@bergabruh/code-scanner 0.1.0 → 0.1.1

package/README.md

@@ -55,22 +55,27 @@ Then invoke one of the plugin's slash commands:
 
 ### OpenCode
 
-Add the package name to the project or global `opencode.json` and restart
+Add the MCP server to the project or global `opencode.json` and restart
 OpenCode:
 
 ```json
 {
   "$schema": "https://opencode.ai/config.json",
-  "plugin": ["@bergabruh/code-scanner"]
+  "mcp": {
+    "mnogovid-code-scanner": {
+      "type": "local",
+      "command": ["npx", "--yes", "@bergabruh/code-scanner"],
+      "enabled": true
+    }
+  }
 }
 ```
 
-OpenCode installs the package through Bun. The package starts its bundled,
-dependency-free Python scanner bridge itself; no `cwd`, MCP block, or copied
-`.opencode` assets are needed. Ask OpenCode to run a workspace security scan;
-it receives the `mnogovid_code_scanner` tool and must still request every
-recorded consent. `python3` and individual scanner executables remain system
-prerequisites and are never installed by the package.
+`npx` installs and starts the bundled Python MCP server; no absolute path or
+copied `.opencode` assets are needed. OpenCode exposes its tools with the
+`mnogovid-code-scanner_` prefix and still requests every recorded consent.
+`python3` and individual scanner executables remain system prerequisites and
+are never installed by the package.
 
 ## Choose a mode
 

package/bin/mnogovid-code-scanner.mjs

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process"
+import { fileURLToPath } from "node:url"
+
+const script = fileURLToPath(new URL("../scripts/security_mcp.py", import.meta.url))
+const child = spawn(process.env.PYTHON ?? "python3", [script], { stdio: "inherit" })
+
+child.on("error", (error) => {
+  process.stderr.write(`Unable to start Mnogovid Code Scanner: ${error.message}\n`)
+  process.exitCode = 1
+})
+child.on("exit", (code, signal) => {
+  process.exitCode = code ?? (signal ? 1 : 0)
+})

package/package.json

@@ -1,14 +1,13 @@
 {
   "name": "@bergabruh/code-scanner",
-  "version": "0.1.0",
-  "description": "OpenCode plugin for consent-gated workspace security scanning.",
+  "version": "0.1.1",
+  "description": "MCP server package for consent-gated workspace security scanning.",
   "license": "Apache-2.0",
-  "type": "module",
-  "main": "./opencode.js",
-  "module": "./opencode.js",
-  "exports": "./opencode.js",
+  "bin": {
+    "mnogovid-code-scanner": "./bin/mnogovid-code-scanner.mjs"
+  },
   "files": [
-    "opencode.js",
+    "bin/*.mjs",
     "scripts/*.py",
     "README.md",
     "LICENSE"
@@ -19,11 +18,8 @@
     "security",
     "sast"
   ],
-  "devDependencies": {
-    "@opencode-ai/plugin": "^1.18.11"
-  },
   "scripts": {
-    "check": "node --check opencode.js"
+    "check": "node --check bin/mnogovid-code-scanner.mjs"
   },
   "homepage": "https://github.com/BergaBruh/mnogovid",
   "repository": {

package/opencode.js

@@ -1,115 +0,0 @@
-import { spawn } from "node:child_process"
-import { fileURLToPath } from "node:url"
-import { tool } from "@opencode-ai/plugin"
-
-const METHODS = new Set([
-  "security_catalog",
-  "security_doctor",
-  "security_bootstrap",
-  "security_plan",
-  "security_virtual_run",
-  "security_run",
-  "security_ingest",
-  "security_start_run",
-  "security_record_run",
-  "security_finalize_run",
-  "security_advisory_lookup",
-  "security_ai_triage_payload",
-])
-
-class PythonMcpBridge {
-  constructor(script) {
-    this.nextId = 1
-    this.pending = new Map()
-    this.buffer = ""
-    this.queue = Promise.resolve()
-    this.stderr = ""
-    this.child = spawn("python3", [script], { stdio: ["pipe", "pipe", "pipe"] })
-    this.child.stdout.setEncoding("utf8")
-    this.child.stdout.on("data", (chunk) => this.receive(chunk))
-    this.child.stderr.setEncoding("utf8")
-    this.child.stderr.on("data", (chunk) => {
-      this.stderr = (this.stderr + chunk).slice(-4096)
-    })
-    this.child.on("error", (error) => this.failAll(error))
-    this.child.on("exit", (code, signal) => {
-      this.failAll(new Error(`Python scanner exited (${signal ?? code ?? "unknown"})${this.stderr ? `: ${this.stderr}` : ""}`))
-    })
-    process.once("exit", () => this.child.kill())
-  }
-
-  receive(chunk) {
-    this.buffer += chunk
-    let newline
-    while ((newline = this.buffer.indexOf("\n")) >= 0) {
-      const line = this.buffer.slice(0, newline)
-      this.buffer = this.buffer.slice(newline + 1)
-      if (!line.trim()) continue
-      try {
-        const message = JSON.parse(line)
-        const pending = this.pending.get(message.id)
-        if (!pending) continue
-        this.pending.delete(message.id)
-        if (message.error) pending.reject(new Error(message.error.message ?? "Python scanner protocol error"))
-        else pending.resolve(message.result)
-      } catch (error) {
-        this.failAll(new Error(`Invalid response from Python scanner: ${error.message}`))
-      }
-    }
-  }
-
-  failAll(error) {
-    for (const { reject } of this.pending.values()) reject(error)
-    this.pending.clear()
-  }
-
-  call(method, args) {
-    const request = () => new Promise((resolve, reject) => {
-      if (this.child.exitCode !== null || this.child.killed) {
-        reject(new Error("Python scanner is unavailable; verify that python3 is installed."))
-        return
-      }
-      const id = this.nextId++
-      this.pending.set(id, { resolve, reject })
-      this.child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method: "tools/call", params: { name: method, arguments: args } })}\n`)
-    })
-    const result = this.queue.then(request, request)
-    this.queue = result.catch(() => undefined)
-    return result
-  }
-}
-
-function parseArguments(raw) {
-  try {
-    const value = JSON.parse(raw)
-    if (!value || Array.isArray(value) || typeof value !== "object") throw new Error("must be a JSON object")
-    return value
-  } catch (error) {
-    throw new Error(`argumentsJson ${error.message}`)
-  }
-}
-
-export const MnogovidCodeScanner = async () => {
-  const script = fileURLToPath(new URL("./scripts/security_mcp.py", import.meta.url))
-  const bridge = new PythonMcpBridge(script)
-
-  return {
-    tool: {
-      mnogovid_code_scanner: tool({
-        description: "Call one consent-gated Mnogovid Code Scanner operation. Valid operations: security_catalog, security_doctor, security_bootstrap, security_plan, security_virtual_run, security_run, security_ingest, security_start_run, security_record_run, security_finalize_run, security_advisory_lookup, security_ai_triage_payload. Pass argumentsJson as a JSON object. The Python core validates workspace paths, recorded lifecycle and consent before any scanner starts.",
-        args: {
-          operation: tool.schema.string(),
-          argumentsJson: tool.schema.string(),
-        },
-        async execute({ operation, argumentsJson }) {
-          if (!METHODS.has(operation)) return `Unknown Mnogovid Code Scanner operation: ${operation}`
-          try {
-            return JSON.stringify(await bridge.call(operation, parseArguments(argumentsJson)))
-          } catch (error) {
-            return JSON.stringify({ error: error.message })
-          }
-        },
-      }),
-    },
-  }
-}