v0.12.1 — Recall corpus: MCP013 checked against published CVEs and refactors

MCP013 recall is now measured against real published CVEs and harmless refactors of them, not only our own fixtures. npm run corpus runs six MCP command-injection CVE pairs (the vulnerable commit must fire, the fix commit must stay clean), 18 recall mutations, 17 guard mutations, and a 26-server clean set that must stay silent. All pass, and the corpus is reproducible from pinned SHAs with no vendored source (see docs/Corpus.md).

One detection change: MCP013/MCP014 helper-chain taint now follows up to five calls (was four), so an extra harmless wrapper no longer hides a real finding. No new findings in the safe fixtures, the clean set, or the real-world regression scan. The corpus is dev tooling and is not shipped in the npm package.

What's Changed

• feat: add logo assets and update version to 0.2.0 in package files by @akanthed in #43
• 0.12.1: recall corpus + MCP013 hop limit 5 by @akanthed in #51

Full Changelog: v0.12.0...v0.12.1