Tools
MCP Inspector's 2.7.0 release prep publishes a five-lockfile npm audit table and deliberately refuses npm audit fix
PR #2379, merged 2026-09-16, bumps Inspector to 2.7.0 and carries a full npm audit report across root, clients/web, clients/cli, clients/tui and clients/launcher, showing zero findings at every severity rather than just at or above the --audit-level=high gate. The PR explicitly records that npm audit fix was not run, with or without --force, per issue #2058, and that no git tag was created because the release tag must point at the merge commit on main. The whole sequence is driven by a checked-in .claude/skills/release/SKILL.md, which is a concrete example of a project encoding its release process as an agent skill.
Source
↳ Follow the thread