@venos-inc/venos 0.1.4 → 0.1.6

package/etc/mcp-server/tools.js

@@ -1,6 +1,7 @@
 // MCP tool definitions and handlers for the venos MCP server.
 import { z } from "zod";
 import { scanPath, scanImage } from "./trivy.js";
+import { scanSkill } from "./skill-spector.js";
 // Render the control scorecard as markdown. Pure (no I/O) so it is unit-tested
 // directly. An optional classFilter narrows the table to one class; the summary
 // counts always reflect the full registry.
@@ -24,6 +25,44 @@ export function formatControls(data, classFilter) {
     lines.push(`| Class | Control | Category | Enforced by |`, `|-------|---------|----------|-------------|`, ...rows.map((ctrl) => `| ${ctrl.class} | ${ctrl.name} | ${ctrl.category} | ${ctrl.enforcedBy} |`));
     return lines.join("\n");
 }
+// Render the Claude Code usage rollup as markdown. Pure (no I/O) so it is
+// unit-tested directly. Renders an empty-state line when no usage has been
+// reported yet rather than an empty table.
+export function formatClaudeUsage(u) {
+    const t = u.totals;
+    if (t.sessionCount === 0 && u.byModel.length === 0) {
+        return [
+            `## Venos Claude Code usage (last ${u.sinceHours}h)`,
+            ``,
+            `No Claude Code usage reported yet. Run \`venos usage-sync\` on a device with ~/.claude transcripts to populate this.`,
+        ].join("\n");
+    }
+    const totalCost = u.byModel.reduce((sum, m) => sum + m.costUsd, 0);
+    const lines = [
+        `## Venos Claude Code usage (last ${u.sinceHours}h)`,
+        ``,
+        `- **Sessions**: ${t.sessionCount.toLocaleString()}`,
+        `- **Models**: ${t.modelCount.toLocaleString()}`,
+        `- **Messages**: ${t.messageCount.toLocaleString()}`,
+        `- **Tokens in / out**: ${t.tokensIn.toLocaleString()} / ${t.tokensOut.toLocaleString()}`,
+        `- **Cache read / write**: ${t.cacheReadTokens.toLocaleString()} / ${t.cacheWriteTokens.toLocaleString()}`,
+        `- **Total cost**: $${totalCost.toFixed(4)}`,
+        ``,
+        `### By model`,
+        `| Model | Tokens in | Tokens out | Cache read | Cache write | Cost (USD) |`,
+        `|-------|-----------|------------|------------|-------------|-----------|`,
+        ...u.byModel.map((m) => `| ${m.model} | ${m.tokensIn.toLocaleString()} | ${m.tokensOut.toLocaleString()} | ${m.cacheReadTokens.toLocaleString()} | ${m.cacheWriteTokens.toLocaleString()} | $${m.costUsd.toFixed(4)} |`),
+    ];
+    const section = (title, rows) => {
+        if (rows.length === 0)
+            return;
+        lines.push(``, `### ${title}`, `| Name | Invocations |`, `|------|-------------|`, ...rows.map((r) => `| ${r.name} | ${r.invocationCount.toLocaleString()} |`));
+    };
+    section("Skills", u.skills);
+    section("Subagents", u.subagents);
+    section("MCP servers", u.mcpServers);
+    return lines.join("\n");
+}
 // Render a budget cell as "used / ceiling" — or "used / -" when no ceiling is
 // set on that dimension. Pure so it is unit-tested directly.
 function budgetCell(used, ceiling, fixed = 0) {
@@ -167,6 +206,22 @@ export function formatClosedLoop(loop) {
         lines.push(`- **Reason**: ${loop.terminationReason}`);
     return lines.join("\n");
 }
+// Render internal-knowledge search hits as a plain-ASCII markdown table. Pure
+// (no I/O) so it is unit-tested directly. A single newline replaces newlines in
+// chunk text so each hit stays on one table row. No emoji or pictographic
+// glyphs (security/compliance product convention).
+export function formatKnowledgeHits(query, hits) {
+    const lines = [`## Internal knowledge: "${query}"`, ``];
+    if (hits.length === 0) {
+        lines.push(`No matching knowledge found.`);
+        return lines.join("\n");
+    }
+    lines.push(`| Source | Chunk | Similarity | Text |`, `|--------|-------|------------|------|`, ...hits.map((h) => {
+        const text = h.chunkText.replace(/\s*\n+\s*/g, " ").trim();
+        return `| ${h.sourceId} | ${h.chunkIndex} | ${h.similarity.toFixed(2)} | ${text} |`;
+    }));
+    return lines.join("\n");
+}
 export function registerTools(server, client) {
     // ── Trivy: scan a local filesystem path ─────────────────────────────────
     server.tool("trivy_scan_path", "Scan a local directory or file for vulnerabilities using Trivy. Returns a summary of CVEs grouped by severity.", {
@@ -213,6 +268,57 @@ export function registerTools(server, client) {
         }
         return { content: [{ type: "text", text: lines.join("\n") }] };
     });
+    // ── SkillSpector: scan an agent skill for security findings ──────────────
+    server.tool("venos_scan_skill", "Scan an agent skill or plugin directory for security findings (prompt injection, data exfiltration, supply-chain, excessive agency) using SkillSpector. Returns a risk verdict and the top findings.", {
+        path: z.string().describe("Path to the skill directory or SKILL.md (e.g. ~/.claude/skills/my-skill)"),
+        useLlm: z
+            .boolean()
+            .optional()
+            .describe("Opt into the slower LLM semantic stage. Defaults to static-only analysis."),
+    }, async ({ path, useLlm }) => {
+        const result = await scanSkill(path, useLlm ?? false);
+        if (!result.skillspectorInstalled) {
+            return { content: [{ type: "text", text: `Error: ${result.errorMessage}` }], isError: true };
+        }
+        if (result.errorMessage) {
+            return {
+                content: [{ type: "text", text: `Error scanning ${path}: ${result.errorMessage}` }],
+                isError: true,
+            };
+        }
+        const lines = [
+            `## Skill scan: \`${result.skillName || result.target}\``,
+            ``,
+            `| Risk | Value |`,
+            `|------|-------|`,
+            `| Score | ${result.riskScore}/100 |`,
+            `| Severity | ${result.riskSeverity || "n/a"} |`,
+            `| Recommendation | ${result.recommendation || "n/a"} |`,
+            ``,
+            `| Severity | Count |`,
+            `|----------|-------|`,
+            `| Critical | ${result.critical} |`,
+            `| High     | ${result.high} |`,
+            `| Medium   | ${result.medium} |`,
+            `| Low      | ${result.low} |`,
+            `| **Total**   | **${result.total}** |`,
+            ``,
+        ];
+        if (result.topFindings.length > 0) {
+            lines.push(`### Top findings`);
+            for (const f of result.topFindings) {
+                const loc = f.file ? ` in \`${f.file}${f.startLine ? `:${f.startLine}` : ""}\`` : "";
+                lines.push(`- **${f.id}** (${f.severity}) ${f.category}${loc} — ${f.finding}`);
+            }
+        }
+        else {
+            lines.push("No security findings detected.");
+        }
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+            isError: result.recommendation === "DO_NOT_INSTALL",
+        };
+    });
     // ── Trivy: scan a container image ────────────────────────────────────────
     server.tool("trivy_scan_image", "Scan a container image for OS and library vulnerabilities using Trivy.", {
         image: z.string().describe("Container image reference (e.g. nginx:latest, node:20-alpine)"),
@@ -355,8 +461,12 @@ export function registerTools(server, client) {
     // ── Venos: classify text against the engine ──────────────────────────────
     server.tool("venos_classify", "Run a piece of text (a prompt, a shell command, a tool argument) through venos and get back the policy decision (allow/deny). Call this BEFORE executing anything destructive or sensitive (rm, curl to unknown hosts, writes outside the workspace) so the decision is logged as a Cursor event in the dashboard.", {
         text: z.string().describe("The prompt, command, or content to classify."),
-    }, async ({ text }) => {
-        const r = await client.classify(text);
+        origin: z
+            .string()
+            .optional()
+            .describe("Optional label for where this content came from (e.g. a filename like 'insurance-database.xlsx'). Recorded on the event so it can be shown and filtered in the dashboard's ORIGIN column."),
+    }, async ({ text, origin }) => {
+        const r = await client.classify(text, origin);
         const lines = [
             `## Venos decision: \`${r.decision}\``,
             ``,
@@ -385,6 +495,37 @@ export function registerTools(server, client) {
         ];
         return { content: [{ type: "text", text: lines.join("\n") }] };
     });
+    // ── Venos: Claude Code usage rollup ──────────────────────────────────────
+    server.tool("venos_usage", "Show the organization's Claude Code usage tracked by venos: per-model token counts (input/output and cache read/write) with read-time-derived cost, plus which skills, subagents, and MCP servers were invoked most. Populated by `venos usage-sync` from device ~/.claude transcripts. Returns an empty-state note when nothing has been reported yet.", {
+        sinceHours: z
+            .number()
+            .int()
+            .min(1)
+            .optional()
+            .describe("Lookback window in hours (default: 30 days)."),
+    }, async ({ sinceHours }) => {
+        const usage = await client.usage(sinceHours);
+        return { content: [{ type: "text", text: formatClaudeUsage(usage) }] };
+    });
+    // ── Venos: report Claude Code usage ──────────────────────────────────────
+    // The aggregation reads the per-device ~/.claude transcripts, which only the
+    // device CLI can do reliably (the stdio MCP server may be running on a host
+    // without access to those files). Rather than fake a sync from here, this
+    // tool returns the exact command to run; venos_usage then reads the result.
+    server.tool("venos_usage_sync", "Report this device's Claude Code usage (tokens, cost, skill/subagent/MCP attribution) to venos. The usage data lives in ~/.claude transcripts, which the venos CLI reads directly; run the command this tool returns, then call venos_usage to see the rollup.", {}, async () => {
+        const lines = [
+            `## Report Claude Code usage to venos`,
+            ``,
+            `Claude Code usage is aggregated from this device's \`~/.claude\` transcripts by the venos CLI. Run:`,
+            ``,
+            "```",
+            `venos usage-sync`,
+            "```",
+            ``,
+            `Then call \`venos_usage\` to see the per-model cost and skill/subagent/MCP attribution rollup.`,
+        ];
+        return { content: [{ type: "text", text: lines.join("\n") }] };
+    });
     // ── Venos: control scorecard ─────────────────────────────────────────────
     server.tool("venos_controls", "List venos's active security controls from the control scorecard, each classified as a barrier (impossible-class: structural/cryptographic) or friction (tedious: detection/heuristics) per the Zero-Trust-for-AI-Agents design test.", {
         class: z
@@ -395,6 +536,20 @@ export function registerTools(server, client) {
         const data = await client.controls();
         return { content: [{ type: "text", text: formatControls(data, classFilter) }] };
     });
+    // ── Venos: internal knowledge search (RAG) ───────────────────────────────
+    server.tool("venos_knowledge_search", "Search the organization's internal knowledge base (runbooks, docs, policies indexed into venos) and return the most relevant chunks for a natural-language query, ranked by semantic similarity. Use to answer 'how do we do X here?' from org-specific material rather than guessing. Returns an empty result when nothing matches.", {
+        query: z.string().describe("Natural-language question or phrase to search the internal knowledge base for."),
+        limit: z
+            .number()
+            .int()
+            .min(1)
+            .max(20)
+            .optional()
+            .describe("Max number of chunks to return (default 8, capped at 20)."),
+    }, async ({ query, limit }) => {
+        const hits = await client.knowledgeSearch(query, limit);
+        return { content: [{ type: "text", text: formatKnowledgeHits(query, hits) }] };
+    });
     // ── Venos: recent delegation chains ──────────────────────────────────────
     server.tool("venos_delegation", "List recent multi-agent delegation chains tracked by venos — each is one agent delegating to another (e.g. a Claude Code Task sub-agent), with the hop count and last activity. Use to see which agents are delegating work to which, and to find a chain (session) to inspect in the dashboard.", {
         limit: z.number().int().min(1).max(50).optional().describe("Max chains to return (default 20)"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venos-inc/venos",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Self-service CLI for venos — wire your AI client to the venos security gateway in one command.",
   "license": "UNLICENSED",
   "type": "module",
@@ -29,8 +29,8 @@
   "devDependencies": {
     "@types/node": "^22.0.0",
     "@venos/tsconfig": "workspace:*",
-    "esbuild": "0.21.5",
+    "esbuild": "^0.25.0",
     "typescript": "5.6.3",
-    "vitest": "2.1.9"
+    "vitest": "^3.2.6"
   }
 }

package/etc/mcp-server/node_modules/@types/node/dom-events.d.ts

@@ -1,124 +0,0 @@
-export {}; // Don't export anything!
-
-//// DOM-like Events
-// NB: The Event / EventTarget / EventListener implementations below were copied
-// from lib.dom.d.ts, then edited to reflect Node's documentation at
-// https://nodejs.org/api/events.html#class-eventtarget.
-// Please read that link to understand important implementation differences.
-
-// This conditional type will be the existing global Event in a browser, or
-// the copy below in a Node environment.
-type __Event = typeof globalThis extends { onmessage: any; Event: any } ? {}
-    : {
-        /** This is not used in Node.js and is provided purely for completeness. */
-        readonly bubbles: boolean;
-        /** Alias for event.stopPropagation(). This is not used in Node.js and is provided purely for completeness. */
-        cancelBubble: () => void;
-        /** True if the event was created with the cancelable option */
-        readonly cancelable: boolean;
-        /** This is not used in Node.js and is provided purely for completeness. */
-        readonly composed: boolean;
-        /** Returns an array containing the current EventTarget as the only entry or empty if the event is not being dispatched. This is not used in Node.js and is provided purely for completeness. */
-        composedPath(): [EventTarget?];
-        /** Alias for event.target. */
-        readonly currentTarget: EventTarget | null;
-        /** Is true if cancelable is true and event.preventDefault() has been called. */
-        readonly defaultPrevented: boolean;
-        /** This is not used in Node.js and is provided purely for completeness. */
-        readonly eventPhase: 0 | 2;
-        /** The `AbortSignal` "abort" event is emitted with `isTrusted` set to `true`. The value is `false` in all other cases. */
-        readonly isTrusted: boolean;
-        /** Sets the `defaultPrevented` property to `true` if `cancelable` is `true`. */
-        preventDefault(): void;
-        /** This is not used in Node.js and is provided purely for completeness. */
-        returnValue: boolean;
-        /** Alias for event.target. */
-        readonly srcElement: EventTarget | null;
-        /** Stops the invocation of event listeners after the current one completes. */
-        stopImmediatePropagation(): void;
-        /** This is not used in Node.js and is provided purely for completeness. */
-        stopPropagation(): void;
-        /** The `EventTarget` dispatching the event */
-        readonly target: EventTarget | null;
-        /** The millisecond timestamp when the Event object was created. */
-        readonly timeStamp: number;
-        /** Returns the type of event, e.g. "click", "hashchange", or "submit". */
-        readonly type: string;
-    };
-
-// See comment above explaining conditional type
-type __EventTarget = typeof globalThis extends { onmessage: any; EventTarget: any } ? {}
-    : {
-        /**
-         * Adds a new handler for the `type` event. Any given `listener` is added only once per `type` and per `capture` option value.
-         *
-         * If the `once` option is true, the `listener` is removed after the next time a `type` event is dispatched.
-         *
-         * The `capture` option is not used by Node.js in any functional way other than tracking registered event listeners per the `EventTarget` specification.
-         * Specifically, the `capture` option is used as part of the key when registering a `listener`.
-         * Any individual `listener` may be added once with `capture = false`, and once with `capture = true`.
-         */
-        addEventListener(
-            type: string,
-            listener: EventListener | EventListenerObject,
-            options?: AddEventListenerOptions | boolean,
-        ): void;
-        /** Dispatches a synthetic event event to target and returns true if either event's cancelable attribute value is false or its preventDefault() method was not invoked, and false otherwise. */
-        dispatchEvent(event: Event): boolean;
-        /** Removes the event listener in target's event listener list with the same type, callback, and options. */
-        removeEventListener(
-            type: string,
-            listener: EventListener | EventListenerObject,
-            options?: EventListenerOptions | boolean,
-        ): void;
-    };
-
-interface EventInit {
-    bubbles?: boolean;
-    cancelable?: boolean;
-    composed?: boolean;
-}
-
-interface EventListenerOptions {
-    /** Not directly used by Node.js. Added for API completeness. Default: `false`. */
-    capture?: boolean;
-}
-
-interface AddEventListenerOptions extends EventListenerOptions {
-    /** When `true`, the listener is automatically removed when it is first invoked. Default: `false`. */
-    once?: boolean;
-    /** When `true`, serves as a hint that the listener will not call the `Event` object's `preventDefault()` method. Default: false. */
-    passive?: boolean;
-    /** The listener will be removed when the given AbortSignal object's `abort()` method is called. */
-    signal?: AbortSignal;
-}
-
-interface EventListener {
-    (evt: Event): void;
-}
-
-interface EventListenerObject {
-    handleEvent(object: Event): void;
-}
-
-import {} from "events"; // Make this an ambient declaration
-declare global {
-    /** An event which takes place in the DOM. */
-    interface Event extends __Event {}
-    var Event: typeof globalThis extends { onmessage: any; Event: infer T } ? T
-        : {
-            prototype: __Event;
-            new(type: string, eventInitDict?: EventInit): __Event;
-        };
-
-    /**
-     * EventTarget is a DOM interface implemented by objects that can
-     * receive events and may have listeners for them.
-     */
-    interface EventTarget extends __EventTarget {}
-    var EventTarget: typeof globalThis extends { onmessage: any; EventTarget: infer T } ? T
-        : {
-            prototype: __EventTarget;
-            new(): __EventTarget;
-        };
-}

package/etc/mcp-server/node_modules/@types/node/globals.global.d.ts

@@ -1 +0,0 @@
-declare var global: typeof globalThis;