@mlawsonking/code-guard-mcp 1.0.0

package/README.md

@@ -0,0 +1,22 @@
+# code-guard-mcp
+
+Security scanner for **AI-generated code**, as an MCP server — the check a coding agent runs on its *own* code or
+diff **before it commits**. Deterministic, free, **no LLM**.
+
+**Why:** 53% of code is now AI-written and ~25% ships vulnerable, yet nothing scans it *in the agent's loop* for
+free. Code Guard is that fast first-line scanner (not a full audit replacement).
+
+## Tools
+- **`scan_code`** — scan a snippet → findings `{rule, category, severity, line, message, remediation}` + verdict
+  `pass`/`review`/`block`. Detects command/code/SQL injection, SSRF, hardcoded secrets, weak crypto, unsafe
+  deserialization (pickle/yaml), disabled TLS verification, XSS / template injection.
+- **`scan_diff`** — scan only the **added lines** of a unified diff (correct new-file line numbers).
+- **`list_rules`** — the rule catalog (coverage transparency).
+
+## Install
+```json
+{ "mcpServers": { "code-guard": { "command": "npx", "args": ["-y", "@mlawsonking/code-guard-mcp"] } } }
+```
+
+Deterministic (same input → same output). API: https://code-guard-api.vercel.app · part of the agent-guardrail
+suite (Package Guard · Agent Firewall · Payment Guard · Email Guard · Code Guard).

package/index.mjs

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// code-guard-mcp — MCP server: security scan for AI-generated code. Deterministic, no LLM.
+//   scan_code  -> scan a code snippet for vulns before committing/running it
+//   scan_diff  -> scan only the added lines of a unified diff
+//   list_rules -> the rule catalog (coverage)
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { z } from 'zod';
+
+const API = process.env.CODE_GUARD_API || 'https://code-guard-api.vercel.app';
+const ok = (text) => ({ content: [{ type: 'text', text }] });
+const err = (msg) => ({ content: [{ type: 'text', text: `Error: ${msg}` }], isError: true });
+async function post(path, body) { const r = await fetch(`${API}${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json', Accept: 'application/json' }, body: JSON.stringify(body) }); return r.json(); }
+async function get(path) { const r = await fetch(`${API}${path}`, { headers: { Accept: 'application/json' } }); return r.json(); }
+
+const server = new McpServer({ name: 'code-guard', version: '1.0.0' });
+
+server.tool(
+  'scan_code',
+  'Security-scan a snippet of code you (the agent) just generated, BEFORE committing or running it. Deterministic rule engine (no LLM) for the high-frequency vulnerability classes in AI-written code: command/code/SQL injection, SSRF, hardcoded secrets & API keys, weak crypto, unsafe deserialization (pickle/yaml), disabled TLS verification, XSS / template injection. Returns findings (rule id, category, severity, line, message, remediation) and a verdict: pass / review / block. Fast first-line check, not a full audit.',
+  { code: z.string().describe('The source code to scan.'), language: z.string().optional().describe('python | javascript | typescript | … (optional; auto-detected).') },
+  async ({ code, language }) => { try { const j = await post('/api/scan-code', { code, language }); return j.ok ? ok(JSON.stringify(j, null, 2)) : err(j.error || 'scan failed'); } catch (e) { return err(String((e && e.message) || e)); } }
+);
+
+server.tool(
+  'scan_diff',
+  'Scan only the ADDED lines of a unified diff (your just-written change), with correct new-file line numbers. Use in a commit loop to catch vulnerabilities you just introduced. Returns findings + a verdict: pass / review / block.',
+  { diff: z.string().describe('A unified diff (git diff).'), language: z.string().optional() },
+  async ({ diff, language }) => { try { const j = await post('/api/scan-diff', { diff, language }); return j.ok ? ok(JSON.stringify(j, null, 2)) : err(j.error || 'scan failed'); } catch (e) { return err(String((e && e.message) || e)); } }
+);
+
+server.tool(
+  'list_rules',
+  'List the deterministic rule catalog Code Guard checks (rule id, category, severity, language), so you know its coverage.',
+  {},
+  async () => { try { const j = await get('/api/rules'); return j.ok ? ok(JSON.stringify(j, null, 2)) : err('failed'); } catch (e) { return err(String((e && e.message) || e)); } }
+);
+
+const transport = new StdioServerTransport();
+await server.connect(transport);
+console.error('code-guard-mcp running (3 tools).');

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@mlawsonking/code-guard-mcp",
+  "version": "1.0.0",
+  "mcpName": "io.github.mlawsonking/code-guard-mcp",
+  "publishConfig": { "access": "public" },
+  "description": "MCP server: security scanner for AI-generated code — the agent scans its own code/diff before committing. Detects injection, SSRF, hardcoded secrets, weak crypto, unsafe deserialization, TLS-off, XSS. Deterministic, free, no LLM.",
+  "type": "module",
+  "bin": { "code-guard-mcp": "index.mjs" },
+  "files": ["index.mjs", "README.md"],
+  "engines": { "node": ">=18" },
+  "keywords": ["mcp", "model-context-protocol", "ai", "agents", "security", "sast", "code-security", "ai-generated-code", "vulnerability", "injection", "secrets", "guardrails", "coding-agent"],
+  "repository": { "type": "git", "url": "git+https://github.com/mlawsonking/MCP.git", "directory": "code-guard-mcp" },
+  "homepage": "https://github.com/mlawsonking/MCP#readme",
+  "license": "MIT",
+  "author": "mlawsonking",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    "zod": "^3.23.8"
+  }
+}