@briefgate/mcp 0.1.0

package/dist/webhook.d.ts

@@ -0,0 +1,54 @@
+export type BriefGateWebhookEventType = 'item.submitted' | 'intake.completed' | 'client.viewed' | 'chase.bounced' | 'intake.stalled';
+interface BaseEvent {
+    event: BriefGateWebhookEventType;
+    intake_id: string;
+    account_id: string;
+    created_at: string;
+}
+export interface ItemSubmittedEvent extends BaseEvent {
+    event: 'item.submitted';
+    item_key: string;
+    item_status: 'submitted';
+}
+export interface IntakeCompletedEvent extends BaseEvent {
+    event: 'intake.completed';
+}
+export interface ClientViewedEvent extends BaseEvent {
+    event: 'client.viewed';
+    client_email: string;
+}
+export interface ChaseBounced extends BaseEvent {
+    event: 'chase.bounced';
+    channel: 'email' | 'sms';
+    reason?: string;
+}
+export interface IntakeStalledEvent extends BaseEvent {
+    event: 'intake.stalled';
+    attempts: number;
+}
+export type BriefGateWebhookEvent = ItemSubmittedEvent | IntakeCompletedEvent | ClientViewedEvent | ChaseBounced | IntakeStalledEvent;
+/**
+ * Verify a BriefGate webhook delivery.
+ *
+ * BriefGate signs each webhook body with HMAC-SHA256 over `${t}.${rawBody}`
+ * and sends the result in `X-BriefGate-Signature` as `t=<unix>,v1=<hex>`.
+ *
+ * This function performs a timing-safe comparison and rejects requests whose
+ * timestamp falls outside the tolerance window (replay protection).
+ *
+ * @param secret    Webhook secret configured in the BriefGate dashboard.
+ * @param header    Value of the `X-BriefGate-Signature` header.
+ * @param rawBody   Raw request body string — do not JSON-parse before passing.
+ * @param opts      Optional: toleranceSec (default 300).
+ * @returns true if the signature is valid and the timestamp is fresh.
+ */
+export declare function verifyWebhookSignature(secret: string, header: string, rawBody: string, opts?: {
+    toleranceSec?: number;
+}): boolean;
+/**
+ * Parse and type a webhook event from a raw body string.
+ * Throws if the body is not valid JSON or the event field is missing.
+ */
+export declare function parseWebhookEvent(rawBody: string): BriefGateWebhookEvent;
+export {};
+//# sourceMappingURL=webhook.d.ts.map

package/dist/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,yBAAyB,GACjC,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,eAAe,GACf,gBAAgB,CAAC;AAErB,UAAU,SAAS;IACjB,KAAK,EAAE,yBAAyB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAqB,SAAQ,SAAS;IACrD,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,KAAK,EAAE,eAAe,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,OAAO,GAAG,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,qBAAqB,GAC7B,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,YAAY,GACZ,kBAAkB,CAAC;AAIvB;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/B,OAAO,CA2BT;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAmBxE"}

package/dist/webhook.js

@@ -0,0 +1,94 @@
+// Webhook signature verification and event parsing.
+//
+// Export path: @briefgate/mcp/webhook
+// This module is kept separate so consumers can import it without pulling in
+// the full MCP server and its SDK dependencies.
+import { createHmac, timingSafeEqual } from 'node:crypto';
+// ─── Signature verification ───────────────────────────────────────────────────
+/**
+ * Verify a BriefGate webhook delivery.
+ *
+ * BriefGate signs each webhook body with HMAC-SHA256 over `${t}.${rawBody}`
+ * and sends the result in `X-BriefGate-Signature` as `t=<unix>,v1=<hex>`.
+ *
+ * This function performs a timing-safe comparison and rejects requests whose
+ * timestamp falls outside the tolerance window (replay protection).
+ *
+ * @param secret    Webhook secret configured in the BriefGate dashboard.
+ * @param header    Value of the `X-BriefGate-Signature` header.
+ * @param rawBody   Raw request body string — do not JSON-parse before passing.
+ * @param opts      Optional: toleranceSec (default 300).
+ * @returns true if the signature is valid and the timestamp is fresh.
+ */
+export function verifyWebhookSignature(secret, header, rawBody, opts) {
+    const toleranceSec = opts?.toleranceSec ?? 300;
+    const parsed = parseSignatureHeader(header);
+    if (!parsed)
+        return false;
+    const { t, v1 } = parsed;
+    // Reject requests outside the replay-protection window.
+    const nowSec = Math.floor(Date.now() / 1000);
+    if (Math.abs(nowSec - t) > toleranceSec)
+        return false;
+    // Recompute HMAC over the same payload the server signed.
+    const payload = `${t}.${rawBody}`;
+    const actualHex = createHmac('sha256', secret).update(payload).digest('hex');
+    // Timing-safe comparison prevents side-channel attacks that infer the
+    // correct signature from response time differences.
+    try {
+        const expected = Buffer.from(v1, 'hex');
+        const actual = Buffer.from(actualHex, 'hex');
+        // Lengths must match before timingSafeEqual; a length mismatch would
+        // itself leak information, so we compare lengths first then reject.
+        if (expected.length !== actual.length)
+            return false;
+        return timingSafeEqual(expected, actual);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Parse and type a webhook event from a raw body string.
+ * Throws if the body is not valid JSON or the event field is missing.
+ */
+export function parseWebhookEvent(rawBody) {
+    let parsed;
+    try {
+        parsed = JSON.parse(rawBody);
+    }
+    catch {
+        throw new Error('Webhook body is not valid JSON.');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error('Webhook body must be a JSON object.');
+    }
+    const obj = parsed;
+    if (typeof obj['event'] !== 'string' || typeof obj['intake_id'] !== 'string') {
+        throw new Error('Webhook event is missing required fields: event, intake_id.');
+    }
+    return obj;
+}
+// ─── Internal helpers ─────────────────────────────────────────────────────────
+function parseSignatureHeader(header) {
+    // Expected format: t=1234567890,v1=abcdef0123...
+    const parts = {};
+    for (const segment of header.split(',')) {
+        const eq = segment.indexOf('=');
+        if (eq === -1)
+            return null;
+        parts[segment.slice(0, eq).trim()] = segment.slice(eq + 1).trim();
+    }
+    const tStr = parts['t'];
+    const v1 = parts['v1'];
+    if (!tStr || !v1)
+        return null;
+    const t = parseInt(tStr, 10);
+    if (isNaN(t))
+        return null;
+    // Reject obviously wrong hex lengths (SHA-256 = 64 hex chars).
+    if (v1.length !== 64)
+        return null;
+    return { t, v1 };
+}
+//# sourceMappingURL=webhook.js.map

package/dist/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,sCAAsC;AACtC,6EAA6E;AAC7E,gDAAgD;AAEhD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAmD1D,iFAAiF;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,MAAc,EACd,OAAe,EACf,IAAgC;IAEhC,MAAM,YAAY,GAAG,IAAI,EAAE,YAAY,IAAI,GAAG,CAAC;IAE/C,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;IAEzB,wDAAwD;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,YAAY;QAAE,OAAO,KAAK,CAAC;IAEtD,0DAA0D;IAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE7E,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7C,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACpD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,GAAuC,CAAC;AACjD,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB,CAAC,MAAc;IAC1C,iDAAiD;IACjD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1B,+DAA+D;IAC/D,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAElC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AACnB,CAAC"}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@briefgate/mcp",
+  "version": "0.1.0",
+  "mcpName": "io.github.sekera-radim/briefgate",
+  "description": "BriefGate MCP server — your coding agent asks the client for logos, copy and credentials, and BriefGate chases them until they arrive.",
+  "keywords": [
+    "mcp",
+    "briefgate",
+    "client-intake",
+    "onboarding",
+    "ai-agent",
+    "claude-code",
+    "freelance"
+  ],
+  "license": "MIT",
+  "author": "Radim Sekera",
+  "homepage": "https://briefgate.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/sekera.radim/briefgate.git",
+    "directory": "mcp"
+  },
+  "bugs": {
+    "url": "https://gitlab.com/sekera.radim/briefgate/-/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "exports": {
+    ".": "./dist/index.js",
+    "./webhook": "./dist/webhook.js"
+  },
+  "bin": {
+    "briefgate-mcp": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsx watch src/index.ts",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src test",
+    "test": "vitest run",
+    "check": "npm run typecheck && npm run lint && npm run test",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.39.0",
+    "@types/node": "^22.15.29",
+    "eslint": "^9.39.0",
+    "tsx": "^4.23.1",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.64.0",
+    "vitest": "^3.2.7"
+  }
+}