@securecode-ai/mcp 0.1.0

package/dist/mcp/tools.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOOLS = void 0;
+exports.TOOLS = [
+    {
+        name: 'securecode.scan',
+        description: 'Scan a source file or code string for vulnerabilities. Read-only: no approval needed. Returns findings (type, severity, location, message, evidence). Uses the SecureCode AI multi-phase pipeline (Scout discovery, Juror verification, Reconcile).',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                code: {
+                    type: 'string',
+                    description: 'Source code to scan (if filePath is omitted).',
+                },
+                filePath: {
+                    type: 'string',
+                    description: 'Workspace-relative path to the file to scan (reads from disk within the workspace root).',
+                },
+                language: {
+                    type: 'string',
+                    description: 'Language id (javascript, typescript, python, php). Inferred from filePath if omitted.',
+                },
+            },
+        },
+    },
+    {
+        name: 'securecode.map',
+        description: 'Get or build the Project Map for the workspace — extracted endpoints, middleware, auth scheme, and ORM. Read-only: no approval needed. Actions: "endpoints" (default, returns the endpoint list), "status" (map metadata), "build" (rebuild the map from source).',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                action: {
+                    type: 'string',
+                    enum: ['status', 'endpoints', 'build'],
+                    description: 'What to do: "status" for map metadata, "endpoints" for the endpoint list (default), "build" to rebuild the map from source.',
+                },
+            },
+        },
+    },
+    {
+        name: 'securecode.fix',
+        description: 'Generate a patch for a specific vulnerability finding. REQUIRES human approval before executing. Returns the fixed code + diff + explanation. Does NOT auto-apply; the human reviews and applies the patch.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                code: {
+                    type: 'string',
+                    description: 'The source code containing the vulnerability.',
+                },
+                filePath: {
+                    type: 'string',
+                    description: 'Workspace-relative path to the file (reads from disk if code is omitted).',
+                },
+                language: {
+                    type: 'string',
+                    description: 'Language id (javascript, typescript, python, php).',
+                },
+                vulnerabilityType: {
+                    type: 'string',
+                    description: 'Vulnerability type (e.g. sql_injection, xss, missing_authorization).',
+                },
+                lineStart: {
+                    type: 'number',
+                    description: '1-indexed start line of the finding.',
+                },
+                lineEnd: {
+                    type: 'number',
+                    description: '1-indexed end line of the finding.',
+                },
+                evidenceSnippet: {
+                    type: 'string',
+                    description: 'The vulnerable code snippet.',
+                },
+                framework: {
+                    type: 'string',
+                    description: 'Optional framework hint (e.g. express, nextjs, fastapi).',
+                },
+            },
+            required: ['code', 'language', 'vulnerabilityType', 'lineStart', 'lineEnd', 'evidenceSnippet'],
+        },
+    },
+    {
+        name: 'securecode.attack',
+        description: 'Request an endpoint red-team attack against a localhost dev server. REQUIRES human approval. The target must be a mapped endpoint from the Project Map and the dev server must already be running on localhost. Beta: localhost targets only.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                filePath: {
+                    type: 'string',
+                    description: 'Workspace-relative path to the source file containing the endpoint.',
+                },
+                code: {
+                    type: 'string',
+                    description: 'Source code to analyze (if filePath is omitted).',
+                },
+                language: {
+                    type: 'string',
+                    description: 'Language id.',
+                },
+                vulnerabilityType: {
+                    type: 'string',
+                    description: 'Optional — skip auto-scan and attack this vulnerability type.',
+                },
+                lineStart: {
+                    type: 'number',
+                    description: 'Optional — 1-indexed start line of the finding to attack.',
+                },
+                lineEnd: {
+                    type: 'number',
+                    description: 'Optional — 1-indexed end line of the finding.',
+                },
+                evidenceSnippet: {
+                    type: 'string',
+                    description: 'Optional — vulnerable code snippet for the finding.',
+                },
+            },
+        },
+    },
+];
+//# sourceMappingURL=tools.js.map

package/dist/mcp/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":";;;AAEa,QAAA,KAAK,GAAc;IAC5B;QACI,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACP,qPAAqP;QACzP,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0FAA0F;iBAC1G;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uFAAuF;iBACvG;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,mQAAmQ;QACvQ,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,MAAM,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC;oBACtC,WAAW,EAAE,6HAA6H;iBAC7I;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,6MAA6M;QACjN,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2EAA2E;iBAC3F;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oDAAoD;iBACpE;gBACD,iBAAiB,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sEAAsE;iBACtF;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sCAAsC;iBACtD;gBACD,OAAO,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oCAAoC;iBACpD;gBACD,eAAe,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,8BAA8B;iBAC9C;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0DAA0D;iBAC1E;aACJ;YACD,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC;SACjG;KACJ;IACD;QACI,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACP,+OAA+O;QACnP,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qEAAqE;iBACrF;gBACD,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kDAAkD;iBAClE;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,cAAc;iBAC9B;gBACD,iBAAiB,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+DAA+D;iBAC/E;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2DAA2D;iBAC3E;gBACD,OAAO,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,eAAe,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qDAAqD;iBACrE;aACJ;SACJ;KACJ;CACJ,CAAC"}

package/dist/mcp/types.d.ts

@@ -0,0 +1,26 @@
+export interface JsonRpcRequest {
+    jsonrpc: '2.0';
+    id?: number | string | null;
+    method: string;
+    params?: unknown;
+}
+export interface JsonRpcResponse {
+    jsonrpc: '2.0';
+    id: number | string | null;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+export interface ToolDef {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+}
+export interface ServerContext {
+    apiUrl: string;
+    apiToken: string;
+    workspaceRoot: string;
+}

package/dist/mcp/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/mcp/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/mcp/types.ts"],"names":[],"mappings":""}

package/dist/project-map/astHelpers.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Phase 4 — generic Tree-sitter AST helpers shared by Layer 1 (static
+ * extraction) and Layer 2 (dynamic detection). Keeping them in one place
+ * means the two layers share the same notion of "a call to X" and "a
+ * string literal at this position".
+ */
+import { TreeSitterNode } from './parserLoader';
+/** Walk the tree depth-first, yielding every named + unnamed node. */
+export declare function walk(node: TreeSitterNode): Iterable<TreeSitterNode>;
+/** Walk named nodes only (skips punctuation/brackets). */
+export declare function walkNamed(node: TreeSitterNode): Iterable<TreeSitterNode>;
+/** True iff node is a string-literal node (JS/TS/Python all share 'string'). */
+export declare function isStringLiteral(node: TreeSitterNode): boolean;
+/** True iff node is an identifier (variable reference). */
+export declare function isIdentifier(node: TreeSitterNode): boolean;
+/** Get the text of a string literal without the surrounding quotes. */
+export declare function stringLiteralValue(node: TreeSitterNode, source: string): string;
+/**
+ * Find the first ancestor matching a predicate.
+ */
+export declare function firstAncestor(node: TreeSitterNode, pred: (n: TreeSitterNode) => boolean): TreeSitterNode | null;
+/**
+ * For a call_expression like `app.get('/x', mw, handler)`, return the parts:
+ *   { receiver: 'app', method: 'get', args: [nodes...] }
+ * Works for Python calls too (`app.get("/x", handler)`) because both
+ * grammars expose call_expression with function being a member_expression.
+ */
+export interface CallParts {
+    /**
+     * The BASE identifier the call is rooted at ('app', 'router', 'res',
+     * 'prisma'), or null for a free call.
+     *
+     * This is the base of the whole access chain, not the immediately
+     * preceding expression: for `res.status(201).json(x)` the receiver is
+     * `res`, not the text `res.status(201)`. Callers universally want to ask
+     * "is this a call on the response object / the app / an imported module",
+     * and comparing against the literal preceding text answers that question
+     * wrongly the moment a chained call appears.
+     */
+    receiver: string | null;
+    /** The full receiver expression as written, for display. */
+    receiverText: string | null;
+    /** The method name ('get', 'use', 'post', ...). */
+    method: string;
+    /** Argument nodes (positional). */
+    args: TreeSitterNode[];
+    /** Source-line of the call (0-indexed). */
+    line: number;
+}
+/**
+ * Walk an access chain down to the identifier it is rooted at.
+ *
+ * `res.status(201)` -> `res`, `prisma.user` -> `prisma`,
+ * `supabase.from('x').select('*')` -> `supabase`. Returns null when the chain
+ * bottoms out in something that is not an identifier (a literal, `this`, an
+ * immediately-invoked function), in which case callers fall back to the text.
+ */
+export declare function baseIdentifier(node: TreeSitterNode, source: string): string | null;
+/** Parse a call node into CallParts. Returns null if not a recognizable call. */
+export declare function callParts(callNode: TreeSitterNode, source: string): CallParts | null;
+/**
+ * Resolve an identifier to a string value when it's defined as a
+ * simple const/variable assignment to a string literal IN THE SAME FILE.
+ * Used for intra-file dataflow confidence (0.6).
+ *
+ * `assignments` is a map of variableName -> stringLiteralValue, built by
+ * a pre-pass over the file.
+ */
+export declare function resolveIdentifier(name: string, assignments: Map<string, string>): string | null;
+/**
+ * Build a map of `name -> string literal value` for every
+ *   const X = 'literal'  /  let X = 'literal'  /  X = 'literal'
+ * in the file. Also handles Python `X = 'literal'` at module level.
+ */
+export declare function collectStringAssignments(root: TreeSitterNode, source: string): Map<string, string>;
+/**
+ * Normalise a Python module reference into the same relative-path shape the
+ * JS/TS import specs use, so one resolver handles both.
+ *
+ *   `.deps`      -> `./deps`
+ *   `..models`   -> `../models`
+ *   `.`          -> `./`
+ *   `sqlalchemy.orm` -> unchanged (absolute; matched by name, not resolved)
+ */
+export declare function pythonModuleSpec(mod: string): string;
+/** Collect every import in the file as { localName -> sourceSpec }. */
+export declare function collectImports(root: TreeSitterNode, source: string): Map<string, string>;
+/** Resolve a module spec like './middleware/auth' to an absolute file path. */
+export declare function resolveModulePath(spec: string, fromFile: string, workspaceRoot: string): string | null;