v0.3.0 - npx, a GitHub Action, and verified citations

Three new ways to run the same checker. The rules themselves are unchanged apart
from MCP007's wording, so a report from v0.2.0 and a report from this one say the
same thing about the same server.

npx mcp-migration-check https://example.com/mcp   # probe a live endpoint
npx mcp-migration-check --source ./my-server      # scan a repository

Or in a workflow:

- uses: AlpayC/mcp-migration-check@v1
  with:
    source: .
    fail-on: critical

The hosted demo is unchanged at
https://mcp-migration-check.alpaycelik.workers.dev, and mcp-migration.skill
is attached below as before.

Added

• npm package. npx mcp-migration-check <url> — also pnpm dlx, yarn dlx
  and bunx. One generated file and a README, empty dependency tree. Exit codes
  are 0 clean, 1 at least one critical finding, 2 inconclusive, so it works
  as a CI gate on its own. Published from CI with provenance.
• GitHub Action. AlpayC/mcp-migration-check@v1. Composite, so there is no
  setup-node and no install step — the engine ships pre-bundled. Writes a graded
  table to the job summary and exposes grade, score, critical, warnings,
  findings and badge-url as step outputs. An endpoint that cannot be reached
  never fails the build: an outage is not the same claim as an unmigrated server.
• Ecosystem report. npm run report:ecosystem walks the official MCP registry,
  probes every remote endpoint and writes an aggregate snapshot — grade
  distribution, how often each rule fires, and how much of the registry answered
  at all. It counts servers rather than naming them.
• Dated citations. Every report now states when the rules were last verified
  against the spec, and a weekly job re-fetches each citation and opens an issue if
  a page stopped saying what the rule cites it for. A 200 does not prove a link is
  right — this project has the receipt for that.

Changed

• MCP007 names the package for your role. It used to say
  @modelcontextprotocol/server / @modelcontextprotocol/client, which reads like a
  path and is wrong for any single project. It now picks by role — /server for a
  server, /client for a client, both only when a project is genuinely both — and
  warns against adding /client reflexively.

Fixed

• A time-of-check/time-of-use gap in the source scan: it called stat on a path
  and then read that path separately, so the file measured need not be the file
  read. Both now go through one file handle.

Repository

CodeQL on every push and weekly, an automated release pipeline, Dependabot,
CONTRIBUTING.md, SECURITY.md and a code of conduct.

Full Changelog: v0.2.0...v0.2.1