@nerdsystem/mcp 0.0.0-stage → 0.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 nerdsystem
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,12 @@
-# Temporary Holding Version
+# @nerdsystem/mcp
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+An MCP server for coding agents working on a nerdsystem project. Two tools:
+
+- `run_gates`: runs the security gates (secrets, dependencies, platform rules, policy, personal data, typecheck, suppressions, and the built bundle when present) against the working tree and returns failures the agent can act on: rule id, file, line, risk, fix, verify command, attempt count, and whether a person must act instead.
+- `explain_failure`: takes a rule id and returns the risk, the fix, and an example of the wrong and the right pattern.
+
+Projects created with `npx nerdsystem init` include the configuration for Claude Code in `.mcp.json`. To add it by hand:
+
+```json
+{ "mcpServers": { "nerdsystem": { "command": "npx", "args": ["-y", "@nerdsystem/mcp"] } } }
+```

package/dist/index.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createServer } from "./server.js";
+const server = createServer();
+await server.connect(new StdioServerTransport());

package/dist/server.js

@@ -0,0 +1,46 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+import { RULES, ruleFor } from "nerdsystem/gates";
+import { runVerify } from "nerdsystem/commands/verify";
+import { findProjectRoot } from "nerdsystem/project";
+/**
+ * Thin: the gates run from the same library the CLI and the builder use, approved suppressions
+ * come from the control plane with the CLI's saved login, and every failure uses the shape the
+ * dashboard and GitHub check runs show.
+ */
+export function createServer(cwd = process.cwd()) {
+    const server = new McpServer({ name: "nerdsystem", version: "0.0.1" });
+    server.registerTool("run_gates", {
+        title: "Run nerdsystem security gates",
+        description: "Runs the gates a deploy runs (secrets, dependencies, platform rules, acceptable use, personal data, typecheck, suppressions; and the built bundle if dist/ exists) against the working tree. Returns failures with rule_id, file, line, risk, fix, verify, attempt, and audience. Fix every failure with audience \"agent\", then run again; stop and tell the person about anything with audience \"human\" or when `stop` is non-empty.",
+        inputSchema: { rule: z.string().optional().describe("Run only this rule id or prefix, e.g. secrets/ or secrets/aws-access-key"), include_build: z.boolean().optional().describe("Also scan dist/ if present (default true)") },
+    }, async ({ rule, include_build }) => {
+        let root;
+        try {
+            root = findProjectRoot(cwd);
+        }
+        catch (err) {
+            return { content: [{ type: "text", text: JSON.stringify({ error: err instanceof Error ? err.message : String(err) }) }], isError: true };
+        }
+        const out = await runVerify(root, { withBuild: include_build ?? true, stopOnFail: false, quiet: true, onlyRules: rule ? [rule] : undefined });
+        const payload = {
+            ok: out.ok,
+            stop: out.stop,
+            failures: out.failures,
+            summary: out.results.map((r) => ({ gate: r.name, status: r.status, summary: r.summary })),
+            next: out.ok ? "All gates pass. Deploy with `nerd deploy` or push." : out.stop.length ? "Stop: these rules have failed too many times in a row. Tell the person and wait." : out.failures.some((f) => f.audience === "human" && f.severity === "block") ? "Some findings need a person (audience \"human\"). Fix the agent ones, then tell the person about the rest." : "Fix each failure, then call run_gates again (it re-runs every gate).",
+        };
+        return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }], isError: !out.ok };
+    });
+    server.registerTool("explain_failure", {
+        title: "Explain a gate rule",
+        description: "Given a rule_id from run_gates, returns what could happen, what to change, and a short wrong/right example.",
+        inputSchema: { rule_id: z.string().describe("e.g. secrets/stripe-secret or bundle/vite-secret-exposed") },
+    }, async ({ rule_id }) => {
+        const def = RULES[rule_id] ?? ruleFor(rule_id);
+        const known = Boolean(RULES[rule_id]);
+        const payload = { rule_id, known, title: def.title, severity: def.severity, audience: def.audience, risk: def.risk, fix: def.fix, example: def.example ?? null, verify: `nerd verify --rule ${rule_id}` };
+        return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
+    });
+    return server;
+}

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "@nerdsystem/mcp",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.2",
+  "description": "MCP server that lets coding agents run nerdsystem's security gates and read fix instructions.",
+  "type": "module",
+  "bin": {
+    "nerdsystem-mcp": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/doobe01/nerdsystem-cloudflare",
+    "directory": "packages/mcp"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.32.2",
+    "zod": "^4.6.7",
+    "nerdsystem": "0.0.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && chmod +x dist/index.js",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
 }