@securecode-ai/mcp 0.1.0 → 0.2.1

package/README.md

@@ -14,7 +14,9 @@ npm install -g @securecode-ai/mcp
 securecode-mcp login
 ```
 
-Or set the `SECURECODE_API_TOKEN` environment variable.
+Enter your email, receive a 6-digit verification code, and paste it back. Your JWT is stored in the OS keychain (Windows Credential Manager, macOS Keychain, or Linux Secret Service). If the keychain is unavailable, it falls back to `~/.securecode/credentials.json` (mode 0600).
+
+Alternatively, set the `SECURECODE_API_TOKEN` environment variable.
 
 ## MCP client configuration
 
@@ -50,14 +52,14 @@ claude mcp add securecode -s user -- securecode-mcp serve --workspace /path/to/y
 
 ```bash
 securecode-mcp serve [--workspace <path>]    Start the MCP stdio server
-securecode-mcp login [--api-url <url>]      Store your API token
+securecode-mcp login [--api-url <url>]      Authenticate via email + OTP
 securecode-mcp status                       Show auth status
 securecode-mcp logout                       Remove credentials
 ```
 
 ## Security
 
-- No API token in MCP client configuration — credentials are stored in `~/.securecode/credentials.json` (mode 0600) or the `SECURECODE_API_TOKEN` env var.
+- Credentials stored in OS keychain (Windows Credential Manager, macOS Keychain, Linux Secret Service) with file fallback.
 - File reads are confined to the `--workspace` root.
 - Fixes are returned for review and never auto-applied.
 - No telemetry.

package/dist/api/client.d.ts

@@ -19,4 +19,8 @@ export declare class ApiClient {
     private readonly timeoutMs;
     constructor(opts: ApiClientOptions);
     postJson<T>(path: string, body: unknown): Promise<T>;
+    /**
+     * POST without an Authorization header — for login/OTP before a token exists.
+     */
+    static postJsonNoAuth(baseUrl: string, path: string, body: unknown, timeoutMs?: number): Promise<any>;
 }

package/dist/api/client.js

@@ -136,6 +136,55 @@ class ApiClient {
             req.end();
         });
     }
+    /**
+     * POST without an Authorization header — for login/OTP before a token exists.
+     */
+    static async postJsonNoAuth(baseUrl, path, body, timeoutMs = 30_000) {
+        const url = `${baseUrl.replace(/\/$/, '')}${path}`;
+        const payload = JSON.stringify(body);
+        const parsed = new URL(url);
+        const lib = parsed.protocol === 'https:' ? https : http;
+        return new Promise((resolve, reject) => {
+            const req = lib.request({
+                hostname: parsed.hostname,
+                port: parsed.port || (parsed.protocol === 'https:' ? 443 : 80),
+                path: parsed.pathname + parsed.search,
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Content-Length': Buffer.byteLength(payload),
+                },
+            }, (res) => {
+                let raw = '';
+                res.on('data', (chunk) => { raw += chunk.toString('utf8'); });
+                res.on('end', () => {
+                    let data;
+                    try {
+                        data = raw ? JSON.parse(raw) : {};
+                    }
+                    catch {
+                        data = { raw };
+                    }
+                    const status = res.statusCode ?? 0;
+                    if (status >= 200 && status < 300) {
+                        resolve(data);
+                    }
+                    else {
+                        reject(new ApiClientError(status, data.code, data.error || data.message || `HTTP ${status}`, data.remaining));
+                    }
+                });
+            });
+            req.on('error', (err) => {
+                reject(new ApiClientError(0, undefined, `Network error: ${err.message}`, undefined));
+            });
+            req.setTimeout(timeoutMs, () => {
+                req.destroy();
+                reject(new ApiClientError(0, undefined, `Request timed out after ${timeoutMs}ms`, undefined));
+            });
+            req.write(payload);
+            req.end();
+        });
+    }
 }
 exports.ApiClient = ApiClient;
 //# sourceMappingURL=client.js.map

package/dist/api/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,6CAA+B;AAG/B,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5C,MAAa,cAAe,SAAQ,KAAK;IAEjB;IACA;IAEA;IAJpB,YACoB,MAAc,EACd,OAA2B,EAC3C,OAAe,EACC,SAA6B;QAE7C,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAoB;QAE3B,cAAS,GAAT,SAAS,CAAoB;QAG7C,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,qBAAqB,CAAC,GAAY;QACrC,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,GAAY;QAC7B,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,GAAY;QAC3B,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,GAAY;QACnC,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;CACJ;AA1BD,wCA0BC;AAQD,MAAa,SAAS;IACD,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,SAAS,CAAS;IAEnC,YAAY,IAAsB;QAC9B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,IAAY,EAAE,IAAa;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAExD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACnB;gBACI,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACL,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC5C,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;iBACxC;aACJ,EACD,CAAC,GAAG,EAAE,EAAE;gBACJ,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC7B,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;wBACjD,OAAO,GAAG,IAAI,CAAC;wBACf,GAAG,CAAC,OAAO,EAAE,CAAC;wBACd,MAAM,CAAC,IAAI,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;wBAC5E,OAAO;oBACX,CAAC;oBACD,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACf,IAAI,OAAO;wBAAE,OAAO;oBACpB,IAAI,IAAS,CAAC;oBACd,IAAI,CAAC;wBACD,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,CAAC;oBAAC,MAAM,CAAC;wBACL,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;oBACnB,CAAC;oBACD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;oBACnC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAS,CAAC,CAAC;oBACvB,CAAC;yBAAM,CAAC;wBACJ,MAAM,MAAM,GAAa;4BACrB,MAAM;4BACN,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;4BAClC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,MAAM,EAAE;4BACvD,SAAS,EAAE,IAAI,CAAC,SAAS;yBAC5B,CAAC;wBACF,MAAM,CAAC,IAAI,cAAc,CACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,SAAS,CACnB,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC,CACJ,CAAC;YAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;gBAChC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,2BAA2B,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YACvG,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AApFD,8BAoFC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,6CAA+B;AAG/B,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5C,MAAa,cAAe,SAAQ,KAAK;IAEjB;IACA;IAEA;IAJpB,YACoB,MAAc,EACd,OAA2B,EAC3C,OAAe,EACC,SAA6B;QAE7C,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAoB;QAE3B,cAAS,GAAT,SAAS,CAAoB;QAG7C,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,qBAAqB,CAAC,GAAY;QACrC,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,GAAY;QAC7B,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,GAAY;QAC3B,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,GAAY;QACnC,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;CACJ;AA1BD,wCA0BC;AAQD,MAAa,SAAS;IACD,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,SAAS,CAAS;IAEnC,YAAY,IAAsB;QAC9B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,IAAY,EAAE,IAAa;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAExD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACnB;gBACI,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACL,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC5C,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;iBACxC;aACJ,EACD,CAAC,GAAG,EAAE,EAAE;gBACJ,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC7B,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;wBACjD,OAAO,GAAG,IAAI,CAAC;wBACf,GAAG,CAAC,OAAO,EAAE,CAAC;wBACd,MAAM,CAAC,IAAI,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;wBAC5E,OAAO;oBACX,CAAC;oBACD,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACf,IAAI,OAAO;wBAAE,OAAO;oBACpB,IAAI,IAAS,CAAC;oBACd,IAAI,CAAC;wBACD,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,CAAC;oBAAC,MAAM,CAAC;wBACL,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;oBACnB,CAAC;oBACD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;oBACnC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAS,CAAC,CAAC;oBACvB,CAAC;yBAAM,CAAC;wBACJ,MAAM,MAAM,GAAa;4BACrB,MAAM;4BACN,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;4BAClC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,MAAM,EAAE;4BACvD,SAAS,EAAE,IAAI,CAAC,SAAS;yBAC5B,CAAC;wBACF,MAAM,CAAC,IAAI,cAAc,CACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,SAAS,CACnB,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC,CACJ,CAAC;YAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;gBAChC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,2BAA2B,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YACvG,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,IAAY,EAAE,IAAa,EAAE,SAAS,GAAG,MAAM;QACxF,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAExD,OAAO,IAAI,OAAO,CAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACnB;gBACI,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACL,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;iBAC/C;aACJ,EACD,CAAC,GAAG,EAAE,EAAE;gBACJ,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACf,IAAI,IAAS,CAAC;oBACd,IAAI,CAAC;wBAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC;wBAAC,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;oBAAC,CAAC;oBACpE,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;oBACnC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAClB,CAAC;yBAAM,CAAC;wBACJ,MAAM,CAAC,IAAI,cAAc,CACrB,MAAM,EACN,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,MAAM,EAAE,EAC9C,IAAI,CAAC,SAAS,CACjB,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC,CACJ,CAAC;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;gBAC3B,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,2BAA2B,SAAS,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YAClG,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAzID,8BAyIC"}

package/dist/api/types.d.ts

@@ -12,6 +12,46 @@ export interface ScanRequest {
         }>;
         endpointContext?: unknown;
     };
+    /** Phase B/C/E: AST-derived sink findings + taint flows + guard evals. */
+    deterministicFacts?: {
+        sinks?: Array<{
+            line: number;
+            endLine: number;
+            sink: string;
+            canonicalType: string;
+            severity: string;
+            callExpression: string;
+            arguments: Array<{
+                kind: string;
+                value?: string;
+                interpolated?: boolean;
+            }>;
+            enclosingFunction?: string | null;
+            isInsideTryCatch: boolean;
+        }>;
+        taint?: Array<{
+            source: string;
+            sourceLine: number;
+            sink: string;
+            sinkLine: number;
+            canonicalType: string;
+            propagationPath: Array<{
+                line: number;
+                variable: string;
+                operation: string;
+                description: string;
+            }>;
+            isTainted: boolean;
+        }>;
+        guards?: Array<{
+            guardName: string;
+            guardType: string;
+            attackType: string;
+            effective: boolean;
+            reason: string;
+            bypassExample?: string;
+        }>;
+    };
 }
 export interface ScanFinding {
     check_id?: string;

package/dist/index.js

@@ -37,12 +37,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path = __importStar(require("path"));
 const credentialStore_1 = require("./auth/credentialStore");
 const server_1 = require("./mcp/server");
+const client_1 = require("./api/client");
 function printUsage() {
     console.log(`SecureCode MCP — standalone security scanner for AI coding tools
 
 Usage:
   securecode-mcp serve [--workspace <path>]    Start the MCP stdio server
-  securecode-mcp login [--api-url <url>]        Store your API token
+  securecode-mcp login [--api-url <url>]        Authenticate via email + OTP
   securecode-mcp status                        Show current auth status
   securecode-mcp logout                        Remove stored credentials
   securecode-mcp --help                        Show this help
@@ -93,27 +94,83 @@ async function cmdLogin(args) {
     console.log('SecureCode MCP Login');
     console.log(`API URL: ${apiUrl}`);
     console.log('');
-    const token = await ask('Enter your SecureCode API token: ');
+    // Step 1: Ask for email
+    const email = (await ask('Enter your email: ')).trim();
+    if (!email || !email.includes('@')) {
+        console.error('Error: A valid email is required.');
+        rl.close();
+        process.exit(1);
+    }
+    // Step 2: Check if the email exists
+    console.log('');
+    console.log('Checking account...');
+    try {
+        await client_1.ApiClient.postJsonNoAuth(apiUrl, '/auth/check-email', { email });
+    }
+    catch (err) {
+        if (err.status === 404 || err.message?.toLowerCase().includes('not')) {
+            console.error(`Error: No account found for ${email}. Sign up at https://usesecurecode.tech first.`);
+        }
+        else {
+            console.error(`Error: ${err.message || err}`);
+        }
+        rl.close();
+        process.exit(1);
+    }
+    // Step 3: Send OTP
+    console.log('Sending verification code...');
+    try {
+        await client_1.ApiClient.postJsonNoAuth(apiUrl, '/auth/send-otp', { email });
+    }
+    catch (err) {
+        console.error(`Error sending code: ${err.message || err}`);
+        rl.close();
+        process.exit(1);
+    }
+    // Step 4: Ask for the OTP code
+    console.log(`A 6-digit verification code was sent to ${email}.`);
+    const otp = (await ask('Enter the code: ')).trim();
+    if (!otp || otp.length < 4) {
+        console.error('Error: A valid verification code is required.');
+        rl.close();
+        process.exit(1);
+    }
     rl.close();
-    if (!token || token.trim().length === 0) {
-        console.error('Error: No token provided.');
+    // Step 5: Verify OTP → get JWT
+    console.log('Verifying...');
+    let token;
+    let plan;
+    try {
+        const resp = await client_1.ApiClient.postJsonNoAuth(apiUrl, '/auth/verify-otp', { email, otp });
+        token = resp.token;
+        plan = resp.plan || 'free';
+        if (!token) {
+            console.error('Error: No token returned from verification.');
+            process.exit(1);
+        }
+    }
+    catch (err) {
+        console.error(`Error: ${err.message || err}`);
         process.exit(1);
     }
+    // Step 6: Store the token
     const result = credentialStore_1.CredentialStore.save({
-        apiToken: token.trim(),
+        apiToken: token,
         apiUrl,
         storedAt: new Date().toISOString(),
     });
     console.log('');
+    console.log(`Authenticated (${plan} plan).`);
     if (result.method === 'keychain') {
-        console.log('Credentials saved to OS keychain.');
+        console.log('Token saved to OS keychain.');
     }
     else {
-        console.log(`Credentials saved to ~/.securecode/credentials.json (mode 0600).`);
+        console.log('Token saved to ~/.securecode/credentials.json (mode 0600).');
         if (result.warning) {
             console.log(`Warning: ${result.warning}`);
         }
     }
+    console.log('');
     console.log('You can now run: securecode-mcp serve --workspace /path/to/project');
 }
 function cmdStatus() {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,2CAA6B;AAC7B,4DAAyD;AACzD,yCAA2C;AAG3C,SAAS,UAAU;IACf,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;CAsBf,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc;IAClC,IAAI,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,iCAAe,CAAC,UAAU,EAAE,CAAC;IAE3C,MAAM,GAAG,GAAkB;QACvB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,SAAS;KAC3B,CAAC;IAEF,IAAA,oBAAW,EAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc;IAClC,IAAI,MAAM,GAAG,gCAAgC,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAErF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,mCAAmC,CAAC,CAAC;IAC7D,EAAE,CAAC,KAAK,EAAE,CAAC;IAEX,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,iCAAe,CAAC,IAAI,CAAC;QAChC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE;QACtB,MAAM;QACN,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,SAAS;IACd,MAAM,KAAK,GAAG,iCAAe,CAAC,GAAG,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS;IACd,MAAM,OAAO,GAAG,iCAAe,CAAC,KAAK,EAAE,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAChD,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACf,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACvD,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9B,QAAQ,OAAO,EAAE,CAAC;QACd,KAAK,OAAO;YACR,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACV,KAAK,OAAO;YACR,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACV,KAAK,QAAQ;YACT,SAAS,EAAE,CAAC;YACZ,MAAM;QACV,KAAK,QAAQ;YACT,SAAS,EAAE,CAAC;YACZ,MAAM;QACV;YACI,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YAC7C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,2CAA6B;AAC7B,4DAAyD;AACzD,yCAA2C;AAE3C,yCAAyC;AAEzC,SAAS,UAAU;IACf,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;CAsBf,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc;IAClC,IAAI,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,iCAAe,CAAC,UAAU,EAAE,CAAC;IAE3C,MAAM,GAAG,GAAkB;QACvB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,SAAS;KAC3B,CAAC;IAEF,IAAA,oBAAW,EAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc;IAClC,IAAI,MAAM,GAAG,gCAAgC,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAErF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,wBAAwB;IACxB,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,oCAAoC;IACpC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnC,IAAI,CAAC;QACD,MAAM,kBAAS,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,KAAK,CAAC,+BAA+B,KAAK,gDAAgD,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,IAAI,CAAC;QACD,MAAM,kBAAS,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAC3D,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,+BAA+B;IAC/B,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,GAAG,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,EAAE,CAAC,KAAK,EAAE,CAAC;IAEX,+BAA+B;IAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,KAAa,CAAC;IAClB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,kBAAS,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;QAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,0BAA0B;IAC1B,MAAM,MAAM,GAAG,iCAAe,CAAC,IAAI,CAAC;QAChC,QAAQ,EAAE,KAAK;QACf,MAAM;QACN,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,SAAS;IACd,MAAM,KAAK,GAAG,iCAAe,CAAC,GAAG,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS;IACd,MAAM,OAAO,GAAG,iCAAe,CAAC,KAAK,EAAE,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAChD,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACf,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACvD,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9B,QAAQ,OAAO,EAAE,CAAC;QACd,KAAK,OAAO;YACR,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACV,KAAK,OAAO;YACR,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACV,KAAK,QAAQ;YACT,SAAS,EAAE,CAAC;YACZ,MAAM;QACV,KAAK,QAAQ;YACT,SAAS,EAAE,CAAC;YACZ,MAAM;QACV;YACI,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YAC7C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC"}

package/dist/mcp/server.js

@@ -42,7 +42,7 @@ const fix_1 = require("../tools/fix");
 const attack_1 = require("../tools/attack");
 const PROTOCOL_VERSION = '2025-03-26';
 const SERVER_NAME = 'securecode-mcp';
-const SERVER_VERSION = '0.1.0';
+const SERVER_VERSION = '0.2.0';
 let initialized = false;
 function send(msg) {
     process.stdout.write(JSON.stringify(msg) + '\n');
@@ -53,6 +53,16 @@ function result(id, value) {
 function error(id, code, message, data) {
     send({ jsonrpc: '2.0', id, error: { code, message, data } });
 }
+/** Send a progress notification so the MCP client knows the server is still working. */
+function sendProgress(progressToken, progress, total, message) {
+    if (progressToken === undefined)
+        return;
+    send({
+        jsonrpc: '2.0',
+        method: 'notifications/progress',
+        params: { progressToken, progress, total, message },
+    });
+}
 const TOOL_HANDLERS = {
     'securecode.scan': scan_1.toolScan,
     'securecode.map': map_1.toolMap,
@@ -108,6 +118,7 @@ async function handleRequest(ctx, req) {
                 const params = (req.params || {});
                 const name = params.name;
                 const args = params.arguments || {};
+                const progressToken = params._meta?.progressToken;
                 const handler = name ? TOOL_HANDLERS[name] : undefined;
                 if (!handler) {
                     return { jsonrpc: '2.0', id, error: { code: -32601, message: `Unknown tool: ${name}` } };
@@ -120,6 +131,10 @@ async function handleRequest(ctx, req) {
                 if (invalid) {
                     return { jsonrpc: '2.0', id, error: { code: -32602, message: invalid } };
                 }
+                // Pass progress callback to the handler via args
+                if (progressToken !== undefined) {
+                    args._progress = (progress, total, message) => sendProgress(progressToken, progress, total, message);
+                }
                 const result_data = await handler(ctx, args);
                 return {
                     jsonrpc: '2.0', id,

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuHA,kCA4CC;AAnKD,mDAAqC;AAErC,mCAAgC;AAChC,wCAAyC;AACzC,sCAAuC;AACvC,sCAAuC;AACvC,4CAA6C;AAE7C,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAS,IAAI,CAAC,GAA2E;IACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,EAA0B,EAAE,KAAc;IACtD,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,EAA0B,EAAE,IAAY,EAAE,OAAe,EAAE,IAAc;IACpF,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,aAAa,GAAwE;IACvF,iBAAiB,EAAE,eAAQ;IAC3B,gBAAgB,EAAE,aAAO;IACzB,gBAAgB,EAAE,aAAO;IACzB,mBAAmB,EAAE,mBAAU;CAClC,CAAC;AAEF,SAAS,YAAY,CAAC,IAAa,EAAE,IAAS;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,WAGnB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,+BAA+B,IAAI,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC;QACpE,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACjE,MAAM,EAAE,GACJ,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;YACnD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7E,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC;oBACrD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC5E,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;4BAC7C,IAAI,CAAC;QACT,IAAI,CAAC,EAAE,EAAE,CAAC;YACN,OAAO,cAAc,IAAI,QAAQ,IAAI,CAAC,IAAI,cAAc,QAAQ,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC;QAC9H,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAmB;IAChE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,IAAI,CAAC;QACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,WAAW,GAAG,IAAI,CAAC;gBACnB,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,eAAe,EAAE,gBAAgB;wBACjC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;wBAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;qBAC7D;iBACJ,CAAC;YACN,CAAC;YACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,aAAK,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAuC,CAAC;gBACxE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,aAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC5C,IAAI,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7C,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;qBAC1E;iBACJ,CAAC;YACN,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACN,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACxC,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACvG,CAAC;QACL,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;AACL,CAAC;AAED,SAAgB,WAAW,CAAC,GAAkB;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/E,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACL,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACnC,OAAO;QACX,CAAC;QAED,IACI,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,OAAQ,MAAyB,CAAC,MAAM,KAAK,QAAQ,EACvD,CAAC;YACC,MAAM,OAAO,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC1D,CAAC,CAAE,MAAyB,CAAC,EAAE,IAAI,IAAI;gBACvC,CAAC,CAAC,IAAI,CAAC;YACf,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QAED,MAAM,GAAG,GAAG,MAAwB,CAAC;QACrC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuIA,kCA4CC;AAnLD,mDAAqC;AAErC,mCAAgC;AAChC,wCAAyC;AACzC,sCAAuC;AACvC,sCAAuC;AACvC,4CAA6C;AAE7C,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAS,IAAI,CAAC,GAA2E;IACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,EAA0B,EAAE,KAAc;IACtD,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,EAA0B,EAAE,IAAY,EAAE,OAAe,EAAE,IAAc;IACpF,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,aAA0C,EAAE,QAAgB,EAAE,KAAa,EAAE,OAAe;IAC9G,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO;IACxC,IAAI,CAAC;QACD,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;KACtD,CAAC,CAAC;AACP,CAAC;AAED,MAAM,aAAa,GAAwE;IACvF,iBAAiB,EAAE,eAAQ;IAC3B,gBAAgB,EAAE,aAAO;IACzB,gBAAgB,EAAE,aAAO;IACzB,mBAAmB,EAAE,mBAAU;CAClC,CAAC;AAEF,SAAS,YAAY,CAAC,IAAa,EAAE,IAAS;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,WAGnB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,+BAA+B,IAAI,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC;QACpE,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACjE,MAAM,EAAE,GACJ,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;YACnD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7E,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC;oBACrD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC5E,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;4BAC7C,IAAI,CAAC;QACT,IAAI,CAAC,EAAE,EAAE,CAAC;YACN,OAAO,cAAc,IAAI,QAAQ,IAAI,CAAC,IAAI,cAAc,QAAQ,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC;QAC9H,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAmB;IAChE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,IAAI,CAAC;QACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,WAAW,GAAG,IAAI,CAAC;gBACnB,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,eAAe,EAAE,gBAAgB;wBACjC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;wBAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;qBAC7D;iBACJ,CAAC;YACN,CAAC;YACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,aAAK,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAoF,CAAC;gBACrH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;gBACpC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;gBAClD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,aAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC5C,IAAI,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBACD,iDAAiD;gBACjD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAC9B,IAAI,CAAC,SAAS,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,OAAe,EAAE,EAAE,CAClE,YAAY,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7C,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;qBAC1E;iBACJ,CAAC;YACN,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACN,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACxC,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACvG,CAAC;QACL,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;AACL,CAAC;AAED,SAAgB,WAAW,CAAC,GAAkB;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/E,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACL,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACnC,OAAO;QACX,CAAC;QAED,IACI,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,OAAQ,MAAyB,CAAC,MAAM,KAAK,QAAQ,EACvD,CAAC;YACC,MAAM,OAAO,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC1D,CAAC,CAAE,MAAyB,CAAC,EAAE,IAAI,IAAI;gBACvC,CAAC,CAAC,IAAI,CAAC;YACf,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QAED,MAAM,GAAG,GAAG,MAAwB,CAAC;QACrC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/poc/httpPocExecutor.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Phase F — HTTP POC executor.
+ *
+ * Verifies server-side vulnerabilities (SQL injection, open redirect, SSRF,
+ * access control) by sending a single HTTP request with the attack payload
+ * and checking the response for the exploit signature.
+ *
+ * This is a thin layer — the existing SandboxRunner handles complex attack
+ * scenarios (baseline comparison, multi-request flows, dev server spawning).
+ * This executor assumes the dev server is already running and just does a
+ * quick payload injection + response check.
+ */
+import type { PocRequest, PocResult } from './pocTypes';
+/**
+ * Execute a POC via a simple HTTP request.
+ *
+ * Sends the attack payload to the target endpoint and checks the response
+ * for the exploit signature. Returns a PocResult with the verdict.
+ */
+export declare function executeWithHttp(req: PocRequest): Promise<PocResult>;

package/dist/poc/httpPocExecutor.js

@@ -0,0 +1,247 @@
+"use strict";
+/**
+ * Phase F — HTTP POC executor.
+ *
+ * Verifies server-side vulnerabilities (SQL injection, open redirect, SSRF,
+ * access control) by sending a single HTTP request with the attack payload
+ * and checking the response for the exploit signature.
+ *
+ * This is a thin layer — the existing SandboxRunner handles complex attack
+ * scenarios (baseline comparison, multi-request flows, dev server spawning).
+ * This executor assumes the dev server is already running and just does a
+ * quick payload injection + response check.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeWithHttp = executeWithHttp;
+// ── Exploit signature patterns ──────────────────────────────────────────────
+/** SQL error messages that indicate a successful injection. */
+const SQL_ERROR_PATTERNS = [
+    /SQL syntax.*MySQL/i,
+    /Warning.*mysql_/i,
+    /PostgreSQL.*ERROR/i,
+    /ORA-\d{5}/i,
+    /SQLite3?::query/i,
+    /Microsoft SQL Server/i,
+    /Incorrect syntax near/i,
+    /Unclosed quotation mark/i,
+    /PG::.*Error/i,
+    /psycopg2\.errors/i,
+    /SQL syntax error/i, // General — catches most SQL backends
+    /sqlite3\.OperationalError/i,
+    /You have an error in your SQL syntax/i,
+];
+/** Patterns that indicate the response reflected user input without sanitization. */
+const XSS_PATTERNS = [
+    /<script[^>]*>.*?<\/script>/i,
+    /onerror\s*=/i,
+    /onload\s*=/i,
+    /javascript:/i,
+];
+/** Internal addresses that indicate SSRF. */
+const SSRF_INTERNAL_PATTERNS = [
+    /169\.254\.169\.254/i, // AWS metadata
+    /127\.0\.0\.1/i,
+    /localhost/i,
+    /10\.\d+\.\d+\.\d+/i,
+    /192\.168\.\d+\.\d+/i,
+];
+// ── Execution ───────────────────────────────────────────────────────────────
+/**
+ * Execute a POC via a simple HTTP request.
+ *
+ * Sends the attack payload to the target endpoint and checks the response
+ * for the exploit signature. Returns a PocResult with the verdict.
+ */
+async function executeWithHttp(req) {
+    const baseUrl = req.endpoint.baseUrl || 'http://127.0.0.1:3000';
+    const fullPath = req.endpoint.path.startsWith('/')
+        ? req.endpoint.path
+        : '/' + req.endpoint.path;
+    const url = baseUrl + fullPath;
+    const payload = req.payload || '';
+    const injectionPoint = req.injectionPoint || 'query';
+    const paramName = req.paramName || 'q';
+    const method = req.endpoint.method || 'GET';
+    try {
+        // Build the request based on injection point
+        let requestUrl = url;
+        const headers = {};
+        let body;
+        if (injectionPoint === 'query') {
+            const sep = requestUrl.includes('?') ? '&' : '?';
+            requestUrl = `${requestUrl}${sep}${paramName}=${encodeURIComponent(payload)}`;
+        }
+        else if (injectionPoint === 'body') {
+            body = JSON.stringify({ [paramName]: payload });
+            headers['Content-Type'] = 'application/json';
+        }
+        else if (injectionPoint === 'header') {
+            headers[paramName] = payload;
+        }
+        else if (injectionPoint === 'path') {
+            // Replace a path parameter with the payload
+            requestUrl = url.replace(/:\w+/, encodeURIComponent(payload));
+        }
+        const init = {
+            method,
+            headers,
+            ...(body ? { body } : {}),
+            signal: AbortSignal.timeout(10_000),
+        };
+        const startTime = Date.now();
+        const response = await fetch(requestUrl, init);
+        const responseTime = Date.now() - startTime;
+        const responseHeaders = {};
+        response.headers.forEach((v, k) => { responseHeaders[k] = v; });
+        const responseBody = await response.text().catch(() => '');
+        // ── Check exploit signatures based on vuln type ────────────────
+        if (req.vulnType === 'sql_injection' || req.vulnType === 'nosql_injection') {
+            // Check for SQL error messages or data leakage
+            for (const pattern of SQL_ERROR_PATTERNS) {
+                if (pattern.test(responseBody)) {
+                    return {
+                        exploitable: true,
+                        output: responseBody.slice(0, 500),
+                        timedOut: false,
+                        evidence: `SQL error message detected in response (pattern: ${pattern.source})`,
+                        backend: 'http',
+                    };
+                }
+            }
+            // Check for unexpected 200 on a malformed query
+            if (response.status >= 200 && response.status < 300 && payload.includes("'")) {
+                return {
+                    exploitable: true,
+                    output: responseBody.slice(0, 500),
+                    timedOut: false,
+                    evidence: `Injection payload accepted (HTTP ${response.status}) — query did not error on the payload`,
+                    backend: 'http',
+                };
+            }
+            return {
+                exploitable: false,
+                output: responseBody.slice(0, 500),
+                timedOut: false,
+                evidence: `No SQL error or data leakage detected (HTTP ${response.status})`,
+                backend: 'http',
+            };
+        }
+        if (req.vulnType === 'xss') {
+            // Check if the payload appears unescaped in the response
+            if (payload && responseBody.includes(payload)) {
+                return {
+                    exploitable: true,
+                    output: responseBody.slice(0, 500),
+                    timedOut: false,
+                    evidence: 'Payload reflected unescaped in HTTP response body',
+                    backend: 'http',
+                };
+            }
+            for (const pattern of XSS_PATTERNS) {
+                if (pattern.test(responseBody)) {
+                    return {
+                        exploitable: true,
+                        output: responseBody.slice(0, 500),
+                        timedOut: false,
+                        evidence: `XSS pattern detected in response: ${pattern.source}`,
+                        backend: 'http',
+                    };
+                }
+            }
+            return {
+                exploitable: false,
+                output: responseBody.slice(0, 500),
+                timedOut: false,
+                evidence: 'Payload not reflected in response (may be escaped or sanitized)',
+                backend: 'http',
+            };
+        }
+        if (req.vulnType === 'open_redirect') {
+            // Check the Location header for the redirect target
+            const location = responseHeaders['location'] || '';
+            if (location && payload && location.includes(payload)) {
+                return {
+                    exploitable: true,
+                    output: `Location: ${location}`,
+                    timedOut: false,
+                    evidence: `Redirected to ${location} — open redirect confirmed`,
+                    backend: 'http',
+                };
+            }
+            if (response.status >= 300 && response.status < 400 && location) {
+                return {
+                    exploitable: true,
+                    output: `Location: ${location}`,
+                    timedOut: false,
+                    evidence: `HTTP ${response.status} redirect to ${location}`,
+                    backend: 'http',
+                };
+            }
+            return {
+                exploitable: false,
+                timedOut: false,
+                evidence: `No redirect detected (HTTP ${response.status}, no Location header)`,
+                backend: 'http',
+            };
+        }
+        if (req.vulnType === 'ssrf') {
+            // Check if the response indicates an internal request was made
+            for (const pattern of SSRF_INTERNAL_PATTERNS) {
+                if (pattern.test(responseBody)) {
+                    return {
+                        exploitable: true,
+                        output: responseBody.slice(0, 500),
+                        timedOut: false,
+                        evidence: `Internal address detected in response: ${pattern.source}`,
+                        backend: 'http',
+                    };
+                }
+            }
+            return {
+                exploitable: false,
+                timedOut: false,
+                evidence: 'No internal address detected in response',
+                backend: 'http',
+            };
+        }
+        if (req.vulnType === 'broken_access_control') {
+            // Check for auth bypass: expected 401/403 but got 200
+            if (response.status >= 200 && response.status < 300) {
+                return {
+                    exploitable: true,
+                    output: responseBody.slice(0, 500),
+                    timedOut: false,
+                    evidence: `Access control bypass: got HTTP ${response.status} (expected 401/403)`,
+                    backend: 'http',
+                };
+            }
+            return {
+                exploitable: false,
+                timedOut: false,
+                evidence: `Access control held (HTTP ${response.status})`,
+                backend: 'http',
+            };
+        }
+        // Generic fallback
+        return {
+            exploitable: false,
+            output: responseBody.slice(0, 500),
+            timedOut: false,
+            evidence: `No specific signature check for ${req.vulnType} (HTTP ${response.status}, ${responseTime}ms)`,
+            backend: 'http',
+        };
+    }
+    catch (error) {
+        const timedOut = error.name === 'TimeoutError' || error.name === 'AbortError';
+        return {
+            exploitable: false,
+            error: error.message,
+            timedOut,
+            evidence: timedOut
+                ? 'POC timed out after 10s — the endpoint may not be running'
+                : `HTTP request failed: ${error.message}`,
+            backend: 'http',
+        };
+    }
+}
+//# sourceMappingURL=httpPocExecutor.js.map