fix(cli): read version from package.json instead of hardcoding

CHANGELOG.md

@@ -8,6 +8,9 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Fixed
 
+- Report the real `package.json` version from `--version` instead of a hardcoded
+  value that had drifted.
+
 - Reject non-array `tools` fields in static manifests before auditing, with an
   error identifying the source file.
 

src/cli.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 import { runAudit, shouldFail } from "./audit.js";
 import { loadConfig, normalizeConfig } from "./config.js";
 import type { McpAuditConfig } from "./config.js";
@@ -12,7 +13,14 @@ import { ALL_RULES } from "./rules/index.js";
 import type { AuditTarget, Severity } from "./types.js";
 import { ALL_SEVERITIES } from "./types.js";
 
-const VERSION = "0.1.0";
+const require = createRequire(import.meta.url);
+const VERSION: string = (() => {
+  try {
+    return require("../package.json").version;
+  } catch {
+    return "0.0.0";
+  }
+})();
 
 type CliFlag = string | boolean | string[];
 

test/cli.test.ts

@@ -3,6 +3,7 @@ import { collectHeaders, main, overlayFlags, parseArgs } from "../src/cli.js";
 import { DEFAULT_CONFIG } from "../src/config.js";
 import { runAudit } from "../src/audit.js";
 import { makeTarget } from "./helpers.js";
+import packageJson from "../package.json";
 
 afterEach(() => {
   vi.restoreAllMocks();
@@ -18,6 +19,14 @@ describe("top-level information flags", () => {
     expect(write).toHaveBeenCalledWith(expect.stringMatching(/^\d+\.\d+\.\d+\n$/));
   });
 
+  it("reports the version from package.json, not a hardcoded value", async () => {
+    const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+
+    await expect(main(["--version"])).resolves.toBe(0);
+
+    expect(write).toHaveBeenCalledWith(`${packageJson.version}\n`);
+  });
+
   it("keeps a bare invocation as a usage error", async () => {
     const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);