v1.2.0 — Security Hardening & Programmatic API

Security

• Path traversal protection in MCP tools — dir and output arguments are validated
• Package name validation — npm naming rules enforced (regex + 214-char limit)
• HTML reporter XSS — metric values escaped with escapeHtml() (defense-in-depth)
• GitHub URL validation — owner/repo format checked before API calls
• Funding collector — GitHub Sponsors username validated before URL construction

New Features

• Programmatic API — import { scan, checkPackage } from 'dep-oracle' now works as documented
• 3 new MCP tools — dep_oracle_typosquat_check, dep_oracle_compare, dep_oracle_report (8 tools total)
• GitHub Action — now builds correctly as a self-contained bundle via tsup
• server.json — included in npm package for MCP registry compatibility

Fixes

• Collector timeout (30s) prevents indefinite hang on slow/unresponsive APIs
• Trust score weight validation — custom weights must sum to 1.0
• Patch bonus logic — only applies when vulnerabilities exist and patches are within 30 days
• Python parser — #egg= fragments in git URLs no longer stripped by comment removal
• Typosquat detection — homoglyph analysis expanded to catch 2-character substitutions
• Cache error handling — distinguishes JSON corruption from unexpected I/O errors

Status

Platform	Version	Status
npm	1.1.4 (1.2.0 ready to publish)	npmjs.com/package/dep-oracle
GitHub	1.2.0	This release
MCP Registry	Active	modelcontextprotocol.io/registry

Install

npx dep-oracle
# or
npm install -g dep-oracle

Programmatic API

import { scan, checkPackage } from 'dep-oracle';

const report = await scan({ dir: './my-project' });
console.log(report.overallScore);

const result = await checkPackage('express');
console.log(result.trustScore);

Claude Code Integration

{
  "mcpServers": {
    "dep-oracle": {
      "command": "npx",
      "args": ["dep-oracle", "mcp"]
    }
  }
}

Full Changelog: v1.1.4...v1.2.0