What is wanted
Stop hardcoding the CLI version string, and read it from package.json instead.
The problem
src/cli.ts line 15:
package.json line 3 says:
They have already drifted. mcp-audit --version and the header line of usage() (line 46, mcp-audit v${VERSION}) both report a version that is not the one published to npm as @royalpinto007/mcp-audit.
Why it matters
The version is the first thing anyone pastes into a bug report. If it is wrong, every reproduction attempt starts from the wrong tree. It will also drift again on the next release, because nothing links the two numbers.
Steps
- In
src/cli.ts, read the version from package.json at runtime rather than duplicating it. The package is ESM ("type": "module" in package.json), so createRequire(import.meta.url) from node:module is the straightforward approach, wrapped in a try/catch that falls back to a placeholder. There is a working example of exactly this pattern in a sibling project if you want a reference shape, but the three-line version is fine.
- Mind the path. The binary ships as
dist/cli.js (see the bin field in package.json), so the resolved path from the built file is ../package.json, not ../../package.json. Verify with npm run build && node dist/cli.js --version.
- Confirm
"files": ["dist", "README.md", "LICENSE"] still results in a working install; package.json itself is always included by npm, so this is safe.
- Note that
mcp-audit --version on its own is separately broken and is tracked in another issue. Test with node dist/cli.js rules --version or fix on top of that one.
Under an hour, no new dependencies. Comment below to claim it and I will usually reply within a day.
What is wanted
Stop hardcoding the CLI version string, and read it from
package.jsoninstead.The problem
src/cli.tsline 15:package.jsonline 3 says:They have already drifted.
mcp-audit --versionand the header line ofusage()(line 46,mcp-audit v${VERSION}) both report a version that is not the one published to npm as@royalpinto007/mcp-audit.Why it matters
The version is the first thing anyone pastes into a bug report. If it is wrong, every reproduction attempt starts from the wrong tree. It will also drift again on the next release, because nothing links the two numbers.
Steps
src/cli.ts, read the version frompackage.jsonat runtime rather than duplicating it. The package is ESM ("type": "module"inpackage.json), socreateRequire(import.meta.url)fromnode:moduleis the straightforward approach, wrapped in a try/catch that falls back to a placeholder. There is a working example of exactly this pattern in a sibling project if you want a reference shape, but the three-line version is fine.dist/cli.js(see thebinfield inpackage.json), so the resolved path from the built file is../package.json, not../../package.json. Verify withnpm run build && node dist/cli.js --version."files": ["dist", "README.md", "LICENSE"]still results in a working install;package.jsonitself is always included by npm, so this is safe.mcp-audit --versionon its own is separately broken and is tracked in another issue. Test withnode dist/cli.js rules --versionor fix on top of that one.Under an hour, no new dependencies. Comment below to claim it and I will usually reply within a day.