@securecode-ai/mcp 0.2.1 → 0.3.0

package/dist/dependency/parsers/yarn.js

@@ -0,0 +1,153 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseYarnLockfile = parseYarnLockfile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const lockfile_1 = require("@yarnpkg/lockfile");
+/**
+ * Parse a yarn v1 `yarn.lock` (the classic format). v2+ (Berry) uses a
+ * different text format and is NOT covered here — we deliberately bail in
+ * that case so the caller can skip the file gracefully.
+ *
+ * yarn v1 lockfiles contain the resolved transitive tree: every package
+ * entry has a `version` and a `resolved` URL, including transitive deps.
+ */
+function parseYarnLockfile(lockfilePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(lockfilePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    // Detect Yarn Berry (v2+) which uses a different format. The classic
+    // parser will produce garbage on it, so bail.
+    if (raw.includes('__metadata:')) {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = (0, lockfile_1.parse)(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || parsed.type !== 'success') {
+        // 'merge' / 'conflict' lockfiles are not directly usable.
+        return null;
+    }
+    const manifestPath = path.join(path.dirname(lockfilePath), 'package.json');
+    let projectLicense;
+    try {
+        const pkg = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        if (typeof pkg.license === 'string')
+            projectLicense = pkg.license;
+        else if (pkg.license && typeof pkg.license === 'object' && typeof pkg.license.type === 'string') {
+            projectLicense = pkg.license.type;
+        }
+    }
+    catch {
+        // optional
+    }
+    // Collect direct dependency names from package.json so we can flag direct vs transitive.
+    const directNames = new Set();
+    try {
+        const pkg = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        for (const k of Object.keys(pkg.dependencies || {}))
+            directNames.add(k);
+        for (const k of Object.keys(pkg.devDependencies || {}))
+            directNames.add(k);
+        for (const k of Object.keys(pkg.optionalDependencies || {}))
+            directNames.add(k);
+    }
+    catch {
+        // optional
+    }
+    const packages = [];
+    const seen = new Set();
+    const obj = parsed.object;
+    for (const [key, entry] of Object.entries(obj)) {
+        // Key looks like "@scope/name@version, @scope/name@npm:^1.2.3, ..."
+        // The actual package name is everything up to the last "@" that
+        // is not part of a scoped leading "@". We pull the canonical name
+        // from the entry itself when possible (yarn exposes `name` only in
+        // some versions), otherwise from the key.
+        const name = extractYarnName(key);
+        const version = entry.version;
+        if (!name || !version)
+            continue;
+        const id = `${name}@${version}`;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        packages.push({
+            ecosystem: 'yarn',
+            name,
+            version,
+            manifestPath,
+            direct: directNames.has(name),
+        });
+    }
+    return {
+        ecosystem: 'yarn',
+        lockfilePath,
+        manifestPath,
+        packages,
+        projectLicense,
+    };
+}
+/**
+ * Extract the package name from a yarn lockfile key.
+ * Examples:
+ *   "lodash@^4.17.19"                       -> "lodash"
+ *   "@babel/core@^7.0.0"                    -> "@babel/core"
+ *   "lodash@npm:^4.17.19, lodash@^4.17.20"  -> "lodash"
+ */
+function extractYarnName(key) {
+    const first = key.split(',')[0].trim();
+    // For scoped: leading "@" then name then "@version"
+    if (first.startsWith('@')) {
+        const at = first.indexOf('@', 1);
+        if (at < 0)
+            return undefined;
+        return first.slice(0, at);
+    }
+    const at = first.indexOf('@');
+    if (at < 0)
+        return undefined;
+    return first.slice(0, at);
+}
+//# sourceMappingURL=yarn.js.map

package/dist/dependency/parsers/yarn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yarn.js","sourceRoot":"","sources":["../../../src/dependency/parsers/yarn.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaA,8CA+EC;AA5FD,uCAAyB;AACzB,2CAA6B;AAC7B,gDAAiG;AAGjG;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,YAAoB;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,qEAAqE;IACrE,8CAA8C;IAC9C,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,MAA0E,CAAC;IAC/E,IAAI,CAAC;QACD,MAAM,GAAG,IAAA,gBAAa,EAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC,CAAC;IAC3E,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC;aAC7D,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,WAAW;IACf,CAAC;IAED,yFAAyF;IACzF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACL,WAAW;IACf,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,MAA8C,CAAC;IAClE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,mEAAmE;QACnE,0CAA0C;QAC1C,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS;QAChC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC;YACV,SAAS,EAAE,MAAM;YACjB,IAAI;YACJ,OAAO;YACP,YAAY;YACZ,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;SAChC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,SAAS,EAAE,MAAM;QACjB,YAAY;QACZ,YAAY;QACZ,QAAQ;QACR,cAAc;KACjB,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,oDAAoD;IACpD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC"}

package/dist/dependency/resolver.d.ts

@@ -0,0 +1,28 @@
+import { ParsedLockfile, ResolvedPackage } from './types';
+export interface WorkspaceLockfiles {
+    npm: string[];
+    yarn: string[];
+    pnpm: string[];
+    pipenv: string[];
+    pip: string[];
+}
+/**
+ * Walk the workspace looking for known lockfiles. Skips `node_modules`,
+ * `.git`, `.venv`, `venv`, and `dist` to avoid duplicate hits from
+ * vendored deps.
+ */
+export declare function findLockfiles(workspaceRoot: string): WorkspaceLockfiles;
+/** Parse a single lockfile path into a ParsedLockfile (or null). */
+export declare function parseLockfile(lockfilePath: string): ParsedLockfile | null;
+/**
+ * Resolve the full transitive dependency set across all parsed lockfiles.
+ *
+ * The "resolution" is essentially deduplication:
+ *   - Same (ecosystem-family, name, version) seen in two lockfiles is reported once.
+ *   - `family` collapses npm/yarn/pnpm into one (they share the npm registry)
+ *     so a dep found in both package-lock.json and yarn.lock is not queried twice.
+ *   - pip/pipenv are similarly collapsed into one PyPI family.
+ *
+ * Returns the flat list of resolved packages ready for OSV batching.
+ */
+export declare function resolveAll(parsed: ParsedLockfile[]): ResolvedPackage[];

package/dist/dependency/resolver.js

@@ -0,0 +1,159 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findLockfiles = findLockfiles;
+exports.parseLockfile = parseLockfile;
+exports.resolveAll = resolveAll;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const npm_1 = require("./parsers/npm");
+const yarn_1 = require("./parsers/yarn");
+const pnpm_1 = require("./parsers/pnpm");
+const requirements_1 = require("./parsers/requirements");
+const pipfile_1 = require("./parsers/pipfile");
+/**
+ * The "resolver". For npm/yarn/pnpm/Pipfile.lock the lockfile ALREADY contains
+ * the fully-resolved transitive tree, so resolving = walking it (no network).
+ * For requirements.txt with no lockfile, entries are already individual; we
+ * just propagate `unresolved` flags so the checker can surface them instead
+ * of querying OSV with a version we don't actually know.
+ *
+ * This module is also responsible for finding lockfiles in the workspace.
+ */
+const LOCKFILE_NAMES = [
+    { name: 'package-lock.json', ecosystem: 'npm' },
+    { name: 'yarn.lock', ecosystem: 'yarn' },
+    { name: 'pnpm-lock.yaml', ecosystem: 'pnpm' },
+    { name: 'Pipfile.lock', ecosystem: 'pipenv' },
+    { name: 'requirements.txt', ecosystem: 'pip' },
+];
+/**
+ * Walk the workspace looking for known lockfiles. Skips `node_modules`,
+ * `.git`, `.venv`, `venv`, and `dist` to avoid duplicate hits from
+ * vendored deps.
+ */
+function findLockfiles(workspaceRoot) {
+    const out = { npm: [], yarn: [], pnpm: [], pipenv: [], pip: [] };
+    const skip = new Set(['node_modules', '.git', '.venv', 'venv', 'env', 'dist', 'build', '.next', '.turbo']);
+    const walk = (dir, depth) => {
+        if (depth > 8)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (skip.has(e.name))
+                    continue;
+                walk(full, depth + 1);
+            }
+            else if (e.isFile()) {
+                for (const lf of LOCKFILE_NAMES) {
+                    if (e.name === lf.name) {
+                        out[lf.ecosystem].push(full);
+                        break;
+                    }
+                }
+            }
+        }
+    };
+    walk(workspaceRoot, 0);
+    // De-duplicate by directory+ecosystem (a project should only have one
+    // lockfile per ecosystem per folder, but monorepos can have several).
+    const dedup = (arr) => Array.from(new Set(arr));
+    out.npm = dedup(out.npm);
+    out.yarn = dedup(out.yarn);
+    out.pnpm = dedup(out.pnpm);
+    out.pipenv = dedup(out.pipenv);
+    out.pip = dedup(out.pip);
+    return out;
+}
+/** Parse a single lockfile path into a ParsedLockfile (or null). */
+function parseLockfile(lockfilePath) {
+    const base = path.basename(lockfilePath);
+    switch (base) {
+        case 'package-lock.json':
+            return (0, npm_1.parseNpmLockfile)(lockfilePath);
+        case 'yarn.lock':
+            return (0, yarn_1.parseYarnLockfile)(lockfilePath);
+        case 'pnpm-lock.yaml':
+            return (0, pnpm_1.parsePnpmLockfile)(lockfilePath);
+        case 'Pipfile.lock':
+            return (0, pipfile_1.parsePipfileLock)(lockfilePath);
+        case 'requirements.txt':
+            return (0, requirements_1.parseRequirementsTxt)(lockfilePath);
+        default:
+            return null;
+    }
+}
+/**
+ * Resolve the full transitive dependency set across all parsed lockfiles.
+ *
+ * The "resolution" is essentially deduplication:
+ *   - Same (ecosystem-family, name, version) seen in two lockfiles is reported once.
+ *   - `family` collapses npm/yarn/pnpm into one (they share the npm registry)
+ *     so a dep found in both package-lock.json and yarn.lock is not queried twice.
+ *   - pip/pipenv are similarly collapsed into one PyPI family.
+ *
+ * Returns the flat list of resolved packages ready for OSV batching.
+ */
+function resolveAll(parsed) {
+    const familyOf = (e) => e === 'pip' || e === 'pipenv' ? 'pypi' : 'npm';
+    const seen = new Set();
+    const out = [];
+    for (const lf of parsed) {
+        if (!lf)
+            continue;
+        for (const pkg of lf.packages) {
+            // For npm-family, names are case-sensitive on disk but the registry
+            // treats them case-insensitively for lookup; normalize to lower for
+            // dedup so we don't double-query OSV.
+            const fam = familyOf(pkg.ecosystem);
+            const nameKey = fam === 'npm' ? pkg.name : pkg.name.toLowerCase();
+            const id = `${fam}:${nameKey}@${pkg.version || 'unknown'}`;
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            out.push(pkg);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=resolver.js.map

package/dist/dependency/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/dependency/resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,sCAsCC;AAGD,sCAgBC;AAaD,gCAqBC;AAnID,uCAAyB;AACzB,2CAA6B;AAE7B,uCAAiD;AACjD,yCAAmD;AACnD,yCAAmD;AACnD,yDAA8D;AAC9D,+CAAqD;AAErD;;;;;;;;GAQG;AAEH,MAAM,cAAc,GAAkD;IAClE,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE;IAC/C,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE;IACxC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE;IAC7C,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE;IAC7C,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,EAAE;CACjD,CAAC;AAUF;;;;GAIG;AACH,SAAgB,aAAa,CAAC,aAAqB;IAC/C,MAAM,GAAG,GAAuB,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE3G,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE;QACxC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO;QACtB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACD,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACL,OAAO;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAClB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC/B,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpB,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;oBAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;wBACrB,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAC7B,MAAM;oBACV,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAEvB,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,KAAK,GAAG,CAAC,GAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,SAAgB,aAAa,CAAC,YAAoB;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,mBAAmB;YACpB,OAAO,IAAA,sBAAgB,EAAC,YAAY,CAAC,CAAC;QAC1C,KAAK,WAAW;YACZ,OAAO,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QAC3C,KAAK,gBAAgB;YACjB,OAAO,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QAC3C,KAAK,cAAc;YACf,OAAO,IAAA,0BAAgB,EAAC,YAAY,CAAC,CAAC;QAC1C,KAAK,kBAAkB;YACnB,OAAO,IAAA,mCAAoB,EAAC,YAAY,CAAC,CAAC;QAC9C;YACI,OAAO,IAAI,CAAC;IACpB,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,UAAU,CAAC,MAAwB;IAC/C,MAAM,QAAQ,GAAG,CAAC,CAAY,EAAkB,EAAE,CAC9C,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5B,oEAAoE;YACpE,oEAAoE;YACpE,sCAAsC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClE,MAAM,EAAE,GAAG,GAAG,GAAG,IAAI,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/dependency/types.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Shared types for the dependency vulnerability checker (Phase 2).
+ *
+ * No source code is ever sent anywhere — only package name + version strings
+ * leave the machine, to OSV.dev (free, no key) and GitHub Advisory REST API
+ * (free, no key for 60 req/hr; 5000 req/hr with optional token). NVD is an
+ * optional CVSS fallback.
+ */
+/** Ecosystems we can parse a lockfile for. */
+export type Ecosystem = 'npm' | 'yarn' | 'pnpm' | 'pip' | 'pipenv';
+/** OSV ecosystem identifier used in OSV.dev API payloads. */
+export type OsvEcosystem = 'npm' | 'PyPI';
+/**
+ * A single resolved dependency as extracted from a lockfile.
+ * For npm/yarn/pnpm this is a transitive entry straight out of the lockfile
+ * (so the resolver does not need to hit the network). For requirements.txt
+ * without a Pipfile.lock, entries may be marked `unresolved` instead of
+ * fetching a registry.
+ */
+export interface ResolvedPackage {
+    ecosystem: Ecosystem;
+    /** Package name as the registry knows it (PyPI names are normalized to lower). */
+    name: string;
+    /** Resolved version (semver for JS, PEP 440-ish for Python). */
+    version: string;
+    /** SPDX license identifier when available from lockfile/metadata, else undefined. */
+    license?: string;
+    /** Path to the manifest this entry came from (for Apply affordance). */
+    manifestPath?: string;
+    /**
+     * True when the version could not be resolved locally (e.g. requirements.txt
+     * pin like `>=1.0` with no lockfile). These are reported as "unresolved"
+     * findings rather than queried against OSV (since we don't know the version).
+     */
+    unresolved?: boolean;
+    /** Direct dependency (declared in manifest) vs transitive (resolved from lockfile). */
+    direct?: boolean;
+}
+/** Output of a lockfile parser. */
+export interface ParsedLockfile {
+    ecosystem: Ecosystem;
+    /** Path to the lockfile that was parsed. */
+    lockfilePath: string;
+    /** Path to the manifest the lockfile corresponds to (package.json, requirements.txt, ...). */
+    manifestPath?: string;
+    /** All resolved packages, direct + transitive. */
+    packages: ResolvedPackage[];
+    /** SPDX license of the project itself, if discoverable (npm package.json `license`). */
+    projectLicense?: string;
+}
+/** An affected version range as returned by OSV / GHSA. */
+export interface AffectedRange {
+    /** OSV ecosystem ('npm' | 'PyPI'). */
+    ecosystem: OsvEcosystem;
+    /** Lower bound of the affected range, inclusive (optional). */
+    introduced?: string;
+    /** Upper bound of the affected range, exclusive (the "first fixed" version). */
+    fixed?: string;
+    /** Raw range string for diagnostics. */
+    raw?: string;
+}
+/** A vulnerability record normalized from OSV / GHSA / NVD. */
+export interface Vulnerability {
+    /** OSV id (OSV-...) or GHSA id (GHSA-...) or CVE id (CVE-...). */
+    id: string;
+    /** Source the record came from. */
+    source: 'osv' | 'ghsa' | 'nvd';
+    /** One-line summary. */
+    summary: string;
+    /** List of affected version ranges. */
+    affected: AffectedRange[];
+    /** CVSS v3 base score 0-10 when known (NVD or OSV severity). */
+    cvssScore?: number;
+    /** URLs for the user to read more. */
+    references?: string[];
+}
+/** A vulnerability matched to a resolved package. */
+export interface MatchedVulnerability {
+    /** The resolved package that is vulnerable. */
+    package: ResolvedPackage;
+    /** Vulnerabilities affecting `package.version`. */
+    vulnerabilities: Vulnerability[];
+    /** Smallest version bump that exits all affected ranges, when computable. */
+    minSafeVersion?: string;
+}

package/dist/dependency/types.js

@@ -0,0 +1,11 @@
+"use strict";
+/**
+ * Shared types for the dependency vulnerability checker (Phase 2).
+ *
+ * No source code is ever sent anywhere — only package name + version strings
+ * leave the machine, to OSV.dev (free, no key) and GitHub Advisory REST API
+ * (free, no key for 60 req/hr; 5000 req/hr with optional token). NVD is an
+ * optional CVSS fallback.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/dependency/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/dependency/types.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG"}

package/dist/mcp/server.js

@@ -40,6 +40,7 @@ const scan_1 = require("../tools/scan");
 const map_1 = require("../tools/map");
 const fix_1 = require("../tools/fix");
 const attack_1 = require("../tools/attack");
+const scanDependencies_1 = require("../tools/scanDependencies");
 const PROTOCOL_VERSION = '2025-03-26';
 const SERVER_NAME = 'securecode-mcp';
 const SERVER_VERSION = '0.2.0';
@@ -68,6 +69,7 @@ const TOOL_HANDLERS = {
     'securecode.map': map_1.toolMap,
     'securecode.fix': fix_1.toolFix,
     'securecode.attack': attack_1.toolAttack,
+    'securecode.scan-dependencies': scanDependencies_1.toolScanDependencies,
 };
 function validateArgs(tool, args) {
     const schema = tool.inputSchema;

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuIA,kCA4CC;AAnLD,mDAAqC;AAErC,mCAAgC;AAChC,wCAAyC;AACzC,sCAAuC;AACvC,sCAAuC;AACvC,4CAA6C;AAE7C,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAS,IAAI,CAAC,GAA2E;IACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,EAA0B,EAAE,KAAc;IACtD,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,EAA0B,EAAE,IAAY,EAAE,OAAe,EAAE,IAAc;IACpF,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,aAA0C,EAAE,QAAgB,EAAE,KAAa,EAAE,OAAe;IAC9G,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO;IACxC,IAAI,CAAC;QACD,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;KACtD,CAAC,CAAC;AACP,CAAC;AAED,MAAM,aAAa,GAAwE;IACvF,iBAAiB,EAAE,eAAQ;IAC3B,gBAAgB,EAAE,aAAO;IACzB,gBAAgB,EAAE,aAAO;IACzB,mBAAmB,EAAE,mBAAU;CAClC,CAAC;AAEF,SAAS,YAAY,CAAC,IAAa,EAAE,IAAS;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,WAGnB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,+BAA+B,IAAI,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC;QACpE,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACjE,MAAM,EAAE,GACJ,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;YACnD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7E,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC;oBACrD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC5E,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;4BAC7C,IAAI,CAAC;QACT,IAAI,CAAC,EAAE,EAAE,CAAC;YACN,OAAO,cAAc,IAAI,QAAQ,IAAI,CAAC,IAAI,cAAc,QAAQ,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC;QAC9H,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAmB;IAChE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,IAAI,CAAC;QACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,WAAW,GAAG,IAAI,CAAC;gBACnB,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,eAAe,EAAE,gBAAgB;wBACjC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;wBAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;qBAC7D;iBACJ,CAAC;YACN,CAAC;YACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,aAAK,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAoF,CAAC;gBACrH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;gBACpC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;gBAClD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,aAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC5C,IAAI,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBACD,iDAAiD;gBACjD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAC9B,IAAI,CAAC,SAAS,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,OAAe,EAAE,EAAE,CAClE,YAAY,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7C,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;qBAC1E;iBACJ,CAAC;YACN,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACN,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACxC,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACvG,CAAC;QACL,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;AACL,CAAC;AAED,SAAgB,WAAW,CAAC,GAAkB;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/E,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACL,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACnC,OAAO;QACX,CAAC;QAED,IACI,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,OAAQ,MAAyB,CAAC,MAAM,KAAK,QAAQ,EACvD,CAAC;YACC,MAAM,OAAO,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC1D,CAAC,CAAE,MAAyB,CAAC,EAAE,IAAI,IAAI;gBACvC,CAAC,CAAC,IAAI,CAAC;YACf,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QAED,MAAM,GAAG,GAAG,MAAwB,CAAC;QACrC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyIA,kCA4CC;AArLD,mDAAqC;AAErC,mCAAgC;AAChC,wCAAyC;AACzC,sCAAuC;AACvC,sCAAuC;AACvC,4CAA6C;AAC7C,gEAAiE;AAEjE,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAS,IAAI,CAAC,GAA2E;IACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,EAA0B,EAAE,KAAc;IACtD,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,EAA0B,EAAE,IAAY,EAAE,OAAe,EAAE,IAAc;IACpF,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,aAA0C,EAAE,QAAgB,EAAE,KAAa,EAAE,OAAe;IAC9G,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO;IACxC,IAAI,CAAC;QACD,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;KACtD,CAAC,CAAC;AACP,CAAC;AAED,MAAM,aAAa,GAAwE;IACvF,iBAAiB,EAAE,eAAQ;IAC3B,gBAAgB,EAAE,aAAO;IACzB,gBAAgB,EAAE,aAAO;IACzB,mBAAmB,EAAE,mBAAU;IAC/B,8BAA8B,EAAE,uCAAoB;CACvD,CAAC;AAEF,SAAS,YAAY,CAAC,IAAa,EAAE,IAAS;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,WAGnB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,+BAA+B,IAAI,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC;QACpE,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACjE,MAAM,EAAE,GACJ,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;YACnD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7E,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC;oBACrD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC5E,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;4BAC7C,IAAI,CAAC;QACT,IAAI,CAAC,EAAE,EAAE,CAAC;YACN,OAAO,cAAc,IAAI,QAAQ,IAAI,CAAC,IAAI,cAAc,QAAQ,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC;QAC9H,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAmB;IAChE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,IAAI,CAAC;QACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,WAAW,GAAG,IAAI,CAAC;gBACnB,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,eAAe,EAAE,gBAAgB;wBACjC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;wBAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;qBAC7D;iBACJ,CAAC;YACN,CAAC;YACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,aAAK,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAoF,CAAC;gBACrH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;gBACpC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;gBAClD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,aAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC5C,IAAI,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBACD,iDAAiD;gBACjD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAC9B,IAAI,CAAC,SAAS,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,OAAe,EAAE,EAAE,CAClE,YAAY,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7C,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;qBAC1E;iBACJ,CAAC;YACN,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACN,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACxC,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACvG,CAAC;QACL,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;AACL,CAAC;AAED,SAAgB,WAAW,CAAC,GAAkB;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/E,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACL,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACnC,OAAO;QACX,CAAC;QAED,IACI,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,OAAQ,MAAyB,CAAC,MAAM,KAAK,QAAQ,EACvD,CAAC;YACC,MAAM,OAAO,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC1D,CAAC,CAAE,MAAyB,CAAC,EAAE,IAAI,IAAI;gBACvC,CAAC,CAAC,IAAI,CAAC;YACf,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QAED,MAAM,GAAG,GAAG,MAAwB,CAAC;QACrC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/mcp/tools.js

@@ -116,5 +116,13 @@ exports.TOOLS = [
             },
         },
     },
+    {
+        name: 'securecode.scan-dependencies',
+        description: 'Scan local lockfiles for known vulnerabilities using OSV.dev + GitHub Advisory + NVD. Read-only: no approval needed. Runs entirely locally — only package name+version leave the machine. Supports package-lock.json, yarn.lock, pnpm-lock.yaml, Pipfile.lock, requirements.txt. Returns findings with severity, installed version, fix version, and license info.',
+        inputSchema: {
+            type: 'object',
+            properties: {},
+        },
+    },
 ];
 //# sourceMappingURL=tools.js.map

package/dist/mcp/tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":";;;AAEa,QAAA,KAAK,GAAc;IAC5B;QACI,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACP,qPAAqP;QACzP,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0FAA0F;iBAC1G;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uFAAuF;iBACvG;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,mQAAmQ;QACvQ,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,MAAM,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC;oBACtC,WAAW,EAAE,6HAA6H;iBAC7I;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,6MAA6M;QACjN,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2EAA2E;iBAC3F;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oDAAoD;iBACpE;gBACD,iBAAiB,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sEAAsE;iBACtF;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sCAAsC;iBACtD;gBACD,OAAO,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oCAAoC;iBACpD;gBACD,eAAe,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,8BAA8B;iBAC9C;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0DAA0D;iBAC1E;aACJ;YACD,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC;SACjG;KACJ;IACD;QACI,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACP,+OAA+O;QACnP,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qEAAqE;iBACrF;gBACD,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kDAAkD;iBAClE;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,cAAc;iBAC9B;gBACD,iBAAiB,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+DAA+D;iBAC/E;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2DAA2D;iBAC3E;gBACD,OAAO,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,eAAe,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qDAAqD;iBACrE;aACJ;SACJ;KACJ;CACJ,CAAC"}
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":";;;AAEa,QAAA,KAAK,GAAc;IAC5B;QACI,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACP,qPAAqP;QACzP,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0FAA0F;iBAC1G;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uFAAuF;iBACvG;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,mQAAmQ;QACvQ,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,MAAM,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC;oBACtC,WAAW,EAAE,6HAA6H;iBAC7I;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,6MAA6M;QACjN,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2EAA2E;iBAC3F;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oDAAoD;iBACpE;gBACD,iBAAiB,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sEAAsE;iBACtF;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sCAAsC;iBACtD;gBACD,OAAO,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oCAAoC;iBACpD;gBACD,eAAe,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,8BAA8B;iBAC9C;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0DAA0D;iBAC1E;aACJ;YACD,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC;SACjG;KACJ;IACD;QACI,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACP,+OAA+O;QACnP,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qEAAqE;iBACrF;gBACD,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kDAAkD;iBAClE;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,cAAc;iBAC9B;gBACD,iBAAiB,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+DAA+D;iBAC/E;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2DAA2D;iBAC3E;gBACD,OAAO,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,eAAe,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qDAAqD;iBACrE;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACP,oWAAoW;QACxW,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE;SACjB;KACJ;CACJ,CAAC"}

package/dist/tools/scanDependencies.d.ts

@@ -0,0 +1,11 @@
+import type { ServerContext } from '../mcp/types';
+/**
+ * securecode.scan-dependencies — scan local lockfiles for known vulnerabilities.
+ *
+ * Read-only: no approval needed. Runs entirely locally — only package name+version
+ * leave the machine (to OSV.dev, GitHub Advisory, NVD). No source code is sent.
+ *
+ * Supports 5 lockfile types: package-lock.json, yarn.lock, pnpm-lock.yaml,
+ * Pipfile.lock, requirements.txt.
+ */
+export declare function toolScanDependencies(ctx: ServerContext, _args: any): Promise<unknown>;

package/dist/tools/scanDependencies.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolScanDependencies = toolScanDependencies;
+const dependencyChecker_1 = require("../dependency/dependencyChecker");
+const depCache_1 = require("../dependency/depCache");
+/**
+ * securecode.scan-dependencies — scan local lockfiles for known vulnerabilities.
+ *
+ * Read-only: no approval needed. Runs entirely locally — only package name+version
+ * leave the machine (to OSV.dev, GitHub Advisory, NVD). No source code is sent.
+ *
+ * Supports 5 lockfile types: package-lock.json, yarn.lock, pnpm-lock.yaml,
+ * Pipfile.lock, requirements.txt.
+ */
+async function toolScanDependencies(ctx, _args) {
+    const cache = new depCache_1.FileCacheStore(ctx.workspaceRoot);
+    const result = await (0, dependencyChecker_1.scanDependencies)({
+        workspaceRoot: ctx.workspaceRoot,
+        state: cache,
+        licensePolicy: 'warn',
+        useGhsa: true,
+    });
+    return {
+        findings: result.findings.map((f) => ({
+            check_id: f.check_id,
+            severity: f.severity,
+            message: f.message,
+            source: f.source,
+            dependency: f.dependency,
+        })),
+        packageCount: result.packageCount,
+        unresolvedCount: result.unresolvedCount,
+        lockfiles: result.lockfiles,
+        ghsaSkipped: result.ghsaSkipped ?? false,
+    };
+}
+//# sourceMappingURL=scanDependencies.js.map

package/dist/tools/scanDependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanDependencies.js","sourceRoot":"","sources":["../../src/tools/scanDependencies.ts"],"names":[],"mappings":";;AAaA,oDAuBC;AAnCD,uEAAmE;AACnE,qDAAwD;AAExD;;;;;;;;GAQG;AACI,KAAK,UAAU,oBAAoB,CAAC,GAAkB,EAAE,KAAU;IACrE,MAAM,KAAK,GAAG,IAAI,yBAAc,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAgB,EAAC;QAClC,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,MAAM;QACrB,OAAO,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,OAAO;QACH,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,KAAK;KAC3C,CAAC;AACN,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecode-ai/mcp",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Standalone SecureCode MCP server — scan, map, fix, and attack tools for AI coding assistants. Works without the VS Code extension.",
   "main": "dist/index.js",
   "bin": {
@@ -43,10 +43,17 @@
     "access": "public"
   },
   "dependencies": {
-    "web-tree-sitter": "0.26.11"
+    "@yarnpkg/lockfile": "^1.1.0",
+    "semver": "^7.5.4",
+    "spdx-correct": "^3.2.0",
+    "web-tree-sitter": "0.26.11",
+    "yaml": "^2.3.4"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",
+    "@types/semver": "^7.5.6",
+    "@types/spdx-correct": "^3.1.3",
+    "@types/yarnpkg__lockfile": "^1.1.9",
     "typescript": "^5.3.2",
     "vitest": "^2.1.0"
   }