fix(types): resolve all ~99 typecheck errors, fixing real bugs along the way

[VrilLabs]

Summary

npm run typecheck (part of CI's Test job, which runs lint -> typecheck -> test -> coverage) was failing with ~99 errors. Root causes, largest to smallest:

• zod v3 vs v4 mismatch: @modelcontextprotocol/server@2.0.0 (the package actually imported for McpServer, not @modelcontextprotocol/sdk) bundles its own zod v4 and requires v4-shaped schemas for registerTool. Bumped zod ^3.23.8 -> ^4.4.3 and fixed the resulting breakage (.default() must precede .transform(), z.record() needs an explicit key schema, .ip() -> z.union([z.ipv4(), z.ipv6()])).
• pino logger calls were backwards everywhere: pino's signature is logger.info(mergingObject, message?); the codebase called logger.info(message, mergingObject) throughout index.ts. Fixed every call site.
• ToolResult had drifted from the SDK's actual CallToolResult: replaced the hand-rolled interface with a type alias to the real one, which also cleared every registerTool overload error.
• node-fetch conflicted with Node 22's native fetch: removed the dependency, switched to global fetch, updated test mocks to vi.stubGlobal('fetch', ...).
• Two real bugs fixed: server.invokeTool(...) doesn't exist on McpServer — the 4 per-flavor scan tools were calling a nonexistent method (extracted shared logic into a scanEndpoint function instead). capabilities was misplaced in the server constructor's first argument instead of the second. getRecentScans results were read via snake_case DB column names instead of the actual camelCase JS properties.
• Relative imports needed explicit .js extensions, plus a handful of genuinely dead fields/params removed.

Test plan

• npm run typecheck — 0 errors (was ~99)
• npm run lint — clean
• npx vitest run — 190 passed / 9 failed, identical to the baseline before this change (pre-existing, unrelated test-isolation failures)
• npm run build — succeeds
• Smoke-tested the compiled server (node dist/index.js) — boots and serves on stdio with no errors

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR focuses on getting CI typechecking back to green by aligning local types and runtime behavior with @modelcontextprotocol/server@2.x, upgrading to Zod v4, and cleaning up several type-driven correctness issues in the server/tool implementations.

Changes:

• Align tool/result typing with MCP server types and refactor scan tool logic to avoid using nonexistent server APIs.
• Remove node-fetch in favor of Node’s native fetch, updating test setup/mocks accordingly.
• Upgrade to zod@4 and adjust schemas/usages (record key schemas, default/transform ordering, IP validation), plus fix pino logging call signatures and ESM .js import specifiers.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/types/index.ts	Replaces hand-rolled ToolResult with MCP server’s CallToolResult type.
src/test/setup.ts	Switches global HTTP mocking from node-fetch module mocking to vi.stubGlobal('fetch', ...).
src/index.ts	Fixes MCP server construction args, refactors scan handling, updates logging, ESM imports, and DB field usage.
src/database/index.ts	Updates internal imports to ESM-style .js paths.
src/core/virusTotal.ts	Migrates to global fetch, updates Zod v4 schema details, and adjusts request/error parsing typings.
src/core/virusTotal.test.ts	Removes node-fetch import and relies on globally mocked fetch.
src/core/alienVault.ts	Migrates to global fetch, updates Zod v4 IP validation, and tightens response.json() typing.
src/core/alienVault.test.ts	Removes node-fetch import and relies on globally mocked fetch.
src/config/index.ts	Updates Zod v4 default()/transform() ordering and type imports.
package.json	Removes node-fetch; upgrades zod to v4.
package-lock.json	Lockfile updates reflecting node-fetch removal and zod@4 upgrade.

Suppressed comments (1)

src/index.ts:560

• Same issue as scanId: the DB column is threats_detected, so s.threatsDetected will be undefined unless the database layer aliases/massages column names. Add a fallback here (or fix the repository SQL to return camelCase).

            threatsDetected: s.threatsDetected,

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.