MCP Risk Inventory v0.1.2

Patch release that makes npm the primary install path after registry publishing.

Install:

npm install -g mcp-risk-inventory
mcp-risk scan .

GitHub fallback:

npm install -g github:FoundagentTest/mcp-risk-inventory#v0.1.2
mcp-risk scan .

Changes:

• Publishes npm package mcp-risk-inventory@0.1.2 as the latest registry package. 0.1.1 was also published, and 0.1.2 refreshes the packaged README so npm is no longer described as pending.
• Updates README install copy so npm is the primary CTA and GitHub install is the fallback.
• Updates GitHub Action examples to FoundagentTest/mcp-risk-inventory@v0.1.2.
• Scanner behavior is unchanged from v0.1.1 except the reported version.

MCP Risk Inventory v0.1.1

Update 2026-07-09: npm publishing is complete. The latest release is v0.1.2, and the primary install path is now:

npm install -g mcp-risk-inventory
mcp-risk scan .

Use npm install -g github:FoundagentTest/mcp-risk-inventory#v0.1.2 only as a fallback.

---

Historical v0.1.1 changes:

• Adds a safe redacted-config/false-positive GitHub issue template.
• Adds compact client/config coverage near the install instructions.
• Adds a minimal GitHub Action workflow without SARIF alongside the full SARIF upload example.
• Updates the then-current GitHub install and action examples to v0.1.1.

v0.1.1 remains installable from npm, but v0.1.2 is the current release because it refreshes the packaged README and public install copy.

mcp-risk-inventory v0.1.0

Initial public release of MCP Risk Inventory.\n\n- Dependency-free Node 18 CLI with mcp-risk bin.\n- Composite GitHub Action for SARIF/CI scans.\n- Static checks for local MCP execution, unpinned package launchers, secret exposure, broad filesystem grants, remote endpoints, tool schema drift, and unknown registries.\n- npm package metadata is prepared, but npm registry publishing is pending npm credentials in the release environment.