MCP Rigor 1.0.0-rc.4

MCP Rigor 1.0.0-rc.4

Dependency hygiene release: npm install mcprigor now completes with zero deprecation warnings and 96 packages (down from ~230).

Changed

Excel data sources now use a built-in, zero-dependency XLSX reader (src/xlsx.ts) instead of exceljs:

• Reads worksheets resolved through workbook relationships: shared and inline strings, numbers, booleans, formula cached values, and date-styled serials (returned as ISO strings)
• Minimal ZIP reader on Node's built-in zlib, with decompressed-size and cell-count caps (zip-bomb protection) in addition to the existing 25 MiB and ZIP-signature preflights
• Removes the deprecated transitive chain users saw as npm warnings: inflight, rimraf@2, glob@7, fstream, lodash.isequal, uuid@8

Runtime dependencies are now exactly three: @modelcontextprotocol/sdk, ajv, yaml.

No user-facing behavior change: Data from "file.xlsx" and the excel provider work as before, including sheet selection and error codes (MCP-DATA-008/018/019).

Verification

• 21 test files / 82 tests passing — including new XLSX edge cases (XML entities, booleans, dates, formulas, sparse cells, missing sheet, non-XLSX rejection) against fixture files written by an independent implementation (exceljs, now dev-only)
• npm audit: 0 vulnerabilities
• Clean-install check: zero npm warnings, exceljs absent from the shipped tree

Install

npm install --save-dev mcprigor

Tarball SHA-256: 1e2026f9ad100c89b8be12f69dc28e5f1733a303aa7cca31a7b8065527eb31a1