@stealthmole/mcp 0.1.7 → 0.1.8

package/bin/cli.mjs

@@ -1,8 +1,327 @@
 #!/usr/bin/env node
 
+// NOTE: In MCP (Model Context Protocol), stdout is reserved for JSON-RPC messages.
+// All user-facing messages MUST use console.error (stderr), not console.log (stdout).
+
+import { createServer } from "net";
+import {
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+  renameSync,
+  unlinkSync,
+} from "fs";
+import { join } from "path";
+import { platform, homedir } from "os";
+
+// Read current package version for pinned auto-registration
+const PKG_VERSION = JSON.parse(
+  readFileSync(new URL("../package.json", import.meta.url), "utf-8")
+).version;
+
+/**
+ * Auto-register stealthmole.mcp in Claude Desktop's claude_desktop_config.json
+ * if not already present. Returns true if newly registered, false otherwise.
+ */
+function ensureClaudeDesktopConfig() {
+  try {
+    const os = platform();
+    let configDir;
+
+    if (os === "darwin") {
+      configDir = join(
+        homedir(),
+        "Library",
+        "Application Support",
+        "Claude"
+      );
+    } else if (os === "win32") {
+      if (!process.env.APPDATA) {
+        console.error(
+          "[stealthmole.mcp] APPDATA environment variable not set, skipping config registration."
+        );
+        return false;
+      }
+      configDir = join(process.env.APPDATA, "Claude");
+    } else {
+      // Linux: use XDG_CONFIG_HOME or fall back to ~/.config
+      configDir = join(
+        process.env.XDG_CONFIG_HOME || join(homedir(), ".config"),
+        "Claude"
+      );
+    }
+
+    const configPath = join(configDir, "claude_desktop_config.json");
+
+    let config;
+    try {
+      config = JSON.parse(readFileSync(configPath, "utf-8"));
+    } catch {
+      // File missing or invalid JSON — start fresh
+      config = {};
+    }
+
+    if (!config.mcpServers) {
+      config.mcpServers = {};
+    }
+
+    // Already registered — nothing to do
+    if (config.mcpServers["stealthmole.mcp"]) {
+      return false;
+    }
+
+    config.mcpServers["stealthmole.mcp"] = {
+      command: "npx",
+      args: ["-y", `@stealthmole/mcp@^${PKG_VERSION}`],
+    };
+
+    // Create directory with owner-only permissions if it doesn't exist
+    mkdirSync(configDir, { recursive: true, mode: 0o700 });
+
+    // Atomic write: write to temp file then rename to prevent data loss on concurrent runs
+    const tmpPath = configPath + ".tmp";
+    try {
+      writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n", {
+        encoding: "utf-8",
+        mode: 0o600,
+      });
+      renameSync(tmpPath, configPath);
+    } catch (writeErr) {
+      try {
+        unlinkSync(tmpPath);
+      } catch {
+        /* ignore cleanup failure */
+      }
+      throw writeErr;
+    }
+
+    console.error(
+      "\n[stealthmole.mcp] ✔ Registered stealthmole.mcp in Claude Desktop settings."
+    );
+    console.error(
+      "[stealthmole.mcp]   Please restart Claude Desktop to apply the changes.\n"
+    );
+    return true;
+  } catch (err) {
+    // Config write failed — warn and continue normal execution
+    if (process.argv.includes("--debug")) {
+      console.error(
+        `[stealthmole.mcp] ⚠ Failed to auto-register in Claude Desktop settings: ${err.message}`
+      );
+    } else {
+      console.error(
+        "[stealthmole.mcp] ⚠ Failed to auto-register in Claude Desktop settings."
+      );
+    }
+    return false;
+  }
+}
+
+const newlyRegistered = ensureClaudeDesktopConfig();
+
+// First run after registration: exit without starting the proxy
+if (newlyRegistered) {
+  process.exit(0);
+}
+
+const SERVER_URL = "https://mcp.stealthmole.com/mcp";
+const DEBUG = process.argv.includes("--debug");
+
+// Handle --help and --version before argv filtering
+if (process.argv.includes("--help") || process.argv.includes("-h")) {
+  console.error(
+    `stealthmole.mcp v${PKG_VERSION}\n` +
+      "\nUsage: npx stealthmole.mcp [options]\n" +
+      "\nOptions:\n" +
+      "  --port <number>           Callback port for OAuth redirect\n" +
+      "  --callback-port <number>  Alias for --port\n" +
+      "  --debug                   Enable debug logging\n" +
+      "  --help, -h                Show this help message\n" +
+      "  --version, -v             Show version number\n"
+  );
+  process.exit(0);
+}
+
+if (process.argv.includes("--version") || process.argv.includes("-v")) {
+  console.error(PKG_VERSION);
+  process.exit(0);
+}
+
 /**
- * Thin wrapper that delegates to the main stealthmole.mcp package.
- * This allows `npx stealthmole-mcp` to work as an alias for `npx stealthmole.mcp`.
+ * Find an available port not occupied by another process.
+ *
+ * Step 1: Bind to port 0 — OS assigns a candidate port
+ * Step 2: Close candidate, rebind explicitly to verify availability
+ *         (SO_REUSEADDR can cause listen(0) to return an in-use port)
+ * Step 3: On verification failure, retry with a new candidate (up to maxAttempts)
+ *
+ * The verified guard server is returned open to hold the port.
  */
+function findFreePort(maxAttempts = 20) {
+  let attempts = 0;
+
+  function tryOnce() {
+    return new Promise((resolve, reject) => {
+      // Step 1: Get a candidate port from the OS
+      const probe = createServer();
+      probe.listen(0, "127.0.0.1", () => {
+        const { port } = probe.address();
+        probe.close(() => {
+          // Step 2: Verify by explicitly rebinding to the same port
+          const guard = createServer();
+          guard.once("error", (err) => {
+            // Port occupied by another process — retry
+            attempts++;
+            if (DEBUG) {
+              console.error(
+                `Port ${port} is occupied by another process, retrying... (${attempts}/${maxAttempts})`
+              );
+            }
+            if (attempts >= maxAttempts) {
+              reject(
+                new Error(
+                  `Could not find a free port after ${maxAttempts} attempts`
+                )
+              );
+            } else {
+              resolve(tryOnce());
+            }
+          });
+          guard.listen(port, "127.0.0.1", () => {
+            // Port confirmed free — return with guard server still open
+            resolve({ port, server: guard });
+          });
+        });
+      });
+      probe.on("error", (err) => {
+        attempts++;
+        if (attempts >= maxAttempts) {
+          reject(err);
+        } else {
+          resolve(tryOnce());
+        }
+      });
+    });
+  }
+
+  return tryOnce();
+}
+
+// Show user-friendly message for EADDRINUSE instead of a stack trace
+process.on("uncaughtException", (err) => {
+  if (err.code === "EADDRINUSE") {
+    console.error(
+      `[stealthmole.mcp] Port ${err.port ?? ""} is already in use. ` +
+        "Retrying should resolve this. " +
+        "To use a specific port: npx stealthmole.mcp --port <number>"
+    );
+    process.exit(1);
+  }
+  // Re-throwing inside uncaughtException causes undefined behavior in Node.js.
+  // Log and exit instead.
+  console.error("[stealthmole.mcp] Unexpected error:", err);
+  process.exit(1);
+});
+
+const clientInfo = {
+  client_id: "stealthmole_front",
+  redirect_uris: ["http://127.0.0.1"],
+};
+if (process.env.STEALTHMOLE_CLIENT_SECRET) {
+  clientInfo.client_secret = process.env.STEALTHMOLE_CLIENT_SECRET;
+}
+const CLIENT_INFO = JSON.stringify(clientInfo);
+
+// Inline Keycloak OIDC metadata — includes offline_access for token refresh support
+// scope (string) controls actual scope sent to Keycloak via mcp-remote's getEffectiveScope()
+// scopes_supported (array) is declarative only — not used by mcp-remote for scope resolution
+const CLIENT_METADATA = JSON.stringify({
+  issuer: "https://xoxo.stealthmole.com/auth/realms/stealthmole",
+  authorization_endpoint:
+    "https://xoxo.stealthmole.com/auth/realms/stealthmole/protocol/openid-connect/auth",
+  token_endpoint:
+    "https://xoxo.stealthmole.com/auth/realms/stealthmole/protocol/openid-connect/token",
+  registration_endpoint:
+    "https://xoxo.stealthmole.com/auth/realms/stealthmole/clients-registrations/openid-connect",
+  jwks_uri:
+    "https://xoxo.stealthmole.com/auth/realms/stealthmole/protocol/openid-connect/certs",
+  scopes_supported: ["openid", "offline_access"],
+  response_types_supported: ["code"],
+  code_challenge_methods_supported: ["S256"],
+  token_endpoint_auth_methods_supported: [
+    "client_secret_basic",
+    "client_secret_post",
+    "none",
+  ],
+  scope: "openid offline_access",
+});
+
+// Extract only allowed flags and discard the rest
+// Prevents injection of unverified flags like --allow-http or --header
+const ALLOWED_FLAGS = new Set(["--port", "--callback-port", "--debug"]);
+const VALUE_FLAGS = new Set(["--port", "--callback-port"]);
+const filteredArgs = [];
+{
+  const rawArgs = process.argv.slice(2);
+  for (let i = 0; i < rawArgs.length; i++) {
+    if (rawArgs[i].startsWith("--")) {
+      if (ALLOWED_FLAGS.has(rawArgs[i])) {
+        if (VALUE_FLAGS.has(rawArgs[i]) && i + 1 < rawArgs.length) {
+          const val = rawArgs[i + 1];
+          const port = Number(val);
+          // Reject flag-like values and invalid port ranges
+          if (val.startsWith("--") || !Number.isInteger(port) || port < 1 || port > 65535) {
+            i++;
+            continue;
+          }
+          filteredArgs.push(rawArgs[i], val);
+          i++;
+        } else {
+          filteredArgs.push(rawArgs[i]);
+        }
+      }
+      // Unknown flags are silently ignored
+    }
+  }
+}
+process.argv.length = 2;
+process.argv.push(...filteredArgs);
+
+// Check if the user specified a callback port explicitly
+const userSpecifiedPort =
+  process.argv.includes("--port") || process.argv.includes("--callback-port");
+
+// Inject server URL as the first positional argument for mcp-remote
+process.argv.splice(2, 0, SERVER_URL);
+
+// If no port was specified, auto-discover a free port and inject it.
+// The guard server holds the port until mcp-remote is ready to bind.
+let guardServer = null;
+if (!userSpecifiedPort) {
+  const { port: callbackPort, server } = await findFreePort();
+  guardServer = server;
+  process.argv.splice(3, 0, String(callbackPort));
+  if (DEBUG) {
+    console.error(
+      `Using automatically selected callback port: ${callbackPort}`
+    );
+  }
+}
+
+process.argv.push("--static-oauth-client-info", CLIENT_INFO);
+process.argv.push("--static-oauth-client-metadata", CLIENT_METADATA);
+
+// Suppress mcp-remote startup logs unless --debug is set.
+// Uses mcp-remote's built-in --silent flag (safer than overriding console.error).
+if (!DEBUG) {
+  process.argv.push("--silent");
+}
+
+// Release the guard server and immediately start mcp-remote to minimize the TOCTOU window.
+// NOTE: mcp-remote binds the port itself, so the guard must be released first.
+// This brief TOCTOU window is an architectural constraint of mcp-remote.
+if (guardServer) {
+  await new Promise((resolve) => guardServer.close(resolve));
+}
 
-import "stealthmole.mcp/bin/cli.mjs";
+await import("mcp-remote/dist/proxy.js");

package/package.json

@@ -1,19 +1,23 @@
 {
   "name": "@stealthmole/mcp",
-  "version": "0.1.7",
-  "description": "StealthMole Threat Intelligence MCP client — alias package for stealthmole.mcp",
+  "version": "0.1.8",
+  "description": "StealthMole Threat Intelligence MCP client - connect Claude Desktop, Cursor, and other MCP clients to StealthMole API",
   "bin": {
     "stealthmole-mcp": "./bin/cli.mjs",
     "stealthmole.mcp": "./bin/cli.mjs"
   },
+  "scripts": {
+    "postinstall": "node scripts/patch-oauth-callback.mjs"
+  },
   "type": "module",
   "license": "MIT",
   "homepage": "https://www.stealthmole.com",
   "files": [
-    "bin/"
+    "bin/",
+    "scripts/"
   ],
   "dependencies": {
-    "stealthmole.mcp": "0.1.7"
+    "mcp-remote": "0.1.38"
   },
   "engines": {
     "node": ">=18.0.0"

package/scripts/patch-oauth-callback.mjs

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+
+/**
+ * Postinstall script that patches mcp-remote's OAuth callback page
+ * to redirect to https://www.stealthmole.com/ after successful authentication,
+ * instead of showing a "close this window" message.
+ *
+ * Safety:
+ * - Uses exact string matching (not greedy regex) to minimize unintended replacements
+ * - Verifies the result still contains the auth-code-received event emission
+ * - Non-fatal: CLI works normally even if patching fails
+ */
+
+import { readdirSync, readFileSync, writeFileSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+import { createRequire } from "module";
+
+// pnpm 호환: require.resolve로 mcp-remote의 실제 위치를 찾음
+// (pnpm은 node_modules를 symlink 구조로 관리하므로 상대 경로가 동작하지 않음)
+const require = createRequire(import.meta.url);
+const distDir = join(dirname(require.resolve("mcp-remote/package.json")), "dist");
+
+// Exact string that identifies the callback response in mcp-remote
+const OLD_RESPONSE = `res.send(\`
+      Authorization successful!
+      You may close this window and return to the CLI.
+      <script>
+        // If this is a non-interactive session (no manual approval step was required) then
+        // this should automatically close the window. If not, this will have no effect and
+        // the user will see the message above.
+        window.close();
+      </script>
+    \`)`;
+
+const NEW_HTML = [
+  "<!DOCTYPE html>",
+  '<html lang="en">',
+  "<head>",
+  '  <meta charset="utf-8">',
+  '  <meta http-equiv="refresh" content="3;url=https://www.stealthmole.com/">',
+  "  <title>Authorization Successful - StealthMole</title>",
+  "  <style>",
+  "    body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;justify-content:center;align-items:center;min-height:100vh;margin:0;background:#0f172a;color:#e2e8f0}",
+  "    .card{text-align:center;padding:2.5rem 3rem;background:#1e293b;border-radius:16px;box-shadow:0 4px 24px rgba(0,0,0,.3)}",
+  "    h1{font-size:1.4rem;margin:0 0 .8rem;color:#34d399}",
+  "    p{margin:0;font-size:.95rem;color:#94a3b8}",
+  "    span{color:#34d399;font-weight:600}",
+  "  </style>",
+  "</head>",
+  "<body>",
+  '  <div class="card">',
+  "    <h1>Authorization Successful</h1>",
+  '    <p>Redirecting to StealthMole in <span id="c">3</span>s\\u2026</p>',
+  "  </div>",
+  "  <script>",
+  '    var t=3,e=document.getElementById("c"),i=setInterval(function(){if(--t<=0){clearInterval(i);location.href="https://www.stealthmole.com/"}e.textContent=t},1e3);',
+  "  </script>",
+  "</body>",
+  "</html>",
+].join("\n");
+
+const NEW_RESPONSE = "res.send(`" + NEW_HTML + "`)";
+
+// Post-patch integrity marker: this line must exist after the patched res.send()
+const INTEGRITY_MARKER = 'options.events.emit("auth-code-received"';
+
+try {
+  const files = readdirSync(distDir).filter((f) => f.endsWith(".js"));
+  let patched = false;
+
+  for (const file of files) {
+    const filePath = join(distDir, file);
+    const content = readFileSync(filePath, "utf-8");
+
+    if (!content.includes(OLD_RESPONSE)) continue;
+
+    const newContent = content.replace(OLD_RESPONSE, NEW_RESPONSE);
+
+    // Verify: the replacement should change exactly one occurrence
+    if (newContent === content) continue;
+
+    // Integrity check: auth-code-received event must still be present
+    if (!newContent.includes(INTEGRITY_MARKER)) {
+      console.error(
+        `[stealthmole.mcp] Patch integrity check failed for ${file}, skipping.`
+      );
+      continue;
+    }
+
+    writeFileSync(filePath, newContent, "utf-8");
+    console.error(
+      `[stealthmole.mcp] Patched OAuth callback page in ${file}`
+    );
+    patched = true;
+  }
+
+  if (!patched) {
+    console.error(
+      "[stealthmole.mcp] OAuth callback page already patched or pattern not found."
+    );
+  }
+} catch {
+  // Non-fatal: if patching fails the CLI still works, just shows the default page
+  console.error(
+    "[stealthmole.mcp] Could not patch OAuth callback page."
+  );
+}