@extenshi/mcp 0.0.1

package/README.md

@@ -0,0 +1,67 @@
+# @extenshi/mcp
+
+A [Model Context Protocol](https://modelcontextprotocol.io) server that brings the
+**Extenshi extension catalog** — search, security analysis, market research, and
+pre-publish scanning — into your AI tools (Claude Code, Claude Desktop, Cursor, …).
+
+It runs locally over **stdio**, so there's nothing to host. It reuses your existing
+Extenshi API key (the same one `@extenshi/cli` uses) and talks to the public Extenshi
+backend on your behalf.
+
+## Get an API key
+
+An API key is **required** — every tool refuses to run without one, and the backend
+enforces it too.
+
+1. Sign up at **https://auth.extenshi.io/signup**
+2. Create a key at **https://dojo.extenshi.io/api-keys**
+3. Provide it via the `EXTENSHI_API_KEY` environment variable (or run `extenshi login`,
+   which the MCP server reads from `~/.extenshi/config.json`).
+
+## Configure your MCP client
+
+```json
+{
+  "mcpServers": {
+    "extenshi": {
+      "command": "npx",
+      "args": ["-y", "@extenshi/mcp"],
+      "env": { "EXTENSHI_API_KEY": "ek_…" }
+    }
+  }
+}
+```
+
+## Tools
+
+| Tool | What it does | Cost |
+| --- | --- | --- |
+| `search_extensions` | Hybrid search across Chrome/Firefox/Edge with filters (store, category, pricing, rating, risk, permissions) | free |
+| `get_extension` | Full catalog detail for one extension by numeric catalog ID | free |
+| `get_security` | Risk score + finding counts + top grouped findings (reads existing scans) | free |
+| `get_related_extensions` | Similar / competing extensions for competitive analysis | free |
+| `market_overview` | Aggregate catalog stats + facet counts (category / pricing / risk) | free |
+| `scan_extension` | Pre-publish security scan of a local artifact (.zip/.crx/.xpi), with live progress | 1 credit (free for extensions you've verified ownership of) |
+
+Read tools require a key but cost nothing. `scan_extension` spends one credit, or scans
+free when you pass the numeric `extension_id` of an extension whose ownership you have
+verified — top up at https://dojo.extenshi.io/billing.
+
+## Configuration
+
+| Env var | Default | Purpose |
+| --- | --- | --- |
+| `EXTENSHI_API_KEY` | — | Your `ek_…` developer key (required) |
+| `EXTENSHI_BFF_URL` | `https://bff.extenshi.io` | Catalog read API base URL |
+| `EXTENSHI_API_URL` | `https://scan.extenshi.io` | Scan backend base URL |
+
+## Develop
+
+```bash
+yarn build            # tsc -> dist/
+# Inspect locally:
+EXTENSHI_API_KEY=ek_… npx @modelcontextprotocol/inspector node dist/index.js
+```
+
+Publishing is handled by `./scripts/publish.sh` (npm Automation token from Infisical;
+`DRY_RUN=1 ./scripts/publish.sh` to validate). Requires Node ≥20.

package/dist/bff.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Thin tRPC client for the public catalog BFF (`bff.extenshi.io`).
+ *
+ * The BFF tRPC server is configured WITHOUT a data transformer (no superjson),
+ * so this client must match — plain JSON over the wire. We type the proxy as
+ * `any` on purpose: catalog-api emits no `.d.ts`, so the BFF↔API type chain
+ * can't be imported reliably across a published-package boundary. The runtime
+ * proxy builds the procedure path from property access regardless of types.
+ *
+ * Every call carries `Authorization: Bearer <ek_…>`. Today the BFF read
+ * procedures are anonymous, but they are moving to mandatory key-enforcement
+ * (no anonymous data access) — sending the key now is forward-compatible and
+ * needs no client change when enforcement lands.
+ */
+export interface Bff {
+    searchExtensions(input: Record<string, unknown>): Promise<unknown>;
+    getExtensionById(id: number): Promise<unknown>;
+    getSecurityData(extensionId: number): Promise<unknown>;
+    getRiskSummary(extensionId: number): Promise<unknown>;
+    getRelatedExtensions(extensionId: number, limit: number): Promise<unknown>;
+    getSearchFacets(input: Record<string, unknown>): Promise<unknown>;
+    getStats(): Promise<unknown>;
+}
+export declare function makeBff(bffUrl: string, apiKey: string): Bff;
+//# sourceMappingURL=bff.d.ts.map

package/dist/bff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bff.d.ts","sourceRoot":"","sources":["../src/bff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,MAAM,WAAW,GAAG;IACnB,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAClE,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtD,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrD,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1E,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAC5B;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,CAsB3D"}

package/dist/bff.js

@@ -0,0 +1,37 @@
+/**
+ * Thin tRPC client for the public catalog BFF (`bff.extenshi.io`).
+ *
+ * The BFF tRPC server is configured WITHOUT a data transformer (no superjson),
+ * so this client must match — plain JSON over the wire. We type the proxy as
+ * `any` on purpose: catalog-api emits no `.d.ts`, so the BFF↔API type chain
+ * can't be imported reliably across a published-package boundary. The runtime
+ * proxy builds the procedure path from property access regardless of types.
+ *
+ * Every call carries `Authorization: Bearer <ek_…>`. Today the BFF read
+ * procedures are anonymous, but they are moving to mandatory key-enforcement
+ * (no anonymous data access) — sending the key now is forward-compatible and
+ * needs no client change when enforcement lands.
+ */
+import { createTRPCClient, httpBatchLink } from '@trpc/client';
+export function makeBff(bffUrl, apiKey) {
+    const client = createTRPCClient({
+        links: [
+            httpBatchLink({
+                url: `${bffUrl}/api/trpc`,
+                headers: () => ({ authorization: `Bearer ${apiKey}` }),
+            }),
+        ],
+    });
+    // NB: the store router is mounted under `catalog` in the BFF appRouter
+    // (routers/index.ts: `catalog: storeRouter`), NOT `store`. Security is `security`.
+    return {
+        searchExtensions: (input) => client.catalog.searchExtensions.query(input),
+        getExtensionById: (id) => client.catalog.getExtensionById.query({ id }),
+        getSecurityData: (extensionId) => client.security.getSecurityData.query({ extensionId }),
+        getRiskSummary: (extensionId) => client.security.getRiskSummary.query({ extensionId }),
+        getRelatedExtensions: (extensionId, limit) => client.catalog.getRelatedExtensions.query({ extensionId, limit }),
+        getSearchFacets: (input) => client.catalog.getSearchFacets.query(input),
+        getStats: () => client.catalog.getStats.query(),
+    };
+}
+//# sourceMappingURL=bff.js.map

package/dist/bff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bff.js","sourceRoot":"","sources":["../src/bff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAe9D,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,MAAc;IACrD,MAAM,MAAM,GAAkB,gBAAgB,CAAC;QAC9C,KAAK,EAAE;YACN,aAAa,CAAC;gBACb,GAAG,EAAE,GAAG,MAAM,WAAW;gBACzB,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;aACtD,CAAC;SACF;KACD,CAAC,CAAA;IAEF,uEAAuE;IACvE,mFAAmF;IACnF,OAAO;QACN,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC;QACzE,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;QACvE,eAAe,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QACxF,cAAc,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QACtF,oBAAoB,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAClE,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;QACvE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE;KAC/C,CAAA;AACF,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Configuration loading for the Extenshi MCP server.
+ *
+ * The MCP server runs locally (stdio) inside the developer's AI client, so the
+ * API key comes from the environment — never from a request header. We
+ * deliberately reuse the SAME key sources as `@extenshi/cli` so a developer who
+ * already ran `extenshi login` is set up with zero extra steps:
+ *
+ *   1. Environment variable EXTENSHI_API_KEY (set in the client's mcp config)
+ *   2. A `.env` in the current working directory (does NOT override real env)
+ *   3. Config file ~/.extenshi/config.json (written by `extenshi login`)
+ *
+ * Base URLs default to production and are overridable for local/staging:
+ *   - EXTENSHI_BFF_URL  (read tools)  default https://bff.extenshi.io
+ *   - EXTENSHI_API_URL  (scan)        default https://scan.extenshi.io
+ *
+ * stdout is the MCP protocol channel — this module must NEVER write to it.
+ */
+export interface ResolvedConfig {
+    /** The `ek_…` developer API key, or null if none is configured. */
+    apiKey: string | null;
+    /** Base URL of the catalog BFF (read tools), no trailing slash. */
+    bffUrl: string;
+    /** Base URL of the scan backend (scan_extension tool), no trailing slash. */
+    scanUrl: string;
+}
+export declare function loadConfig(): ResolvedConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAgBH,MAAM,WAAW,cAAc;IAC9B,mEAAmE;IACnE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAA;CACf;AAoDD,wBAAgB,UAAU,IAAI,cAAc,CAS3C"}

package/dist/config.js

@@ -0,0 +1,83 @@
+/**
+ * Configuration loading for the Extenshi MCP server.
+ *
+ * The MCP server runs locally (stdio) inside the developer's AI client, so the
+ * API key comes from the environment — never from a request header. We
+ * deliberately reuse the SAME key sources as `@extenshi/cli` so a developer who
+ * already ran `extenshi login` is set up with zero extra steps:
+ *
+ *   1. Environment variable EXTENSHI_API_KEY (set in the client's mcp config)
+ *   2. A `.env` in the current working directory (does NOT override real env)
+ *   3. Config file ~/.extenshi/config.json (written by `extenshi login`)
+ *
+ * Base URLs default to production and are overridable for local/staging:
+ *   - EXTENSHI_BFF_URL  (read tools)  default https://bff.extenshi.io
+ *   - EXTENSHI_API_URL  (scan)        default https://scan.extenshi.io
+ *
+ * stdout is the MCP protocol channel — this module must NEVER write to it.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+const DEFAULT_BFF_URL = 'https://bff.extenshi.io';
+const DEFAULT_SCAN_URL = 'https://scan.extenshi.io';
+const CONFIG_PATH = path.join(os.homedir(), '.extenshi', 'config.json');
+function readConfigFile() {
+    try {
+        return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Parse a `.env` body into key/value pairs. Supports comments (#), blank
+ * lines, an optional `export ` prefix, and single/double-quoted values.
+ */
+function parseDotEnv(raw) {
+    const out = {};
+    for (const rawLine of raw.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const withoutExport = line.startsWith('export ') ? line.slice('export '.length) : line;
+        const eq = withoutExport.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = withoutExport.slice(0, eq).trim();
+        if (!key)
+            continue;
+        let value = withoutExport.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        out[key] = value;
+    }
+    return out;
+}
+/** Load a local `.env` into process.env without overriding real env. Fail-soft. */
+function loadDotEnv(cwd = process.cwd()) {
+    try {
+        const parsed = parseDotEnv(fs.readFileSync(path.join(cwd, '.env'), 'utf8'));
+        for (const [key, value] of Object.entries(parsed)) {
+            if (process.env[key] === undefined)
+                process.env[key] = value;
+        }
+    }
+    catch {
+        // No .env or unreadable — non-fatal.
+    }
+}
+function stripSlash(url) {
+    return url.replace(/\/$/, '');
+}
+export function loadConfig() {
+    loadDotEnv();
+    const file = readConfigFile();
+    return {
+        apiKey: process.env.EXTENSHI_API_KEY ?? file.apiKey ?? null,
+        bffUrl: stripSlash(process.env.EXTENSHI_BFF_URL ?? DEFAULT_BFF_URL),
+        scanUrl: stripSlash(process.env.EXTENSHI_API_URL ?? file.apiUrl ?? DEFAULT_SCAN_URL),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,MAAM,eAAe,GAAG,yBAAyB,CAAA;AACjD,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAEnD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;AAgBvE,SAAS,cAAc;IACtB,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAe,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAW;IAC/B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAE3C,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACtF,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAQ;QAEvB,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7C,IAAI,CAAC,GAAG;YAAE,SAAQ;QAElB,IAAI,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC9C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC9C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;QAC3E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAC7D,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,qCAAqC;IACtC,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,UAAU;IACzB,UAAU,EAAE,CAAA;IACZ,MAAM,IAAI,GAAG,cAAc,EAAE,CAAA;IAE7B,OAAO;QACN,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3D,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,eAAe,CAAC;QACnE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,IAAI,gBAAgB,CAAC;KACpF,CAAA;AACF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+/**
+ * @extenshi/mcp — Model Context Protocol server for extension developers.
+ *
+ * Runs locally over stdio inside an MCP client (Claude Code/Desktop, Cursor)
+ * and exposes the Extenshi catalog as tools: market-research reads against the
+ * public BFF, plus a paid `scan_extension` that reuses the CLI scan path.
+ *
+ * Auth: an `ek_…` API key is REQUIRED. Over stdio there are no request headers,
+ * so the key comes from the environment (EXTENSHI_API_KEY) / `~/.extenshi`
+ * config — see config.ts. Every tool refuses to run without it and points the
+ * developer at the dedicated key page. The backend independently enforces the
+ * key, so this is defense in depth, not the only gate.
+ *
+ * NB: stdout is the MCP protocol channel — never write to it (use stderr).
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG"}

package/dist/index.js

@@ -0,0 +1,262 @@
+#!/usr/bin/env node
+/**
+ * @extenshi/mcp — Model Context Protocol server for extension developers.
+ *
+ * Runs locally over stdio inside an MCP client (Claude Code/Desktop, Cursor)
+ * and exposes the Extenshi catalog as tools: market-research reads against the
+ * public BFF, plus a paid `scan_extension` that reuses the CLI scan path.
+ *
+ * Auth: an `ek_…` API key is REQUIRED. Over stdio there are no request headers,
+ * so the key comes from the environment (EXTENSHI_API_KEY) / `~/.extenshi`
+ * config — see config.ts. Every tool refuses to run without it and points the
+ * developer at the dedicated key page. The backend independently enforces the
+ * key, so this is defense in depth, not the only gate.
+ *
+ * NB: stdout is the MCP protocol channel — never write to it (use stderr).
+ */
+import { createRequire } from 'node:module';
+import { FastMCP, UserError } from 'fastmcp';
+import { z } from 'zod';
+import { makeBff } from './bff.js';
+import { loadConfig } from './config.js';
+import { ScanError, scanArtifact } from './scan.js';
+import { shapeExtension, shapeSearch, shapeSecurity } from './shape.js';
+const require = createRequire(import.meta.url);
+const pkg = require('../package.json');
+const KEY_PAGE = 'https://dojo.extenshi.io/api-keys';
+const SIGNUP_PAGE = 'https://auth.extenshi.io/signup';
+const BILLING_PAGE = 'https://dojo.extenshi.io/billing';
+const MISSING_KEY_MESSAGE = 'An Extenshi API key is required. Create one at ' +
+    `${KEY_PAGE} (sign up first at ${SIGNUP_PAGE} if needed), then set it as the ` +
+    'EXTENSHI_API_KEY environment variable in your MCP client config (or run `extenshi login`).';
+const cfg = loadConfig();
+/** Return the configured key or refuse with an actionable instruction. */
+function requireKey() {
+    if (!cfg.apiKey)
+        throw new UserError(MISSING_KEY_MESSAGE);
+    return cfg.apiKey;
+}
+/** Build a BFF client bound to the developer's key (verifies key presence). */
+function bff() {
+    return makeBff(cfg.bffUrl, requireKey());
+}
+/** Normalize a thrown read error into a user-facing message. */
+function readError(err) {
+    if (err instanceof UserError)
+        throw err;
+    const message = err instanceof Error ? err.message : String(err);
+    // A 401 means the BFF rejected the key (enforcement landed / key invalid).
+    if (/unauthorized|401|api key/i.test(message)) {
+        throw new UserError(`Request rejected — ${message}\n\n${MISSING_KEY_MESSAGE}`);
+    }
+    throw new UserError(message);
+}
+const server = new FastMCP({
+    name: 'extenshi',
+    // FastMCP types `version` as a semver template literal; package.json gives a plain string.
+    version: pkg.version,
+    instructions: 'Extenshi catalog tools for extension developers: search the cross-store catalog, ' +
+        'inspect an extension and its security findings, find competitors, read market stats, ' +
+        'and run a pre-publish security scan. Requires an Extenshi API key ' +
+        `(${KEY_PAGE}). Read tools are free; scan_extension spends 1 credit (free for ` +
+        'extensions you have verified ownership of).',
+});
+// ── Read tools (free; key required) ─────────────────────────────────────────
+server.addTool({
+    name: 'search_extensions',
+    description: 'Search the cross-store extension catalog (Chrome, Firefox, Edge) with hybrid relevance. ' +
+        'Filter by store, category, pricing, rating, risk level, or requested permissions. ' +
+        'Returns a compact list for market research and competitive analysis.',
+    parameters: z.object({
+        query: z.string().optional().describe('Free-text search query (name, description, keywords).'),
+        stores: z
+            .array(z.enum(['CHROME', 'FIREFOX', 'EDGE']))
+            .optional()
+            .describe('Limit to stores: CHROME, FIREFOX, and/or EDGE.'),
+        categories: z.array(z.string()).optional().describe('Catalog category slugs to include.'),
+        pricing: z
+            .array(z.enum(['FREE', 'FREEMIUM', 'IN_APP_PURCHASES', 'SUBSCRIPTION']))
+            .optional()
+            .describe('Pricing models to include.'),
+        risk: z
+            .array(z.enum(['NONE', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL']))
+            .optional()
+            .describe('Risk categories to include.'),
+        permissions: z.array(z.string()).optional().describe('Only extensions requesting these permissions.'),
+        minRating: z.number().min(0).max(5).optional(),
+        sortBy: z
+            .enum(['relevance', 'popular', 'rating', 'recent', 'name', 'safety'])
+            .optional()
+            .describe('Sort order (default: popular, or relevance when a query is given).'),
+        limit: z.number().int().min(1).max(25).default(20).describe('Max results to return (1–25).'),
+    }),
+    execute: async (args) => {
+        try {
+            const limit = args.limit ?? 20;
+            const result = await bff().searchExtensions({
+                query: args.query,
+                stores: args.stores,
+                categories: args.categories,
+                pricingModels: args.pricing,
+                riskCategories: args.risk,
+                permissions: args.permissions,
+                minRating: args.minRating,
+                sortBy: args.sortBy ?? (args.query ? 'relevance' : 'popular'),
+                take: limit,
+            });
+            return JSON.stringify(shapeSearch(result, limit), null, 2);
+        }
+        catch (err) {
+            return readError(err);
+        }
+    },
+});
+server.addTool({
+    name: 'get_extension',
+    description: 'Get full catalog detail for one extension by its numeric catalog ID: metadata, ' +
+        'per-store ratings, install counts, categories, and a security badge.',
+    parameters: z.object({
+        extension_id: z.number().int().describe('Numeric catalog ID (from search_extensions results).'),
+    }),
+    execute: async (args) => {
+        try {
+            const result = await bff().getExtensionById(args.extension_id);
+            if (!result)
+                throw new UserError(`No extension found with catalog ID ${args.extension_id}.`);
+            return JSON.stringify(shapeExtension(result), null, 2);
+        }
+        catch (err) {
+            return readError(err);
+        }
+    },
+});
+server.addTool({
+    name: 'get_security',
+    description: 'Get the security analysis for an extension: risk score/category, finding counts by ' +
+        'severity, and the top grouped findings (scanner, rule, severity, count). ' +
+        'Reads existing scan results — does not trigger a new scan.',
+    parameters: z.object({
+        extension_id: z.number().int().describe('Numeric catalog ID.'),
+    }),
+    execute: async (args) => {
+        try {
+            const client = bff();
+            const [security, riskSummary] = await Promise.all([
+                client.getSecurityData(args.extension_id).catch(() => null),
+                client.getRiskSummary(args.extension_id).catch(() => null),
+            ]);
+            if (!security && !riskSummary) {
+                return JSON.stringify({ scanned: false, message: 'This extension has not been scanned yet.' }, null, 2);
+            }
+            return JSON.stringify(shapeSecurity(security, riskSummary), null, 2);
+        }
+        catch (err) {
+            return readError(err);
+        }
+    },
+});
+server.addTool({
+    name: 'get_related_extensions',
+    description: 'Find similar/competing extensions for a given extension — useful for competitive ' +
+        'analysis and alternatives research.',
+    parameters: z.object({
+        extension_id: z.number().int().describe('Numeric catalog ID.'),
+        limit: z.number().int().min(1).max(12).default(6).describe('Max alternatives to return (1–12).'),
+    }),
+    execute: async (args) => {
+        try {
+            const result = await bff().getRelatedExtensions(args.extension_id, args.limit ?? 6);
+            return JSON.stringify(shapeSearch(result, args.limit ?? 6), null, 2);
+        }
+        catch (err) {
+            return readError(err);
+        }
+    },
+});
+server.addTool({
+    name: 'market_overview',
+    description: 'Get aggregate catalog market stats and facet counts (by category, pricing model, and ' +
+        'risk level). Pass an optional query/filters to scope the facets to a search.',
+    parameters: z.object({
+        query: z.string().optional().describe('Optional query to scope facets to a search.'),
+        stores: z.array(z.enum(['CHROME', 'FIREFOX', 'EDGE'])).optional(),
+        categories: z.array(z.string()).optional(),
+    }),
+    execute: async (args) => {
+        try {
+            const client = bff();
+            const [stats, facets] = await Promise.all([
+                client.getStats().catch(() => null),
+                client
+                    .getSearchFacets({ query: args.query, stores: args.stores, categories: args.categories })
+                    .catch(() => null),
+            ]);
+            return JSON.stringify({
+                stats: stats ?? undefined,
+                facets: facets ?? undefined,
+            }, null, 2);
+        }
+        catch (err) {
+            return readError(err);
+        }
+    },
+});
+// ── Action tool (paid; key required) ────────────────────────────────────────
+server.addTool({
+    name: 'scan_extension',
+    description: 'Run a pre-publish security scan on a local extension artifact (.zip/.crx/.xpi) and ' +
+        'return the report. Spends 1 credit — FREE for an extension whose ownership you have ' +
+        'verified (pass its numeric catalog extension_id). Streams live per-scanner progress.',
+    parameters: z.object({
+        artifact_path: z.string().describe('Absolute or relative path to the built extension artifact (≤50 MB).'),
+        extension_id: z
+            .number()
+            .int()
+            .optional()
+            .describe('Numeric catalog ID of a VERIFIED-owned extension — required to spend a FREE credit.'),
+    }),
+    execute: async (args, { reportProgress }) => {
+        const apiKey = requireKey();
+        try {
+            const report = await scanArtifact({
+                artifactPath: args.artifact_path,
+                apiKey,
+                scanUrl: cfg.scanUrl,
+                extensionId: args.extension_id?.toString(),
+                onProgress: (p) => {
+                    if (typeof p.total === 'number' && p.total > 0) {
+                        void reportProgress({ progress: p.completed ?? 0, total: p.total });
+                    }
+                },
+            });
+            return JSON.stringify(shapeExtension(report), null, 2);
+        }
+        catch (err) {
+            if (err instanceof ScanError)
+                throw new UserError(scanErrorMessage(err));
+            throw err;
+        }
+    },
+});
+/** Map a scan backend failure to an actionable next step. */
+function scanErrorMessage(err) {
+    switch (err.status) {
+        case 401:
+            return `Authentication failed: ${err.message}\n\n${MISSING_KEY_MESSAGE}`;
+        case 402:
+            return `Out of credits. Top up at ${BILLING_PAGE}.`;
+        case 403:
+            if (err.errorCode === 'FREE_REQUIRES_CLAIM' || err.errorCode === 'FREE_REQUIRES_VERIFIED_OWNERSHIP') {
+                return (`${err.message}\n\nFree credits only cover extensions you have verified ownership of. ` +
+                    'Pass the numeric catalog extension_id of a verified extension, or buy credits at ' +
+                    `${BILLING_PAGE} to scan arbitrary artifacts.`);
+            }
+            return `Access denied: ${err.message}`;
+        case 429:
+            return `Rate limited — wait ${err.retryAfterSec ?? 60}s before trying again.`;
+        default:
+            return err.message;
+    }
+}
+server.start({ transportType: 'stdio' });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAY,OAAO,EAAE,MAAM,UAAU,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAEvE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAA;AAE7D,MAAM,QAAQ,GAAG,mCAAmC,CAAA;AACpD,MAAM,WAAW,GAAG,iCAAiC,CAAA;AACrD,MAAM,YAAY,GAAG,kCAAkC,CAAA;AAEvD,MAAM,mBAAmB,GACxB,iDAAiD;IACjD,GAAG,QAAQ,sBAAsB,WAAW,kCAAkC;IAC9E,4FAA4F,CAAA;AAE7F,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;AAExB,0EAA0E;AAC1E,SAAS,UAAU;IAClB,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,mBAAmB,CAAC,CAAA;IACzD,OAAO,GAAG,CAAC,MAAM,CAAA;AAClB,CAAC;AAED,+EAA+E;AAC/E,SAAS,GAAG;IACX,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;AACzC,CAAC;AAED,gEAAgE;AAChE,SAAS,SAAS,CAAC,GAAY;IAC9B,IAAI,GAAG,YAAY,SAAS;QAAE,MAAM,GAAG,CAAA;IACvC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAChE,2EAA2E;IAC3E,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,sBAAsB,OAAO,OAAO,mBAAmB,EAAE,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC;IAC1B,IAAI,EAAE,UAAU;IAChB,2FAA2F;IAC3F,OAAO,EAAE,GAAG,CAAC,OAA0C;IACvD,YAAY,EACX,mFAAmF;QACnF,uFAAuF;QACvF,oEAAoE;QACpE,IAAI,QAAQ,mEAAmE;QAC/E,6CAA6C;CAC9C,CAAC,CAAA;AAEF,+EAA+E;AAE/E,MAAM,CAAC,OAAO,CAAC;IACd,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACV,0FAA0F;QAC1F,oFAAoF;QACpF,sEAAsE;IACvE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QAC9F,MAAM,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;aAC5C,QAAQ,EAAE;aACV,QAAQ,CAAC,gDAAgD,CAAC;QAC5D,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QACzF,OAAO,EAAE,CAAC;aACR,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC,CAAC;aACvE,QAAQ,EAAE;aACV,QAAQ,CAAC,4BAA4B,CAAC;QACxC,IAAI,EAAE,CAAC;aACL,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;aAC5D,QAAQ,EAAE;aACV,QAAQ,CAAC,6BAA6B,CAAC;QACzC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;QACrG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC9C,MAAM,EAAE,CAAC;aACP,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;aACpE,QAAQ,EAAE;aACV,QAAQ,CAAC,oEAAoE,CAAC;QAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KAC5F,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAA;YAC9B,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC;gBAC3C,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,cAAc,EAAE,IAAI,CAAC,IAAI;gBACzB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7D,IAAI,EAAE,KAAK;aACX,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,SAAS,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;IACF,CAAC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,OAAO,CAAC;IACd,IAAI,EAAE,eAAe;IACrB,WAAW,EACV,iFAAiF;QACjF,sEAAsE;IACvE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;KAC/F,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC9D,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAA;YAC5F,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,SAAS,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;IACF,CAAC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,OAAO,CAAC;IACd,IAAI,EAAE,cAAc;IACpB,WAAW,EACV,qFAAqF;QACrF,2EAA2E;QAC3E,4DAA4D;IAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;KAC9D,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,GAAG,EAAE,CAAA;YACpB,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACjD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;gBAC3D,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aAC1D,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,SAAS,CACpB,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0CAA0C,EAAE,EACvE,IAAI,EACJ,CAAC,CACD,CAAA;YACF,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,SAAS,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;IACF,CAAC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,OAAO,CAAC;IACd,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EACV,mFAAmF;QACnF,qCAAqC;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;KAChG,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;YACnF,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,SAAS,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;IACF,CAAC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,OAAO,CAAC;IACd,IAAI,EAAE,iBAAiB;IACvB,WAAW,EACV,uFAAuF;QACvF,8EAA8E;IAC/E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QACpF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC1C,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,GAAG,EAAE,CAAA;YACpB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACzC,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;gBACnC,MAAM;qBACJ,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;qBACxF,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACnB,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,SAAS,CACpB;gBACC,KAAK,EAAE,KAAK,IAAI,SAAS;gBACzB,MAAM,EAAE,MAAM,IAAI,SAAS;aAC3B,EACD,IAAI,EACJ,CAAC,CACD,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,SAAS,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;IACF,CAAC;CACD,CAAC,CAAA;AAEF,+EAA+E;AAE/E,MAAM,CAAC,OAAO,CAAC;IACd,IAAI,EAAE,gBAAgB;IACtB,WAAW,EACV,qFAAqF;QACrF,sFAAsF;QACtF,sFAAsF;IACvF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;QACzG,YAAY,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CAAC,qFAAqF,CAAC;KACjG,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBACjC,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,MAAM;gBACN,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE;gBAC1C,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;oBACjB,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;wBAChD,KAAK,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;oBACpE,CAAC;gBACF,CAAC;aACD,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,SAAS;gBAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAA;YACxE,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;CACD,CAAC,CAAA;AAEF,6DAA6D;AAC7D,SAAS,gBAAgB,CAAC,GAAc;IACvC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,GAAG;YACP,OAAO,0BAA0B,GAAG,CAAC,OAAO,OAAO,mBAAmB,EAAE,CAAA;QACzE,KAAK,GAAG;YACP,OAAO,6BAA6B,YAAY,GAAG,CAAA;QACpD,KAAK,GAAG;YACP,IAAI,GAAG,CAAC,SAAS,KAAK,qBAAqB,IAAI,GAAG,CAAC,SAAS,KAAK,kCAAkC,EAAE,CAAC;gBACrG,OAAO,CACN,GAAG,GAAG,CAAC,OAAO,yEAAyE;oBACvF,mFAAmF;oBACnF,GAAG,YAAY,+BAA+B,CAC9C,CAAA;YACF,CAAC;YACD,OAAO,kBAAkB,GAAG,CAAC,OAAO,EAAE,CAAA;QACvC,KAAK,GAAG;YACP,OAAO,uBAAuB,GAAG,CAAC,aAAa,IAAI,EAAE,wBAAwB,CAAA;QAC9E;YACC,OAAO,GAAG,CAAC,OAAO,CAAA;IACpB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAA"}

package/dist/scan.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Scan an extension artifact against the Extenshi scan backend and RETURN the
+ * report (no printing) — the MCP-friendly counterpart to the CLI's `runScan`.
+ *
+ * It replicates the exact request `@extenshi/cli` makes
+ * (`POST {scanUrl}/api/v1/scan`, multipart `apiKey` + `artifact` + optional
+ * `extensionId`, SSE progress, 240s timeout, server-side credit
+ * consume→commit→refund) so the MCP `scan_extension` tool and the CLI bill and
+ * behave identically. The network + SSE logic is vendored (not imported) to
+ * keep this package independently publishable — npm rejects `workspace:*`.
+ *
+ * Errors surface as `ScanError` carrying the HTTP status + machine `errorCode`
+ * so the caller can render the right next-step instruction.
+ */
+export interface ScanProgress {
+    stage?: string;
+    scanner?: string | null;
+    completed?: number;
+    total?: number | null;
+    pct?: number;
+}
+export interface ScanArtifactOptions {
+    artifactPath: string;
+    apiKey: string;
+    /** Scan backend base URL, no trailing slash (e.g. https://scan.extenshi.io). */
+    scanUrl: string;
+    /** Numeric catalog ID — required to spend a FREE credit on an unverified extension. */
+    extensionId?: string;
+    /** Called for each upstream progress event so the caller can stream it. */
+    onProgress?: (p: ScanProgress) => void;
+}
+/** A scan failure that carries the HTTP status and the backend's machine code. */
+export declare class ScanError extends Error {
+    status?: number;
+    errorCode?: string;
+    retryAfterSec?: number;
+    constructor(message: string, opts?: {
+        status?: number;
+        errorCode?: string;
+        retryAfterSec?: number;
+    });
+}
+export type ScanReport = Record<string, unknown>;
+export declare function scanArtifact(opts: ScanArtifactOptions): Promise<ScanReport>;
+//# sourceMappingURL=scan.d.ts.map

package/dist/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAUH,MAAM,WAAW,YAAY;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,mBAAmB;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAA;IACf,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,CAAA;CACtC;AAED,kFAAkF;AAClF,qBAAa,SAAU,SAAQ,KAAK;IACnC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;gBAEV,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO;CAOvG;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEhD,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiDjF"}

package/dist/scan.js

@@ -0,0 +1,142 @@
+/**
+ * Scan an extension artifact against the Extenshi scan backend and RETURN the
+ * report (no printing) — the MCP-friendly counterpart to the CLI's `runScan`.
+ *
+ * It replicates the exact request `@extenshi/cli` makes
+ * (`POST {scanUrl}/api/v1/scan`, multipart `apiKey` + `artifact` + optional
+ * `extensionId`, SSE progress, 240s timeout, server-side credit
+ * consume→commit→refund) so the MCP `scan_extension` tool and the CLI bill and
+ * behave identically. The network + SSE logic is vendored (not imported) to
+ * keep this package independently publishable — npm rejects `workspace:*`.
+ *
+ * Errors surface as `ScanError` carrying the HTTP status + machine `errorCode`
+ * so the caller can render the right next-step instruction.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { FormData, fetch } from 'undici';
+import { parseSseFrames } from './sse.js';
+const SCAN_TIMEOUT_MS = 240_000;
+const MAX_ARTIFACT_BYTES = 50 * 1024 * 1024;
+/** A scan failure that carries the HTTP status and the backend's machine code. */
+export class ScanError extends Error {
+    status;
+    errorCode;
+    retryAfterSec;
+    constructor(message, opts = {}) {
+        super(message);
+        this.name = 'ScanError';
+        this.status = opts.status;
+        this.errorCode = opts.errorCode;
+        this.retryAfterSec = opts.retryAfterSec;
+    }
+}
+export async function scanArtifact(opts) {
+    const { artifactPath, apiKey, scanUrl, extensionId, onProgress } = opts;
+    if (!fs.existsSync(artifactPath)) {
+        throw new ScanError(`Artifact file not found: ${artifactPath}`);
+    }
+    const stats = fs.statSync(artifactPath);
+    if (!stats.isFile()) {
+        throw new ScanError(`Artifact path is not a file: ${artifactPath}`);
+    }
+    if (stats.size > MAX_ARTIFACT_BYTES) {
+        throw new ScanError(`Artifact exceeds 50 MB limit (${(stats.size / 1024 / 1024).toFixed(1)} MB)`);
+    }
+    const form = new FormData();
+    form.append('apiKey', apiKey);
+    form.append('artifact', new File([fs.readFileSync(artifactPath)], path.basename(artifactPath)));
+    if (extensionId)
+        form.append('extensionId', extensionId);
+    let response;
+    try {
+        response = await fetch(`${scanUrl}/api/v1/scan`, {
+            method: 'POST',
+            body: form,
+            headers: { accept: 'text/event-stream' },
+            signal: AbortSignal.timeout(SCAN_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'TimeoutError') {
+            throw new ScanError(`Scan timed out after ${SCAN_TIMEOUT_MS / 1000}s. If a credit was charged it auto-refunds within 1 minute — do NOT retry immediately.`);
+        }
+        throw err;
+    }
+    // Auth/billing/gateway errors are always JSON and arrive before any stream.
+    if (!response.ok) {
+        const body = await parseJsonBody(response);
+        throw errorForStatus(response.status, body);
+    }
+    const contentType = response.headers.get('content-type') ?? '';
+    if (contentType.includes('text/event-stream')) {
+        return await consumeSseStream(response, onProgress);
+    }
+    // Legacy single-JSON mode (server ignored the Accept header).
+    return await parseJsonBody(response);
+}
+async function consumeSseStream(response, onProgress) {
+    if (!response.body)
+        throw new ScanError('Scan stream had no response body');
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let report = null;
+    let errorMessage = null;
+    const handle = (ev) => {
+        if (ev.event === 'progress') {
+            const p = safeJson(ev.data);
+            if (p && onProgress)
+                onProgress(p);
+        }
+        else if (ev.event === 'result') {
+            report = safeJson(ev.data);
+        }
+        else if (ev.event === 'error') {
+            const e = safeJson(ev.data);
+            errorMessage = e && typeof e.error === 'string' ? e.error : 'scan failed';
+        }
+    };
+    for await (const chunk of response.body) {
+        buffer += decoder.decode(chunk, { stream: true });
+        const { events, rest } = parseSseFrames(buffer);
+        buffer = rest;
+        for (const ev of events)
+            handle(ev);
+    }
+    // Flush a trailing frame not terminated by a blank line.
+    const { events } = parseSseFrames(`${buffer}\n\n`);
+    for (const ev of events)
+        handle(ev);
+    if (errorMessage)
+        throw new ScanError(`Scan failed: ${errorMessage}`);
+    if (!report)
+        throw new ScanError('Scan stream ended before returning a result');
+    return report;
+}
+function safeJson(data) {
+    try {
+        return JSON.parse(data);
+    }
+    catch {
+        return null;
+    }
+}
+async function parseJsonBody(response) {
+    const raw = await response.text();
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        const snippet = raw.replace(/\s+/g, ' ').trim().slice(0, 200);
+        throw new ScanError(`Scan backend returned a non-JSON response (HTTP ${response.status}). ${snippet ? `Response: ${snippet}` : ''}`.trim(), { status: response.status });
+    }
+}
+function errorForStatus(status, body) {
+    const message = typeof body.error === 'string' ? body.error : `HTTP ${status}`;
+    const errorCode = typeof body.errorCode === 'string' ? body.errorCode : undefined;
+    const retryAfterSec = typeof body.retryAfterSec === 'number'
+        ? body.retryAfterSec
+        : undefined;
+    return new ScanError(message, { status, errorCode, retryAfterSec });
+}
+//# sourceMappingURL=scan.js.map

package/dist/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAiB,MAAM,QAAQ,CAAA;AACvD,OAAO,EAAE,cAAc,EAAiB,MAAM,UAAU,CAAA;AAExD,MAAM,eAAe,GAAG,OAAO,CAAA;AAC/B,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAqB3C,kFAAkF;AAClF,MAAM,OAAO,SAAU,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,aAAa,CAAS;IAEtB,YAAY,OAAe,EAAE,OAAwE,EAAE;QACtG,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAA;IACxC,CAAC;CACD;AAID,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAyB;IAC3D,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;IAEvE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IACvC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CAAC,gCAAgC,YAAY,EAAE,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAClG,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAA;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7B,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC/F,IAAI,WAAW;QAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAExD,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;YACxC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC5C,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAClB,wBAAwB,eAAe,GAAG,IAAI,wFAAwF,CACtI,CAAA;QACF,CAAC;QACD,MAAM,GAAG,CAAA;IACV,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAC9D,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IACpD,CAAC;IAED,8DAA8D;IAC9D,OAAO,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAA;AACrC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,QAAkB,EAClB,UAAsC;IAEtC,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IAE3E,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,MAAM,GAAsB,IAAI,CAAA;IACpC,IAAI,YAAY,GAAkB,IAAI,CAAA;IAEtC,MAAM,MAAM,GAAG,CAAC,EAAY,EAAQ,EAAE;QACrC,IAAI,EAAE,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;YAC3B,IAAI,CAAC,IAAI,UAAU;gBAAE,UAAU,CAAC,CAAiB,CAAC,CAAA;QACnD,CAAC;aAAM,IAAI,EAAE,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;aAAM,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;YAC3B,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAA;QAC1E,CAAC;IACF,CAAC,CAAA;IAED,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;QAC/C,MAAM,GAAG,IAAI,CAAA;QACb,KAAK,MAAM,EAAE,IAAI,MAAM;YAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IACpC,CAAC;IACD,yDAAyD;IACzD,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,MAAM,MAAM,CAAC,CAAA;IAClD,KAAK,MAAM,EAAE,IAAI,MAAM;QAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IAEnC,IAAI,YAAY;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,YAAY,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAA;IAC/E,OAAO,MAAM,CAAA;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC7B,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAkB;IAC9C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC7D,MAAM,IAAI,SAAS,CAClB,mDAAmD,QAAQ,CAAC,MAAM,MAAM,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EACtH,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC3B,CAAA;IACF,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,IAA6B;IACpE,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAA;IAC9E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACjF,MAAM,aAAa,GAClB,OAAQ,IAAmC,CAAC,aAAa,KAAK,QAAQ;QACrE,CAAC,CAAE,IAAkC,CAAC,aAAa;QACnD,CAAC,CAAC,SAAS,CAAA;IACb,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAA;AACpE,CAAC"}

package/dist/shape.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Output shaping for MCP tool results.
+ *
+ * MCP tool results land directly in the AI client's context window, so we keep
+ * them compact and curated. Field names below match the live BFF payloads
+ * (catalog router mounted as `catalog`, security as `security`):
+ *   - search items wrap a cross-store cluster: `{ id, slug, snapshots[], availableStores, security }`
+ *     where the human-facing fields (name, rating, users, store) live on each snapshot.
+ *   - `getExtensionById` returns the cluster with aggregated `latest*` fields.
+ *   - `getSecurityData` returns `{ riskAssessment, scanExecution, findings:{ total, groupTotal, bySeverity } }`.
+ *   - `getRiskSummary` is already a compact summary (or null if never scanned).
+ *
+ * `compact()` is a defensive fallback that bounds array length / string length /
+ * depth so a tool can never blow up the context even if a shape drifts.
+ */
+interface CompactOpts {
+    maxArray?: number;
+    maxString?: number;
+    maxDepth?: number;
+}
+/** Recursively bound a value's size: cap arrays, truncate strings, limit depth. */
+export declare function compact(value: unknown, opts?: CompactOpts, depth?: number): unknown;
+type Obj = Record<string, unknown>;
+/** Compact a search / related result down to a count + curated items. */
+export declare function shapeSearch(result: unknown, limit: number): Obj;
+/** Curate a single extension detail (`getExtensionById`). */
+export declare function shapeExtension(result: unknown): unknown;
+/** Curate the security view: risk summary + grouped findings (top N per severity). */
+export declare function shapeSecurity(security: unknown, riskSummary: unknown): Obj;
+export {};
+//# sourceMappingURL=shape.d.ts.map

package/dist/shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shape.d.ts","sourceRoot":"","sources":["../src/shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,UAAU,WAAW;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,mFAAmF;AACnF,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,WAAgB,EAAE,KAAK,SAAI,GAAG,OAAO,CAqBlF;AAED,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AA+ClC,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,CAS/D;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAiCvD;AAkBD,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,GAAG,GAAG,CAuC1E"}

package/dist/shape.js

@@ -0,0 +1,184 @@
+/**
+ * Output shaping for MCP tool results.
+ *
+ * MCP tool results land directly in the AI client's context window, so we keep
+ * them compact and curated. Field names below match the live BFF payloads
+ * (catalog router mounted as `catalog`, security as `security`):
+ *   - search items wrap a cross-store cluster: `{ id, slug, snapshots[], availableStores, security }`
+ *     where the human-facing fields (name, rating, users, store) live on each snapshot.
+ *   - `getExtensionById` returns the cluster with aggregated `latest*` fields.
+ *   - `getSecurityData` returns `{ riskAssessment, scanExecution, findings:{ total, groupTotal, bySeverity } }`.
+ *   - `getRiskSummary` is already a compact summary (or null if never scanned).
+ *
+ * `compact()` is a defensive fallback that bounds array length / string length /
+ * depth so a tool can never blow up the context even if a shape drifts.
+ */
+/** Recursively bound a value's size: cap arrays, truncate strings, limit depth. */
+export function compact(value, opts = {}, depth = 0) {
+    const { maxArray = 20, maxString = 400, maxDepth = 5 } = opts;
+    if (typeof value === 'string') {
+        return value.length > maxString ? `${value.slice(0, maxString)}…` : value;
+    }
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (depth >= maxDepth)
+        return Array.isArray(value) ? `[${value.length} items]` : '{…}';
+    if (Array.isArray(value)) {
+        const capped = value.slice(0, maxArray).map((v) => compact(v, opts, depth + 1));
+        if (value.length > maxArray)
+            capped.push(`…+${value.length - maxArray} more`);
+        return capped;
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (v === undefined || v === null)
+            continue;
+        out[k] = compact(v, opts, depth + 1);
+    }
+    return out;
+}
+function isObj(v) {
+    return !!v && typeof v === 'object' && !Array.isArray(v);
+}
+/** Drop nullish entries so curated objects stay terse. */
+function prune(obj) {
+    for (const k of Object.keys(obj))
+        if (obj[k] === undefined || obj[k] === null)
+            delete obj[k];
+    return obj;
+}
+function primaryCategory(snap) {
+    const cats = snap.categories;
+    if (Array.isArray(cats) && isObj(cats[0]))
+        return cats[0].name ?? cats[0].displayName;
+    return undefined;
+}
+/** Curate one search-result cluster via its primary (first) snapshot. */
+function shapeSearchItem(item) {
+    if (!isObj(item))
+        return { value: compact(item) };
+    const snaps = Array.isArray(item.snapshots) ? item.snapshots : [];
+    const snap = isObj(snaps[0]) ? snaps[0] : {};
+    const security = isObj(item.security) ? item.security : undefined;
+    const riskAssessment = security && isObj(security.riskAssessment) ? security.riskAssessment : undefined;
+    return prune({
+        id: item.id,
+        slug: item.slug,
+        name: snap.name,
+        author: snap.authorName,
+        stores: item.availableStores,
+        store: snap.store,
+        storeId: snap.storeId,
+        users: snap.usersNumeric ?? snap.weeklyDownloads,
+        rating: snap.rating,
+        reviews: snap.ratingCount,
+        category: primaryCategory(snap),
+        version: snap.version,
+        lastUpdated: snap.lastUpdated,
+        sizeBytes: item.latestSizeBytes,
+        riskScore: riskAssessment?.overallScore ?? security?.overallScore,
+        shortDescription: typeof snap.shortDescription === 'string' ? snap.shortDescription.slice(0, 200) : undefined,
+    });
+}
+/** Compact a search / related result down to a count + curated items. */
+export function shapeSearch(result, limit) {
+    const arr = Array.isArray(result)
+        ? result
+        : isObj(result) && Array.isArray(result.items)
+            ? result.items
+            : [];
+    const items = arr.slice(0, limit).map(shapeSearchItem);
+    const total = isObj(result) ? (result.total ?? result.totalCount) : undefined;
+    return prune({ count: items.length, total, items });
+}
+/** Curate a single extension detail (`getExtensionById`). */
+export function shapeExtension(result) {
+    if (!isObj(result))
+        return result ?? null;
+    const snaps = Array.isArray(result.snapshots) ? result.snapshots : [];
+    const stores = [...new Set(snaps.map((s) => (isObj(s) ? s.store : undefined)).filter(Boolean))];
+    const reviews = result.reviews;
+    return prune({
+        id: result.id,
+        slug: result.slug,
+        name: result.latestName,
+        rating: result.latestRating,
+        users: result.latestUsersNumeric,
+        lastUpdated: result.latestUpdatedAt,
+        traderStatus: result.latestTraderStatus,
+        riskScore: result.latestRiskScore,
+        riskScoreAt: result.latestRiskScoreAt,
+        sizeBytes: result.latestSizeBytes,
+        hidden: result.hidden || undefined,
+        stores: stores.length ? stores : undefined,
+        reviewCount: Array.isArray(reviews) ? reviews.length : reviews,
+        snapshots: snaps.slice(0, 6).map((s) => prune({
+            store: s.store,
+            storeId: s.storeId,
+            name: s.name,
+            rating: s.rating,
+            reviews: s.ratingCount,
+            users: s.usersNumeric ?? s.weeklyDownloads,
+            version: s.version,
+            lastUpdated: s.lastUpdated,
+            category: primaryCategory(s),
+        })),
+    });
+}
+/** Curate a finding group to the essentials. */
+function shapeFinding(f) {
+    if (!isObj(f))
+        return { value: compact(f) };
+    const locations = Array.isArray(f.locations)
+        ? f.locations.slice(0, 5).map((l) => (isObj(l) ? l.file : l))
+        : undefined;
+    return prune({
+        scanner: f.scanner,
+        rule: f.rule_id ?? f.ruleId,
+        severity: f.severity,
+        title: f.title,
+        count: f.count,
+        files: locations,
+    });
+}
+/** Curate the security view: risk summary + grouped findings (top N per severity). */
+export function shapeSecurity(security, riskSummary) {
+    const out = {};
+    if (isObj(riskSummary)) {
+        out.summary = riskSummary;
+    }
+    else if (isObj(security) && isObj(security.riskAssessment)) {
+        const ra = security.riskAssessment;
+        out.summary = prune({
+            overallScore: ra.overallScore,
+            riskCategory: ra.riskCategory,
+            severityBreakdown: isObj(ra.contributingFactors)
+                ? ra.contributingFactors.severity_breakdown
+                : undefined,
+        });
+    }
+    if (isObj(security)) {
+        if (isObj(security.scanExecution)) {
+            const se = security.scanExecution;
+            out.scan = prune({ status: se.status, completedAt: se.completedAt });
+        }
+        if (isObj(security.findings)) {
+            const f = security.findings;
+            const bySeverity = {};
+            if (isObj(f.bySeverity)) {
+                for (const [sev, rows] of Object.entries(f.bySeverity)) {
+                    if (Array.isArray(rows) && rows.length) {
+                        bySeverity[sev] = rows.slice(0, 8).map(shapeFinding);
+                        if (rows.length > 8)
+                            bySeverity[sev].push(`…+${rows.length - 8} more`);
+                    }
+                }
+            }
+            out.findings = prune({ total: f.total, groupTotal: f.groupTotal, bySeverity });
+        }
+    }
+    if (Object.keys(out).length === 0)
+        return { scanned: false, message: 'This extension has not been scanned yet.' };
+    return out;
+}
+//# sourceMappingURL=shape.js.map

package/dist/shape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shape.js","sourceRoot":"","sources":["../src/shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,mFAAmF;AACnF,MAAM,UAAU,OAAO,CAAC,KAAc,EAAE,OAAoB,EAAE,EAAE,KAAK,GAAG,CAAC;IACxE,MAAM,EAAE,QAAQ,GAAG,EAAE,EAAE,SAAS,GAAG,GAAG,EAAE,QAAQ,GAAG,CAAC,EAAE,GAAG,IAAI,CAAA;IAE7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1E,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7D,IAAI,KAAK,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;IAEtF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QAC/E,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,QAAQ,OAAO,CAAC,CAAA;QAC7E,OAAO,MAAM,CAAA;IACd,CAAC;IAED,MAAM,GAAG,GAA4B,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,SAAQ;QAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAID,SAAS,KAAK,CAAC,CAAU;IACxB,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,0DAA0D;AAC1D,SAAS,KAAK,CAAC,GAAQ;IACtB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAA;IAC5F,OAAO,GAAG,CAAA;AACX,CAAC;AAED,SAAS,eAAe,CAAC,IAAS;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAA;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAQ,IAAI,CAAC,CAAC,CAAS,CAAC,IAAI,IAAK,IAAI,CAAC,CAAC,CAAS,CAAC,WAAW,CAAA;IACvG,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,yEAAyE;AACzE,SAAS,eAAe,CAAC,IAAa;IACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,SAAmB,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,MAAM,cAAc,GACnB,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,cAAsB,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1F,OAAO,KAAK,CAAC;QACZ,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,UAAU;QACvB,MAAM,EAAE,IAAI,CAAC,eAAe;QAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,eAAe;QAChD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,WAAW;QACzB,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,eAAe;QAC/B,SAAS,EAAE,cAAc,EAAE,YAAY,IAAI,QAAQ,EAAE,YAAY;QACjE,gBAAgB,EACf,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;KAC5F,CAAC,CAAA;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,WAAW,CAAC,MAAe,EAAE,KAAa;IACzD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAChC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7C,CAAC,CAAE,MAAM,CAAC,KAAmB;YAC7B,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7E,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAS,CAAC,CAAA;AAC3D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,MAAe;IAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,IAAI,IAAI,CAAA;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,SAAmB,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;IAC9B,OAAO,KAAK,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,UAAU;QACvB,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,WAAW,EAAE,MAAM,CAAC,eAAe;QACnC,YAAY,EAAE,MAAM,CAAC,kBAAkB;QACvC,SAAS,EAAE,MAAM,CAAC,eAAe;QACjC,WAAW,EAAE,MAAM,CAAC,iBAAiB;QACrC,SAAS,EAAE,MAAM,CAAC,eAAe;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;QAClC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC1C,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QAC9D,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,KAAK,CAAC;YACL,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,WAAW;YACtB,KAAK,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,eAAe;YAC1C,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;SAC5B,CAAC,CACF;KACD,CAAC,CAAA;AACH,CAAC;AAED,gDAAgD;AAChD,SAAS,YAAY,CAAC,CAAU;IAC/B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAE,CAAC,CAAC,SAAuB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,SAAS,CAAA;IACZ,OAAO,KAAK,CAAC;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM;QAC3B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,SAAS;KAChB,CAAC,CAAA;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,QAAiB,EAAE,WAAoB;IACpE,MAAM,GAAG,GAAQ,EAAE,CAAA;IAEnB,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,OAAO,GAAG,WAAW,CAAA;IAC1B,CAAC;SAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9D,MAAM,EAAE,GAAG,QAAQ,CAAC,cAAqB,CAAA;QACzC,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC;YACnB,YAAY,EAAE,EAAE,CAAC,YAAY;YAC7B,YAAY,EAAE,EAAE,CAAC,YAAY;YAC7B,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC;gBAC/C,CAAC,CAAE,EAAE,CAAC,mBAA2B,CAAC,kBAAkB;gBACpD,CAAC,CAAC,SAAS;SACZ,CAAC,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,aAAoB,CAAA;YACxC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;QACrE,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAe,CAAA;YAClC,MAAM,UAAU,GAAQ,EAAE,CAAA;YAC1B,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAiB,CAAC,EAAE,CAAC;oBAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;wBACxC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;wBACpD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;4BAAG,UAAU,CAAC,GAAG,CAAe,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;oBACtF,CAAC;gBACF,CAAC;YACF,CAAC;YACD,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;QAC/E,CAAC;IACF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAA;IAC/E,OAAO,GAAG,CAAA;AACX,CAAC"}

package/dist/sse.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Minimal Server-Sent Events frame parser for the scan progress stream.
+ *
+ * Vendored from `@extenshi/cli` (tools/extenshi-cli/src/sse.ts) so this package
+ * stays a clean standalone npm publish with no cross-workspace dependency
+ * (npm rejects `workspace:*` at publish time — see scripts/publish.sh in the
+ * CLI). The scan backend emits `text/event-stream` with named events
+ * (`progress`, `result`, `error`) plus keep-alive comment frames (`:ping`).
+ *
+ * Pure (no I/O): feed it the accumulated buffer, get back the complete events
+ * plus the unconsumed tail to carry into the next chunk.
+ */
+export interface SseEvent {
+    /** The `event:` field value (defaults to "message" per the SSE spec). */
+    event: string;
+    /** The joined `data:` field value(s). */
+    data: string;
+}
+/**
+ * Split an accumulated SSE buffer into complete events. Frames are delimited by
+ * a blank line (`\n\n`); a partial trailing frame is returned as `rest`.
+ * Comment frames (lines starting with `:`) and dataless frames are skipped.
+ */
+export declare function parseSseFrames(buffer: string): {
+    events: SseEvent[];
+    rest: string;
+};
+//# sourceMappingURL=sse.d.ts.map

package/dist/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,QAAQ;IACxB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAA;IACb,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAA;CACZ;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAgCnF"}

package/dist/sse.js

@@ -0,0 +1,48 @@
+/**
+ * Minimal Server-Sent Events frame parser for the scan progress stream.
+ *
+ * Vendored from `@extenshi/cli` (tools/extenshi-cli/src/sse.ts) so this package
+ * stays a clean standalone npm publish with no cross-workspace dependency
+ * (npm rejects `workspace:*` at publish time — see scripts/publish.sh in the
+ * CLI). The scan backend emits `text/event-stream` with named events
+ * (`progress`, `result`, `error`) plus keep-alive comment frames (`:ping`).
+ *
+ * Pure (no I/O): feed it the accumulated buffer, get back the complete events
+ * plus the unconsumed tail to carry into the next chunk.
+ */
+/**
+ * Split an accumulated SSE buffer into complete events. Frames are delimited by
+ * a blank line (`\n\n`); a partial trailing frame is returned as `rest`.
+ * Comment frames (lines starting with `:`) and dataless frames are skipped.
+ */
+export function parseSseFrames(buffer) {
+    let buf = buffer.replace(/\r\n/g, '\n');
+    const events = [];
+    while (true) {
+        const boundary = buf.indexOf('\n\n');
+        if (boundary === -1)
+            break;
+        const frame = buf.slice(0, boundary);
+        buf = buf.slice(boundary + 2);
+        let eventName = 'message';
+        const dataLines = [];
+        for (const line of frame.split('\n')) {
+            if (line === '' || line.startsWith(':'))
+                continue; // blank or comment (keep-alive)
+            const colon = line.indexOf(':');
+            const field = colon === -1 ? line : line.slice(0, colon);
+            let value = colon === -1 ? '' : line.slice(colon + 1);
+            if (value.startsWith(' '))
+                value = value.slice(1);
+            if (field === 'event')
+                eventName = value;
+            else if (field === 'data')
+                dataLines.push(value);
+        }
+        if (dataLines.length > 0) {
+            events.push({ event: eventName, data: dataLines.join('\n') });
+        }
+    }
+    return { events, rest: buf };
+}
+//# sourceMappingURL=sse.js.map

package/dist/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC5C,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACvC,MAAM,MAAM,GAAe,EAAE,CAAA;IAE7B,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,QAAQ,KAAK,CAAC,CAAC;YAAE,MAAK;QAE1B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;QACpC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;QAE7B,IAAI,SAAS,GAAG,SAAS,CAAA;QACzB,MAAM,SAAS,GAAa,EAAE,CAAA;QAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAQ,CAAC,gCAAgC;YAElF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/B,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;YACxD,IAAI,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YACrD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAEjD,IAAI,KAAK,KAAK,OAAO;gBAAE,SAAS,GAAG,KAAK,CAAA;iBACnC,IAAI,KAAK,KAAK,MAAM;gBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AAC7B,CAAC"}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@extenshi/mcp",
+  "version": "0.0.1",
+  "description": "Extenshi MCP server — bring the extension catalog (search, security, market research) and pre-publish scanning into your AI tools",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "extenshi-mcp": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest run",
+    "prepublishOnly": "yarn build"
+  },
+  "dependencies": {
+    "@trpc/client": "^11.17.0",
+    "fastmcp": "^4.0.1",
+    "undici": "^7.3.0",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@types/node": "^22.16.5",
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}