Prevent MCP registration from launching the wrong npm package - #315
Open
bensandler-stripe wants to merge 5 commits into
Open
Prevent MCP registration from launching the wrong npm package#315bensandler-stripe wants to merge 5 commits into
bensandler-stripe wants to merge 5 commits into
Conversation
- Incur confuses the link-cli executable with its npm package, generating npx link-cli --mcp instead of @stripe/link-cli and potentially inheriting package references from project metadata. - Set the default MCP command from the trusted package name and version embedded at build time. - Add an isolated registration regression test and repair guidance for existing MCP registrations. - Leave the separate unsafe skills suggestion path for the upstream Incur follow-up. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
bensandler-stripe
marked this pull request as ready for review
September 10, 2026 21:46
- Hardcoded npx broke MCP registration in Bun- and pnpm-only environments. - Mirror Incur runner precedence while retaining the scoped, versioned Link CLI package. - Replace the subprocess regression test with compact npm, pnpm, Bun, and precedence coverage. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
- Use a local resolved hints variable to avoid reassigning the function parameter. - Preserve existing package-runner detection behavior and precedence. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
- Register Node standalone builds with their current executable path. - Keep the detected package runner and pinned scoped package for managed installs. - Cover standalone registration and document the corrected behavior. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
- Detect standalone execution by comparing the resolved entrypoint and executable paths. - Avoid the node:sea import that the regular CLI bundle rewrites incorrectly. - Preserve absolute executable registration with the focused standalone regression. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@stripe/link-clipackage instead of the unrelated unscopedlink-clipackage.link-cli mcp addafter upgrading.