@falzz1010/laravel-mcp-server 1.0.0

package/build/utils/rate-limiter.js

@@ -0,0 +1,57 @@
+export class RateLimiter {
+    config;
+    timestamps = [];
+    lastRequestTime = 0;
+    constructor(config = {
+        maxRequestsPerMinute: 30,
+        maxRequestsPerHour: 500,
+        cooldownMs: 2000,
+    }) {
+        this.config = config;
+    }
+    checkRateLimit() {
+        const now = Date.now();
+        // Check cooldown
+        const elapsedSinceLast = now - this.lastRequestTime;
+        if (this.lastRequestTime > 0 && elapsedSinceLast < this.config.cooldownMs) {
+            const waitMs = this.config.cooldownMs - elapsedSinceLast;
+            return {
+                allowed: false,
+                retryAfterMs: waitMs,
+                reason: `Rate Limiter: Please wait ${Math.ceil(waitMs / 1000)}s before sending another request (cooldown: ${this.config.cooldownMs}ms).`,
+            };
+        }
+        // Clean timestamps older than 1 hour
+        const oneHourAgo = now - 3600 * 1000;
+        this.timestamps = this.timestamps.filter((ts) => ts > oneHourAgo);
+        // Check requests in last 1 minute
+        const oneMinuteAgo = now - 60 * 1000;
+        const requestsLastMinute = this.timestamps.filter((ts) => ts > oneMinuteAgo).length;
+        if (requestsLastMinute >= this.config.maxRequestsPerMinute) {
+            return {
+                allowed: false,
+                retryAfterMs: 60000,
+                reason: `Rate Limiter: Maximum limit of ${this.config.maxRequestsPerMinute} requests per minute exceeded.`,
+            };
+        }
+        // Check requests in last 1 hour
+        if (this.timestamps.length >= this.config.maxRequestsPerHour) {
+            return {
+                allowed: false,
+                retryAfterMs: 3600000,
+                reason: `Rate Limiter: Maximum limit of ${this.config.maxRequestsPerHour} requests per hour exceeded.`,
+            };
+        }
+        return { allowed: true };
+    }
+    recordRequest() {
+        const now = Date.now();
+        this.timestamps.push(now);
+        this.lastRequestTime = now;
+    }
+    reset() {
+        this.timestamps = [];
+        this.lastRequestTime = 0;
+    }
+}
+//# sourceMappingURL=rate-limiter.js.map

package/build/utils/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/utils/rate-limiter.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,WAAW;IAKZ;IAJF,UAAU,GAAa,EAAE,CAAC;IAC1B,eAAe,GAAG,CAAC,CAAC;IAE5B,YACU,SAA4B;QAClC,oBAAoB,EAAE,EAAE;QACxB,kBAAkB,EAAE,GAAG;QACvB,UAAU,EAAE,IAAI;KACjB;QAJO,WAAM,GAAN,MAAM,CAIb;IACA,CAAC;IAEG,cAAc;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,iBAAiB;QACjB,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC;QACpD,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,IAAI,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,gBAAgB,CAAC;YACzD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,MAAM;gBACpB,MAAM,EAAE,6BAA6B,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,+CAA+C,IAAI,CAAC,MAAM,CAAC,UAAU,MAAM;aACzI,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC;QAElE,kCAAkC;QAClC,MAAM,YAAY,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;QACrC,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC;QAEpF,IAAI,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAC3D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,KAAK;gBACnB,MAAM,EAAE,kCAAkC,IAAI,CAAC,MAAM,CAAC,oBAAoB,gCAAgC;aAC3G,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC7D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,OAAO;gBACrB,MAAM,EAAE,kCAAkC,IAAI,CAAC,MAAM,CAAC,kBAAkB,8BAA8B;aACvG,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEM,aAAa;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IAEM,KAAK;QACV,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;IAC3B,CAAC;CACF"}

package/build/utils/security.d.ts

@@ -0,0 +1,23 @@
+export type CommandTier = "READ_ONLY" | "CAUTIOUS" | "DANGEROUS";
+export declare function validateLaravelPath(laravelPath: string): void;
+export declare function checkEnvironment(laravelPath: string): void;
+export declare function classifyCommand(command: string): CommandTier;
+export declare function isCommandAllowed(command: string): {
+    allowed: boolean;
+    tier: CommandTier;
+    reason: string;
+};
+export declare function sanitizeArgs(args: string[]): string[];
+export declare function validateDangerousFlags(command: string, args: string[]): void;
+export declare function sanitizeTinkerCode(code: string): {
+    safe: boolean;
+    blocked: string[];
+};
+export declare function isPathSafe(relativePath: string, rootPath: string): string;
+export declare function isWriteAllowed(relativePath: string): {
+    allowed: boolean;
+    reason: string;
+};
+export declare function maskEnvValues(content: string): string;
+export declare function computeFileHash(content: string): string;
+//# sourceMappingURL=security.d.ts.map

package/build/utils/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC;AAkHjE,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAQ7D;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAc1D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAY5D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAczG;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAmBrD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAkB5E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAmBrF;AAED,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBzE;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqCzF;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAqBrD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/build/utils/security.js

@@ -0,0 +1,282 @@
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+const READ_ONLY_COMMANDS = new Set([
+    "about",
+    "env",
+    "route:list",
+    "migrate:status",
+    "schedule:list",
+    "config:show",
+]);
+const CAUTIOUS_COMMANDS = new Set([
+    "route:cache",
+    "route:clear",
+    "config:cache",
+    "config:clear",
+    "cache:clear",
+    "view:clear",
+    "optimize",
+    "optimize:clear",
+    "migrate",
+    "db:seed",
+    "key:generate",
+    "storage:link",
+]);
+const DANGEROUS_COMMANDS = new Set([
+    "migrate:fresh",
+    "migrate:reset",
+    "migrate:rollback",
+    "migrate:refresh",
+    "db:wipe",
+    "down",
+    "up",
+    "tinker",
+    "serve",
+    "queue:restart",
+    "event:generate",
+    "vendor:publish",
+    "schedule:run",
+    "notifications:table",
+    "session:table",
+    "queue:table",
+    "cache:table",
+    "package:discover",
+    "stub:publish",
+]);
+const DANGEROUS_FNS_TINKER = [
+    "exec",
+    "system",
+    "passthru",
+    "shell_exec",
+    "popen",
+    "proc_open",
+    "unlink",
+    "rmdir",
+    "mkdir",
+    "rename",
+    "copy",
+    "chmod",
+    "chown",
+    "file_put_contents",
+    "fwrite",
+    "fopen",
+    "curl_exec",
+    "eval",
+    "assert",
+    "ini_set",
+    "putenv",
+    "dl",
+    "truncate",
+    "forceDelete",
+    "DB::statement",
+    "DB::unprepared",
+    "Schema::drop",
+    "Schema::dropIfExists",
+];
+const ALLOWED_WRITE_EXTENSIONS = new Set([
+    ".php",
+    ".json",
+    ".yaml",
+    ".yml",
+    ".xml",
+    ".stub",
+    ".md",
+    ".txt",
+]);
+const ALLOWED_WRITE_DIRS = [
+    "app",
+    "routes",
+    "database/migrations",
+    "database/seeders",
+    "database/factories",
+    "resources/views",
+    "config",
+    "tests",
+];
+const BLOCKED_WRITE_PATHS = [
+    ".env",
+    "vendor",
+    "node_modules",
+    "storage",
+    "public",
+    "bootstrap",
+    "artisan",
+    "composer.json",
+    "composer.lock",
+    ".git",
+];
+export function validateLaravelPath(laravelPath) {
+    if (!fs.existsSync(laravelPath)) {
+        throw new Error(`Directory does not exist: ${laravelPath}`);
+    }
+    const artisanPath = path.join(laravelPath, "artisan");
+    if (!fs.existsSync(artisanPath)) {
+        throw new Error(`Target directory is not a valid Laravel project (missing 'artisan' file): ${laravelPath}`);
+    }
+}
+export function checkEnvironment(laravelPath) {
+    const envPath = path.join(laravelPath, ".env");
+    if (fs.existsSync(envPath)) {
+        const envContent = fs.readFileSync(envPath, "utf-8");
+        const match = envContent.match(/^APP_ENV\s*=\s*(.*)$/m);
+        if (match) {
+            const envValue = match[1].trim().replace(/^["']|["']$/g, "");
+            if (envValue.toLowerCase() === "production") {
+                throw new Error("SECURITY BLOCK: Laravel MCP Server refuses to start when APP_ENV=production.");
+            }
+            else if (envValue.toLowerCase() === "staging") {
+                console.error("[WARNING] Server running in STAGING environment. Exercise caution.");
+            }
+        }
+    }
+}
+export function classifyCommand(command) {
+    const normalized = command.trim().toLowerCase();
+    if (DANGEROUS_COMMANDS.has(normalized)) {
+        return "DANGEROUS";
+    }
+    if (READ_ONLY_COMMANDS.has(normalized)) {
+        return "READ_ONLY";
+    }
+    if (CAUTIOUS_COMMANDS.has(normalized) || normalized.startsWith("make:")) {
+        return "CAUTIOUS";
+    }
+    return "DANGEROUS";
+}
+export function isCommandAllowed(command) {
+    const tier = classifyCommand(command);
+    if (tier === "DANGEROUS") {
+        return {
+            allowed: false,
+            tier,
+            reason: `Command '${command}' is classified as DANGEROUS or UNKNOWN and is permanently blocked for safety.`,
+        };
+    }
+    return {
+        allowed: true,
+        tier,
+        reason: `Command '${command}' is permitted in tier ${tier}.`,
+    };
+}
+export function sanitizeArgs(args) {
+    if (args.length > 20) {
+        throw new Error("Security Error: Too many arguments (max 20).");
+    }
+    const injectionRegex = /[;&|`$><\r\n\0]|^\.\.\/|^\.\.\\/;
+    return args.map((arg) => {
+        if (arg.length > 255) {
+            throw new Error(`Security Error: Argument exceeds 255 characters limit: '${arg.substring(0, 20)}...'`);
+        }
+        if (injectionRegex.test(arg)) {
+            throw new Error(`Security Error: Argument contains illegal characters or injection attempt: '${arg}'`);
+        }
+        if (arg.includes("../") || arg.includes("..\\")) {
+            throw new Error(`Security Error: Path traversal detected in argument: '${arg}'`);
+        }
+        return arg.trim();
+    });
+}
+export function validateDangerousFlags(command, args) {
+    const lowerArgs = args.map((a) => a.toLowerCase());
+    if (lowerArgs.includes("--force")) {
+        if (["migrate", "db:seed", "key:generate"].includes(command.toLowerCase())) {
+            throw new Error(`Security Error: '--force' flag is strictly blocked on command '${command}'.`);
+        }
+    }
+    if (lowerArgs.includes("--seed") && command.toLowerCase() === "migrate") {
+        throw new Error("Security Error: '--seed' flag is blocked on 'migrate'. Use 'db:seed' tool explicitly.");
+    }
+    for (const arg of lowerArgs) {
+        if (arg.startsWith("--drop-") || arg.startsWith("--wipe")) {
+            throw new Error(`Security Error: Destructive flag '${arg}' is prohibited.`);
+        }
+    }
+}
+export function sanitizeTinkerCode(code) {
+    if (code.length > 2000) {
+        return { safe: false, blocked: ["Code length exceeds max limit of 2000 characters"] };
+    }
+    const blocked = [];
+    for (const fn of DANGEROUS_FNS_TINKER) {
+        // Check regex pattern for fn occurrence
+        const pattern = new RegExp(`\\b${fn.replace(/::/g, "::")}\\b`, "i");
+        if (pattern.test(code)) {
+            blocked.push(fn);
+        }
+    }
+    return {
+        safe: blocked.length === 0,
+        blocked,
+    };
+}
+export function isPathSafe(relativePath, rootPath) {
+    const resolvedRoot = path.resolve(rootPath);
+    const resolvedTarget = path.resolve(resolvedRoot, relativePath);
+    if (!resolvedTarget.startsWith(resolvedRoot)) {
+        throw new Error(`Security Error: Path traversal attempt blocked: '${relativePath}'`);
+    }
+    // Check for symlink outside root if target exists
+    if (fs.existsSync(resolvedTarget)) {
+        const realPath = fs.realpathSync(resolvedTarget);
+        if (!realPath.startsWith(resolvedRoot)) {
+            throw new Error(`Security Error: Symlink points outside project root: '${relativePath}'`);
+        }
+    }
+    return resolvedTarget;
+}
+export function isWriteAllowed(relativePath) {
+    const normalized = relativePath.replace(/\\/g, "/").replace(/^\.\//, "");
+    // Check blocked paths
+    for (const blocked of BLOCKED_WRITE_PATHS) {
+        if (normalized === blocked || normalized.startsWith(`${blocked}/`)) {
+            return {
+                allowed: false,
+                reason: `Writing to '${blocked}' is strictly prohibited.`,
+            };
+        }
+    }
+    // Check extension whitelist
+    const ext = path.extname(normalized).toLowerCase();
+    const isBlade = normalized.endsWith(".blade.php");
+    if (!isBlade && !ALLOWED_WRITE_EXTENSIONS.has(ext)) {
+        return {
+            allowed: false,
+            reason: `File extension '${ext}' is not in the whitelist for write operations.`,
+        };
+    }
+    // Check directory whitelist
+    const isInAllowedDir = ALLOWED_WRITE_DIRS.some((dir) => normalized === dir || normalized.startsWith(`${dir}/`));
+    if (!isInAllowedDir) {
+        return {
+            allowed: false,
+            reason: `Target path '${normalized}' is outside allowed directories (${ALLOWED_WRITE_DIRS.join(", ")}).`,
+        };
+    }
+    return { allowed: true, reason: "Path is permitted for writing." };
+}
+export function maskEnvValues(content) {
+    const sensitivePattern = /(PASSWORD|SECRET|KEY|TOKEN|HASH|PRIVATE|CREDENTIAL|API_KEY|AUTH|MAIL_PASSWORD|AWS_|REDIS_PASSWORD|DB_PASSWORD|PUSHER_|MIX_PUSHER_)/i;
+    return content
+        .split("\n")
+        .map((line) => {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#")) {
+            return line;
+        }
+        const eqIndex = line.indexOf("=");
+        if (eqIndex === -1) {
+            return line;
+        }
+        const key = line.substring(0, eqIndex).trim();
+        if (sensitivePattern.test(key)) {
+            return `${key}=***MASKED***`;
+        }
+        return line;
+    })
+        .join("\n");
+}
+export function computeFileHash(content) {
+    return crypto.createHash("sha256").update(content).digest("hex");
+}
+//# sourceMappingURL=security.js.map

package/build/utils/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AAIjC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,OAAO;IACP,KAAK;IACL,YAAY;IACZ,gBAAgB;IAChB,eAAe;IACf,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,aAAa;IACb,YAAY;IACZ,UAAU;IACV,gBAAgB;IAChB,SAAS;IACT,SAAS;IACT,cAAc;IACd,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,iBAAiB;IACjB,SAAS;IACT,MAAM;IACN,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG;IAC3B,MAAM;IACN,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,OAAO;IACP,WAAW;IACX,QAAQ;IACR,OAAO;IACP,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,OAAO;IACP,mBAAmB;IACnB,QAAQ;IACR,OAAO;IACP,WAAW;IACX,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,IAAI;IACJ,UAAU;IACV,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,sBAAsB;CACvB,CAAC;AAEF,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG;IACzB,KAAK;IACL,QAAQ;IACR,qBAAqB;IACrB,kBAAkB;IAClB,oBAAoB;IACpB,iBAAiB;IACjB,QAAQ;IACR,OAAO;CACR,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,MAAM;IACN,QAAQ;IACR,cAAc;IACd,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;IACT,eAAe;IACf,eAAe;IACf,MAAM;CACP,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,6EAA6E,WAAW,EAAE,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC7D,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;YAClG,CAAC;iBAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;gBAChD,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,IAAI;YACJ,MAAM,EAAE,YAAY,OAAO,gFAAgF;SAC5G,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI;QACJ,MAAM,EAAE,YAAY,OAAO,0BAA0B,IAAI,GAAG;KAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,cAAc,GAAG,iCAAiC,CAAC;IAEzD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,2DAA2D,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,+EAA+E,GAAG,GAAG,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,IAAc;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAEnD,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,kEAAkE,OAAO,IAAI,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,kBAAkB,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,kDAAkD,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;QACtC,wCAAwC;QACxC,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC1B,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,YAAoB,EAAE,QAAgB;IAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAEhE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,oDAAoD,YAAY,GAAG,CAAC,CAAC;IACvF,CAAC;IAED,kDAAkD;IAClD,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yDAAyD,YAAY,GAAG,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,YAAoB;IACjD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAEzE,sBAAsB;IACtB,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,CAAC;YACnE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,eAAe,OAAO,2BAA2B;aAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,OAAO,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,mBAAmB,GAAG,iDAAiD;SAChF,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAC5C,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAChE,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gBAAgB,UAAU,qCAAqC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACzG,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,gBAAgB,GAAG,qIAAqI,CAAC;IAE/J,OAAO,OAAO;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,GAAG,GAAG,eAAe,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC"}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@falzz1010/laravel-mcp-server",
+  "version": "1.0.0",
+  "description": "Secure MCP Server for Laravel development — AI-powered artisan commands, log inspection, and code management with 10-layer security",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "laravel",
+    "mcp",
+    "model-context-protocol",
+    "ai",
+    "claude",
+    "cursor",
+    "artisan",
+    "development",
+    "php",
+    "typescript"
+  ],
+  "author": "Laravel MCP Server Contributors",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Falzz1010/laravel-mcp-server.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Falzz1010/laravel-mcp-server/issues"
+  },
+  "homepage": "https://github.com/Falzz1010/laravel-mcp-server#readme",
+  "type": "module",
+  "main": "build/index.js",
+  "bin": {
+    "laravel-mcp": "build/index.js"
+  },
+  "files": [
+    "build/**/*",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node build/index.js",
+    "test": "npm run build && node --test build/tests/security.test.js build/tests/full-security-audit.test.js",
+    "inspect": "npx @modelcontextprotocol/inspector node build/index.js",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.5.0",
+    "@types/node": "^22.0.0",
+    "tsx": "^4.19.0"
+  }
+}