@securecode-ai/mcp 0.1.0

package/dist/tools/attack.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolAttack = toolAttack;
+const broker_1 = require("../approval/broker");
+const agentLoop_1 = require("../attack/agentLoop");
+const cache_1 = require("../project-map/cache");
+const files_1 = require("../utils/files");
+async function toolAttack(ctx, args) {
+    let code = args.code;
+    let language = args.language;
+    const filePath = args.filePath;
+    if (!code && filePath) {
+        const file = (0, files_1.readFileFromWorkspace)(ctx.workspaceRoot, filePath);
+        code = file.code;
+        language = language || file.language;
+    }
+    if (!code) {
+        return {
+            applied: false,
+            note: 'Provide code or filePath for the endpoint to attack.',
+        };
+    }
+    if (!language) {
+        return {
+            applied: false,
+            note: 'Could not determine language. Provide language or filePath with a known extension.',
+        };
+    }
+    const map = (0, cache_1.readCache)(ctx.workspaceRoot);
+    if (!map || !map.endpoints || map.endpoints.length === 0) {
+        return {
+            applied: false,
+            note: 'No Project Map found or no endpoints mapped. Run securecode.map with action "build" first.',
+        };
+    }
+    let endpoint;
+    if (filePath) {
+        const relPath = filePath.replace(/\\/g, '/').replace(/^\.\//, '');
+        endpoint = map.endpoints.find((e) => {
+            const sf = (e.sourceFile || '').replace(/\\/g, '/');
+            return sf === relPath || sf.endsWith('/' + relPath) || sf.endsWith(relPath);
+        });
+    }
+    if (!endpoint) {
+        endpoint = map.endpoints[0];
+    }
+    const port = args.port || args.targetPort || 3000;
+    const targetHost = args.targetHost || '127.0.0.1';
+    const summary = `Attack endpoint ${endpoint.method} ${endpoint.path} from ${endpoint.sourceFile}\n` +
+        `Target: ${targetHost}:${port}\n` +
+        `Vulnerability: ${args.vulnerabilityType || '(auto-detected)'}\n` +
+        `Budget: max ${12} steps, 90s wall clock`;
+    const broker = new broker_1.ApprovalBroker();
+    await broker.start();
+    try {
+        const result = await broker.requestApproval('securecode.attack', summary, [endpoint.path, targetHost, port, code, args.vulnerabilityType], 60_000);
+        if (!result.approved) {
+            return {
+                applied: false,
+                reason: result.reason,
+                requestId: result.requestId,
+            };
+        }
+        const attackResult = await (0, agentLoop_1.runAttack)(ctx, { method: endpoint.method, path: endpoint.path, sourceFile: endpoint.sourceFile, handlerName: endpoint.handlerName }, code, language, {
+            targetPort: port,
+            targetHost,
+            signal: undefined,
+        });
+        return {
+            applied: true,
+            status: attackResult.status,
+            report: attackResult.report,
+            error: attackResult.error,
+        };
+    }
+    finally {
+        await broker.stop();
+    }
+}
+//# sourceMappingURL=attack.js.map

package/dist/tools/attack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attack.js","sourceRoot":"","sources":["../../src/tools/attack.ts"],"names":[],"mappings":";;AAOA,gCA6FC;AAnGD,+CAAoD;AACpD,mDAAgD;AAChD,gDAAiD;AACjD,0CAAsE;AAG/D,KAAK,UAAU,UAAU,CAAC,GAAkB,EAAE,IAAS;IAC1D,IAAI,IAAI,GAAuB,IAAI,CAAC,IAAI,CAAC;IACzC,IAAI,QAAQ,GAAuB,IAAI,CAAC,QAAQ,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA8B,CAAC;IAErD,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAA,6BAAqB,EAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACjB,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO;YACH,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,sDAAsD;SAC/D,CAAC;IACN,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO;YACH,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,oFAAoF;SAC7F,CAAC;IACN,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,iBAAS,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO;YACH,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,4FAA4F;SACrG,CAAC;IACN,CAAC;IAED,IAAI,QAAa,CAAC;IAClB,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,QAAQ,GAAI,GAAG,CAAC,SAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACpD,OAAO,EAAE,KAAK,OAAO,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACP,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC;IAElD,MAAM,OAAO,GAAG,mBAAmB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,SAAS,QAAQ,CAAC,UAAU,IAAI;QAC/F,WAAW,UAAU,IAAI,IAAI,IAAI;QACjC,kBAAkB,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,IAAI;QACjE,eAAe,EAAE,wBAAwB,CAAC;IAE9C,MAAM,MAAM,GAAG,IAAI,uBAAc,EAAE,CAAC;IACpC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAErB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CACvC,mBAAmB,EACnB,OAAO,EACP,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAC/D,MAAM,CACT,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC9B,CAAC;QACN,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAA,qBAAS,EAChC,GAAG,EACH,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,EACpH,IAAI,EACJ,QAAQ,EACR;YACI,UAAU,EAAE,IAAI;YAChB,UAAU;YACV,MAAM,EAAE,SAAS;SACpB,CACJ,CAAC;QAEF,OAAO;YACH,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,KAAK,EAAE,YAAY,CAAC,KAAK;SAC5B,CAAC;IACN,CAAC;YAAS,CAAC;QACP,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;AACL,CAAC"}

package/dist/tools/fix.d.ts

@@ -0,0 +1,2 @@
+import type { ServerContext } from '../mcp/types';
+export declare function toolFix(ctx: ServerContext, args: any): Promise<unknown>;

package/dist/tools/fix.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolFix = toolFix;
+const client_1 = require("../api/client");
+const files_1 = require("../utils/files");
+const broker_1 = require("../approval/broker");
+async function toolFix(ctx, args) {
+    const client = new client_1.ApiClient({ baseUrl: ctx.apiUrl, token: ctx.apiToken });
+    let code = args.code;
+    const language = args.language;
+    if (!code && args.filePath) {
+        const file = (0, files_1.readFileFromWorkspace)(ctx.workspaceRoot, args.filePath);
+        code = file.code;
+    }
+    if (!code) {
+        throw Object.assign(new Error('Provide code or filePath.'), { code: -32602 });
+    }
+    const summary = `Fix ${args.vulnerabilityType} at line ${args.lineStart}-${args.lineEnd}\n\nEvidence: ${args.evidenceSnippet?.substring(0, 200) || '(not provided)'}`;
+    const broker = new broker_1.ApprovalBroker();
+    await broker.start();
+    try {
+        const result = await broker.requestApproval('securecode.fix', summary, [code, language, args.vulnerabilityType, args.lineStart, args.lineEnd, args.evidenceSnippet], 60_000);
+        if (!result.approved) {
+            return {
+                applied: false,
+                reason: result.reason,
+                requestId: result.requestId,
+            };
+        }
+        const data = await client.postJson('/fix', {
+            code,
+            language,
+            vulnerability: {
+                type: args.vulnerabilityType,
+                line_start: args.lineStart,
+                line_end: args.lineEnd,
+                evidence_snippet: args.evidenceSnippet,
+            },
+            ...(args.framework ? { framework: args.framework } : {}),
+        });
+        return {
+            applied: false,
+            fix: {
+                fixedCode: data.fixed_code,
+                diff: data.diff,
+                summary: data.fix_summary,
+                securityNotes: data.security_notes,
+                whySecure: data.why_secure,
+                importsNeeded: data.imports_needed,
+                confidence: data.confidence,
+            },
+            note: 'Patch returned for human review. Apply in your editor — do not auto-apply.',
+            approvedBy: result.requestId,
+        };
+    }
+    finally {
+        await broker.stop();
+    }
+}
+//# sourceMappingURL=fix.js.map

package/dist/tools/fix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix.js","sourceRoot":"","sources":["../../src/tools/fix.ts"],"names":[],"mappings":";;AAMA,0BAiEC;AAvED,0CAA0C;AAG1C,0CAAuD;AACvD,+CAAoD;AAE7C,KAAK,UAAU,OAAO,CAAC,GAAkB,EAAE,IAAS;IACvD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE3E,IAAI,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAW,IAAI,CAAC,QAAQ,CAAC;IAEvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAA,6BAAqB,EAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,iBAAiB,YAAY,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,iBAAiB,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,gBAAgB,EAAE,CAAC;IAEtK,MAAM,MAAM,GAAG,IAAI,uBAAc,EAAE,CAAC;IACpC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAErB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CACvC,gBAAgB,EAChB,OAAO,EACP,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,EAC5F,MAAM,CACT,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC9B,CAAC;QACN,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAc,MAAM,EAAE;YACpD,IAAI;YACJ,QAAQ;YACR,aAAa,EAAE;gBACX,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,UAAU,EAAE,IAAI,CAAC,SAAS;gBAC1B,QAAQ,EAAE,IAAI,CAAC,OAAO;gBACtB,gBAAgB,EAAE,IAAI,CAAC,eAAe;aACzC;YACD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;QAEH,OAAO;YACH,OAAO,EAAE,KAAK;YACd,GAAG,EAAE;gBACD,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,WAAW;gBACzB,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,UAAU,EAAE,IAAI,CAAC,UAAU;aAC9B;YACD,IAAI,EAAE,4EAA4E;YAClF,UAAU,EAAE,MAAM,CAAC,SAAS;SAC/B,CAAC;IACN,CAAC;YAAS,CAAC;QACP,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;AACL,CAAC"}

package/dist/tools/map.d.ts

@@ -0,0 +1,2 @@
+import type { ServerContext } from '../mcp/types';
+export declare function toolMap(ctx: ServerContext, args: any): Promise<unknown>;

package/dist/tools/map.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolMap = toolMap;
+const cache_1 = require("../project-map/cache");
+const mapBuilder_1 = require("../project-map/mapBuilder");
+async function toolMap(ctx, args) {
+    const action = args.action || 'endpoints';
+    if (action === 'build') {
+        const result = await (0, mapBuilder_1.buildProjectMap)({ workspaceRoot: ctx.workspaceRoot });
+        (0, cache_1.writeCache)(ctx.workspaceRoot, result.map);
+        return {
+            built: true,
+            endpoints: (result.map.endpoints || []).length,
+            filesProcessed: result.filesProcessed,
+            filesSkipped: result.filesSkipped,
+            errors: result.errors,
+            durationMs: result.durationMs,
+            builtAt: result.map.builtAt,
+        };
+    }
+    if (action === 'status') {
+        return (0, cache_1.cacheStatus)(ctx.workspaceRoot);
+    }
+    // Default: return endpoints (read from cache, or build if no cache)
+    let map = (0, cache_1.readCache)(ctx.workspaceRoot);
+    if (!map) {
+        const result = await (0, mapBuilder_1.buildProjectMap)({ workspaceRoot: ctx.workspaceRoot });
+        (0, cache_1.writeCache)(ctx.workspaceRoot, result.map);
+        map = result.map;
+    }
+    return {
+        endpoints: (map.endpoints || []).map((e) => ({
+            method: e.method,
+            path: e.path,
+            handler: e.handlerName,
+            sourceFile: e.sourceFile,
+            line: e.line,
+            authScheme: e.authScheme,
+            dataLayer: e.dataLayer,
+            confidence: e.confidence,
+        })),
+        builtAt: map.builtAt,
+        version: map.version,
+    };
+}
+//# sourceMappingURL=map.js.map

package/dist/tools/map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"map.js","sourceRoot":"","sources":["../../src/tools/map.ts"],"names":[],"mappings":";;AAMA,0BA2CC;AA9CD,gDAA0E;AAC1E,0DAA4D;AAErD,KAAK,UAAU,OAAO,CAAC,GAAkB,EAAE,IAAS;IACvD,MAAM,MAAM,GAAI,IAAI,CAAC,MAAiB,IAAI,WAAW,CAAC;IAEtD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAe,EAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QAC3E,IAAA,kBAAU,EAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO;YACH,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM;YAC9C,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO;SAC9B,CAAC;IACN,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAA,mBAAW,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;IAED,oEAAoE;IACpE,IAAI,GAAG,GAAG,IAAA,iBAAS,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAe,EAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QAC3E,IAAA,kBAAU,EAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACrB,CAAC;IAED,OAAO;QACH,SAAS,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,WAAW;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;KACvB,CAAC;AACN,CAAC"}

package/dist/tools/scan.d.ts

@@ -0,0 +1,2 @@
+import type { ServerContext } from '../mcp/types';
+export declare function toolScan(ctx: ServerContext, args: any): Promise<unknown>;

package/dist/tools/scan.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolScan = toolScan;
+const client_1 = require("../api/client");
+const files_1 = require("../utils/files");
+async function toolScan(ctx, args) {
+    const client = new client_1.ApiClient({ baseUrl: ctx.apiUrl, token: ctx.apiToken });
+    let code = args.code;
+    let language = args.language;
+    const filePath = args.filePath;
+    if (!code && filePath) {
+        const file = (0, files_1.readFileFromWorkspace)(ctx.workspaceRoot, filePath);
+        code = file.code;
+        language = language || file.language;
+    }
+    if (!code) {
+        throw Object.assign(new Error('Provide code or filePath.'), { code: -32602 });
+    }
+    if (!language) {
+        throw Object.assign(new Error('Provide language or filePath with a known extension.'), { code: -32602 });
+    }
+    const data = await client.postJson('/scan', {
+        code,
+        language,
+        ...(filePath ? { filePath } : {}),
+        scanDepth: 'auto',
+    });
+    const findings = data.scanType === 'advanced' && data.finalFindings
+        ? data.finalFindings
+        : data.findings || [];
+    return {
+        scanType: data.scanType,
+        scanId: data.scanId,
+        findings: findings.map((f) => ({
+            type: f.type || f.check_id,
+            severity: f.severity || f.extra?.severity,
+            location: f.location || {
+                line_start: f.start?.line,
+                line_end: f.end?.line ?? f.start?.line,
+            },
+            message: f.message || f.extra?.message,
+            evidence: f.evidence_snippet,
+            confidence: f.confidence,
+            why: f.why_real,
+            fixStrategy: f.fix_strategy,
+            fixSnippet: f.fix_snippet,
+        })),
+        scanSummary: data.scanSummary,
+        degraded: data.degraded,
+        remainingScans: data.remainingAIScans,
+        plan: data.plan,
+        scanCredits: data.scanCredits,
+    };
+}
+//# sourceMappingURL=scan.js.map

package/dist/tools/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/tools/scan.ts"],"names":[],"mappings":";;AAOA,4BAuDC;AA5DD,0CAA0C;AAG1C,0CAAsE;AAE/D,KAAK,UAAU,QAAQ,CAAC,GAAkB,EAAE,IAAS;IACxD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE3E,IAAI,IAAI,GAAuB,IAAI,CAAC,IAAI,CAAC;IACzC,IAAI,QAAQ,GAAuB,IAAI,CAAC,QAAQ,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA8B,CAAC;IAErD,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAA,6BAAqB,EAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACjB,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAe,OAAO,EAAE;QACtD,IAAI;QACJ,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,SAAS,EAAE,MAAM;KACpB,CAAC,CAAC;IAEH,MAAM,QAAQ,GACV,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,aAAa;QAC9C,CAAC,CAAC,IAAI,CAAC,aAAa;QACpB,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAE9B,OAAO;QACH,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ;YACzC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI;gBACpB,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI;gBACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI;aACzC;YACD,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO;YACtC,QAAQ,EAAE,CAAC,CAAC,gBAAgB;YAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,GAAG,EAAE,CAAC,CAAC,QAAQ;YACf,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,UAAU,EAAE,CAAC,CAAC,WAAW;SAC5B,CAAC,CAAC;QACH,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,gBAAgB;QACrC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;KAChC,CAAC;AACN,CAAC"}

package/dist/utils/files.d.ts

@@ -0,0 +1,8 @@
+export declare function inferLanguage(filePath: string): string | undefined;
+export declare function isSupportedFile(filePath: string): boolean;
+export declare function resolveWorkspacePath(workspaceRoot: string, inputPath: string): string;
+export declare function readFileFromWorkspace(workspaceRoot: string, inputPath: string): {
+    code: string;
+    language: string;
+    absolutePath: string;
+};

package/dist/utils/files.js

@@ -0,0 +1,79 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inferLanguage = inferLanguage;
+exports.isSupportedFile = isSupportedFile;
+exports.resolveWorkspacePath = resolveWorkspacePath;
+exports.readFileFromWorkspace = readFileFromWorkspace;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const SUPPORTED_EXTENSIONS = {
+    '.js': 'javascript',
+    '.mjs': 'javascript',
+    '.cjs': 'javascript',
+    '.jsx': 'javascriptreact',
+    '.ts': 'typescript',
+    '.tsx': 'typescriptreact',
+    '.py': 'python',
+    '.php': 'php',
+};
+function inferLanguage(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    return SUPPORTED_EXTENSIONS[ext];
+}
+function isSupportedFile(filePath) {
+    return inferLanguage(filePath) !== undefined;
+}
+function resolveWorkspacePath(workspaceRoot, inputPath) {
+    const resolved = path.resolve(workspaceRoot, inputPath);
+    const normalizedRoot = path.resolve(workspaceRoot);
+    if (!resolved.startsWith(normalizedRoot + path.sep) && resolved !== normalizedRoot) {
+        throw new Error(`Path '${inputPath}' is outside the workspace root. Only files within the workspace can be read.`);
+    }
+    return resolved;
+}
+function readFileFromWorkspace(workspaceRoot, inputPath) {
+    const absPath = resolveWorkspacePath(workspaceRoot, inputPath);
+    if (!fs.existsSync(absPath)) {
+        throw new Error(`File not found: ${inputPath}`);
+    }
+    const code = fs.readFileSync(absPath, 'utf8');
+    const language = inferLanguage(absPath);
+    if (!language) {
+        throw new Error(`Unsupported file type: ${path.extname(inputPath)}`);
+    }
+    return { code, language, absolutePath: absPath };
+}
+//# sourceMappingURL=files.js.map

package/dist/utils/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/utils/files.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,sCAGC;AAED,0CAEC;AAED,oDAOC;AAED,sDAWC;AA3CD,uCAAyB;AACzB,2CAA6B;AAE7B,MAAM,oBAAoB,GAA2B;IACjD,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,KAAK;CAChB,CAAC;AAEF,SAAgB,aAAa,CAAC,QAAgB;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,eAAe,CAAC,QAAgB;IAC5C,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AACjD,CAAC;AAED,SAAgB,oBAAoB,CAAC,aAAqB,EAAE,SAAiB;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,SAAS,SAAS,+EAA+E,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,SAAgB,qBAAqB,CAAC,aAAqB,EAAE,SAAiB;IAC1E,MAAM,OAAO,GAAG,oBAAoB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@securecode-ai/mcp",
+  "version": "0.1.0",
+  "description": "Standalone SecureCode MCP server — scan, map, fix, and attack tools for AI coding assistants. Works without the VS Code extension.",
+  "main": "dist/index.js",
+  "bin": {
+    "securecode-mcp": "dist/index.js"
+  },
+  "scripts": {
+    "build": "tsc -p ./",
+    "start": "node dist/index.js serve",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "files": [
+    "dist/",
+    "resources/tree-sitter/"
+  ],
+  "keywords": [
+    "mcp",
+    "security",
+    "scanner",
+    "vulnerability",
+    "ai",
+    "code-analysis",
+    "securecode"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AhmedSleem06/SecureCode-mcp.git"
+  },
+  "homepage": "https://usesecurecode.tech",
+  "bugs": {
+    "url": "https://github.com/AhmedSleem06/SecureCode-mcp/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "web-tree-sitter": "0.26.11"
+  },
+  "devDependencies": {
+    "@types/node": "^20.10.0",
+    "typescript": "^5.3.2",
+    "vitest": "^2.1.0"
+  }
+}