cli/package.json at main · getmcpm/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
{
  "name": "@getmcpm/cli",
  "version": "0.15.0",
  "mcpName": "io.github.getmcpm/cli",
  "description": "MCP security guard and package manager: block prompt injection, tool poisoning and rug-pulls in Model Context Protocol servers at runtime; trust-scored installs for Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI.",
  "type": "module",
  "bin": {
    "mcpm": "./dist/index.js"
  },
  "main": "./dist/index.js",
  "files": [
    "dist"
  ],
  "scripts": {
    "build": "tsup",
    "dev": "tsup --watch",
    "test": "vitest run",
    "test:watch": "vitest",
    "test:coverage": "vitest run --coverage",
    "lint": "pnpm run typecheck",
    "typecheck": "tsc --noEmit && tsc -p tsconfig.tooling.json",
    "clean": "rm -rf dist coverage",
    "dogfood:confine": "pnpm build && bash scripts/dogfood-confine.sh",
    "dogfood:release": "bash scripts/dogfood-release.sh",
    "prepublishOnly": "npm run build"
  },
  "keywords": [
    "mcp",
    "model-context-protocol",
    "mcp-security",
    "mcp-server",
    "package-manager",
    "cli",
    "security",
    "prompt-injection",
    "tool-poisoning",
    "llm-security",
    "ai-agents",
    "supply-chain-security",
    "sigstore",
    "claude",
    "claude-code",
    "cursor",
    "vscode",
    "windsurf",
    "gemini-cli"
  ],
  "author": "",
  "license": "MIT",
  "publishConfig": {
    "access": "public"
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/getmcpm/cli"
  },
  "engines": {
    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
  },
  "pnpm": {
    "overrides": {
      "vite": "8.3.5",
      "hono": "^4.13.14",
      "@hono/node-server": "^2.1.5",
      "fast-uri": "^3.1.8",
      "qs": "^6.17.1",
      "postcss": "^8.5.18",
      "ip-address": "^10.5.1",
      "esbuild": "^0.28.1",
      "body-parser": "^2.3.0"
    }
  },
  "dependencies": {
    "@inquirer/prompts": "^8.7.5",
    "@modelcontextprotocol/sdk": "^1.32.2",
    "@modelcontextprotocol/server": "^2.4.0",
    "@sigstore/bundle": "^5.0.0",
    "@sigstore/protobuf-specs": "^0.5.2",
    "@sigstore/verify": "^4.1.2",
    "@types/proper-lockfile": "^4.1.4",
    "chalk": "^6.0.0",
    "cli-table3": "^0.6.5",
    "commander": "^15.0.0",
    "jsonc-parser": "^3.3.1",
    "ora": "^9.4.0",
    "proper-lockfile": "^4.1.2",
    "semver": "^7.8.1",
    "yaml": "^2.9.1",
    "zod": "^4.6.5"
  },
  "devDependencies": {
    "@modelcontextprotocol/client": "^2.4.0",
    "@types/node": "^22.20.3",
    "@types/semver": "^7.8.0",
    "@vitest/coverage-v8": "^5.0.1",
    "fast-check": "^4.10.2",
    "tsup": "^9.0.0",
    "typescript": "^5.9.3",
    "vitest": "^5.0.1"
  }
}