@envseal/mcp-server 0.1.0

package/dist/tools/declare.d.ts

@@ -0,0 +1,253 @@
+import type { Broker } from '@envseal/core';
+export declare const name = "env_declare";
+export declare const description: string;
+export declare const inputSchema: import("zod").ZodObject<{
+    entries: import("zod").ZodArray<import("zod").ZodEffects<import("zod").ZodObject<{
+        key: import("zod").ZodString;
+        description: import("zod").ZodString;
+        required: import("zod").ZodDefault<import("zod").ZodBoolean>;
+        secret: import("zod").ZodDefault<import("zod").ZodBoolean>;
+        format: import("zod").ZodOptional<import("zod").ZodObject<{
+            pattern: import("zod").ZodOptional<import("zod").ZodString>;
+            minLength: import("zod").ZodOptional<import("zod").ZodNumber>;
+            maxLength: import("zod").ZodOptional<import("zod").ZodNumber>;
+            example: import("zod").ZodOptional<import("zod").ZodString>;
+        }, "strip", import("zod").ZodTypeAny, {
+            pattern?: string | undefined;
+            minLength?: number | undefined;
+            maxLength?: number | undefined;
+            example?: string | undefined;
+        }, {
+            pattern?: string | undefined;
+            minLength?: number | undefined;
+            maxLength?: number | undefined;
+            example?: string | undefined;
+        }>>;
+        provider: import("zod").ZodOptional<import("zod").ZodObject<{
+            id: import("zod").ZodString;
+            name: import("zod").ZodString;
+            signupUrl: import("zod").ZodOptional<import("zod").ZodString>;
+            docsUrl: import("zod").ZodOptional<import("zod").ZodString>;
+            rotateUrl: import("zod").ZodOptional<import("zod").ZodString>;
+            scopesNeeded: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString, "many">>;
+        }, "strip", import("zod").ZodTypeAny, {
+            id: string;
+            name: string;
+            signupUrl?: string | undefined;
+            docsUrl?: string | undefined;
+            rotateUrl?: string | undefined;
+            scopesNeeded?: string[] | undefined;
+        }, {
+            id: string;
+            name: string;
+            signupUrl?: string | undefined;
+            docsUrl?: string | undefined;
+            rotateUrl?: string | undefined;
+            scopesNeeded?: string[] | undefined;
+        }>>;
+        verify: import("zod").ZodOptional<import("zod").ZodObject<{
+            method: import("zod").ZodEnum<["GET", "POST"]>;
+            url: import("zod").ZodString;
+            headerTemplate: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>;
+            expectStatus: import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodNumber, "many">>;
+        }, "strip", import("zod").ZodTypeAny, {
+            method: "GET" | "POST";
+            url: string;
+            headerTemplate: Record<string, string>;
+            expectStatus: number[];
+        }, {
+            method: "GET" | "POST";
+            url: string;
+            headerTemplate: Record<string, string>;
+            expectStatus?: number[] | undefined;
+        }>>;
+        sink: import("zod").ZodDefault<import("zod").ZodEnum<["dotenv", "keychain", "sops", "onepassword", "doppler", "vault", "external"]>>;
+        rotation: import("zod").ZodOptional<import("zod").ZodObject<{
+            maxAgeDays: import("zod").ZodNumber;
+        }, "strip", import("zod").ZodTypeAny, {
+            maxAgeDays: number;
+        }, {
+            maxAgeDays: number;
+        }>>;
+    }, "strict", import("zod").ZodTypeAny, {
+        key: string;
+        description: string;
+        required: boolean;
+        secret: boolean;
+        sink: "dotenv" | "keychain" | "sops" | "onepassword" | "doppler" | "vault" | "external";
+        format?: {
+            pattern?: string | undefined;
+            minLength?: number | undefined;
+            maxLength?: number | undefined;
+            example?: string | undefined;
+        } | undefined;
+        provider?: {
+            id: string;
+            name: string;
+            signupUrl?: string | undefined;
+            docsUrl?: string | undefined;
+            rotateUrl?: string | undefined;
+            scopesNeeded?: string[] | undefined;
+        } | undefined;
+        verify?: {
+            method: "GET" | "POST";
+            url: string;
+            headerTemplate: Record<string, string>;
+            expectStatus: number[];
+        } | undefined;
+        rotation?: {
+            maxAgeDays: number;
+        } | undefined;
+    }, {
+        key: string;
+        description: string;
+        required?: boolean | undefined;
+        secret?: boolean | undefined;
+        format?: {
+            pattern?: string | undefined;
+            minLength?: number | undefined;
+            maxLength?: number | undefined;
+            example?: string | undefined;
+        } | undefined;
+        provider?: {
+            id: string;
+            name: string;
+            signupUrl?: string | undefined;
+            docsUrl?: string | undefined;
+            rotateUrl?: string | undefined;
+            scopesNeeded?: string[] | undefined;
+        } | undefined;
+        verify?: {
+            method: "GET" | "POST";
+            url: string;
+            headerTemplate: Record<string, string>;
+            expectStatus?: number[] | undefined;
+        } | undefined;
+        sink?: "dotenv" | "keychain" | "sops" | "onepassword" | "doppler" | "vault" | "external" | undefined;
+        rotation?: {
+            maxAgeDays: number;
+        } | undefined;
+    }>, {
+        key: string;
+        description: string;
+        required: boolean;
+        secret: boolean;
+        sink: "dotenv" | "keychain" | "sops" | "onepassword" | "doppler" | "vault" | "external";
+        format?: {
+            pattern?: string | undefined;
+            minLength?: number | undefined;
+            maxLength?: number | undefined;
+            example?: string | undefined;
+        } | undefined;
+        provider?: {
+            id: string;
+            name: string;
+            signupUrl?: string | undefined;
+            docsUrl?: string | undefined;
+            rotateUrl?: string | undefined;
+            scopesNeeded?: string[] | undefined;
+        } | undefined;
+        verify?: {
+            method: "GET" | "POST";
+            url: string;
+            headerTemplate: Record<string, string>;
+            expectStatus: number[];
+        } | undefined;
+        rotation?: {
+            maxAgeDays: number;
+        } | undefined;
+    }, {
+        key: string;
+        description: string;
+        required?: boolean | undefined;
+        secret?: boolean | undefined;
+        format?: {
+            pattern?: string | undefined;
+            minLength?: number | undefined;
+            maxLength?: number | undefined;
+            example?: string | undefined;
+        } | undefined;
+        provider?: {
+            id: string;
+            name: string;
+            signupUrl?: string | undefined;
+            docsUrl?: string | undefined;
+            rotateUrl?: string | undefined;
+            scopesNeeded?: string[] | undefined;
+        } | undefined;
+        verify?: {
+            method: "GET" | "POST";
+            url: string;
+            headerTemplate: Record<string, string>;
+            expectStatus?: number[] | undefined;
+        } | undefined;
+        sink?: "dotenv" | "keychain" | "sops" | "onepassword" | "doppler" | "vault" | "external" | undefined;
+        rotation?: {
+            maxAgeDays: number;
+        } | undefined;
+    }>, "many">;
+}, "strict", import("zod").ZodTypeAny, {
+    entries: {
+        key: string;
+        description: string;
+        required: boolean;
+        secret: boolean;
+        sink: "dotenv" | "keychain" | "sops" | "onepassword" | "doppler" | "vault" | "external";
+        format?: {
+            pattern?: string | undefined;
+            minLength?: number | undefined;
+            maxLength?: number | undefined;
+            example?: string | undefined;
+        } | undefined;
+        provider?: {
+            id: string;
+            name: string;
+            signupUrl?: string | undefined;
+            docsUrl?: string | undefined;
+            rotateUrl?: string | undefined;
+            scopesNeeded?: string[] | undefined;
+        } | undefined;
+        verify?: {
+            method: "GET" | "POST";
+            url: string;
+            headerTemplate: Record<string, string>;
+            expectStatus: number[];
+        } | undefined;
+        rotation?: {
+            maxAgeDays: number;
+        } | undefined;
+    }[];
+}, {
+    entries: {
+        key: string;
+        description: string;
+        required?: boolean | undefined;
+        secret?: boolean | undefined;
+        format?: {
+            pattern?: string | undefined;
+            minLength?: number | undefined;
+            maxLength?: number | undefined;
+            example?: string | undefined;
+        } | undefined;
+        provider?: {
+            id: string;
+            name: string;
+            signupUrl?: string | undefined;
+            docsUrl?: string | undefined;
+            rotateUrl?: string | undefined;
+            scopesNeeded?: string[] | undefined;
+        } | undefined;
+        verify?: {
+            method: "GET" | "POST";
+            url: string;
+            headerTemplate: Record<string, string>;
+            expectStatus?: number[] | undefined;
+        } | undefined;
+        sink?: "dotenv" | "keychain" | "sops" | "onepassword" | "doppler" | "vault" | "external" | undefined;
+        rotation?: {
+            maxAgeDays: number;
+        } | undefined;
+    }[];
+}>;
+export declare function handler(args: unknown, broker: Broker): Promise<import("../respond.js").ToolResult>;
+//# sourceMappingURL=declare.d.ts.map

package/dist/tools/declare.js

@@ -0,0 +1,20 @@
+import { INPUT_SCHEMAS } from '@envseal/protocol';
+import { respond, respondError } from '../respond.js';
+export const name = 'env_declare';
+export const description = 'Declares that this project needs the given environment variables by writing entries to the project ' +
+    'manifest (env.schema.jsonc). Idempotent; does not prompt the user. ' +
+    'Declare metadata only: key name, description, and optional format/provider constraints. ' +
+    'It will NOT collect values and rejects any entry that tries to carry a value. ' +
+    'After declaring, call env_describe to check presence or env_request to prompt the user for the value.';
+export const inputSchema = INPUT_SCHEMAS.env_declare;
+export async function handler(args, broker) {
+    try {
+        const input = INPUT_SCHEMAS.env_declare.parse(args ?? {});
+        const result = await broker.declare(input);
+        return respond(result);
+    }
+    catch (error) {
+        return respondError(error);
+    }
+}
+//# sourceMappingURL=declare.js.map

package/dist/tools/describe.d.ts

@@ -0,0 +1,12 @@
+import type { Broker } from '@envseal/core';
+export declare const name = "env_describe";
+export declare const description: string;
+export declare const inputSchema: import("zod").ZodObject<{
+    scope: import("zod").ZodOptional<import("zod").ZodString>;
+}, "strict", import("zod").ZodTypeAny, {
+    scope?: string | undefined;
+}, {
+    scope?: string | undefined;
+}>;
+export declare function handler(args: unknown, broker: Broker): Promise<import("../respond.js").ToolResult>;
+//# sourceMappingURL=describe.d.ts.map

package/dist/tools/describe.js

@@ -0,0 +1,22 @@
+import { INPUT_SCHEMAS } from '@envseal/protocol';
+import { respond, respondError } from '../respond.js';
+export const name = 'env_describe';
+export const description = 'Returns only redacted status: whether each key is present, a length bucket, and a salted fingerprint. ' +
+    'This never returns secret values and there is no flag, option, or debug mode that makes it do so. ' +
+    'Do not attempt to read .env directly — that is blocked and unnecessary. ' +
+    'Use this to see which declared keys exist, whether a value is present, and whether a stored value ' +
+    'changed since your last call (compare fingerprints). ' +
+    'It will NOT return, echo, or reconstruct any value. ' +
+    'To collect a missing value, first call env_declare (if the key is not yet declared), then env_request.';
+export const inputSchema = INPUT_SCHEMAS.env_describe;
+export async function handler(args, broker) {
+    try {
+        const input = INPUT_SCHEMAS.env_describe.parse(args ?? {});
+        const result = await broker.describe();
+        return respond(result);
+    }
+    catch (error) {
+        return respondError(error);
+    }
+}
+//# sourceMappingURL=describe.js.map

package/dist/tools/request.d.ts

@@ -0,0 +1,15 @@
+import type { Broker } from '@envseal/core';
+export declare const name = "env_request";
+export declare const description: string;
+export declare const inputSchema: import("zod").ZodObject<{
+    keys: import("zod").ZodArray<import("zod").ZodString, "many">;
+    reason: import("zod").ZodString;
+}, "strict", import("zod").ZodTypeAny, {
+    keys: string[];
+    reason: string;
+}, {
+    keys: string[];
+    reason: string;
+}>;
+export declare function handler(args: unknown, broker: Broker): Promise<import("../respond.js").ToolResult>;
+//# sourceMappingURL=request.d.ts.map

package/dist/tools/request.js

@@ -0,0 +1,22 @@
+import { INPUT_SCHEMAS } from '@envseal/protocol';
+import { respond, respondError } from '../respond.js';
+export const name = 'env_request';
+export const description = 'Opens a secure input surface where the user types the value directly. You will never see the value. ' +
+    'Returns a ticket immediately; poll env_await for the outcome. ' +
+    'You must call env_declare for a key before you can request it. ' +
+    "The 'reason' field is shown verbatim to the user, so write it as a clear, honest ask explaining why " +
+    'the project needs the key. ' +
+    'It will NOT return the value, and the typed value never crosses this channel — only a ticket that ' +
+    'you poll with env_await.';
+export const inputSchema = INPUT_SCHEMAS.env_request;
+export async function handler(args, broker) {
+    try {
+        const input = INPUT_SCHEMAS.env_request.parse(args ?? {});
+        const result = await broker.request(input);
+        return respond(result);
+    }
+    catch (error) {
+        return respondError(error);
+    }
+}
+//# sourceMappingURL=request.js.map

package/dist/tools/revoke.d.ts

@@ -0,0 +1,12 @@
+import type { Broker } from '@envseal/core';
+export declare const name = "env_revoke";
+export declare const description = "Removes stored credentials. Records in the audit log and emits the provider rotation URL so you can help the user invalidate the old key.";
+export declare const inputSchema: import("zod").ZodObject<{
+    keys: import("zod").ZodArray<import("zod").ZodString, "many">;
+}, "strict", import("zod").ZodTypeAny, {
+    keys: string[];
+}, {
+    keys: string[];
+}>;
+export declare function handler(args: unknown, broker: Broker): Promise<import("../respond.js").ToolResult>;
+//# sourceMappingURL=revoke.d.ts.map

package/dist/tools/revoke.js

@@ -0,0 +1,16 @@
+import { EnvRevokeInput, INPUT_SCHEMAS } from '@envseal/protocol';
+import { respond, respondError } from '../respond.js';
+export const name = 'env_revoke';
+export const description = 'Removes stored credentials. Records in the audit log and emits the provider rotation URL so you can help the user invalidate the old key.';
+export const inputSchema = INPUT_SCHEMAS.env_revoke;
+export async function handler(args, broker) {
+    try {
+        const input = EnvRevokeInput.parse(args);
+        const result = await broker.revoke(input);
+        return respond(result);
+    }
+    catch (error) {
+        return respondError(error);
+    }
+}
+//# sourceMappingURL=revoke.js.map

package/dist/tools/use.d.ts

@@ -0,0 +1,15 @@
+import type { Broker } from '@envseal/core';
+export declare const name = "env_use";
+export declare const description: string;
+export declare const inputSchema: import("zod").ZodObject<{
+    keys: import("zod").ZodArray<import("zod").ZodString, "many">;
+    command: import("zod").ZodArray<import("zod").ZodString, "many">;
+}, "strict", import("zod").ZodTypeAny, {
+    keys: string[];
+    command: string[];
+}, {
+    keys: string[];
+    command: string[];
+}>;
+export declare function handler(args: unknown, broker: Broker): Promise<import("../respond.js").ToolResult>;
+//# sourceMappingURL=use.d.ts.map

package/dist/tools/use.js

@@ -0,0 +1,22 @@
+import { INPUT_SCHEMAS } from '@envseal/protocol';
+import { respond, respondError } from '../respond.js';
+export const name = 'env_use';
+export const description = 'Runs a command with the named secrets injected into the child environment only. ' +
+    'Output is filtered so the values cannot appear in what you read back. ' +
+    'Requires user confirmation. ' +
+    'Pass the command as an argv array with no shell. ' +
+    'It will NOT print the secrets to you, will NOT export them into your own environment, and refuses to ' +
+    'run without explicit user confirmation. ' +
+    'To check whether a key exists instead of running a command, call env_describe.';
+export const inputSchema = INPUT_SCHEMAS.env_use;
+export async function handler(args, broker) {
+    try {
+        const input = INPUT_SCHEMAS.env_use.parse(args ?? {});
+        const result = await broker.use(input);
+        return respond(result);
+    }
+    catch (error) {
+        return respondError(error);
+    }
+}
+//# sourceMappingURL=use.js.map

package/dist/tools/verify.d.ts

@@ -0,0 +1,12 @@
+import type { Broker } from '@envseal/core';
+export declare const name = "env_verify";
+export declare const description: string;
+export declare const inputSchema: import("zod").ZodObject<{
+    keys: import("zod").ZodArray<import("zod").ZodString, "many">;
+}, "strict", import("zod").ZodTypeAny, {
+    keys: string[];
+}, {
+    keys: string[];
+}>;
+export declare function handler(args: unknown, broker: Broker): Promise<import("../respond.js").ToolResult>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/tools/verify.js

@@ -0,0 +1,24 @@
+import { INPUT_SCHEMAS } from '@envseal/protocol';
+import { respond, respondError } from '../respond.js';
+import { annotateVerifyResults } from '../confirm.js';
+export const name = 'env_verify';
+export const description = 'Tests a stored credential against its provider and returns a classified result. ' +
+    'Never returns the provider\'s response body. ' +
+    'Results are classified as ok, auth_failed, forbidden, rate_limited, network_error, no_probe, or ' +
+    'probe_not_approved, plus a short sanitized message. ' +
+    'It will NOT return raw provider responses, headers, or the credential itself. ' +
+    'To check mere presence rather than validity, call env_describe instead.';
+export const inputSchema = INPUT_SCHEMAS.env_verify;
+export async function handler(args, broker) {
+    try {
+        const input = INPUT_SCHEMAS.env_verify.parse(args ?? {});
+        // `probe_not_approved` alone names a host and nothing the caller can act
+        // on. See annotateVerifyResults.
+        const result = annotateVerifyResults(await broker.verify(input));
+        return respond(result);
+    }
+    catch (error) {
+        return respondError(error);
+    }
+}
+//# sourceMappingURL=verify.js.map

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@envseal/mcp-server",
+  "version": "0.1.0",
+  "type": "module",
+  "license": "Apache-2.0",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "envseal-mcp": "./dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.13.0",
+    "zod": "^3.24.1",
+    "@envseal/protocol": "0.1.0",
+    "@envseal/core": "0.1.0",
+    "@envseal/prompters": "0.1.0",
+    "@envseal/registry": "0.1.0"
+  },
+  "devDependencies": {
+    "tsx": "^4.19.2",
+    "zod-to-json-schema": "^3.24.1"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && pnpm gen:dialects",
+    "gen:dialects": "tsx scripts/gen-dialects.ts",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}