feat: OSS SAST set up

.github/workflows/main.yml

@@ -58,6 +58,31 @@ jobs:
 
             - run: pnpm test:all
 
+    sast:
+      runs-on: ubuntu-latest
+      if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+      steps: 
+        - uses: actions/checkout@v6
+
+        - name: Install pnpm
+          uses: pnpm/action-setup@v4
+          id: pnpm-install
+          with:
+              run_install: false
+        - uses: actions/setup-node@v6
+          with:
+              node-version: 24
+              cache: pnpm
+              cache-dependency-path: pnpm-lock.yaml
+
+        - run: pnpm install
+        - run: pnpm test:coverage:all
+
+        - name: SonarQube Scan
+          uses: SonarSource/sonarqube-scan-action@v6
+          env:
+            SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
     publish:
         runs-on: ubuntu-latest
         if: github.event_name == 'release'

.gitignore

@@ -21,6 +21,7 @@ lib-cov
 
 # Coverage directory used by tools like istanbul
 coverage
+reports
 *.lcov
 
 # nyc test coverage

common/vitest-config/package.json

@@ -23,6 +23,7 @@
     "version": "2.0.0",
     "devDependencies": {
         "@modelcontextprotocol/tsconfig": "workspace:^",
-        "vite-tsconfig-paths": "catalog:devTools"
+        "vite-tsconfig-paths": "catalog:devTools",
+        "vitest-sonar-reporter": "^3.0.0"
     }
 }

common/vitest-config/vitest.config.js

@@ -6,15 +6,32 @@ import url from 'node:url';
 const ignorePatterns = ['**/dist/**'];
 const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
 
+const reporters = ['default'];
+const outputFile = {};
+
+if (process.env.GITHUB_ACTIONS === 'true') {
+    reporters.push([import.meta.resolve('vitest-sonar-reporter'), { silent: true }], 'github-actions');
+    outputFile['vitest-sonar-reporter'] = 'reports/sonar-report.xml';
+}
+
 export default defineConfig({
     test: {
         globals: true,
         environment: 'node',
         include: ['test/**/*.test.ts'],
         exclude: ignorePatterns,
+        reporters,
+        outputFile,
         deps: {
             moduleDirectories: ['node_modules', path.resolve(__dirname, '../../packages'), path.resolve(__dirname, '../../common')]
         },
+        coverage: {
+            provider: 'v8',
+            reporter: ['text', 'json', 'html', 'lcov'],
+            reportsDirectory: './coverage',
+            include: ['src/**/*.ts'],
+            exclude: ['**/dist/**', '**/node_modules/**', '**/*.test.ts', '**/*.spec.ts'],
+        },
     },
     poolOptions: {
         threads: {

examples/shared/package.json

@@ -28,6 +28,7 @@
         "lint:fix": "eslint src/ --fix && prettier --ignore-path ../../.prettierignore --write .",
         "check": "npm run typecheck && npm run lint",
         "test": "vitest run",
+        "test:coverage": "vitest run --coverage",
         "test:watch": "vitest",
         "start": "npm run server",
         "server": "tsx watch --clear-screen=false scripts/cli.ts server",

package.json

@@ -30,6 +30,7 @@
         "lint:fix:all": "pnpm -r lint:fix",
         "check:all": "pnpm -r typecheck && pnpm -r lint",
         "test:all": "pnpm -r test",
+        "test:coverage:all": "vitest run --coverage",
         "test:conformance:client": "conformance client --command 'npx tsx src/conformance/everything-client.ts'",
         "test:conformance:client:all": "conformance client --command 'npx tsx src/conformance/everything-client.ts' --suite all",
         "test:conformance:client:run": "npx tsx src/conformance/everything-client.ts",
@@ -45,8 +46,9 @@
         "@eslint/js": "catalog:devTools",
         "@modelcontextprotocol/client": "workspace:^",
         "@modelcontextprotocol/conformance": "0.1.9",
-        "@modelcontextprotocol/server": "workspace:^",
         "@modelcontextprotocol/node": "workspace:^",
+        "@modelcontextprotocol/server": "workspace:^",
+        "@modelcontextprotocol/vitest-config": "workspace:^",
         "@types/content-type": "catalog:devTools",
         "@types/cors": "catalog:devTools",
         "@types/cross-spawn": "catalog:devTools",
@@ -57,6 +59,7 @@
         "@types/supertest": "catalog:devTools",
         "@types/ws": "catalog:devTools",
         "@typescript/native-preview": "catalog:devTools",
+        "@vitest/coverage-v8": "catalog:devTools",
         "cors": "catalog:runtimeServerOnly",
         "eslint": "catalog:devTools",
         "eslint-config-prettier": "catalog:devTools",

packages/client/package.json

@@ -39,6 +39,7 @@
         "lint:fix": "eslint src/ --fix && prettier --ignore-path ../../.prettierignore --write .",
         "check": "npm run typecheck && npm run lint",
         "test": "vitest run",
+        "test:coverage": "vitest run --coverage",
         "test:watch": "vitest",
         "start": "npm run server",
         "server": "tsx watch --clear-screen=false scripts/cli.ts server",

packages/core/package.json

@@ -28,6 +28,7 @@
         "lint:fix": "eslint src/ --fix && prettier --ignore-path ../../.prettierignore --write .",
         "check": "npm run typecheck && npm run lint",
         "test": "vitest run",
+        "test:coverage": "vitest run --coverage",
         "test:watch": "vitest",
         "start": "npm run server",
         "server": "tsx watch --clear-screen=false scripts/cli.ts server",

packages/middleware/express/package.json

@@ -41,6 +41,7 @@
         "lint:fix": "eslint src/ --fix && prettier --ignore-path ../../.prettierignore --write .",
         "check": "npm run typecheck && npm run lint",
         "test": "vitest run",
+        "test:coverage": "vitest run --coverage",
         "test:watch": "vitest"
     },
     "dependencies": {},

packages/middleware/hono/package.json

@@ -41,6 +41,7 @@
         "lint:fix": "eslint src/ --fix && prettier --ignore-path ../../.prettierignore --write .",
         "check": "npm run typecheck && npm run lint",
         "test": "vitest run",
+        "test:coverage": "vitest run --coverage",
         "test:watch": "vitest"
     },
     "dependencies": {},

packages/middleware/node/package.json

@@ -40,6 +40,7 @@
         "lint:fix": "eslint src/ --fix && prettier --ignore-path ../../.prettierignore --write .",
         "check": "npm run typecheck && npm run lint",
         "test": "vitest run",
+        "test:coverage": "vitest run --coverage",
         "test:watch": "vitest",
         "start": "npm run server",
         "server": "tsx watch --clear-screen=false scripts/cli.ts server",

packages/server/package.json

@@ -39,6 +39,7 @@
         "lint:fix": "eslint src/ --fix && prettier --ignore-path ../../.prettierignore --write .",
         "check": "npm run typecheck && npm run lint",
         "test": "vitest run",
+        "test:coverage": "vitest run --coverage",
         "test:watch": "vitest",
         "start": "npm run server",
         "server": "tsx watch --clear-screen=false scripts/cli.ts server",