@inner-security/mcp 0.1.0

package/bundle/server.js

@@ -0,0 +1,883 @@
+#!/usr/bin/env node
+
+// src/server.ts
+import { realpathSync } from "fs";
+import { pathToFileURL } from "url";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+
+// ../contracts/dist/enums.js
+var ECOSYSTEM = ["npm", "pypi"];
+var STATUS_TO_ACTION = {
+  benign: "ALLOW",
+  suspicious: "REVIEW",
+  malicious: "BLOCK",
+  unknown: "PENDING"
+};
+
+// ../contracts/dist/fixtures.js
+var NOW = "2026-06-27T00:00:00Z";
+var WEEK = "2026-07-04T00:00:00Z";
+function v(p) {
+  const status = p.status;
+  return {
+    ecosystem: "npm",
+    action: STATUS_TO_ACTION[status],
+    confidence: status === "malicious" ? 0.97 : status === "suspicious" ? 0.6 : 0.95,
+    behaviors: [],
+    corroboration: "behavioral_only",
+    evidence_uri: `s3://inner-evidence/${p.name}@${p.version}.json`,
+    engine_version: "v0.1.0",
+    scanned_at: NOW,
+    expires_at: WEEK,
+    engine_signature: "ed25519:STUB",
+    version_id: `${p.name}@${p.version}`,
+    ...p
+  };
+}
+var SAMPLE_VERDICTS = [
+  // --- 10 malicious ---
+  // event-stream-style: real-world supply-chain attack (flatmap-stream payload).
+  v({
+    name: "event-stream",
+    version: "3.3.6",
+    status: "malicious",
+    content_hash: "sha256:bad1",
+    corroboration: "corroborated",
+    behaviors: [
+      { category: "credential_theft", severity: "critical", evidence_ref: "trace#1" },
+      { category: "c2_communication", severity: "high", evidence_ref: "trace#2" }
+    ],
+    capabilities: [
+      { capability: "reads_credentials", source: "hook" },
+      { capability: "network_exfil", source: "network" }
+    ]
+  }),
+  // Typosquat of 'react'.
+  v({
+    name: "reaact",
+    version: "1.0.0",
+    status: "malicious",
+    content_hash: "sha256:bad2",
+    corroboration: "corroborated",
+    behaviors: [{ category: "malicious_download", severity: "high", evidence_ref: "trace#1" }],
+    capabilities: [{ capability: "self_propagation", source: "static" }]
+  }),
+  // Behavioral-only: spawns shell during install. Behavioral_only → REVIEW until eval-certified.
+  v({
+    name: "left-pad-2",
+    version: "0.0.1",
+    status: "malicious",
+    content_hash: "sha256:bad3",
+    corroboration: "behavioral_only",
+    behaviors: [{ category: "command_execution", severity: "high", evidence_ref: "trace#1" }],
+    capabilities: [{ capability: "spawns_process", source: "syscall" }]
+  }),
+  // Postinstall script reads ~/.aws/credentials and POSTs to an external host.
+  v({
+    name: "aws-helper-cli",
+    version: "0.4.2",
+    status: "malicious",
+    content_hash: "sha256:bad4",
+    corroboration: "corroborated",
+    behaviors: [
+      { category: "credential_theft", severity: "critical", evidence_ref: "trace#1" },
+      { category: "data_exfiltration", severity: "critical", evidence_ref: "trace#2" }
+    ],
+    capabilities: [
+      { capability: "reads_credentials", source: "syscall" },
+      { capability: "network_exfil", source: "network" }
+    ]
+  }),
+  // Obfuscated eval(atob(...)) payload — dynamic code execution detected statically.
+  v({
+    name: "kazka-utils",
+    version: "2.1.0",
+    status: "malicious",
+    content_hash: "sha256:bad5",
+    corroboration: "behavioral_only",
+    behaviors: [{ category: "dynamic_code_execution", severity: "high", evidence_ref: "trace#1" }],
+    capabilities: [{ capability: "obfuscated_payload", source: "static" }]
+  }),
+  // PyPI: setup.py performs persistence write to ~/.bashrc.
+  v({
+    ecosystem: "pypi",
+    name: "colorama-utils",
+    version: "0.4.5",
+    status: "malicious",
+    content_hash: "sha256:bad6",
+    corroboration: "behavioral_only",
+    behaviors: [{ category: "persistence", severity: "high", evidence_ref: "trace#1" }],
+    capabilities: [{ capability: "persistence", source: "syscall" }]
+  }),
+  // C2 beacon over WebSocket on a regular interval — slow-lane confirmed.
+  v({
+    name: "discord-bot-helper",
+    version: "0.0.7",
+    status: "malicious",
+    content_hash: "sha256:bad7",
+    corroboration: "corroborated",
+    behaviors: [{ category: "c2_communication", severity: "critical", evidence_ref: "trace#1" }],
+    capabilities: [{ capability: "c2_beacon", source: "network" }]
+  }),
+  // PyPI typosquat: 'requrest' -> 'requests'. Reads env vars and writes /tmp/.x.
+  v({
+    ecosystem: "pypi",
+    name: "requrest",
+    version: "2.31.0",
+    status: "malicious",
+    content_hash: "sha256:bad8",
+    corroboration: "corroborated",
+    behaviors: [
+      { category: "data_collection", severity: "medium", evidence_ref: "trace#1" },
+      { category: "file_manipulation", severity: "medium", evidence_ref: "trace#2" }
+    ],
+    capabilities: [
+      { capability: "env_recon", source: "hook" },
+      { capability: "modifies_files", source: "syscall" }
+    ]
+  }),
+  // Reverse shell binding /bin/sh to a remote port during import.
+  v({
+    name: "fastly-cdn-uploader",
+    version: "1.0.0",
+    status: "malicious",
+    content_hash: "sha256:bad9",
+    corroboration: "corroborated",
+    behaviors: [{ category: "reverse_shell", severity: "critical", evidence_ref: "trace#1" }],
+    capabilities: [
+      { capability: "spawns_process", source: "syscall" },
+      { capability: "network_exfil", source: "network" }
+    ]
+  }),
+  // Web-injection payload: serves modified content on import; common in browser-side attacks.
+  v({
+    name: "analytics-tracker-pro",
+    version: "3.0.0",
+    status: "malicious",
+    content_hash: "sha256:bad10",
+    corroboration: "behavioral_only",
+    behaviors: [{ category: "web_injection", severity: "medium", evidence_ref: "trace#1" }]
+  }),
+  // --- 10 benign ---
+  v({ name: "react", version: "18.3.1", status: "benign", content_hash: "sha256:ok1" }),
+  v({ name: "lodash", version: "4.17.21", status: "benign", content_hash: "sha256:ok2" }),
+  v({ name: "axios", version: "1.7.2", status: "benign", content_hash: "sha256:ok3" }),
+  v({ name: "typescript", version: "5.5.4", status: "benign", content_hash: "sha256:ok4" }),
+  v({ name: "express", version: "4.19.2", status: "benign", content_hash: "sha256:ok5" }),
+  v({ name: "vite", version: "5.4.0", status: "benign", content_hash: "sha256:ok6" }),
+  // Heavy native build (node-gyp). Long install time is legitimate, not malicious.
+  v({ name: "node-sass", version: "9.0.0", status: "benign", content_hash: "sha256:ok7" }),
+  v({ ecosystem: "pypi", name: "requests", version: "2.31.0", status: "benign", content_hash: "sha256:ok8" }),
+  v({ ecosystem: "pypi", name: "numpy", version: "1.26.4", status: "benign", content_hash: "sha256:ok9" }),
+  v({ ecosystem: "pypi", name: "pandas", version: "2.2.2", status: "benign", content_hash: "sha256:ok10" })
+];
+
+// ../verdict-client/dist/client.js
+var DEFAULT_API_URL = "http://localhost:8787";
+function isPending(item) {
+  return item.action === "PENDING";
+}
+function isEnvelope(item) {
+  return !isPending(item);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function stripTrailingSlash(u) {
+  return u.replace(/\/+$/, "");
+}
+var VerdictClient = class {
+  baseUrl;
+  apiKey;
+  timeoutMs;
+  maxPollAttempts;
+  maxRetries;
+  fetchImpl;
+  cache;
+  constructor(opts = {}) {
+    this.baseUrl = stripTrailingSlash(opts.baseUrl ?? process.env.INNER_API_URL ?? DEFAULT_API_URL);
+    this.apiKey = opts.apiKey ?? process.env.INNER_API_KEY;
+    this.timeoutMs = opts.timeoutMs ?? 1e4;
+    this.maxPollAttempts = opts.maxPollAttempts ?? 8;
+    this.maxRetries = opts.maxRetries ?? 2;
+    this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    this.cache = opts.cache;
+    if (typeof this.fetchImpl !== "function") {
+      throw new Error("No fetch implementation available (Node >= 18 required, or pass fetchImpl).");
+    }
+  }
+  headers() {
+    const h = { "content-type": "application/json" };
+    if (this.apiKey)
+      h.authorization = `Bearer ${this.apiKey}`;
+    return h;
+  }
+  /** A single fetch with a per-request AbortController timeout. */
+  async fetchOnce(url, init) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), this.timeoutMs);
+    try {
+      return await this.fetchImpl(url, { ...init, signal: ctrl.signal });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  /**
+   * fetch with timeout + retries-with-backoff on transient failures (network
+   * error / timeout / 5xx). 404 is returned as-is (the poll path treats it as
+   * "not ready yet"); other 4xx are returned as-is for the caller to handle.
+   */
+  async fetchWithRetry(url, init) {
+    let lastErr;
+    let wait = 250;
+    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+      try {
+        const res = await this.fetchOnce(url, init);
+        if (res.status >= 500 && attempt < this.maxRetries) {
+          await sleep(wait);
+          wait = Math.min(wait * 2, 5e3);
+          continue;
+        }
+        return res;
+      } catch (err) {
+        lastErr = err;
+        if (attempt < this.maxRetries) {
+          await sleep(wait);
+          wait = Math.min(wait * 2, 5e3);
+          continue;
+        }
+      }
+    }
+    throw lastErr instanceof Error ? lastErr : new Error(`Request to ${url} failed`);
+  }
+  /** Raw C1 batch call. Items may come back as VerdictEnvelope or PendingResponse. */
+  async getVerdicts(items) {
+    const body = { items };
+    const res = await this.fetchWithRetry(`${this.baseUrl}/v1/verdict`, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      throw new Error(`Verdict API POST /v1/verdict failed: ${res.status} ${res.statusText}`);
+    }
+    return await res.json();
+  }
+  /**
+   * Poll a PENDING job to resolution. Returns the resolved item (may still be
+   * PENDING if it never resolves within maxPollAttempts). 404 is treated as
+   * "not ready yet" and retried; a non-ok, non-404 response throws.
+   */
+  async pollVerdict(pending) {
+    let attempt = 0;
+    let waitMs = Math.max(250, pending.eta_ms || 1e3);
+    let last = pending;
+    const url = `${this.baseUrl}/v1/verdict/${encodeURIComponent(pending.job_id)}`;
+    while (attempt < this.maxPollAttempts) {
+      await sleep(Math.min(waitMs, 5e3));
+      const res = await this.fetchWithRetry(url, {
+        method: "GET",
+        headers: this.headers()
+      });
+      if (res.status === 404) {
+        attempt += 1;
+        waitMs = Math.min(waitMs * 2, 5e3);
+        continue;
+      }
+      if (!res.ok) {
+        throw new Error(`Verdict API GET /v1/verdict/${pending.job_id} failed: ${res.status} ${res.statusText}`);
+      }
+      last = await res.json();
+      if (!isPending(last))
+        return last;
+      attempt += 1;
+      waitMs = Math.min(waitMs * 2, 5e3);
+    }
+    return last;
+  }
+  /**
+   * Resolve a single item to a final envelope, polling through PENDING. Returns
+   * the envelope, or the unresolved PendingResponse if it never landed.
+   */
+  async resolveVerdict(item) {
+    const { results } = await this.getVerdicts([item]);
+    const first = results[0];
+    if (!first)
+      throw new Error("Verdict API returned no results for the request.");
+    if (isPending(first))
+      return this.pollVerdict(first);
+    return first;
+  }
+  /** Resolve a batch, polling each PENDING to resolution. Order matches input. */
+  async resolveVerdicts(items) {
+    const { results } = await this.getVerdicts(items);
+    return Promise.all(results.map((r) => isPending(r) ? this.pollVerdict(r) : Promise.resolve(r)));
+  }
+  /**
+   * High-level fail-open resolution (the CLI scan path). Returns one
+   * ResolvedItem per requested item. On a total API failure (network/timeout),
+   * falls back to the fail-open cache for every item; for individual
+   * missing/never-resolved items, falls back to the cache too. Items the cache
+   * cannot safely satisfy surface as 'unresolved' (UNKNOWN) so the operator
+   * decides — never a silent allow.
+   */
+  async resolve(items) {
+    if (items.length === 0)
+      return { resolved: [], degraded: false };
+    let response;
+    try {
+      response = await this.getVerdicts(items);
+    } catch {
+      return this.failOpen(items);
+    }
+    const results = response.results ?? [];
+    const resolved = [];
+    for (let i = 0; i < items.length; i++) {
+      const item = items[i];
+      const r = results[i];
+      if (!r) {
+        resolved.push(this.fromCacheOrUnresolved(item));
+        continue;
+      }
+      if (isPending(r)) {
+        let env;
+        try {
+          env = await this.pollVerdict(r);
+        } catch {
+          env = void 0;
+        }
+        if (env && isEnvelope(env)) {
+          this.cache?.put(item, env);
+          resolved.push({ item, envelope: env, source: "api" });
+        } else {
+          resolved.push(this.fromCacheOrUnresolved(item));
+        }
+        continue;
+      }
+      this.cache?.put(item, r);
+      resolved.push({ item, envelope: r, source: "api" });
+    }
+    return { resolved, degraded: false };
+  }
+  failOpen(items) {
+    const resolved = items.map((item) => {
+      const cached = this.cache?.get(item);
+      if (cached) {
+        return { item, envelope: cached, source: "cache", failedOpen: true };
+      }
+      return { item, source: "unresolved", failedOpen: true };
+    });
+    return { resolved, degraded: true };
+  }
+  fromCacheOrUnresolved(item) {
+    const cached = this.cache?.get(item);
+    if (cached)
+      return { item, envelope: cached, source: "cache" };
+    return { item, source: "unresolved" };
+  }
+};
+
+// src/handlers.ts
+import { randomUUID } from "crypto";
+
+// src/alternatives.ts
+var CURATED = {
+  // npm typosquats / known-bad fixtures -> the legitimate package.
+  "npm:reaact": { suggestion: "react", rationale: 'Likely typosquat of the official "react" package.' },
+  "npm:event-stream": {
+    suggestion: "readable-stream",
+    rationale: 'event-stream@3.3.6 carried the flatmap-stream supply-chain payload; "readable-stream" is the maintained, widely-used stream toolkit.'
+  },
+  "npm:left-pad-2": {
+    suggestion: "just-pad-left",
+    rationale: "Use a maintained, single-purpose padding helper instead of an unknown clone."
+  },
+  "npm:aws-helper-cli": {
+    suggestion: "@aws-sdk/client-sts",
+    rationale: "Use the official AWS SDK rather than a third-party credential-touching helper."
+  },
+  "npm:discord-bot-helper": {
+    suggestion: "discord.js",
+    rationale: "discord.js is the maintained, audited Discord client library."
+  },
+  "npm:fastly-cdn-uploader": {
+    suggestion: "@fastly/js-compute",
+    rationale: "Prefer Fastly's official tooling over an unaffiliated uploader."
+  },
+  "npm:analytics-tracker-pro": {
+    suggestion: "@vercel/analytics",
+    rationale: "Use a reputable analytics library instead of an unknown tracker."
+  },
+  // pypi typosquats / known-bad fixtures.
+  "pypi:requrest": {
+    suggestion: "requests",
+    rationale: 'Likely typosquat of the official "requests" HTTP library.'
+  },
+  "pypi:colorama-utils": {
+    suggestion: "colorama",
+    rationale: 'Use the official "colorama" package; the "-utils" variant performs persistence writes.'
+  }
+};
+function suggestAlternative(ecosystem, name) {
+  const key = `${ecosystem}:${name.toLowerCase()}`;
+  const hit = CURATED[key];
+  if (hit) {
+    return {
+      ecosystem,
+      requested: name,
+      suggestion: hit.suggestion,
+      rationale: hit.rationale,
+      source: "curated"
+    };
+  }
+  return {
+    ecosystem,
+    requested: name,
+    suggestion: null,
+    rationale: "No curated safe alternative is known for this package. (suggest_alternative currently uses a small curated map; a real recommendation backend is future work.)",
+    source: "none"
+  };
+}
+
+// src/parse-deps.ts
+function cleanNpmVersion(spec) {
+  const trimmed = spec.trim();
+  if (!trimmed) return null;
+  if (trimmed === "*" || trimmed === "latest" || trimmed === "x" || trimmed === "X") return null;
+  if (/^(workspace:|link:|file:|git\+|git:|github:|https?:)/.test(trimmed)) return null;
+  const m = trimmed.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/);
+  if (m) return m[0];
+  const stripped = trimmed.replace(/^[\^~>=<\s]+/, "").trim();
+  return /^\d/.test(stripped) ? stripped : null;
+}
+function parsePackageJson(content) {
+  const json = JSON.parse(content);
+  const sections = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+  const items = [];
+  const warnings = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const section of sections) {
+    const deps = json[section];
+    if (deps && typeof deps === "object") {
+      for (const [name, rawSpec] of Object.entries(deps)) {
+        if (seen.has(name)) continue;
+        seen.add(name);
+        const spec = String(rawSpec);
+        const alias = spec.match(/^npm:(@?[^@]+(?:\/[^@]+)?)@(.+)$/);
+        if (alias) {
+          const aliasVersion = cleanNpmVersion(alias[2]);
+          if (aliasVersion) {
+            items.push({ ecosystem: "npm", name: alias[1], version: aliasVersion });
+          } else {
+            warnings.push(`Skipped "${name}" (${spec}) \u2014 alias has no concrete version.`);
+          }
+          continue;
+        }
+        const version = cleanNpmVersion(spec);
+        if (version) {
+          items.push({ ecosystem: "npm", name, version });
+        } else {
+          warnings.push(`Skipped "${name}" (${spec}) \u2014 no concrete version (wildcard/tag/git/url).`);
+        }
+      }
+    }
+  }
+  return { items, warnings, skipped: warnings.length };
+}
+function parsePackageLock(content) {
+  const json = JSON.parse(content);
+  const items = [];
+  const warnings = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [path, meta] of Object.entries(json.packages ?? {})) {
+    if (!path || !path.startsWith("node_modules/")) continue;
+    const name = path.slice(path.lastIndexOf("node_modules/") + "node_modules/".length);
+    if (!name || seen.has(name)) continue;
+    seen.add(name);
+    if (!meta?.version) {
+      warnings.push(`Skipped "${name}" \u2014 no resolved version in lockfile.`);
+      continue;
+    }
+    items.push({ ecosystem: "npm", name, version: meta.version });
+  }
+  return { items, warnings, skipped: warnings.length };
+}
+function parseRequirementsTxt(content) {
+  const items = [];
+  const warnings = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.split("#")[0].trim();
+    if (!line) continue;
+    if (line.startsWith("-") || line.includes("://")) {
+      warnings.push(`Skipped "${line.slice(0, 60)}" \u2014 not a simple pin.`);
+      continue;
+    }
+    const m = line.match(/^([A-Za-z0-9._-]+)\s*(?:\[[^\]]*\])?\s*(?:[=<>!~]=?\s*([0-9][\w.+!-]*))?/);
+    if (!m) {
+      warnings.push(`Skipped "${line.slice(0, 60)}" \u2014 unparseable requirement.`);
+      continue;
+    }
+    const name = m[1];
+    const version = m[2];
+    if (!version) {
+      warnings.push(`Skipped "${line.slice(0, 60)}" \u2014 only pinned (pkg==version) deps are resolved.`);
+      continue;
+    }
+    if (seen.has(name)) continue;
+    seen.add(name);
+    items.push({ ecosystem: "pypi", name, version });
+  }
+  return { items, warnings, skipped: warnings.length };
+}
+function inferFormat(content) {
+  const trimmed = content.trim();
+  if (trimmed.startsWith("{")) {
+    try {
+      const json = JSON.parse(trimmed);
+      if (json.lockfileVersion !== void 0 || json.packages !== void 0) {
+        return "package-lock.json";
+      }
+      return "package.json";
+    } catch {
+    }
+  }
+  return "requirements.txt";
+}
+function parseDependenciesWithWarnings(input) {
+  if (input.packages && input.packages.length > 0) {
+    return { items: input.packages, warnings: [], skipped: 0 };
+  }
+  if (!input.content || input.content.trim() === "") {
+    throw new Error("check_dependencies needs either `packages` or non-empty `content`.");
+  }
+  const format = input.format ?? inferFormat(input.content);
+  switch (format) {
+    case "package.json":
+      return parsePackageJson(input.content);
+    case "package-lock.json":
+      return parsePackageLock(input.content);
+    case "requirements.txt":
+      return parseRequirementsTxt(input.content);
+    default:
+      throw new Error(`Unsupported manifest format: ${String(format)}`);
+  }
+}
+
+// src/handlers.ts
+function isBlocked(action) {
+  return action === "BLOCK" || action === "REVIEW";
+}
+function stripControlChars(s) {
+  return s.replace(/[\u0000-\u001F\u007F-\u009F]/g, " ").replace(/\s+/g, " ").trim();
+}
+function fence(raw, max = 200) {
+  const s = stripControlChars(String(raw ?? "")).slice(0, max);
+  return `\xAB${s}\xBB`;
+}
+function fenceList(items) {
+  return items.map((c) => fence(c, 60)).join(", ");
+}
+function envelopeToVerdict(item, resolved, withAlternative) {
+  if (isPending(resolved)) {
+    return {
+      ecosystem: item.ecosystem,
+      name: item.name,
+      version: item.version,
+      pending: true,
+      action: "PENDING",
+      summary: `${fence(item.name)}@${fence(item.version, 60)}: verdict PENDING (job ${resolved.job_id}); not resolved yet \u2014 treat as unknown and re-check before install.`
+    };
+  }
+  const env = resolved;
+  const blocked = isBlocked(env.action);
+  const out = {
+    ecosystem: env.ecosystem,
+    name: env.name,
+    version: env.version,
+    pending: false,
+    status: env.status,
+    action: env.action,
+    confidence: env.confidence,
+    behaviors: env.behaviors,
+    policy_decision: env.policy_decision,
+    provisional: env.provisional,
+    summary: `${fence(env.name)}@${fence(env.version, 60)}: ${env.status.toUpperCase()} -> ${env.action}${env.behaviors.length ? ` (${fenceList(env.behaviors.map((b) => b.category))})` : ""}${env.provisional ? " [provisional]" : ""}`
+  };
+  if (withAlternative && blocked) {
+    out.suggested_alternative = suggestAlternative(env.ecosystem, env.name);
+  }
+  return out;
+}
+async function checkPackage(client, args) {
+  const item = {
+    ecosystem: args.ecosystem,
+    name: args.name,
+    version: args.version
+  };
+  const resolved = await client.resolveVerdict(item);
+  return envelopeToVerdict(item, resolved, true);
+}
+async function checkDependencies(client, args) {
+  const { items, warnings, skipped } = parseDependenciesWithWarnings(args);
+  if (items.length === 0) {
+    return {
+      tally: { total: 0, allow: 0, review: 0, block: 0, pending: 0 },
+      verdicts: [],
+      has_risk: false,
+      skipped,
+      warnings
+    };
+  }
+  const resolved = await client.resolveVerdicts(items);
+  const verdicts = items.map((item, i) => envelopeToVerdict(item, resolved[i], true));
+  const tally = {
+    total: verdicts.length,
+    allow: verdicts.filter((v2) => v2.action === "ALLOW").length,
+    review: verdicts.filter((v2) => v2.action === "REVIEW").length,
+    block: verdicts.filter((v2) => v2.action === "BLOCK").length,
+    pending: verdicts.filter((v2) => v2.action === "PENDING").length
+  };
+  const has_risk = tally.block + tally.review + tally.pending + skipped > 0;
+  return { tally, verdicts, has_risk, skipped, warnings };
+}
+async function explainVerdict(client, args) {
+  const item = {
+    ecosystem: args.ecosystem,
+    name: args.name,
+    version: args.version
+  };
+  const resolved = await client.resolveVerdict(item);
+  if (isPending(resolved)) {
+    return {
+      ecosystem: args.ecosystem,
+      name: args.name,
+      version: args.version,
+      pending: true,
+      explanation: `No verdict is available yet for ${fence(args.name)}@${fence(args.version, 60)} (still PENDING, job ${resolved.job_id}). The package is being analyzed; re-check shortly.`
+    };
+  }
+  const env = resolved;
+  const behaviorLines = env.behaviors.map(
+    (b) => `- ${fence(b.category, 60)} (${fence(b.severity, 40)}) [evidence: ${fence(b.evidence_ref, 120)}]`
+  );
+  const explanation = `${fence(env.name)}@${fence(env.version, 60)} is ${env.status.toUpperCase()} -> action ${env.action} (confidence ${(env.confidence * 100).toFixed(0)}%, ${env.corroboration}${env.provisional ? ", provisional" : ""}).
+` + (behaviorLines.length ? `Observed behaviors:
+${behaviorLines.join("\n")}` : "No specific behaviors were flagged.") + (env.reasoning ? `
+Engine reasoning: ${fence(env.reasoning, 500)}` : "") + `
+Evidence trace: ${fence(env.evidence_uri, 200)}`;
+  return {
+    ecosystem: env.ecosystem,
+    name: env.name,
+    version: env.version,
+    pending: false,
+    status: env.status,
+    action: env.action,
+    confidence: env.confidence,
+    corroboration: env.corroboration,
+    assurance: env.assurance,
+    provisional: env.provisional,
+    behaviors: env.behaviors.map((b) => ({
+      category: b.category,
+      severity: b.severity,
+      evidence_ref: b.evidence_ref
+    })),
+    capabilities: env.capabilities,
+    reasoning: env.reasoning,
+    evidence_uri: env.evidence_uri,
+    explanation
+  };
+}
+function suggestAlternativeHandler(args) {
+  return suggestAlternative(args.ecosystem, args.name);
+}
+var ReviewStore = class {
+  reviews = [];
+  record(args) {
+    const review = {
+      // crypto.randomUUID() avoids the ms-granularity collisions of Date.now()
+      // when two reviews for the same coordinate are recorded in the same tick.
+      id: `review-${args.ecosystem}-${args.name}${args.version ? `@${args.version}` : ""}-${randomUUID()}`,
+      ecosystem: args.ecosystem,
+      name: args.name,
+      version: args.version,
+      reason: args.reason,
+      requested_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.reviews.push(review);
+    return review;
+  }
+  list() {
+    return [...this.reviews];
+  }
+};
+
+// src/server.ts
+var ecosystemSchema = z.enum(ECOSYSTEM);
+function ok(structured, text) {
+  return {
+    content: [{ type: "text", text }],
+    structuredContent: structured
+  };
+}
+function fail(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return {
+    content: [{ type: "text", text: `Error: ${message}` }],
+    isError: true
+  };
+}
+function buildServer(clientOpts = {}) {
+  const client = new VerdictClient(clientOpts);
+  const reviews = new ReviewStore();
+  const server = new McpServer(
+    { name: "inner-mcp", version: "0.1.0" },
+    {
+      instructions: "Inner security gate for package installs. Before you run npm/pip install, call check_package (or check_dependencies for a whole manifest). If a package is BLOCK or REVIEW, do NOT install it \u2014 use suggest_alternative for a safer option, or request_review to flag it. Use explain_verdict to show the user why."
+    }
+  );
+  server.registerTool(
+    "check_package",
+    {
+      title: "Check a package before installing",
+      description: "Get the Inner verdict (status/action/confidence/behaviors) for a single package, plus a suggested safer alternative when it is blocked. Call this BEFORE installing.",
+      inputSchema: {
+        ecosystem: ecosystemSchema.describe("Package ecosystem: npm or pypi"),
+        name: z.string().describe('Package name, e.g. "react"'),
+        version: z.string().describe('Exact version, e.g. "18.3.1"')
+      }
+    },
+    async (args) => {
+      try {
+        const verdict = await checkPackage(client, args);
+        return ok(verdict, verdict.summary);
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  );
+  server.registerTool(
+    "check_dependencies",
+    {
+      title: "Check a whole dependency set",
+      description: "Resolve verdicts for an entire manifest/lockfile (package.json, package-lock.json, requirements.txt) or an explicit package list. Returns per-package verdicts + a tally.",
+      inputSchema: {
+        content: z.string().optional().describe("Raw manifest/lockfile contents (package.json, package-lock.json, or requirements.txt)."),
+        format: z.enum(["package.json", "package-lock.json", "requirements.txt"]).optional().describe("Parser to use; inferred from content when omitted."),
+        ecosystem: ecosystemSchema.optional().describe("Ecosystem hint for ambiguous inputs."),
+        packages: z.array(
+          z.object({
+            ecosystem: ecosystemSchema,
+            name: z.string(),
+            version: z.string()
+          })
+        ).optional().describe("Explicit package list (bypasses parsing).")
+      }
+    },
+    async (args) => {
+      try {
+        const result = await checkDependencies(client, args);
+        const { tally } = result;
+        const text = `Checked ${tally.total} package(s): ${tally.allow} ALLOW, ${tally.review} REVIEW, ${tally.block} BLOCK, ${tally.pending} PENDING.` + (result.skipped > 0 ? ` ${result.skipped} entr${result.skipped === 1 ? "y" : "ies"} skipped as unparseable (NOT scanned \u2014 treat as unprotected).` : "") + (result.has_risk ? " Risk present \u2014 review BLOCK/REVIEW/PENDING/skipped before installing." : " All clear.");
+        return ok(result, text);
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  );
+  server.registerTool(
+    "explain_verdict",
+    {
+      title: "Explain a verdict",
+      description: "Deep-insight reasoning for a package: the behaviors observed, their severity, the evidence each cites, corroboration/assurance, and a narrative explanation.",
+      inputSchema: {
+        ecosystem: ecosystemSchema.describe("Package ecosystem: npm or pypi"),
+        name: z.string().describe("Package name"),
+        version: z.string().describe("Exact version")
+      }
+    },
+    async (args) => {
+      try {
+        const explanation = await explainVerdict(client, args);
+        return ok(explanation, explanation.explanation);
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  );
+  server.registerTool(
+    "suggest_alternative",
+    {
+      title: "Suggest a safer alternative",
+      description: "For a blocked/risky package, suggest a safer equivalent. Heuristic/curated for now (a real recommendation backend is future work); returns null when nothing is known.",
+      inputSchema: {
+        ecosystem: ecosystemSchema.describe("Package ecosystem: npm or pypi"),
+        name: z.string().describe("The package to find an alternative for")
+      }
+    },
+    async (args) => {
+      try {
+        const suggestion = suggestAlternativeHandler(args);
+        const text = suggestion.suggestion ? `Suggested alternative for ${suggestion.requested}: ${suggestion.suggestion} \u2014 ${suggestion.rationale}` : suggestion.rationale;
+        return ok(suggestion, text);
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  );
+  server.registerTool(
+    "request_review",
+    {
+      title: "Request a human review",
+      description: "Record a request for a human to review a package (e.g. a false positive or an unresolved verdict). Returns a review ticket id.",
+      inputSchema: {
+        ecosystem: ecosystemSchema.describe("Package ecosystem: npm or pypi"),
+        name: z.string().describe("Package name"),
+        version: z.string().optional().describe("Version, if known"),
+        reason: z.string().optional().describe("Why a review is requested")
+      }
+    },
+    async (args) => {
+      try {
+        const review = reviews.record(args);
+        return ok(
+          review,
+          `Review requested for ${review.name}${review.version ? `@${review.version}` : ""} (ticket ${review.id}).`
+        );
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  );
+  return server;
+}
+async function main() {
+  const server = buildServer();
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  const apiUrl = process.env.INNER_API_URL ?? `${DEFAULT_API_URL} (local mock)`;
+  process.stderr.write(`[inner-mcp] ready on stdio; Verdict API: ${apiUrl}
+`);
+}
+var invokedDirectly = (() => {
+  const entry = process.argv[1];
+  if (entry === void 0) return false;
+  try {
+    const real = realpathSync(entry);
+    return import.meta.url === pathToFileURL(real).href;
+  } catch {
+    return import.meta.url === pathToFileURL(entry).href;
+  }
+})();
+if (invokedDirectly) {
+  main().catch((err) => {
+    process.stderr.write(`[inner-mcp] fatal: ${err instanceof Error ? err.stack : String(err)}
+`);
+    process.exit(1);
+  });
+}
+export {
+  buildServer
+};