v0.4.0 feat: mcpm outdated, encrypted secrets, publish pipeline#6
Merged
Conversation
mcpm outdated
- New command: shows installed servers with version updates or trust regressions
- Shared checkVersionDrift() with mcpm update (no duplicate logic)
- Normalises semver pre* release types; trust level from score.level (not inline threshold)
- Always bypasses cache for fresh results; --json output
Encrypted secrets store
- New src/store/keychain.ts: AES-GCM + PBKDF2 (600k iterations, per-value salt)
- Zero native deps (no keytar/node-gyp); importKey cached per-process
- toPlaceholder/parsePlaceholder for config file references
- Input validation: server and key names must match [a-zA-Z0-9._-]
mcpm publish
- New command group: scaffold (interactive wizard), check (dry-run), submit
- Trust gate: blocks on critical/high findings via shared assertTrustGate()
- Graceful 404/405: shows "API not yet available" when registry endpoint missing
- Token from GITHUB_TOKEN/MCPM_TOKEN env only — never from CLI flags
- ANSI stripping on scanner finding messages in error output
Telemetry (default off)
- Queue + anonymize: strips server names; errorCode allowlisted [A-Z_]{1,64}
- Respects MCPM_NO_TRACK=1 and DO_NOT_TRACK=1
servers.ts
- Added trustScore?: number to InstalledServer for drift detection
- Schema v2: writes { mcpmSchemaVersion: 2, servers: [...] }
- Backward-compatible: reads legacy bare-array format transparently
The project's original decision log (2026-03-28) documented exactly this: 'Trust paradox: security tool shouldn't track users at launch.' README line 236 makes an unconditional claim. Shipping a telemetry queue, even disabled, breaks that promise. Revisit after registry network effect is established and users have reason to trust the tool.
- Bump package.json to 0.4.0 - Update banner-light.svg and banner-dark.svg to v0.4.0 - Add CHANGELOG.md with 0.4.0 entry - Add new commands (outdated, secrets, publish) to README commands table - Fix prerelease semver producing invalid versionChange in mcpm outdated - Fix console.log → stdoutOutput in publish scaffold action - Persist trustScore in install.ts so mcpm outdated trust regression is live
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New capabilities in v0.4.0:
mcpm outdated— Version drift + trust regression detection--jsonflag for machine-readable outputEncrypted secrets store —
src/store/keychain.tscrypto.subtlemcpm:keychain:server/KEYfor MCP config injectionmcpm publish— Registry submission pipelinemcpm publish scaffold— 5-prompt interactive wizard to create.mcpm-publish.yamlmcpm publish check— pre-flight trust gate (blocks on critical/high findings)mcpm publish— submit to official registry (graceful fallback until API exists)ServersFile schema v2 —
{ mcpmSchemaVersion: 2, servers: [...] }with backward-compatible v1 migrationInfra: Dropped telemetry (contradicts README's "No telemetry. No analytics. No account required." guarantee)
Pre-Landing Review
4 findings reviewed:
semver.diff()returning "prerelease") produced invalidversionChangevalue — added VALID_CHANGES set with "unknown" fallbackconsole.login scaffold action replaced withstdoutOutputfor consistencytrustScorenot persisted at install time — added tostoreEntryininstall.ts, trust regression detection is now live--registryURL validation — low risk (CLI threat model), deferred to follow-upPR Quality Score: 8/10
Test Coverage
82% of new code paths covered (above 80% target). 883 tests pass.
Key gaps (safe to defer):
registry/publish-client.ts— only exercised via mocks; real network paths untestedcommands/publish/manifest.ts— YAML parse error and ENOENT paths not directly testedmcpm outdated(cosmetic)Test plan
npm run build)🤖 Generated with Claude Code