Repository navigation
Published tarball includes CLAUDE.md (Claude Code project guide) #290
Description
Activity
Hey @morganmaiani-bit 👋
looking into this and the impact is actually broader than just CLAUDE.md. The current 2.3.1 tarball ships 47 files / 1.19 MB including the entire src/ source, all tests/, tsconfig.json, Dockerfile, docker-compose.yml, .github/, and docs/images/*.png, none of which are needed at runtime, since bin/cli.mjs is a self-contained esbuild bundle that only reads scripts/notion-openapi.json at runtime.I've put together a fix that adds a tight "files" allowlist to package.json so the tarball ships only what's actually needed:
Before
Tarball size 1.19 MB
File count 47After
Tarball size 442.7 KB (−63%)
File count 5Opening a PR shortly, I will link it when it's opened.
Summary
@notionhq/notion-mcp-servershipsCLAUDE.md(Claude Code project guide) inside the published npm tarball, observable vianpx @notionhq/notion-mcp-server.Repro
Why this matters
CLAUDE.mdis a maintainer-facing project guide. No runtime purpose for consumers. Two issues:npxcache.CLAUDE.mdfiles from tool-touched directories — if a downstream developer reads files inside the installed package (especially likely for an MCP server that ships with Claude Code workflows), this guide can inject into their session context.Suggested fix
Add a
filesallowlist topackage.json, or addCLAUDE.mdto.npmignore.Context
Found during a Claude Code permissions audit. Filing individually across several npm packages with the same pattern. Happy to PR if useful.