@securecode-ai/mcp 0.3.8 → 0.4.0

package/dist/api/types.d.ts

@@ -2,7 +2,7 @@ export interface ScanRequest {
     code: string;
     language: string;
     filePath?: string;
-    scanDepth?: 'auto' | 'deep';
+    scanDepth?: 'auto' | 'deep' | 'agent';
     workspaceHints?: {
         frameworkHint?: string;
         relatedFiles?: Array<{
@@ -167,3 +167,21 @@ export interface ProjectMap {
     builtAt?: string;
     version?: number;
 }
+export interface SandboxProveResponse {
+    proven: 'PROVEN' | 'UNPROVEN' | 'INCONCLUSIVE' | 'NOT_REPRODUCIBLE';
+    canReproduce: boolean;
+    skipReason?: string;
+    rationale?: string;
+    degraded: boolean;
+    sandbox?: {
+        verdict: string;
+        rule: string;
+        reason: string;
+        serverBooted: boolean;
+        port: number;
+        elapsedMs: number;
+        baselineStatus?: number;
+        exploitStatus?: number;
+    };
+    scanCredits?: number;
+}

package/dist/attack/agentScanExecutor.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Scan agent executor — dispatches each agent action to the right tool
+ * and returns a redacted, truncated observation string.
+ *
+ * MCP-side tools (read_file, search_code, trace_flow, check_guard) run
+ * locally using tree-sitter + filesystem. API-side tools (check_policy)
+ * call POST /agent/scan/tool over the wire.
+ */
+import { ApiClient } from '../api/client';
+import type { ServerContext } from '../mcp/types';
+import type { AgentScanAction, AgentScanTarget } from './agentScanProtocol';
+export declare function executeAction(action: AgentScanAction, ctx: ServerContext, runId: string, client: ApiClient, target: AgentScanTarget): Promise<string>;

package/dist/attack/agentScanExecutor.js

@@ -0,0 +1,208 @@
+"use strict";
+/**
+ * Scan agent executor — dispatches each agent action to the right tool
+ * and returns a redacted, truncated observation string.
+ *
+ * MCP-side tools (read_file, search_code, trace_flow, check_guard) run
+ * locally using tree-sitter + filesystem. API-side tools (check_policy)
+ * call POST /agent/scan/tool over the wire.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeAction = executeAction;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const files_1 = require("../utils/files");
+const searchCode_1 = require("../utils/searchCode");
+const taintTracker_1 = require("../project-map/taintTracker");
+const guardEvaluator_1 = require("../project-map/guardEvaluator");
+const report_1 = require("./report");
+const MAX_OBSERVATION_CHARS = 8000;
+function truncate(text) {
+    if (text.length <= MAX_OBSERVATION_CHARS)
+        return text;
+    return text.slice(0, MAX_OBSERVATION_CHARS) + '\n… [truncated]';
+}
+function redact(text) {
+    return truncate((0, report_1.redactText)(text));
+}
+function toSinkLanguage(language) {
+    const map = {
+        javascript: 'javascript',
+        javascriptreact: 'javascript',
+        typescript: 'typescript',
+        typescriptreact: 'tsx',
+        python: 'python',
+    };
+    return map[language] || null;
+}
+function findFunctionInFile(source, functionName) {
+    // Simple heuristic: find a function/method declaration by name and
+    // extract its body by brace matching. Works for most JS/TS/Python.
+    const patterns = [
+        new RegExp(`(?:export\\s+)?(?:async\\s+)?function\\s+${escapeRegex(functionName)}\\s*\\(`),
+        new RegExp(`(?:const|let|var)\\s+${escapeRegex(functionName)}\\s*=\\s*(?:async\\s*)?\\(`),
+        new RegExp(`\\b${escapeRegex(functionName)}\\s*(?::\\s*[^=]+)?\\s*=\\s*(?:async\\s*)?\\(`),
+    ];
+    for (const pattern of patterns) {
+        const match = source.match(pattern);
+        if (!match)
+            continue;
+        const startIdx = match.index;
+        // Find opening brace
+        let braceStart = source.indexOf('{', startIdx);
+        if (braceStart === -1)
+            continue;
+        // Find matching close brace
+        let depth = 0;
+        let endIdx = -1;
+        for (let i = braceStart; i < source.length; i++) {
+            if (source[i] === '{')
+                depth++;
+            else if (source[i] === '}') {
+                depth--;
+                if (depth === 0) {
+                    endIdx = i;
+                    break;
+                }
+            }
+        }
+        if (endIdx !== -1) {
+            return source.slice(startIdx, endIdx + 1);
+        }
+    }
+    return null;
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+async function executeAction(action, ctx, runId, client, target) {
+    switch (action.type) {
+        case 'read_file': {
+            try {
+                const absPath = (0, files_1.resolveWorkspacePath)(ctx.workspaceRoot, action.path);
+                const content = fs.readFileSync(absPath, 'utf8');
+                const rel = path.relative(ctx.workspaceRoot, absPath).replace(/\\/g, '/');
+                const lines = content.split('\n').length;
+                const numbered = content
+                    .split('\n')
+                    .map((line, i) => `${i + 1}: ${line}`)
+                    .join('\n');
+                return redact(`File: ${rel} (${lines} lines)\n\n${numbered}`);
+            }
+            catch (e) {
+                return `Error reading file "${action.path}": ${e.message || e}`;
+            }
+        }
+        case 'search_code': {
+            try {
+                const result = await (0, searchCode_1.searchCode)(ctx.workspaceRoot, action.pattern, action.glob);
+                return redact((0, searchCode_1.formatSearchResult)(result));
+            }
+            catch (e) {
+                return `Error searching for "${action.pattern}": ${e.message || e}`;
+            }
+        }
+        case 'trace_flow': {
+            try {
+                const absPath = (0, files_1.resolveWorkspacePath)(ctx.workspaceRoot, action.filePath);
+                const content = fs.readFileSync(absPath, 'utf8');
+                const { language } = (0, files_1.readFileFromWorkspace)(ctx.workspaceRoot, action.filePath);
+                const sinkLang = toSinkLanguage(language);
+                if (!sinkLang) {
+                    return `Unsupported language for taint tracking: ${language}`;
+                }
+                const results = await (0, taintTracker_1.trackTaint)(content, sinkLang);
+                if (results.length === 0) {
+                    return `No taint flows found in ${action.filePath}.`;
+                }
+                const formatted = results.map(r => {
+                    const path = r.propagationPath
+                        .map(p => `  L${p.line} ${p.operation}: ${p.description}`)
+                        .join('\n');
+                    return `${r.source} (L${r.sourceLine}) → ${r.sink} (L${r.sinkLine}) [${r.canonicalType}]${r.isTainted ? ' TAINTED' : ' (sanitized)'}\n${path}`;
+                }).join('\n\n');
+                return redact(formatted);
+            }
+            catch (e) {
+                return `Error tracing flow in "${action.filePath}": ${e.message || e}`;
+            }
+        }
+        case 'check_guard': {
+            try {
+                const absPath = (0, files_1.resolveWorkspacePath)(ctx.workspaceRoot, action.filePath);
+                const content = fs.readFileSync(absPath, 'utf8');
+                const guardSource = findFunctionInFile(content, action.guardName);
+                if (!guardSource) {
+                    return `Guard function "${action.guardName}" not found in ${action.filePath}. Use search_code to find where it's defined.`;
+                }
+                const { language } = (0, files_1.readFileFromWorkspace)(ctx.workspaceRoot, action.filePath);
+                const sinkLang = toSinkLanguage(language);
+                if (!sinkLang) {
+                    return `Unsupported language for guard evaluation: ${language}`;
+                }
+                const result = await (0, guardEvaluator_1.evaluateGuard)(guardSource, action.guardName, action.attackType, sinkLang);
+                const effectiveStr = result.effective ? 'EFFECTIVE' : 'NOT EFFECTIVE';
+                let output = `Guard "${action.guardName}" vs ${action.attackType}: ${effectiveStr}\nReason: ${result.reason}`;
+                if (result.bypassExample) {
+                    output += `\nBypass: ${result.bypassExample}`;
+                }
+                return output;
+            }
+            catch (e) {
+                return `Error evaluating guard "${action.guardName}": ${e.message || e}`;
+            }
+        }
+        case 'check_policy': {
+            try {
+                const toolReq = {
+                    runId,
+                    action,
+                    target,
+                };
+                const resp = await client.postJson('/agent/scan/tool', toolReq);
+                return truncate(resp.observation);
+            }
+            catch (e) {
+                return `Error running check_policy: ${e.message || e}`;
+            }
+        }
+        case 'finish': {
+            // finish is handled by the loop, not the executor
+            return '';
+        }
+    }
+}
+//# sourceMappingURL=agentScanExecutor.js.map

package/dist/attack/agentScanExecutor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentScanExecutor.js","sourceRoot":"","sources":["../../src/attack/agentScanExecutor.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgFH,sCAsGC;AApLD,uCAAyB;AACzB,2CAA6B;AAG7B,0CAA6E;AAC7E,oDAAqE;AACrE,8DAAyD;AACzD,kEAA8D;AAE9D,qCAAsC;AAQtC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,SAAS,QAAQ,CAAC,IAAY;IAC1B,IAAI,IAAI,CAAC,MAAM,IAAI,qBAAqB;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,GAAG,iBAAiB,CAAC;AACpE,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IACxB,OAAO,QAAQ,CAAC,IAAA,mBAAU,EAAC,IAAI,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACpC,MAAM,GAAG,GAAiC;QACtC,UAAU,EAAE,YAAY;QACxB,eAAe,EAAE,YAAY;QAC7B,UAAU,EAAE,YAAY;QACxB,eAAe,EAAE,KAAK;QACtB,MAAM,EAAE,QAAQ;KACnB,CAAC;IACF,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,YAAoB;IAC5D,mEAAmE;IACnE,mEAAmE;IACnE,MAAM,QAAQ,GAAG;QACb,IAAI,MAAM,CAAC,4CAA4C,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC;QAC1F,IAAI,MAAM,CAAC,wBAAwB,WAAW,CAAC,YAAY,CAAC,4BAA4B,CAAC;QACzF,IAAI,MAAM,CAAC,MAAM,WAAW,CAAC,YAAY,CAAC,+CAA+C,CAAC;KAC7F,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAM,CAAC;QAE9B,qBAAqB;QACrB,IAAI,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,UAAU,KAAK,CAAC,CAAC;YAAE,SAAS;QAEhC,4BAA4B;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBAC1B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzB,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAAC,MAAM,GAAG,CAAC,CAAC;oBAAC,MAAM;gBAAC,CAAC;YAC3C,CAAC;QACL,CAAC;QACD,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAEM,KAAK,UAAU,aAAa,CAC/B,MAAuB,EACvB,GAAkB,EAClB,KAAa,EACb,MAAiB,EACjB,MAAuB;IAEvB,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,WAAW,CAAC,CAAC,CAAC;YACf,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,IAAA,4BAAoB,EAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrE,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACjD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;gBACzC,MAAM,QAAQ,GAAG,OAAO;qBACnB,KAAK,CAAC,IAAI,CAAC;qBACX,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;qBACrC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,OAAO,MAAM,CAAC,SAAS,GAAG,KAAK,KAAK,cAAc,QAAQ,EAAE,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,OAAO,uBAAuB,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;YACpE,CAAC;QACL,CAAC;QAED,KAAK,aAAa,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAU,EAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAChF,OAAO,MAAM,CAAC,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,OAAO,wBAAwB,MAAM,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;YACxE,CAAC;QACL,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,IAAA,4BAAoB,EAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,6BAAqB,EAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC/E,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACZ,OAAO,4CAA4C,QAAQ,EAAE,CAAC;gBAClE,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAA,yBAAU,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,OAAO,2BAA2B,MAAM,CAAC,QAAQ,GAAG,CAAC;gBACzD,CAAC;gBACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;oBAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,eAAe;yBACzB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;yBACzD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,OAAO,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,UAAU,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBACnJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChB,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,OAAO,0BAA0B,MAAM,CAAC,QAAQ,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;YAC3E,CAAC;QACL,CAAC;QAED,KAAK,aAAa,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,IAAA,4BAAoB,EAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACjD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACf,OAAO,mBAAmB,MAAM,CAAC,SAAS,kBAAkB,MAAM,CAAC,QAAQ,+CAA+C,CAAC;gBAC/H,CAAC;gBACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,6BAAqB,EAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC/E,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACZ,OAAO,8CAA8C,QAAQ,EAAE,CAAC;gBACpE,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAa,EAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBAC/F,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;gBACtE,IAAI,MAAM,GAAG,UAAU,MAAM,CAAC,SAAS,QAAQ,MAAM,CAAC,UAAU,KAAK,YAAY,aAAa,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9G,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;oBACvB,MAAM,IAAI,aAAa,MAAM,CAAC,aAAa,EAAE,CAAC;gBAClD,CAAC;gBACD,OAAO,MAAM,CAAC;YAClB,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,OAAO,2BAA2B,MAAM,CAAC,SAAS,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;YAC7E,CAAC;QACL,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC;gBACD,MAAM,OAAO,GAAyB;oBAClC,KAAK;oBACL,MAAM;oBACN,MAAM;iBACT,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAwB,kBAAkB,EAAE,OAAO,CAAC,CAAC;gBACvF,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,OAAO,+BAA+B,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;YAC3D,CAAC;QACL,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,kDAAkD;YAClD,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/attack/agentScanLoop.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Scan agent loop driver — the MCP-side loop that drives the scan agent.
+ *
+ * Mirrors agentLoop.ts (the attack agent) but with scan tools instead of
+ * HTTP probes. The API is a stateless per-step brain; this loop owns the
+ * transcript, the filesystem, and the tool execution.
+ *
+ * Flow:
+ *   1. POST /agent/scan/start → { runId, budget }
+ *   2. while (true):
+ *        POST /agent/scan/step { runId, target, transcript, budget }
+ *        ← { next: action | null }
+ *        if null → done (capped or completed)
+ *        if finish → done with findings
+ *        execute action locally → observation
+ *        push { action, observation } into transcript
+ *   3. return result
+ */
+import type { ServerContext } from '../mcp/types';
+import { type AgentScanBudget, type AgentScanResult, type AgentScanTarget } from './agentScanProtocol';
+export interface AgentScanOptions {
+    budget?: Partial<AgentScanBudget>;
+    signal?: AbortSignal;
+    onProgress?: (stepsTaken: number, maxSteps: number, message: string) => void;
+}
+export declare function runAgentScan(ctx: ServerContext, target: AgentScanTarget, options?: AgentScanOptions): Promise<AgentScanResult>;

package/dist/attack/agentScanLoop.js

@@ -0,0 +1,135 @@
+"use strict";
+/**
+ * Scan agent loop driver — the MCP-side loop that drives the scan agent.
+ *
+ * Mirrors agentLoop.ts (the attack agent) but with scan tools instead of
+ * HTTP probes. The API is a stateless per-step brain; this loop owns the
+ * transcript, the filesystem, and the tool execution.
+ *
+ * Flow:
+ *   1. POST /agent/scan/start → { runId, budget }
+ *   2. while (true):
+ *        POST /agent/scan/step { runId, target, transcript, budget }
+ *        ← { next: action | null }
+ *        if null → done (capped or completed)
+ *        if finish → done with findings
+ *        execute action locally → observation
+ *        push { action, observation } into transcript
+ *   3. return result
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAgentScan = runAgentScan;
+const client_1 = require("../api/client");
+const agentScanExecutor_1 = require("./agentScanExecutor");
+const agentScanProtocol_1 = require("./agentScanProtocol");
+async function runAgentScan(ctx, target, options = {}) {
+    const client = new client_1.ApiClient({ baseUrl: ctx.apiUrl, token: ctx.apiToken });
+    const budget = {
+        stepsRemaining: options.budget?.stepsRemaining ?? agentScanProtocol_1.AGENT_SCAN_DEFAULTS.maxSteps,
+        costSpentUsd: options.budget?.costSpentUsd ?? 0,
+        costCapUsd: options.budget?.costCapUsd ?? agentScanProtocol_1.AGENT_SCAN_DEFAULTS.costCapUsd,
+    };
+    const startTime = Date.now();
+    const wallClockMs = agentScanProtocol_1.AGENT_SCAN_DEFAULTS.wallClockMs;
+    let stepsTaken = 0;
+    let costSpentUsd = 0;
+    try {
+        const startResp = await client.postJson('/agent/scan/start', {});
+        const transcript = [];
+        while (true) {
+            // Wall clock check
+            if (Date.now() - startTime > wallClockMs) {
+                return {
+                    status: 'capped',
+                    findings: [],
+                    transcript,
+                    stepsUsed: stepsTaken,
+                    costSpentUsd,
+                    summary: `Wall clock limit (${wallClockMs}ms) exceeded.`,
+                };
+            }
+            // Abort check
+            if (options.signal?.aborted) {
+                return {
+                    status: 'cancelled',
+                    findings: [],
+                    transcript,
+                    stepsUsed: stepsTaken,
+                    costSpentUsd,
+                    summary: 'Cancelled by user.',
+                };
+            }
+            const stepReq = {
+                runId: startResp.runId,
+                target,
+                transcript,
+                budget: {
+                    stepsRemaining: budget.stepsRemaining,
+                    costSpentUsd,
+                    costCapUsd: budget.costCapUsd,
+                },
+            };
+            const stepResp = await client.postJson('/agent/scan/step', stepReq);
+            costSpentUsd += stepResp.costUsd || 0;
+            // Null next = done (cost capped or steps exhausted)
+            if (!stepResp.next) {
+                const status = stepResp.costCapped
+                    ? 'capped'
+                    : (stepResp.degraded ? 'degraded' : 'completed');
+                return {
+                    status,
+                    findings: [],
+                    transcript,
+                    stepsUsed: stepsTaken,
+                    costSpentUsd,
+                    summary: stepResp.costCapped
+                        ? `Cost cap ($${budget.costCapUsd.toFixed(2)}) reached.`
+                        : 'Agent completed without explicit finish.',
+                };
+            }
+            const action = stepResp.next;
+            stepsTaken++;
+            budget.stepsRemaining = stepResp.stepsRemaining;
+            // Progress callback
+            if (options.onProgress) {
+                const actionDesc = describeAction(action);
+                options.onProgress(stepsTaken, agentScanProtocol_1.AGENT_SCAN_DEFAULTS.maxSteps, `Step ${stepsTaken}: ${actionDesc}`);
+            }
+            // Finish = done with findings
+            if (action.type === 'finish') {
+                return {
+                    status: 'completed',
+                    findings: action.findings,
+                    transcript,
+                    stepsUsed: stepsTaken,
+                    costSpentUsd,
+                    summary: action.summary,
+                };
+            }
+            // Execute the action locally
+            const observation = await (0, agentScanExecutor_1.executeAction)(action, ctx, startResp.runId, client, target);
+            transcript.push({ action, observation });
+        }
+    }
+    catch (err) {
+        return {
+            status: 'spawn_failed',
+            findings: [],
+            transcript: [],
+            stepsUsed: stepsTaken,
+            costSpentUsd,
+            error: err.message || String(err),
+        };
+    }
+}
+function describeAction(action) {
+    switch (action.type) {
+        case 'read_file': return `read_file(${action.path})`;
+        case 'search_code': return `search_code("${action.pattern}")`;
+        case 'trace_flow': return `trace_flow(${action.filePath})`;
+        case 'check_guard': return `check_guard(${action.guardName})`;
+        case 'check_policy': return `check_policy(${action.filePath})`;
+        case 'finish': return 'finish';
+    }
+}
+//# sourceMappingURL=agentScanLoop.js.map

package/dist/attack/agentScanLoop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentScanLoop.js","sourceRoot":"","sources":["../../src/attack/agentScanLoop.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AAyBH,oCAmHC;AA1ID,0CAA0C;AAE1C,2DAAoD;AACpD,2DAY6B;AAQtB,KAAK,UAAU,YAAY,CAC9B,GAAkB,EAClB,MAAuB,EACvB,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAoB;QAC5B,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,IAAI,uCAAmB,CAAC,QAAQ;QAC9E,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,CAAC;QAC/C,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,uCAAmB,CAAC,UAAU;KAC3E,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,uCAAmB,CAAC,WAAW,CAAC;IACpD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAyB,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAEzF,MAAM,UAAU,GAA8B,EAAE,CAAC;QAEjD,OAAO,IAAI,EAAE,CAAC;YACV,mBAAmB;YACnB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,WAAW,EAAE,CAAC;gBACvC,OAAO;oBACH,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,EAAE;oBACZ,UAAU;oBACV,SAAS,EAAE,UAAU;oBACrB,YAAY;oBACZ,OAAO,EAAE,qBAAqB,WAAW,eAAe;iBAC3D,CAAC;YACN,CAAC;YAED,cAAc;YACd,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC1B,OAAO;oBACH,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,EAAE;oBACZ,UAAU;oBACV,SAAS,EAAE,UAAU;oBACrB,YAAY;oBACZ,OAAO,EAAE,oBAAoB;iBAChC,CAAC;YACN,CAAC;YAED,MAAM,OAAO,GAAyB;gBAClC,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,MAAM;gBACN,UAAU;gBACV,MAAM,EAAE;oBACJ,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,YAAY;oBACZ,UAAU,EAAE,MAAM,CAAC,UAAU;iBAChC;aACJ,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAoB,kBAAkB,EAAE,OAAO,CAAC,CAAC;YACvF,YAAY,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;YAEtC,oDAAoD;YACpD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAuB,QAAQ,CAAC,UAAU;oBAClD,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBACrD,OAAO;oBACH,MAAM;oBACN,QAAQ,EAAE,EAAE;oBACZ,UAAU;oBACV,SAAS,EAAE,UAAU;oBACrB,YAAY;oBACZ,OAAO,EAAE,QAAQ,CAAC,UAAU;wBACxB,CAAC,CAAC,cAAc,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY;wBACxD,CAAC,CAAC,0CAA0C;iBACnD,CAAC;YACN,CAAC;YAED,MAAM,MAAM,GAAoB,QAAQ,CAAC,IAAI,CAAC;YAC9C,UAAU,EAAE,CAAC;YACb,MAAM,CAAC,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;YAEhD,oBAAoB;YACpB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC1C,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,uCAAmB,CAAC,QAAQ,EAAE,QAAQ,UAAU,KAAK,UAAU,EAAE,CAAC,CAAC;YACtG,CAAC;YAED,8BAA8B;YAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,OAAO;oBACH,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU;oBACV,SAAS,EAAE,UAAU;oBACrB,YAAY;oBACZ,OAAO,EAAE,MAAM,CAAC,OAAO;iBAC1B,CAAC;YACN,CAAC;YAED,6BAA6B;YAC7B,MAAM,WAAW,GAAG,MAAM,IAAA,iCAAa,EAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAEtF,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,OAAO;YACH,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,UAAU;YACrB,YAAY;YACZ,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;SACpC,CAAC;IACN,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,MAAuB;IAC3C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,WAAW,CAAC,CAAC,OAAO,aAAa,MAAM,CAAC,IAAI,GAAG,CAAC;QACrD,KAAK,aAAa,CAAC,CAAC,OAAO,gBAAgB,MAAM,CAAC,OAAO,IAAI,CAAC;QAC9D,KAAK,YAAY,CAAC,CAAC,OAAO,cAAc,MAAM,CAAC,QAAQ,GAAG,CAAC;QAC3D,KAAK,aAAa,CAAC,CAAC,OAAO,eAAe,MAAM,CAAC,SAAS,GAAG,CAAC;QAC9D,KAAK,cAAc,CAAC,CAAC,OAAO,gBAAgB,MAAM,CAAC,QAAQ,GAAG,CAAC;QAC/D,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC;IACnC,CAAC;AACL,CAAC"}

package/dist/attack/agentScanProtocol.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Scan-side agent — wire contract mirror.
+ *
+ * Mirror: api/src/attacker/agentScanProtocol.ts — keep string values in step.
+ * Types are duplicated (not shared) between the API and MCP repos.
+ */
+export declare const AGENT_SCAN_DEFAULTS: {
+    readonly maxSteps: 20;
+    readonly costCapUsd: 0.4;
+    readonly wallClockMs: 180000;
+    readonly perStepEstimateUsd: 0.08;
+    readonly creditsPerRun: 5;
+    readonly dailyRunLimit: 20;
+};
+export interface AgentScanReadFileAction {
+    type: 'read_file';
+    path: string;
+    rationale: string;
+}
+export interface AgentScanSearchCodeAction {
+    type: 'search_code';
+    pattern: string;
+    glob?: string;
+    rationale: string;
+}
+export interface AgentScanTraceFlowAction {
+    type: 'trace_flow';
+    filePath: string;
+    rationale: string;
+}
+export interface AgentScanCheckGuardAction {
+    type: 'check_guard';
+    filePath: string;
+    guardName: string;
+    attackType: AttackType;
+    rationale: string;
+}
+export interface AgentScanCheckPolicyAction {
+    type: 'check_policy';
+    filePath: string;
+    rationale: string;
+}
+export interface AgentScanFinding {
+    line: number;
+    lineEnd?: number;
+    type: string;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    confidence: number;
+    evidence: string;
+    why: string;
+    fixStrategy?: string;
+}
+export interface AgentScanFinishAction {
+    type: 'finish';
+    findings: AgentScanFinding[];
+    summary: string;
+}
+export type AgentScanAction = AgentScanReadFileAction | AgentScanSearchCodeAction | AgentScanTraceFlowAction | AgentScanCheckGuardAction | AgentScanCheckPolicyAction | AgentScanFinishAction;
+export type AgentScanActionType = 'read_file' | 'search_code' | 'trace_flow' | 'check_guard' | 'check_policy' | 'finish';
+export type AttackType = 'sql_injection' | 'nosql_injection' | 'command_injection' | 'xss' | 'ssrf' | 'path_traversal' | 'open_redirect' | 'prototype_pollution' | 'insecure_deserialization' | 'broken_access_control';
+export interface AgentScanTranscriptStep {
+    action: AgentScanAction;
+    observation: string;
+}
+export interface AgentScanBudget {
+    stepsRemaining: number;
+    costSpentUsd: number;
+    costCapUsd: number;
+}
+export interface AgentScanTarget {
+    filePath: string;
+    language: string;
+    fileContent: string;
+    endpointContext?: unknown;
+}
+export interface AgentScanStartResponse {
+    runId: string;
+    budget: AgentScanBudget;
+    scanCredits: number;
+    refundId: string;
+}
+export interface AgentScanStepRequest {
+    runId: string;
+    target: AgentScanTarget;
+    transcript: AgentScanTranscriptStep[];
+    budget: AgentScanBudget;
+}
+export interface AgentScanStepResponse {
+    next: AgentScanAction | null;
+    costUsd: number;
+    tokens: number;
+    degraded: boolean;
+    costCapped: boolean;
+    stepsRemaining: number;
+}
+export interface AgentScanToolRequest {
+    runId: string;
+    action: AgentScanCheckPolicyAction;
+    target: AgentScanTarget;
+}
+export interface AgentScanToolResponse {
+    observation: string;
+}
+export type AgentScanRunStatus = 'completed' | 'capped' | 'degraded' | 'spawn_failed' | 'cancelled';
+export interface AgentScanResult {
+    status: AgentScanRunStatus;
+    findings: AgentScanFinding[];
+    summary?: string;
+    transcript: AgentScanTranscriptStep[];
+    stepsUsed: number;
+    costSpentUsd: number;
+    error?: string;
+}

package/dist/attack/agentScanProtocol.js

@@ -0,0 +1,18 @@
+"use strict";
+/**
+ * Scan-side agent — wire contract mirror.
+ *
+ * Mirror: api/src/attacker/agentScanProtocol.ts — keep string values in step.
+ * Types are duplicated (not shared) between the API and MCP repos.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_SCAN_DEFAULTS = void 0;
+exports.AGENT_SCAN_DEFAULTS = {
+    maxSteps: 20,
+    costCapUsd: 0.40,
+    wallClockMs: 180_000,
+    perStepEstimateUsd: 0.08,
+    creditsPerRun: 5,
+    dailyRunLimit: 20,
+};
+//# sourceMappingURL=agentScanProtocol.js.map

package/dist/attack/agentScanProtocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentScanProtocol.js","sourceRoot":"","sources":["../../src/attack/agentScanProtocol.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEU,QAAA,mBAAmB,GAAG;IAC/B,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,IAAI;IAChB,WAAW,EAAE,OAAO;IACpB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,CAAC;IAChB,aAAa,EAAE,EAAE;CACX,CAAC"}

package/dist/mcp/server.js

@@ -43,6 +43,7 @@ const attack_1 = require("../tools/attack");
 const scanDependencies_1 = require("../tools/scanDependencies");
 const scanBatch_1 = require("../tools/scanBatch");
 const scanSecrets_1 = require("../tools/scanSecrets");
+const agentScan_1 = require("../tools/agentScan");
 const PROTOCOL_VERSION = '2025-03-26';
 const SERVER_NAME = 'securecode-mcp';
 const SERVER_VERSION = '0.2.0';
@@ -74,6 +75,7 @@ const TOOL_HANDLERS = {
     'securecode.scan-dependencies': scanDependencies_1.toolScanDependencies,
     'securecode.scan-batch': scanBatch_1.toolScanBatch,
     'securecode.scan-secrets': scanSecrets_1.toolScanSecrets,
+    'securecode.agent-scan': agentScan_1.toolAgentScan,
 };
 function validateArgs(tool, args) {
     const schema = tool.inputSchema;

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6IA,kCA4CC;AAzLD,mDAAqC;AAErC,mCAAgC;AAChC,wCAAyC;AACzC,sCAAuC;AACvC,sCAAuC;AACvC,4CAA6C;AAC7C,gEAAiE;AACjE,kDAAmD;AACnD,sDAAuD;AAEvD,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAS,IAAI,CAAC,GAA2E;IACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,EAA0B,EAAE,KAAc;IACtD,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,EAA0B,EAAE,IAAY,EAAE,OAAe,EAAE,IAAc;IACpF,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,aAA0C,EAAE,QAAgB,EAAE,KAAa,EAAE,OAAe;IAC9G,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO;IACxC,IAAI,CAAC;QACD,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;KACtD,CAAC,CAAC;AACP,CAAC;AAED,MAAM,aAAa,GAAwE;IACvF,iBAAiB,EAAE,eAAQ;IAC3B,gBAAgB,EAAE,aAAO;IACzB,gBAAgB,EAAE,aAAO;IACzB,mBAAmB,EAAE,mBAAU;IAC/B,8BAA8B,EAAE,uCAAoB;IACpD,uBAAuB,EAAE,yBAAa;IACtC,yBAAyB,EAAE,6BAAe;CAC7C,CAAC;AAEF,SAAS,YAAY,CAAC,IAAa,EAAE,IAAS;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,WAGnB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,+BAA+B,IAAI,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC;QACpE,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACjE,MAAM,EAAE,GACJ,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;YACnD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7E,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC;oBACrD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC5E,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;4BAC7C,IAAI,CAAC;QACT,IAAI,CAAC,EAAE,EAAE,CAAC;YACN,OAAO,cAAc,IAAI,QAAQ,IAAI,CAAC,IAAI,cAAc,QAAQ,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC;QAC9H,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAmB;IAChE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,IAAI,CAAC;QACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,WAAW,GAAG,IAAI,CAAC;gBACnB,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,eAAe,EAAE,gBAAgB;wBACjC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;wBAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;qBAC7D;iBACJ,CAAC;YACN,CAAC;YACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,aAAK,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAoF,CAAC;gBACrH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;gBACpC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;gBAClD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,aAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC5C,IAAI,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBACD,iDAAiD;gBACjD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAC9B,IAAI,CAAC,SAAS,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,OAAe,EAAE,EAAE,CAClE,YAAY,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7C,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;qBAC1E;iBACJ,CAAC;YACN,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACN,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACxC,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACvG,CAAC;QACL,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;AACL,CAAC;AAED,SAAgB,WAAW,CAAC,GAAkB;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/E,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACL,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACnC,OAAO;QACX,CAAC;QAED,IACI,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,OAAQ,MAAyB,CAAC,MAAM,KAAK,QAAQ,EACvD,CAAC;YACC,MAAM,OAAO,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC1D,CAAC,CAAE,MAAyB,CAAC,EAAE,IAAI,IAAI;gBACvC,CAAC,CAAC,IAAI,CAAC;YACf,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QAED,MAAM,GAAG,GAAG,MAAwB,CAAC;QACrC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+IA,kCA4CC;AA3LD,mDAAqC;AAErC,mCAAgC;AAChC,wCAAyC;AACzC,sCAAuC;AACvC,sCAAuC;AACvC,4CAA6C;AAC7C,gEAAiE;AACjE,kDAAmD;AACnD,sDAAuD;AACvD,kDAAmD;AAEnD,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAS,IAAI,CAAC,GAA2E;IACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,EAA0B,EAAE,KAAc;IACtD,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,EAA0B,EAAE,IAAY,EAAE,OAAe,EAAE,IAAc;IACpF,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,aAA0C,EAAE,QAAgB,EAAE,KAAa,EAAE,OAAe;IAC9G,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO;IACxC,IAAI,CAAC;QACD,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;KACtD,CAAC,CAAC;AACP,CAAC;AAED,MAAM,aAAa,GAAwE;IACvF,iBAAiB,EAAE,eAAQ;IAC3B,gBAAgB,EAAE,aAAO;IACzB,gBAAgB,EAAE,aAAO;IACzB,mBAAmB,EAAE,mBAAU;IAC/B,8BAA8B,EAAE,uCAAoB;IACpD,uBAAuB,EAAE,yBAAa;IACtC,yBAAyB,EAAE,6BAAe;IAC1C,uBAAuB,EAAE,yBAAa;CACzC,CAAC;AAEF,SAAS,YAAY,CAAC,IAAa,EAAE,IAAS;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,WAGnB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,+BAA+B,IAAI,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC;QACpE,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACjE,MAAM,EAAE,GACJ,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;YACnD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7E,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC;oBACrD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC5E,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;4BAC7C,IAAI,CAAC;QACT,IAAI,CAAC,EAAE,EAAE,CAAC;YACN,OAAO,cAAc,IAAI,QAAQ,IAAI,CAAC,IAAI,cAAc,QAAQ,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC;QAC9H,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAmB;IAChE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,IAAI,CAAC;QACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,WAAW,GAAG,IAAI,CAAC;gBACnB,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,eAAe,EAAE,gBAAgB;wBACjC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;wBAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;qBAC7D;iBACJ,CAAC;YACN,CAAC;YACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,aAAK,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAoF,CAAC;gBACrH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;gBACpC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;gBAClD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,aAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC5C,IAAI,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBACD,iDAAiD;gBACjD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAC9B,IAAI,CAAC,SAAS,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,OAAe,EAAE,EAAE,CAClE,YAAY,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7C,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;qBAC1E;iBACJ,CAAC;YACN,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACN,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACxC,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACvG,CAAC;QACL,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;AACL,CAAC;AAED,SAAgB,WAAW,CAAC,GAAkB;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/E,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACL,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACnC,OAAO;QACX,CAAC;QAED,IACI,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,OAAQ,MAAyB,CAAC,MAAM,KAAK,QAAQ,EACvD,CAAC;YACC,MAAM,OAAO,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC1D,CAAC,CAAE,MAAyB,CAAC,EAAE,IAAI,IAAI;gBACvC,CAAC,CAAC,IAAI,CAAC;YACf,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QAED,MAAM,GAAG,GAAG,MAAwB,CAAC;QACrC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/mcp/tools.js

@@ -177,5 +177,26 @@ exports.TOOLS = [
             },
         },
     },
+    {
+        name: 'securecode.agent-scan',
+        description: 'Agent-mode scan: an AI investigator that reads files, traces data flows, checks guards, and compares endpoint policies to find vulnerabilities. Slower but deeper than a deep scan. The agent replaces the Scout phase and its findings are verified by the Juror. Uses 5 scan credits. Best for complex access-control and cross-file vulnerabilities.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                code: {
+                    type: 'string',
+                    description: 'Source code to scan (if filePath is omitted).',
+                },
+                filePath: {
+                    type: 'string',
+                    description: 'Workspace-relative path to the file to scan (reads from disk within the workspace root).',
+                },
+                language: {
+                    type: 'string',
+                    description: 'Language id (javascript, typescript, python, php). Inferred from filePath if omitted.',
+                },
+            },
+        },
+    },
 ];
 //# sourceMappingURL=tools.js.map

package/dist/mcp/tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":";;;AAEa,QAAA,KAAK,GAAc;IAC5B;QACI,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACP,qPAAqP;QACzP,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0FAA0F;iBAC1G;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uFAAuF;iBACvG;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;oBAC9B,WAAW,EAAE,qMAAqM;iBACrN;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,mQAAmQ;QACvQ,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,MAAM,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC;oBACtC,WAAW,EAAE,6HAA6H;iBAC7I;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,6MAA6M;QACjN,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2EAA2E;iBAC3F;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oDAAoD;iBACpE;gBACD,iBAAiB,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sEAAsE;iBACtF;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sCAAsC;iBACtD;gBACD,OAAO,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oCAAoC;iBACpD;gBACD,eAAe,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,8BAA8B;iBAC9C;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0DAA0D;iBAC1E;aACJ;YACD,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC;SACjG;KACJ;IACD;QACI,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACP,+OAA+O;QACnP,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qEAAqE;iBACrF;gBACD,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kDAAkD;iBAClE;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,cAAc;iBAC9B;gBACD,iBAAiB,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+DAA+D;iBAC/E;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2DAA2D;iBAC3E;gBACD,OAAO,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,eAAe,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qDAAqD;iBACrE;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACP,oWAAoW;QACxW,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE;SACjB;KACJ;IACD;QACI,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACP,8TAA8T;QAClU,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oFAAoF;iBACpG;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,gFAAgF;iBAChG;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qCAAqC;iBACrD;gBACD,YAAY,EAAE;oBACV,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,+GAA+G;iBAC/H;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACP,6RAA6R;QACjS,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oFAAoF;iBACpG;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,gFAAgF;iBAChG;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qCAAqC;iBACrD;aACJ;SACJ;KACJ;CACJ,CAAC"}
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":";;;AAEa,QAAA,KAAK,GAAc;IAC5B;QACI,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACP,qPAAqP;QACzP,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0FAA0F;iBAC1G;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uFAAuF;iBACvG;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;oBAC9B,WAAW,EAAE,qMAAqM;iBACrN;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,mQAAmQ;QACvQ,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,MAAM,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC;oBACtC,WAAW,EAAE,6HAA6H;iBAC7I;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,6MAA6M;QACjN,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2EAA2E;iBAC3F;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oDAAoD;iBACpE;gBACD,iBAAiB,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sEAAsE;iBACtF;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sCAAsC;iBACtD;gBACD,OAAO,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oCAAoC;iBACpD;gBACD,eAAe,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,8BAA8B;iBAC9C;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0DAA0D;iBAC1E;aACJ;YACD,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC;SACjG;KACJ;IACD;QACI,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACP,+OAA+O;QACnP,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qEAAqE;iBACrF;gBACD,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kDAAkD;iBAClE;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,cAAc;iBAC9B;gBACD,iBAAiB,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+DAA+D;iBAC/E;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2DAA2D;iBAC3E;gBACD,OAAO,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,eAAe,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qDAAqD;iBACrE;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACP,oWAAoW;QACxW,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE;SACjB;KACJ;IACD;QACI,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACP,8TAA8T;QAClU,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oFAAoF;iBACpG;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,gFAAgF;iBAChG;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qCAAqC;iBACrD;gBACD,YAAY,EAAE;oBACV,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,+GAA+G;iBAC/H;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACP,6RAA6R;QACjS,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,SAAS,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oFAAoF;iBACpG;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,gFAAgF;iBAChG;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qCAAqC;iBACrD;aACJ;SACJ;KACJ;IACD;QACI,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACP,yVAAyV;QAC7V,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC/D;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0FAA0F;iBAC1G;gBACD,QAAQ,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uFAAuF;iBACvG;aACJ;SACJ;KACJ;CACJ,CAAC"}

package/dist/tools/agentScan.d.ts

@@ -0,0 +1,20 @@
+/**
+ * securecode.agent-scan MCP tool — agent-mode scan with exploit proof.
+ *
+ * An AI investigator that reads files, traces data flows, checks guards,
+ * and compares endpoint policies to find vulnerabilities. Each high/critical
+ * finding is then sent to the sandbox for PROVEN/UNPROVEN verification before
+ * the Juror confirms it.
+ *
+ * Flow:
+ *   1. Resolve code + language from filePath
+ *   2. Build endpoint context from the project map
+ *   3. Run the agent loop (POST /agent/scan/start + /step loop)
+ *   4. For each high/critical finding → POST /sandbox/prove → PROVEN/UNPROVEN
+ *   5. Map agent findings → CandidateContext[]
+ *   6. POST /scan with scanDepth: 'agent' + candidateContexts (skips Scout,
+ *      Juror + Phase 3 verify the agent's candidates)
+ *   7. Return merged result (agent findings + proven stamps + Juror-verified)
+ */
+import type { ServerContext } from '../mcp/types';
+export declare function toolAgentScan(ctx: ServerContext, args: any): Promise<unknown>;

package/dist/tools/agentScan.js

@@ -0,0 +1,171 @@
+"use strict";
+/**
+ * securecode.agent-scan MCP tool — agent-mode scan with exploit proof.
+ *
+ * An AI investigator that reads files, traces data flows, checks guards,
+ * and compares endpoint policies to find vulnerabilities. Each high/critical
+ * finding is then sent to the sandbox for PROVEN/UNPROVEN verification before
+ * the Juror confirms it.
+ *
+ * Flow:
+ *   1. Resolve code + language from filePath
+ *   2. Build endpoint context from the project map
+ *   3. Run the agent loop (POST /agent/scan/start + /step loop)
+ *   4. For each high/critical finding → POST /sandbox/prove → PROVEN/UNPROVEN
+ *   5. Map agent findings → CandidateContext[]
+ *   6. POST /scan with scanDepth: 'agent' + candidateContexts (skips Scout,
+ *      Juror + Phase 3 verify the agent's candidates)
+ *   7. Return merged result (agent findings + proven stamps + Juror-verified)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolAgentScan = toolAgentScan;
+const client_1 = require("../api/client");
+const files_1 = require("../utils/files");
+const mapContext_1 = require("../project-map/mapContext");
+const agentScanLoop_1 = require("../attack/agentScanLoop");
+function mapFindingsToCandidates(findings) {
+    return findings.map(f => ({
+        line: f.line,
+        lineEnd: f.lineEnd,
+        type: f.type,
+        snippet: f.evidence,
+        definitionContext: f.why,
+    }));
+}
+/** Only prove high/critical findings — don't waste credits on low/medium. */
+function shouldProve(finding) {
+    return finding.severity === 'critical' || finding.severity === 'high';
+}
+async function toolAgentScan(ctx, args) {
+    const progress = args._progress;
+    // 1. Resolve code + language
+    let code;
+    let language;
+    let filePath;
+    if (args.filePath) {
+        filePath = args.filePath;
+        const fileResult = (0, files_1.readFileFromWorkspace)(ctx.workspaceRoot, args.filePath);
+        code = fileResult.code;
+        language = args.language || fileResult.language;
+    }
+    else if (args.code) {
+        code = args.code;
+        language = args.language || 'javascript';
+    }
+    else {
+        throw new Error('Either filePath or code must be provided.');
+    }
+    // 2. Build endpoint context from the project map
+    let endpointContext = [];
+    if (filePath) {
+        try {
+            endpointContext = await (0, mapContext_1.getEndpointContextForFile)(filePath, ctx.workspaceRoot);
+        }
+        catch {
+            // best-effort — proceed without endpoint context
+        }
+    }
+    // 3. Run the agent loop
+    const target = {
+        filePath: filePath || 'inline-code',
+        language,
+        fileContent: code,
+        endpointContext,
+    };
+    const agentResult = await (0, agentScanLoop_1.runAgentScan)(ctx, target, {
+        onProgress: (steps, max, msg) => {
+            if (progress)
+                progress(steps, max, msg);
+        },
+    });
+    if (agentResult.status === 'spawn_failed') {
+        throw new Error(agentResult.error || 'Agent scan failed to start.');
+    }
+    // 4. Prove each high/critical finding via the sandbox
+    const client = new client_1.ApiClient({ baseUrl: ctx.apiUrl, token: ctx.apiToken });
+    const provenFindings = [];
+    const proveable = agentResult.findings.filter(shouldProve);
+    if (proveable.length > 0 && progress) {
+        progress(0, proveable.length, `Proving ${proveable.length} finding(s) in sandbox...`);
+    }
+    let proveIdx = 0;
+    for (const finding of agentResult.findings) {
+        if (!shouldProve(finding)) {
+            provenFindings.push({ ...finding, proven: 'SKIPPED', provenReason: 'Low/medium severity — not proven' });
+            continue;
+        }
+        try {
+            if (progress) {
+                proveIdx++;
+                progress(proveIdx, proveable.length, `Proving ${finding.type} at line ${finding.line}...`);
+            }
+            const proveResp = await client.postJson('/sandbox/prove', {
+                code,
+                language,
+                vulnerabilityType: finding.type,
+                line: finding.line,
+                lineEnd: finding.lineEnd,
+                evidence: finding.evidence,
+                why: finding.why,
+            });
+            provenFindings.push({
+                ...finding,
+                proven: proveResp.proven,
+                provenReason: proveResp.rationale || proveResp.skipReason || proveResp.sandbox?.reason,
+            });
+        }
+        catch (err) {
+            // Insufficient credits or API error — skip proving, mark as INCONCLUSIVE
+            provenFindings.push({
+                ...finding,
+                proven: 'INCONCLUSIVE',
+                provenReason: `Sandbox prove failed: ${err.message || err}`,
+            });
+        }
+    }
+    // 5. Map findings → CandidateContext[]
+    const candidateContexts = mapFindingsToCandidates(provenFindings);
+    // 6. If no findings, return early
+    if (candidateContexts.length === 0) {
+        return {
+            status: agentResult.status,
+            summary: agentResult.summary || 'Agent completed with no findings.',
+            findings: [],
+            agentFindings: provenFindings,
+            stepsUsed: agentResult.stepsUsed,
+            costSpentUsd: agentResult.costSpentUsd,
+            transcript: agentResult.transcript,
+        };
+    }
+    // 7. POST /scan with scanDepth: 'agent' + candidateContexts
+    //    This skips Scout and sends the agent's candidates directly to Juror
+    //    + Phase 3 for verification.
+    const scanResp = await client.postJson('/scan', {
+        code,
+        language,
+        ...(filePath ? { filePath } : {}),
+        scanDepth: 'agent',
+        candidateContexts,
+        ...(endpointContext.length > 0 ? { endpointContext } : {}),
+    });
+    // 8. Return merged result with proven stamps
+    return {
+        status: agentResult.status,
+        summary: agentResult.summary,
+        agentFindings: provenFindings,
+        verifiedFindings: scanResp.finalFindings || [],
+        allFindings: scanResp.findings || [],
+        scanId: scanResp.scanId,
+        scanType: scanResp.scanType,
+        degraded: scanResp.degraded,
+        scanCredits: scanResp.scanCredits,
+        plan: scanResp.plan,
+        stepsUsed: agentResult.stepsUsed,
+        costSpentUsd: agentResult.costSpentUsd,
+        transcript: agentResult.transcript,
+        provenCount: provenFindings.filter(f => f.proven === 'PROVEN').length,
+        unprovenCount: provenFindings.filter(f => f.proven === 'UNPROVEN').length,
+        inconclusiveCount: provenFindings.filter(f => f.proven === 'INCONCLUSIVE').length,
+    };
+}
+//# sourceMappingURL=agentScan.js.map

package/dist/tools/agentScan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentScan.js","sourceRoot":"","sources":["../../src/tools/agentScan.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AAsCH,sCA8IC;AAlLD,0CAA0C;AAE1C,0CAAuD;AACvD,0DAAsE;AACtE,2DAAuD;AAiBvD,SAAS,uBAAuB,CAAC,QAAyB;IACtD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,iBAAiB,EAAE,CAAC,CAAC,GAAG;KAC3B,CAAC,CAAC,CAAC;AACR,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,OAAyB;IAC1C,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC;AAC1E,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,IAAS;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAqF,CAAC;IAE5G,6BAA6B;IAC7B,IAAI,IAAY,CAAC;IACjB,IAAI,QAAgB,CAAC;IACrB,IAAI,QAA4B,CAAC;IAEjC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACzB,MAAM,UAAU,GAAG,IAAA,6BAAqB,EAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QACvB,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;IACpD,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACjB,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC7C,CAAC;SAAM,CAAC;QACJ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,iDAAiD;IACjD,IAAI,eAAe,GAAU,EAAE,CAAC;IAChC,IAAI,QAAQ,EAAE,CAAC;QACX,IAAI,CAAC;YACD,eAAe,GAAG,MAAM,IAAA,sCAAyB,EAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACL,iDAAiD;QACrD,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,MAAM,MAAM,GAAoB;QAC5B,QAAQ,EAAE,QAAQ,IAAI,aAAa;QACnC,QAAQ;QACR,WAAW,EAAE,IAAI;QACjB,eAAe;KAClB,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,IAAA,4BAAY,EAAC,GAAG,EAAE,MAAM,EAAE;QAChD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,QAAQ;gBAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;KACJ,CAAC,CAAC;IAEH,IAAI,WAAW,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,6BAA6B,CAAC,CAAC;IACxE,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAoB,EAAE,CAAC;IAE3C,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,SAAS,CAAC,MAAM,2BAA2B,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,cAAc,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,kCAAkC,EAAE,CAAC,CAAC;YACzG,SAAS;QACb,CAAC;QAED,IAAI,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,CAAC;gBACX,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,OAAO,CAAC,IAAI,YAAY,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;YAC/F,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAuB,gBAAgB,EAAE;gBAC5E,IAAI;gBACJ,QAAQ;gBACR,iBAAiB,EAAE,OAAO,CAAC,IAAI;gBAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;aACnB,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC;gBAChB,GAAG,OAAO;gBACV,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,YAAY,EAAE,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM;aACzF,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,yEAAyE;YACzE,cAAc,CAAC,IAAI,CAAC;gBAChB,GAAG,OAAO;gBACV,MAAM,EAAE,cAAc;gBACtB,YAAY,EAAE,yBAAyB,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE;aAC9D,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAElE,kCAAkC;IAClC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;YACH,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,mCAAmC;YACnE,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,cAAc;YAC7B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,UAAU,EAAE,WAAW,CAAC,UAAU;SACrC,CAAC;IACN,CAAC;IAED,4DAA4D;IAC5D,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAe,OAAO,EAAE;QAC1D,IAAI;QACJ,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,SAAS,EAAE,OAAO;QAClB,iBAAiB;QACjB,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;IAEH,6CAA6C;IAC7C,OAAO;QACH,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,aAAa,EAAE,cAAc;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;QAC9C,WAAW,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;QACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;QACrE,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;QACzE,iBAAiB,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM;KACpF,CAAC;AACN,CAAC"}

package/dist/utils/searchCode.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Code search utility — wraps ripgrep (rg) for fast workspace-wide search.
+ * Falls back to recursive grep if rg is not available.
+ *
+ * Returns matching lines with file paths and line numbers, capped at maxHits.
+ */
+export interface SearchHit {
+    path: string;
+    line: number;
+    text: string;
+}
+export interface SearchResult {
+    hits: SearchHit[];
+    total: number;
+    truncated: boolean;
+}
+export declare function searchCode(workspaceRoot: string, pattern: string, glob?: string): Promise<SearchResult>;
+export declare function formatSearchResult(result: SearchResult): string;

package/dist/utils/searchCode.js

@@ -0,0 +1,173 @@
+"use strict";
+/**
+ * Code search utility — wraps ripgrep (rg) for fast workspace-wide search.
+ * Falls back to recursive grep if rg is not available.
+ *
+ * Returns matching lines with file paths and line numbers, capped at maxHits.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.searchCode = searchCode;
+exports.formatSearchResult = formatSearchResult;
+const child_process_1 = require("child_process");
+const path = __importStar(require("path"));
+const MAX_HITS = 50;
+const MAX_LINE_LENGTH = 500;
+function promisifyExecFile(file, args, opts) {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.execFile)(file, args, opts, (err, stdout, stderr) => {
+            if (err && err.code === 'ENOENT') {
+                reject(new Error(`Command not found: ${file}`));
+                return;
+            }
+            resolve({ stdout, stderr, code: err ? err.code : null });
+        });
+    });
+}
+function hasRipgrep() {
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)('rg', ['--version'], (err) => {
+            resolve(!err || err.code !== 'ENOENT');
+        });
+    });
+}
+function trimLine(text) {
+    const trimmed = text.trim();
+    return trimmed.length > MAX_LINE_LENGTH
+        ? trimmed.slice(0, MAX_LINE_LENGTH) + '…'
+        : trimmed;
+}
+async function searchWithRipgrep(workspaceRoot, pattern, glob) {
+    const args = [
+        '--json',
+        '--max-count', String(MAX_HITS),
+        '--no-heading',
+        '--line-number',
+        '--ignore-case',
+    ];
+    if (glob) {
+        args.push('--glob', glob);
+    }
+    args.push('--', pattern, workspaceRoot);
+    let result;
+    try {
+        result = await promisifyExecFile('rg', args, {
+            cwd: workspaceRoot,
+            maxBuffer: 10 * 1024 * 1024,
+        });
+    }
+    catch (e) {
+        if (e.message === 'Command not found: rg')
+            throw e;
+        result = { stdout: '', stderr: e.message || '', code: e.code || 1 };
+    }
+    const hits = [];
+    for (const line of result.stdout.split('\n')) {
+        if (!line.trim())
+            continue;
+        try {
+            const obj = JSON.parse(line);
+            if (obj.type === 'match' && obj.data) {
+                const relativePath = path.relative(workspaceRoot, obj.data.path.text).replace(/\\/g, '/');
+                hits.push({
+                    path: relativePath,
+                    line: obj.data.line_number,
+                    text: trimLine(obj.data.lines.text),
+                });
+            }
+        }
+        catch {
+            // skip non-JSON lines
+        }
+    }
+    return hits;
+}
+async function searchWithGrep(workspaceRoot, pattern, glob) {
+    const args = ['-rn', '-i', '--max-count=50'];
+    if (glob) {
+        args.push('--include', glob.replace(/^\*\./, '*.'));
+    }
+    args.push('--', pattern, '.');
+    let result;
+    try {
+        result = await promisifyExecFile('grep', args, {
+            cwd: workspaceRoot,
+            maxBuffer: 10 * 1024 * 1024,
+        });
+    }
+    catch (e) {
+        if (e.message === 'Command not found: grep')
+            throw e;
+        result = { stdout: '', stderr: '', code: e.code || 1 };
+    }
+    const hits = [];
+    for (const line of result.stdout.split('\n').slice(0, MAX_HITS)) {
+        const match = line.match(/^([^:]+):(\d+):(.*)$/);
+        if (match) {
+            hits.push({
+                path: match[1].replace(/\\/g, '/'),
+                line: parseInt(match[2], 10),
+                text: trimLine(match[3]),
+            });
+        }
+    }
+    return hits;
+}
+async function searchCode(workspaceRoot, pattern, glob) {
+    let hits;
+    if (await hasRipgrep()) {
+        hits = await searchWithRipgrep(workspaceRoot, pattern, glob);
+    }
+    else {
+        hits = await searchWithGrep(workspaceRoot, pattern, glob);
+    }
+    const total = hits.length;
+    const truncated = total > MAX_HITS;
+    if (truncated)
+        hits = hits.slice(0, MAX_HITS);
+    return { hits, total, truncated };
+}
+function formatSearchResult(result) {
+    if (result.hits.length === 0) {
+        return 'No matches found.';
+    }
+    const lines = result.hits.map(h => `${h.path}:${h.line}: ${h.text}`);
+    let output = lines.join('\n');
+    if (result.truncated) {
+        output += `\n… (${result.total} total matches, showing first ${MAX_HITS})`;
+    }
+    return output;
+}
+//# sourceMappingURL=searchCode.js.map

package/dist/utils/searchCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"searchCode.js","sourceRoot":"","sources":["../../src/utils/searchCode.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwIH,gCAkBC;AAED,gDAYC;AAtKD,iDAAyC;AACzC,2CAA6B;AAe7B,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,SAAS,iBAAiB,CACtB,IAAY,EACZ,IAAc,EACd,IAAwC;IAExC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,IAAA,wBAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC/C,IAAI,GAAG,IAAK,GAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC;gBAChD,OAAO;YACX,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAE,GAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,UAAU;IACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAA,wBAAQ,EAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;YAClC,OAAO,CAAC,CAAC,GAAG,IAAK,GAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,eAAe;QACnC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,GAAG;QACzC,CAAC,CAAC,OAAO,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC5B,aAAqB,EACrB,OAAe,EACf,IAAa;IAEb,MAAM,IAAI,GAAG;QACT,QAAQ;QACR,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC/B,cAAc;QACd,eAAe;QACf,eAAe;KAClB,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACP,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE;YACzC,GAAG,EAAE,aAAa;YAClB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC9B,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,OAAO,KAAK,uBAAuB;YAAE,MAAM,CAAC,CAAC;QACnD,MAAM,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC1F,IAAI,CAAC,IAAI,CAAC;oBACN,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;oBAC1B,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;iBACtC,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,sBAAsB;QAC1B,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CACzB,aAAqB,EACrB,OAAe,EACf,IAAa;IAEb,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC7C,IAAI,IAAI,EAAE,CAAC;QACP,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAE9B,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE;YAC3C,GAAG,EAAE,aAAa;YAClB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC9B,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,OAAO,KAAK,yBAAyB;YAAE,MAAM,CAAC,CAAC;QACrD,MAAM,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,IAAI,CAAC;gBACN,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;gBAClC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC5B,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;aAC3B,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAEM,KAAK,UAAU,UAAU,CAC5B,aAAqB,EACrB,OAAe,EACf,IAAa;IAEb,IAAI,IAAiB,CAAC;IAEtB,IAAI,MAAM,UAAU,EAAE,EAAE,CAAC;QACrB,IAAI,GAAG,MAAM,iBAAiB,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACJ,IAAI,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;IACnC,IAAI,SAAS;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE9C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAoB;IACnD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,mBAAmB,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC9B,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CACnC,CAAC;IACF,IAAI,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,MAAM,CAAC,KAAK,iCAAiC,QAAQ,GAAG,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecode-ai/mcp",
-  "version": "0.3.8",
+  "version": "0.4.0",
   "description": "Standalone SecureCode MCP server — scan, map, fix, and attack tools for AI coding assistants. Works without the VS Code extension.",
   "main": "dist/index.js",
   "bin": {