@skaleagents/swarm 0.6.16 → 0.6.18

package/README.md

@@ -1,7 +1,13 @@
 # @skaleagents/swarm
 
-SkaleAgents MCP server with local stdio and hosted Streamable HTTP transports.
-Uses browser OAuth for sign-in.
+SkaleAgents MCP server. The hosted connection is `https://skaleagents.com/mcp`.
+
+## Quick start
+
+Copy `https://skaleagents.com/mcp` into your client and choose OAuth. Sign in
+with Google and click Allow. Leave client ID and secret blank when the client
+asks. Setup steps for Cursor, Claude Code, Claude Desktop, ChatGPT, and Codex
+are on the [MCP config page](https://skaleagents.com/mcp-config).
 
 Tools: `plan_architecture_review`, `review_application_architecture`,
 `review_architecture`, and `scan_iac`. The older `scan_iac_stub` name remains
@@ -56,7 +62,7 @@ for every review area, and the next questions. The MCP provides static evidence
 and the connected assistant's model reasons through the architecture. No
 separate hosted model is invoked, and the tools do not clone repositories or
 run submitted code. A clean static check is not a whole-system correctness
-verdict. The [settings page](https://skaleagents.com/settings) has an interactive
+verdict. The [MCP config page](https://skaleagents.com/mcp-config) has an interactive
 review-brief builder.
 
 ## Infrastructure scanning
@@ -102,15 +108,9 @@ locations point to resource declarations; property paths identify the setting.
 YAML aliases must be expanded before submission. Coverage limits are included
 in every result. An empty finding list is not proof that a system is secure.
 
-## Hosted connection
+## Hosted transport
 
-Use `https://skaleagents.com/mcp` in Claude Desktop or ChatGPT's custom connector
-settings. Choose OAuth and leave client ID and secret fields blank. The client
-registers itself, opens Google sign-in, and asks you to approve MCP access.
-See [client setup](https://skaleagents.com/settings) for Cursor, Claude Code,
-Claude Desktop, ChatGPT, and Codex instructions.
-
-The web app hosts this endpoint using `handleMcpRequest` from
+The web app hosts `https://skaleagents.com/mcp` using `handleMcpRequest` from
 `@skaleagents/swarm/http`. Audit workers import `scanIac` from
 `@skaleagents/swarm/scan`. It validates each bearer credential with the API's
 `/api/oauth/mcp-token` endpoint before running a tool. Tokens are bound to the
@@ -120,94 +120,23 @@ forwarded to the public bot directory.
 `protectedResourceMetadata` exports the discovery response for
 `/.well-known/oauth-protected-resource/mcp`.
 
-## Local stdio prerequisites
-
-1. Node.js 20 or newer. The client connects to `https://api.skaleagents.com` by default.
-2. A browser that can open the SkaleAgents sign-in page.
-
-The first tool call opens browser sign-in. Approve MCP access there and return
-to your AI client. The package stores the OAuth refresh credential locally and
-refreshes access automatically. You do not need to create or paste an API key.
-Active connections can be revoked from the web app's MCP settings page.
-
-Local `review_architecture` calls validate the account and fetch public bot
-hints concurrently. The public directory request carries no credential. Every
-review still requires successful account validation. An anonymous directory
-request may already be in flight when validation rejects a connection.
-
 ## Local development
 
+People working on this repo need Node.js 20 or newer. This is not the way to connect a client.
+
 ```bash
 git clone https://github.com/SkaleAgents/mcp-server.git
 cd mcp-server
 npm install
-cp .env.example .env
 npm run build
 npm test
-npm run smoke   # needs API on :8082
-```
-
-## Cursor
-
-Add to `.cursor/mcp.json` (project) or Cursor Settings → MCP:
-
-### Option A: local clone (recommended while API is local)
-
-```json
-{
-  "mcpServers": {
-    "skaleagents": {
-      "command": "node",
-      "args": ["/absolute/path/to/mcp-server/dist/index.js"],
-      "env": {
-        "PLATFORM_API_URL": "http://localhost:8082"
-      }
-    }
-  }
-}
 ```
 
-Dev without build:
-
-```json
-{
-  "mcpServers": {
-    "skaleagents": {
-      "command": "npx",
-      "args": ["tsx", "/absolute/path/to/mcp-server/src/index.ts"],
-      "env": {
-        "PLATFORM_API_URL": "http://localhost:8082"
-      }
-    }
-  }
-}
-```
-
-### Option B: published package (hosted API)
-
-```json
-{
-  "mcpServers": {
-    "skaleagents": {
-      "command": "npx",
-       "args": ["-y", "@skaleagents/swarm@0.6.1"]
-    }
-  }
-}
-```
-
-Reconnect after upgrading to refresh the tool catalog. The consultation tools,
-snippet review, IaC scanner, and compatibility alias should all appear.
-
-## Claude Code
-
-Use the published package configuration above in `.mcp.json`. OAuth starts on the first tool call. No API URL or keys are needed.
-
 ## Environment
 
 | Variable | Required | Description |
 |----------|----------|-------------|
-| `SKALEAGENTS_API_TOKEN` | No | Legacy Sanctum bearer-token override. OAuth is used when empty. |
+| `SKALEAGENTS_API_TOKEN` | No | Legacy override for CI only, not the way to connect. |
 | `PLATFORM_API_URL` | No | Defaults to `https://api.skaleagents.com`. Override only for local development or another API deployment. Empty values use the default. |
 | `SKALEAGENTS_OAUTH_CACHE` | No | OAuth cache path. Default `~/.config/skaleagents/oauth.json`. |
 | `SKALEAGENTS_OAUTH_ENABLED` | No | Set to `false` only to disable browser OAuth. |
@@ -215,7 +144,7 @@ Use the published package configuration above in `.mcp.json`. OAuth starts on th
 
 ## Steady-state tool latency probe
 
-With an existing, authorized `SKALEAGENTS_API_TOKEN` in the environment, run
+This probe uses the legacy `SKALEAGENTS_API_TOKEN` CI override. It is not how a client connects. With that variable already set, run
 `npm run benchmark:tool`. The script builds this checkout, starts its stdio MCP
 server, makes five warmup calls, then times 50 `review_architecture` calls on a
 fixed synthetic application snippet. Set `BENCHMARK_WARMUP` from 0 to 20 and

package/dist/http.js

@@ -33,7 +33,7 @@ export function protectedResourceMetadata() {
         authorization_servers: [getApiUrl()],
         scopes_supported: ["mcp"],
         bearer_methods_supported: ["header"],
-        resource_documentation: "https://skaleagents.com/settings",
+        resource_documentation: "https://skaleagents.com/mcp-config",
     });
 }
 export async function handleMcpRequest(request) {

package/dist/review-edits.d.ts

@@ -0,0 +1,21 @@
+export type ExactLineEdit = {
+    diff: string;
+    from: string;
+    to: string | null;
+};
+export declare function exactLineEdit(content: string, title: string): ExactLineEdit | null;
+export declare function rankFindings<T extends {
+    severity: string;
+}>(findings: T[]): T[];
+export declare function changePhrase(edit: ExactLineEdit): string;
+type RankedFinding = {
+    title: string;
+    severity: string;
+    proposedChange?: ExactLineEdit;
+};
+export declare function presentReview(content: string, output: Record<string, unknown>): {
+    findings: any[];
+    priority: RankedFinding[];
+    summary: string;
+};
+export {};

package/dist/review-edits.js

@@ -0,0 +1,145 @@
+const severityOrder = ["critical", "high", "medium", "low", "info"];
+const noFindingsSummary = "No findings. That does not prove the system is secure.";
+const rules = {
+    "Dockerfile runs as root": dockerfileUser,
+    "Workflow permissions are broad": workflowPermissions,
+    "Elevated container privileges": privilegedContainer,
+    "Privileged container in a Helm template": privilegedContainer,
+    "Database publicly accessible": publicDatabase,
+    "Database or storage allows public network access": publicNetworkAccess,
+    "Storage encryption disabled": storageEncryption,
+    "Pull request target checks out PR code": pullRequestTargetCheckout,
+};
+export function exactLineEdit(content, title) {
+    const rule = rules[title];
+    if (!rule)
+        return null;
+    return rule(content.split("\n"));
+}
+export function rankFindings(findings) {
+    return findings
+        .map((finding, index) => ({ finding, index }))
+        .sort((left, right) => {
+        const leftRank = severityOrder.indexOf(left.finding.severity);
+        const rightRank = severityOrder.indexOf(right.finding.severity);
+        return (leftRank === -1 ? severityOrder.length : leftRank) - (rightRank === -1 ? severityOrder.length : rightRank) || left.index - right.index;
+    })
+        .map((item) => item.finding);
+}
+export function changePhrase(edit) {
+    if (edit.to === null)
+        return `${edit.from.trim()} removed`;
+    return `${edit.from.trim()} becomes ${edit.to.trim()}`;
+}
+function isRankedFinding(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const finding = value;
+    return typeof finding.title === "string" && typeof finding.severity === "string";
+}
+export function presentReview(content, output) {
+    const raw = Array.isArray(output.findings) ? output.findings : [];
+    const findings = raw.map((finding) => {
+        if (!isRankedFinding(finding))
+            return finding;
+        const edit = exactLineEdit(content, finding.title);
+        if (!edit)
+            return finding;
+        return { ...finding, proposedChange: edit };
+    });
+    const priority = rankFindings(findings.filter(isRankedFinding)).slice(0, 3);
+    return {
+        ...output,
+        findings,
+        priority,
+        summary: priority.length === 0
+            ? noFindingsSummary
+            : `Fix these first: ${priority.map((finding) => finding.proposedChange ? `${finding.title}: ${changePhrase(finding.proposedChange)}` : finding.title).join(", ")}.`,
+    };
+}
+function dockerfileUser(lines) {
+    const exact = lines.flatMap((line, index) => line === "USER root" || line === "USER 0" ? [{ line, index }] : []);
+    if (exact.length !== 1)
+        return null;
+    return replacement(exact[0].line, "USER nobody", exact[0].index);
+}
+function workflowPermissions(lines) {
+    const exact = lines.flatMap((line, index) => line.trim() === "permissions: write-all" ? [{ line, index }] : []);
+    if (exact.length !== 1)
+        return null;
+    const indent = exact[0].line.match(/^\s*/)?.[0] ?? "";
+    return replacement(exact[0].line, `${indent}permissions: contents: read`, exact[0].index);
+}
+function privilegedContainer(lines) {
+    return oneExactReplacement(lines, [{ from: "privileged: true", to: "privileged: false" }]);
+}
+function publicDatabase(lines) {
+    return oneExactReplacement(lines, [{ from: "publicly_accessible = true", to: "publicly_accessible = false" }]);
+}
+function publicNetworkAccess(lines) {
+    return oneExactReplacement(lines, [
+        { from: "publicNetworkAccess: 'Enabled'", to: "publicNetworkAccess: 'Disabled'" },
+        { from: "publicNetworkAccess: \"Enabled\"", to: "publicNetworkAccess: \"Disabled\"" },
+    ]);
+}
+function storageEncryption(lines) {
+    return oneExactReplacement(lines, [
+        { from: "storage_encrypted = false", to: "storage_encrypted = true" },
+        { from: "encrypted: false", to: "encrypted: true" },
+        { from: "encrypted = false", to: "encrypted = true" },
+    ]);
+}
+function pullRequestTargetCheckout(lines) {
+    const exact = lines.flatMap((line, index) => isExactHeadRefLine(line) ? [{ line, index }] : []);
+    if (exact.length !== 1)
+        return null;
+    const match = exact[0];
+    if (!isPullRequestTargetWorkflow(lines) || !refBelongsToCheckout(lines, match.index))
+        return null;
+    return {
+        from: match.line,
+        to: null,
+        diff: [
+            `@@ -${match.index + 1},1 +${Math.max(match.index, 0)},0 @@`,
+            `-${match.line}`,
+        ].join("\n"),
+    };
+}
+function oneExactReplacement(lines, pairs) {
+    const matches = lines.flatMap((line, index) => {
+        const pair = pairs.find((item) => item.from === line.trim());
+        return pair ? [{ line, index, to: pair.to }] : [];
+    });
+    if (matches.length !== 1)
+        return null;
+    const indent = matches[0].line.match(/^\s*/)?.[0] ?? "";
+    return replacement(matches[0].line, `${indent}${matches[0].to}`, matches[0].index);
+}
+function replacement(from, to, lineIndex) {
+    const line = lineIndex + 1;
+    return {
+        from,
+        to,
+        diff: [`@@ -${line},1 +${line},1 @@`, `-${from}`, `+${to}`].join("\n"),
+    };
+}
+function isExactHeadRefLine(line) {
+    const trimmed = line.trim();
+    return trimmed === "ref: ${{ github.event.pull_request.head.ref }}" || trimmed === "ref: ${{ github.event.pull_request.head.sha }}";
+}
+function isPullRequestTargetWorkflow(lines) {
+    return lines.some((line) => {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("#"))
+            return false;
+        return trimmed === "on: pull_request_target" || trimmed === "pull_request_target:" || trimmed.startsWith("pull_request_target:");
+    });
+}
+function refBelongsToCheckout(lines, index) {
+    for (let cursor = index - 1; cursor >= 0; cursor -= 1) {
+        const trimmed = lines[cursor].trim();
+        if (trimmed.startsWith("- uses:") || trimmed.startsWith("uses:"))
+            return /actions\/checkout@/.test(trimmed);
+    }
+    return false;
+}

package/dist/server.js

@@ -5,6 +5,7 @@ import { architectureFindings, fetchPublicBotHints } from "./review.js";
 import { looksLikeIac, ScanInputError } from "./iac/parse.js";
 import { filterFindings, scanIac, summarize } from "./iac/scan.js";
 import { registerConsultation } from "./application/tools.js";
+import { presentReview } from "./review-edits.js";
 import { VERSION } from "./version.js";
 const contentSchema = z
     .string()
@@ -104,18 +105,17 @@ export function createServer(remote = false) {
             const options = { focus, minSeverity, maxFindings };
             if (format !== "application" &&
                 (format !== "auto" || looksLikeIac(content))) {
-                return result({
+                return result(presentReview(content, {
                     ...scanIac(content, { ...options, format }),
                     botHints: await botHints,
-                });
+                }));
             }
             const findings = filterFindings(architectureFindings(content, focus).slice(1), options);
-            return result({
+            return result(presentReview(content, {
                 status: "completed",
                 engineVersion: VERSION,
                 format: "application",
                 focus,
-                summary: `Application review completed; ${findings.length} findings match the selected filters.`,
                 findings: findings.slice(0, maxFindings),
                 totalFindings: findings.length,
                 totals: summarize(findings),
@@ -125,7 +125,7 @@ export function createServer(remote = false) {
                     "Infrastructure bottleneck checks cover a disabled timeout, a one-connection pool, and an unbounded retry limit.",
                 ],
                 botHints: await botHints,
-            });
+            }));
         }
         catch (error) {
             return inputError(error);
@@ -180,7 +180,7 @@ export function createServer(remote = false) {
                     return unauthorizedContent(auth);
             }
             try {
-                return result(scanIac(content, { format, focus, minSeverity, maxFindings }));
+                return result(presentReview(content, scanIac(content, { format, focus, minSeverity, maxFindings })));
             }
             catch (error) {
                 return inputError(error);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.16";
+export declare const VERSION = "0.6.18";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.16";
+export const VERSION = "0.6.18";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.16",
+  "version": "0.6.18",
   "private": false,
   "publishConfig": {
     "access": "public"