MCP Rigor 1.0.0-rc.4

MCP Rigor 1.0.0-rc.4

Dependency hygiene release: npm install mcprigor now completes with zero deprecation warnings and 96 packages (down from ~230).

Changed

Excel data sources now use a built-in, zero-dependency XLSX reader (src/xlsx.ts) instead of exceljs:

• Reads worksheets resolved through workbook relationships: shared and inline strings, numbers, booleans, formula cached values, and date-styled serials (returned as ISO strings)
• Minimal ZIP reader on Node's built-in zlib, with decompressed-size and cell-count caps (zip-bomb protection) in addition to the existing 25 MiB and ZIP-signature preflights
• Removes the deprecated transitive chain users saw as npm warnings: inflight, rimraf@2, glob@7, fstream, lodash.isequal, uuid@8

Runtime dependencies are now exactly three: @modelcontextprotocol/sdk, ajv, yaml.

No user-facing behavior change: Data from "file.xlsx" and the excel provider work as before, including sheet selection and error codes (MCP-DATA-008/018/019).

Verification

• 21 test files / 82 tests passing — including new XLSX edge cases (XML entities, booleans, dates, formulas, sparse cells, missing sheet, non-XLSX rejection) against fixture files written by an independent implementation (exceljs, now dev-only)
• npm audit: 0 vulnerabilities
• Clean-install check: zero npm warnings, exceljs absent from the shipped tree

Install

npm install --save-dev mcprigor

Tarball SHA-256: 1e2026f9ad100c89b8be12f69dc28e5f1733a303aa7cca31a7b8065527eb31a1

MCP Rigor 1.0.0-rc.3

MCP Rigor 1.0.0-rc.3

Security hardening release for the plain-language flow-import resolver, responding to a supply-chain scan finding. Recommended for all users.

Security

Flow imports are now confined to the test-suite directory. Previously, Import flows from "..." accepted absolute paths, ../ traversal, and symlink targets outside the suite, allowing a crafted .mcpr file to read arbitrary local files into the compiled suite. Imports are now validated after path canonicalization, with new stable error codes:

• MCPLANG304 — absolute import paths rejected
• MCPLANG307 — imports resolving outside the suite directory rejected (covers .. traversal and symlink escapes)
• MCPLANG303 — recursion depth limited (8)
• MCPLANG305 — imported file size limited (1 MB)
• MCPLANG306 — import count limited (64)

No user-facing change for documented usage: relative in-suite imports (Import flows from "./shared-flows.mcpr") work exactly as before.

Verification

• 21 test files / 80 tests passing (2 new confinement regression tests)
• Full CI matrix green: Ubuntu / macOS / Windows × Node 20 / 22 + security suite
• npm audit: 0 vulnerabilities

Install

npm install --save-dev mcprigor

Tarball SHA-256: cd2899a856607bd3954a2d7d9ca0fe0cd1f6013787376b14b03f6ec7c7d788c4

MCP Rigor 1.0.0-rc.2

MCP Rigor 1.0.0-rc.2

Cross-platform fix release. Recommended for all users; 1.0.0-rc.1 had three platform-specific bugs found by the CI matrix.

Fixed

• Windows: QA workspace assets failed to load — URL.pathname produced invalid /D:/... paths; now uses fileURLToPath.
• Windows: missing stdio server command misclassified — reported MCP-INIT-001 Connection closed instead of MCP-SPAWN-001; a cross-platform PATH/PATHEXT preflight now classifies it correctly with an actionable message.
• Node 20: isolated extension workers failed to start when running from TypeScript sources (--import tsx does not reliably register loaders for worker threads); the built worker is now preferred.

Verification

• Full CI matrix green: Ubuntu / macOS / Windows × Node 20 / 22, security suite, and protocol-revision × transport compatibility jobs (0 failed jobs).
• 21 test files / 78 tests passing.
• npm audit: 0 vulnerabilities.

Install

npm install --save-dev mcprigor

Tarball SHA-256: 93182b7f9ce04a5aa647eb0f7edc75d145f2238b4cb9158ee127b0a0fb7ad36f

MCP Rigor 1.0.0-rc.1

MCP Rigor 1.0.0-rc.1

First public release candidate. Plain-language, deterministic, black-box testing for Model Context Protocol servers — funded and supported by LoopIQ, the AI-Native governance platform for software releases.

Install

npm install --save-dev mcprigor
npx mcprigor init tests/acceptance.mcpr
npx mcprigor test tests/acceptance.mcpr

No build from source required — the npm package ships compiled code.

Highlights

• Plain-language .mcpr tests with full YAML feature parity — no code, no AI interpretation
• stdio + Streamable HTTP transports, with transport-parity comparison
• Contract locks with SHA-256 fingerprints and classified drift detection (breaking / potentially breaking / non-breaking)
• Evidence bundles: sanitized traces, negotiated metadata, content fingerprints
• Semantic snapshots with path-level diffs, and safe allowlisted replay
• Data-driven tests: inline tables, CSV, JSON, YAML, Excel, REST, Google Sheets; typed columns, filters, joins, seeded sampling
• MCP-native coverage: notifications, subscriptions, progress, cancellation, log levels, pagination, tasks
• Guided no-code authoring against a live server
• Local browser QA workspace (loopback-only, CSRF-protected)
• Worker-isolated extension SDK with manifest permissions
• Stable error taxonomy — 14 categories with actionable QA explanations

Security posture

• npm audit: 0 vulnerabilities (production and dev)
• Centralized secret redaction (raw/percent/base64 variants), ANSI/OSC terminal sanitization
• SSRF protection for remote data (private-IP rejection, redirect caps, body limits)
• Hostile-input limits for YAML/CSV/XLSX parsing
• Remote data and custom code are opt-in (--allow-remote-data, --allow-custom-code)
• Dedicated security-hardening and lifecycle test suites run in CI

Verification

• 21 test files / 78 tests passing on Node 20/22 across Linux, macOS, Windows
• Compatibility matrix: MCP protocol revisions 2024-11-05 / 2025-03-26 / 2025-06-18 × stdio / Streamable HTTP

Links

• Website & docs: https://mcprigor.com
• npm: https://www.npmjs.com/package/mcprigor
• Tarball SHA-256: 98dfc9a8414f23b9c83c6d0aab6d67a5fbc3d4ca3e5fa812337b2ea7f326dc52

Release candidate: APIs may still receive minor changes before the final 1.0.