From cbe956c17a3524a7faee845f5f64e128635feb88 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Tue, 28 Jul 2026 03:58:18 -0400 Subject: [PATCH] docs: restore SECURITY.md, lost in the v2 tree swap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `SECURITY.md` existed on the pre-swap `main` (ac3c1a12) and still exists on `v1/main`, but the v2 tree never had one — so #1817 silently removed the security policy from the default branch. That is the wrong file to be missing right now: it is where private vulnerability reporting is advertised, and it disappeared in the same window as 2.0.0 shipping and external pull requests being turned off (#1820). Losing the PR path and the security-report path together would leave an outside reporter with no documented route at all. Restored from `v1/main` with the additions #1820 asks for: - A supported-versions table covering all four package names — v2 supported, the v1 line security-fixes-only under the `v1-latest` dist-tag, anything below 1.0.0 unsupported. The three sub-packages are named explicitly since they exist only on v1 and are deprecated. - A note that the repository does not accept outside pull requests, but that this explicitly does NOT apply to security reports, which must go through the advisory process rather than any public channel. Without that, the new issues-only policy reads as "no way to reach us". - "Whether it affects v2, v1, or both" added to the report checklist, now that two lines are live. Verified private vulnerability reporting is enabled on the repo, so the advisory link is a working route rather than an aspiration. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD --- SECURITY.md | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..3e26f2162 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,53 @@ +# Security Policy + +Thank you for helping keep the Model Context Protocol and its ecosystem secure. + +## Supported Versions + +| Version | Package | Support | +| ------- | ---------------------------------------- | ------------------------------------------------------- | +| **2.x** | `@modelcontextprotocol/inspector` | ✅ Actively supported | +| 1.x | `@modelcontextprotocol/inspector` | ⚠️ **Security fixes only**, published under `v1-latest` | +| 1.x | `@modelcontextprotocol/inspector-client` | ⚠️ Security fixes only | +| 1.x | `@modelcontextprotocol/inspector-server` | ⚠️ Security fixes only | +| 1.x | `@modelcontextprotocol/inspector-cli` | ⚠️ Security fixes only | +| < 1.0.0 | any | ❌ Unsupported | + +v2 ships as a **single** package — `@modelcontextprotocol/inspector`. The three +`inspector-client` / `inspector-server` / `inspector-cli` sub-packages exist only +on the v1 line and are deprecated. + +v1 development happens on the `v1/main` branch and is limited to security fixes. +Those releases are published under the **`v1-latest`** dist-tag so they never +displace the current v2 release: + +```bash +npm i @modelcontextprotocol/inspector@v1-latest +``` + +Everything else — features, bug fixes, improvements — lands in v2 only. + +## Reporting Security Issues + +If you discover a security vulnerability in this repository, please report it through +the [GitHub Security Advisory process](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) +for this repository. Private vulnerability reporting is enabled, so this is the +fastest route to a maintainer. + +Please **do not** report security vulnerabilities through public GitHub issues, discussions, +or pull requests. + +Note that this repository does not accept pull requests from outside contributors +(see [CONTRIBUTORS.md](./CONTRIBUTORS.md)) — **this does not apply to security +reports**, which should always go through the advisory process above rather than +any public channel. + +## What to Include + +To help us triage and respond quickly, please include: + +- A description of the vulnerability +- Steps to reproduce the issue +- The potential impact +- Whether it affects v2, v1, or both +- Any suggested fixes (optional)