging with it. The comment records that, since it means each publish job must keep listing every scope it needs — including `contents: read` — and a future edit that trims one "because it's inherited" would break the publish. Surfaced by the v2 tree swap (#1817): `main` had never scanned this workflow before. Pre-existing on `v2/main`, not introduced by that merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD * chore(deps): upgrade @hono/node-server to 2.0.12 Clears GHSA-frvp-7c67-39w9 (2 Dependabot alerts): path traversal in `serve-static` on Windows via an encoded backslash, affecting < 2.0.5. The Inspector's prod web server calls the flagged function directly (`clients/web/server/server.ts` mounts `serveStatic` at `/*`). Worth being precise about the actual exposure, since the summary line reads worse than the flaw is: `..` escapes remain blocked, so it only reaches files *inside* the configured root, by slipping past prefix-mounted middleware. Here `root` is the built SPA — everything in it is public by design — and the only prefix middleware (`/api/*`) is a separate route, not a subdirectory of that root. So there was no auth bypass and no arbitrary file read to fix; this is hygiene, not an incident. The 1.x → 2.x majors turn out to be a non-event for this codebase: v2 drops Node 18 (the repo already requires >=22.19.0) and removes the Vercel adapter (unused). `serve`, `serveStatic`, and `ServerType` — the entire import surface here, across the prod server and ~15 integration tests — are unchanged. `npm run validate` passes on all four clients. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
103 lines
3.6 KiB
JSON
103 lines
3.6 KiB
JSON
{
|
|
"name": "@modelcontextprotocol/inspector-web",
|
|
"private": true,
|
|
"type": "module",
|
|
"main": "build/index.js",
|
|
"bin": {
|
|
"mcp-inspector-web": "./build/index.js"
|
|
},
|
|
"exports": {
|
|
".": "./build/index.js"
|
|
},
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -b && vite build && npm run build:runner",
|
|
"build:client": "vite build",
|
|
"build:runner": "tsup --config tsup.runner.config.ts",
|
|
"build:storybook": "storybook build",
|
|
"validate": "npm run format:check && npm run lint && npm run build && npm run test",
|
|
"pretest": "npm run test-servers:build",
|
|
"test": "vitest run --project=unit",
|
|
"test:watch": "vitest --project=unit",
|
|
"test:coverage": "npm run test-servers:build && vitest run --project=unit --project=integration --coverage",
|
|
"test:storybook": "vitest run --project=storybook",
|
|
"test:storybook:watch": "vitest --project=storybook",
|
|
"test:integration": "npm run test-servers:build && vitest run --project=integration",
|
|
"test:integration:watch": "npm run test-servers:build && vitest --project=integration",
|
|
"test-servers:build": "tsc -p ../../test-servers --noCheck",
|
|
"lint": "eslint .",
|
|
"format": "prettier --write src server .storybook \"*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\"",
|
|
"format:check": "prettier --check src server .storybook \"*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\"",
|
|
"preview": "vite preview",
|
|
"storybook": "storybook dev -p 6006"
|
|
},
|
|
"dependencies": {
|
|
"@dnd-kit/core": "^6.3.1",
|
|
"@dnd-kit/sortable": "^8.0.0",
|
|
"@dnd-kit/utilities": "^3.2.2",
|
|
"@emotion/react": "^11.14.0",
|
|
"@hono/node-server": "^2.0.12",
|
|
"@mantine/core": "^8.3.17",
|
|
"@mantine/form": "^8.3.17",
|
|
"@mantine/hooks": "^8.3.17",
|
|
"@mantine/notifications": "^8.3.17",
|
|
"@modelcontextprotocol/client": "2.0.0-beta.5",
|
|
"@modelcontextprotocol/core": "2.0.0-beta.5",
|
|
"@modelcontextprotocol/ext-apps": "^1.7.4",
|
|
"@modelcontextprotocol/server": "2.0.0-beta.5",
|
|
"@modelcontextprotocol/server-legacy": "2.0.0-beta.5",
|
|
"@napi-rs/keyring": "^1.3.0",
|
|
"ajv": "^8.17.1",
|
|
"atomically": "^2.1.1",
|
|
"chokidar": "^4.0.3",
|
|
"commander": "^13.1.0",
|
|
"hono": "^4.12.18",
|
|
"open": "^10.2.0",
|
|
"papaparse": "^5.5.4",
|
|
"pino": "^9.14.0",
|
|
"react": "^19.2.4",
|
|
"react-dom": "^19.2.4",
|
|
"react-icons": "^5.6.0",
|
|
"react-markdown": "^10.1.0",
|
|
"react-syntax-highlighter": "^16.1.1",
|
|
"remark-gfm": "^4.0.1",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"devDependencies": {
|
|
"@chromatic-com/storybook": "^5.0.1",
|
|
"@eslint/js": "^9.39.4",
|
|
"@storybook/addon-a11y": "^10.2.19",
|
|
"@storybook/addon-docs": "^10.2.19",
|
|
"@storybook/addon-onboarding": "^10.2.19",
|
|
"@storybook/addon-vitest": "^10.2.19",
|
|
"@storybook/react-vite": "^10.2.19",
|
|
"@testing-library/jest-dom": "^6.9.1",
|
|
"@testing-library/react": "^16.3.2",
|
|
"@testing-library/user-event": "^14.6.1",
|
|
"@types/express": "^5.0.6",
|
|
"@types/node": "^24.12.4",
|
|
"@types/papaparse": "^5.5.2",
|
|
"@types/react": "^19.2.14",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@types/react-syntax-highlighter": "^15.5.13",
|
|
"@vitejs/plugin-react": "^6.0.0",
|
|
"@vitest/browser-playwright": "^4.1.0",
|
|
"@vitest/coverage-v8": "^4.1.0",
|
|
"eslint": "^9.39.4",
|
|
"eslint-plugin-react-hooks": "^7.0.1",
|
|
"eslint-plugin-react-refresh": "^0.5.2",
|
|
"eslint-plugin-storybook": "^10.2.19",
|
|
"express": "^5.2.1",
|
|
"globals": "^17.4.0",
|
|
"happy-dom": "^20.9.0",
|
|
"playwright": "^1.58.2",
|
|
"prettier": "3.8.4",
|
|
"storybook": "^10.2.19",
|
|
"tsup": "^8.5.1",
|
|
"typescript": "~5.9.3",
|
|
"typescript-eslint": "^8.56.1",
|
|
"vite": "^8.0.0",
|
|
"vitest": "^4.1.0",
|
|
"yaml": "^2.9.0"
|
|
}
|
|
}
|