@gaurdi/mcp 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+/**
+ * Gaurdi MCP server — supply-chain security tools for AI coding agents.
+ *
+ * Exposes four tools over the Model Context Protocol (stdio transport):
+ *   1. gaurdi_check_package      — check a single npm package
+ *   2. gaurdi_pre_install_check   — parse an install command and check packages
+ *   3. gaurdi_suggest_alternative — suggest safer alternatives for a package
+ *   4. gaurdi_scan_lockfile       — scan an entire lockfile for risks
+ */
+export {};

package/dist/index.js

@@ -0,0 +1,334 @@
+#!/usr/bin/env node
+/**
+ * Gaurdi MCP server — supply-chain security tools for AI coding agents.
+ *
+ * Exposes four tools over the Model Context Protocol (stdio transport):
+ *   1. gaurdi_check_package      — check a single npm package
+ *   2. gaurdi_pre_install_check   — parse an install command and check packages
+ *   3. gaurdi_suggest_alternative — suggest safer alternatives for a package
+ *   4. gaurdi_scan_lockfile       — scan an entire lockfile for risks
+ */
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+// ---------------------------------------------------------------------------
+// Configuration
+// ---------------------------------------------------------------------------
+const API_URL = process.env.GAURDI_API_URL ?? "https://guardiancode-production.up.railway.app";
+/** Request timeout in milliseconds for all outgoing HTTP calls. */
+const REQUEST_TIMEOUT_MS = 30_000;
+function loadAuthToken() {
+    const authPath = join(homedir(), ".gaurdi", "auth.json");
+    if (!existsSync(authPath))
+        return undefined;
+    try {
+        const data = JSON.parse(readFileSync(authPath, "utf-8"));
+        return data.token;
+    }
+    catch {
+        return undefined;
+    }
+}
+const AUTH_TOKEN = loadAuthToken();
+// ---------------------------------------------------------------------------
+// HTTP helpers
+// ---------------------------------------------------------------------------
+async function apiGet(path) {
+    const headers = { Accept: "application/json" };
+    if (AUTH_TOKEN)
+        headers["Authorization"] = `Bearer ${AUTH_TOKEN}`;
+    const res = await fetch(`${API_URL}${path}`, {
+        headers,
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+        const body = await res.text();
+        throw new Error(`GET ${path} failed (${res.status}): ${body}`);
+    }
+    return (await res.json());
+}
+async function apiPost(path, body) {
+    const headers = {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+    };
+    if (AUTH_TOKEN)
+        headers["Authorization"] = `Bearer ${AUTH_TOKEN}`;
+    const res = await fetch(`${API_URL}${path}`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`POST ${path} failed (${res.status}): ${text}`);
+    }
+    return (await res.json());
+}
+// ---------------------------------------------------------------------------
+// Tool implementations
+// ---------------------------------------------------------------------------
+async function checkPackage(ecosystem, name, version) {
+    const qs = version ? `?version=${encodeURIComponent(version)}` : "";
+    return apiGet(`/v1/package/${encodeURIComponent(ecosystem)}/${encodeURIComponent(name)}${qs}`);
+}
+function formatPackageScore(score) {
+    const lines = [];
+    lines.push(`Package: ${score.package.name}@${score.package.version}`);
+    lines.push(`Risk: ${score.risk} (score ${score.score}/100)`);
+    lines.push(`Provenance: ${score.provenance}`);
+    if (score.signals.length > 0) {
+        lines.push("");
+        lines.push("Signals:");
+        for (const s of score.signals) {
+            lines.push(`  [${s.risk.toUpperCase()}] ${s.title}: ${s.description}`);
+        }
+    }
+    if (score.alternatives.length > 0) {
+        lines.push("");
+        lines.push("Suggested alternatives:");
+        for (const a of score.alternatives) {
+            const dl = a.weekly_downloads
+                ? ` (${a.weekly_downloads.toLocaleString()} weekly downloads)`
+                : "";
+            lines.push(`  - ${a.name}${dl}${a.reason ? ": " + a.reason : ""}`);
+        }
+    }
+    return lines.join("\n");
+}
+/** Parse packages from a shell install command (npm install X Y, pip install X Y). */
+function parseInstallCommand(command) {
+    const trimmed = command.trim();
+    // npm install / npm i / npm add / yarn add / pnpm add
+    const npmRe = /^(?:npm\s+(?:install|i|add)|yarn\s+add|pnpm\s+(?:add|install))\s+(.+)/i;
+    const npmMatch = trimmed.match(npmRe);
+    if (npmMatch) {
+        const args = npmMatch[1]
+            .split(/\s+/)
+            .filter((a) => !a.startsWith("-")); // strip flags like --save-dev
+        const packages = args.map((a) => a.replace(/@[\^~]?[\d.*]+$/, "")); // strip version suffixes
+        return { ecosystem: "npm", packages: packages.filter(Boolean) };
+    }
+    // pip install / pip3 install
+    const pipRe = /^pip3?\s+install\s+(.+)/i;
+    const pipMatch = trimmed.match(pipRe);
+    if (pipMatch) {
+        const args = pipMatch[1]
+            .split(/\s+/)
+            .filter((a) => !a.startsWith("-") && !a.startsWith("--"));
+        const packages = args.map((a) => a.replace(/[>=<!\[].*$/, ""));
+        return { ecosystem: "pypi", packages: packages.filter(Boolean) };
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// MCP Server setup
+// ---------------------------------------------------------------------------
+const server = new Server({ name: "gaurdi", version: "0.1.0" }, { capabilities: { tools: {} } });
+// --- List tools -----------------------------------------------------------
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: [
+        {
+            name: "gaurdi_check_package",
+            description: "Check a single package for supply-chain risks. Returns risk score, signals, provenance, and alternatives.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    ecosystem: {
+                        type: "string",
+                        description: 'Package ecosystem (currently only "npm" supported).',
+                        default: "npm",
+                    },
+                    name: { type: "string", description: "Package name, e.g. 'lodash'." },
+                    version: {
+                        type: "string",
+                        description: "Specific version to check. Omit for latest.",
+                    },
+                },
+                required: ["name"],
+            },
+        },
+        {
+            name: "gaurdi_pre_install_check",
+            description: 'Parse a package-install command (e.g. "npm install foo bar") and check each package for supply-chain risks before running it.',
+            inputSchema: {
+                type: "object",
+                properties: {
+                    command: {
+                        type: "string",
+                        description: 'The install command to check, e.g. "npm install express lodash".',
+                    },
+                },
+                required: ["command"],
+            },
+        },
+        {
+            name: "gaurdi_suggest_alternative",
+            description: "Check a package and return suggested safer alternatives if the package is risky.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    ecosystem: {
+                        type: "string",
+                        description: 'Package ecosystem (default "npm").',
+                        default: "npm",
+                    },
+                    name: { type: "string", description: "Package name to find alternatives for." },
+                },
+                required: ["name"],
+            },
+        },
+        {
+            name: "gaurdi_scan_lockfile",
+            description: "Scan an entire lockfile (package-lock.json) for supply-chain risks across all dependencies.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    file_path: {
+                        type: "string",
+                        description: "Absolute path to the lockfile to scan.",
+                    },
+                },
+                required: ["file_path"],
+            },
+        },
+    ],
+}));
+// --- Call tool -------------------------------------------------------------
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name, arguments: args } = request.params;
+    try {
+        switch (name) {
+            // ---- gaurdi_check_package ------------------------------------
+            case "gaurdi_check_package": {
+                const ecosystem = args?.ecosystem ?? "npm";
+                const pkgName = args?.name;
+                const version = args?.version;
+                if (!pkgName)
+                    throw new Error("Missing required argument: name");
+                const score = await checkPackage(ecosystem, pkgName, version);
+                return { content: [{ type: "text", text: formatPackageScore(score) }] };
+            }
+            // ---- gaurdi_pre_install_check --------------------------------
+            case "gaurdi_pre_install_check": {
+                const command = args?.command;
+                if (!command)
+                    throw new Error("Missing required argument: command");
+                const parsed = parseInstallCommand(command);
+                if (!parsed || parsed.packages.length === 0) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Could not parse install command: ${command}\nSupported formats: npm install <pkg>, yarn add <pkg>, pip install <pkg>`,
+                            },
+                        ],
+                    };
+                }
+                // Check all packages in parallel
+                const settledResults = await Promise.allSettled(parsed.packages.map((pkg) => checkPackage(parsed.ecosystem, pkg)));
+                const results = [];
+                let blocked = false;
+                for (let i = 0; i < parsed.packages.length; i++) {
+                    const pkg = parsed.packages[i];
+                    const settled = settledResults[i];
+                    if (settled.status === "fulfilled") {
+                        const score = settled.value;
+                        results.push(formatPackageScore(score));
+                        if (score.score >= 60) {
+                            blocked = true;
+                            results.push(`\n** BLOCKED: ${pkg} has risk score ${score.score}/100 (>= 60 threshold) **`);
+                        }
+                    }
+                    else {
+                        results.push(`${pkg}: error checking — ${settled.reason}`);
+                    }
+                }
+                const verdict = blocked
+                    ? "VERDICT: One or more packages exceed the risk threshold. Do NOT run this command."
+                    : "VERDICT: All packages pass. Safe to proceed.";
+                return {
+                    content: [{ type: "text", text: results.join("\n\n---\n\n") + "\n\n" + verdict }],
+                };
+            }
+            // ---- gaurdi_suggest_alternative ------------------------------
+            case "gaurdi_suggest_alternative": {
+                const ecosystem = args?.ecosystem ?? "npm";
+                const pkgName = args?.name;
+                if (!pkgName)
+                    throw new Error("Missing required argument: name");
+                const score = await checkPackage(ecosystem, pkgName);
+                const lines = [];
+                lines.push(`${score.package.name}@${score.package.version}: risk=${score.risk} score=${score.score}/100`);
+                if (score.alternatives.length === 0) {
+                    lines.push("\nNo alternatives suggested. The package may be safe or unique.");
+                }
+                else {
+                    lines.push("\nSuggested alternatives:");
+                    for (const a of score.alternatives) {
+                        const dl = a.weekly_downloads
+                            ? ` (${a.weekly_downloads.toLocaleString()} weekly downloads)`
+                            : "";
+                        lines.push(`  - ${a.name}${dl}${a.reason ? ": " + a.reason : ""}`);
+                    }
+                }
+                return { content: [{ type: "text", text: lines.join("\n") }] };
+            }
+            // ---- gaurdi_scan_lockfile ------------------------------------
+            case "gaurdi_scan_lockfile": {
+                const filePath = args?.file_path;
+                if (!filePath)
+                    throw new Error("Missing required argument: file_path");
+                let content;
+                try {
+                    content = readFileSync(filePath, "utf-8");
+                }
+                catch (err) {
+                    throw new Error(`Cannot read lockfile at ${filePath}: ${err}`);
+                }
+                const result = await apiPost("/v1/scan", {
+                    lockfile_content: content,
+                });
+                const lines = [];
+                lines.push(`Scanned ${result.total_packages} packages in ${result.duration_ms}ms`);
+                lines.push(`Overall risk: ${result.overall_risk}`);
+                lines.push(`Flagged packages: ${result.flagged_packages}`);
+                if (result.packages.length > 0) {
+                    lines.push("");
+                    // Show only flagged packages (risk > None/Info)
+                    const flagged = result.packages.filter((p) => p.risk !== "None" && p.risk !== "Info");
+                    for (const pkg of flagged) {
+                        lines.push("---");
+                        lines.push(formatPackageScore(pkg));
+                    }
+                }
+                return { content: [{ type: "text", text: lines.join("\n") }] };
+            }
+            default:
+                throw new Error(`Unknown tool: ${name}`);
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: "text", text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error("Gaurdi MCP server running on stdio");
+}
+main().catch((err) => {
+    console.error("Fatal:", err);
+    process.exit(1);
+});

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@gaurdi/mcp",
+  "version": "0.1.0",
+  "description": "Gaurdi MCP server — supply chain security for AI coding tools. Checks every package before your AI agent installs it.",
+  "type": "module",
+  "bin": {
+    "gaurdi-mcp": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "supply-chain",
+    "security",
+    "npm",
+    "ai-agent",
+    "gaurdi"
+  ],
+  "author": "Gaurdi (https://gaurdi.com)",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mithunnarayana89/guardianCode.git",
+    "directory": "mcp-server"
+  },
+  "homepage": "https://gaurdi.com",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.5.2",
+    "typescript": "^5.0.0"
+  }
+}