v0.2.0 — every rule reads TypeScript, and a pre-commit hook

Every rule reads TypeScript. JavaScript files are read. Nineteen of twenty-one rules ship a fixer. There is a pre-commit hook.

All of it contributed.

Install

pip install mcp-migrate==0.2.0

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/dheerajjha/mcp-migrate
    rev: v0.2.0
    hooks:
      - id: mcp-migrate

Why 0.2.0 and not 0.1.5

check --json no longer emits location. A finding carried "location": "server.py:12"; it now carries "path": "server.py" and "line": 12 separately. If you parse --json, this is the one thing here that will break you. The combined string forced consumers to re-parse something already structured, and it was ambiguous the moment a path contained a colon.

Pre-1.0, that is what a minor bump is for. The executable contract is schemas/check-json.schema.json.

Added

• All 21 rules read TypeScript, up from 17. R002 was the last holdout. The grade is still withheld — see #172, which is a decision, not a coverage gap.
• JavaScript source is loaded — .js/.jsx/.mjs/.cjs, routed through the TypeScript comment/string scanner. No rule reads into them yet (#149).
• Nine more fixers, taking the set from ten to nineteen. Only R010 and R015 lack one, and R015's absence is now a documented decision rather than a gap.
• A pre-commit hook, measured at 0.31–0.34s over 600 files.
• The docs are checked against the code. The cookbook index, the README rule table and every fixer's cookbook pointer are now asserted against all_rules()/all_fixers() — it caught two real drifts within an hour of landing.
• Static guards against two traps that had already bitten: a compiled regex flag dropped by passing only .pattern, and a rule declaring a language with no test exercising it.

Fixed

• fix --write could make check report a file clean without fixing it. R003's fixer wrote a placeholder "Mcp-Method": "<set-mcp-method>" when it couldn't recover the real value — source that compiles, runs, and sends that literal string as an HTTP header — and the rule then treated the fixer's own TODO comment as evidence the header was set. End to end: a real advisory became a broken header the tool reported as "Grade A. Nothing to fix."
• A JavaScript project could be reported as clean. Loading .js files put them in project.files, and "did we check anything" was bool(project.files) — so a pure-JS server with a live Mcp-Session-Id exited 0 with zero rules having run.
• Four rules fired on identifiers that merely started with an SDK name — PingRequester, SetLevelRequesterFactory, InitializeRequesterHelper, CreateMessageRequestBuilder.
• Four stale claims in check's own output, including telling JavaScript users that "mcp-migrate only reads Python today" months after every rule read TypeScript.

Full detail in CHANGELOG.md.

Contributors

@waterlemonnn, @IronLad123, @syf2211, @aryansk, @ankitverma31, @slegarraga, @ujjwalprakash17, @PuvaanRaaj.

@aryansk and @ankitverma31 are first-time contributors. @aryansk and @waterlemonnn independently found the JavaScript scanner gap 1.5 hours apart; @syf2211's R003 fixer and @waterlemonnn's arrived three days apart on the same issue. In both cases the second PR changed what the first one shipped.