Review production dependency audit findings

[BigCactusLabs]

Summary

While setting up hevy-mcp@1.25.3 from a fresh local install, npm audit --omit=dev reports production-scope vulnerabilities. This does not necessarily mean the stdio MCP server is directly exploitable in normal local use, but it does make the published runtime dependency surface look broader than expected for a stdio-only MCP server.

The main concern is that generator/tooling-oriented packages appear in the production dependency tree, which pulls in transitive packages currently flagged by npm audit.

Environment

• hevy-mcp: 1.25.3
• Node.js: v26.3.0
• npm: 11.16.0
• Command run: npm audit --omit=dev --json

Audit result

npm audit --omit=dev reports:

• 10 total production-scope vulnerabilities
• 9 moderate
• 1 high
• 0 critical

Notable dependency paths:

hevy-mcp
└─ @kubb/plugin-client@4.38.0
   ├─ @kubb/react-fabric@0.14.0
   │  ├─ ws@8.18.0
   │  └─ react-devtools-core@6.1.5
   │     └─ ws@7.5.10
   └─ @kubb/core / @kubb/oas / @kubb/plugin-* packages

hevy-mcp
└─ @modelcontextprotocol/sdk@1.29.0
   └─ express-rate-limit@8.3.2
      └─ ip-address@10.1.0

The high-severity audit item comes through ws:

ws  7.0.0 - 7.5.10 || 8.0.0 - 8.20.1
Severity: high
ws: Memory exhaustion DoS from tiny fragments and data chunks

The moderate item through the MCP SDK path is:

ip-address <=10.1.0
Severity: moderate
ip-address has XSS in Address6 HTML-emitting methods

Why this may be worth reviewing

hevy-mcp is stdio-only as of recent releases, so the practical exposure of websocket/http-related transitive dependencies may be limited for normal local MCP usage. Still, consumers installing the package see these as production-scope dependencies.

The runtime dependency list currently includes:

{
  "@kubb/plugin-client": "^4.38.0",
  "@modelcontextprotocol/sdk": "^1.29.0",
  "@sentry/node": "^10.58.0",
  "axios": "^1.18.0",
  "zod": "^4.4.3"
}

The part that stands out is @kubb/plugin-client in dependencies. It appears to bring in Kubb generation/plugin infrastructure and React/devtools-adjacent transitive dependencies even though the published package only needs to run the MCP server.

Suggested direction

Would it be possible to review whether:

1. @kubb/plugin-client needs to remain in production dependencies, or whether the generated axios client can be shipped without the broader Kubb plugin tree.
2. Kubb codegen/plugin packages can move to devDependencies if they are only needed for generation/build.
3. The MCP SDK/transitive dependency path can be refreshed once patched versions are available.

I did not run npm audit fix --force. npm reports that the forced Kubb fix would install older/breaking Kubb versions, so this probably needs an intentional dependency review rather than an automatic audit fix.

[coderabbitai]

🔗 Related PRs

#219 - Prevent dotenvx stdout pollution [merged]
#225 - refactor(types): ✨ Improve type exports for better readability [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[chrisdoc]

@CharlieHelps have a look

[charliecreates]

I took a close look at this. The report is mostly valid, with one detail now stale.

• @kubb/plugin-client is still in production dependencies and currently appears in the runtime import path (generated client files import @kubb/plugin-client/clients/axios), so it does broaden the production dependency surface.
• @modelcontextprotocol/sdk is runtime-required for the stdio MCP server and should remain in dependencies.
• The express-rate-limit -> ip-address finding appears outdated for fresh installs today (patched transitives resolve now), though it can still appear from current lockfile state.
• The remaining high finding is still on the Kubb transitive ws path.

Suggested path:

1. Reconfigure Kubb generation so emitted runtime code no longer imports @kubb/plugin-client/clients/axios (for example via bundling or a local client import path).
2. After regeneration/build verification, move @kubb/plugin-client to devDependencies.
3. Re-run fresh-install npm audit --omit=dev to verify reduction.

If useful, I can open a PR that implements (1) + (2) and includes before/after audit output.

[chrisdoc]

@CharlieHelps open a PR for it

[charliecreates]

Opened: #356

This switches Kubb client generation to bundled runtime artifacts and moves @kubb/plugin-client to devDependencies, which removes it from production install deps. npm audit --omit=dev is down to the remaining MCP SDK transitive findings.