Plugin: mcp-sdk-security
Changelog
Release history and version updates for eslint-plugin-mcp-sdk-security
Generated from the release history
Built from this package's CHANGELOG.md at deploy time, so it matches the
version these docs describe. The full cross-package history lives on the
changelog.
1.0.1
- FixBound the parsed-module caches behind cross-file value following.
- Dependenciesupdated workspace dependencies:
@interlace/eslint-devkit@1.20.2
1.0.0
Breaking- Breaking1.0.0, stable MCP SDK security rules checked against real code
- Dependenciesupdated workspace dependencies:
@interlace/eslint-devkit@1.20.0
0.6.0
- Fixfollow tool arguments into built commands and $ templates, read imported descriptions and schemas
- Featureadd 11 rules for the vulnerability classes the plugin could not detect
0.5.0
- Fixsupport SDK v2 and mcp-handler, resolve sinks by module, fix schema-less tool FPs, reset presets
0.4.3
- FixThe README logo now links to the plugin's own documentation.
0.4.2
- Fix
server['registerTool'](…)registers the same tool - Fix
server['registerTool']registers the same tool as.registerTool - Dependenciesupdated workspace dependencies:
@interlace/eslint-devkit@1.19.0
0.4.1
- FixAdd an install-size badge to the README prelude, linking to each package's packagephobia page. npm renders the README from the last publish, so a badge only appears on npmjs.com after a release.
- Dependenciesupdated workspace dependencies:
@interlace/eslint-devkit@1.18.2
0.4.0
- Feature🐛 Fix — a template literal is a string, in 82 rules that disagreed
- Dependenciesupdated workspace dependencies:
@interlace/eslint-devkit@1.18.0
0.3.1
- Docsthe four AI-security plugins are documented on the site at last
- Dependenciesupdated workspace dependencies:
@interlace/eslint-devkit@1.17.3
0.3.0
- Every rule now runs on files that load the MCP SDK by
require,import =or #548 - DependenciesUpdated internal dependencies
0.2.2
- Correct the declared ESLint floor:
^8.0.0→^8.40.0. #407 - DependenciesUpdated internal dependencies
0.2.1
- Ship the JavaScript without tsc's layout. #411
- DependenciesUpdated internal dependencies
0.2.0
0.1.1
- Complete the logo row across every published package. #377
- Fix the
./oxlintsubpath export, which pointed atsrc/oxlint.js— a file no build produces.require('<package>/oxlint')threw MODULE_NOT_FOUND on every published package, while every README documented that exact wiring for oxlint'sjsPlugins. The export now points at the build output,dist/src/oxlint.js. #335 - Fix SDK peer declarations that npm silently ignored #335
- DependenciesUpdated internal dependencies
0.1.0
- AI SDK security family + fix the broken oxlint export (#335) (47cde07f) — 2026-08-04
- complete the logo row across every published package (#377) (85e57a7c) — 2026-08-04
Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.