fix(scanner): npx resolver prefers real package source over tools.json stub (MCP-2397)#661
Merged
Merged
Conversation
Deploying mcpproxy-docs with
|
| Latest commit: |
1849c9e
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://2c4b3f55.mcpproxy-docs.pages.dev |
| Branch Preview URL: | https://fix-mcp-2397-npx-resolver-st.mcpproxy-docs.pages.dev |
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
…n stub The npx cache can hold the same package under multiple hashes: one with the real installed source (package.json + dist/*.js) and another with only a tools.json stub that mcpproxy writes when dumping tool definitions. The stub's mtime is usually newer, so resolveNpxCache's newest-mtime heuristic picked it and the scan reported false coverage (1 stub file instead of ~30 real files). Rank candidates by real-source-ness first (package.json, a dist/lib/build/src subdir, or a JS/TS file at the root), falling back to the newest-mtime tiebreak only within the same class. When EVERY candidate is a bare stub, return an error instead of the stub so the published-source fetch fallback added in MCP-2206 (#658) fetches the real source — rather than short-circuiting it with false 1-file coverage. Related MCP-2397 Co-Authored-By: Paperclip <noreply@paperclip.ing>
Dumbris
force-pushed
the
fix/mcp-2397-npx-resolver-stub
branch
from
f730e70 to
1849c9e
Compare
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 27501795447 --repo smart-mcp-proxy/mcpproxy-go
|
![mcpproxy-gatekeeper[bot]](https://avatars.githubusercontent.com/u/216428285?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem (MCP-2397)
An npx server resolved to
~/.npm/_npx/<hash>/.../server-everythingcontaining only atools.jsonstub (3.7 KB), while the real source (~/.npm/_npx/<otherhash>/.../dist/*.js, ~30 files) was never scanned → false coverage ("1 file scanned").Root cause:
resolveNpxCacheselected the candidate by newest directory mtime. The same package name exists under multiple npx cache hashes; thetools.jsonstub (written by mcpproxy itself when dumping tool definitions) has a newer mtime than the real installed source, so the stub won.Reproduced locally — two cache dirs for
@modelcontextprotocol/server-everything:5b2dd62b…/…/server-everything→ 46 files,package.json+dist/(real)test123/…/server-everything→ 1 file (tools.json), newer mtime → was being pickedFix
Rank candidates by real-source-ness first, falling back to the newest-mtime tiebreak only within the same class:
package.json(canonical npm marker), or adist/lib/build/srcsubdir, or any.js/.mjs/.cjs/.tsfile at its root.Warnso the incomplete-coverage case is visible in logs.Tests
TestResolveNpxCachePrefersRealSourceOverStub(TDD): two hashes, stub forced strictly newer viaos.Chtimes→ asserts the real source dir is chosen. Fails on old code, passes on new.TestResolveNpxCache/…NotFound/ npx filesystem-arg tests still green.go test ./internal/security/... -racegreen;golangci-lint(CI config) 0 issues.Relation to #658
Distinct and complementary. #658 (
MCP-2206, still open) adds a published-source fetch fallback when no local source is found. This PR fixes the local-cache selection that found a stub and used it instead of the better local candidate. No overlap in the changed code path (selection logic vs. new fetch fallback); will re-verify interaction once #658 merges.