@vaultcompass/vault-guard-mcp 1.0.1 → 1.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +89 -0
- package/dist/index.js +2 -1
- package/package.json +4 -4
package/README.md
ADDED
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
# @vaultcompass/vault-guard-mcp
|
|
2
|
+
|
|
3
|
+
[MCP](https://modelcontextprotocol.io/) server for [Vault Guard](https://github.com/vaultcompasshq/vault-guard). Gives Cursor and Claude the ability to scan a proposed edit before it lands, at edit time instead of commit time. One config line, fully local.
|
|
4
|
+
|
|
5
|
+
## Install
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
npm install -g @vaultcompass/vault-guard-mcp
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
Requires **Node.js 22+**.
|
|
12
|
+
|
|
13
|
+
## Quickstart (Cursor / Claude Desktop)
|
|
14
|
+
|
|
15
|
+
Add to your MCP config (`~/.cursor/mcp.json`, `claude_desktop_config.json`, etc.):
|
|
16
|
+
|
|
17
|
+
```json
|
|
18
|
+
{
|
|
19
|
+
"mcpServers": {
|
|
20
|
+
"vault-guard": {
|
|
21
|
+
"command": "npx",
|
|
22
|
+
"args": ["-y", "@vaultcompass/vault-guard-mcp"]
|
|
23
|
+
}
|
|
24
|
+
}
|
|
25
|
+
}
|
|
26
|
+
```
|
|
27
|
+
|
|
28
|
+
Restart the editor. Vault Guard tools are now available to your AI agent.
|
|
29
|
+
|
|
30
|
+
## Tools
|
|
31
|
+
|
|
32
|
+
| Tool | Purpose |
|
|
33
|
+
|------|---------|
|
|
34
|
+
| `scan_workspace` | Scan a directory (`.gitignore`-aware). Returns JSON, SARIF, and summary. |
|
|
35
|
+
| `scan_file` | Scan a single file on disk. |
|
|
36
|
+
| `scan_text` | Scan arbitrary UTF-8 text (e.g. a proposed edit). Optional `virtual_path` for SARIF URIs. |
|
|
37
|
+
| `report_token_usage` | Rough on-disk token estimate for paths (no network calls). |
|
|
38
|
+
| `record_session_event` | Append an opt-in local row to `~/.vault-guard/usage.sqlite` (e.g. `secret_blocked`, `revert`). |
|
|
39
|
+
|
|
40
|
+
## Example agent workflow
|
|
41
|
+
|
|
42
|
+
1. Before applying an edit, the agent calls `scan_text` with the proposed content.
|
|
43
|
+
2. If secrets are found, the agent warns the user or refuses to apply the change.
|
|
44
|
+
3. For repo-wide checks, use `scan_workspace` on the project root.
|
|
45
|
+
|
|
46
|
+
All scanning runs locally. No secrets or file contents are sent to external servers.
|
|
47
|
+
|
|
48
|
+
## Development (from a clone)
|
|
49
|
+
|
|
50
|
+
```bash
|
|
51
|
+
git clone https://github.com/vaultcompasshq/vault-guard.git
|
|
52
|
+
cd vault-guard
|
|
53
|
+
pnpm install && pnpm --filter @vaultcompass/vault-guard-mcp build
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
Point MCP config at the local binary:
|
|
57
|
+
|
|
58
|
+
```json
|
|
59
|
+
{
|
|
60
|
+
"mcpServers": {
|
|
61
|
+
"vault-guard": {
|
|
62
|
+
"command": "pnpm",
|
|
63
|
+
"args": ["exec", "vault-guard-mcp"],
|
|
64
|
+
"cwd": "/path/to/vault-guard"
|
|
65
|
+
}
|
|
66
|
+
}
|
|
67
|
+
}
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
## Privacy
|
|
71
|
+
|
|
72
|
+
Telemetry written by `record_session_event` stays on disk under `~/.vault-guard/` only. See [docs/PRIVACY.md](https://github.com/vaultcompasshq/vault-guard/blob/main/docs/PRIVACY.md).
|
|
73
|
+
|
|
74
|
+
## Related packages
|
|
75
|
+
|
|
76
|
+
| Package | Purpose |
|
|
77
|
+
|---------|---------|
|
|
78
|
+
| [@vaultcompass/vault-guard](https://www.npmjs.com/package/@vaultcompass/vault-guard) | CLI (`vault-guard scan`, pre-commit hooks, proxy) |
|
|
79
|
+
| [@vaultcompass/vault-guard-core](https://www.npmjs.com/package/@vaultcompass/vault-guard-core) | Scanning engine used by this server |
|
|
80
|
+
|
|
81
|
+
## Documentation
|
|
82
|
+
|
|
83
|
+
- [Full MCP reference](https://github.com/vaultcompasshq/vault-guard/blob/main/docs/MCP.md)
|
|
84
|
+
- [GitHub repository](https://github.com/vaultcompasshq/vault-guard)
|
|
85
|
+
- [Detection rules](https://github.com/vaultcompasshq/vault-guard/blob/main/docs/RULES.md)
|
|
86
|
+
|
|
87
|
+
## License
|
|
88
|
+
|
|
89
|
+
MIT. [Vault & Compass LLC](https://vaultcompass.io)
|
package/dist/index.js
CHANGED
|
@@ -86,6 +86,7 @@ async function scanWorkspaceDirectory(root, scanner, concurrency = 10) {
|
|
|
86
86
|
}
|
|
87
87
|
|
|
88
88
|
// src/server.ts
|
|
89
|
+
var SERVER_VERSION = true ? "1.0.3" : "0.0.0-dev";
|
|
89
90
|
function makeScanner() {
|
|
90
91
|
const cwd = process.cwd();
|
|
91
92
|
let cfg;
|
|
@@ -111,7 +112,7 @@ function toolPayload(obj) {
|
|
|
111
112
|
}
|
|
112
113
|
function createMcpServer() {
|
|
113
114
|
const server = new import_mcp.McpServer(
|
|
114
|
-
{ name: "vault-guard", version:
|
|
115
|
+
{ name: "vault-guard", version: SERVER_VERSION },
|
|
115
116
|
{
|
|
116
117
|
capabilities: {
|
|
117
118
|
tools: {}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vaultcompass/vault-guard-mcp",
|
|
3
|
-
"version": "1.0.
|
|
4
|
-
"description": "
|
|
3
|
+
"version": "1.0.3",
|
|
4
|
+
"description": "Let Cursor and Claude scan AI-proposed edits for secrets before applying. Local MCP server.",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"bin": {
|
|
7
7
|
"vault-guard-mcp": "./dist/index.js"
|
|
@@ -26,8 +26,8 @@
|
|
|
26
26
|
"dependencies": {
|
|
27
27
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
28
28
|
"zod": "^4.4.3",
|
|
29
|
-
"@vaultcompass/vault-guard-
|
|
30
|
-
"@vaultcompass/vault-guard-
|
|
29
|
+
"@vaultcompass/vault-guard-telemetry": "1.0.3",
|
|
30
|
+
"@vaultcompass/vault-guard-core": "1.0.3"
|
|
31
31
|
},
|
|
32
32
|
"devDependencies": {
|
|
33
33
|
"@types/jest": "^30.0.0",
|