@agentscore-xyz/mcp-server 2.2.1 → 2.2.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Janus Compliance Limited
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,5 +1,7 @@
 # @agentscore-xyz/mcp-server
 
+> **Service end date: 31 December 2026.** AgentScore's scanning service and API close after that date. Version 2.2.2 is the final release. Until the end date every tool result carries a closing note; from 1 January 2027 every tool returns a closing message and checks nothing. The two Policy Gate set-up tools are withdrawn and no longer generate or write a workflow. Do not build a new dependency on this server.
+
 **Ask your agent if an npm MCP package is safe to install.** A drop-in MCP server that exposes AgentScore's live security data to Claude, Cursor, ChatGPT, and any MCP-compatible client. No API key, zero config, eight tools.
 
 [![AgentScore](https://agentscores.xyz/api/scan/badge?npm=@agentscore-xyz/mcp-server)](https://agentscores.xyz/report/@agentscore-xyz/mcp-server)

package/dist/api.js

@@ -1,6 +1,6 @@
 const BASE_URL = "https://www.agentscores.xyz";
 const TIMEOUT_MS = 8000;
-const CLIENT_ID = "@agentscore-xyz/mcp-server/2.2.1";
+const CLIENT_ID = "@agentscore-xyz/mcp-server/2.2.2";
 export class ApiError extends Error {
     status;
     code;

package/dist/index.js

@@ -5,7 +5,7 @@ import { z } from "zod";
 import { handleTool } from "./tools.js";
 const server = new McpServer({
     name: "agentscore",
-    version: "2.2.0",
+    version: "2.2.2",
 });
 // --- Tools ---
 server.tool("scan_package", "Scan an npm package for MCP security issues. Checks install scripts, prompt injection patterns, suspicious URLs, source code patterns, dependency count, metadata completeness, and publisher provenance. Returns score (0-100), risk level, and detailed findings.", {
@@ -23,14 +23,14 @@ server.tool("check_abuse", "Check if a package or agent has been reported to the
 server.tool("monitor_status", "Check if an MCP package is under continuous monitoring and get its scan history. Shows current score, risk level, and recent changes.", {
     npm: z.string().describe("npm package name"),
 }, async (args) => handleTool("monitor_status", args));
-server.tool("check_my_repo", "Inspect the current repo for MCP dependencies, look up AgentScore verdicts for each package, and summarise what should be gated in CI. Use this when a developer wants to understand all MCP packages in a repo instead of scanning one package at a time.", {
+server.tool("check_my_repo", "Inspect the current repo for MCP dependencies and look up AgentScore verdicts for each package. Use this when a developer wants to understand all MCP packages in a repo instead of scanning one package at a time.", {
     path: z.string().optional().describe("Optional path to the repo root. Defaults to the current working directory."),
 }, async (args) => handleTool("check_my_repo", args));
-server.tool("generate_policy_gate_setup", "Generate the exact GitHub Actions workflow needed to enforce AgentScore Policy Gate for a repo. Detects MCP dependencies locally and returns the OIDC-based YAML needed for setup. No API key or secret is required.", {
+server.tool("generate_policy_gate_setup", "Withdrawn. AgentScore's scanning service and API close after 31 December 2026, so the Policy Gate is no longer offered for new set-ups. This tool returns that notice and generates nothing.", {
     path: z.string().optional().describe("Optional path to the repo root. Defaults to the current working directory."),
     repo_url: z.string().optional().describe("Optional repository URL override for the pilot handoff link."),
 }, async (args) => handleTool("generate_policy_gate_setup", args));
-server.tool("install_policy_gate", "Write the AgentScore Policy Gate workflow file to this repo. Creates .github/workflows/agentscore-policy-gate.yml with OIDC authentication (no API key needed). Detects MCP dependencies and includes them in the workflow. The gate will auto-provision the repo on first push.", {
+server.tool("install_policy_gate", "Withdrawn. AgentScore's scanning service and API close after 31 December 2026, so the Policy Gate is no longer offered for new set-ups. This tool returns that notice and writes no file.", {
     path: z.string().optional().describe("Optional path to the repo root. Defaults to the current working directory."),
     repo_url: z.string().optional().describe("Optional repository URL override."),
 }, async (args) => handleTool("install_policy_gate", args));
@@ -38,7 +38,7 @@ server.tool("install_policy_gate", "Write the AgentScore Policy Gate workflow fi
 async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error("AgentScore MCP server v2.2 running on stdio");
+    console.error("AgentScore MCP server v2.2.2 running on stdio (the service closes after 31 December 2026)");
 }
 main().catch((err) => {
     console.error("Fatal error:", err);

package/dist/sunset.d.ts

@@ -0,0 +1,6 @@
+export declare const SERVICE_END_ISO = "2027-01-01T00:00:00Z";
+export declare const SERVICE_END_LABEL = "31 December 2026";
+export declare const CLOSING_NOTE = "Note: AgentScore's scanning service and API close after 31 December 2026 (UTC). After that date this server returns a closing message in place of results.";
+export declare const ENDED_MESSAGE = "AgentScore's scanning service and API closed on 31 December 2026. This tool no longer returns security verdicts or scan results, and nothing was checked.";
+export declare const GATE_WITHDRAWN = "The AgentScore Policy Gate is no longer offered for new set-ups. AgentScore's scanning service and API close after 31 December 2026, and a gate installed now would stop working on that date. No workflow has been generated or written.";
+export declare function serviceEnded(now?: number): boolean;

package/dist/sunset.js

@@ -0,0 +1,13 @@
+// AgentScore's scanning service and API close after 31 December 2026 (the main
+// application's src/lib/sunset.js holds the same date). This is the final
+// release of the server: it tells the user about the closure, stops offering the
+// Policy Gate set-up, and returns a plain closing message once the date has
+// passed, without calling an API that would only answer 410.
+export const SERVICE_END_ISO = "2027-01-01T00:00:00Z";
+export const SERVICE_END_LABEL = "31 December 2026";
+export const CLOSING_NOTE = `Note: AgentScore's scanning service and API close after ${SERVICE_END_LABEL} (UTC). After that date this server returns a closing message in place of results.`;
+export const ENDED_MESSAGE = `AgentScore's scanning service and API closed on ${SERVICE_END_LABEL}. This tool no longer returns security verdicts or scan results, and nothing was checked.`;
+export const GATE_WITHDRAWN = `The AgentScore Policy Gate is no longer offered for new set-ups. AgentScore's scanning service and API close after ${SERVICE_END_LABEL}, and a gate installed now would stop working on that date. No workflow has been generated or written.`;
+export function serviceEnded(now = Date.now()) {
+    return now >= Date.parse(SERVICE_END_ISO);
+}

package/dist/tools.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fetchApi, ApiError } from "./api.js";
 import { inspectRepoForMcpDependencies, } from "./repo.js";
+import { serviceEnded, CLOSING_NOTE, ENDED_MESSAGE, GATE_WITHDRAWN, } from "./sunset.js";
 const WEBSITE_BASE = "https://www.agentscores.xyz";
 function text(s, isError = false) {
     return { content: [{ type: "text", text: s }], isError };
@@ -92,7 +93,6 @@ function formatScan(data) {
             lines.push(`  ${t.name}: ${t.description?.slice(0, 100) || "no description"}`);
         }
     }
-    lines.push(policyGateHint({ packageName: data.package }));
     return lines.join("\n");
 }
 function formatVerdict(data) {
@@ -114,7 +114,6 @@ function formatVerdict(data) {
     if (data.tool_count > 0) {
         lines.push("", `Tools exposed: ${data.tool_count}`);
     }
-    lines.push(policyGateHint({ packageName: data.package }));
     return lines.join("\n");
 }
 function formatExposure(data) {
@@ -224,7 +223,6 @@ function formatRepoSummary(repoPath, repoUrl, checkedFiles, results) {
         const reasons = item.reasons.length > 0 ? ` | reasons: ${item.reasons.join(", ")}` : "";
         lines.push(`  ${item.name}@${version} - ${item.verdict.toUpperCase()} (${score}/100, ${risk}) [source: ${item.source}]${reasons}`);
     }
-    lines.push("", "Next step:", "  Run generate_policy_gate_setup to preview the OIDC-based GitHub Actions workflow for this repo.", "  Run install_policy_gate to write .github/workflows/agentscore-policy-gate.yml directly.");
     return lines.join("\n");
 }
 function buildOidcWorkflowYaml(packages) {
@@ -278,7 +276,21 @@ function formatPolicyGateSetup(repoPath, repoUrl, dependencies, checkedFiles) {
     }
     return lines.join("\n");
 }
+// Final release (2.2.2): every tool tells the user the service is closing, the
+// two Policy Gate set-up tools are withdrawn, and once the end date has passed
+// no tool calls the API at all.
 export async function handleTool(name, args) {
+    if (serviceEnded())
+        return text(ENDED_MESSAGE, true);
+    if (name === "generate_policy_gate_setup" || name === "install_policy_gate") {
+        return text(GATE_WITHDRAWN, true);
+    }
+    const result = await runTool(name, args);
+    if (result.isError)
+        return result;
+    return { ...result, content: [...result.content, { type: "text", text: CLOSING_NOTE }] };
+}
+async function runTool(name, args) {
     try {
         switch (name) {
             case "scan_package": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentscore-xyz/mcp-server",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "mcpName": "io.github.Thezenmonster/agentscore",
   "description": "MCP security trust layer. Scan packages, inspect repo MCP dependencies, generate Policy Gate setup, install the workflow directly, check exposure, and query abuse data.",
   "type": "module",