@vaultcompass/vault-guard-mcp 1.5.0 → 1.7.0

package/dist/index.js

@@ -59,9 +59,11 @@ var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
 function isBinaryFile(filePath) {
   return BINARY_EXTENSIONS.has(import_path.default.extname(filePath).toLowerCase());
 }
-async function scanWorkspaceDirectory(root, scanner, concurrency = 10, configIgnorePatterns2 = []) {
+var MCP_SCAN_BUDGET_MS = 5e3;
+async function scanWorkspaceDirectory(root, scanner, concurrency = 10, configIgnorePatterns2 = [], scanBudgetMs = MCP_SCAN_BUDGET_MS) {
   const files = await (0, import_vault_guard_core.getFilesToScanAsync)(root, false, void 0, configIgnorePatterns2);
   const results = [];
+  const overBudget = [];
   let filesScanned = 0;
   let bytesScanned = 0;
   const scanOne = async (file) => {
@@ -71,10 +73,15 @@ async function scanWorkspaceDirectory(root, scanner, concurrency = 10, configIgn
       if (!st.isFile()) return;
       filesScanned += 1;
       bytesScanned += st.size;
+      const t0 = Date.now();
       const matches = await (0, import_vault_guard_core.scanTextFileAsync)(scanner, file, { maxFileBytes: MAX_FILE_SIZE });
+      const elapsed = Date.now() - t0;
       if (matches.length > 0) {
         results.push({ file, matches });
       }
+      if (elapsed > scanBudgetMs) {
+        overBudget.push({ file, elapsed_ms: elapsed, budget_ms: scanBudgetMs });
+      }
     } catch {
     }
   };
@@ -82,11 +89,11 @@ async function scanWorkspaceDirectory(root, scanner, concurrency = 10, configIgn
     const batch = files.slice(i, i + concurrency);
     await Promise.all(batch.map(scanOne));
   }
-  return { results, filesScanned, bytesScanned };
+  return { results, filesScanned, bytesScanned, overBudget };
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "1.5.0" : "0.0.0-dev";
+var SERVER_VERSION = true ? "1.7.0" : "0.0.0-dev";
 function loadMcpConfig(workspaceRoot) {
   let cfg;
   try {
@@ -205,7 +212,7 @@ function createMcpServer(options = {}) {
       }
       const dir = resolved.path;
       const t0 = Date.now();
-      const { results, filesScanned, bytesScanned } = await scanWorkspaceDirectory(
+      const { results, filesScanned, bytesScanned, overBudget } = await scanWorkspaceDirectory(
         dir,
         scanner,
         10,
@@ -220,8 +227,13 @@ function createMcpServer(options = {}) {
       return toolPayload({
         summary: {
           files_with_secrets: results.length,
-          total_matches: results.reduce((n, r) => n + r.matches.length, 0)
+          total_matches: results.reduce((n, r) => n + r.matches.length, 0),
+          // Post-hoc: these files WERE scanned, but took long enough that the
+          // result is not trusted. Surfaced so an agent is not handed a silent
+          // "clean" for a file whose scan behaved pathologically.
+          ...overBudget.length > 0 ? { files_over_scan_budget: overBudget.length } : {}
         },
+        ...overBudget.length > 0 ? { over_budget: overBudget } : {},
         json: JSON.parse((0, import_vault_guard_core2.formatJson)(results, { cwd: dir, run })),
         sarif: (0, import_vault_guard_core2.formatSarif)(results, { cwd: dir, run }),
         results
@@ -254,15 +266,22 @@ function createMcpServer(options = {}) {
       }
       const t0 = Date.now();
       const matches = scanner.scan(fp);
+      const elapsed = Date.now() - t0;
       const run = {
-        duration_ms: Date.now() - t0,
+        duration_ms: elapsed,
         files_scanned: 1,
         bytes_scanned: st.size,
         patterns_active: scanner.getActivePatternCount()
       };
       const results = matches.length ? [{ file: fp, matches }] : [];
+      const overBudget = elapsed > MCP_SCAN_BUDGET_MS;
       return toolPayload({
-        summary: { files_with_secrets: results.length, total_matches: matches.length },
+        summary: {
+          files_with_secrets: results.length,
+          total_matches: matches.length,
+          ...overBudget ? { over_scan_budget: true } : {}
+        },
+        ...overBudget ? { over_budget: [{ file: fp, elapsed_ms: elapsed, budget_ms: MCP_SCAN_BUDGET_MS }] } : {},
         json: JSON.parse((0, import_vault_guard_core2.formatJson)(results, { cwd: workspaceRoot, run })),
         sarif: (0, import_vault_guard_core2.formatSarif)(results, { cwd: workspaceRoot, run })
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard-mcp",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "Let Cursor and Claude scan AI-proposed edits for secrets before applying. Local MCP server.",
   "main": "dist/index.js",
   "bin": {
@@ -26,8 +26,8 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^4.4.3",
-    "@vaultcompass/vault-guard-core": "1.5.0",
-    "@vaultcompass/vault-guard-telemetry": "1.5.0"
+    "@vaultcompass/vault-guard-core": "1.7.0",
+    "@vaultcompass/vault-guard-telemetry": "1.7.0"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",