@mmerterden/multi-agent-toolkit-mcp 3.13.1 → 3.14.0

package/CHANGELOG.md

@@ -1320,6 +1320,19 @@ paths and requires an error on each. Gate 9 requires every tool advertising an
 outputSchema to actually return `structuredContent`, and to keep its text
 content beside it. 14 gates, all green.
 
+## [3.14.0] - 2026-09-21
+
+### Added
+
+- **`security` family: `security_cvss_score` and `security_dep_inventory`.**
+  security_cvss_score turns a CVSS 3.1 base vector into a score and band by the
+  FIRST arithmetic, so a finding's number cannot drift from its vector.
+  security_dep_inventory normalizes a lockfile (npm, yarn, pnpm, CocoaPods, pip,
+  Go, Cargo, RubyGems) into {ecosystem, name, version}. Both are pure JS and
+  contact nothing - matching an inventory against known CVEs stays a separate,
+  network-bearing step, so the stdio-only egress surface is unchanged. Gated at
+  serve time by `MCP_TOOLKIT_CAPS=security`. 117 tools total.
+
 ## [3.0.0] - 2026-08-22
 
 ### Changed

package/README.md

@@ -7,7 +7,7 @@
 
 🇹🇷 Türkçe: [README.tr.md](./README.tr.md)
 
-**115 tools** for iOS Simulator, Android Emulator, and headless web control. MCP server that lets your AI coding assistant see, interact with, and audit your mobile apps - plus drive browsers, run an 18-rule App Store compliance audit, and orchestrate multi-step batch flows.
+**117 tools** for iOS Simulator, Android Emulator, and headless web control. MCP server that lets your AI coding assistant see, interact with, and audit your mobile apps - plus drive browsers, run an 18-rule App Store compliance audit, and orchestrate multi-step batch flows.
 
 Distributed on the **public npm registry** - `npx @mmerterden/multi-agent-toolkit-mcp` resolves with no auth, no token, no `~/.npmrc` setup.
 
@@ -15,7 +15,7 @@ Distributed on the **public npm registry** - `npx @mmerterden/multi-agent-toolki
 
 That distinction is worth keeping straight. This line once called five hosts "the multi-agent-pipeline's full-orchestration targets", which stopped being true in pipeline v10.7.0 when the Cursor / Antigravity / Codex / Copilot Chat adapters were deleted. Codex CLI returned as a first-class target in pipeline v13.0.0 on capability - it now has skills, parallel sub-agents, hooks and MCP - and it is on the verified list only because a gate exercises it, not because it is supported elsewhere. Claiming hosts nobody exercises is not free either: 2.20.0 and 2.21.0 shipped an illegal `outputSchema` on the first tool, so Claude Code rejected the whole `tools/list` and served zero of the 78 - in the primary host, for two releases, with every gate in this repo green.
 
-**13 categories:**
+**14 categories:**
 - **Device Control** (59 tools) - screenshot, tap, swipe, type, navigate, dark mode, locale, orientation, location, permissions, push notifications, real start/stop screen recording
 - **Memory** (2 tools) - `ios_leaks` runs /usr/bin/leaks against a simulator or host process, snapshot or diff against a saved memory graph; `android_meminfo` reads dumpsys meminfo, snapshot or diff. Both report `measurable:false` rather than a clean result when they could not look
 - **Crash Diagnostics** (2 tools) - `ios_list_crashes` reads the host's DiagnosticReports, `android_list_crashes` dumps the adb crash buffer, both tail-bounded
@@ -29,6 +29,7 @@ That distinction is worth keeping straight. This line once called five hosts "th
 - **Research** (2 tools) - provider-backed web search normalized to {title, url, snippet}, and a cited answer through Perplexity Sonar. Keys are read from the environment at call time and go straight into a header; a literal key is not an accepted argument, the same contract the Wallet signer uses
 - **Media** (1 tool) - `media_frames` pulls key frames out of a recording with ffmpeg, dropping near-duplicates, so the video `ios_record_video` just produced becomes something a model can actually look at
 - **Autonomous Agent DSL** (2 tools) - `agent_run_steps` executes a batch array of {tool, args, continue_on_error?, wait_ms?} steps in one MCP round trip. Ideal for scripted login flows, form fills, multi-step QA paths. `agent_query_output` searches the full output of an earlier call that was too large to return inline, so a follow-up question does not mean re-running an expensive tool.
+- **Security** (2 tools) - offline, no egress: `security_cvss_score` turns a CVSS 3.1 base vector into a score and band by the FIRST arithmetic, so a finding's number cannot drift from its vector; `security_dep_inventory` normalizes a lockfile (npm, yarn, pnpm, CocoaPods, pip, Go, Cargo, RubyGems) into `{ecosystem, name, version}` for a separate CVE lookup to consume. Neither contacts a registry
 
 ## Quick Start
 

package/README.tr.md

@@ -15,7 +15,7 @@ iOS Simulator, Android Emulator ve headless web kontrolü için **115 araç**. A
 
 Bu ayrımı net tutmakta fayda var. Bu satır bir zamanlar beş host'u "multi-agent-pipeline'ın tam-orkestrasyon hedefleri" olarak adlandırıyordu, bu da pipeline v10.7.0'da Cursor / Antigravity / Codex / Copilot Chat adaptörleri silindiğinde doğru olmaktan çıktı. Codex CLI, pipeline v13.0.0'da yetenek üzerinden birinci-sınıf bir hedef olarak geri döndü - artık skill'leri, paralel sub-agent'ları, hook'ları ve MCP'si var - ve doğrulanmış listede sadece bir kapı onu çalıştırdığı için yer alıyor, başka bir yerde desteklendiği için değil. Kimsenin çalıştırmadığı host'ları iddia etmek de bedavaya gelmiyor: 2.20.0 ve 2.21.0, ilk araçta yasa dışı bir `outputSchema` gönderdi, bu yüzden Claude Code tüm `tools/list`'i reddetti ve 78'in sıfırını sundu - birincil host'ta, iki release boyunca, bu repo'daki her kapı yeşilken.
 
-**13 kategori:**
+**14 kategori:**
 - **Device Control** (59 araç) - screenshot, tap, swipe, type, navigate, dark mode, locale, orientation, location, permissions, push notifications, gerçek start/stop ekran kaydı
 - **Memory** (2 araç) - `ios_leaks`, bir simülatör ya da host süreci üzerinde /usr/bin/leaks çalıştırır; anlık görüntü alır ya da kayıtlı bir memory graph ile karşılaştırır. `android_meminfo`, dumpsys meminfo okur, aynı şekilde anlık görüntü ya da fark. İkisi de bakamadıklarında temiz bir sonuç değil `measurable:false` döner
 - **Crash Diagnostics** (2 araç) - `ios_list_crashes` host'un DiagnosticReports dizinini okur, `android_list_crashes` adb crash buffer'ını döker, ikisi de tail-sınırlı
@@ -29,6 +29,7 @@ Bu ayrımı net tutmakta fayda var. Bu satır bir zamanlar beş host'u "multi-ag
 - **Research** (2 araç) - sağlayıcı destekli web araması, {title, url, snippet} şemasına normalize edilmiş; ve Perplexity Sonar üzerinden atıflı cevap. Anahtarlar çağrı anında ortamdan okunup doğrudan bir başlığa gider; düz metin anahtar kabul edilen bir argüman değil - Wallet imzalayıcısının kullandığı sözleşmenin aynısı
 - **Media** (1 araç) - `media_frames`, bir kaydın anahtar karelerini ffmpeg ile çıkarır ve birbirine benzeyenleri eler; böylece `ios_record_video`'nun ürettiği video bir modelin gerçekten bakabileceği bir şeye dönüşür
 - **Autonomous Agent DSL** (2 araç) - `agent_run_steps`, tek bir MCP round trip'inde {tool, args, continue_on_error?, wait_ms?} adımlarından oluşan bir batch dizisini çalıştırır. Scriptlenmiş login akışları, form doldurma, çok-adımlı QA yolları için ideal. `agent_query_output`, satır içi dönemeyecek kadar büyük olan önceki bir çağrının tam çıktısını arar; böylece bir takip sorusu pahalı aracı yeniden koşturmak anlamına gelmez.
+- **Security** (2 araç) - çevrimdışı, egress yok: `security_cvss_score` bir CVSS 3.1 temel vektörünü FIRST aritmetiğiyle skora ve banda çevirir, böylece bir bulgunun sayısı vektöründen sapamaz; `security_dep_inventory` bir lockfile'ı (npm, yarn, pnpm, CocoaPods, pip, Go, Cargo, RubyGems) `{ecosystem, name, version}` listesine normalize eder, ayrı bir CVE aramasının tüketmesi için. İkisi de bir registry'ye bağlanmaz
 
 ## Hızlı Başlangıç
 

package/index.js

@@ -46,6 +46,7 @@ import {
   shutdownAllLsp,
 } from "./tools/code-intel/index.js";
 import { PASS_TOOLS, handlePass, PASS_READ_ONLY, PASS_OUTPUT_SCHEMAS } from "./tools/pass-kit/index.js";
+import { SECURITY_TOOLS, handleSecurity, SECURITY_OUTPUT_SCHEMAS } from "./tools/security/index.js";
 import { parseLaunchOutput } from "./tools/launch-time/index.js";
 import { parseLeaksOutput, parseMeminfoOutput, diffMeminfo } from "./tools/memory/index.js";
 import { auditIosTree, auditAndroidDump, parseAuditResults } from "./tools/a11y/index.js";
@@ -2499,10 +2500,10 @@ async function handleMedia(name, args) {
 //
 // Unset means everything, which is the behaviour every existing consumer
 // already has. The value is a comma-separated list of families: ios, android,
-// web, design, code, pass, agent, context, research, media. An unknown name is
+// web, design, code, pass, agent, context, research, media, security. An unknown name is
 // reported on stderr rather than silently ignored, because a typo that quietly
 // disables a family is worse than a noisy one.
-const ALL_CAPS = ["ios", "android", "web", "design", "code", "pass", "agent", "context", "research", "media"];
+const ALL_CAPS = ["ios", "android", "web", "design", "code", "pass", "agent", "context", "research", "media", "security"];
 
 function enabledCaps() {
   const raw = (process.env.MCP_TOOLKIT_CAPS || "").trim();
@@ -2543,6 +2544,7 @@ const ALL_TOOLS = [
   ...DESIGN_TOOLS,
   ...CODE_TOOLS,
   ...PASS_TOOLS,
+  ...SECURITY_TOOLS,
 ];
 
 // Name -> inputSchema, so the CallTool boundary can enforce the declared shape.
@@ -2805,6 +2807,7 @@ const OUTPUT_SCHEMAS = {
   // made all 78 unavailable in Claude Code - see the note further down.
   ...CODE_OUTPUT_SCHEMAS,
   ...PASS_OUTPUT_SCHEMAS,
+  ...SECURITY_OUTPUT_SCHEMAS,
   ios_accessibility_audit: ACCESSIBILITY_AUDIT_SCHEMA,
   android_accessibility_audit: ACCESSIBILITY_AUDIT_SCHEMA,
 
@@ -3019,6 +3022,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
     // aborted call cancels the in-flight LSP request instead of orphaning it.
     else if (name.startsWith("code_")) result = await handleCode(name, args || {}, ctx);
     else if (name.startsWith("pass_")) result = await handlePass(name, args || {});
+    else if (name.startsWith("security_")) result = await handleSecurity(name, args || {});
     else return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
     // Same reason as dispatchStep: a handler returns null only from its
     // `default:` arm, so an unrecognised name that happens to carry a known

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mmerterden/multi-agent-toolkit-mcp",
-  "version": "3.13.1",
-  "description": "MCP server for iOS Simulator, Android Emulator and headless web control. 115 tools: device automation (tap/swipe/type), accessibility audits, visual diff, crash logs, App Store / Play Store pre-submission compliance. Runs standalone over stdio with any MCP client.",
+  "version": "3.14.0",
+  "description": "MCP server for iOS Simulator, Android Emulator and headless web control. 117 tools: device automation (tap/swipe/type), accessibility audits, visual diff, crash logs, App Store / Play Store pre-submission compliance, offline CVSS scoring + dependency inventory. Runs standalone over stdio with any MCP client.",
   "type": "module",
   "main": "index.js",
   "bin": {
@@ -10,7 +10,7 @@
   },
   "scripts": {
     "start": "node index.js",
-    "test": "node --test tools/design-check/__tests__/design-check.test.mjs tools/design-check/__tests__/plan-determinism.test.mjs tools/ios-app-store-audit/__tests__/app-store-audit.test.mjs tools/ios-testflight/__tests__/testflight.test.mjs tools/ui-inspect/__tests__/ui-inspect.test.mjs tools/code-intel/__tests__/code-intel.test.mjs tools/pass-kit/__tests__/pass-kit.test.mjs tools/crash-logs/__tests__/crash-logs.test.mjs tools/a11y/__tests__/a11y.test.mjs tools/launch-time/__tests__/launch-time.test.mjs tools/memory/__tests__/memory.test.mjs tools/offload/__tests__/offload.test.mjs tools/context/__tests__/context.test.mjs __tests__/server-tools.test.mjs __tests__/injection.test.mjs",
+    "test": "node --test tools/design-check/__tests__/design-check.test.mjs tools/design-check/__tests__/plan-determinism.test.mjs tools/ios-app-store-audit/__tests__/app-store-audit.test.mjs tools/ios-testflight/__tests__/testflight.test.mjs tools/ui-inspect/__tests__/ui-inspect.test.mjs tools/code-intel/__tests__/code-intel.test.mjs tools/pass-kit/__tests__/pass-kit.test.mjs tools/crash-logs/__tests__/crash-logs.test.mjs tools/a11y/__tests__/a11y.test.mjs tools/launch-time/__tests__/launch-time.test.mjs tools/memory/__tests__/memory.test.mjs tools/offload/__tests__/offload.test.mjs tools/context/__tests__/context.test.mjs tools/security/__tests__/security.test.mjs __tests__/server-tools.test.mjs __tests__/injection.test.mjs",
     "gates": "bash scripts/gates.sh"
   },
   "keywords": [

package/tools/security/cvss.js

@@ -0,0 +1,108 @@
+/**
+ * CVSS 3.1 base-score computation. Pure arithmetic from the specification
+ * (https://www.first.org/cvss/v3.1/specification-document), no dependency and
+ * no network. Given a base vector string it returns the base score and the
+ * qualitative band, which is what the pipeline maps onto its reviewer severity.
+ *
+ * @module tools/security/cvss
+ */
+
+const AV = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
+const AC = { L: 0.77, H: 0.44 };
+const UI = { N: 0.85, R: 0.62 };
+// Privileges Required depends on Scope: the Changed column is the second entry.
+const PR = { N: [0.85, 0.85], L: [0.62, 0.68], H: [0.27, 0.5] };
+const CIA = { H: 0.56, L: 0.22, N: 0 };
+
+const BASE_METRICS = ["AV", "AC", "PR", "UI", "S", "C", "I", "A"];
+const ALLOWED = {
+  AV: ["N", "A", "L", "P"],
+  AC: ["L", "H"],
+  PR: ["N", "L", "H"],
+  UI: ["N", "R"],
+  S: ["U", "C"],
+  C: ["N", "L", "H"],
+  I: ["N", "L", "H"],
+  A: ["N", "L", "H"],
+};
+
+/**
+ * CVSS 3.1 Roundup: the smallest 1-decimal number >= input, computed in integer
+ * space so float representation cannot round 4.0 up to 4.1. This is the exact
+ * algorithm from the specification's appendix.
+ * @param {number} input
+ * @returns {number}
+ */
+export function roundup(input) {
+  const intInput = Math.round(input * 100000);
+  if (intInput % 10000 === 0) return intInput / 100000;
+  return (Math.floor(intInput / 10000) + 1) / 10;
+}
+
+/**
+ * @param {number} score
+ * @returns {"none"|"low"|"medium"|"high"|"critical"}
+ */
+export function band(score) {
+  if (score === 0) return "none";
+  if (score <= 3.9) return "low";
+  if (score <= 6.9) return "medium";
+  if (score <= 8.9) return "high";
+  return "critical";
+}
+
+/**
+ * Parse a CVSS 3.1 base vector into its metric map, validating the prefix, that
+ * every base metric is present exactly once, and that each value is legal.
+ * @param {string} vector
+ * @returns {{ metrics: Record<string,string> } | { error: string }}
+ */
+export function parseVector(vector) {
+  if (typeof vector !== "string" || !vector.trim()) return { error: "vector is required" };
+  const parts = vector.trim().split("/");
+  if (parts[0] !== "CVSS:3.1") return { error: `vector must start with CVSS:3.1, got "${parts[0]}"` };
+  const metrics = {};
+  for (const part of parts.slice(1)) {
+    const [key, value] = part.split(":");
+    if (!key || value === undefined) return { error: `malformed metric segment "${part}"` };
+    if (metrics[key] !== undefined) return { error: `metric ${key} appears more than once` };
+    metrics[key] = value;
+  }
+  for (const m of BASE_METRICS) {
+    if (metrics[m] === undefined) return { error: `missing base metric ${m}` };
+    if (!ALLOWED[m].includes(metrics[m])) {
+      return { error: `illegal value ${m}:${metrics[m]} (allowed: ${ALLOWED[m].join("/")})` };
+    }
+  }
+  return { metrics };
+}
+
+/**
+ * Compute the CVSS 3.1 base score and band from a base vector.
+ * @param {string} vector
+ * @returns {{ vector: string, baseScore: number, band: string } | { error: string }}
+ */
+export function scoreVector(vector) {
+  const parsed = parseVector(vector);
+  if ("error" in parsed) return parsed;
+  const m = parsed.metrics;
+  const scopeChanged = m.S === "C";
+
+  const iss = 1 - (1 - CIA[m.C]) * (1 - CIA[m.I]) * (1 - CIA[m.A]);
+  const impact = scopeChanged
+    ? 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15)
+    : 6.42 * iss;
+
+  const exploitability = 8.22 * AV[m.AV] * AC[m.AC] * PR[m.PR][scopeChanged ? 1 : 0] * UI[m.UI];
+
+  let baseScore;
+  if (impact <= 0) {
+    baseScore = 0;
+  } else if (scopeChanged) {
+    baseScore = roundup(Math.min(1.08 * (impact + exploitability), 10));
+  } else {
+    baseScore = roundup(Math.min(impact + exploitability, 10));
+  }
+
+  return { vector: vector.trim(), baseScore, band: band(baseScore) };
+}

package/tools/security/index.js

@@ -0,0 +1,115 @@
+/**
+ * security  -  local, offline helpers for a static security review.
+ *
+ * OFFLINE BY CONSTRUCTION. Neither tool contacts a registry, an advisory
+ * database or anything else: security_cvss_score is pure arithmetic, and
+ * security_dep_inventory reads one lockfile off disk and normalizes it. Matching
+ * an inventory against known CVEs is a separate, network-bearing step
+ * (ai-analyst-toolkit:evidence-registry) kept out of this family on purpose, so
+ * the toolkit's stdio-only egress allowlist does not change.
+ *
+ * GENERIC. No project, brand or repo appears here. Every input is a caller value.
+ *
+ * @module tools/security
+ */
+
+import { scoreVector } from "./cvss.js";
+import { inventory, SUPPORTED } from "./deps.js";
+
+const ERROR_PREFIX = "ERROR: ";
+
+export const SECURITY_TOOLS = [
+  {
+    name: "security_cvss_score",
+    description:
+      "Compute the CVSS 3.1 base score and qualitative band from a base vector string, so a finding's score cannot drift from its vector by hand. Pure arithmetic from the FIRST specification, offline. Returns { vector, baseScore, band } where band is none|low|medium|high|critical - the value the pipeline maps to its reviewer severity (critical/high -> blocking, medium -> important, low/none -> suggestion).",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      required: ["vector"],
+      properties: {
+        vector: {
+          type: "string",
+          description:
+            "A full CVSS 3.1 base vector, e.g. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. All eight base metrics required; temporal and environmental metrics are ignored.",
+        },
+      },
+    },
+  },
+  {
+    name: "security_dep_inventory",
+    description:
+      "Parse a dependency lockfile off disk into a normalized inventory of { ecosystem, name, version }. Local parse only - contacts nothing. Supported lockfiles: " +
+      Object.keys(SUPPORTED).join(", ") +
+      ". Hand the inventory to a CVE lookup (ai-analyst-toolkit:evidence-registry) as a separate step; this tool never reaches the network.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      required: ["path"],
+      properties: {
+        path: {
+          type: "string",
+          description:
+            "Absolute path to a supported lockfile (its basename decides the parser, e.g. package-lock.json, Podfile.lock, requirements.txt, go.sum).",
+        },
+      },
+    },
+  },
+];
+
+export const SECURITY_OUTPUT_SCHEMAS = {
+  security_cvss_score: {
+    type: "object",
+    required: ["vector", "baseScore", "band"],
+    properties: {
+      vector: { type: "string" },
+      baseScore: { type: "number" },
+      band: { type: "string", enum: ["none", "low", "medium", "high", "critical"] },
+    },
+  },
+  security_dep_inventory: {
+    type: "object",
+    required: ["ecosystem", "file", "count", "dependencies"],
+    properties: {
+      ecosystem: { type: "string" },
+      file: { type: "string" },
+      count: { type: "integer" },
+      dependencies: {
+        type: "array",
+        items: {
+          type: "object",
+          required: ["ecosystem", "name", "version"],
+          properties: {
+            ecosystem: { type: "string" },
+            name: { type: "string" },
+            version: { type: "string" },
+          },
+        },
+      },
+    },
+  },
+};
+
+/**
+ * @param {string} name
+ * @param {Record<string, unknown>} args
+ * @returns {Promise<string|null>} JSON string result, or an ERROR: string, or null for an unknown name.
+ */
+export async function handleSecurity(name, args = {}) {
+  try {
+    switch (name) {
+      case "security_cvss_score": {
+        const r = scoreVector(args.vector);
+        return "error" in r ? `${ERROR_PREFIX}${r.error}` : JSON.stringify(r);
+      }
+      case "security_dep_inventory": {
+        const r = inventory(args.path);
+        return "error" in r ? `${ERROR_PREFIX}${r.error}` : JSON.stringify(r);
+      }
+      default:
+        return null;
+    }
+  } catch (e) {
+    return `${ERROR_PREFIX}${name}: ${e?.message || String(e)}`;
+  }
+}