`mcp-server/` is a separate npm project with its own lockfile, so the
root-level audit pass in #442 never touched it. Both of its open
Dependabot alerts are runtime-scope transitives of the MCP SDK:
- fast-uri 3.1.3 → 3.1.4 — host confusion via a literal backslash
authority delimiter (high)
- @hono/node-server 1.19.14 → 2.0.12 — serve-static path traversal on
Windows via an encoded backslash (moderate)
Reaching those required @modelcontextprotocol/sdk 1.29.0 → 1.30.0, which
`^1.18.0` already allows, so package.json is unchanged. Lockfile only.
`npm audit` in mcp-server/ now reports 0 vulnerabilities.
Verified: `npm ci`, `npm run typecheck`, `npm run build`, and a stdio
smoke test — initialize succeeds and tools/list still returns all 7
tools on the bumped SDK. Note CI does not cover this directory, so this
was checked by hand.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Introduce mcp-server/ — a stdio Model Context Protocol server that
wraps the /api/v1 public API so MCP clients (Claude, Cursor, etc.) can
drive a self-hosted wacrm instance in natural language.
- Thin wrapper over the existing REST API; all auth, scoping, and rate
limiting stay server-side. No new backend surface.
- Read-only by default: write and broadcast tools are only registered
when WACRM_ENABLE_WRITES / WACRM_ENABLE_BROADCASTS are set, layered
on top of the API key's own scopes. send_broadcast also requires an
explicit confirm and is marked destructive.
- Registry-ready: server.json manifest, package.json mcpName linked to
it (io.github.arnasdon/wacrm-mcp), and glama.json for discovery.
- Docs: docs/mcp.md + README bullet + mcp-server/README.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
