@skaleagents/swarm 0.6.16 → 0.6.17

package/README.md

@@ -1,7 +1,16 @@
 # @skaleagents/swarm
 
-SkaleAgents MCP server with local stdio and hosted Streamable HTTP transports.
-Uses browser OAuth for sign-in.
+SkaleAgents MCP server. The hosted connection is `https://skaleagents.com/mcp`.
+
+## Quick start
+
+Copy `https://skaleagents.com/mcp` into your client and choose OAuth. Sign in
+with Google and click Allow. Leave client ID and secret fields blank when the
+client asks. Setup steps for Cursor, Claude Code, Claude Desktop, ChatGPT, and
+Codex are on the [MCP config page](https://skaleagents.com/mcp-config).
+
+The hosted URL is the way to connect. A local stdio process can still run this
+package; it opens the browser for OAuth when no token is set.
 
 Tools: `plan_architecture_review`, `review_application_architecture`,
 `review_architecture`, and `scan_iac`. The older `scan_iac_stub` name remains
@@ -56,7 +65,7 @@ for every review area, and the next questions. The MCP provides static evidence
 and the connected assistant's model reasons through the architecture. No
 separate hosted model is invoked, and the tools do not clone repositories or
 run submitted code. A clean static check is not a whole-system correctness
-verdict. The [settings page](https://skaleagents.com/settings) has an interactive
+verdict. The [MCP config page](https://skaleagents.com/mcp-config) has an interactive
 review-brief builder.
 
 ## Infrastructure scanning
@@ -106,8 +115,8 @@ in every result. An empty finding list is not proof that a system is secure.
 
 Use `https://skaleagents.com/mcp` in Claude Desktop or ChatGPT's custom connector
 settings. Choose OAuth and leave client ID and secret fields blank. The client
-registers itself, opens Google sign-in, and asks you to approve MCP access.
-See [client setup](https://skaleagents.com/settings) for Cursor, Claude Code,
+registers itself, opens Google sign-in, and asks you to click Allow.
+See [client setup](https://skaleagents.com/mcp-config) for Cursor, Claude Code,
 Claude Desktop, ChatGPT, and Codex instructions.
 
 The web app hosts this endpoint using `handleMcpRequest` from
@@ -127,8 +136,8 @@ forwarded to the public bot directory.
 
 The first tool call opens browser sign-in. Approve MCP access there and return
 to your AI client. The package stores the OAuth refresh credential locally and
-refreshes access automatically. You do not need to create or paste an API key.
-Active connections can be revoked from the web app's MCP settings page.
+refreshes access automatically. Active connections can be revoked from the
+[MCP config page](https://skaleagents.com/mcp-config).
 
 Local `review_architecture` calls validate the account and fetch public bot
 hints concurrently. The public directory request carries no credential. Every

package/dist/http.js

@@ -33,7 +33,7 @@ export function protectedResourceMetadata() {
         authorization_servers: [getApiUrl()],
         scopes_supported: ["mcp"],
         bearer_methods_supported: ["header"],
-        resource_documentation: "https://skaleagents.com/settings",
+        resource_documentation: "https://skaleagents.com/mcp-config",
     });
 }
 export async function handleMcpRequest(request) {

package/dist/review-edits.d.ts

@@ -0,0 +1,21 @@
+export type ExactLineEdit = {
+    diff: string;
+    from: string;
+    to: string | null;
+};
+export declare function exactLineEdit(content: string, title: string): ExactLineEdit | null;
+export declare function rankFindings<T extends {
+    severity: string;
+}>(findings: T[]): T[];
+export declare function changePhrase(edit: ExactLineEdit): string;
+type RankedFinding = {
+    title: string;
+    severity: string;
+    proposedChange?: ExactLineEdit;
+};
+export declare function presentReview(content: string, output: Record<string, unknown>): {
+    findings: any[];
+    priority: RankedFinding[];
+    summary: string;
+};
+export {};

package/dist/review-edits.js

@@ -0,0 +1,145 @@
+const severityOrder = ["critical", "high", "medium", "low", "info"];
+const noFindingsSummary = "No findings. That does not prove the system is secure.";
+const rules = {
+    "Dockerfile runs as root": dockerfileUser,
+    "Workflow permissions are broad": workflowPermissions,
+    "Elevated container privileges": privilegedContainer,
+    "Privileged container in a Helm template": privilegedContainer,
+    "Database publicly accessible": publicDatabase,
+    "Database or storage allows public network access": publicNetworkAccess,
+    "Storage encryption disabled": storageEncryption,
+    "Pull request target checks out PR code": pullRequestTargetCheckout,
+};
+export function exactLineEdit(content, title) {
+    const rule = rules[title];
+    if (!rule)
+        return null;
+    return rule(content.split("\n"));
+}
+export function rankFindings(findings) {
+    return findings
+        .map((finding, index) => ({ finding, index }))
+        .sort((left, right) => {
+        const leftRank = severityOrder.indexOf(left.finding.severity);
+        const rightRank = severityOrder.indexOf(right.finding.severity);
+        return (leftRank === -1 ? severityOrder.length : leftRank) - (rightRank === -1 ? severityOrder.length : rightRank) || left.index - right.index;
+    })
+        .map((item) => item.finding);
+}
+export function changePhrase(edit) {
+    if (edit.to === null)
+        return `${edit.from.trim()} removed`;
+    return `${edit.from.trim()} becomes ${edit.to.trim()}`;
+}
+function isRankedFinding(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const finding = value;
+    return typeof finding.title === "string" && typeof finding.severity === "string";
+}
+export function presentReview(content, output) {
+    const raw = Array.isArray(output.findings) ? output.findings : [];
+    const findings = raw.map((finding) => {
+        if (!isRankedFinding(finding))
+            return finding;
+        const edit = exactLineEdit(content, finding.title);
+        if (!edit)
+            return finding;
+        return { ...finding, proposedChange: edit };
+    });
+    const priority = rankFindings(findings.filter(isRankedFinding)).slice(0, 3);
+    return {
+        ...output,
+        findings,
+        priority,
+        summary: priority.length === 0
+            ? noFindingsSummary
+            : `Fix these first: ${priority.map((finding) => finding.proposedChange ? `${finding.title}: ${changePhrase(finding.proposedChange)}` : finding.title).join(", ")}.`,
+    };
+}
+function dockerfileUser(lines) {
+    const exact = lines.flatMap((line, index) => line === "USER root" || line === "USER 0" ? [{ line, index }] : []);
+    if (exact.length !== 1)
+        return null;
+    return replacement(exact[0].line, "USER nobody", exact[0].index);
+}
+function workflowPermissions(lines) {
+    const exact = lines.flatMap((line, index) => line.trim() === "permissions: write-all" ? [{ line, index }] : []);
+    if (exact.length !== 1)
+        return null;
+    const indent = exact[0].line.match(/^\s*/)?.[0] ?? "";
+    return replacement(exact[0].line, `${indent}permissions: contents: read`, exact[0].index);
+}
+function privilegedContainer(lines) {
+    return oneExactReplacement(lines, [{ from: "privileged: true", to: "privileged: false" }]);
+}
+function publicDatabase(lines) {
+    return oneExactReplacement(lines, [{ from: "publicly_accessible = true", to: "publicly_accessible = false" }]);
+}
+function publicNetworkAccess(lines) {
+    return oneExactReplacement(lines, [
+        { from: "publicNetworkAccess: 'Enabled'", to: "publicNetworkAccess: 'Disabled'" },
+        { from: "publicNetworkAccess: \"Enabled\"", to: "publicNetworkAccess: \"Disabled\"" },
+    ]);
+}
+function storageEncryption(lines) {
+    return oneExactReplacement(lines, [
+        { from: "storage_encrypted = false", to: "storage_encrypted = true" },
+        { from: "encrypted: false", to: "encrypted: true" },
+        { from: "encrypted = false", to: "encrypted = true" },
+    ]);
+}
+function pullRequestTargetCheckout(lines) {
+    const exact = lines.flatMap((line, index) => isExactHeadRefLine(line) ? [{ line, index }] : []);
+    if (exact.length !== 1)
+        return null;
+    const match = exact[0];
+    if (!isPullRequestTargetWorkflow(lines) || !refBelongsToCheckout(lines, match.index))
+        return null;
+    return {
+        from: match.line,
+        to: null,
+        diff: [
+            `@@ -${match.index + 1},1 +${Math.max(match.index, 0)},0 @@`,
+            `-${match.line}`,
+        ].join("\n"),
+    };
+}
+function oneExactReplacement(lines, pairs) {
+    const matches = lines.flatMap((line, index) => {
+        const pair = pairs.find((item) => item.from === line.trim());
+        return pair ? [{ line, index, to: pair.to }] : [];
+    });
+    if (matches.length !== 1)
+        return null;
+    const indent = matches[0].line.match(/^\s*/)?.[0] ?? "";
+    return replacement(matches[0].line, `${indent}${matches[0].to}`, matches[0].index);
+}
+function replacement(from, to, lineIndex) {
+    const line = lineIndex + 1;
+    return {
+        from,
+        to,
+        diff: [`@@ -${line},1 +${line},1 @@`, `-${from}`, `+${to}`].join("\n"),
+    };
+}
+function isExactHeadRefLine(line) {
+    const trimmed = line.trim();
+    return trimmed === "ref: ${{ github.event.pull_request.head.ref }}" || trimmed === "ref: ${{ github.event.pull_request.head.sha }}";
+}
+function isPullRequestTargetWorkflow(lines) {
+    return lines.some((line) => {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("#"))
+            return false;
+        return trimmed === "on: pull_request_target" || trimmed === "pull_request_target:" || trimmed.startsWith("pull_request_target:");
+    });
+}
+function refBelongsToCheckout(lines, index) {
+    for (let cursor = index - 1; cursor >= 0; cursor -= 1) {
+        const trimmed = lines[cursor].trim();
+        if (trimmed.startsWith("- uses:") || trimmed.startsWith("uses:"))
+            return /actions\/checkout@/.test(trimmed);
+    }
+    return false;
+}

package/dist/server.js

@@ -5,6 +5,7 @@ import { architectureFindings, fetchPublicBotHints } from "./review.js";
 import { looksLikeIac, ScanInputError } from "./iac/parse.js";
 import { filterFindings, scanIac, summarize } from "./iac/scan.js";
 import { registerConsultation } from "./application/tools.js";
+import { presentReview } from "./review-edits.js";
 import { VERSION } from "./version.js";
 const contentSchema = z
     .string()
@@ -104,18 +105,17 @@ export function createServer(remote = false) {
             const options = { focus, minSeverity, maxFindings };
             if (format !== "application" &&
                 (format !== "auto" || looksLikeIac(content))) {
-                return result({
+                return result(presentReview(content, {
                     ...scanIac(content, { ...options, format }),
                     botHints: await botHints,
-                });
+                }));
             }
             const findings = filterFindings(architectureFindings(content, focus).slice(1), options);
-            return result({
+            return result(presentReview(content, {
                 status: "completed",
                 engineVersion: VERSION,
                 format: "application",
                 focus,
-                summary: `Application review completed; ${findings.length} findings match the selected filters.`,
                 findings: findings.slice(0, maxFindings),
                 totalFindings: findings.length,
                 totals: summarize(findings),
@@ -125,7 +125,7 @@ export function createServer(remote = false) {
                     "Infrastructure bottleneck checks cover a disabled timeout, a one-connection pool, and an unbounded retry limit.",
                 ],
                 botHints: await botHints,
-            });
+            }));
         }
         catch (error) {
             return inputError(error);
@@ -180,7 +180,7 @@ export function createServer(remote = false) {
                     return unauthorizedContent(auth);
             }
             try {
-                return result(scanIac(content, { format, focus, minSeverity, maxFindings }));
+                return result(presentReview(content, scanIac(content, { format, focus, minSeverity, maxFindings })));
             }
             catch (error) {
                 return inputError(error);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.16";
+export declare const VERSION = "0.6.17";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.16";
+export const VERSION = "0.6.17";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.16",
+  "version": "0.6.17",
   "private": false,
   "publishConfig": {
     "access": "public"