@tankpkg/mcp-server 0.4.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tank Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,132 @@
+# @tankpkg/mcp-server
+
+MCP (Model Context Protocol) server for Tank - scan and publish AI agent skills directly from your editor.
+
+## Features
+
+- **scan-skill** - Scan a skill directory for security issues
+- **publish-skill** - Publish a skill to the Tank registry (with dry-run support)
+- **search-skills** - Search the Tank registry for skills
+- **skill-info** - Get detailed information about a specific skill
+- **login** - Authenticate with Tank via GitHub OAuth
+
+## Installation
+
+### Claude Code
+
+Add to `.claude/settings.json` or your project's `.mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "tank": {
+      "command": "npx",
+      "args": ["-y", "@tankpkg/mcp-server"]
+    }
+  }
+}
+```
+
+### Cursor
+
+Add to `~/.cursor/mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "tank": {
+      "command": "npx",
+      "args": ["-y", "@tankpkg/mcp-server"]
+    }
+  }
+}
+```
+
+### VS Code (Copilot)
+
+Add to `.vscode/mcp.json`:
+
+```json
+{
+  "servers": {
+    "tank": {
+      "command": "npx",
+      "args": ["-y", "@tankpkg/mcp-server"]
+    }
+  }
+}
+```
+
+## Authentication
+
+The MCP server shares authentication with the Tank CLI. If you've already run `tank login`, you're authenticated!
+
+Alternatively, set the `TANK_TOKEN` environment variable:
+
+```json
+{
+  "mcpServers": {
+    "tank": {
+      "command": "npx",
+      "args": ["-y", "@tankpkg/mcp-server"],
+      "env": {
+        "TANK_TOKEN": "tank_your_token_here"
+      }
+    }
+  }
+}
+```
+
+## Usage Examples
+
+Once configured, talk to your AI agent naturally:
+
+### Scan a skill for security issues
+
+```
+"Scan my skill in the ./my-skill folder for security issues"
+```
+
+### Publish a skill
+
+```
+"Publish my-skill as a public package"
+```
+
+### Dry run before publishing
+
+```
+"Do a dry run publish of my skill to check if everything looks good"
+```
+
+### Search for skills
+
+```
+"Search Tank for code review skills"
+```
+
+### Get skill info
+
+```
+"Get info about @tank/code-review skill"
+```
+
+## Development
+
+```bash
+# Install dependencies
+pnpm install
+
+# Build
+pnpm build
+
+# Run tests
+pnpm test
+
+# Start the server (stdio mode)
+pnpm start
+```
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+// Import tools
+import { registerLoginTool } from './tools/login.js';
+import { registerSearchSkillsTool } from './tools/search-skills.js';
+import { registerSkillInfoTool } from './tools/skill-info.js';
+import { registerScanSkillTool } from './tools/scan-skill.js';
+import { registerPublishSkillTool } from './tools/publish-skill.js';
+// Create MCP server instance
+const server = new McpServer({
+    name: 'tank',
+    version: '0.1.0',
+});
+// Register all tools
+registerLoginTool(server);
+registerSearchSkillsTool(server);
+registerSkillInfoTool(server);
+registerScanSkillTool(server);
+registerPublishSkillTool(server);
+// Start stdio transport
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((error) => {
+    console.error('MCP server error:', error);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,eAAe;AACf,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,6BAA6B;AAC7B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,qBAAqB;AACrB,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAC1B,wBAAwB,CAAC,MAAM,CAAC,CAAC;AACjC,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAC9B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAC9B,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAEjC,wBAAwB;AACxB,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lib/api-client.d.ts

@@ -0,0 +1,44 @@
+export interface ApiClientOptions {
+    configDir?: string;
+}
+/**
+ * Tank API client for MCP server.
+ */
+export declare class TankApiClient {
+    private config;
+    constructor(options?: ApiClientOptions);
+    /**
+     * Get the base URL for the Tank API.
+     */
+    get baseUrl(): string;
+    /**
+     * Get the auth token (if available).
+     */
+    get token(): string | undefined;
+    /**
+     * Check if authenticated.
+     */
+    get isAuthenticated(): boolean;
+    /**
+     * Make an authenticated API request.
+     */
+    fetch<T>(path: string, options?: RequestInit): Promise<{
+        data: T;
+        ok: true;
+    } | {
+        error: string;
+        status: number;
+        ok: false;
+    }>;
+    /**
+     * Verify current auth token is valid.
+     */
+    verifyAuth(): Promise<{
+        valid: boolean;
+        user?: {
+            name: string | null;
+            email: string | null;
+        };
+    }>;
+}
+//# sourceMappingURL=api-client.d.ts.map

package/dist/lib/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAa;gBAEf,OAAO,GAAE,gBAAqB;IAI1C;;OAEG;IACH,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED;;OAEG;IACH,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED;;OAEG;IACG,KAAK,CAAC,CAAC,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,CAAC;QAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,KAAK,CAAA;KAAE,CAAC;IAqChF;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAA;KAAE,CAAC;CAetG"}

package/dist/lib/api-client.js

@@ -0,0 +1,78 @@
+import { getConfig } from './config.js';
+/**
+ * Tank API client for MCP server.
+ */
+export class TankApiClient {
+    config;
+    constructor(options = {}) {
+        this.config = getConfig(options.configDir);
+    }
+    /**
+     * Get the base URL for the Tank API.
+     */
+    get baseUrl() {
+        return this.config.registry;
+    }
+    /**
+     * Get the auth token (if available).
+     */
+    get token() {
+        return this.config.token;
+    }
+    /**
+     * Check if authenticated.
+     */
+    get isAuthenticated() {
+        return !!this.config.token;
+    }
+    /**
+     * Make an authenticated API request.
+     */
+    async fetch(path, options = {}) {
+        const url = `${this.baseUrl}${path}`;
+        const headers = {
+            'Content-Type': 'application/json',
+            ...options.headers,
+        };
+        if (this.config.token) {
+            headers['Authorization'] = `Bearer ${this.config.token}`;
+        }
+        try {
+            const response = await fetch(url, {
+                ...options,
+                headers,
+            });
+            if (!response.ok) {
+                const body = await response.json().catch(() => ({}));
+                return {
+                    error: body.error ?? response.statusText,
+                    status: response.status,
+                    ok: false,
+                };
+            }
+            const data = await response.json();
+            return { data, ok: true };
+        }
+        catch (err) {
+            return {
+                error: err instanceof Error ? err.message : 'Network error',
+                status: 0,
+                ok: false,
+            };
+        }
+    }
+    /**
+     * Verify current auth token is valid.
+     */
+    async verifyAuth() {
+        if (!this.config.token) {
+            return { valid: false };
+        }
+        const result = await this.fetch('/api/v1/auth/whoami');
+        if (result.ok) {
+            return { valid: true, user: result.data.user };
+        }
+        return { valid: false };
+    }
+}
+//# sourceMappingURL=api-client.js.map

package/dist/lib/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAmB,MAAM,aAAa,CAAC;AAMzD;;GAEG;AACH,MAAM,OAAO,aAAa;IAChB,MAAM,CAAa;IAE3B,YAAY,UAA4B,EAAE;QACxC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,eAAe;QACjB,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CACT,IAAY,EACZ,UAAuB,EAAE;QAEzB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,GAAI,OAAO,CAAC,OAAkC;SAC/C,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,GAAG,OAAO;gBACV,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrD,OAAO;oBACL,KAAK,EAAG,IAA2B,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU;oBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,EAAE,EAAE,KAAK;iBACV,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAO,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;gBAC3D,MAAM,EAAE,CAAC;gBACT,EAAE,EAAE,KAAK;aACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,qBAAqB,CACtB,CAAC;QAEF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;CACF"}

package/dist/lib/config.d.ts

@@ -0,0 +1,25 @@
+export interface TankConfig {
+    token?: string;
+    user?: {
+        name: string;
+        email: string;
+    };
+    registry: string;
+}
+/**
+ * Get the path to the tank config directory.
+ */
+export declare function getConfigDir(configDir?: string): string;
+/**
+ * Get the path to the tank config file.
+ */
+export declare function getConfigPath(configDir?: string): string;
+/**
+ * Read the tank config file. Returns defaults if file doesn't exist.
+ */
+export declare function getConfig(configDir?: string): TankConfig;
+/**
+ * Write config to disk. Merges with existing config.
+ */
+export declare function setConfig(partial: Partial<TankConfig>, configDir?: string): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/lib/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAMD;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAoBxD;AAED;;GAEG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAC5B,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CAeN"}

package/dist/lib/config.js

@@ -0,0 +1,59 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+const DEFAULT_CONFIG = {
+    registry: 'https://tankpkg.dev',
+};
+/**
+ * Get the path to the tank config directory.
+ */
+export function getConfigDir(configDir) {
+    return configDir ?? path.join(os.homedir(), '.tank');
+}
+/**
+ * Get the path to the tank config file.
+ */
+export function getConfigPath(configDir) {
+    return path.join(getConfigDir(configDir), 'config.json');
+}
+/**
+ * Read the tank config file. Returns defaults if file doesn't exist.
+ */
+export function getConfig(configDir) {
+    const configPath = getConfigPath(configDir);
+    try {
+        const raw = fs.readFileSync(configPath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        const merged = { ...DEFAULT_CONFIG, ...parsed };
+        // TANK_TOKEN env var takes priority
+        const envToken = process.env.TANK_TOKEN?.trim();
+        if (envToken) {
+            merged.token = envToken;
+        }
+        return merged;
+    }
+    catch {
+        const envToken = process.env.TANK_TOKEN?.trim();
+        return {
+            ...DEFAULT_CONFIG,
+            ...(envToken ? { token: envToken } : {}),
+        };
+    }
+}
+/**
+ * Write config to disk. Merges with existing config.
+ */
+export function setConfig(partial, configDir) {
+    const dir = getConfigDir(configDir);
+    const configPath = getConfigPath(configDir);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    const existing = getConfig(configDir);
+    const merged = { ...existing, ...partial };
+    fs.writeFileSync(configPath, JSON.stringify(merged, null, 2) + '\n', {
+        encoding: 'utf-8',
+        mode: 0o600,
+    });
+}
+//# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAQzB,MAAM,cAAc,GAAe;IACjC,QAAQ,EAAE,qBAAqB;CAChC,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,SAAkB;IAC7C,OAAO,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,SAAkB;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,SAAkB;IAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACtD,MAAM,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;QAChD,oCAAoC;QACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QAChD,OAAO;YACL,GAAG,cAAc;YACjB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CACvB,OAA4B,EAC5B,SAAkB;IAElB,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;IAE3C,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QACnE,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/packer.d.ts

@@ -0,0 +1,14 @@
+export interface PackResult {
+    tarball: Buffer;
+    integrity: string;
+    fileCount: number;
+    totalSize: number;
+    readme: string;
+    files: string[];
+    manifest: Record<string, unknown>;
+}
+/**
+ * Pack a skill directory into a .tgz tarball with integrity hashing.
+ */
+export declare function pack(directory: string): Promise<PackResult>;
+//# sourceMappingURL=packer.d.ts.map

package/dist/lib/packer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"packer.d.ts","sourceRoot":"","sources":["../../src/lib/packer.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAsB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkGjE"}

package/dist/lib/packer.js

@@ -0,0 +1,191 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { create } from 'tar';
+import ignore from 'ignore';
+import { skillsJsonSchema } from '@tank/shared';
+// Limits
+const MAX_PACKAGE_SIZE = 50 * 1024 * 1024; // 50MB
+const MAX_FILE_COUNT = 1000;
+// Default ignore patterns
+const DEFAULT_IGNORES = [
+    'node_modules',
+    '.git',
+    '.env*',
+    '*.log',
+    '.tank',
+    '.DS_Store',
+];
+// Always ignored regardless of ignore file contents
+const ALWAYS_IGNORED = ['node_modules', '.git'];
+// Ignore file names (not packed into tarball)
+const IGNORE_FILES = ['.tankignore', '.gitignore'];
+/**
+ * Pack a skill directory into a .tgz tarball with integrity hashing.
+ */
+export async function pack(directory) {
+    const absDir = path.resolve(directory);
+    // 1. Verify directory exists
+    if (!fs.existsSync(absDir)) {
+        throw new Error(`Directory does not exist: ${absDir}`);
+    }
+    const stat = fs.statSync(absDir);
+    if (!stat.isDirectory()) {
+        throw new Error(`Not a directory: ${absDir}`);
+    }
+    // 2. Verify skills.json exists and is valid
+    const skillsJsonPath = path.join(absDir, 'skills.json');
+    if (!fs.existsSync(skillsJsonPath)) {
+        throw new Error('Missing required file: skills.json');
+    }
+    let skillsJsonContent;
+    try {
+        skillsJsonContent = fs.readFileSync(skillsJsonPath, 'utf-8');
+    }
+    catch {
+        throw new Error('Failed to read skills.json');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(skillsJsonContent);
+    }
+    catch {
+        throw new Error('Invalid skills.json: not valid JSON');
+    }
+    const validation = skillsJsonSchema.safeParse(parsed);
+    if (!validation.success) {
+        const issues = validation.error.issues
+            .map((i) => `  - ${i.path.join('.')}: ${i.message}`)
+            .join('\n');
+        throw new Error(`Invalid skills.json:\n${issues}`);
+    }
+    // 3. Verify SKILL.md exists and read its content
+    const skillMdPath = path.join(absDir, 'SKILL.md');
+    if (!fs.existsSync(skillMdPath)) {
+        throw new Error('Missing required file: SKILL.md');
+    }
+    let readmeContent;
+    try {
+        readmeContent = fs.readFileSync(skillMdPath, 'utf-8');
+    }
+    catch {
+        throw new Error('Failed to read SKILL.md');
+    }
+    // 4. Build ignore filter
+    const ig = buildIgnoreFilter(absDir);
+    // 5. Collect files with validation
+    const files = collectFiles(absDir, absDir, ig);
+    // 6. Enforce file count limit
+    if (files.length > MAX_FILE_COUNT) {
+        throw new Error(`Too many files: ${files.length} exceeds maximum of ${MAX_FILE_COUNT}`);
+    }
+    // 7. Calculate total size of source files
+    let totalSize = 0;
+    for (const file of files) {
+        const filePath = path.join(absDir, file);
+        const fileStat = fs.statSync(filePath);
+        totalSize += fileStat.size;
+    }
+    // 8. Create tarball
+    const tarball = await createTarball(absDir, files);
+    // 9. Enforce tarball size limit
+    if (tarball.length > MAX_PACKAGE_SIZE) {
+        throw new Error(`Tarball too large: ${tarball.length} bytes exceeds maximum of ${MAX_PACKAGE_SIZE} bytes (50MB)`);
+    }
+    // 10. Compute integrity hash
+    const hash = crypto.createHash('sha512').update(tarball).digest('base64');
+    const integrity = `sha512-${hash}`;
+    return {
+        tarball,
+        integrity,
+        fileCount: files.length,
+        totalSize,
+        readme: readmeContent,
+        files,
+        manifest: validation.data,
+    };
+}
+/**
+ * Build an ignore filter from .tankignore, .gitignore, or defaults.
+ */
+function buildIgnoreFilter(dir) {
+    const ig = ignore();
+    ig.add(ALWAYS_IGNORED);
+    const tankIgnorePath = path.join(dir, '.tankignore');
+    const gitIgnorePath = path.join(dir, '.gitignore');
+    if (fs.existsSync(tankIgnorePath)) {
+        const content = fs.readFileSync(tankIgnorePath, 'utf-8');
+        ig.add(content);
+        ig.add(IGNORE_FILES);
+    }
+    else if (fs.existsSync(gitIgnorePath)) {
+        const content = fs.readFileSync(gitIgnorePath, 'utf-8');
+        ig.add(content);
+        ig.add(IGNORE_FILES);
+    }
+    else {
+        ig.add(DEFAULT_IGNORES);
+    }
+    return ig;
+}
+/**
+ * Recursively collect files from a directory.
+ */
+function collectFiles(baseDir, currentDir, ig) {
+    const files = [];
+    const entries = fs.readdirSync(currentDir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(currentDir, entry.name);
+        const relativePath = path.relative(baseDir, fullPath);
+        // Security: check for path traversal
+        if (relativePath.split(path.sep).includes('..')) {
+            throw new Error(`Path traversal detected: "${relativePath}" contains ".." component`);
+        }
+        // Security: check for absolute paths
+        if (path.isAbsolute(relativePath)) {
+            throw new Error(`Absolute path detected: "${relativePath}"`);
+        }
+        // Security: check for symlinks
+        const lstatResult = fs.lstatSync(fullPath);
+        if (lstatResult.isSymbolicLink()) {
+            throw new Error(`Symlink detected: "${relativePath}" — symlinks are not allowed`);
+        }
+        const pathForIgnore = lstatResult.isDirectory()
+            ? relativePath + '/'
+            : relativePath;
+        if (ig.ignores(pathForIgnore)) {
+            continue;
+        }
+        if (lstatResult.isDirectory()) {
+            const subFiles = collectFiles(baseDir, fullPath, ig);
+            files.push(...subFiles);
+        }
+        else if (lstatResult.isFile()) {
+            files.push(relativePath);
+        }
+    }
+    return files;
+}
+/**
+ * Create a gzipped tarball from the given files.
+ */
+async function createTarball(cwd, files) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        const stream = create({
+            gzip: true,
+            cwd,
+            portable: true,
+        }, files);
+        stream.on('data', (chunk) => {
+            chunks.push(chunk);
+        });
+        stream.on('end', () => {
+            resolve(Buffer.concat(chunks));
+        });
+        stream.on('error', (err) => {
+            reject(err);
+        });
+    });
+}
+//# sourceMappingURL=packer.js.map

package/dist/lib/packer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packer.js","sourceRoot":"","sources":["../../src/lib/packer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,SAAS;AACT,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAClD,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,0BAA0B;AAC1B,MAAM,eAAe,GAAG;IACtB,cAAc;IACd,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,WAAW;CACZ,CAAC;AAEF,oDAAoD;AACpD,MAAM,cAAc,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;AAEhD,8CAA8C;AAC9C,MAAM,YAAY,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;AAYnD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,SAAiB;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEvC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,4CAA4C;IAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,iBAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,iBAAiB,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM;aACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,iDAAiD;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IAED,yBAAyB;IACzB,MAAM,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAErC,mCAAmC;IACnC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAE/C,8BAA8B;IAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,MAAM,uBAAuB,cAAc,EAAE,CACvE,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,oBAAoB;IACpB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAEnD,gCAAgC;IAChC,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,MAAM,6BAA6B,gBAAgB,eAAe,CACjG,CAAC;IACJ,CAAC;IAED,6BAA6B;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,UAAU,IAAI,EAAE,CAAC;IAEnC,OAAO;QACL,OAAO;QACP,SAAS;QACT,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,SAAS;QACT,MAAM,EAAE,aAAa;QACrB,KAAK;QACL,QAAQ,EAAE,UAAU,CAAC,IAA+B;KACrD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IAEpB,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAEvB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAEnD,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACzD,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChB,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvB,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACxD,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChB,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CACnB,OAAe,EACf,UAAkB,EAClB,EAA6B;IAE7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEtD,qCAAqC;QACrC,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,2BAA2B,CACrE,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,+BAA+B;QAC/B,MAAM,WAAW,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,cAAc,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sBAAsB,YAAY,8BAA8B,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,EAAE;YAC7C,CAAC,CAAC,YAAY,GAAG,GAAG;YACpB,CAAC,CAAC,YAAY,CAAC;QAEjB,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,KAAe;IACvD,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,CACnB;YACE,IAAI,EAAE,IAAI;YACV,GAAG;YACH,QAAQ,EAAE,IAAI;SACf,EACD,KAAK,CACiB,CAAC;QAEzB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACpB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAChC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/login.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerLoginTool(server: McpServer): void;
+//# sourceMappingURL=login.d.ts.map

package/dist/tools/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/tools/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQzE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwHzD"}