From 713de9242dbda41263865e373b805bda9a7b68a3 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Fri, 31 Jul 2026 13:49:16 -0400 Subject: [PATCH] docs: restore SECURITY.md on v2/main, so the next tree swap can't drop it Closes #1864. SECURITY.md was restored to main in #1843 but never added to v2/main. Because v2/main is the develop branch merged into main at milestones, and the two share no common git ancestor, the next milestone merge would silently remove the security policy from the default branch a second time. Copied byte-for-byte from main (sha256 bbc8aaa5a33d481f902c1b7ac260a4c9c0d41dac5bb2916607222dd205dda924, 2633 bytes). No content changes. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU --- SECURITY.md | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..3e26f2162 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,53 @@ +# Security Policy + +Thank you for helping keep the Model Context Protocol and its ecosystem secure. + +## Supported Versions + +| Version | Package | Support | +| ------- | ---------------------------------------- | ------------------------------------------------------- | +| **2.x** | `@modelcontextprotocol/inspector` | ✅ Actively supported | +| 1.x | `@modelcontextprotocol/inspector` | ⚠️ **Security fixes only**, published under `v1-latest` | +| 1.x | `@modelcontextprotocol/inspector-client` | ⚠️ Security fixes only | +| 1.x | `@modelcontextprotocol/inspector-server` | ⚠️ Security fixes only | +| 1.x | `@modelcontextprotocol/inspector-cli` | ⚠️ Security fixes only | +| < 1.0.0 | any | ❌ Unsupported | + +v2 ships as a **single** package — `@modelcontextprotocol/inspector`. The three +`inspector-client` / `inspector-server` / `inspector-cli` sub-packages exist only +on the v1 line and are deprecated. + +v1 development happens on the `v1/main` branch and is limited to security fixes. +Those releases are published under the **`v1-latest`** dist-tag so they never +displace the current v2 release: + +```bash +npm i @modelcontextprotocol/inspector@v1-latest +``` + +Everything else — features, bug fixes, improvements — lands in v2 only. + +## Reporting Security Issues + +If you discover a security vulnerability in this repository, please report it through +the [GitHub Security Advisory process](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) +for this repository. Private vulnerability reporting is enabled, so this is the +fastest route to a maintainer. + +Please **do not** report security vulnerabilities through public GitHub issues, discussions, +or pull requests. + +Note that this repository does not accept pull requests from outside contributors +(see [CONTRIBUTORS.md](./CONTRIBUTORS.md)) — **this does not apply to security +reports**, which should always go through the advisory process above rather than +any public channel. + +## What to Include + +To help us triage and respond quickly, please include: + +- A description of the vulnerability +- Steps to reproduce the issue +- The potential impact +- Whether it affects v2, v1, or both +- Any suggested fixes (optional)