@quint-security/cli 0.1.2

package/dist/commands/logs.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logsCommand = void 0;
+const commander_1 = require("commander");
+const core_1 = require("@quint-security/core");
+exports.logsCommand = new commander_1.Command("logs")
+    .description("Search and display the audit log")
+    .option("--server <name>", "Filter by server name")
+    .option("--tool <name>", "Filter by tool name")
+    .option("--denied", "Show only denied entries")
+    .option("--since <iso-date>", "Show entries since ISO-8601 date")
+    .option("-n, --limit <count>", "Max entries to show", "50")
+    .option("--json", "Output as JSON")
+    .action((opts) => {
+    const policy = (0, core_1.loadPolicy)();
+    const dataDir = (0, core_1.resolveDataDir)(policy.data_dir);
+    const db = (0, core_1.openAuditDb)(dataDir);
+    try {
+        const entries = db.query({
+            server: opts.server,
+            tool: opts.tool,
+            verdict: opts.denied ? "deny" : undefined,
+            since: opts.since,
+            limit: parseInt(opts.limit, 10),
+        });
+        if (opts.json) {
+            console.log(JSON.stringify(entries, null, 2));
+            return;
+        }
+        if (entries.length === 0) {
+            console.log("No audit log entries found.");
+            return;
+        }
+        console.log(`Showing ${entries.length} entries (newest first):\n`);
+        for (const entry of entries) {
+            printEntry(entry);
+        }
+    }
+    finally {
+        db.close();
+    }
+});
+function printEntry(e) {
+    const icon = e.verdict === "deny" ? "✗" : e.verdict === "allow" ? "✓" : "→";
+    const ts = e.timestamp.replace("T", " ").replace(/\.\d+Z$/, "Z");
+    const tool = e.tool_name ? ` tool=${e.tool_name}` : "";
+    const risk = e.risk_score != null ? ` risk=${e.risk_score}(${e.risk_level})` : "";
+    console.log(`  ${icon} [${ts}] ${e.direction} ${e.method}${tool} server=${e.server_name} verdict=${e.verdict}${risk} id=${e.id}`);
+}
+//# sourceMappingURL=logs.js.map

package/dist/commands/logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.js","sourceRoot":"","sources":["../../src/commands/logs.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,+CAAgG;AAEnF,QAAA,WAAW,GAAG,IAAI,mBAAO,CAAC,MAAM,CAAC;KAC3C,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;KAClD,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC;KAC9C,MAAM,CAAC,UAAU,EAAE,0BAA0B,CAAC;KAC9C,MAAM,CAAC,oBAAoB,EAAE,kCAAkC,CAAC;KAChE,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,IAAI,CAAC;KAC1D,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,CAAC,IAOR,EAAE,EAAE;IACH,MAAM,MAAM,GAAG,IAAA,iBAAU,GAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAA,qBAAc,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACzC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;SAChC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,4BAA4B,CAAC,CAAC;QAEnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,SAAS,UAAU,CAAC,CAAa;IAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,EAAE,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC,CAAC,WAAW,YAAY,CAAC,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACpI,CAAC"}

package/dist/commands/policy.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const policyCommand: Command;
+//# sourceMappingURL=policy.d.ts.map

package/dist/commands/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/commands/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,eAAO,MAAM,aAAa,SACoB,CAAC"}

package/dist/commands/policy.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.policyCommand = void 0;
+const commander_1 = require("commander");
+const core_1 = require("@quint-security/core");
+exports.policyCommand = new commander_1.Command("policy")
+    .description("Manage access control policy");
+exports.policyCommand
+    .command("init")
+    .description("Create a default policy.json if none exists")
+    .action(() => {
+    const path = (0, core_1.initPolicy)();
+    console.log(`Policy file: ${path}`);
+});
+exports.policyCommand
+    .command("validate")
+    .description("Validate the current policy.json")
+    .action(() => {
+    const policy = (0, core_1.loadPolicy)();
+    const errors = (0, core_1.validatePolicy)(policy);
+    if (errors.length === 0) {
+        console.log("Policy is valid.");
+    }
+    else {
+        console.log("Policy validation errors:");
+        for (const err of errors) {
+            console.log(`  - ${err}`);
+        }
+        process.exit(1);
+    }
+});
+exports.policyCommand
+    .command("show")
+    .description("Display the current policy")
+    .action(() => {
+    const policy = (0, core_1.loadPolicy)();
+    console.log(JSON.stringify(policy, null, 2));
+});
+//# sourceMappingURL=policy.js.map

package/dist/commands/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/commands/policy.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,+CAA8F;AAEjF,QAAA,aAAa,GAAG,IAAI,mBAAO,CAAC,QAAQ,CAAC;KAC/C,WAAW,CAAC,8BAA8B,CAAC,CAAC;AAE/C,qBAAa;KACV,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,6CAA6C,CAAC;KAC1D,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,IAAI,GAAG,IAAA,iBAAU,GAAE,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEL,qBAAa;KACV,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,MAAM,GAAG,IAAA,iBAAU,GAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAA,qBAAc,EAAC,MAAM,CAAC,CAAC;IAEtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,qBAAa;KACV,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4BAA4B,CAAC;KACzC,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,MAAM,GAAG,IAAA,iBAAU,GAAE,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC"}

package/dist/commands/proxy.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const proxyCommand: Command;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/commands/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/commands/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,eAAO,MAAM,YAAY,SAiBrB,CAAC"}

package/dist/commands/proxy.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.proxyCommand = void 0;
+const commander_1 = require("commander");
+const core_1 = require("@quint-security/core");
+const proxy_1 = require("@quint-security/proxy");
+exports.proxyCommand = new commander_1.Command("proxy")
+    .description("Run as MCP stdio proxy wrapping another MCP server")
+    .requiredOption("--name <name>", "Name identifier for the proxied server")
+    .option("--policy <path>", "Path to policy.json (default: ~/.quint/policy.json)")
+    .argument("<command>", "Command to spawn the real MCP server")
+    .argument("[args...]", "Arguments for the real MCP server")
+    .allowExcessArguments(true)
+    .action((command, args, opts) => {
+    const policy = (0, core_1.loadPolicy)(opts.policy ? opts.policy : undefined);
+    const dataDir = (0, core_1.resolveDataDir)(policy.data_dir);
+    (0, proxy_1.startProxy)({
+        serverName: opts.name,
+        command,
+        args,
+        policy,
+    });
+});
+//# sourceMappingURL=proxy.js.map

package/dist/commands/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/commands/proxy.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,+CAAkE;AAClE,iDAAmD;AAEtC,QAAA,YAAY,GAAG,IAAI,mBAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,oDAAoD,CAAC;KACjE,cAAc,CAAC,eAAe,EAAE,wCAAwC,CAAC;KACzE,MAAM,CAAC,iBAAiB,EAAE,qDAAqD,CAAC;KAChF,QAAQ,CAAC,WAAW,EAAE,sCAAsC,CAAC;KAC7D,QAAQ,CAAC,WAAW,EAAE,mCAAmC,CAAC;KAC1D,oBAAoB,CAAC,IAAI,CAAC;KAC1B,MAAM,CAAC,CAAC,OAAe,EAAE,IAAc,EAAE,IAAuC,EAAE,EAAE;IACnF,MAAM,MAAM,GAAG,IAAA,iBAAU,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAA,qBAAc,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEhD,IAAA,kBAAU,EAAC;QACT,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,OAAO;QACP,IAAI;QACJ,MAAM;KACP,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/status.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const statusCommand: Command;
+//# sourceMappingURL=status.d.ts.map

package/dist/commands/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,eAAO,MAAM,aAAa,SAuCtB,CAAC"}

package/dist/commands/status.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.statusCommand = void 0;
+const commander_1 = require("commander");
+const core_1 = require("@quint-security/core");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+exports.statusCommand = new commander_1.Command("status")
+    .description("Show Quint configuration summary")
+    .action(() => {
+    const policy = (0, core_1.loadPolicy)();
+    const dataDir = (0, core_1.resolveDataDir)(policy.data_dir);
+    console.log("Quint Status");
+    console.log("============");
+    console.log(`  Data dir:    ${dataDir}`);
+    console.log(`  Policy:      ${(0, node_path_1.join)(dataDir, "policy.json")} ${(0, node_fs_1.existsSync)((0, node_path_1.join)(dataDir, "policy.json")) ? "(found)" : "(not found)"}`);
+    console.log(`  Log level:   ${policy.log_level}`);
+    // Keys
+    const kp = (0, core_1.loadKeyPair)(dataDir);
+    if (kp) {
+        console.log(`  Keys:        ${(0, core_1.publicKeyFingerprint)(kp.publicKey)} (loaded)`);
+    }
+    else {
+        console.log(`  Keys:        not generated (run \`quint keys generate\`)`);
+    }
+    // Database
+    const dbPath = (0, node_path_1.join)(dataDir, "quint.db");
+    if ((0, node_fs_1.existsSync)(dbPath)) {
+        const db = (0, core_1.openAuditDb)(dataDir);
+        const count = db.count();
+        db.close();
+        console.log(`  Database:    ${dbPath} (${count} entries)`);
+    }
+    else {
+        console.log(`  Database:    not created yet`);
+    }
+    // Servers
+    console.log(`\n  Servers (${policy.servers.length}):`);
+    for (const srv of policy.servers) {
+        const toolRules = srv.tools.length > 0
+            ? srv.tools.map(t => `${t.tool}:${t.action}`).join(", ")
+            : "no tool-specific rules";
+        console.log(`    ${srv.server} → default:${srv.default_action} [${toolRules}]`);
+    }
+});
+//# sourceMappingURL=status.js.map

package/dist/commands/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,+CAM8B;AAC9B,qCAAqC;AACrC,yCAAiC;AAEpB,QAAA,aAAa,GAAG,IAAI,mBAAO,CAAC,QAAQ,CAAC;KAC/C,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,MAAM,GAAG,IAAA,iBAAU,GAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAA,qBAAc,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEhD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAA,gBAAI,EAAC,OAAO,EAAE,aAAa,CAAC,IAAI,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IACtI,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAElD,OAAO;IACP,MAAM,EAAE,GAAG,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC;IAChC,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAA,2BAAoB,EAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;IAED,WAAW;IACX,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,IAAA,oBAAU,EAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QACzB,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,KAAK,KAAK,WAAW,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAED,UAAU;IACV,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACxD,CAAC,CAAC,wBAAwB,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,cAAc,KAAK,SAAS,GAAG,CAAC,CAAC;IAClF,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/verify.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const verifyCommand: Command;
+//# sourceMappingURL=verify.d.ts.map

package/dist/commands/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,eAAO,MAAM,aAAa,SAkFtB,CAAC"}

package/dist/commands/verify.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyCommand = void 0;
+const commander_1 = require("commander");
+const core_1 = require("@quint-security/core");
+exports.verifyCommand = new commander_1.Command("verify")
+    .description("Verify Ed25519 signatures and hash chain on audit log entries")
+    .option("--id <n>", "Verify a specific entry by ID")
+    .option("--last <n>", "Verify the last N entries", "20")
+    .option("--all", "Verify all entries")
+    .option("--chain", "Also verify hash chain integrity (requires --all or --last)")
+    .action((opts) => {
+    const policy = (0, core_1.loadPolicy)();
+    const dataDir = (0, core_1.resolveDataDir)(policy.data_dir);
+    const db = (0, core_1.openAuditDb)(dataDir);
+    try {
+        let entries;
+        if (opts.id) {
+            const entry = db.getById(parseInt(opts.id, 10));
+            entries = entry ? [entry] : [];
+        }
+        else if (opts.all) {
+            entries = db.getAll(); // ascending order for chain verification
+        }
+        else {
+            entries = db.getLast(parseInt(opts.last, 10));
+            // Reverse to ascending for chain verification
+            entries.reverse();
+        }
+        if (entries.length === 0) {
+            console.log("No entries to verify.");
+            return;
+        }
+        // Signature verification
+        let sigValid = 0;
+        let sigInvalid = 0;
+        for (const entry of entries) {
+            const ok = verifyEntry(entry);
+            if (ok) {
+                sigValid++;
+            }
+            else {
+                sigInvalid++;
+                console.log(`  ✗ INVALID signature on entry #${entry.id} (${entry.timestamp})`);
+            }
+        }
+        console.log(`\nSignatures: ${entries.length} checked, ${sigValid} valid, ${sigInvalid} invalid`);
+        // Hash chain verification
+        if (opts.chain || opts.all) {
+            let chainValid = 0;
+            let chainBroken = 0;
+            for (let i = 1; i < entries.length; i++) {
+                const prev = entries[i - 1];
+                const curr = entries[i];
+                if (curr.prev_hash === "" && prev.prev_hash === "") {
+                    // Legacy entries without hash chain — skip
+                    continue;
+                }
+                const expectedHash = (0, core_1.sha256)(prev.signature);
+                if (curr.prev_hash === expectedHash) {
+                    chainValid++;
+                }
+                else {
+                    chainBroken++;
+                    console.log(`  ⛓ BROKEN chain at entry #${curr.id} — prev_hash doesn't match entry #${prev.id}`);
+                }
+            }
+            if (chainValid + chainBroken > 0) {
+                console.log(`Chain:      ${chainValid + chainBroken} links checked, ${chainValid} valid, ${chainBroken} broken`);
+            }
+            else {
+                console.log(`Chain:      no chain data (legacy entries)`);
+            }
+        }
+        if (sigInvalid > 0) {
+            process.exit(1);
+        }
+    }
+    finally {
+        db.close();
+    }
+});
+function verifyEntry(entry) {
+    const signable = {
+        timestamp: entry.timestamp,
+        server_name: entry.server_name,
+        direction: entry.direction,
+        method: entry.method,
+        message_id: entry.message_id,
+        tool_name: entry.tool_name,
+        arguments_json: entry.arguments_json,
+        response_json: entry.response_json,
+        verdict: entry.verdict,
+        risk_score: entry.risk_score ?? null,
+        risk_level: entry.risk_level ?? null,
+        policy_hash: entry.policy_hash ?? "",
+        prev_hash: entry.prev_hash ?? "",
+        nonce: entry.nonce ?? "",
+        public_key: entry.public_key,
+    };
+    const canonical = (0, core_1.canonicalize)(signable);
+    return (0, core_1.verifySignature)(canonical, entry.signature, entry.public_key);
+}
+//# sourceMappingURL=verify.js.map

package/dist/commands/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,+CAQ8B;AAEjB,QAAA,aAAa,GAAG,IAAI,mBAAO,CAAC,QAAQ,CAAC;KAC/C,WAAW,CAAC,+DAA+D,CAAC;KAC5E,MAAM,CAAC,UAAU,EAAE,+BAA+B,CAAC;KACnD,MAAM,CAAC,YAAY,EAAE,2BAA2B,EAAE,IAAI,CAAC;KACvD,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC;KACrC,MAAM,CAAC,SAAS,EAAE,6DAA6D,CAAC;KAChF,MAAM,CAAC,CAAC,IAAoE,EAAE,EAAE;IAC/E,MAAM,MAAM,GAAG,IAAA,iBAAU,GAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAA,qBAAc,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC;IAEhC,IAAI,CAAC;QACH,IAAI,OAAqB,CAAC;QAE1B,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,CAAC;aAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACpB,OAAO,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,yCAAyC;QAClE,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC/C,8CAA8C;YAC9C,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,EAAE,EAAE,CAAC;gBACP,QAAQ,EAAE,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,mCAAmC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,CAAC,MAAM,aAAa,QAAQ,WAAW,UAAU,UAAU,CAAC,CAAC;QAEjG,0BAA0B;QAC1B,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,WAAW,GAAG,CAAC,CAAC;YAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAExB,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;oBACnD,2CAA2C;oBAC3C,SAAS;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,IAAA,aAAM,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC5C,IAAI,IAAI,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;oBACpC,UAAU,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,WAAW,EAAE,CAAC;oBACd,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,CAAC,EAAE,qCAAqC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnG,CAAC;YACH,CAAC;YAED,IAAI,UAAU,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,eAAe,UAAU,GAAG,WAAW,mBAAmB,UAAU,WAAW,WAAW,SAAS,CAAC,CAAC;YACnH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,SAAS,WAAW,CAAC,KAAiB;IACpC,MAAM,QAAQ,GAA4B;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;IAEF,MAAM,SAAS,GAAG,IAAA,mBAAY,EAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,IAAA,sBAAe,EAAC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;AACvE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const proxy_js_1 = require("./commands/proxy.js");
+const http_proxy_js_1 = require("./commands/http-proxy.js");
+const logs_js_1 = require("./commands/logs.js");
+const keys_js_1 = require("./commands/keys.js");
+const verify_js_1 = require("./commands/verify.js");
+const policy_js_1 = require("./commands/policy.js");
+const status_js_1 = require("./commands/status.js");
+const auth_js_1 = require("./commands/auth.js");
+const init_js_1 = require("./commands/init.js");
+const program = new commander_1.Command()
+    .name("quint")
+    .version("0.1.0")
+    .description("Local security proxy for MCP tool calls");
+program.addCommand(init_js_1.initCommand);
+program.addCommand(proxy_js_1.proxyCommand);
+program.addCommand(http_proxy_js_1.httpProxyCommand);
+program.addCommand(logs_js_1.logsCommand);
+program.addCommand(keys_js_1.keysCommand);
+program.addCommand(verify_js_1.verifyCommand);
+program.addCommand(policy_js_1.policyCommand);
+program.addCommand(status_js_1.statusCommand);
+program.addCommand(auth_js_1.authCommand);
+program.parse();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAEA,yCAAoC;AACpC,kDAAmD;AACnD,4DAA4D;AAC5D,gDAAiD;AACjD,gDAAiD;AACjD,oDAAqD;AACrD,oDAAqD;AACrD,oDAAqD;AACrD,gDAAiD;AACjD,gDAAiD;AAEjD,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE;KAC1B,IAAI,CAAC,OAAO,CAAC;KACb,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,yCAAyC,CAAC,CAAC;AAE1D,OAAO,CAAC,UAAU,CAAC,qBAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,uBAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,gCAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,qBAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,qBAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,yBAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,yBAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,yBAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,qBAAW,CAAC,CAAC;AAEhC,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "@quint-security/cli",
+  "version": "0.1.2",
+  "bin": {
+    "quint": "dist/index.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Quint-Security/cli.git",
+    "directory": "packages/cli"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc"
+  },
+  "dependencies": {
+    "@quint-security/core": "*",
+    "@quint-security/proxy": "*",
+    "commander": "^12.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.4.0"
+  }
+}

package/src/commands/auth.ts

@@ -0,0 +1,103 @@
+import { Command } from "commander";
+import {
+  loadPolicy,
+  resolveDataDir,
+  openAuthDb,
+  generateApiKey,
+} from "@quint-security/core";
+
+export const authCommand = new Command("auth")
+  .description("Manage authentication (API keys and sessions)");
+
+authCommand
+  .command("create-key")
+  .description("Create a new API key")
+  .requiredOption("--label <name>", "Human-readable label for the key")
+  .option("--scopes <scopes>", "Comma-separated scopes (e.g. proxy:read,audit:write)")
+  .option("--ttl <seconds>", "Time-to-live in seconds (0 = no expiry)", "0")
+  .action((opts: { label: string; scopes?: string; ttl: string }) => {
+    const policy = loadPolicy();
+    const dataDir = resolveDataDir(policy.data_dir);
+    const db = openAuthDb(dataDir);
+
+    const scopes = opts.scopes ? opts.scopes.split(",").map((s) => s.trim()) : [];
+    const ttl = parseInt(opts.ttl, 10);
+
+    const { rawKey, apiKey } = generateApiKey(db, {
+      label: opts.label,
+      scopes,
+      ttlSeconds: ttl > 0 ? ttl : undefined,
+    });
+
+    console.log(`API key created.\n`);
+    console.log(`  ID:      ${apiKey.id}`);
+    console.log(`  Label:   ${apiKey.label}`);
+    console.log(`  Scopes:  ${apiKey.scopes || "(all)"}`);
+    console.log(`  Expires: ${apiKey.expires_at ?? "never"}`);
+    console.log(`\n  Raw key (SAVE THIS — shown only once):\n`);
+    console.log(`  ${rawKey}\n`);
+
+    db.close();
+  });
+
+authCommand
+  .command("list-keys")
+  .description("List all API keys")
+  .action(() => {
+    const policy = loadPolicy();
+    const dataDir = resolveDataDir(policy.data_dir);
+    const db = openAuthDb(dataDir);
+
+    const keys = db.listApiKeys();
+    if (keys.length === 0) {
+      console.log("No API keys found. Create one with `quint auth create-key`.");
+      db.close();
+      return;
+    }
+
+    console.log(`${keys.length} API key(s):\n`);
+    for (const key of keys) {
+      const status = key.revoked
+        ? "REVOKED"
+        : key.expires_at && new Date(key.expires_at) < new Date()
+          ? "EXPIRED"
+          : "active";
+      const icon = status === "active" ? "●" : "○";
+      console.log(`  ${icon} ${key.id}  ${key.label}  [${status}]  scopes=${key.scopes || "*"}  created=${key.created_at}`);
+    }
+
+    db.close();
+  });
+
+authCommand
+  .command("revoke-key")
+  .description("Revoke an API key")
+  .requiredOption("--id <id>", "API key ID to revoke")
+  .action((opts: { id: string }) => {
+    const policy = loadPolicy();
+    const dataDir = resolveDataDir(policy.data_dir);
+    const db = openAuthDb(dataDir);
+
+    const key = db.getApiKeyById(opts.id);
+    if (!key) {
+      console.error(`API key not found: ${opts.id}`);
+      db.close();
+      process.exit(1);
+    }
+
+    if (key.revoked) {
+      console.log(`Key ${opts.id} is already revoked.`);
+      db.close();
+      return;
+    }
+
+    db.revokeApiKey(opts.id);
+    // Also revoke any sessions issued to this key
+    const revoked = db.revokeSessionsBySubject(opts.id);
+    console.log(`Revoked key ${opts.id} (${key.label}).`);
+    if (revoked > 0) {
+      console.log(`  Also revoked ${revoked} active session(s).`);
+    }
+
+    db.close();
+  });

package/src/commands/http-proxy.ts

@@ -0,0 +1,34 @@
+import { Command } from "commander";
+import { loadPolicy } from "@quint-security/core";
+import { startHttpProxy } from "@quint-security/proxy";
+
+export const httpProxyCommand = new Command("http-proxy")
+  .description("Run as HTTP proxy in front of a remote MCP server")
+  .requiredOption("--name <name>", "Name identifier for the proxied server")
+  .requiredOption("--port <port>", "Local port to listen on", parseInt)
+  .requiredOption("--target <url>", "Remote MCP server URL to proxy to")
+  .option("--policy <path>", "Path to policy.json (default: ~/.quint/policy.json)")
+  .option("--require-auth", "Require API key authentication on all requests")
+  .action(async (opts: { name: string; port: number; target: string; policy?: string; requireAuth?: boolean }) => {
+    if (isNaN(opts.port) || opts.port < 1 || opts.port > 65535) {
+      process.stderr.write("quint: --port must be a valid port number (1-65535)\n");
+      process.exit(1);
+    }
+
+    try {
+      new URL(opts.target);
+    } catch {
+      process.stderr.write(`quint: --target must be a valid URL\n`);
+      process.exit(1);
+    }
+
+    const policy = loadPolicy(opts.policy ? opts.policy : undefined);
+
+    await startHttpProxy({
+      serverName: opts.name,
+      port: opts.port,
+      targetUrl: opts.target,
+      policy,
+      requireAuth: opts.requireAuth,
+    });
+  });