Commit graph

181 commits

Author SHA1 Message Date
Bryan Thompson
f14863bcdc
feat: enhanced structural validation for mcpb validate (#57)
Add three pre-pack validators to catch common runtime failures early:

- validateEntryPoint: checks file exists, extension matches server type,
  binary has executable bit (Unix)
- validateCommandVariables: scans mcp_config for unrecognized ${...}
  variables against the runtime allowlist
- validateSensitiveFiles: warns about credentials.json, *.pem, *.key,
  .ssh/, etc. that would be bundled

validateManifest() now accepts optional { projectDir } to separate the
manifest directory from the source file directory.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-15 06:56:55 -05:00
Tobin South
1dca91e2be
Merge pull request #178 from modelcontextprotocol/chore/apache-2.0-license
chore: update licensing to Apache 2.0 for new contributions
2026-02-12 10:24:17 -08:00
Adam Jones
24aa4efc88
chore: update licensing to Apache 2.0 for new contributions 2026-01-12 22:50:15 +00:00
joan-anthropic
27083dcf93
Merge pull request #172 from modelcontextprotocol/feat/init-manifest-version-option
feat: add --manifest-version option to init command
2025-12-03 21:32:27 -08:00
Joan Xie
163fa29a1c
style: fix Prettier formatting in cli.ts
Break function parameters onto separate lines with trailing comma.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-03 21:03:04 -08:00
joan-anthropic
2a788100a6
Merge pull request #173 from modelcontextprotocol/fix/mcp-config-required v2.1.2
fix: make mcp_config required for all server types in v0.4 schema
2025-12-03 20:49:16 -08:00
Joan Xie
1dbbffc972
fix: make mcp_config required for all server types in v0.4 schema
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-03 20:48:31 -08:00
Joan Xie
761e834ba8
feat: add --manifest-version option to init command
Allow developers to specify which manifest version to use when
initializing a new manifest.json file.

Usage: mcpb init --manifest-version 0.3

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-03 20:18:45 -08:00
Alexander Sklar
3635e20ca8
Merge pull request #169 from asklar/asklar-patch-1
Fix file-system-node example
2025-12-03 18:53:50 -08:00
joan-anthropic
7c7f4b6af0
Merge pull request #168 from modelcontextprotocol/fix/node-forge-vulnerabilities v.2.1.1 v2.1.0
fix: upgrade node-forge to 1.3.2 to address security vulnerabilities
2025-12-03 17:08:35 -08:00
Alexander Sklar
2ed5481016
Bump version and update dependencies in package.json
update filesystem server version
2025-12-03 17:07:25 -08:00
Joan Xie
be3b8f2561
fix: upgrade node-forge to 1.3.2 to address security vulnerabilities
Fixes three known vulnerabilities:
- GHSA-554w-wpv2-vw27: ASN.1 Unbounded Recursion (High)
- GHSA-5gfm-wpxj-wjgq: ASN.1 Validator Desynchronization (High)
- GHSA-65ch-62r8-g69g: ASN.1 OID Integer Truncation (Medium)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-03 17:06:23 -08:00
joan-anthropic
9c22416146
Merge pull request #167 from modelcontextprotocol/bump-minor-version-2.1.0
chore: bump minor version to 2.1.0
2025-12-03 16:56:10 -08:00
Joan Xie
2ab44ffa5b
chore: bump minor version to 2.1.0
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-03 16:51:56 -08:00
joan-anthropic
970f2d5e5d
Merge pull request #158 from modelcontextprotocol/joan/uv-runtime-support
feat: add experimental UV runtime support in manifest v0.4
2025-12-03 16:50:01 -08:00
Joan Xie
ca4a8819a0
chore: mark v0.4 schema as experimental
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-03 11:48:15 -08:00
Joan Xie
d90365e626
feat: add UV runtime support in manifest v0.4
Add UV as a new server type for Python extensions that use UV runtime
for dependency management instead of bundling dependencies.

Schema changes (v0.4):
- Add "uv" to server.type enum
- Make mcp_config optional (not needed for UV type)
- UV extensions rely on pyproject.toml for dependencies

Documentation:
- Add UV runtime section to MANIFEST.md explaining benefits and usage
- Update README.md to recommend UV runtime for Python
- Add complete hello-world-uv example

Benefits of UV runtime:
- Cross-platform support (Windows/macOS/Linux, Intel/ARM)
- Small bundle size (~100 KB vs 5-10 MB)
- Handles compiled dependencies portably
- No user Python installation required

Example manifest:
{
  "manifest_version": "0.4",
  "server": {
    "type": "uv",
    "entry_point": "src/server.py"
  }
}

Co-authored-by: Joan <joan@anthropic.com>
2025-12-02 21:22:19 -08:00
joan-anthropic
dd9502e8ec
Merge pull request #151 from anthropics/fix/backport-privacy-policices-0_1
fix: remove _meta from 0.1
2025-11-06 13:09:39 -08:00
Joan Xie
349b0ceb47
chore: update patch version 2025-11-06 11:10:53 -08:00
Joan Xie
00e4bb9d10
chore: update version 2025-11-06 11:02:42 -08:00
Joan Xie
671d3d6f2d
rm privacy_policies 2025-11-06 11:01:20 -08:00
Joan Xie
29d23abfe6
fix: backport privacy_policies to 0.1, remove _meta 2025-11-06 09:29:33 -08:00
joan-anthropic
dc7e1514ce
Merge pull request #150 from anthropics/feat/restore-type-exports 2.0.1
Fix: Restore type exports
2025-11-04 13:11:11 -08:00
Joan Xie
d2826644b6
Restore missing type exports for mcpb package
- Export McpbManifestAny and Logger types from types.js
- Export McpbSignatureInfo and McpbUserConfigValues from shared/common.ts
- Add exports to both main and browser entry points
- Bump version to 2.0.1

This eliminates the need for manual type inference in consuming code.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-04 13:09:14 -08:00
joan-anthropic
5079fcfe30
Merge pull request #148 from anthropics/feat/browser-export-versioned-schemas 2.0.0
feat: export versioned zod schemas in mcpb/browser, remove vLatest artifacts
2025-11-04 10:39:43 -08:00
Samuel Attard
5f6b15bc81
remove da bad tings 2025-11-04 10:33:16 -08:00
Joan Xie
5f87ea58d6
Comment out localization parameter in tests
The localization parameter is commented out in the buildManifest function
signature, so it should also be commented out in the test calls.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-03 16:37:27 -08:00
Joan Xie
e4f1236bf2
Fix TypeScript error: remove localization argument from buildManifest call
The buildManifest function signature has the localization parameter
commented out (expecting 13 params), but the function call was still
passing it as the 14th argument, causing a type error.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-03 16:26:38 -08:00
Joan Xie
08cb52bc86
remove localization param 2025-11-03 16:07:24 -08:00
Joan Xie
e59797f9ce
chore: major version bump 2025-11-03 16:04:56 -08:00
Joan Xie
07b77432a6
Fix lint errors: sort imports and rename unused parameter
- Reorganize imports in types.ts to satisfy simple-import-sort
- Rename unused localization parameter to _localization in init.ts
2025-11-03 16:02:09 -08:00
Joan Xie
3a9ee6e007
Export schemas/index instead of specific version
Changed all entry points (index.ts, cli.ts, node.ts) to export from schemas/index.js
instead of schemas/0.3.js. This provides access to all versioned schemas (v0_1, v0_2,
v0_3, vAny) and VERSIONED_MANIFEST_SCHEMAS without exposing a specific version.
2025-11-03 15:59:40 -08:00
Joan Xie
21c9710584
Fix lint errors in types.ts and remove any casts
- Use import type for VERSIONED_MANIFEST_SCHEMAS and DEFAULT_MANIFEST_VERSION
- Remove unnecessary any type annotations from test file
2025-11-03 15:57:20 -08:00
Joan Xie
8018a9a2e0
Remove latest schema reference from build script
The build script was still importing from the deleted schemas/latest.js file.
Updated to import McpbSignatureInfoSchema from 0.3.js and removed the
mcpb-manifest-latest entry from versionedManifestSchemas.
2025-11-03 15:54:54 -08:00
Joan Xie
3fffc30560
Use McpbManifestDefault derived from DEFAULT_MANIFEST_VERSION
Changes:
- Create McpbManifestDefault type derived from VERSIONED_MANIFEST_SCHEMAS[DEFAULT_MANIFEST_VERSION]
- Update init.ts to use McpbManifestDefault instead of hardcoded v0.2 schema
- Import schema types from version matching DEFAULT_MANIFEST_VERSION (0.2)
- Update test to match commented-out localization field
- Make McpbManifest (deprecated) point to McpbManifestDefault

This makes the codebase more maintainable by deriving types from DEFAULT_MANIFEST_VERSION instead of hardcoding version references.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-03 15:47:05 -08:00
Joan Xie
70c3615fc9
Add LATEST_MANIFEST_VERSION export (hardcoded to 0.3)
Export LATEST_MANIFEST_VERSION to indicate the maximum supported manifest version by the vAny schema. This allows clients to know what the highest version is that they can use.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-03 15:35:15 -08:00
Joan Xie
efe9e3345d
Make McpbManifest point to v0.2 for backwards compatibility
- Change McpbManifest type to point to v0.2 schema instead of McpbManifestAny
- Add DEFAULT_MANIFEST_VERSION export to browser.ts
- Update test fixtures to use manifest_version "0.2" when using McpbManifest type
- Keep @deprecated annotation directing users to McpbManifestAny for multi-version support

This maintains backwards compatibility for existing code using McpbManifest while encouraging new code to use McpbManifestAny for broader version support.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-03 15:33:31 -08:00
Joan Xie
30a3b8e779
Remove vLatest concept and associated files
Remove the concept of "vLatest" throughout the codebase to encourage use of McpbManifestAny which supports all manifest versions. Changes include:

- Delete src/schemas/latest.ts and src/schemas_loose/latest.ts
- Remove vLatest and latest-related exports from schema index files
- Remove McpbManifestLatest type, replace McpbManifest to point to McpbManifestAny
- Remove LATEST_MANIFEST_VERSION, LATEST_MANIFEST_SCHEMA constants
- Update all main export files (index.ts, cli.ts, node.ts) to export from 0.3.js instead of latest.js
- Update tests to use v0_3.McpbManifestSchema explicitly
- Add @deprecated annotation to McpbManifest directing users to McpbManifestAny

This encourages better version compatibility by using the union type that supports all manifest versions rather than assuming a single "latest" version.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-03 15:30:03 -08:00
Joan Xie
d7f76fc02d
Fix linting issues
- Remove unused McpbManifest import from config.ts
- Auto-fix formatting and import sorting

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-01 20:41:34 -07:00
Joan Xie
e7d6ea3e68
Fix type error in buildManifest return type
Changed return type to use the specific v0.2 manifest schema type since the
function returns a manifest with DEFAULT_MANIFEST_VERSION (0.2).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-01 20:38:05 -07:00
Joan Xie
7f40d5be42
rm McpbUserConfigValuesSchema export 2025-11-01 20:34:47 -07:00
Joan Xie
753f27e1ba
Revert yarn.lock to match main (zod 3.25.67)
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-01 20:31:26 -07:00
Joan Xie
3538bd4f3b
Bump version to 1.3.0
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-01 20:29:04 -07:00
Joan Xie
2d6dd39b3e
Merge remote-tracking branch 'origin/main' into feat/browser-export-versioned-schemas 2025-11-01 20:28:49 -07:00
Joan Xie
05187d7235
Remove zod resolution and bump version to 1.2.0
- Removed zod version resolution from package.json
- Bumped version from 1.1.5 to 1.2.0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-01 20:27:58 -07:00
Joan Xie
c137df512d
Remove validate utilities from browser exports
This removes the validateManifest utilities that were added to the browser bundle. These functions are not needed for the browser export.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-01 19:48:58 -07:00
Joan Xie
2d76201204
Export versioned schemas and validation utilities in browser bundle
- Update browser.ts to export validation utilities
- Export McpbManifestSchema for backwards compatibility
- Update config.ts to accept McpbManifestAny for broader manifest version support
- Add validate.ts with version-aware validation functions

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-01 16:34:02 -07:00
Joan Xie
5fb25a253e
add McpbManifestAny type 2025-11-01 15:46:37 -07:00
Joan Xie
86166630b4
revert: undo preprocessing changes to any.ts and types.ts
Reverts the preprocessing logic and type name changes to restore
the simpler union schema approach.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-01 15:37:15 -07:00
Joan Xie
f3ac79afda
update browser exports to incl. vAny schema 2025-11-01 15:27:38 -07:00