v0.8.0 — Windows crash fix, chalk removed

Windows crash. The probe CLI called process.exit(code) the instant it resolved, while undici's keep-alive sockets and the AbortSignal.timeout timer were still closing. On windows-latest that trips a libuv assertion (!(handle->flags & UV_HANDLE_CLOSING)) and the process dies with 0xC0000409 instead of its real exit code. Now sets process.exitCode and lets the loop drain, with an unref'd 2s fallback so a lingering socket can never hang CI.

chalk removed. chalk 5+ is ESM-only and this package compiles to CommonJS, so import chalk failed to typecheck and require('chalk') only resolved on newer Node. Replaced with a ~70-line local ANSI helper — identical output, one less dependency, no call site changed.

engines raised to >=22 to match what CI actually tests. moduleResolution: node10 and ts-morph still block TypeScript 7; ts7-compat-guard reports both.

v0.6.0

@booyaka/mcp-vet@0.6.0 — the full 2026-07-28 compliance suite. mcp-vet probe --spec-version 2026-07-28 now covers all three breaking server-behavior changes in the RC, not just the removed handshake.

Added

• missing-server-discover (ERROR) — calls the server/discover RPC every 2026-07-28 server MUST implement (SEP-2575, replaces the removed initialize handshake) and flags an error/hang/missing-capabilities answer.
• legacy-resource-error-code (ERROR) — flags a server still answering -32002 instead of the JSON-RPC standard -32602 for invalid resource params (-32601 no-resources servers are skipped).
• mcp-vet run — alias for mcp-vet probe.

v0.5.0 — the runtime-probe release

The static scan proves legacy patterns are absent from your source. mcp-vet probe proves your running server actually speaks the 2026-07-28 wire contract — the runtime half the tool was previously honest about not covering.

• mcp-vet probe [options] <url | command...> — connects to a running MCP server over stdio (a command it spawns) or Streamable HTTP (a URL) and checks the two 2026-07-28 violations that only exist at runtime:
  • requires-initialize-handshake — sends a stateless first request (capabilities in per-request _meta, no handshake); if the server rejects/hangs, 2026-07-28 clients won't be able to talk to it.
  • json-schema-dialect — inspects live tools/list schemas for draft-07 forms that aren't valid JSON Schema 2020-12.
• Dual-version aware — --spec-version 2025-11-25 (default) checks the current path; --spec-version 2026-07-28 checks the new one, so you can keep both in your rollout matrix.
• CI-safe exit codes — 0 clean, 1 runtime violation found, 2 couldn't connect.
• Runtime rules join the SARIF driver metadata; new test/probe-fixtures/ real servers back 18 new tests (55 total, all passing).

The default mcp-vet . scan stays fully local and network-free — probe is the one command that talks to a server, and only the one you point it at.

npx @booyaka/mcp-vet .                        # static scan (local)
npx @booyaka/mcp-vet probe node ./server.js   # runtime probe (opt-in)

v0.4.0 — the community-feedback release

Every change traces to reader feedback on the launch post.

• Client-side session detection — flags client transports built with a real sessionId / session_id and reads of transport.sessionId; sessionId: undefined / session_id=None are recognized as migrated. A client that still owns a session breaks against a stateless server even when the server scans clean.
• Aliased-import resolution — import { X as Y } (TS) and from m import X as Y (Python) now flag both the import and every usage site.
• Adversarial regression suite — caught/ and missed/ fixtures lock in both the detection wins and the documented misses so the claims can't rot.
• mcp-vet fixtures [dir] — nine protocol-level conformance fixtures + CHECKLIST.md (discover, per-request _meta, routing headers, stateless auth, task handles, duplicate/retry delivery, tools/list cache invalidation, downgrade/refusal) to pair the static scan with a runtime check.
• BENCHMARK.md — pinned corpus SHAs, 447 files / ~44k LOC, every finding hand-labeled: 104/105 true positives, 1 false positive (0.95%), with labeled negatives and a recall discussion. README updated to the measured numbers.
• Docs — July 28 is a spec release, not a remote kill switch; added a dual-version (2025-11-25 + 2026-07-28) rollout matrix and a post-scan notice.

Tests: 30 → 37, all passing.

Install: npx @booyaka/mcp-vet .

v0.3.0 — completeness release

Full 2026-07-28 detection coverage, a real migration path, and a programmatic API.

Detection — now 9 rules: adds tasks/list and tasks/result removals, the deprecated-capability method strings (sampling/createMessage, roots/list, logging/setLevel, …), SDK schema-constant and capability-constructor registration (setRequestHandler(InitializeRequestSchema, …), ClientCapabilities(roots=RootsCapability())), and value-aware sessionIdGenerator. Validated against the official reference servers — 0 false positives.

Tooling — --fix (with --dry-run preview) for the mechanical -32002 → -32602 rewrite; --json stdout; a typed programmatic API (import { scan } from '@booyaka/mcp-vet'); config JSON Schema; and a "needs manual review" reminder for changes static analysis can't catch.

Fixes — --fix no longer corrupts a -32002 inside a string on multibyte Python lines, and no longer reports success on a failed write; CLI --disable now applies on top of a config only.

npx @booyaka/mcp-vet .

See CHANGELOG.md.

mcp-vet v0.2.0

Zero-config CLI that scans MCP server source (TypeScript, JavaScript, Python) for the 7 patterns broken or deprecated by the 2026-07-28 Model Context Protocol spec — sessions / Mcp-Session-Id, the initialize handshake, the -32002 error code, legacy Tasks methods, and the roots / sampling / logging capabilities.

npx mcp-vet .

Highlights: confidence scoring (--min-confidence), SARIF 2.1.0 output for GitHub code scanning, inline suppression, config file, and CI-ready exit codes. Local-only — no account, API key, or network calls.

Validated against the official MCP TypeScript SDK's own example servers: 4 true findings, 0 false positives.

See CHANGELOG.md for the full list.