Cannot trustify npx project from cloned repo

[dmartinol]

What happened?

Steps:

• Clone the dynatrace-mcp repo from:
  git@github.com:dynatrace-oss/dynatrace-mcp.git
• Run the trustification with:
  npx @trustification/exhort-javascript-api stack dynatrace-mcp/package.json

An error is reported, see attached log.

The error disappears if we first run npm install from the dynatrace-mcp folder.

Note: another error was due to missing tsc tool, which I installed on the environment.

Please provide runtime information.

MacOS

Relevant log output

 stack </path/to/manifest> [--html|--summary]

produce stack report for manifest path

Positionals:
  /path/to/manifest  manifest path for analyzing  [string] [required]

Options:
      --help     Show help  [boolean]
  -r, --html     Get the report as HTML instead of JSON  [boolean]
  -s, --summary  For JSON report, get only the 'summary'  [boolean]

Error: Failed to execute npm install --package-lock-only
    at #invokeCommand (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/providers/base_javascript.js:327:19)
    at #createLockFile (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/providers/base_javascript.js:258:32)
    ... 2 lines matching cause stack trace ...
    at Javascript_npm.provideStack (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/providers/base_javascript.js:106:35)
    at Object.requestStack (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/analysis.js:36:29)
    at Object.stackAnalysis (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/index.js:154:27)
    at Object.handler (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/cli.js:74:32)
    at file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/node_modules/yargs/build/lib/command.js:206:54
    at maybeAsyncResult (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/node_modules/yargs/build/lib/utils/maybe-async-result.js:9:15) {
  [cause]: Error: Command failed: npm install --package-lock-only
  sh: tsc: command not found
  npm error code 127
  npm error path /Users/rromerom/workspace/github.com/dynatrace-oss/dynatrace-mcp
  npm error command failed
  npm error command sh -c npm run build
  npm error A complete log of this run can be found in: /Users/rromerom/.npm/_logs/2025-08-01T11_37_19_130Z-debug-0.log
  
      at genericNodeError (node:internal/errors:983:15)
      at wrappedFn (node:internal/errors:537:14)
      at checkExecSyncError (node:child_process:888:11)
      at execFileSync (node:child_process:924:15)
      at invokeCommand (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/tools.js:158:12)
      at #invokeCommand (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/providers/base_javascript.js:318:20)
      at #createLockFile (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/providers/base_javascript.js:258:32)
      at Javascript_npm._buildDependencyTree (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/providers/base_javascript.js:133:29)
      at #getSBOM (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/providers/base_javascript.js:145:33)
      at Javascript_npm.provideStack (file:///Users/rromerom/workspace/github.com/trustification/exhort-javascript-api/dist/src/providers/base_javascript.js:106:35) {
    status: 127,
    signal: null,
    output: [
      null,
      '\n' +
        '> @dynatrace-oss/dynatrace-mcp-server@0.5.0-rc.2 prepare\n' +
        '> npm run build\n' +
        '\n' +
        '\n' +
        '> @dynatrace-oss/dynatrace-mcp-server@0.5.0-rc.2 build\n' +
        '> tsc --build\n' +
        '\n',
      'sh: tsc: command not found\n' +
        'npm error code 127\n' +
        'npm error path /Users/rromerom/workspace/github.com/dynatrace-oss/dynatrace-mcp\n' +
        'npm error command failed\n' +
        'npm error command sh -c npm run build\n' +
        'npm error A complete log of this run can be found in: /Users/rromerom/.npm/_logs/2025-08-01T11_37_19_130Z-debug-0.log\n'
    ],
    pid: 52183,
    stdout: '\n' +
      '> @dynatrace-oss/dynatrace-mcp-server@0.5.0-rc.2 prepare\n' +
      '> npm run build\n' +
      '\n' +
      '\n' +
      '> @dynatrace-oss/dynatrace-mcp-server@0.5.0-rc.2 build\n' +
      '> tsc --build\n' +
      '\n',
    stderr: 'sh: tsc: command not found\n' +
      'npm error code 127\n' +
      'npm error path /Users/rromerom/workspace/github.com/dynatrace-oss/dynatrace-mcp\n' +
      'npm error command failed\n' +
      'npm error command sh -c npm run build\n' +
      'npm error A complete log of this run can be found in: /Users/rromerom/.npm/_logs/2025-08-01T11_37_19_130Z-debug-0.log\n'
  }
}

How can this issue be reproduced?

No response

[dmartinol]

2025-08-01T11_27_59_009Z-debug-0.log

[ruromero]

Hi @dmartinol

It is expected that the project can be built and all dependencies are available. The tool runs npm install --package-lock-only to verify the package-lock file is up to date and then it will resolve the dependencies to generate the SBOM and fetch the vulnerabilities.

The problem you see should go away after running a npm install because the tool tries not to install anything on your behalf.

As it is a Typescript project it requires at least that the typescript package (tsc command) to be installed npm install typescript@5.8.2 if you want to keep the versions consistent.

[ruromero]

As discussed this error might not be evident and we will try to improve the error output and the README file.

[dmartinol]

thank you!