v0.2.3

✨ npx mcp-sso init

Scaffolds a working zero-setup MCP server into a new directory:

npx mcp-sso init my-server && cd my-server && npm install && npm start
# → prints a one-time code; pair with: claude mcp add --transport http my-bridge http://127.0.0.1:3000/mcp

Generates package.json (exact-pinned deps, Node ≥24), server.ts (the recommended Origin-gate + console-pairing composition root), .gitignore, .npmrc (ignore-scripts=true), README.md. The bin is dep-free (node builtins only); fail-closed filesystem trust (atomic O_NOFOLLOW|O_EXCL|O_CREAT writes; target dir + ancestor chain validated no-follow).

Consumer-facing exports

NormRequest, NormResponse, assertCallbackPath, ensureStateDir (atomic — not the raw ensureGitignore), assertRealDir are now root-exported from mcp-sso — so a package consumer replicating the recommended patterns imports them instead of reimplementing them.

Fixes

• destroySoon test-isolation flake (#66) — SDK /mcp calls in 3 test files switched from the inject-mock socket to a real loopback socket (the root cause, gone by construction).
• CodeQL ReDoS hardening (#65) — two js/polynomial-redos regexes restructured; 15 js/missing-rate-limiting alerts triaged as false positives (the bridge rate-limits register/token via RateLimitPort/Bridge.guard).

Infrastructure

• Renovate for github-actions updates — minimumReleaseAge: 15 days auto-enforced (the floor Dependabot can't do natively). Install the Renovate app to activate.
• gitignore session-artifact dirs.

---

Full changelog: v0.2.2...v0.2.3