@securecode-ai/mcp 0.1.0 → 0.2.1

package/dist/tools/scan.js

@@ -3,6 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.toolScan = toolScan;
 const client_1 = require("../api/client");
 const files_1 = require("../utils/files");
+const sinkFinder_1 = require("../project-map/sinkFinder");
+const taintTracker_1 = require("../project-map/taintTracker");
+const guardEvaluator_1 = require("../project-map/guardEvaluator");
+const parserLoader_1 = require("../project-map/parserLoader");
 async function toolScan(ctx, args) {
     const client = new client_1.ApiClient({ baseUrl: ctx.apiUrl, token: ctx.apiToken });
     let code = args.code;
@@ -19,11 +23,51 @@ async function toolScan(ctx, args) {
     if (!language) {
         throw Object.assign(new Error('Provide language or filePath with a known extension.'), { code: -32602 });
     }
+    // Phase B/C/E: AST-based sink finder + taint tracker + guard evaluator.
+    // Runs locally via tree-sitter and attaches deterministic facts to the
+    // scan request. The MCP has no related-files infrastructure, so the
+    // guard evaluator only evaluates guards found in the scanned file itself.
+    let deterministicFacts;
+    if (filePath) {
+        const grammar = (0, parserLoader_1.grammarForFile)(filePath);
+        if (grammar !== 'unknown') {
+            try {
+                const [sinks, taint] = await Promise.all([
+                    (0, sinkFinder_1.findSinks)(code, grammar),
+                    (0, taintTracker_1.trackTaint)(code, grammar),
+                ]);
+                // Phase E: evaluate guards from the scanned file itself against
+                // the attack types found by the sink finder + taint tracker.
+                let guards;
+                const attackTypes = new Set();
+                for (const s of sinks)
+                    attackTypes.add(s.canonicalType);
+                for (const t of taint)
+                    attackTypes.add(t.canonicalType);
+                if (attackTypes.size > 0) {
+                    guards = await (0, guardEvaluator_1.evaluateGuards)([{ source: code, name: filePath }], [...attackTypes], grammar);
+                    if (guards.length === 0)
+                        guards = undefined;
+                }
+                if (sinks.length > 0 || taint.length > 0 || (guards && guards.length > 0)) {
+                    deterministicFacts = {
+                        ...(sinks.length > 0 && { sinks }),
+                        ...(taint.length > 0 && { taint }),
+                        ...(guards && { guards }),
+                    };
+                }
+            }
+            catch {
+                // Best-effort: tree-sitter may be unavailable.
+            }
+        }
+    }
     const data = await client.postJson('/scan', {
         code,
         language,
         ...(filePath ? { filePath } : {}),
         scanDepth: 'auto',
+        ...(deterministicFacts && { deterministicFacts }),
     });
     const findings = data.scanType === 'advanced' && data.finalFindings
         ? data.finalFindings

package/dist/tools/scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/tools/scan.ts"],"names":[],"mappings":";;AAOA,4BAuDC;AA5DD,0CAA0C;AAG1C,0CAAsE;AAE/D,KAAK,UAAU,QAAQ,CAAC,GAAkB,EAAE,IAAS;IACxD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE3E,IAAI,IAAI,GAAuB,IAAI,CAAC,IAAI,CAAC;IACzC,IAAI,QAAQ,GAAuB,IAAI,CAAC,QAAQ,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA8B,CAAC;IAErD,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAA,6BAAqB,EAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACjB,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAe,OAAO,EAAE;QACtD,IAAI;QACJ,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,SAAS,EAAE,MAAM;KACpB,CAAC,CAAC;IAEH,MAAM,QAAQ,GACV,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,aAAa;QAC9C,CAAC,CAAC,IAAI,CAAC,aAAa;QACpB,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAE9B,OAAO;QACH,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ;YACzC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI;gBACpB,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI;gBACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI;aACzC;YACD,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO;YACtC,QAAQ,EAAE,CAAC,CAAC,gBAAgB;YAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,GAAG,EAAE,CAAC,CAAC,QAAQ;YACf,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,UAAU,EAAE,CAAC,CAAC,WAAW;SAC5B,CAAC,CAAC;QACH,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,gBAAgB;QACrC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;KAChC,CAAC;AACN,CAAC"}
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/tools/scan.ts"],"names":[],"mappings":";;AAYA,4BAsGC;AAhHD,0CAA0C;AAG1C,0CAAsE;AACtE,0DAAsD;AACtD,8DAAyD;AACzD,kEAA+D;AAE/D,8DAA6D;AAEtD,KAAK,UAAU,QAAQ,CAAC,GAAkB,EAAE,IAAS;IACxD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE3E,IAAI,IAAI,GAAuB,IAAI,CAAC,IAAI,CAAC;IACzC,IAAI,QAAQ,GAAuB,IAAI,CAAC,QAAQ,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA8B,CAAC;IAErD,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAA,6BAAqB,EAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACjB,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,0EAA0E;IAC1E,IAAI,kBAIS,CAAC;IACd,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,IAAA,6BAAc,EAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC;gBACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACrC,IAAA,sBAAS,EAAC,IAAI,EAAE,OAAO,CAAC;oBACxB,IAAA,yBAAU,EAAC,IAAI,EAAE,OAAO,CAAC;iBAC5B,CAAC,CAAC;gBAEH,gEAAgE;gBAChE,6DAA6D;gBAC7D,IAAI,MAA8D,CAAC;gBACnE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAc,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,KAAK;oBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,aAA2B,CAAC,CAAC;gBACtE,KAAK,MAAM,CAAC,IAAI,KAAK;oBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,aAA2B,CAAC,CAAC;gBACtE,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBACvB,MAAM,GAAG,MAAM,IAAA,+BAAc,EACzB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAClC,CAAC,GAAG,WAAW,CAAC,EAChB,OAAO,CACV,CAAC;oBACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM,GAAG,SAAS,CAAC;gBAChD,CAAC;gBAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;oBACxE,kBAAkB,GAAG;wBACjB,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;wBAClC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;wBAClC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;qBAC5B,CAAC;gBACN,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACL,+CAA+C;YACnD,CAAC;QACL,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAe,OAAO,EAAE;QACtD,IAAI;QACJ,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,SAAS,EAAE,MAAM;QACjB,GAAG,CAAC,kBAAkB,IAAI,EAAE,kBAAkB,EAAE,CAAC;KACpD,CAAC,CAAC;IAEH,MAAM,QAAQ,GACV,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,aAAa;QAC9C,CAAC,CAAC,IAAI,CAAC,aAAa;QACpB,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAE9B,OAAO;QACH,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ;YACzC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI;gBACpB,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI;gBACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI;aACzC;YACD,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO;YACtC,QAAQ,EAAE,CAAC,CAAC,gBAAgB;YAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,GAAG,EAAE,CAAC,CAAC,QAAQ;YACf,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,UAAU,EAAE,CAAC,CAAC,WAAW;SAC5B,CAAC,CAAC;QACH,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,gBAAgB;QACrC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;KAChC,CAAC;AACN,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecode-ai/mcp",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Standalone SecureCode MCP server — scan, map, fix, and attack tools for AI coding assistants. Works without the VS Code extension.",
   "main": "dist/index.js",
   "bin": {