@esankhan3/code-search-mcp 0.0.1

package/dist/middleware/auth.js

@@ -0,0 +1,109 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+const rateBuckets = /* @__PURE__ */ new Map();
+function checkRateLimit(identity, maxPerMinute) {
+  const now = Date.now();
+  const bucket = rateBuckets.get(identity);
+  if (!bucket || now > bucket.resetAt) {
+    rateBuckets.set(identity, { count: 1, resetAt: now + 6e4 });
+    return true;
+  }
+  if (bucket.count >= maxPerMinute) return false;
+  bucket.count++;
+  return true;
+}
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, bucket] of rateBuckets) {
+    if (now > bucket.resetAt) rateBuckets.delete(key);
+  }
+}, 3e5).unref();
+function verifyJwt(token, secret, issuer) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const header = JSON.parse(Buffer.from(parts[0], "base64url").toString());
+    if (header.alg !== "HS256") return null;
+    const data = `${parts[0]}.${parts[1]}`;
+    const expected = createHmac("sha256", secret).update(data).digest("base64url");
+    const sigBuf = Buffer.from(parts[2], "base64url");
+    const expectedBuf = Buffer.from(expected, "base64url");
+    if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {
+      return null;
+    }
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
+    if (payload.exp && payload.exp < Math.floor(Date.now() / 1e3)) return null;
+    if (issuer && payload.iss !== issuer) return null;
+    return { sub: payload.sub ?? "unknown", scope: payload.scope };
+  } catch {
+    return null;
+  }
+}
+function safeCompare(a, b) {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+function createAuthMiddleware(config) {
+  return function authenticate(req, res) {
+    if (config.authMode === "none") {
+      return { mode: "anonymous", subject: "anonymous", scopes: ["*"] };
+    }
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Missing Authorization header" }));
+      return null;
+    }
+    const token = authHeader.slice(7);
+    if (config.authMode === "api-key") {
+      const matched = config.authApiKeys.some((key) => safeCompare(token, key));
+      if (!matched) {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Invalid API key" }));
+        return null;
+      }
+      const identity = {
+        mode: "api-key",
+        subject: `key:${token.slice(0, 8)}...`,
+        scopes: ["*"]
+      };
+      if (!checkRateLimit(identity.subject, config.rateLimitPerMinute)) {
+        res.writeHead(429, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Rate limit exceeded" }));
+        return null;
+      }
+      return identity;
+    }
+    if (config.authMode === "jwt") {
+      if (!config.authJwtSecret) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "JWT secret not configured" }));
+        return null;
+      }
+      const claims = verifyJwt(token, config.authJwtSecret, config.authJwtIssuer);
+      if (!claims) {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Invalid or expired JWT" }));
+        return null;
+      }
+      const identity = {
+        mode: "jwt",
+        subject: claims.sub,
+        scopes: claims.scope ? claims.scope.split(" ") : ["*"]
+      };
+      if (!checkRateLimit(identity.subject, config.rateLimitPerMinute)) {
+        res.writeHead(429, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Rate limit exceeded" }));
+        return null;
+      }
+      return identity;
+    }
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: `Unknown auth mode: ${config.authMode}` }));
+    return null;
+  };
+}
+export {
+  createAuthMiddleware
+};

package/dist/resources/resources.js

@@ -0,0 +1,79 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { getKnowledgeBasePath } from "../core/config.js";
+import { loadAllProfiles } from "../core/repo-profiler.js";
+import { loadProfile } from "../core/repo-profiler.js";
+function registerResources(ctx) {
+  return [
+    {
+      uri: `code-search://repos`,
+      name: "All Repos",
+      description: `List of all repos in project "${ctx.projectName}"`,
+      mimeType: "application/json"
+    },
+    {
+      uri: `code-search://system-graph`,
+      name: "System Graph",
+      description: "Unified knowledge graph with cross-repo edges",
+      mimeType: "application/json"
+    }
+  ];
+}
+async function handleResource(uri, ctx) {
+  try {
+    const kbPath = getKnowledgeBasePath(ctx.projectName);
+    if (uri === "code-search://repos") {
+      const profiles = loadAllProfiles(ctx.projectName);
+      return {
+        contents: [{
+          uri,
+          mimeType: "application/json",
+          text: JSON.stringify(profiles, null, 2)
+        }]
+      };
+    }
+    if (uri === "code-search://system-graph") {
+      const graphPath = join(kbPath, "system_graph_v2.json");
+      if (!existsSync(graphPath)) {
+        return { contents: [{ uri, mimeType: "application/json", text: '{"nodes":[],"edges":[]}' }] };
+      }
+      return {
+        contents: [{
+          uri,
+          mimeType: "application/json",
+          text: readFileSync(graphPath, "utf-8")
+        }]
+      };
+    }
+    const profileMatch = uri.match(/^code-search:\/\/repo\/([^/]+)\/profile$/);
+    if (profileMatch) {
+      const profile = loadProfile(ctx.projectName, profileMatch[1]);
+      return {
+        contents: [{
+          uri,
+          mimeType: "application/json",
+          text: profile ? JSON.stringify(profile, null, 2) : "{}"
+        }]
+      };
+    }
+    const graphMatch = uri.match(/^code-search:\/\/repo\/([^/]+)\/graph$/);
+    if (graphMatch) {
+      const graphPath = join(kbPath, graphMatch[1], "graph.json");
+      return {
+        contents: [{
+          uri,
+          mimeType: "application/json",
+          text: existsSync(graphPath) ? readFileSync(graphPath, "utf-8") : '{"nodes":[],"links":[]}'
+        }]
+      };
+    }
+    return { contents: [{ uri, mimeType: "text/plain", text: `Unknown resource: ${uri}` }] };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { contents: [{ uri, mimeType: "text/plain", text: `Error: ${msg}` }] };
+  }
+}
+export {
+  handleResource,
+  registerResources
+};

package/dist/server.js

@@ -0,0 +1,242 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+  ListResourcesRequestSchema,
+  ReadResourceRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { registerSearchTools, handleSearchTool } from "./tools/search.js";
+import { registerGraphTools, handleGraphTool } from "./tools/graph.js";
+import { registerProfileTools, handleProfileTool } from "./tools/profile.js";
+import { registerIndexTools, handleIndexTool } from "./tools/index-tools.js";
+import { registerResources, handleResource } from "./resources/resources.js";
+import { getKnowledgeBasePath } from "./core/config.js";
+import { indexFromPath } from "./core/indexer.js";
+import { loadServerConfig } from "./core/env-config.js";
+import { startHttpTransport } from "./transports/http-transport.js";
+function createMcpServerInstance(ctx) {
+  const server = new Server(
+    { name: "code-search-mcp", version: "0.1.0" },
+    { capabilities: { tools: {}, resources: {} } }
+  );
+  const allTools = [
+    ...registerSearchTools(),
+    ...registerGraphTools(),
+    ...registerProfileTools(),
+    ...registerIndexTools()
+  ];
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: allTools
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const name = request.params.name;
+    const args = request.params.arguments ?? {};
+    const searchResult = await handleSearchTool(name, args, ctx);
+    if (searchResult) return searchResult;
+    const graphResult = await handleGraphTool(name, args, ctx);
+    if (graphResult) return graphResult;
+    const profileResult = await handleProfileTool(name, args, ctx);
+    if (profileResult) return profileResult;
+    const indexResult = await handleIndexTool(name, args, ctx);
+    if (indexResult) return indexResult;
+    return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
+  });
+  const allResources = registerResources(ctx);
+  server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+    resources: allResources
+  }));
+  server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+    return handleResource(request.params.uri, ctx);
+  });
+  return server;
+}
+async function startServer(projectName, directoryPath) {
+  const config = loadServerConfig();
+  const ctx = {
+    projectName,
+    directoryPath,
+    indexReady: false,
+    startedAt: Date.now(),
+    indexing: {
+      status: "idle",
+      phase: null,
+      message: null,
+      percent: 0,
+      startedAt: null,
+      error: null,
+      lastSuccess: null,
+      lastDurationMs: 0,
+      history: []
+    }
+  };
+  const llmInfo = config.llmMode === "none" ? "disabled (profiling + service mesh skipped)" : config.llmMode === "api" ? `api \u2192 ${config.llmProvider}/${config.llmModel}${config.llmApiKey ? "" : " (WARNING: no API key!)"}` : `cli \u2192 ${config.claudeBin}`;
+  console.error(`[code-search-mcp] LLM: ${llmInfo}`);
+  await autoIndex(ctx);
+  if (config.transport === "stdio") {
+    const server = createMcpServerInstance(ctx);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error(`[code-search-mcp] Server running for "${projectName}" (stdio)`);
+  } else {
+    if (config.authMode === "none" && config.host !== "127.0.0.1" && config.host !== "localhost") {
+      console.error(`[code-search-mcp] WARNING: Auth is disabled but server binds to ${config.host}. Any machine on the network can access your code search API.`);
+      console.error(`[code-search-mcp] Set CODE_SEARCH_AUTH_MODE=api-key or CODE_SEARCH_HOST=127.0.0.1 for security.`);
+    }
+    await startHttpTransport({
+      config,
+      createMcpServer: async () => ({
+        server: createMcpServerInstance(ctx)
+      }),
+      onReady: (url) => {
+        console.error(`[code-search-mcp] Server running for "${projectName}" at ${url}/mcp`);
+        console.error(`[code-search-mcp] Health:  GET  ${url}/health`);
+        console.error(`[code-search-mcp] Status:  GET  ${url}/status`);
+        console.error(`[code-search-mcp] Index:   POST ${url}/index`);
+        console.error(`[code-search-mcp] Auth: ${config.authMode}`);
+      },
+      getHealth: () => ({
+        project: ctx.projectName,
+        indexReady: ctx.indexReady,
+        indexing: ctx.indexing.status,
+        uptime: Math.floor((Date.now() - ctx.startedAt) / 1e3),
+        transport: config.transport,
+        authMode: config.authMode
+      }),
+      getStatus: () => ({
+        project: ctx.projectName,
+        directoryPath: ctx.directoryPath,
+        indexReady: ctx.indexReady,
+        uptime: Math.floor((Date.now() - ctx.startedAt) / 1e3),
+        indexing: {
+          ...ctx.indexing,
+          elapsedMs: ctx.indexing.startedAt ? Date.now() - ctx.indexing.startedAt : null
+        }
+      }),
+      onIndex: async (body) => {
+        const { resolve } = await import("node:path");
+        const { existsSync: existsSync2 } = await import("node:fs");
+        const dirPath = resolve(body.path);
+        if (!existsSync2(dirPath)) {
+          throw new Error(`Path does not exist: ${dirPath}`);
+        }
+        if (ctx.indexing.status === "indexing") {
+          throw new Error(`Indexing already in progress (phase: ${ctx.indexing.phase}). Wait for it to complete or check GET /status.`);
+        }
+        const project = body.project || dirPath.split("/").filter(Boolean).pop() || "project";
+        const stats = await trackedIndex(ctx, project, dirPath, {
+          force: body.force,
+          label: "admin-index"
+        });
+        ctx.projectName = project;
+        ctx.directoryPath = dirPath;
+        return {
+          status: "ok",
+          project,
+          path: dirPath,
+          chunks: stats.totalChunks,
+          repos: stats.repos.length,
+          crossRepoEdges: stats.crossRepoEdges,
+          durationMs: stats.indexDurationMs
+        };
+      }
+    });
+  }
+  const reindexIntervalMs = parseReindexInterval();
+  if (reindexIntervalMs > 0 && ctx.directoryPath) {
+    console.error(`[code-search-mcp] Auto-reindex every ${Math.round(reindexIntervalMs / 6e4)}m`);
+    setInterval(async () => {
+      if (!ctx.directoryPath || ctx.indexing.status === "indexing") return;
+      try {
+        await trackedIndex(ctx, ctx.projectName, ctx.directoryPath, { label: "auto-reindex" });
+      } catch (err) {
+        console.error(`[auto-reindex] Failed:`, err);
+      }
+    }, reindexIntervalMs).unref();
+  }
+}
+function parseReindexInterval() {
+  const raw = process.env.CODE_SEARCH_REINDEX_INTERVAL?.trim();
+  if (!raw || raw === "0" || raw === "none") return 0;
+  const match = raw.match(/^(\d+)(m|h)$/);
+  if (!match) {
+    console.error(`[code-search-mcp] Invalid REINDEX_INTERVAL "${raw}" \u2014 use "30m", "1h", etc. Disabling.`);
+    return 0;
+  }
+  const value = parseInt(match[1], 10);
+  const unit = match[2];
+  return unit === "h" ? value * 60 * 6e4 : value * 6e4;
+}
+const MAX_HISTORY = 50;
+function pushHistory(ctx, type, message) {
+  ctx.indexing.history.push({ timestamp: (/* @__PURE__ */ new Date()).toISOString(), type, message });
+  if (ctx.indexing.history.length > MAX_HISTORY) {
+    ctx.indexing.history = ctx.indexing.history.slice(-MAX_HISTORY);
+  }
+}
+async function trackedIndex(ctx, project, dirPath, opts) {
+  const label = opts?.label ?? "index";
+  ctx.indexing.status = "indexing";
+  ctx.indexing.phase = "starting";
+  ctx.indexing.message = `Starting ${label}...`;
+  ctx.indexing.percent = 0;
+  ctx.indexing.startedAt = Date.now();
+  ctx.indexing.error = null;
+  pushHistory(ctx, "start", `${label}: started for "${project}" at ${dirPath}`);
+  try {
+    const stats = await indexFromPath(project, dirPath, {
+      force: opts?.force,
+      onProgress: (m) => {
+        ctx.indexing.message = m;
+        console.error(`[${label}] ${m}`);
+      },
+      onDetailedProgress: (p) => {
+        ctx.indexing.phase = p.phase;
+        ctx.indexing.percent = p.percent;
+        ctx.indexing.message = p.message;
+      }
+    });
+    ctx.indexReady = true;
+    ctx.indexing.status = "idle";
+    ctx.indexing.phase = null;
+    ctx.indexing.percent = 100;
+    ctx.indexing.lastSuccess = (/* @__PURE__ */ new Date()).toISOString();
+    ctx.indexing.lastDurationMs = stats.indexDurationMs;
+    ctx.indexing.message = `Completed: ${stats.totalChunks} chunks, ${stats.repos.length} repos in ${Math.round(stats.indexDurationMs / 1e3)}s`;
+    pushHistory(ctx, "complete", ctx.indexing.message);
+    return stats;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    ctx.indexing.status = "error";
+    ctx.indexing.error = msg;
+    ctx.indexing.message = `Failed: ${msg}`;
+    pushHistory(ctx, "error", msg);
+    throw err;
+  }
+}
+async function autoIndex(ctx) {
+  try {
+    const kbPath = getKnowledgeBasePath(ctx.projectName);
+    const hasLanceDB = existsSync(join(kbPath, "lancedb"));
+    const hasGraph = existsSync(join(kbPath, "system_graph_v2.json"));
+    if (hasLanceDB && hasGraph) {
+      ctx.indexReady = true;
+      console.error(`[code-search-mcp] Index loaded for "${ctx.projectName}"`);
+      return;
+    }
+    if (!ctx.directoryPath) {
+      console.error(`[code-search-mcp] No index found and no directory path \u2014 tools will return empty results`);
+      return;
+    }
+    console.error(`[code-search-mcp] No index found \u2014 building from ${ctx.directoryPath}...`);
+    await trackedIndex(ctx, ctx.projectName, ctx.directoryPath, { label: "auto-index" });
+    console.error(`[code-search-mcp] Index ready.`);
+  } catch (err) {
+    console.error(`[code-search-mcp] Auto-index failed:`, err);
+  }
+}
+export {
+  startServer
+};

package/dist/sources/github-org.js

@@ -0,0 +1,109 @@
+import { execSync } from "node:child_process";
+import { existsSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+async function cloneOrUpdateOrg(org, opts) {
+  const log = opts?.onProgress ?? ((m) => console.error(`[github] ${m}`));
+  const token = opts?.token ?? process.env.GITHUB_TOKEN;
+  const workspacePath = opts?.workspacePath ?? join(homedir(), ".code-search", org);
+  const maxRepos = opts?.maxRepos ?? 500;
+  mkdirSync(workspacePath, { recursive: true });
+  log(`Fetching repos from github:${org}...`);
+  let orgRepos;
+  try {
+    orgRepos = listReposViaGhCli(org, maxRepos);
+    log(`Found ${orgRepos.length} repos via gh CLI`);
+  } catch {
+    if (!token) {
+      throw new Error("gh CLI not available and no GITHUB_TOKEN set. Install gh CLI or set GITHUB_TOKEN.");
+    }
+    orgRepos = await listReposViaApi(org, token, maxRepos);
+    log(`Found ${orgRepos.length} repos via GitHub API`);
+  }
+  if (opts?.pattern) {
+    const pattern = opts.pattern.replace(/\*/g, ".*");
+    const re = new RegExp(`^${pattern}$`, "i");
+    orgRepos = orgRepos.filter((r) => re.test(r.name));
+    log(`Filtered to ${orgRepos.length} repos matching "${opts.pattern}"`);
+  }
+  const results = [];
+  for (let i = 0; i < orgRepos.length; i++) {
+    const repo = orgRepos[i];
+    const repoPath = join(workspacePath, repo.name);
+    if (existsSync(join(repoPath, ".git"))) {
+      try {
+        execSync("git pull --ff-only --quiet", {
+          cwd: repoPath,
+          stdio: "pipe",
+          timeout: 3e4
+        });
+        log(`  [${i + 1}/${orgRepos.length}] Updated ${repo.name}`);
+      } catch {
+        log(`  [${i + 1}/${orgRepos.length}] ${repo.name} \u2014 pull failed (skipping)`);
+      }
+    } else {
+      try {
+        const cloneCmd = token ? `git -c "http.extraHeader=Authorization: Bearer ${token}" clone --depth 1 --quiet "${repo.cloneUrl}" "${repoPath}"` : `git clone --depth 1 --quiet "${repo.cloneUrl}" "${repoPath}"`;
+        execSync(cloneCmd, {
+          stdio: "pipe",
+          timeout: 12e4
+        });
+        log(`  [${i + 1}/${orgRepos.length}] Cloned ${repo.name}`);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        log(`  [${i + 1}/${orgRepos.length}] ${repo.name} \u2014 clone failed: ${msg.slice(0, 80)}`);
+        continue;
+      }
+    }
+    results.push({
+      name: repo.name,
+      path: repoPath,
+      language: repo.language || "unknown"
+    });
+  }
+  log(`Ready: ${results.length} repos in ${workspacePath}`);
+  return results;
+}
+function listReposViaGhCli(org, limit) {
+  const output = execSync(
+    `gh repo list "${org}" --json name,url,primaryLanguage --limit ${limit} --no-archived`,
+    { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 3e4 }
+  );
+  const repos = JSON.parse(output);
+  return repos.map((r) => ({
+    name: r.name,
+    cloneUrl: r.url.endsWith(".git") ? r.url : `${r.url}.git`,
+    language: (r.primaryLanguage?.name ?? "").toLowerCase()
+  }));
+}
+async function listReposViaApi(org, token, limit) {
+  const allRepos = [];
+  let page = 1;
+  while (allRepos.length < limit) {
+    const url = `https://api.github.com/orgs/${org}/repos?per_page=100&page=${page}&type=sources`;
+    const res = await fetch(url, {
+      headers: {
+        Authorization: `token ${token}`,
+        Accept: "application/vnd.github.v3+json"
+      }
+    });
+    if (!res.ok) {
+      throw new Error(`GitHub API error: ${res.status} ${res.statusText}`);
+    }
+    const repos = await res.json();
+    if (repos.length === 0) break;
+    for (const r of repos) {
+      if (r.archived) continue;
+      allRepos.push({
+        name: r.name,
+        cloneUrl: r.clone_url,
+        language: (r.language ?? "").toLowerCase()
+      });
+    }
+    page++;
+  }
+  return allRepos.slice(0, limit);
+}
+export {
+  cloneOrUpdateOrg
+};

package/dist/sources/local-path.js

@@ -0,0 +1,44 @@
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { join, basename } from "node:path";
+const SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".next", "build", "__pycache__", ".venv", "vendor", "target"]);
+function discoverLocalRepos(directoryPath) {
+  if (!existsSync(directoryPath)) return [];
+  const repos = [];
+  if (existsSync(join(directoryPath, ".git"))) {
+    repos.push({
+      name: basename(directoryPath),
+      path: directoryPath,
+      language: detectLanguage(directoryPath)
+    });
+    return repos;
+  }
+  try {
+    for (const entry of readdirSync(directoryPath)) {
+      if (entry.startsWith(".") || SKIP_DIRS.has(entry)) continue;
+      const fullPath = join(directoryPath, entry);
+      try {
+        if (!statSync(fullPath).isDirectory()) continue;
+      } catch {
+        continue;
+      }
+      if (!existsSync(join(fullPath, ".git"))) continue;
+      repos.push({ name: entry, path: fullPath, language: detectLanguage(fullPath) });
+    }
+  } catch {
+  }
+  return repos;
+}
+function detectLanguage(repoPath) {
+  if (existsSync(join(repoPath, "go.mod"))) return "go";
+  if (existsSync(join(repoPath, "Cargo.toml"))) return "rust";
+  if (existsSync(join(repoPath, "pom.xml")) || existsSync(join(repoPath, "build.gradle"))) return "java";
+  if (existsSync(join(repoPath, "composer.json"))) return "php";
+  if (existsSync(join(repoPath, "pyproject.toml")) || existsSync(join(repoPath, "setup.py"))) return "python";
+  if (existsSync(join(repoPath, "package.json"))) {
+    return existsSync(join(repoPath, "tsconfig.json")) ? "typescript" : "javascript";
+  }
+  return "unknown";
+}
+export {
+  discoverLocalRepos
+};