@cognium-ai/mcp-server 0.2.0 → 0.3.0

package/README.md

@@ -1,9 +1,22 @@
 # @cognium-ai/mcp-server
 
-An [MCP](https://modelcontextprotocol.io) server exposing Cognium's
-spec-conformance, spec-drift, and pattern-search tools over **stdio**. Backed
-by the [`circle-ir-ai`](https://www.npmjs.com/package/circle-ir-ai) engine's
-`analyzeSpecGap`.
+An [MCP](https://modelcontextprotocol.io) server exposing Cognium's security
+scanning and spec-conformance tools over **stdio**. Backed by the
+[`circle-ir-ai`](https://www.npmjs.com/package/circle-ir-ai) engine.
+
+## Tools Overview
+
+| Tool | Category | Description |
+|------|----------|-------------|
+| `find_credential_exposure` | Pillar I | Detect hardcoded secrets (AWS, GitHub, OpenAI, etc.) |
+| `check_license_compliance` | Pillar I | Flag copyleft licenses in dependencies |
+| `find_stale_dependencies` | Pillar I | Check npm registry for outdated packages |
+| `find_install_script_risk` | Pillar I | Detect malicious install script patterns |
+| `find_typosquats` | Pillar I | Detect typosquat package names |
+| `find_excessive_permissions` | Pillar I | Audit MCP config permissions |
+| `verify_spec_conformance` | Spec | Analyze code-to-spec alignment |
+| `find_spec_drift` | Spec | Report spec/code drift |
+| `find_pattern` | Utility | Regex search over code |
 
 ## Install & run
 
@@ -31,7 +44,99 @@ Inspect it interactively:
 npx @modelcontextprotocol/inspector cognium-mcp
 ```
 
-## Tools
+## Pillar I Security Tools
+
+All Pillar I tools return a common envelope:
+
+```jsonc
+{
+  "findings": [{ "kind": "...", "severity": "...", "location": {...}, "evidence": {...}, "suggested_action": "..." }],
+  "summary": { "total": N, "by_severity": {...}, "truncated": false }
+}
+```
+
+- `location.span` is **1-indexed line numbers** `[start_line, end_line]`
+- All tools accept `severity_floor` to filter results
+
+### `find_credential_exposure`
+
+Detect hardcoded secrets using SAST pattern matching.
+
+| Input | Type | Description |
+|-------|------|-------------|
+| `code_root` | string | Absolute path to scan |
+| `include_git_history` | boolean | Scan git history (default: false) |
+| `severity_floor` | enum | Minimum severity: info/low/medium/high/critical |
+
+**Evidence:** `rule_id`, `match_snippet` (redacted), `confidence`
+
+### `check_license_compliance`
+
+Flag copyleft licenses in npm/Cargo dependencies.
+
+| Input | Type | Description |
+|-------|------|-------------|
+| `code_root` | string | Absolute path to scan |
+| `include_dev_deps` | boolean | Include devDependencies (default: false) |
+| `severity_floor` | enum | Minimum severity |
+
+**Severity:** AGPL/SSPL=critical, GPL=high, LGPL/MPL=medium, EUPL/CPAL=low
+
+### `find_stale_dependencies`
+
+Check npm registry for outdated packages.
+
+| Input | Type | Description |
+|-------|------|-------------|
+| `code_root` | string | Absolute path to scan |
+| `include_dev_deps` | boolean | Include devDependencies (default: false) |
+| `severity_floor` | enum | Minimum severity |
+
+**Severity:** >3 years=high, >2 years=medium, >1 year=low
+
+**Evidence:** `dependency`, `current_version`, `latest_version`, `days_since_publish`, `last_publish_date`
+
+### `find_install_script_risk`
+
+Detect malicious patterns in npm lifecycle scripts (preinstall, postinstall, etc.).
+
+| Input | Type | Description |
+|-------|------|-------------|
+| `code_root` | string | Absolute path to scan |
+| `severity_floor` | enum | Minimum severity |
+
+**Rules:** piped downloads (critical), eval/exec (critical), base64 decode (high), env exfiltration (high), network downloads (medium), hidden file writes (medium)
+
+### `find_typosquats`
+
+Detect typosquat package names using Levenshtein distance.
+
+| Input | Type | Description |
+|-------|------|-------------|
+| `code_root` | string | Absolute path to scan |
+| `include_dev_deps` | boolean | Include devDependencies (default: false) |
+| `severity_floor` | enum | Minimum severity |
+
+**Severity:** distance=1 is high, distance=2 is medium
+
+**Evidence:** `dependency`, `similar_to`, `distance`
+
+### `find_excessive_permissions`
+
+Audit MCP server configurations for overly broad permissions.
+
+| Input | Type | Description |
+|-------|------|-------------|
+| `code_root` | string | Absolute path to scan |
+| `severity_floor` | enum | Minimum severity |
+
+**Config formats:** skill bundle (mcp.json), Claude Desktop, Cursor
+
+**Rules:** broad filesystem paths, secret env vars, unrestricted network, dangerous commands
+
+---
+
+## Spec Tools
 
 ### `verify_spec_conformance`
 

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMpE,wBAAgB,WAAW,IAAI,SAAS,CAYvC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAWpE,wBAAgB,WAAW,IAAI,SAAS,CAsBvC"}

package/dist/server.js

@@ -6,15 +6,28 @@ import { registerVerifySpecConformance } from './tools/verify-spec-conformance.j
 import { registerFindSpecDrift } from './tools/find-spec-drift.js';
 import { registerFindPattern } from './tools/find-pattern.js';
 import { registerFindCredentialExposure } from './tools/find-credential-exposure.js';
+import { registerCheckLicenseCompliance } from './tools/check-license-compliance.js';
+import { registerFindStaleDependencies } from './tools/find-stale-dependencies.js';
+import { registerFindInstallScriptRisk } from './tools/find-install-script-risk.js';
+import { registerFindTyposquats } from './tools/find-typosquats.js';
+import { registerFindExcessivePermissions } from './tools/find-excessive-permissions.js';
 export function buildServer() {
     const server = new McpServer({
         name: 'cognium-mcp',
-        version: '0.2.0',
+        version: '0.3.0',
     });
+    // Spec tools (legacy)
     registerVerifySpecConformance(server);
     registerFindSpecDrift(server);
     registerFindPattern(server);
+    // Pillar I Batch 1
     registerFindCredentialExposure(server);
+    registerCheckLicenseCompliance(server);
+    // Pillar I Batch 2
+    registerFindStaleDependencies(server);
+    registerFindInstallScriptRisk(server);
+    registerFindTyposquats(server);
+    registerFindExcessivePermissions(server);
     return server;
 }
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,MAAM,UAAU,WAAW;IACzB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAEvC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAEzF,MAAM,UAAU,WAAW;IACzB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,sBAAsB;IACtB,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAE5B,mBAAmB;IACnB,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAEvC,mBAAmB;IACnB,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,gCAAgC,CAAC,MAAM,CAAC,CAAC;IAEzC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/tools/check-license-compliance.d.ts

@@ -0,0 +1,11 @@
+/**
+ * check_license_compliance MCP tool (Pillar I, Workflow #2).
+ *
+ * Scans a code root for copyleft/restrictive license issues in dependencies.
+ * Supports Node.js (package.json) and Rust (Cargo.toml) ecosystems.
+ *
+ * @see https://github.com/cogniumhq/cognium-ai/issues/79
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerCheckLicenseCompliance(server: McpServer): void;
+//# sourceMappingURL=check-license-compliance.d.ts.map

package/dist/tools/check-license-compliance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-license-compliance.d.ts","sourceRoot":"","sources":["../../src/tools/check-license-compliance.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA0HzE,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAsDtE"}

package/dist/tools/check-license-compliance.js

@@ -0,0 +1,125 @@
+/**
+ * check_license_compliance MCP tool (Pillar I, Workflow #2).
+ *
+ * Scans a code root for copyleft/restrictive license issues in dependencies.
+ * Supports Node.js (package.json) and Rust (Cargo.toml) ecosystems.
+ *
+ * @see https://github.com/cogniumhq/cognium-ai/issues/79
+ */
+import { z } from 'zod';
+import { scanLicenseCompliance, COPYLEFT_SEVERITY, } from 'circle-ir-ai';
+const MAX_FINDINGS = 500;
+const inputSchema = {
+    code_root: z.string().describe('Absolute path to the code root to scan'),
+    include_dev_deps: z.boolean().optional().default(false).describe('Include devDependencies (default: false)'),
+    severity_floor: z.enum(['info', 'low', 'medium', 'high', 'critical']).optional().default('low').describe('Minimum severity to report (default: low)'),
+};
+const findingSchema = z.object({
+    kind: z.literal('LICENSE_VIOLATION'),
+    severity: z.enum(['low', 'medium', 'high', 'critical']),
+    location: z.object({
+        file: z.string(),
+        span: z.tuple([z.number(), z.number()]),
+    }),
+    evidence: z.object({
+        rule_id: z.string(),
+        dependency: z.string(),
+        license: z.string(),
+        confidence: z.number(),
+    }),
+    suggested_action: z.string(),
+});
+const outputSchema = {
+    findings: z.array(findingSchema),
+    summary: z.object({
+        total: z.number(),
+        by_severity: z.object({
+            critical: z.number(),
+            high: z.number(),
+            medium: z.number(),
+            low: z.number(),
+        }),
+        by_ecosystem: z.object({
+            nodejs: z.number(),
+            rust: z.number(),
+        }),
+        truncated: z.boolean(),
+    }),
+    copyleft_reference: z.record(z.string(), z.string()).describe('Reference table: license to severity'),
+};
+const SEVERITY_ORDER = {
+    info: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+function licenseToFinding(finding) {
+    return {
+        kind: 'LICENSE_VIOLATION',
+        severity: finding.severity === 'info' ? 'low' : finding.severity,
+        location: {
+            file: finding.file,
+            span: [finding.line ?? 1, finding.line ?? 1],
+        },
+        evidence: {
+            rule_id: finding.ruleId,
+            dependency: finding.dependency,
+            license: finding.license,
+            confidence: finding.confidence,
+        },
+        suggested_action: finding.suggestedAction,
+    };
+}
+function buildCopyleftReference() {
+    const ref = {};
+    for (const [license, severity] of Object.entries(COPYLEFT_SEVERITY)) {
+        ref[license] = severity;
+    }
+    return ref;
+}
+export function registerCheckLicenseCompliance(server) {
+    server.registerTool('check_license_compliance', {
+        title: 'Check License Compliance',
+        description: 'Scan a code root for copyleft/restrictive license issues in dependencies. ' +
+            'Supports Node.js (package.json) and Rust (Cargo.toml). ' +
+            'Flags AGPL, GPL, LGPL, MPL, and other copyleft licenses with severity classification. ' +
+            'Returns findings with dependency info, license SPDX, and remediation guidance.',
+        inputSchema,
+        outputSchema,
+    }, async ({ code_root, include_dev_deps, severity_floor }) => {
+        const scanResult = await scanLicenseCompliance(code_root, {
+            includeDevDeps: include_dev_deps,
+            minSeverity: severity_floor,
+        });
+        const floorValue = SEVERITY_ORDER[severity_floor ?? 'low'];
+        const filteredFindings = scanResult.findings.filter((f) => SEVERITY_ORDER[f.severity] >= floorValue);
+        const truncated = filteredFindings.length > MAX_FINDINGS;
+        const findings = filteredFindings
+            .slice(0, MAX_FINDINGS)
+            .map(licenseToFinding);
+        const result = {
+            findings,
+            summary: {
+                total: filteredFindings.length,
+                by_severity: {
+                    critical: filteredFindings.filter((f) => f.severity === 'critical').length,
+                    high: filteredFindings.filter((f) => f.severity === 'high').length,
+                    medium: filteredFindings.filter((f) => f.severity === 'medium').length,
+                    low: filteredFindings.filter((f) => f.severity === 'low').length,
+                },
+                by_ecosystem: {
+                    nodejs: filteredFindings.filter((f) => f.ecosystem === 'nodejs').length,
+                    rust: filteredFindings.filter((f) => f.ecosystem === 'rust').length,
+                },
+                truncated,
+            },
+            copyleft_reference: buildCopyleftReference(),
+        };
+        return {
+            content: [{ type: 'text', text: JSON.stringify(result) }],
+            structuredContent: result,
+        };
+    });
+}
+//# sourceMappingURL=check-license-compliance.js.map

package/dist/tools/check-license-compliance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-license-compliance.js","sourceRoot":"","sources":["../../src/tools/check-license-compliance.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAGlB,MAAM,cAAc,CAAC;AAEtB,MAAM,YAAY,GAAG,GAAG,CAAC;AAIzB,MAAM,WAAW,GAAG;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACxE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IAC5G,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACtJ,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACxC,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;KACvB,CAAC;IACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;QACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SACjB,CAAC;QACF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;KACvB,CAAC;IACF,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;CACtG,CAAC;AAqCF,MAAM,cAAc,GAAkC;IACpD,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ;QAChE,QAAQ,EAAE;YACR,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;SAC7C;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B;QACD,gBAAgB,EAAE,OAAO,CAAC,eAAe;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAAiB;IAC9D,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,4EAA4E;YAC5E,yDAAyD;YACzD,wFAAwF;YACxF,gFAAgF;QAClF,WAAW;QACX,YAAY;KACb,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,EAAE;QACxD,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE;YACxD,cAAc,EAAE,gBAAgB;YAChC,WAAW,EAAE,cAA+B;SAC7C,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;QAC3D,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CACjD,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAyB,CAAC,IAAI,UAAU,CACjE,CAAC;QAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,GAAG,YAAY,CAAC;QACzD,MAAM,QAAQ,GAAG,gBAAgB;aAC9B,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC;aACtB,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAEzB,MAAM,MAAM,GAAiC;YAC3C,QAAQ;YACR,OAAO,EAAE;gBACP,KAAK,EAAE,gBAAgB,CAAC,MAAM;gBAC9B,WAAW,EAAE;oBACX,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;oBAC1E,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;oBAClE,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;oBACtE,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;iBACjE;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,MAAM;oBACvE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,MAAM;iBACpE;gBACD,SAAS;aACV;YACD,kBAAkB,EAAE,sBAAsB,EAAE;SAC7C,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/find-excessive-permissions.d.ts

@@ -0,0 +1,16 @@
+/**
+ * find_excessive_permissions MCP tool (Pillar I, Batch 2).
+ *
+ * Analyzes MCP server configurations for overly broad or dangerous permissions.
+ * Supports: skill bundle (mcp.json), Claude Desktop, Cursor configs.
+ *
+ * Auto-detection heuristic:
+ * - Files named mcp.json, .mcp.json, mcp-config.json → skill bundle format
+ * - claude_desktop_config.json → Claude Desktop format
+ * - .cursor/mcp.json → Cursor format
+ *
+ * @see https://github.com/cogniumhq/cognium-ai/issues/80
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerFindExcessivePermissions(server: McpServer): void;
+//# sourceMappingURL=find-excessive-permissions.d.ts.map

package/dist/tools/find-excessive-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-excessive-permissions.d.ts","sourceRoot":"","sources":["../../src/tools/find-excessive-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA6FzE,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAsDxE"}

package/dist/tools/find-excessive-permissions.js

@@ -0,0 +1,127 @@
+/**
+ * find_excessive_permissions MCP tool (Pillar I, Batch 2).
+ *
+ * Analyzes MCP server configurations for overly broad or dangerous permissions.
+ * Supports: skill bundle (mcp.json), Claude Desktop, Cursor configs.
+ *
+ * Auto-detection heuristic:
+ * - Files named mcp.json, .mcp.json, mcp-config.json → skill bundle format
+ * - claude_desktop_config.json → Claude Desktop format
+ * - .cursor/mcp.json → Cursor format
+ *
+ * @see https://github.com/cogniumhq/cognium-ai/issues/80
+ */
+import { z } from 'zod';
+import { excessivePermissionsPass } from 'circle-ir-ai';
+const MAX_FINDINGS = 500;
+const SEVERITY_ORDER = {
+    info: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+const inputSchema = {
+    code_root: z.string().describe('Absolute path to the code root to scan'),
+    severity_floor: z.enum(['info', 'low', 'medium', 'high', 'critical']).optional().default('low').describe('Minimum severity to report (default: low)'),
+};
+const outputSchema = {
+    findings: z.array(z.object({
+        kind: z.literal('EXCESSIVE_PERMISSION'),
+        severity: z.enum(['low', 'medium', 'high', 'critical']),
+        location: z.object({
+            file: z.string(),
+            span: z.tuple([z.number(), z.number()]),
+        }),
+        evidence: z.object({
+            rule_id: z.string(),
+            config_file: z.string(),
+            permission_type: z.string(),
+            value: z.string(),
+        }),
+        suggested_action: z.string(),
+    })),
+    summary: z.object({
+        total: z.number(),
+        by_severity: z.object({
+            critical: z.number(),
+            high: z.number(),
+            medium: z.number(),
+            low: z.number(),
+        }),
+        truncated: z.boolean(),
+    }),
+    detection_info: z.object({
+        config_files_checked: z.array(z.string()),
+        auto_detection_heuristic: z.string(),
+    }),
+};
+const SUGGESTED_ACTIONS = {
+    'perm-broad-filesystem': 'Restrict filesystem access to specific directories needed by the tool. Avoid /home, /Users, or ~ wildcards.',
+    'perm-secret-env-exposure': 'Remove sensitive environment variables from MCP config. Use secrets management instead.',
+    'perm-unrestricted-network': 'Restrict network access to specific hosts/ports needed by the tool.',
+    'perm-dangerous-command': 'Review and restrict allowed commands. Avoid shell interpreters and system utilities.',
+    'perm-write-sensitive-path': 'Restrict write access to user-specific directories. Avoid system paths.',
+};
+function trustFindingToMcp(f) {
+    const meta = f.meta;
+    return {
+        kind: 'EXCESSIVE_PERMISSION',
+        severity: f.severity === 'info' ? 'low' : f.severity,
+        location: {
+            file: f.location?.file ?? 'mcp.json',
+            span: [f.location?.line ?? 1, f.location?.line ?? 1],
+        },
+        evidence: {
+            rule_id: f.ruleId,
+            config_file: f.location?.file ?? 'mcp.json',
+            permission_type: meta.permissionType ?? 'unknown',
+            value: meta.value ?? '',
+        },
+        suggested_action: SUGGESTED_ACTIONS[f.ruleId] ?? 'Review this permission for security risks and apply least-privilege principle.',
+    };
+}
+export function registerFindExcessivePermissions(server) {
+    server.registerTool('find_excessive_permissions', {
+        title: 'Find Excessive Permissions',
+        description: 'Analyze MCP server configurations for overly broad permissions. ' +
+            'Detects: broad filesystem paths (/home, /Users, ~), secret env var exposure, ' +
+            'unrestricted network access, dangerous command allowlisting. ' +
+            'Auto-detects config format (skill bundle, Claude Desktop, Cursor).',
+        inputSchema,
+        outputSchema,
+    }, async ({ code_root, severity_floor }) => {
+        const result = await excessivePermissionsPass(code_root, {});
+        const floorValue = SEVERITY_ORDER[severity_floor ?? 'low'];
+        const filtered = result.findings.filter((f) => SEVERITY_ORDER[f.severity] >= floorValue);
+        const truncated = filtered.length > MAX_FINDINGS;
+        const findings = filtered.slice(0, MAX_FINDINGS).map(trustFindingToMcp);
+        const output = {
+            findings,
+            summary: {
+                total: filtered.length,
+                by_severity: {
+                    critical: filtered.filter((f) => f.severity === 'critical').length,
+                    high: filtered.filter((f) => f.severity === 'high').length,
+                    medium: filtered.filter((f) => f.severity === 'medium').length,
+                    low: filtered.filter((f) => f.severity === 'low').length,
+                },
+                truncated,
+            },
+            detection_info: {
+                config_files_checked: [
+                    'mcp.json', '.mcp.json', 'mcp-config.json',
+                    'claude_desktop_config.json', '.cursor/mcp.json',
+                ],
+                auto_detection_heuristic: 'Files named mcp.json/.mcp.json/mcp-config.json use skill bundle format. ' +
+                    'claude_desktop_config.json uses Claude Desktop format. ' +
+                    '.cursor/mcp.json uses Cursor format.',
+            },
+        };
+        return {
+            content: [{ type: 'text', text: JSON.stringify(output) }],
+            structuredContent: output,
+        };
+    });
+}
+//# sourceMappingURL=find-excessive-permissions.js.map

package/dist/tools/find-excessive-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-excessive-permissions.js","sourceRoot":"","sources":["../../src/tools/find-excessive-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,wBAAwB,EAAyC,MAAM,cAAc,CAAC;AAE/F,MAAM,YAAY,GAAG,GAAG,CAAC;AAIzB,MAAM,cAAc,GAAkC;IACpD,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACtJ,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;QACvC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACxC,CAAC;QACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;YAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;SAClB,CAAC;QACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;KAC7B,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;QACF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;KACvB,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACzC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;KACrC,CAAC;CACH,CAAC;AAeF,MAAM,iBAAiB,GAA2B;IAChD,uBAAuB,EAAE,6GAA6G;IACtI,0BAA0B,EAAE,yFAAyF;IACrH,2BAA2B,EAAE,qEAAqE;IAClG,wBAAwB,EAAE,sFAAsF;IAChH,2BAA2B,EAAE,yEAAyE;CACvG,CAAC;AAEF,SAAS,iBAAiB,CAAC,CAAe;IACxC,MAAM,IAAI,GAAG,CAAC,CAAC,IAA+B,CAAC;IAE/C,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAkD;QAC9F,QAAQ,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,UAAU;YACpC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;SACrD;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,MAAM;YACjB,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,UAAU;YAC3C,eAAe,EAAG,IAAI,CAAC,cAAyB,IAAI,SAAS;YAC7D,KAAK,EAAG,IAAI,CAAC,KAAgB,IAAI,EAAE;SACpC;QACD,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,gFAAgF;KAClI,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,MAAiB;IAChE,MAAM,CAAC,YAAY,CACjB,4BAA4B,EAC5B;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,kEAAkE;YAClE,+EAA+E;YAC/E,+DAA+D;YAC/D,oEAAoE;QACtE,WAAW;QACX,YAAY;KACb,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7D,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAyB,CAAC,IAAI,UAAU,CACjE,CAAC;QAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG;YACb,QAAQ;YACR,OAAO,EAAE;gBACP,KAAK,EAAE,QAAQ,CAAC,MAAM;gBACtB,WAAW,EAAE;oBACX,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;oBAClE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;oBAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;oBAC9D,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;iBACzD;gBACD,SAAS;aACV;YACD,cAAc,EAAE;gBACd,oBAAoB,EAAE;oBACpB,UAAU,EAAE,WAAW,EAAE,iBAAiB;oBAC1C,4BAA4B,EAAE,kBAAkB;iBACjD;gBACD,wBAAwB,EACtB,0EAA0E;oBAC1E,yDAAyD;oBACzD,sCAAsC;aACzC;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/find-install-script-risk.d.ts

@@ -0,0 +1,11 @@
+/**
+ * find_install_script_risk MCP tool (Pillar I, Batch 2).
+ *
+ * Analyzes npm package.json lifecycle scripts for suspicious patterns.
+ * Scope: npm lifecycle scripts only (preinstall, install, postinstall, prepare, etc.)
+ *
+ * @see https://github.com/cogniumhq/cognium-ai/issues/80
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerFindInstallScriptRisk(server: McpServer): void;
+//# sourceMappingURL=find-install-script-risk.d.ts.map

package/dist/tools/find-install-script-risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-install-script-risk.d.ts","sourceRoot":"","sources":["../../src/tools/find-install-script-risk.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgGzE,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA2CrE"}

package/dist/tools/find-install-script-risk.js

@@ -0,0 +1,115 @@
+/**
+ * find_install_script_risk MCP tool (Pillar I, Batch 2).
+ *
+ * Analyzes npm package.json lifecycle scripts for suspicious patterns.
+ * Scope: npm lifecycle scripts only (preinstall, install, postinstall, prepare, etc.)
+ *
+ * @see https://github.com/cogniumhq/cognium-ai/issues/80
+ */
+import { z } from 'zod';
+import { maliciousInstallScriptPass } from 'circle-ir-ai';
+const MAX_FINDINGS = 500;
+const MAX_SNIPPET_LENGTH = 200;
+const SEVERITY_ORDER = {
+    info: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+const inputSchema = {
+    code_root: z.string().describe('Absolute path to the code root to scan'),
+    severity_floor: z.enum(['info', 'low', 'medium', 'high', 'critical']).optional().default('low').describe('Minimum severity to report (default: low)'),
+};
+const outputSchema = {
+    findings: z.array(z.object({
+        kind: z.literal('MALICIOUS_INSTALL_SCRIPT'),
+        severity: z.enum(['low', 'medium', 'high', 'critical']),
+        location: z.object({
+            file: z.string(),
+            span: z.tuple([z.number(), z.number()]),
+        }),
+        evidence: z.object({
+            rule_id: z.string(),
+            script_name: z.string(),
+            script_content: z.string(),
+            pattern_matched: z.string(),
+        }),
+        suggested_action: z.string(),
+    })),
+    summary: z.object({
+        total: z.number(),
+        by_severity: z.object({
+            critical: z.number(),
+            high: z.number(),
+            medium: z.number(),
+            low: z.number(),
+        }),
+        truncated: z.boolean(),
+    }),
+};
+const SUGGESTED_ACTIONS = {
+    'install-script-piped-download': 'Remove piped download execution. If external resources are needed, download explicitly and verify checksums.',
+    'install-script-eval-exec': 'Remove dynamic code execution. Use static scripts instead of eval/exec patterns.',
+    'install-script-base64-decode': 'Remove base64 obfuscation. Install scripts should be readable and auditable.',
+    'install-script-env-exfil': 'Remove environment variable access that could leak secrets. Document required env vars instead.',
+    'install-script-network-download': 'Avoid network downloads in install scripts. Bundle dependencies or use npm dependencies.',
+    'install-script-hidden-file-write': 'Avoid writing to hidden files/directories. Use explicit, documented paths.',
+};
+function truncate(str, max) {
+    if (str.length <= max)
+        return str;
+    return str.slice(0, max - 3) + '...';
+}
+function trustFindingToMcp(f) {
+    const meta = f.meta;
+    return {
+        kind: 'MALICIOUS_INSTALL_SCRIPT',
+        severity: f.severity === 'info' ? 'low' : f.severity,
+        location: {
+            file: f.location?.file ?? 'package.json',
+            span: [f.location?.line ?? 1, f.location?.line ?? 1],
+        },
+        evidence: {
+            rule_id: f.ruleId,
+            script_name: meta.scriptName ?? 'unknown',
+            script_content: truncate(meta.scriptContent ?? '', MAX_SNIPPET_LENGTH),
+            pattern_matched: f.ruleId,
+        },
+        suggested_action: SUGGESTED_ACTIONS[f.ruleId] ?? 'Review this install script for security risks.',
+    };
+}
+export function registerFindInstallScriptRisk(server) {
+    server.registerTool('find_install_script_risk', {
+        title: 'Find Install Script Risk',
+        description: 'Analyze npm package.json lifecycle scripts (preinstall, install, postinstall, prepare) ' +
+            'for suspicious patterns: piped downloads, eval/exec, base64 decoding, env exfiltration, ' +
+            'network downloads, hidden file writes. npm lifecycle scripts only.',
+        inputSchema,
+        outputSchema,
+    }, async ({ code_root, severity_floor }) => {
+        const result = await maliciousInstallScriptPass(code_root, {});
+        const floorValue = SEVERITY_ORDER[severity_floor ?? 'low'];
+        const filtered = result.findings.filter((f) => SEVERITY_ORDER[f.severity] >= floorValue);
+        const truncated = filtered.length > MAX_FINDINGS;
+        const findings = filtered.slice(0, MAX_FINDINGS).map(trustFindingToMcp);
+        const output = {
+            findings,
+            summary: {
+                total: filtered.length,
+                by_severity: {
+                    critical: filtered.filter((f) => f.severity === 'critical').length,
+                    high: filtered.filter((f) => f.severity === 'high').length,
+                    medium: filtered.filter((f) => f.severity === 'medium').length,
+                    low: filtered.filter((f) => f.severity === 'low').length,
+                },
+                truncated,
+            },
+        };
+        return {
+            content: [{ type: 'text', text: JSON.stringify(output) }],
+            structuredContent: output,
+        };
+    });
+}
+//# sourceMappingURL=find-install-script-risk.js.map

package/dist/tools/find-install-script-risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-install-script-risk.js","sourceRoot":"","sources":["../../src/tools/find-install-script-risk.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,0BAA0B,EAAyC,MAAM,cAAc,CAAC;AAEjG,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAI/B,MAAM,cAAc,GAAkC;IACpD,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACtJ,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;QAC3C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACxC,CAAC;QACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;SAC5B,CAAC;QACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;KAC7B,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;QACF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;KACvB,CAAC;CACH,CAAC;AAeF,MAAM,iBAAiB,GAA2B;IAChD,+BAA+B,EAAE,8GAA8G;IAC/I,0BAA0B,EAAE,kFAAkF;IAC9G,8BAA8B,EAAE,8EAA8E;IAC9G,0BAA0B,EAAE,iGAAiG;IAC7H,iCAAiC,EAAE,0FAA0F;IAC7H,kCAAkC,EAAE,4EAA4E;CACjH,CAAC;AAEF,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAW;IACxC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAClC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAe;IACxC,MAAM,IAAI,GAAG,CAAC,CAAC,IAA+B,CAAC;IAE/C,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAkD;QAC9F,QAAQ,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,cAAc;YACxC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;SACrD;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,MAAM;YACjB,WAAW,EAAG,IAAI,CAAC,UAAqB,IAAI,SAAS;YACrD,cAAc,EAAE,QAAQ,CAAE,IAAI,CAAC,aAAwB,IAAI,EAAE,EAAE,kBAAkB,CAAC;YAClF,eAAe,EAAE,CAAC,CAAC,MAAM;SAC1B;QACD,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,gDAAgD;KAClG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAiB;IAC7D,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,yFAAyF;YACzF,0FAA0F;YAC1F,oEAAoE;QACtE,WAAW;QACX,YAAY;KACb,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE/D,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAyB,CAAC,IAAI,UAAU,CACjE,CAAC;QAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG;YACb,QAAQ;YACR,OAAO,EAAE;gBACP,KAAK,EAAE,QAAQ,CAAC,MAAM;gBACtB,WAAW,EAAE;oBACX,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;oBAClE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;oBAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;oBAC9D,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;iBACzD;gBACD,SAAS;aACV;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/find-stale-dependencies.d.ts

@@ -0,0 +1,11 @@
+/**
+ * find_stale_dependencies MCP tool (Pillar I, Batch 2).
+ *
+ * Checks npm registry for dependency publish dates and flags stale packages.
+ * npm package.json only (pypi/cargo/go deferred).
+ *
+ * @see https://github.com/cogniumhq/cognium-ai/issues/80
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerFindStaleDependencies(server: McpServer): void;
+//# sourceMappingURL=find-stale-dependencies.d.ts.map

package/dist/tools/find-stale-dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-stale-dependencies.d.ts","sourceRoot":"","sources":["../../src/tools/find-stale-dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAsGzE,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA6CrE"}

package/dist/tools/find-stale-dependencies.js

@@ -0,0 +1,122 @@
+/**
+ * find_stale_dependencies MCP tool (Pillar I, Batch 2).
+ *
+ * Checks npm registry for dependency publish dates and flags stale packages.
+ * npm package.json only (pypi/cargo/go deferred).
+ *
+ * @see https://github.com/cogniumhq/cognium-ai/issues/80
+ */
+import { z } from 'zod';
+import { dependencyStalenessPass } from 'circle-ir-ai';
+const MAX_FINDINGS = 500;
+const SEVERITY_ORDER = {
+    info: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+const inputSchema = {
+    code_root: z.string().describe('Absolute path to the code root to scan'),
+    include_dev_deps: z.boolean().optional().default(false).describe('Include devDependencies (default: false)'),
+    severity_floor: z.enum(['info', 'low', 'medium', 'high', 'critical']).optional().default('low').describe('Minimum severity to report (default: low)'),
+};
+const outputSchema = {
+    findings: z.array(z.object({
+        kind: z.literal('STALE_DEPENDENCY'),
+        severity: z.enum(['low', 'medium', 'high', 'critical']),
+        location: z.object({
+            file: z.string(),
+            span: z.tuple([z.number(), z.number()]),
+        }),
+        evidence: z.object({
+            rule_id: z.string(),
+            dependency: z.string(),
+            current_version: z.string(),
+            latest_version: z.string().nullable(),
+            days_since_publish: z.number(),
+            last_publish_date: z.string(),
+        }),
+        suggested_action: z.string(),
+    })),
+    summary: z.object({
+        total: z.number(),
+        by_severity: z.object({
+            critical: z.number(),
+            high: z.number(),
+            medium: z.number(),
+            low: z.number(),
+        }),
+        truncated: z.boolean(),
+    }),
+};
+function trustFindingToMcp(f) {
+    const meta = f.meta;
+    const days = meta.daysSincePublish ?? 0;
+    let action = 'Consider updating to the latest version.';
+    if (days > 1095) {
+        action = 'This package has not been updated in over 3 years. Evaluate if it is still maintained or find an alternative.';
+    }
+    else if (days > 730) {
+        action = 'This package has not been updated in over 2 years. Check for security advisories and consider alternatives.';
+    }
+    else if (days > 365) {
+        action = 'This package has not been updated in over 1 year. Monitor for updates.';
+    }
+    if (f.ruleId === 'dep-no-maintainers') {
+        action = 'This package has zero maintainers on npm. High risk of abandonment - find an alternative.';
+    }
+    return {
+        kind: 'STALE_DEPENDENCY',
+        severity: f.severity === 'info' ? 'low' : f.severity,
+        location: {
+            file: f.location?.file ?? 'package.json',
+            span: [f.location?.line ?? 1, f.location?.line ?? 1],
+        },
+        evidence: {
+            rule_id: f.ruleId,
+            dependency: meta.dependency ?? 'unknown',
+            current_version: meta.currentVersion ?? 'unknown',
+            latest_version: meta.latestVersion ?? null,
+            days_since_publish: meta.daysSincePublish ?? 0,
+            last_publish_date: meta.lastPublishDate ?? '',
+        },
+        suggested_action: action,
+    };
+}
+export function registerFindStaleDependencies(server) {
+    server.registerTool('find_stale_dependencies', {
+        title: 'Find Stale Dependencies',
+        description: 'Check npm dependencies for staleness by querying the registry for last publish date. ' +
+            'Flags packages not updated in >1 year (low), >2 years (medium), >3 years (high). ' +
+            'Also flags packages with zero maintainers. npm package.json only.',
+        inputSchema,
+        outputSchema,
+    }, async ({ code_root, include_dev_deps, severity_floor }) => {
+        const result = await dependencyStalenessPass(code_root, {
+            includeDevDeps: include_dev_deps,
+        });
+        const floorValue = SEVERITY_ORDER[severity_floor ?? 'low'];
+        const filtered = result.findings.filter((f) => SEVERITY_ORDER[f.severity] >= floorValue);
+        const truncated = filtered.length > MAX_FINDINGS;
+        const findings = filtered.slice(0, MAX_FINDINGS).map(trustFindingToMcp);
+        const output = {
+            findings,
+            summary: {
+                total: filtered.length,
+                by_severity: {
+                    critical: filtered.filter((f) => f.severity === 'critical').length,
+                    high: filtered.filter((f) => f.severity === 'high').length,
+                    medium: filtered.filter((f) => f.severity === 'medium').length,
+                    low: filtered.filter((f) => f.severity === 'low').length,
+                },
+                truncated,
+            },
+        };
+        return {
+            content: [{ type: 'text', text: JSON.stringify(output) }],
+            structuredContent: output,
+        };
+    });
+}
+//# sourceMappingURL=find-stale-dependencies.js.map

package/dist/tools/find-stale-dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-stale-dependencies.js","sourceRoot":"","sources":["../../src/tools/find-stale-dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,uBAAuB,EAAyC,MAAM,cAAc,CAAC;AAE9F,MAAM,YAAY,GAAG,GAAG,CAAC;AAIzB,MAAM,cAAc,GAAkC;IACpD,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACxE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IAC5G,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACtJ,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACnC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACxC,CAAC;QACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;YAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACrC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC9B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;SAC9B,CAAC;QACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;KAC7B,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;QACF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;KACvB,CAAC;CACH,CAAC;AAiBF,SAAS,iBAAiB,CAAC,CAAe;IACxC,MAAM,IAAI,GAAG,CAAC,CAAC,IAA+B,CAAC;IAC/C,MAAM,IAAI,GAAI,IAAI,CAAC,gBAA2B,IAAI,CAAC,CAAC;IAEpD,IAAI,MAAM,GAAG,0CAA0C,CAAC;IACxD,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAChB,MAAM,GAAG,+GAA+G,CAAC;IAC3H,CAAC;SAAM,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,6GAA6G,CAAC;IACzH,CAAC;SAAM,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,wEAAwE,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACtC,MAAM,GAAG,2FAA2F,CAAC;IACvG,CAAC;IAED,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAkD;QAC9F,QAAQ,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,cAAc;YACxC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;SACrD;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,MAAM;YACjB,UAAU,EAAG,IAAI,CAAC,UAAqB,IAAI,SAAS;YACpD,eAAe,EAAG,IAAI,CAAC,cAAyB,IAAI,SAAS;YAC7D,cAAc,EAAG,IAAI,CAAC,aAAwB,IAAI,IAAI;YACtD,kBAAkB,EAAG,IAAI,CAAC,gBAA2B,IAAI,CAAC;YAC1D,iBAAiB,EAAG,IAAI,CAAC,eAA0B,IAAI,EAAE;SAC1D;QACD,gBAAgB,EAAE,MAAM;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAiB;IAC7D,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,uFAAuF;YACvF,mFAAmF;YACnF,mEAAmE;QACrE,WAAW;QACX,YAAY;KACb,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE;YACtD,cAAc,EAAE,gBAAgB;SACjC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAyB,CAAC,IAAI,UAAU,CACjE,CAAC;QAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG;YACb,QAAQ;YACR,OAAO,EAAE;gBACP,KAAK,EAAE,QAAQ,CAAC,MAAM;gBACtB,WAAW,EAAE;oBACX,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;oBAClE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;oBAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;oBAC9D,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;iBACzD;gBACD,SAAS;aACV;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/find-typosquats.d.ts

@@ -0,0 +1,11 @@
+/**
+ * find_typosquats MCP tool (Pillar I, Batch 2).
+ *
+ * Detects potential typosquat packages by comparing dependency names
+ * against popular npm packages using Levenshtein distance.
+ *
+ * @see https://github.com/cogniumhq/cognium-ai/issues/80
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerFindTyposquats(server: McpServer): void;
+//# sourceMappingURL=find-typosquats.d.ts.map

package/dist/tools/find-typosquats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-typosquats.d.ts","sourceRoot":"","sources":["../../src/tools/find-typosquats.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAyFzE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA6C9D"}

package/dist/tools/find-typosquats.js

@@ -0,0 +1,110 @@
+/**
+ * find_typosquats MCP tool (Pillar I, Batch 2).
+ *
+ * Detects potential typosquat packages by comparing dependency names
+ * against popular npm packages using Levenshtein distance.
+ *
+ * @see https://github.com/cogniumhq/cognium-ai/issues/80
+ */
+import { z } from 'zod';
+import { typosquatDetectionPass } from 'circle-ir-ai';
+const MAX_FINDINGS = 500;
+const SEVERITY_ORDER = {
+    info: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+const inputSchema = {
+    code_root: z.string().describe('Absolute path to the code root to scan'),
+    include_dev_deps: z.boolean().optional().default(false).describe('Include devDependencies (default: false)'),
+    severity_floor: z.enum(['info', 'low', 'medium', 'high', 'critical']).optional().default('low').describe('Minimum severity to report (default: low)'),
+};
+const outputSchema = {
+    findings: z.array(z.object({
+        kind: z.literal('TYPOSQUAT_RISK'),
+        severity: z.enum(['medium', 'high']),
+        location: z.object({
+            file: z.string(),
+            span: z.tuple([z.number(), z.number()]),
+        }),
+        evidence: z.object({
+            rule_id: z.string(),
+            dependency: z.string(),
+            similar_to: z.string(),
+            distance: z.number(),
+        }),
+        suggested_action: z.string(),
+    })),
+    summary: z.object({
+        total: z.number(),
+        by_severity: z.object({
+            critical: z.number(),
+            high: z.number(),
+            medium: z.number(),
+            low: z.number(),
+        }),
+        truncated: z.boolean(),
+    }),
+};
+function trustFindingToMcp(f) {
+    const meta = f.meta;
+    const distance = meta.distance ?? 0;
+    const similarTo = meta.similarTo ?? 'unknown';
+    const dependency = meta.dependency ?? 'unknown';
+    const action = distance === 1
+        ? `"${dependency}" is 1 character away from "${similarTo}". Verify this is intentional and not a typosquat attack.`
+        : `"${dependency}" is similar to "${similarTo}". Verify this is the intended package.`;
+    return {
+        kind: 'TYPOSQUAT_RISK',
+        severity: f.severity === 'high' ? 'high' : 'medium',
+        location: {
+            file: f.location?.file ?? 'package.json',
+            span: [f.location?.line ?? 1, f.location?.line ?? 1],
+        },
+        evidence: {
+            rule_id: f.ruleId,
+            dependency,
+            similar_to: similarTo,
+            distance,
+        },
+        suggested_action: action,
+    };
+}
+export function registerFindTyposquats(server) {
+    server.registerTool('find_typosquats', {
+        title: 'Find Typosquats',
+        description: 'Detect potential typosquat packages by comparing dependency names against popular npm packages. ' +
+            'Uses Levenshtein distance: distance=1 is high severity, distance=2 is medium. ' +
+            'Protects against attacks like "lodahs" instead of "lodash".',
+        inputSchema,
+        outputSchema,
+    }, async ({ code_root, include_dev_deps, severity_floor }) => {
+        const result = await typosquatDetectionPass(code_root, {
+            includeDevDeps: include_dev_deps,
+        });
+        const floorValue = SEVERITY_ORDER[severity_floor ?? 'low'];
+        const filtered = result.findings.filter((f) => SEVERITY_ORDER[f.severity] >= floorValue);
+        const truncated = filtered.length > MAX_FINDINGS;
+        const findings = filtered.slice(0, MAX_FINDINGS).map(trustFindingToMcp);
+        const output = {
+            findings,
+            summary: {
+                total: filtered.length,
+                by_severity: {
+                    critical: filtered.filter((f) => f.severity === 'critical').length,
+                    high: filtered.filter((f) => f.severity === 'high').length,
+                    medium: filtered.filter((f) => f.severity === 'medium').length,
+                    low: filtered.filter((f) => f.severity === 'low').length,
+                },
+                truncated,
+            },
+        };
+        return {
+            content: [{ type: 'text', text: JSON.stringify(output) }],
+            structuredContent: output,
+        };
+    });
+}
+//# sourceMappingURL=find-typosquats.js.map

package/dist/tools/find-typosquats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-typosquats.js","sourceRoot":"","sources":["../../src/tools/find-typosquats.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,sBAAsB,EAAyC,MAAM,cAAc,CAAC;AAE7F,MAAM,YAAY,GAAG,GAAG,CAAC;AAIzB,MAAM,cAAc,GAAkC;IACpD,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACxE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IAC5G,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACtJ,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACxC,CAAC;QACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;SACrB,CAAC;QACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;KAC7B,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;QACF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;KACvB,CAAC;CACH,CAAC;AAeF,SAAS,iBAAiB,CAAC,CAAe;IACxC,MAAM,IAAI,GAAG,CAAC,CAAC,IAA+B,CAAC;IAC/C,MAAM,QAAQ,GAAI,IAAI,CAAC,QAAmB,IAAI,CAAC,CAAC;IAChD,MAAM,SAAS,GAAI,IAAI,CAAC,SAAoB,IAAI,SAAS,CAAC;IAC1D,MAAM,UAAU,GAAI,IAAI,CAAC,UAAqB,IAAI,SAAS,CAAC;IAE5D,MAAM,MAAM,GAAG,QAAQ,KAAK,CAAC;QAC3B,CAAC,CAAC,IAAI,UAAU,+BAA+B,SAAS,2DAA2D;QACnH,CAAC,CAAC,IAAI,UAAU,oBAAoB,SAAS,yCAAyC,CAAC;IAEzF,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QACnD,QAAQ,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,cAAc;YACxC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;SACrD;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,MAAM;YACjB,UAAU;YACV,UAAU,EAAE,SAAS;YACrB,QAAQ;SACT;QACD,gBAAgB,EAAE,MAAM;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAiB;IACtD,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,kGAAkG;YAClG,gFAAgF;YAChF,6DAA6D;QAC/D,WAAW;QACX,YAAY;KACb,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE;YACrD,cAAc,EAAE,gBAAgB;SACjC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAyB,CAAC,IAAI,UAAU,CACjE,CAAC;QAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG;YACb,QAAQ;YACR,OAAO,EAAE;gBACP,KAAK,EAAE,QAAQ,CAAC,MAAM;gBACtB,WAAW,EAAE;oBACX,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;oBAClE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;oBAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;oBAC9D,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;iBACzD;gBACD,SAAS;aACV;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cognium-ai/mcp-server",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "MCP server exposing Cognium spec-conformance, spec-drift, and pattern-search tools over stdio",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",