v0.2.0 - corrected rules, tests, and a hosted demo

Download mcp-migration.skill below and install it in Claude, or try the hosted demo at
https://mcp-migration-check.alpaycelik.workers.dev

Not using Claude? The .skill file is a zip — unpack it and run scripts/mcpcheck.mjs with nothing but Node. Any agent that can run a shell command can use it.

Rules corrected

• All seven spec links were broken. They pointed at anchors like .../2026-07-28#lifecycle, but the specification is split across subpages and has no such anchors, so every link silently resolved to the overview page. All now point at verified subpages.
• MCP007 gave impossible advice. It told you to upgrade @modelcontextprotocol/sdk to ^2 and run a codemod. That package has never published a 2.x — v2 shipped on 2026-07-27 as a rename to @modelcontextprotocol/server and @modelcontextprotocol/client. The rule now keys on the presence of the v1 package and names the real replacements and the real codemod, npx @modelcontextprotocol/codemod@latest v1-to-v2 .
• MCP006 stopped producing false criticals. OAuth metadata discovery now follows the URL a server advertises in its WWW-Authenticate challenge (same-origin only), then both RFC 9728 locations.

Added

• 86 assertions over the engine, weighted toward the SSRF guard
• CI on every push: typecheck, tests, skill-bundle freshness, fixture output
• Hosted demo on Cloudflare Workers with an SSRF guard and rate limiting
• AGENTS.md for agents working in the repository

Fixed

• npm run pack:skill had never worked on Windows