Convert the project to use Node.js type stripping #4

bcomnes · 2025-06-27T23:27:21Z

Kind of a bigish change, but in general should simplify the workflow by removing the dev-time build step. No reason not to start using this flow sooner than later.

Everything runs directly with node on Node 23 or later or node --experimental-strip-types on Node 22. The flag is getting dropped soon as well. All the scripts and shebangs have been updated to include this as well. It's a noop in Node 23 or later.

When working in the repo, you just run .ts files.
When publishing to npm or GitHub releases, you run the build step, pack the module, ship it somewhere, then run npm run clean which cleans out the declaration files and js files.
I also swapped : for - when not using run-s groupings
I kept build-dtx separate from the main build. It runs the main build first because I presume that needs built .js assets.
I added a test action, and converted one of the debug scripts to a node test runner test that runs in CI. I added a socket API token to the test environment.

Ill add in-line comments as well.

socket-security · 2025-06-27T23:27:38Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@anthropic-ai/dxt@0.1.0
@types/node@22.15.19 ⏵ 22.15.33	⁺¹	⁺¹
c8@10.1.3
npm-run-all2@8.0.4
zod@3.25.3 ⏵ 3.25.67		⁺²⁶
@modelcontextprotocol/sdk@1.11.4 ⏵ 1.13.2	⁺¹		⁺¹

View full report

socket-security-staging · 2025-06-27T23:28:14Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@anthropic-ai/dxt@0.1.0
@types/node@22.15.19 ⏵ 22.15.33	⁺¹	⁺¹	⁺¹
c8@10.1.3
npm-run-all2@8.0.4
zod@3.25.3 ⏵ 3.25.67		⁺²⁶
@modelcontextprotocol/sdk@1.11.4 ⏵ 1.13.2	⁺¹

View full report

socket-security-staging · 2025-06-27T23:28:15Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click for details)
Warn		`@anthropic-ai/dxt@0.1.0` is an Unpopular package. Location: Package overview From: package-lock.json → `npm/@anthropic-ai/dxt@0.1.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@anthropic-ai/dxt@0.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

bcomnes · 2025-06-27T23:30:45Z

DEBUG.md

@@ -23,7 +24,7 @@ The `mock-client` directory contains debug clients for testing the Socket MCP se
 Direct stdio communication using JSON-RPC protocol:

 ```bash
-npm run debug:stdio
+npm run debug-stdio


I switched to - instead of : to disambiguate npm scripts that are run with globs and those just grouped together that don't run together.

bcomnes · 2025-06-27T23:31:22Z

Dockerfile

-
-# Build the application
-RUN npm run build
+COPY . .


This is so that as the project grows you don't have to constantly update a file list. You are free to change this if you prefer.

bcomnes · 2025-06-27T23:31:35Z

Dockerfile

Don't need to build in production either!

bcomnes · 2025-06-27T23:32:13Z

index.ts

@@ -1,22 +1,20 @@
-#!/usr/bin/env node
+#!/usr/bin/env node --experimental-strip-types


Had to add a flag to the shebang.

bcomnes · 2025-06-27T23:33:18Z

mock-client/http-client.ts

@@ -1,11 +1,11 @@
-#!/usr/bin/env node
-import fetch from 'node-fetch';


Node has built in fetch now!

bcomnes · 2025-06-27T23:33:29Z

mock-client/http-client.ts

@@ -20,9 +20,9 @@ async function parseResponse(response: any) {

 // Simple HTTP client for testing MCP server in HTTP mode
 async function testHTTPMode() {
-  const baseUrl = (process.env.MCP_URL || 'http://localhost:3000').replace(/\/$/, ''); // Remove trailing slash
+  const baseUrl = (process.env['MCP_URL'] || 'http://localhost:3000').replace(/\/$/, ''); // Remove trailing slash


Typescript forced this.

bcomnes · 2025-06-27T23:34:09Z

mock-client/stdio-client.ts


 async function main() {
+  const serverPath = join(import.meta.dirname, '..', 'index.ts');


Lets use __dirname instead of cwd resolutions.

bcomnes · 2025-06-27T23:34:29Z

package.json

+  },
+  "engines": {
+    "node": ">=22.0.0",
+    "npm": ">= 10"


Added an engines field.

bcomnes · 2025-06-27T23:34:49Z

package.json

-    "debug:http": "node ./build/mock-client/http-client.js",
-    "server:stdio": "SOCKET_API_KEY=${SOCKET_API_KEY} ./build/index.js",
-    "server:http": "MCP_HTTP_MODE=true SOCKET_API_KEY=${SOCKET_API_KEY} ./build/index.js"
+    "prepublishOnly": "npm run build",


When you publish, this will auto-build.

bcomnes · 2025-06-27T23:35:04Z

package.json

-    "server:stdio": "SOCKET_API_KEY=${SOCKET_API_KEY} ./build/index.js",
-    "server:http": "MCP_HTTP_MODE=true SOCKET_API_KEY=${SOCKET_API_KEY} ./build/index.js"
+    "prepublishOnly": "npm run build",
+    "postpublish": "npm run clean",


When the publish is over, it cleans up.

bcomnes · 2025-06-27T23:35:30Z

package.json

-    "server:http": "MCP_HTTP_MODE=true SOCKET_API_KEY=${SOCKET_API_KEY} ./build/index.js"
+    "prepublishOnly": "npm run build",
+    "postpublish": "npm run clean",
+    "test": "run-s test:*",


Added the test lifecycle, with type checking and the node test runner with coverage.

bcomnes · 2025-06-27T23:35:58Z

package.json

+    "build": "npm run clean && run-s build:*",
+    "build:types": "tsc -p tsconfig.declaration.json",
+    "build:permissions": "chmod +x ./index.js && (chmod +x ./mock-client/*.js 2>/dev/null || true)",
+    "build-dtx": "run-s build build-dtx:dtx-pack",


I kept the build-dtx command out of the main build step, because it seems like something that is done by hand?

bcomnes · 2025-06-27T23:37:00Z

package.json

+    "index.d.ts",
+    "index.d.ts.map",
+    "mock-client/**/*.js",
+    "mock-client/**/*.d.ts*"


Alternatively we could just leave everything in a src folder.

bcomnes · 2025-06-27T23:37:49Z

scripts/clean.sh

@@ -0,0 +1,171 @@
+#!/bin/bash


This cleans up declarations and emitted .js files. This keeps your working directory clean of any publish time assets.

bcomnes · 2025-06-27T23:38:12Z

test.ts

@@ -0,0 +1,64 @@
+#!/usr/bin/env node


I ported the stdout debug script to a test environment.

bcomnes · 2025-06-27T23:38:29Z

tsconfig.declaration.json

@@ -0,0 +1,16 @@
+{


This is used during publishing only.

bcomnes · 2025-06-27T23:46:15Z

Followup: #5

bcomnes force-pushed the bret/type-stripping branch from 3628f19 to 7cca8ed Compare June 27, 2025 23:27

bcomnes force-pushed the bret/type-stripping branch from 7cca8ed to 372f99a Compare June 27, 2025 23:28