@agentscore-xyz/mcp-server 2.1.0 → 2.2.0

package/dist/index.js

@@ -5,7 +5,7 @@ import { z } from "zod";
 import { handleTool } from "./tools.js";
 const server = new McpServer({
     name: "agentscore",
-    version: "2.1.0",
+    version: "2.2.0",
 });
 // --- Tools ---
 server.tool("scan_package", "Scan an npm package for MCP security issues. Checks install scripts, prompt injection patterns, suspicious URLs, source code patterns, dependency count, metadata completeness, and publisher provenance. Returns score (0-100), risk level, and detailed findings.", {
@@ -30,11 +30,15 @@ server.tool("generate_policy_gate_setup", "Generate the exact GitHub Actions wor
     path: z.string().optional().describe("Optional path to the repo root. Defaults to the current working directory."),
     repo_url: z.string().optional().describe("Optional repository URL override for the pilot handoff link."),
 }, async (args) => handleTool("generate_policy_gate_setup", args));
+server.tool("install_policy_gate", "Write the AgentScore Policy Gate workflow file to this repo. Creates .github/workflows/agentscore-policy-gate.yml with OIDC authentication (no API key needed). Detects MCP dependencies and includes them in the workflow. The gate will auto-provision the repo on first push.", {
+    path: z.string().optional().describe("Optional path to the repo root. Defaults to the current working directory."),
+    repo_url: z.string().optional().describe("Optional repository URL override."),
+}, async (args) => handleTool("install_policy_gate", args));
 // --- Start ---
 async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error("AgentScore MCP server v2.1 running on stdio");
+    console.error("AgentScore MCP server v2.2 running on stdio");
 }
 main().catch((err) => {
     console.error("Fatal error:", err);

package/dist/tools.js

@@ -1,3 +1,5 @@
+import fs from "node:fs";
+import path from "node:path";
 import { fetchApi, ApiError } from "./api.js";
 import { inspectRepoForMcpDependencies, } from "./repo.js";
 const WEBSITE_BASE = "https://www.agentscores.xyz";
@@ -224,6 +226,34 @@ function formatRepoSummary(repoPath, repoUrl, checkedFiles, results) {
     lines.push("", "Next step:", "  Run generate_policy_gate_setup to get the exact GitHub Actions workflow for this repo.", `  Start a free pilot: ${buildIntentUrl("pilot", repoUrl)}`);
     return lines.join("\n");
 }
+function buildOidcWorkflowYaml(packages) {
+    const lines = [
+        "name: AgentScore Policy Gate",
+        "",
+        "on:",
+        "  pull_request:",
+        "  push:",
+        "    branches: [main]",
+        "",
+        "permissions:",
+        "  id-token: write",
+        "  contents: read",
+        "",
+        "jobs:",
+        "  mcp-policy:",
+        "    runs-on: ubuntu-latest",
+        "    steps:",
+        "      - uses: actions/checkout@v4",
+        "      - uses: Thezenmonster/mcp-verdict-action@v1",
+        "        with:",
+        '          fail-on: block',
+    ];
+    if (packages.length > 0) {
+        lines.push(`          packages: "${packages.join(",")}"`);
+    }
+    lines.push("");
+    return lines.join("\n");
+}
 function buildWorkflowYaml(packages) {
     const lines = [
         "name: AgentScore Policy Gate",
@@ -326,6 +356,35 @@ export async function handleTool(name, args) {
                 const repoUrl = normaliseRepositoryUrl(repoUrlArg || repo.repoUrl);
                 return text(formatPolicyGateSetup(repo.repoPath, repoUrl, repo.dependencies, repo.checkedFiles));
             }
+            case "install_policy_gate": {
+                const inputPath = typeof args.path === "string" ? args.path : undefined;
+                const repoUrlArg = typeof args.repo_url === "string" ? args.repo_url : undefined;
+                const repo = inspectRepoForMcpDependencies(inputPath);
+                const repoUrl = normaliseRepositoryUrl(repoUrlArg || repo.repoUrl);
+                const packages = repo.dependencies.map((d) => d.name);
+                const yaml = buildOidcWorkflowYaml(packages);
+                const workflowDir = path.join(repo.repoPath, ".github", "workflows");
+                const workflowPath = path.join(workflowDir, "agentscore-policy-gate.yml");
+                fs.mkdirSync(workflowDir, { recursive: true });
+                fs.writeFileSync(workflowPath, yaml, "utf8");
+                const pilotUrl = buildIntentUrl("pilot", repoUrl);
+                const lines = [
+                    `Workflow written to: ${workflowPath}`,
+                    "",
+                    `Detected ${packages.length} MCP ${packages.length === 1 ? "dependency" : "dependencies"}: ${packages.join(", ") || "none"}`,
+                    "",
+                    "This workflow uses GitHub OIDC for authentication. No API key or secret needed.",
+                    "On first push, AgentScore will auto-provision your repo and return verdicts.",
+                    "",
+                    "Next steps:",
+                    "  1. Review the workflow file",
+                    "  2. Commit and push",
+                    "  3. The gate runs automatically on every PR and push to main",
+                    "",
+                    `If you want a managed pilot with custom thresholds and exceptions: ${pilotUrl}`,
+                ];
+                return text(lines.join("\n"));
+            }
             default:
                 return text(`Unknown tool: ${name}`, true);
         }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@agentscore-xyz/mcp-server",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "mcpName": "io.github.Thezenmonster/agentscore",
-  "description": "MCP security trust layer. Scan packages, inspect repo MCP dependencies, generate Policy Gate setup, check exposure, and query abuse data.",
+  "description": "MCP security trust layer. Scan packages, inspect repo MCP dependencies, generate Policy Gate setup, check exposure, and query abuse data.",
   "type": "module",
   "bin": {
     "agentscore-mcp": "./dist/index.js"

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Janus Compliance Limited
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.