From e1fb23e1b8718cc6dbeda3ec6d5d49bb7609b678 Mon Sep 17 00:00:00 2001
From: "Sharad." <heysharad@proton.me>
Date: Wed, 16 Sep 2026 23:58:02 +0530
Subject: [PATCH 1/2] fix(cli): read version from package.json instead of
 hardcoding

---
 src/cli.ts       | 10 +++++++++-
 test/cli.test.ts |  9 +++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/cli.ts b/src/cli.ts
index 2d47ed7..d3166e7 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 import { runAudit, shouldFail } from "./audit.js";
 import { loadConfig, normalizeConfig } from "./config.js";
 import type { McpAuditConfig } from "./config.js";
@@ -12,7 +13,14 @@ import { ALL_RULES } from "./rules/index.js";
 import type { AuditTarget, Severity } from "./types.js";
 import { ALL_SEVERITIES } from "./types.js";
 
-const VERSION = "0.1.0";
+const require = createRequire(import.meta.url);
+const VERSION: string = (() => {
+  try {
+    return require("../package.json").version;
+  } catch {
+    return "0.0.0";
+  }
+})();
 
 type CliFlag = string | boolean | string[];
 
diff --git a/test/cli.test.ts b/test/cli.test.ts
index 9d5e28a..00d8730 100644
--- a/test/cli.test.ts
+++ b/test/cli.test.ts
@@ -3,6 +3,7 @@ import { collectHeaders, main, overlayFlags, parseArgs } from "../src/cli.js";
 import { DEFAULT_CONFIG } from "../src/config.js";
 import { runAudit } from "../src/audit.js";
 import { makeTarget } from "./helpers.js";
+import packageJson from "../package.json";
 
 afterEach(() => {
   vi.restoreAllMocks();
@@ -18,6 +19,14 @@ describe("top-level information flags", () => {
     expect(write).toHaveBeenCalledWith(expect.stringMatching(/^\d+\.\d+\.\d+\n$/));
   });
 
+  it("reports the version from package.json, not a hardcoded value", async () => {
+    const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+
+    await expect(main(["--version"])).resolves.toBe(0);
+
+    expect(write).toHaveBeenCalledWith(`${packageJson.version}\n`);
+  });
+
   it("keeps a bare invocation as a usage error", async () => {
     const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
 

From 309f66b963b9ce1791e5e759dd3f51fc6a0d3e92 Mon Sep 17 00:00:00 2001
From: "Sharad." <heysharad@proton.me>
Date: Thu, 17 Sep 2026 08:26:22 +0530
Subject: [PATCH 2/2] docs(changelog): note package.json-drive version
 reporting

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 35c097c..d2674b4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,9 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Fixed
 
+- Report the real `package.json` version from `--version` instead of a hardcoded
+  value that had drifted.
+
 - Reject non-array `tools` fields in static manifests before auditing, with an
   error identifying the source file.