The 0.5.4 release notes carried an unusual section: Known issue shipped with 0.5.4. We had spent that whole release fixing the first minute of using the CLI — twelve corrections to help text, exit codes, path handling, and MCP behaviour — and in the middle of it we found one more that did not make the cut.
mendapi scan -h
did not print help. It ran a scan.
Every other subcommand normalized -h
to --help
before dispatching. scan
did not, so the short flag fell through to the scanner, which happily ignored an unrecognized argument and started working. Nobody loses data over this. But it is exactly the kind of thing that makes a first-time user close the terminal, and we had just shipped a release about first impressions.
We wrote it down rather than quietly patching over it, because a tool whose entire premise is upstream changes should be visible before they surprise you does not get to hide its own.
One change. -h
is normalized to --help
before any subcommand spawns, so all nine subcommands behave identically:
$ npx mendapi@0.5.5 scan -h
Usage: mendapi scan
--repo <path>
--provider <name>
--change-id <id>
--out <file.json>
--json --quiet
--include-prereleases
The regression gate that covers this now asserts on all nine subcommands, plus a negative control that fails if the assertion ever becomes vacuously true. That second part matters more than the fix: a test that passes because it stopped testing anything is worse than no test.
The MCP registry entry has been refreshed. com.mendapi/mendapi
now carries an icon set and a website URL alongside the package metadata, so clients that render a server picker have something to render.
Nothing else changed. scan
, fix
, deps
, review
, and pr
still run entirely on your machine. No network primitives exist in those files at all, and the build fails if any appear.
npx mendapi@latest scan
Or wire it into an agent:
claude mcp add mendapi \
-- npx mendapi mcp
Requires Node.js 22.13 or newer. Zero npm dependencies.