docs: restore SECURITY.md, lost in the v2 tree swap - #1843
Merged
Conversation
`SECURITY.md` existed on the pre-swap `main` (ac3c1a1) and still exists on `v1/main`, but the v2 tree never had one — so #1817 silently removed the security policy from the default branch. That is the wrong file to be missing right now: it is where private vulnerability reporting is advertised, and it disappeared in the same window as 2.0.0 shipping and external pull requests being turned off (#1820). Losing the PR path and the security-report path together would leave an outside reporter with no documented route at all. Restored from `v1/main` with the additions #1820 asks for: - A supported-versions table covering all four package names — v2 supported, the v1 line security-fixes-only under the `v1-latest` dist-tag, anything below 1.0.0 unsupported. The three sub-packages are named explicitly since they exist only on v1 and are deprecated. - A note that the repository does not accept outside pull requests, but that this explicitly does NOT apply to security reports, which must go through the advisory process rather than any public channel. Without that, the new issues-only policy reads as "no way to reach us". - "Whether it affects v2, v1, or both" added to the report checklist, now that two lines are live. Verified private vulnerability reporting is enabled on the repo, so the advisory link is a working route rather than an aspiration. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
This was referenced Jul 28, 2026
This was referenced Jul 28, 2026
Closed
Merged
cliffhall
added a commit
that referenced
this pull request
Aug 1, 2026
…p it (#1867) Closes #1864. SECURITY.md was restored to main in #1843 but never added to v2/main. Because v2/main is the develop branch merged into main at milestones, and the two share no common git ancestor, the next milestone merge would silently remove the security policy from the default branch a second time. Copied byte-for-byte from main (sha256 bbc8aaa5a33d481f902c1b7ac260a4c9c0d41dac5bb2916607222dd205dda924, 2633 bytes). No content changes. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 2, 2026
pull Bot
pushed a commit
to Bang2985/inspector
that referenced
this pull request
Aug 5, 2026
Resolves the eight conflicts from the first v2/main -> main milestone merge on a branch cut from main, so v2/main's ancestry stays clean -- resolving them on the PR head would have back-merged main into v2/main, which is exactly what modelcontextprotocol#1868 was closed to avoid. All eight took v2/main's side, each verifiably the newer content: - README.md stale Mcp-Param-* callout; v2/main's is corrected by modelcontextprotocol#1847 (the Inspector builds the headers itself) - SECURITY.md add/add (modelcontextprotocol#1843 on main, modelcontextprotocol#1867 on v2/main); differ by one line, the CONTRIBUTORS.md -> CONTRIBUTING.md rename from modelcontextprotocol#1884 - clients/web/package.json vitest ^4.1.0 -> ^4.1.10, the modelcontextprotocol#1899 fix - the five package-lock.json files, then regenerated from a clean install rather than hand-merged main's release-workflow commits (modelcontextprotocol#1831 least-privilege token, modelcontextprotocol#1834 dist-tag derivation, modelcontextprotocol#1836 OIDC trusted publishing) auto-merged and are preserved -- .github/workflows/main.yml is the only file where the merged tree differs from v2/main. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1820.
The regression
SECURITY.mdexists on the pre-swapmain(ac3c1a12) and onv1/main— but the v2 tree never had one, so #1817 silently removed the security policy from the default branch.I found this while checking #1820's prerequisites, not from any alert. Nothing flagged it.
Why it matters right now
It is where private vulnerability reporting is advertised, and it vanished in the same window as 2.0.0 shipping and external pull requests being switched off.
Losing the PR path and the security-report path together would leave an outside reporter with no documented route at all — exactly the wrong gap for a tool that connects to arbitrary MCP servers.
What's restored, plus what #1820 asked for
Base content restored from
v1/main, with three additions:Supported-versions table covering all four package names:
@modelcontextprotocol/inspector@modelcontextprotocol/inspectorv1-latest-client/-server/-cliThe three sub-packages are named explicitly because they exist only on the v1 line and are deprecated — v2 ships a single package, so someone reading "is my version supported?" needs them listed.
A carve-out for security reports. The doc now states that the repo does not accept outside pull requests, and that this does not apply to security reports. Without it, the new issues-only policy reads as "no way to reach us".
"Whether it affects v2, v1, or both" added to the report checklist, now that two lines are live.
Verified
Private vulnerability reporting is enabled on the repo (
GET /repos/.../private-vulnerability-reporting→{"enabled": true}), so the advisory link is a working route rather than an aspiration.🤖 Generated with Claude Code
https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD