arabold/docs-mcp-server

Dependencies

100 dependencies, 1 flagged: playwright

All four hints declared on every tool

10/10 tools missing one or more hints — scrape_docs (missing: readOnlyHint, idempotentHint); refresh_version (missing: readOnlyHint, idempotentHint); search_docs (missing: idempotentHint, openWorldHint), +7 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

9/10 tool handlers declare input schemas (90%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool test coverage

3/10 tools referenced in tests (30%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

1 child_process/subprocess call in production code — runs shell commands (src/cli/utils.ts:94)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

No arbitrary install scripts

Has postinstall/preinstall script — runs arbitrary code on npm install

Remove postinstall/preinstall hooks unless they’re essential.

Production dependencies are patched

1 critical, 8 high severity in production deps — tar@7.4.3 (critical), @fastify/static@10.1.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dependency freshness

5/63 production deps abandoned (no release in 2+ years): gray-matter@2023-07-12 (3.1y), remark-html@2023-11-20 (2.7y), remark-parse@2023-11-20 (2.7y)