@mcpspend/proxy 0.2.2 → 0.3.1

package/dist/cli.js

@@ -4,7 +4,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const config_js_1 = require("./config.js");
 const proxy_js_1 = require("./proxy.js");
 const init_js_1 = require("./init.js");
-const VERSION = '0.2.2';
+const VERSION = '0.3.1';
 const HELP = `mcpspend — observability proxy for MCP servers (v${VERSION})
 
 USAGE

package/dist/clients.d.ts

@@ -12,12 +12,14 @@ export interface ClientDefinition {
     id: 'claude-desktop' | 'cursor' | 'windsurf' | 'vscode' | 'vscode-workspace' | 'claude-code';
     name: string;
     configPaths: () => string[];
+    installMarkers?: () => string[];
     serversKey?: string;
 }
 export declare const CLIENTS: ClientDefinition[];
 export interface DiscoveredClient {
     client: ClientDefinition;
     path: string;
+    bootstrapped?: boolean;
 }
 export declare function discoverClients(): DiscoveredClient[];
 export declare function readClientConfig(path: string): ClientConfig;

package/dist/clients.js

@@ -40,6 +40,22 @@ exports.CLIENTS = [
             (0, node_path_1.join)(home, '.codeium', 'windsurf', 'mcp_config.json'),
             (0, node_path_1.join)(home, '.codeium', 'windsurf-next', 'mcp_config.json'),
         ],
+        // Windsurf only creates mcp_config.json after the user adds a server via
+        // the UI. The .codeium/windsurf dir exists from the moment Windsurf runs
+        // once, and the AppData install dir exists from the install itself.
+        installMarkers: () => {
+            const markers = [
+                (0, node_path_1.join)(home, '.codeium', 'windsurf'),
+                (0, node_path_1.join)(home, '.codeium', 'windsurf-next'),
+            ];
+            if (isWin) {
+                markers.push((0, node_path_1.join)(process.env.LOCALAPPDATA || (0, node_path_1.join)(home, 'AppData', 'Local'), 'Windsurf'));
+            }
+            else if (isMac) {
+                markers.push('/Applications/Windsurf.app');
+            }
+            return markers;
+        },
     },
     {
         id: 'vscode',
@@ -68,12 +84,29 @@ exports.CLIENTS = [
 function discoverClients() {
     const found = [];
     for (const c of exports.CLIENTS) {
+        let matched = false;
+        // First try existing config files (the common case).
         for (const p of c.configPaths()) {
             if ((0, node_fs_1.existsSync)(p)) {
                 found.push({ client: c, path: p });
+                matched = true;
                 break;
             }
         }
+        if (matched)
+            continue;
+        // Fall back to install markers. If the client is installed but has never
+        // had a config written, take the first configPath as the destination and
+        // mark the discovery as bootstrapped.
+        if (c.installMarkers) {
+            const installed = c.installMarkers().some(p => (0, node_fs_1.existsSync)(p));
+            if (installed) {
+                const paths = c.configPaths();
+                if (paths.length > 0) {
+                    found.push({ client: c, path: paths[0], bootstrapped: true });
+                }
+            }
+        }
     }
     return found;
 }

package/dist/clients.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/clients.test.js

@@ -0,0 +1,133 @@
+"use strict";
+// Unit tests for the wrap/unwrap logic in clients.ts.
+//
+// History: we shipped 0.2.0 with isAlreadyWrapped() failing to recognise
+// `npx -y @mcpspend/proxy@latest wrap …`, which caused init to double-wrap
+// configs that users had previously set up manually. These tests pin down
+// every wrap shape we ever generate or accept.
+//
+// Run with: node --test --import tsx src/clients.test.ts
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const clients_js_1 = require("./clients.js");
+(0, node_test_1.describe)('isAlreadyWrapped', () => {
+    (0, node_test_1.test)('recognises npx -y @mcpspend/proxy wrap', () => {
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)({
+            command: 'npx',
+            args: ['-y', '@mcpspend/proxy', 'wrap', '--', 'node', 'server.js'],
+        }), true);
+    });
+    (0, node_test_1.test)('recognises npx -y @mcpspend/proxy@latest wrap', () => {
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)({
+            command: 'npx',
+            args: ['-y', '@mcpspend/proxy@latest', 'wrap', '--', 'node', 'server.js'],
+        }), true);
+    });
+    (0, node_test_1.test)('recognises npx -y @mcpspend/proxy@0.2.2 wrap', () => {
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)({
+            command: 'npx',
+            args: ['-y', '@mcpspend/proxy@0.2.2', 'wrap', '--', 'node', 'server.js'],
+        }), true);
+    });
+    (0, node_test_1.test)('recognises npx without -y flag', () => {
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)({
+            command: 'npx',
+            args: ['@mcpspend/proxy', 'wrap', '--', 'node', 'server.js'],
+        }), true);
+    });
+    (0, node_test_1.test)('recognises bin-direct mcpspend wrap', () => {
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)({
+            command: 'mcpspend',
+            args: ['wrap', '--', 'node', 'server.js'],
+        }), true);
+    });
+    (0, node_test_1.test)('recognises absolute Windows path to mcpspend.cmd', () => {
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)({
+            command: 'C:\\Users\\me\\AppData\\Roaming\\npm\\mcpspend.cmd',
+            args: ['wrap', '--', 'node', 'server.js'],
+        }), true);
+    });
+    (0, node_test_1.test)('rejects unrelated npx invocations', () => {
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)({
+            command: 'npx',
+            args: ['-y', '@modelcontextprotocol/server-filesystem', '/data'],
+        }), false);
+    });
+    (0, node_test_1.test)('rejects raw mcpspend without wrap subcommand', () => {
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)({
+            command: 'mcpspend',
+            args: ['init', '--key', 'mcps_live_xxx'],
+        }), false);
+    });
+    (0, node_test_1.test)('rejects empty args', () => {
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)({ command: 'npx', args: [] }), false);
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)({ command: 'mcpspend', args: [] }), false);
+    });
+    (0, node_test_1.test)('rejects an npx invoking some other package called proxy', () => {
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)({
+            command: 'npx',
+            args: ['-y', '@otherorg/proxy', 'wrap', '--', 'node', 'server.js'],
+        }), false);
+    });
+});
+(0, node_test_1.describe)('wrap → unwrap roundtrip', () => {
+    (0, node_test_1.test)('npx-style preserves command + args + env', () => {
+        const original = {
+            command: 'npx',
+            args: ['-y', '@modelcontextprotocol/server-filesystem', '/data'],
+            env: { FOO: 'bar' },
+        };
+        const wrapped = (0, clients_js_1.wrapEntry)(original);
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)(wrapped), true, 'wrapped should be recognised');
+        const restored = (0, clients_js_1.unwrapEntry)(wrapped);
+        strict_1.default.deepEqual(restored, original);
+    });
+    (0, node_test_1.test)('bin-style preserves command + args + env', () => {
+        const original = {
+            command: 'node',
+            args: ['./my-server.js'],
+            env: { GITHUB_TOKEN: 'xxx' },
+        };
+        const wrapped = (0, clients_js_1.wrapEntry)(original, { style: 'bin' });
+        strict_1.default.equal(wrapped.command, 'mcpspend');
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)(wrapped), true);
+        const restored = (0, clients_js_1.unwrapEntry)(wrapped);
+        strict_1.default.deepEqual(restored, original);
+    });
+    (0, node_test_1.test)('does NOT bake the API key into wrapped args (prevents git leak)', () => {
+        const wrapped = (0, clients_js_1.wrapEntry)({ command: 'node', args: ['server.js'] }, { apiKey: 'mcps_live_SECRET' });
+        const flat = JSON.stringify(wrapped);
+        strict_1.default.equal(flat.includes('mcps_live_SECRET'), false);
+        strict_1.default.equal(flat.includes('--key'), false);
+    });
+    (0, node_test_1.test)('projectId and agentName are baked in (they are not secrets)', () => {
+        const wrapped = (0, clients_js_1.wrapEntry)({ command: 'node', args: ['server.js'] }, { projectId: 'prj_xyz', agentName: 'demo-agent' });
+        strict_1.default.ok(wrapped.args.includes('--project'));
+        strict_1.default.ok(wrapped.args.includes('prj_xyz'));
+        strict_1.default.ok(wrapped.args.includes('--agent'));
+        strict_1.default.ok(wrapped.args.includes('demo-agent'));
+    });
+});
+(0, node_test_1.describe)('unwrapEntry edge cases', () => {
+    (0, node_test_1.test)('returns null for non-wrapped entries (no-op safety)', () => {
+        strict_1.default.equal((0, clients_js_1.unwrapEntry)({ command: 'npx', args: ['some', 'thing'] }), null);
+    });
+    (0, node_test_1.test)('handles wrapped entry with no -- separator gracefully', () => {
+        strict_1.default.equal((0, clients_js_1.unwrapEntry)({ command: 'mcpspend', args: ['wrap'] }), null);
+    });
+});
+(0, node_test_1.describe)('idempotency', () => {
+    (0, node_test_1.test)('wrapping a wrapped entry should not double-wrap (guarded at wrapAllServers level)', () => {
+        // wrapEntry itself does not check — it's wrapAllServers that gates on
+        // isAlreadyWrapped. Confirm that the gate works as documented.
+        const original = { command: 'npx', args: ['@modelcontextprotocol/server-filesystem', '/data'] };
+        const once = (0, clients_js_1.wrapEntry)(original);
+        strict_1.default.equal((0, clients_js_1.isAlreadyWrapped)(once), true);
+        // If wrapAllServers correctly skips, the entry passed to wrapEntry would
+        // already be wrapped — but defensive callers should rely on isAlreadyWrapped.
+    });
+});

package/dist/init.d.ts

@@ -16,6 +16,7 @@ export interface ClientReport {
     backupPath?: string;
     servers: WrapResult[];
     error?: string;
+    bootstrapped?: boolean;
 }
 export interface InitReport {
     apiKeyConfigured: boolean;

package/dist/init.js

@@ -27,10 +27,24 @@ function runInit(opts = {}) {
         discovered = discovered.filter((d) => set.has(d.client.id));
     }
     const clientReports = [];
-    for (const { client, path } of discovered) {
+    for (const { client, path, bootstrapped } of discovered) {
         const serversKey = client.serversKey || 'mcpServers';
         try {
             const current = (0, clients_js_1.readClientConfig)(path);
+            // Bootstrap-mode: client is installed but has no MCP config yet. We still
+            // want to create the file with an empty mcpServers object so the user
+            // can add their first server via the UI and have it auto-wrapped on the
+            // next `init` run. Unwrap is a no-op here.
+            if (bootstrapped && opts.unwrap) {
+                clientReports.push({
+                    client: client.id,
+                    name: client.name,
+                    path,
+                    status: 'no-changes',
+                    servers: [],
+                });
+                continue;
+            }
             const { config: next, results } = opts.unwrap
                 ? (0, clients_js_1.unwrapAllServers)(current, serversKey)
                 : (0, clients_js_1.wrapAllServers)(current, serversKey, {
@@ -38,7 +52,12 @@ function runInit(opts = {}) {
                     endpoint: opts.endpoint,
                     agentName: opts.agentName,
                 });
-            const changed = JSON.stringify(current) !== JSON.stringify(next);
+            const changed = bootstrapped || JSON.stringify(current) !== JSON.stringify(next);
+            if (bootstrapped && !(next[serversKey] && Object.keys(next[serversKey]).length > 0)) {
+                // Ensure the key exists in the new file even when empty.
+                ;
+                next[serversKey] = {};
+            }
             if (opts.dryRun) {
                 clientReports.push({
                     client: client.id,
@@ -67,6 +86,7 @@ function runInit(opts = {}) {
                 status: 'patched',
                 backupPath: backupPath || undefined,
                 servers: results,
+                bootstrapped,
             });
         }
         catch (err) {
@@ -102,7 +122,7 @@ function formatReport(report, unwrap = false) {
     }
     lines.push(`Found ${report.clientsFound} MCP client(s):`);
     for (const r of report.clients) {
-        const tag = r.status === 'patched' ? '✓ patched'
+        const tag = r.status === 'patched' ? (r.bootstrapped ? '✓ bootstrapped (empty config created)' : '✓ patched')
             : r.status === 'no-changes' ? '· no changes'
                 : r.status === 'dry-run' ? '∼ dry-run'
                     : `✗ error: ${r.error}`;
@@ -111,6 +131,9 @@ function formatReport(report, unwrap = false) {
         if (r.backupPath) {
             lines.push(`    backup: ${r.backupPath}`);
         }
+        if (r.bootstrapped && r.servers.length === 0) {
+            lines.push(`    (add MCP servers in the client UI — they'll be auto-wrapped next time you run init)`);
+        }
         for (const s of r.servers) {
             const sym = s.status === 'wrapped' ? '+'
                 : s.status === 'already-wrapped' ? '='

package/dist/proxy.d.ts

@@ -1,4 +1,5 @@
 import type { Config } from './config.js';
+export declare const __testExtractServerName: (command: string, args: string[]) => string;
 export declare function runProxy(opts: {
     command: string;
     args: string[];

package/dist/proxy.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.__testExtractServerName = void 0;
 exports.runProxy = runProxy;
 const cross_spawn_1 = __importDefault(require("cross-spawn"));
 const node_crypto_1 = require("node:crypto");
@@ -14,29 +15,80 @@ function estimateTokens(payload) {
     const s = typeof payload === 'string' ? payload : JSON.stringify(payload);
     return Math.max(1, Math.ceil(s.length / 4));
 }
-function extractServerName(command, args) {
-    // Best-effort: pick the most descriptive token from the command line.
-    // Examples:
-    //   npx @modelcontextprotocol/server-filesystem /path  →  "filesystem"
-    //   node ./my-mcp-server.js                            →  "my-mcp-server"
-    //   /usr/bin/uvx mcp-server-fetch                       →  "mcp-server-fetch"
-    const tokens = [command, ...args];
-    for (const t of tokens) {
-        const m = t.match(/(?:server-|mcp-server-)([a-z0-9-]+)/i);
-        if (m)
-            return m[1];
+// Strip an npm package spec down to its identifying core. We do this in stages
+// so each rule is auditable and reviewers can extend it without unwinding a
+// monster regex.
+//
+//   @playwright/mcp@latest             → playwright
+//   @modelcontextprotocol/server-fs    → fs
+//   @owner/foo-mcp                     → foo
+//   github-mcp-server                  → github
+//   mcp-server-fetch                   → fetch
+//   firecrawl-mcp                      → firecrawl
+function stripMcpAffixes(s) {
+    let t = s;
+    t = t.replace(/^mcp-server-/i, '').replace(/-mcp-server$/i, '');
+    t = t.replace(/^server-/i, '').replace(/-server$/i, '');
+    t = t.replace(/^mcp-/i, '').replace(/-mcp$/i, '');
+    return t.toLowerCase().trim();
+}
+function isDegenerate(t) {
+    return !t || t === 'mcp' || t === 'server' || t === 'latest';
+}
+function normaliseServerToken(raw) {
+    let t = raw;
+    // Drop everything after the version separator, but only when it's a version,
+    // not a scope marker. `@playwright/mcp@latest` → `@playwright/mcp`.
+    const lastAt = t.lastIndexOf('@');
+    if (lastAt > 0)
+        t = t.slice(0, lastAt);
+    // If this is a scoped npm spec like `@playwright/mcp`, try the unscoped
+    // name first; if that strips down to something generic ("mcp", "server"),
+    // fall back to the scope itself. That gives "playwright" instead of "mcp"
+    // for `@playwright/mcp@latest`, while still preferring the specific name
+    // for `@modelcontextprotocol/server-filesystem` → "filesystem".
+    let scope = null;
+    if (t.startsWith('@')) {
+        const slash = t.indexOf('/');
+        if (slash > 0) {
+            scope = t.slice(1, slash).toLowerCase();
+            t = t.slice(slash + 1);
+        }
     }
-    for (const t of tokens) {
-        const m = t.match(/([a-z0-9-]+)-mcp-server/i);
-        if (m)
-            return m[1];
+    // Path basename when this is a script path.
+    t = t.split(/[\\/]/).pop() || t;
+    t = t.replace(/\.(js|cjs|mjs|ts|tsx|py)$/i, '');
+    let name = stripMcpAffixes(t);
+    if (isDegenerate(name) && scope) {
+        name = stripMcpAffixes(scope);
     }
-    // Fallback: last non-flag arg's basename without extension
-    const lastArg = [...tokens].reverse().find((t) => !t.startsWith('-'));
-    if (lastArg) {
-        return lastArg.split(/[\\/]/).pop().replace(/\.[^.]+$/, '');
+    if (isDegenerate(name))
+        return null;
+    return name;
+}
+// Exported only for tests — see proxy.test.ts. Kept off the public surface to
+// avoid implying it's a stable API.
+const __testExtractServerName = (command, args) => extractServerName(command, args);
+exports.__testExtractServerName = __testExtractServerName;
+function extractServerName(command, args) {
+    // Skip well-known shims that never carry the server identity themselves.
+    const skipPrefix = new Set(['npx', 'npx.cmd', 'npx.exe', 'uvx', 'pnpx', 'bunx', 'pipx', 'node', 'bun', 'deno', 'python', 'python3']);
+    const tokens = [command, ...args].filter((t) => {
+        if (!t)
+            return false;
+        if (t.startsWith('-'))
+            return false; // flags
+        const base = t.split(/[\\/]/).pop()?.toLowerCase() || '';
+        return !skipPrefix.has(base) && !skipPrefix.has(t.toLowerCase());
+    });
+    for (const t of tokens) {
+        const name = normaliseServerToken(t);
+        if (name)
+            return name;
     }
-    return 'mcp';
+    // Last resort — last raw token basename.
+    const lastArg = [...args].reverse().find((t) => !t.startsWith('-')) || command;
+    return (lastArg.split(/[\\/]/).pop() || lastArg).replace(/\.[^.]+$/, '') || 'mcp';
 }
 async function runProxy(opts) {
     const { command, args, config, model } = opts;

package/dist/proxy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/proxy.test.js

@@ -0,0 +1,57 @@
+"use strict";
+// Tests for extractServerName. The function is not exported from proxy.ts so
+// we re-import via require and access the internal binding. If the API ever
+// grows we'll bring it out into its own module.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+// Internal binding access — proxy.ts doesn't export extractServerName because
+// it's an implementation detail. We dynamic-require to expose it for tests
+// without changing the public surface.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const proxy = require('./proxy.js');
+// If the module doesn't expose a test hook, re-implement the same dispatcher
+// inline. We'd rather duplicate three lines than couple production code to
+// the test layout.
+function extractName(command, args) {
+    if (proxy.__testExtractServerName)
+        return proxy.__testExtractServerName(command, args);
+    throw new Error('proxy.ts must expose __testExtractServerName for tests — see proxy.ts diff in this PR');
+}
+(0, node_test_1.describe)('extractServerName', () => {
+    (0, node_test_1.test)('playwright via @playwright/mcp@latest', () => {
+        strict_1.default.equal(extractName('npx', ['-y', '@playwright/mcp@latest']), 'playwright');
+    });
+    (0, node_test_1.test)('filesystem via @modelcontextprotocol/server-filesystem', () => {
+        strict_1.default.equal(extractName('npx', ['-y', '@modelcontextprotocol/server-filesystem', '/data']), 'filesystem');
+    });
+    (0, node_test_1.test)('github via @modelcontextprotocol/server-github', () => {
+        strict_1.default.equal(extractName('npx', ['-y', '@modelcontextprotocol/server-github']), 'github');
+    });
+    (0, node_test_1.test)('fetch via mcp-server-fetch (uvx)', () => {
+        strict_1.default.equal(extractName('uvx', ['mcp-server-fetch']), 'fetch');
+    });
+    (0, node_test_1.test)('firecrawl via firecrawl-mcp', () => {
+        strict_1.default.equal(extractName('npx', ['-y', 'firecrawl-mcp']), 'firecrawl');
+    });
+    (0, node_test_1.test)('github via github-mcp-server', () => {
+        strict_1.default.equal(extractName('npx', ['-y', 'github-mcp-server']), 'github');
+    });
+    (0, node_test_1.test)('node script with mcp-server suffix', () => {
+        strict_1.default.equal(extractName('node', ['./my-mcp-server.js']), 'my');
+    });
+    (0, node_test_1.test)('Windows absolute path node script', () => {
+        strict_1.default.equal(extractName('node', ['C:\\Users\\me\\servers\\notion-mcp.js']), 'notion');
+    });
+    (0, node_test_1.test)('skips npm shims, finds package after', () => {
+        strict_1.default.equal(extractName('npx', ['--yes', '@some-org/brave-search']), 'brave-search');
+    });
+    (0, node_test_1.test)('falls back to last token when nothing matches conventions', () => {
+        const out = extractName('python', ['./custom_runner.py']);
+        strict_1.default.ok(out.length > 0, 'should produce something');
+        strict_1.default.notEqual(out, 'python');
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpspend/proxy",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "description": "Transparent proxy CLI for MCP servers — tracks tool calls, latency, and cost via MCPSpend.",
   "license": "MIT",
   "homepage": "https://mcpspend.com",
@@ -36,6 +36,7 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsx src/cli.ts",
+    "test": "node --test --import tsx src/clients.test.ts src/proxy.test.ts",
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "npm run build"
   },