@offgridsec/kira-lite-mcp 0.2.1 → 0.2.2

package/hook.mjs

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 
-// Kira-Lite pre-write hook for Claude Code
-// Fires via PreToolUse BEFORE Write/Edit hits disk — exits 2 to block vulnerable code.
-// Falls back to report-only mode when running under PostToolUse (legacy installs).
+// Kira-Lite post-write hook for Claude Code
+// Scans files after Edit/Write to catch anything the MCP pre-scan missed.
 
 import { KiraScanner } from "./dist/core/scanner.js";
 import { readFileSync } from "node:fs";
@@ -29,26 +28,21 @@ process.stdin.on("data", (chunk) => (input += chunk));
 process.stdin.on("end", async () => {
   try {
     const hookData = JSON.parse(input);
-    const toolName = hookData?.tool_name;
-    const toolInput = hookData?.tool_input;
-    const filePath = toolInput?.file_path;
-    const isPreHook = hookData?.hook_event_name === "PreToolUse";
+    const filePath = hookData?.tool_input?.file_path;
 
-    if (!toolInput) process.exit(0);
+    if (!filePath) process.exit(0);
 
-    // Extract the code being written from tool_input (available in both Pre and PostToolUse)
-    let code = null;
-    if (toolName === "Write") {
-      code = toolInput?.content;
-    } else if (toolName === "Edit") {
-      code = toolInput?.new_string;
-    } else if (toolName === "MultiEdit") {
-      code = (toolInput?.edits || []).map((e) => e.new_string).join("\n");
+    // Read the file that was just written
+    let code;
+    try {
+      code = readFileSync(filePath, "utf-8");
+    } catch {
+      process.exit(0); // file doesn't exist or can't read — skip
     }
 
-    if (!code || !filePath) process.exit(0);
-
     const language = detectLanguage(filePath);
+
+    // Use regex-only scan for speed (hooks should be fast)
     const result = scanner.scanRegex({ code, language, filename: filePath });
 
     const critical = result.findings.filter(
@@ -56,16 +50,14 @@ process.stdin.on("end", async () => {
     );
 
     if (critical.length > 0) {
-      const action = isPreHook ? "BLOCKED" : "WARNING (fix manually)";
-      process.stdout.write(
-        `\n⚠ Kira-Lite ${action}: ${critical.length} critical/high vulnerabilities in ${filePath}:\n`
+      console.error(
+        `\n⚠ Kira-Lite: ${critical.length} critical/high vulnerabilities in ${filePath}:`
       );
       for (const f of critical) {
-        process.stdout.write(`  [${f.severity.toUpperCase()}] ${f.title} (line ${f.line})\n`);
+        console.error(`  [${f.severity.toUpperCase()}] ${f.title} (line ${f.line})`);
       }
-      process.stdout.write("\nFix these vulnerabilities before writing the code.\n\n");
-      // PreToolUse: exit 2 blocks the write. PostToolUse: exit 0 (write already happened).
-      process.exit(isPreHook ? 2 : 0);
+      console.error("");
+      process.exit(1);
     }
 
     process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@offgridsec/kira-lite-mcp",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Kira-Lite MCP Server — Real-time security scanning for AI coding assistants",
   "author": "Offgrid Security <contact@offgridsec.com>",
   "homepage": "https://offgridsec.com",