@chen_258/audit-tool 1.0.2

package/dist/audit/index.js

@@ -0,0 +1,231 @@
+import { spawn } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+/**
+ * 执行安全审计命令，获取到的审计结果格式化生成 md 文件 存入指定的输出路径
+ */
+class Audit {
+    constructor(inputPath, outputPath) {
+        Object.defineProperty(this, "inputPath", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "outputPath", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "cachedResult", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
+        this.inputPath = inputPath;
+        this.outputPath = outputPath;
+    }
+    /**
+     * 执行 npm audit --json 并返回 JSON 字符串
+     * 结果会被缓存，避免重复执行
+     */
+    command() {
+        if (this.cachedResult) {
+            return Promise.resolve(this.cachedResult);
+        }
+        return new Promise((resolve, reject) => {
+            const childProcess = spawn('npm', ['audit', '--json'], {
+                cwd: this.inputPath,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                shell: true,
+            });
+            let stdoutData = '';
+            let stderrData = '';
+            childProcess.stdout.on('data', (data) => {
+                stdoutData += data.toString();
+            });
+            childProcess.stderr.on('data', (data) => {
+                stderrData += data.toString();
+            });
+            childProcess.on('close', (code) => {
+                if (code === 0 || code === 1) {
+                    try {
+                        JSON.parse(stdoutData);
+                        this.cachedResult = stdoutData;
+                        resolve(stdoutData);
+                    }
+                    catch (error) {
+                        process.stderr.write(`JSON 解析失败，stderr 内容: ${stderrData}\n`);
+                        reject(new Error(`JSON 解析失败: ${error.message}\n原始输出前500字符: ${stdoutData.substring(0, 500)}`));
+                    }
+                }
+                else {
+                    reject(new Error(`npm audit 执行失败，退出码: ${code}\nstderr: ${stderrData}`));
+                }
+            });
+            childProcess.on('error', (err) => {
+                reject(new Error(`npm audit 启动失败: ${err.message}`));
+            });
+        });
+    }
+    async jsonFormat() {
+        const result = await this.command();
+        const jsonPath = path.join(this.inputPath, 'audit.json');
+        await fs.promises.writeFile(jsonPath, JSON.stringify(JSON.parse(result), null, 2));
+        process.stderr.write(`JSON 结果已保存到: ${jsonPath}\n`);
+    }
+    async generateMarkdownReport() {
+        try {
+            const result = await this.command();
+            const auditData = JSON.parse(result);
+            // 获取项目根目录名称
+            const projectName = path.basename(this.inputPath);
+            // 创建 Markdown 内容
+            let markdown = `# ${projectName} 项目安全审计报告\n\n`;
+            markdown += `**生成时间:** ${new Date().toLocaleString()}\n`;
+            markdown += `**审计路径:** ${process.cwd()}\n\n`;
+            // 漏洞统计 — 兼容 npm audit JSON 格式
+            const vulnerabilities = auditData.vulnerabilities || {};
+            const metadata = auditData.metadata || {};
+            const stats = metadata.vulnerabilities || {};
+            // 处理无漏洞场景（npm 可能返回空 vulnerabilities 且无 metadata）
+            const vulnCount = Object.keys(vulnerabilities).length;
+            if (vulnCount === 0 && (!stats.total || stats.total === 0)) {
+                markdown += `## 审计结果\n\n`;
+                markdown += `**未发现安全漏洞。** 所有依赖均通过安全审计。\n\n`;
+            }
+            else {
+                markdown += `## 漏洞统计\n\n`;
+                markdown += `| 严重程度 | 数量 |\n`;
+                markdown += `|----------|------|\n`;
+                markdown += `| **严重** | ${stats.critical || 0} |\n`;
+                markdown += `| **高危** | ${stats.high || 0} |\n`;
+                markdown += `| **中危** | ${stats.moderate || 0} |\n`;
+                markdown += `| **低危** | ${stats.low || 0} |\n`;
+                markdown += `| **信息** | ${stats.info || 0} |\n`;
+                markdown += `| **总计** | ${stats.total || vulnCount} |\n\n`;
+                // 按严重程度分组漏洞
+                const vulnerabilitiesBySeverity = {};
+                Object.entries(vulnerabilities).forEach(([key, vuln]) => {
+                    const severity = vuln.severity || 'unknown';
+                    if (!vulnerabilitiesBySeverity[severity]) {
+                        vulnerabilitiesBySeverity[severity] = [];
+                    }
+                    vulnerabilitiesBySeverity[severity].push({
+                        key,
+                        ...vuln
+                    });
+                });
+                // 严重程度排序（从高到低）
+                const severityOrder = ['critical', 'high', 'moderate', 'low', 'info', 'unknown'];
+                severityOrder.forEach(severity => {
+                    const vulnList = vulnerabilitiesBySeverity[severity];
+                    if (vulnList && vulnList.length > 0) {
+                        const severityZh = {
+                            'critical': '严重',
+                            'high': '高危',
+                            'moderate': '中危',
+                            'low': '低危',
+                            'info': '信息',
+                            'unknown': '未知'
+                        }[severity] || severity;
+                        markdown += `## ${severityZh} 漏洞\n\n`;
+                        vulnList.forEach((vuln, index) => {
+                            markdown += `### ${index + 1}. ${vuln.name} (${vuln.key})\n\n`;
+                            markdown += `**漏洞编号:** ${vuln.via?.[0]?.url || vuln.via?.[0]?.id || vuln.via?.[0]?.title || 'N/A'}\n\n`;
+                            if (vuln.cvss?.score) {
+                                markdown += `**CVSS 分数:** ${vuln.cvss.score}\n`;
+                                markdown += `**CVSS 等级:** ${vuln.cvss.severity}\n\n`;
+                            }
+                            markdown += `**漏洞等级:** ${vuln.severity}\n`;
+                            markdown += `**依赖路径:** \`${vuln.effects?.join(' → ') || vuln.key}\`\n`;
+                            markdown += `**受影响的版本:** ${vuln.range}\n`;
+                            markdown += `**修复版本:** ${vuln.fixAvailable?.name ? `${vuln.fixAvailable.name}@${vuln.fixAvailable.version}` : '暂无修复'}\n\n`;
+                            markdown += `**依赖关系:**\n`;
+                            if (vuln.nodes && vuln.nodes.length > 0) {
+                                vuln.nodes.forEach((node) => {
+                                    markdown += `- ${node}\n`;
+                                });
+                            }
+                            else {
+                                markdown += `- 直接依赖\n`;
+                            }
+                            markdown += `\n`;
+                            if (vuln.range === '*' || vuln.range === '>=0.0.0') {
+                                markdown += `⚠️ **警告:** 此依赖影响所有版本\n\n`;
+                            }
+                        });
+                    }
+                });
+            }
+            // 修复建议
+            markdown += `## 修复建议\n\n`;
+            if (auditData.actions && auditData.actions.length > 0) {
+                auditData.actions.forEach((action, index) => {
+                    markdown += `${index + 1}. **${action.action}**\n`;
+                    if (action.resolves && action.resolves.length > 0) {
+                        action.resolves.forEach((resolve) => {
+                            markdown += `   - 修复 \`${resolve.id}\`: ${resolve.path}\n`;
+                        });
+                    }
+                    markdown += `\n`;
+                });
+            }
+            else {
+                markdown += `1. 运行 \`npm audit fix\` 自动修复可修复的漏洞\n`;
+                markdown += `2. 运行 \`npm audit fix --force\` 强制修复所有漏洞（可能有破坏性变更）\n`;
+                markdown += `3. 手动更新受影响包的版本\n\n`;
+            }
+            // 保存 Markdown 文件
+            let mdPath;
+            if (this.outputPath) {
+                try {
+                    const stat = await fs.promises.stat(this.outputPath);
+                    if (stat.isDirectory()) {
+                        mdPath = path.join(this.outputPath, 'audit.md');
+                    }
+                    else {
+                        mdPath = this.outputPath;
+                    }
+                }
+                catch (error) {
+                    if (this.outputPath.endsWith('/') || this.outputPath.endsWith('\\')) {
+                        mdPath = path.join(this.outputPath, 'audit.md');
+                    }
+                    else {
+                        mdPath = this.outputPath;
+                    }
+                }
+            }
+            else {
+                mdPath = path.join(this.inputPath, 'audit.md');
+            }
+            const dir = path.dirname(mdPath);
+            if (!fs.existsSync(dir)) {
+                await fs.promises.mkdir(dir, { recursive: true });
+            }
+            await fs.promises.writeFile(mdPath, markdown, 'utf-8');
+            process.stderr.write(`Markdown 报告已生成: ${mdPath}\n`);
+            return markdown;
+        }
+        catch (error) {
+            process.stderr.write(`生成 Markdown 报告失败: ${error}\n`);
+            throw error;
+        }
+    }
+    async run() {
+        process.stderr.write('开始安全审计...\n');
+        await this.jsonFormat();
+        const report = await this.generateMarkdownReport();
+        process.stderr.write('安全审计完成，Markdown 报告已生成！\n');
+        return report;
+    }
+}
+export async function audit(inputPath, outputPath) {
+    const auditInstance = new Audit(inputPath, outputPath);
+    const report = await auditInstance.run();
+    process.stderr.write('审计函数执行完成，程序可以继续...\n');
+    return report;
+}

package/dist/common/utils.js

@@ -0,0 +1,46 @@
+import { fileURLToPath } from 'url';
+import { dirname } from 'path';
+import child_process from 'child_process';
+/**
+ * 获取当前文件的目录名
+ * @param importMetaUrl - import.meta.url 的值
+ * @returns 当前文件的目录路径
+ */
+export function getDirname(importMetaUrl) {
+    const __filename = fileURLToPath(importMetaUrl);
+    return dirname(__filename);
+}
+/**
+ * 生成唯一ID
+ * @returns 唯一标识符字符串
+ */
+export function uniqueId() {
+    return Date.now().toString(36) + Math.random().toString(36).substring(2);
+}
+/**
+ * 执行shell命令
+ * @param command - 要执行的shell命令
+ * @param options - 执行选项
+ * @returns 执行结果
+ */
+export function runCommand(command, args, options) {
+    return new Promise((resolve, reject) => {
+        const proc = child_process.spawn(command, args, {
+            cwd: options.path,
+            stdio: 'inherit',
+            shell: true,
+            ...options
+        });
+        proc.on('close', (code) => {
+            if (code === 0) {
+                resolve(code);
+            }
+            else {
+                reject(new Error(`命令执行失败，退出码: ${code}`));
+            }
+        });
+        proc.on('error', (err) => {
+            reject(err);
+        });
+    });
+}

package/dist/entry/index.js

@@ -0,0 +1,26 @@
+import { createPageJson, getPageJson } from '../package-json/index.js';
+import { createWorkDir, deleteWorkDir } from '../file/index.js';
+import { audit } from '../audit/index.js';
+/**
+ * CLI 入口 — 独立运行模式
+ * 直接在终端执行安全审计，结果输出为 Markdown 文件
+ *
+ * MCP 模式请使用: npm run mcp:start
+ */
+async function main(url) {
+    const workDir = await createWorkDir(); // 创建临时目录
+    // 获取本地或者远程工程文件的package.json
+    const resJson = await getPageJson(url);
+    //在工作目录生成临时的package.json（使用 pnpm 生成 lock 文件）
+    await createPageJson(workDir, resJson);
+    //安全审计 进入临时目录 执行 pnpm audit 执行安全审计
+    await audit(workDir, './audit.md');
+    await deleteWorkDir(workDir); // 删除临时目录
+}
+// 测试本地项目
+main('https://raw.githubusercontent.com/djdjjsfsks/manage/main').then(() => {
+    console.log('✅ 程序执行完毕');
+}).catch((error) => {
+    console.error('❌ 程序执行失败:', error.message);
+    process.exit(1);
+});

package/dist/file/index.js

@@ -0,0 +1,15 @@
+import fs from 'fs';
+import { join } from 'path';
+import { uniqueId, getDirname } from '../common/utils';
+const __dirname = getDirname(import.meta.url); // 获取当前文件的目录名
+const basePath = join(__dirname, './'); // 获取上级目录
+const workBasePath = join(basePath, 'work'); // 定义工作目录路径
+fs.mkdirSync(workBasePath, { recursive: true }); // 确保工作目录存在
+export async function createWorkDir() {
+    const workDir = join(workBasePath, uniqueId());
+    await fs.promises.mkdir(workDir, { recursive: true }); // 创建工作目录
+    return workDir;
+}
+export async function deleteWorkDir(workDir) {
+    await fs.promises.rm(workDir, { recursive: true, force: true });
+}

package/dist/mcp/index.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createAuditServer } from './server.js';
+async function main() {
+    const server = createAuditServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    process.stderr.write('[mcp] npm-audit-server 已启动，等待客户端连接...\n');
+}
+main().catch((error) => {
+    process.stderr.write(`[mcp] 启动失败: ${error.message}\n`);
+    process.exit(1);
+});

package/dist/mcp/server.js

@@ -0,0 +1,63 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { createPageJson, getPageJson } from '../package-json/index.js';
+import { createWorkDir, deleteWorkDir } from '../file/index.js';
+import { audit } from '../audit/index.js';
+import path from 'path';
+import fs from 'fs';
+export function createAuditServer() {
+    const server = new McpServer({
+        name: 'npm-audit-server',
+        version: '1.0.0',
+        description: 'Node.js 项目依赖安全审计服务，基于 npm audit 对项目进行漏洞扫描',
+    });
+    server.tool('audit-project', '对指定 Node.js 项目执行依赖安全审计，返回 Markdown 格式的漏洞报告。支持远程 GitHub URL 或本地项目路径。', {
+        project_url: z.string().describe('项目的远程 URL（如 GitHub raw 地址）或本地项目绝对路径'),
+    }, async ({ project_url }) => {
+        let workDir = null;
+        try {
+            // 判断 project_url 是本地路径还是远程 URL
+            const isLocal = fs.existsSync(project_url);
+            let targetDir;
+            if (isLocal) {
+                // 本地路径：report 写入目标项目根目录
+                targetDir = path.resolve(project_url);
+            }
+            else {
+                // 远程 URL：report 写入 MCP 客户端工作目录（调用方项目）
+                targetDir = process.cwd();
+            }
+            // 1. 创建临时工作目录
+            workDir = await createWorkDir();
+            // 2. 获取目标项目的 package.json
+            const pkgJson = await getPageJson(project_url);
+            // 3. 在临时目录写入 package.json，优先复制源项目 lock 文件
+            const sourcePath = isLocal ? path.resolve(project_url) : undefined;
+            await createPageJson(workDir, pkgJson, sourcePath);
+            // 4. 执行 npm audit 并生成 Markdown 报告到目标目录
+            const reportPath = path.join(targetDir, 'audit.md');
+            const report = await audit(workDir, reportPath);
+            return {
+                content: [{ type: 'text', text: report }],
+            };
+        }
+        catch (error) {
+            return {
+                content: [{ type: 'text', text: `审计失败: ${error.message}` }],
+                isError: true,
+            };
+        }
+        finally {
+            // 5. 无论成功失败，清理临时目录
+            if (workDir) {
+                try {
+                    await deleteWorkDir(workDir);
+                }
+                catch {
+                    // 清理失败不影响返回结果
+                }
+            }
+        }
+    });
+    return server;
+}

package/dist/package-json/index.js

@@ -0,0 +1,68 @@
+import path from 'path';
+import fs from 'fs';
+import { runCommand } from '../common/utils';
+/**
+ * 获取package.json 文件内容
+ * @param url 判断当前项目的路径是远程还是本地
+ * @returns 返回获取到的package.json 文件内容
+ */
+export async function getPageJson(url) {
+    if (url.startsWith('http://') || url.startsWith('https://')) {
+        // 处理远程URL
+        return getRemotePageJson(url);
+    }
+    else {
+        // 处理本地路径
+        return getLocalPageJson(url);
+    }
+}
+/**
+ * 获取本地package.json 文件内容
+ * @param projectPath 本地路径
+ * @returns 返回获取到的package.json 文件内容
+ */
+async function getLocalPageJson(projectPath) {
+    const packageJsonPath = path.join(projectPath, 'package.json');
+    const packageJson = await fs.promises.readFile(packageJsonPath, 'utf8');
+    return JSON.parse(packageJson);
+}
+/**
+ * 获取远程package.json 文件内容 比如gitHub
+ * @param url 远程URL
+ * @returns 返回获取到的package.json 文件内容
+ * https://github.com/djdjjsfsks/manage/blob/main
+ */
+async function getRemotePageJson(url) {
+    const response = await fetch(`${url}/package.json`);
+    if (!response.ok) {
+        throw new Error(`Failed to fetch package.json from ${url}`);
+    }
+    const packageJson = await response.text();
+    return JSON.parse(packageJson);
+}
+/**
+ * 创建package.json 文件，优先复制源项目的 package-lock.json，
+ * 仅在无 lock 文件时才执行 npm install 生成
+ * @param workDir 工作目录路径
+ * @param val 页面配置对象
+ * @param sourcePath 源项目路径（用于查找已有的 lock 文件）
+ */
+export async function createPageJson(workDir, val, sourcePath) {
+    const packageJsonPath = path.join(workDir, 'package.json');
+    await fs.promises.writeFile(packageJsonPath, JSON.stringify(val, null, 2));
+    const lockFileName = 'package-lock.json';
+    const sourceLockPath = sourcePath ? path.join(sourcePath, lockFileName) : null;
+    const workLockPath = path.join(workDir, lockFileName);
+    // 优先复制源项目已有的 lock 文件，跳过耗时的 npm install
+    if (sourceLockPath && fs.existsSync(sourceLockPath)) {
+        await fs.promises.copyFile(sourceLockPath, workLockPath);
+        process.stderr.write(`[mcp] 已复制 ${lockFileName}，跳过 npm install\n`);
+    }
+    else {
+        // 无 lock 文件时才生成，添加优化标志加速
+        await runCommand('npm', [
+            'install', '--package-lock-only', '--force',
+            '--ignore-scripts', '--no-audit', '--no-fund',
+        ], { path: workDir });
+    }
+}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@chen_258/audit-tool",
+  "version": "1.0.2",
+  "type": "module",
+  "main": "./dist/mcp/index.js",
+  "bin": {
+    "audit-tool": "./dist/mcp/index.js"
+  },
+  "files": [
+    "dist/"
+  ],
+  "engines": {
+    "node": "16.0.0"
+  },
+  "description": "基于 npm audit 的 MCP 安全审计服务器",
+  "keywords": ["mcp", "npm-audit", "security", "vulnerability"],
+  "license": "MIT",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc && vite build",
+    "preview": "vite preview",
+    "start": "tsx src/entry/index.ts",
+    "dev:ts": "tsx src/entry/index.ts",
+    "build:ts": "tsc --project tsconfig.tsnode.json",
+    "run:js": "node dist/entry/index.js",
+    "mcp:start": "tsx src/mcp/index.ts",
+    "prepublishOnly": "npm run build:ts"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.27.1",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "ts-node": "^10.9.2",
+    "tsx": "^4.19.2",
+    "typescript": "~5.9.3",
+    "vite": "^8.0.1"
+  }
+}