npm Python analyzed 1.21.0

@n24q02m/mcp-core

v1.21.0

Shared foundation for building MCP servers -- Streamable HTTP transport, OAuth 2.1, browser-based credential setup, and a shared embedding daemon.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

code evidence v1.21.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 46

fs package/build/cli/build-cli.js :29 import { accessSync, constants, existsSync } from 'node:fs';
fs package/build/lifecycle/lock.js :26 import { existsSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
fs package/build/oauth/jwt-issuer.js :24 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
fs package/build/oauth/user-store.js :6 import { mkdirSync } from 'node:fs';
fs package/build/relay/browser.js :5 import { readFile } from 'node:fs/promises';
fs package/build/storage/atomic-write.js :1 import { open, rename, unlink } from 'node:fs/promises';
fs package/build/storage/backends.js :9 import { mkdir, readFile, unlink } from 'node:fs/promises';
fs package/build/storage/config-file.js :1 import { existsSync } from 'node:fs';
fs package/build/storage/machine-id.js :2 import { readFile } from 'node:fs/promises';
fs package/build/storage/per-plugin-store.js :18 import { mkdir, readFile } from 'node:fs/promises';
fs package/build/storage/session-lock.js :10 import { existsSync } from 'node:fs';
fs package/build/transport/cache.js :14 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
fs package/build/transport/local-server.js :17 import * as fs from 'node:fs';

shell package/build/relay/browser.js :4 import { execFile } from 'node:child_process';
shell package/build/storage/machine-id.js :1 import { execFile } from 'node:child_process';

net package/build/auth/credential-form.js :772 fetch(otpUrl(), { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) })
net package/build/auth/delegated-oauth-app.js :131 const r = await fetch('/setup-status');
net package/build/relay/client.js :28 const response = await fetch(`${relayBaseUrl}/api/sessions`, {
net package/build/storage/backends.js :104 const resp = await fetch(url, {
net package/build/transport/local-server.js :18 import { createServer } from 'node:http';

secrets package/build/auth/delegated-oauth-app.js :157 const jwtIssuer = options.jwtIssuer ?? new JWTIssuer(options.serverName, undefined, process.env.CREDENTIAL_SECRET ?? null);
secrets package/build/auth/local-oauth-app.js :101 const jwtIssuer = options.jwtIssuer ?? new JWTIssuer(options.serverName, undefined, process.env.CREDENTIAL_SECRET ?? null);
secrets package/build/storage/backends.js :164 return new CfKvBackend(baseUrl, process.env.MCP_KV_TOKEN);
secrets package/build/storage/per-plugin-store.js :54 const master = process.env.CREDENTIAL_SECRET;
secrets package/build/transport/local-server.js :53 const relayPassword = process.env.MCP_RELAY_PASSWORD ?? '';

db package/build/oauth/user-store.js :8 import Database from 'better-sqlite3';