@authtrack/secura 0.1.0 → 0.1.1

package/README.md

@@ -1,157 +1,229 @@
-# @authtrack/secura
-
-**AuthTrack static analysis (SAST) from the command line.**
-
-`secura` points five independent engines — [Semgrep], [Bearer], [OSV-Scanner],
-[Gitleaks] and [CodeQL] — at a repository, merges and deduplicates their
-findings, retrieves similar known-vulnerable patterns, then has an LLM confirm
-or rule out each finding and write a patch for the confirmed ones. It streams
-the whole run live in your terminal and prints a report at the end.
-
-The scanning runs on the **AuthTrack backend**; this CLI is a thin, zero-dependency
-client that talks to it. You don't need Python, and you don't need the scanners
-installed locally.
-
-[Semgrep]: https://semgrep.dev
-[Bearer]: https://www.bearer.com
-[OSV-Scanner]: https://google.github.io/osv-scanner/
-[Gitleaks]: https://github.com/gitleaks/gitleaks
-[CodeQL]: https://codeql.github.com
-
----
-
-## Install
-
-```bash
-npm install -g @authtrack/secura
-```
-
-Or run it once, without installing:
-
-```bash
-npx @authtrack/secura scan .
-```
-
-Requires **Node ≥ 18**. No build step, no native modules.
-
-## Quick start
-
-```bash
-# Scan the current directory
-secura scan .
-
-# Scan a public GitHub repo (the backend clones it)
-secura scan owner/repo
-secura scan https://github.com/owner/repo
-
-# Fast pass — skip CodeQL (its database build dominates the run)
-secura scan . --fast
-
-# CI gate: exit non-zero if anything HIGH or worse is confirmed
-secura scan . --fail-on high
-
-# Save the full machine-readable report
-secura scan . --json report.json
-```
-
-## Targets
-
-| Target | What happens |
-| --- | --- |
-| `.` or `./path/to/repo` | A local folder. Sent to the backend to scan (see [Backend](#backend)). |
-| `owner/repo` | Public GitHub shorthand. The backend shallow-clones it, scans, then deletes it. |
-| `https://github.com/owner/repo`, `git@…`, `ssh://…` | Any public Git URL. Cloned by the backend. |
-
-For a local path, how the code reaches the backend depends on where the backend runs:
-
-- **Local backend** (the default, `http://localhost:8000`): the absolute path is
-  sent as-is and scanned in place — nothing is copied.
-- **Remote backend** (a `--api` that isn't localhost), or **`--upload`**: the
-  directory is packaged into a `tar.gz` (excluding `node_modules`, `.git`, build
-  output, lockfiles, minified assets, …) and uploaded. Requires `tar` on your
-  PATH (bundled with Windows 10 1803+, macOS and Linux). If `tar` is missing,
-  scan a Git URL instead.
-
-## Options
-
-```
--f, --fast                 Skip CodeQL (its DB build dominates the run).
--l, --language <lang>      CodeQL language (javascript, python, java, go, ruby,
-                           csharp, cpp). Auto-detected when omitted.
--t, --max-triage <n>       Cap findings sent to LLM triage (default 25).
-    --fail-on <sev>        Exit 1 if a confirmed finding is >= this severity
-                           (critical|high|medium|low). For CI gates.
--o, --json <path>          Write the full report as JSON to <path>.
-    --max-findings <n>     How many confirmed findings to print (default 20).
-    --show-fixes           Print the generated fix diffs in full.
--q, --quiet                Suppress the live view; print only the report.
-    --api <url>            Backend base URL (default $SECURA_API or
-                           http://localhost:8000/api/v1).
-    --token <token>        Bearer token, if the backend requires one
-                           (default $SECURA_TOKEN).
-    --upload               Package and upload the local dir even for a local
-                           backend (automatic for a remote --api).
-```
-
-### Exit codes
-
-| Code | Meaning |
-| --- | --- |
-| `0` | Completed; no `--fail-on` breach. |
-| `1` | `--fail-on` gate breached (a confirmed finding at or above the threshold). |
-| `2` | Bad target, or the scan failed. |
-| `130` | Interrupted (Ctrl-C). |
-
-## Backend
-
-`secura` needs a reachable AuthTrack backend. Point it at one with `--api` or the
-`SECURA_API` environment variable (matching the web app's `NEXT_PUBLIC_API_URL`):
-
-```bash
-export SECURA_API="https://scans.example.com/api/v1"
-secura scan owner/repo
-```
-
-The default is `http://localhost:8000/api/v1`. The scan endpoints are unauthenticated;
-`--token` / `SECURA_TOKEN` is sent as a bearer header only if provided, so it keeps
-working if auth is added later.
-
-## CI example
-
-```yaml
-# GitHub Actions — fail the build on a confirmed high+ finding
-- name: SAST
-  run: npx @authtrack/secura scan . --fast --fail-on high --json sast.json
-  env:
-    SECURA_API: ${{ secrets.SECURA_API }}
-```
-
----
-
-## Publishing (maintainers)
-
-This package publishes from the `cli/` directory of the AuthTrack repo. It is
-plain ESM with no build step, so publishing is just:
-
-```bash
-cd cli
-npm login                     # once per machine
-npm version patch             # 0.1.0 -> 0.1.1 (bumps package.json + git tag)
-npm publish --access public   # scoped packages need --access public on first publish
-```
-
-Notes:
-
-- **Scope.** The name `@authtrack/secura` requires the `@authtrack` org to exist
-  on npm and your account to be a member. Create it at
-  <https://www.npmjs.com/org/create>, or rename the package to an unscoped name
-  you own (e.g. `authtrack-secura`) in `package.json` — the `bin` stays `secura`
-  either way, so `secura scan …` is unchanged for users.
-- **What ships.** Only `bin/`, `src/` and `README.md` (the `files` allowlist).
-  Verify with `npm pack --dry-run` before publishing.
-- **Smoke test the tarball.** `npm pack` then
-  `npm i -g ./authtrack-secura-<version>.tgz` and run `secura --help`.
-
-## License
-
-MIT
+# @authtrack/secura
+
+**AuthTrack static analysis (SAST) from the command line.**
+
+`secura` points five independent engines — [Semgrep], [Bearer], [OSV-Scanner],
+[Gitleaks] and [CodeQL] — at a repository, merges and deduplicates their
+findings, retrieves similar known-vulnerable patterns, then has an LLM confirm
+or rule out each finding and write a patch for the confirmed ones. It streams
+the whole run live in your terminal and prints a report at the end.
+
+The scanning runs on the **AuthTrack backend**; this CLI is a thin, zero-dependency
+client that talks to it. You don't need Python, and you don't need the scanners
+installed locally.
+
+[Semgrep]: https://semgrep.dev
+[Bearer]: https://www.bearer.com
+[OSV-Scanner]: https://google.github.io/osv-scanner/
+[Gitleaks]: https://github.com/gitleaks/gitleaks
+[CodeQL]: https://codeql.github.com
+
+---
+
+## Install
+
+```bash
+npm install -g @authtrack/secura
+```
+
+Or run it once, without installing:
+
+```bash
+npx @authtrack/secura scan .
+```
+
+Requires **Node ≥ 18**. No build step, no native modules.
+
+## Quick start
+
+```bash
+# Scan the current directory
+secura scan .
+
+# Scan a public GitHub repo (the backend clones it)
+secura scan owner/repo
+secura scan https://github.com/owner/repo
+
+# Fast pass — skip CodeQL (its database build dominates the run)
+secura scan . --fast
+
+# CI gate: exit non-zero if anything HIGH or worse is confirmed
+secura scan . --fail-on high
+
+# Save the full machine-readable report
+secura scan . --json report.json
+```
+
+## Targets
+
+| Target | What happens |
+| --- | --- |
+| `.` or `./path/to/repo` | A local folder. Sent to the backend to scan (see [Backend](#backend)). |
+| `owner/repo` | Public GitHub shorthand. The backend shallow-clones it, scans, then deletes it. |
+| `https://github.com/owner/repo`, `git@…`, `ssh://…` | Any public Git URL. Cloned by the backend. |
+
+For a local path, how the code reaches the backend depends on where the backend runs:
+
+- **Local backend** (the default, `http://localhost:8000`): the absolute path is
+  sent as-is and scanned in place — nothing is copied.
+- **Remote backend** (a `--api` that isn't localhost), or **`--upload`**: the
+  directory is packaged into a `tar.gz` (excluding `node_modules`, `.git`, build
+  output, lockfiles, minified assets, …) and uploaded. Requires `tar` on your
+  PATH (bundled with Windows 10 1803+, macOS and Linux). If `tar` is missing,
+  scan a Git URL instead.
+
+## Options
+
+```
+-f, --fast                 Skip CodeQL (its DB build dominates the run).
+-l, --language <lang>      CodeQL language (javascript, python, java, go, ruby,
+                           csharp, cpp). Auto-detected when omitted.
+-t, --max-triage <n>       Cap findings sent to LLM triage (default 25).
+    --fail-on <sev>        Exit 1 if a confirmed finding is >= this severity
+                           (critical|high|medium|low). For CI gates.
+-o, --json <path>          Write the full report as JSON to <path>.
+    --max-findings <n>     How many confirmed findings to print (default 20).
+    --show-fixes           Print the generated fix diffs in full.
+-q, --quiet                Suppress the live view; print only the report.
+    --api <url>            Backend base URL (default $SECURA_API or
+                           http://localhost:8000/api/v1).
+    --token <token>        Bearer token, if the backend requires one
+                           (default $SECURA_TOKEN).
+    --upload               Package and upload the local dir even for a local
+                           backend (automatic for a remote --api).
+```
+
+### Exit codes
+
+| Code | Meaning |
+| --- | --- |
+| `0` | Completed; no `--fail-on` breach. |
+| `1` | `--fail-on` gate breached (a confirmed finding at or above the threshold). |
+| `2` | Bad target, or the scan failed. |
+| `130` | Interrupted (Ctrl-C). |
+
+## Backend
+
+`secura` needs a reachable AuthTrack backend. Point it at one with `--api` or the
+`SECURA_API` environment variable (matching the web app's `NEXT_PUBLIC_API_URL`):
+
+```bash
+export SECURA_API="https://scans.example.com/api/v1"
+secura scan owner/repo
+```
+
+The default is `http://localhost:8000/api/v1`. The scan endpoints are unauthenticated;
+`--token` / `SECURA_TOKEN` is sent as a bearer header only if provided, so it keeps
+working if auth is added later.
+
+## CI example
+
+```yaml
+# GitHub Actions — fail the build on a confirmed high+ finding
+- name: SAST
+  run: npx @authtrack/secura scan . --fast --fail-on high --json sast.json
+  env:
+    SECURA_API: ${{ secrets.SECURA_API }}
+```
+
+---
+
+## MCP Server (`secura-mcp`)
+
+After `npm install -g @authtrack/secura`, a second command `secura-mcp` is also installed.
+**You never run it yourself** — your AI editor runs it automatically as a background subprocess
+and exposes its tools to the AI assistant.
+
+### Tools exposed
+
+| Tool | What it does |
+|------|-------------|
+| `run_static_scan` | SAST — Semgrep, Bearer, OSV-Scanner, Gitleaks, CodeQL + AI triage |
+| `run_recon` | Surface mapping — crawl & classify endpoints |
+| `run_header_audit` | OWASP security-header & cookie audit |
+
+### Claude Code setup
+
+Create or edit `~/.claude/claude_desktop_config.json` (or the path shown in Claude's settings):
+
+```json
+{
+  "mcpServers": {
+    "secura": {
+      "command": "secura-mcp",
+      "env": {
+        "SECURA_API": "http://localhost:8000/api/v1",
+        "SECURA_TOKEN": "<your-jwt-if-needed>"
+      }
+    }
+  }
+}
+```
+
+### Cursor setup
+
+Open **Cursor → Settings → Features → MCP** and add:
+
+```json
+{
+  "secura": {
+    "command": "secura-mcp",
+    "env": {
+      "SECURA_API": "http://localhost:8000/api/v1",
+      "SECURA_TOKEN": "<your-jwt-if-needed>"
+    }
+  }
+}
+```
+
+### Usage (after setup)
+
+Just talk to your AI assistant as normal — it will automatically call the tools when relevant:
+
+```
+"Check this repo for vulnerabilities"
+→ AI calls run_static_scan({ target_path: "." })
+
+"Map the attack surface of https://example.com"
+→ AI calls run_recon({ url: "https://example.com" })
+
+"Audit the security headers on my staging server"
+→ AI calls run_header_audit({ url: "https://staging.example.com" })
+```
+
+### Environment variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `SECURA_API` | `https://securaai-major-project.onrender.com/api/v1` | Backend base URL |
+| `SECURA_TOKEN` | _(empty)_ | Bearer token for authenticated backends |
+
+---
+
+
+
+This package publishes from the `cli/` directory of the AuthTrack repo. It is
+plain ESM with no build step, so publishing is just:
+
+```bash
+cd cli
+npm login                     # once per machine
+npm version patch             # 0.1.0 -> 0.1.1 (bumps package.json + git tag)
+npm publish --access public   # scoped packages need --access public on first publish
+```
+
+Notes:
+
+- **Scope.** The name `@authtrack/secura` requires the `@SecuraAI` org to exist
+  on npm and your account to be a member. Create it at
+  <https://www.npmjs.com/org/create>, or rename the package to an unscoped name
+  you own (e.g. `securai-secura`) in `package.json` — the `bin` stays `secura`
+  either way, so `secura scan …` is unchanged for users.
+- **What ships.** Only `bin/`, `src/` and `README.md` (the `files` allowlist).
+  Verify with `npm pack --dry-run` before publishing.
+- **Smoke test the tarball.** `npm pack` then
+  `npm i -g ./securai-secura-<version>.tgz` and run `secura --help`.
+
+## License
+
+MIT

package/bin/secura-mcp.mjs

@@ -0,0 +1,412 @@
+#!/usr/bin/env node
+/**
+ * secura-mcp — SecuraAI MCP server (stdio transport).
+ *
+ * Exposes four security-scanning tools to any MCP-capable AI editor
+ * (Claude Code, Cursor, Continue, etc.).  The editor spawns this process
+ * automatically; users never run it themselves.
+ *
+ * Tools exposed:
+ *   run_static_scan   — SAST (Semgrep, Bearer, OSV-Scanner, Gitleaks, CodeQL)
+ *   run_recon         — Surface mapping / endpoint discovery
+ *   run_header_audit  — Security-header & cookie audit
+ *   run_injection_scan — SQL / command / XSS injection testing
+ *
+ * Configuration (environment variables, all optional):
+ *   SECURA_API    — Backend base URL  (default: https://securaai-major-project.onrender.com/api/v1)
+ *   SECURA_TOKEN  — Bearer token for authenticated backends
+ *
+ * Usage in Claude Code / Cursor mcp config:
+ *   {
+ *     "mcpServers": {
+ *       "secura": {
+ *         "command": "secura-mcp",
+ *         "env": {
+ *           "SECURA_API": "http://localhost:8000/api/v1",
+ *           "SECURA_TOKEN": "<your-jwt>"
+ *         }
+ *       }
+ *     }
+ *   }
+ */
+
+import { Server }            from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+} from "@modelcontextprotocol/sdk/types.js";
+
+// ── Config ───────────────────────────────────────────────────────────────────
+
+const DEFAULT_API = "https://securaai-major-project.onrender.com/api/v1";
+
+function resolveConfig() {
+  const api   = (process.env.SECURA_API   || DEFAULT_API).replace(/\/+$/, "");
+  const token = process.env.SECURA_TOKEN  || "";
+  return { api, token };
+}
+
+function authHeaders(token, extra = {}) {
+  const h = { ...extra };
+  if (token) h.Authorization = `Bearer ${token}`;
+  return h;
+}
+
+// ── SSE streaming helpers ────────────────────────────────────────────────────
+
+async function* readSse(res) {
+  const decoder = new TextDecoder();
+  const reader  = res.body.getReader();
+  let buffer    = "";
+
+  const emit = function* (frame) {
+    for (const line of frame.split("\n")) {
+      if (!line.startsWith("data:")) continue;
+      const json = line.slice(line.indexOf(":") + 1).trim();
+      if (!json) continue;
+      try { yield JSON.parse(json); } catch { /* skip malformed */ }
+    }
+  };
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+    const frames = buffer.split("\n\n");
+    buffer = frames.pop() || "";
+    for (const f of frames) yield* emit(f);
+  }
+  const tail = buffer.trim();
+  if (tail) yield* emit(tail);
+}
+
+/**
+ * Drain an SSE stream and collect the accumulated graph state.
+ * Returns { finalState, scanId, error }.
+ */
+async function drainStream(url, token, headers, body) {
+  let res;
+  try {
+    res = await fetch(url, {
+      method:  "POST",
+      headers: authHeaders(token, headers),
+      body,
+    });
+  } catch (err) {
+    throw new Error(`Cannot reach SecuraAI backend at ${url}: ${err.message}`);
+  }
+
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new Error(`Backend error ${res.status}: ${detail.slice(0, 400)}`);
+  }
+
+  const accumulated = {};
+  let   scanId      = null;
+  let   lastError   = null;
+
+  for await (const evt of readSse(res)) {
+    if (evt.event === "node_update" && evt.state) {
+      Object.assign(accumulated, evt.state);
+    }
+    if (evt.event === "complete") {
+      scanId = evt.scan_id ?? null;
+    }
+    if (evt.event === "error") {
+      lastError = evt.message;
+    }
+  }
+
+  return { finalState: accumulated, scanId, error: lastError };
+}
+
+// ── Tool implementations ─────────────────────────────────────────────────────
+
+/** SAST — static analysis scan. */
+async function runStaticScan(args) {
+  const { api, token } = resolveConfig();
+  const body = JSON.stringify({
+    target_path:     args.target_path,
+    include_codeql:  args.include_codeql  ?? true,
+    codeql_language: args.codeql_language ?? "",
+    max_triage:      args.max_triage      ?? 25,
+  });
+
+  const { finalState, scanId, error } = await drainStream(
+    `${api}/scan/stream/static`, token,
+    { "Content-Type": "application/json" }, body,
+  );
+
+  if (error) throw new Error(error);
+
+  const report = finalState.static_report ?? {};
+  return formatStaticReport(report, scanId);
+}
+
+/** Recon — surface mapping / endpoint discovery. */
+async function runRecon(args) {
+  const { api, token } = resolveConfig();
+  const body = JSON.stringify({
+    url:       args.url,
+    max_depth: args.max_depth ?? 2,
+    max_pages: args.max_pages ?? 30,
+  });
+
+  const { finalState, scanId, error } = await drainStream(
+    `${api}/scan/stream/recon`, token,
+    { "Content-Type": "application/json" }, body,
+  );
+
+  if (error) throw new Error(error);
+
+  const report    = finalState.surface_report ?? {};
+  const endpoints = finalState.classified_endpoints ?? report.endpoints ?? [];
+  return formatReconReport(report, endpoints, scanId);
+}
+
+/** Header audit — security-header & cookie checks. */
+async function runHeaderAudit(args) {
+  const { api, token } = resolveConfig();
+  const body = JSON.stringify({
+    url:       args.url,
+    max_depth: args.max_depth ?? 2,
+    max_pages: args.max_pages ?? 30,
+  });
+
+  const { finalState, scanId, error } = await drainStream(
+    `${api}/scan/stream/full`, token,
+    { "Content-Type": "application/json" }, body,
+  );
+
+  if (error) throw new Error(error);
+
+  const auditReport   = finalState.audit_report   ?? {};
+  const surfaceReport = finalState.surface_report  ?? {};
+  return formatHeaderReport(auditReport, surfaceReport, scanId);
+}
+
+
+
+// ── Formatters ───────────────────────────────────────────────────────────────
+
+function formatStaticReport(report, scanId) {
+  const lines = [
+    "## SecuraAI Static Analysis Report",
+    "",
+    `**Target:** ${report.target ?? "unknown"}`,
+    `**Scan ID:** ${scanId ?? "n/a"}`,
+    `**Summary:** ${report.summary ?? "No summary available."}`,
+    "",
+    `| Metric | Count |`,
+    `|--------|-------|`,
+    `| Unique findings (after merge) | ${report.total_after_merge ?? 0} |`,
+    `| Confirmed vulnerabilities | ${report.confirmed_count ?? 0} |`,
+    `| Ruled out (false positives) | ${report.ruled_out_count ?? 0} |`,
+    `| Fixes generated | ${report.fixes_count ?? 0} |`,
+    `| With CodeQL taint path | ${report.with_taint_path_count ?? 0} |`,
+    "",
+  ];
+
+  const confirmed = report.confirmed_findings ?? [];
+  if (confirmed.length > 0) {
+    lines.push("### Confirmed Vulnerabilities", "");
+    confirmed.slice(0, 20).forEach((f, i) => {
+      const sev      = (f.final_severity || f.severity || "info").toUpperCase();
+      const evidence = f.taint_path      ? "taint path"
+                     : f.multi_tool_confirmed ? "multi-tool"
+                     : "single tool";
+      lines.push(
+        `**${i + 1}. [${sev}] ${f.category ?? f.rule_id}**`,
+        `- File: \`${f.file}:${f.line}\``,
+        `- Rule: \`${f.rule_id}\``,
+        `- Evidence: ${evidence}`,
+        f.triage_reason ? `- Reason: ${f.triage_reason}` : null,
+        "",
+      ).filter(Boolean);
+    });
+    if (confirmed.length > 20) lines.push(`_…and ${confirmed.length - 20} more_`, "");
+  } else {
+    lines.push("✅ No confirmed vulnerabilities found.", "");
+  }
+
+  return { content: [{ type: "text", text: lines.filter(l => l !== null).join("\n") }] };
+}
+
+function formatReconReport(report, endpoints, scanId) {
+  const lines = [
+    "## SecuraAI Recon Report",
+    "",
+    `**Target:** ${report.target_url ?? "unknown"}`,
+    `**Scan ID:** ${scanId ?? "n/a"}`,
+    `**Total Endpoints:** ${report.total_endpoints ?? endpoints.length}`,
+    `**Scanned At:** ${report.scan_timestamp ?? new Date().toISOString()}`,
+    "",
+    report.summary ? `### Summary\n\n${report.summary}\n` : null,
+    "### Endpoints Discovered",
+    "",
+    `| URL | Method | Type | Status |`,
+    `|-----|--------|------|--------|`,
+  ].filter(Boolean);
+
+  endpoints.slice(0, 50).forEach(ep => {
+    lines.push(
+      `| \`${ep.url}\` | ${ep.method ?? "GET"} | ${ep.endpoint_type ?? "unknown"} | ${ep.status_code ?? "-"} |`
+    );
+  });
+
+  if (endpoints.length > 50) lines.push(`\n_…and ${endpoints.length - 50} more endpoints_`);
+
+  return { content: [{ type: "text", text: lines.join("\n") }] };
+}
+
+function formatHeaderReport(audit, surface, scanId) {
+  const lines = [
+    "## SecuraAI Header Audit Report",
+    "",
+    `**Target:** ${audit.target_url ?? surface.target_url ?? "unknown"}`,
+    `**Scan ID:** ${scanId ?? "n/a"}`,
+    `**Total Findings:** ${audit.total_findings ?? 0}`,
+    "",
+  ];
+
+  const findings = audit.findings ?? [];
+  if (findings.length > 0) {
+    lines.push("### Findings", "");
+    findings.slice(0, 30).forEach((f, i) => {
+      const sev = (f.severity || "info").toUpperCase();
+      lines.push(
+        `**${i + 1}. [${sev}] ${f.header_name ?? f.category}**`,
+        `- URL: \`${f.url}\``,
+        `- Issue: ${f.issue ?? f.expected ?? ""}`,
+        f.recommendation ? `- Fix: ${f.recommendation}` : null,
+        "",
+      ).filter(Boolean);
+    });
+  } else {
+    lines.push("✅ No header misconfigurations found.", "");
+  }
+
+  return { content: [{ type: "text", text: lines.filter(l => l !== null).join("\n") }] };
+}
+
+
+
+// ── Tool definitions (shown to the AI) ───────────────────────────────────────
+
+const TOOLS = [
+  {
+    name:        "run_static_scan",
+    description: "Run SAST static analysis on a local code repository using Semgrep, Bearer, OSV-Scanner, Gitleaks and CodeQL. Returns confirmed vulnerabilities, false positives, and generated fixes.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        target_path: {
+          type:        "string",
+          description: "Absolute or relative path to the local repository/folder to scan. Can also be a GitHub URL (https://github.com/owner/repo) or 'owner/repo' shorthand.",
+        },
+        include_codeql: {
+          type:        "boolean",
+          description: "Include CodeQL taint analysis (slower but finds deeper data-flow issues). Default: true.",
+          default:     true,
+        },
+        codeql_language: {
+          type:        "string",
+          description: "CodeQL extractor language (javascript, python, java, go, ruby, csharp, cpp). Leave empty to auto-detect.",
+          default:     "",
+        },
+        max_triage: {
+          type:        "number",
+          description: "Maximum number of merged findings to AI-triage. Default: 25.",
+          default:     25,
+        },
+      },
+      required: ["target_path"],
+    },
+  },
+  {
+    name:        "run_recon",
+    description: "Crawl a web application and map its attack surface — discovering endpoints, classifying them (API, auth, static, etc.), and producing a surface report with an LLM-written summary.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        url: {
+          type:        "string",
+          description: "The target URL to crawl (e.g. https://example.com).",
+        },
+        max_depth: {
+          type:        "number",
+          description: "Maximum crawl depth from the seed URL. Default: 2.",
+          default:     2,
+        },
+        max_pages: {
+          type:        "number",
+          description: "Maximum number of pages to visit. Default: 30.",
+          default:     30,
+        },
+      },
+      required: ["url"],
+    },
+  },
+  {
+    name:        "run_header_audit",
+    description: "Crawl a web application and audit its HTTP security headers and cookies against OWASP best practices (CSP, HSTS, X-Frame-Options, SameSite cookies, CORS, etc.).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        url: {
+          type:        "string",
+          description: "The target URL to audit (e.g. https://example.com).",
+        },
+        max_depth: {
+          type:        "number",
+          description: "Maximum crawl depth. Default: 2.",
+          default:     2,
+        },
+        max_pages: {
+          type:        "number",
+          description: "Maximum pages to audit. Default: 30.",
+          default:     30,
+        },
+      },
+      required: ["url"],
+    },
+  },
+];
+
+// ── MCP Server setup ─────────────────────────────────────────────────────────
+
+const server = new Server(
+  { name: "secura", version: "0.1.0" },
+  { capabilities: { tools: {} } },
+);
+
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+  const { name, arguments: args } = request.params;
+
+  try {
+    switch (name) {
+      case "run_static_scan":  return await runStaticScan(args);
+      case "run_recon":        return await runRecon(args);
+      case "run_header_audit": return await runHeaderAudit(args);
+      default:
+        return {
+          content: [{ type: "text", text: `Unknown tool: ${name}` }],
+          isError: true,
+        };
+    }
+  } catch (err) {
+    return {
+      content: [{ type: "text", text: `Error: ${err.message}` }],
+      isError: true,
+    };
+  }
+});
+
+// ── Start ─────────────────────────────────────────────────────────────────────
+
+const transport = new StdioServerTransport();
+await server.connect(transport);
+// Server runs until the editor closes stdin.

package/package.json

@@ -1,46 +1,54 @@
-{
-  "name": "@authtrack/secura",
-  "version": "0.1.0",
-  "description": "AuthTrack static analysis (SAST) from the command line — streams a five-scanner scan (Semgrep, Bearer, OSV-Scanner, Gitleaks, CodeQL) from the AuthTrack backend and renders it live in your terminal.",
-  "type": "module",
-  "bin": {
-    "secura": "bin/secura.mjs"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "files": [
-    "bin",
-    "src",
-    "README.md"
-  ],
-  "keywords": [
-    "sast",
-    "static-analysis",
-    "security",
-    "semgrep",
-    "codeql",
-    "gitleaks",
-    "osv-scanner",
-    "bearer",
-    "cli",
-    "vulnerability",
-    "authtrack"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ashleyalmeida07/Authtrack-Major-Project.git",
-    "directory": "cli"
-  },
-  "homepage": "https://github.com/ashleyalmeida07/Authtrack-Major-Project#readme",
-  "bugs": {
-    "url": "https://github.com/ashleyalmeida07/Authtrack-Major-Project/issues"
-  },
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "secura": "node bin/secura.mjs"
-  }
-}
+{
+  "name": "@authtrack/secura",
+  "version": "0.1.1",
+  "description": "SecuraAI security scanner CLI and MCP server — static analysis, recon, header audit and injection testing via AI agents.",
+  "type": "module",
+  "bin": {
+    "secura": "bin/secura.mjs",
+    "secura-mcp": "bin/secura-mcp.mjs"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "bin",
+    "src",
+    "README.md"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  },
+  "keywords": [
+    "sast",
+    "static-analysis",
+    "security",
+    "semgrep",
+    "codeql",
+    "gitleaks",
+    "osv-scanner",
+    "bearer",
+    "cli",
+    "vulnerability",
+    "mcp",
+    "model-context-protocol",
+    "securai",
+    "securaai"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ashleyalmeida07/Authtrack-Major-Project.git",
+    "directory": "cli"
+  },
+  "homepage": "https://github.com/ashleyalmeida07/Authtrack-Major-Project#readme",
+  "bugs": {
+    "url": "https://github.com/ashleyalmeida07/Authtrack-Major-Project/issues"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "secura": "node bin/secura.mjs",
+    "secura-mcp": "node bin/secura-mcp.mjs"
+  }
+}

package/src/config.mjs

@@ -8,7 +8,7 @@
 
 // Matches frontend/src/lib/api.ts (API_BASE) so the CLI and the web app default
 // to the same backend.
-const DEFAULT_API = "http://localhost:8000/api/v1";
+const DEFAULT_API = "https://securaai-major-project.onrender.com/api/v1";
 
 export function resolveConfig(values) {
   const raw = values.api || process.env.SECURA_API || DEFAULT_API;