@venos-inc/venos 0.1.9 → 0.1.11

package/etc/mcp-server/node_modules/vite-node/node_modules/.bin/vite

@@ -6,9 +6,9 @@ case `uname` in
 esac
 
 if [ -z "$NODE_PATH" ]; then
-  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/bin/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/node_modules"
+  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/bin/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/node_modules"
 else
-  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/bin/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/node_modules:$NODE_PATH"
+  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/bin/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/node_modules:$NODE_PATH"
 fi
 if [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir/../../../../../vite@6.4.3_@types+node@22.19.19/node_modules/vite/bin/vite.js" "$@"

package/etc/mcp-server/node_modules/vitest/node_modules/.bin/vite

@@ -6,9 +6,9 @@ case `uname` in
 esac
 
 if [ -z "$NODE_PATH" ]; then
-  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/bin/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/node_modules"
+  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/bin/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/node_modules"
 else
-  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/bin/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/node_modules:$NODE_PATH"
+  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/bin/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules/vite/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite@6.4.3_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/node_modules:$NODE_PATH"
 fi
 if [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir/../../../../../vite@6.4.3_@types+node@22.19.19/node_modules/vite/bin/vite.js" "$@"

package/etc/mcp-server/node_modules/vitest/node_modules/.bin/vite-node

@@ -6,9 +6,9 @@ case `uname` in
 esac
 
 if [ -z "$NODE_PATH" ]; then
-  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite-node@3.2.4_@types+node@22.19.19/node_modules/vite-node/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite-node@3.2.4_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/node_modules"
+  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite-node@3.2.4_@types+node@22.19.19/node_modules/vite-node/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite-node@3.2.4_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/node_modules"
 else
-  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite-node@3.2.4_@types+node@22.19.19/node_modules/vite-node/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/vite-node@3.2.4_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/node_modules:$NODE_PATH"
+  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite-node@3.2.4_@types+node@22.19.19/node_modules/vite-node/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/vite-node@3.2.4_@types+node@22.19.19/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/node_modules:$NODE_PATH"
 fi
 if [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir/../../../../../vite-node@3.2.4_@types+node@22.19.19/node_modules/vite-node/vite-node.mjs" "$@"

package/etc/mcp-server/node_modules/vitest/node_modules/.bin/why-is-node-running

@@ -6,9 +6,9 @@ case `uname` in
 esac
 
 if [ -z "$NODE_PATH" ]; then
-  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/why-is-node-running@2.3.0/node_modules/why-is-node-running/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/why-is-node-running@2.3.0/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/node_modules"
+  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/why-is-node-running@2.3.0/node_modules/why-is-node-running/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/why-is-node-running@2.3.0/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/node_modules"
 else
-  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/why-is-node-running@2.3.0/node_modules/why-is-node-running/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/why-is-node-running@2.3.0/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.9/node_modules/.pnpm/node_modules:$NODE_PATH"
+  export NODE_PATH="/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/why-is-node-running@2.3.0/node_modules/why-is-node-running/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/why-is-node-running@2.3.0/node_modules:/Users/baraklagziel/code/venos/.worktrees/cli-publish-0.1.11/node_modules/.pnpm/node_modules:$NODE_PATH"
 fi
 if [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir/../../../../../why-is-node-running@2.3.0/node_modules/why-is-node-running/cli.js" "$@"

package/etc/mcp-server/tools.js

@@ -2,6 +2,132 @@
 import { z } from "zod";
 import { scanPath, scanImage } from "./trivy.js";
 import { scanSkill } from "./skill-spector.js";
+export const SETUP_MCP_SERVER_PACKAGE = "@venos/mcp-server";
+export const SETUP_LOCAL_MCP_SERVER_BIN = "/absolute/path/to/venos/packages/mcp-server/dist/bin.js";
+export function setupMcpServerEntry() {
+    return {
+        command: "node",
+        args: [SETUP_LOCAL_MCP_SERVER_BIN],
+        env: {
+            VENOS_URL: "http://localhost:8788",
+            VENOS_ORG_ID: "your-org-id",
+            VENOS_API_KEY: "$VENOS_API_KEY",
+        },
+    };
+}
+function setupJson(value) {
+    return JSON.stringify(value, null, 2);
+}
+const CURSOR_STYLE_SETUP = setupJson({
+    mcpServers: {
+        venos: setupMcpServerEntry(),
+    },
+});
+const VSCODE_SETUP = setupJson({
+    "mcp.servers": {
+        venos: setupMcpServerEntry(),
+    },
+});
+export const SETUP_TEMPLATES = {
+    cursor: `## venos setup for Cursor
+
+**Coverage: best-effort** (no hook API — Cursor's AI calls venos_classify voluntarily)
+
+### 1. Add ${SETUP_MCP_SERVER_PACKAGE} to ~/.cursor/mcp.json
+
+\`\`\`json
+${CURSOR_STYLE_SETUP}
+\`\`\`
+
+### 2. Add .cursorrules to your project
+
+Create \`.cursorrules\` with:
+
+> Before running shell commands that delete files, write outside the workspace,
+> fetch from unrecognized hosts, install packages, or rewrite git history — call
+> venos_classify with the exact command and abort if decision is deny.
+
+### 3. Verify
+
+In the Cursor agent panel: "list venos tools" → you should see venos_classify.
+Events will appear in the venos dashboard under source: cursor.`,
+    windsurf: `## venos setup for Windsurf
+
+**Coverage: best-effort** (no hook API — Cascade calls venos_classify voluntarily)
+
+### 1. Add ${SETUP_MCP_SERVER_PACKAGE}
+
+In Windsurf → Settings → MCP Servers, add:
+
+\`\`\`json
+${CURSOR_STYLE_SETUP}
+\`\`\`
+
+### 2. Add .windsurfrules to your project
+
+Create \`.windsurfrules\` with the venos policy directive (see template in
+packages/mcp-server/templates/windsurf-rules.md).
+
+Events will appear in the venos dashboard under source: windsurf.`,
+    cline: `## venos setup for Cline
+
+**Coverage: best-effort** (no hook API — Cline's AI calls venos_classify voluntarily)
+
+### 1. Add ${SETUP_MCP_SERVER_PACKAGE} in Cline settings
+
+Add to Cline's MCP configuration:
+
+\`\`\`json
+${CURSOR_STYLE_SETUP}
+\`\`\`
+
+### 2. Add .clinerules to your project
+
+Create \`.clinerules\` with the venos policy directive (see
+packages/mcp-server/templates/cline-rules.md).
+
+Events will appear in the venos dashboard under source: vscode-mcp.`,
+    vscode: `## venos setup for VS Code Copilot
+
+**Coverage: best-effort** (no hook API — Copilot calls venos_classify voluntarily)
+
+### 1. Add ${SETUP_MCP_SERVER_PACKAGE} in VS Code
+
+In VS Code settings (settings.json):
+
+\`\`\`json
+${VSCODE_SETUP}
+\`\`\`
+
+### 2. Add Copilot instructions
+
+Create \`.github/copilot-instructions.md\` with the venos policy directive (see
+packages/mcp-server/templates/vscode-rules.md).
+
+Events will appear in the venos dashboard under source: vscode-mcp.`,
+    aider: `## venos setup for Aider
+
+**Coverage: best-effort** (system-prompt injection — Aider's AI may skip the call)
+
+### 1. Add to .aider.conf.yml
+
+\`\`\`yaml
+system-prompt: |
+  Before running any shell command that deletes files, writes outside the workspace,
+  fetches from an unrecognized host, installs packages, or rewrites git history,
+  call venos_classify with the exact command string and abort if decision is deny.
+\`\`\`
+
+### 2. For mandatory coverage
+
+Route Aider's LLM calls through the venos gateway (apps/mcp-proxy).
+Set: OPENAI_API_BASE=http://localhost:8080/v1 (where mcp-proxy listens).
+
+Events will appear in the venos dashboard under source: webhook.`,
+};
+export function formatSetupTemplate(tool) {
+    return SETUP_TEMPLATES[tool];
+}
 // Render the control scorecard as markdown. Pure (no I/O) so it is unit-tested
 // directly. An optional classFilter narrows the table to one class; the summary
 // counts always reflect the full registry.
@@ -25,6 +151,30 @@ export function formatControls(data, classFilter) {
     lines.push(`| Class | Control | Category | Enforced by |`, `|-------|---------|----------|-------------|`, ...rows.map((ctrl) => `| ${ctrl.class} | ${ctrl.name} | ${ctrl.category} | ${ctrl.enforcedBy} |`));
     return lines.join("\n");
 }
+// Render a document classification result as markdown. Pure (no I/O) so it is
+// unit-tested directly.
+export function formatDocumentScan(doc) {
+    const labels = doc.labels?.length ? doc.labels.map((l) => l.name).join(", ") : "none";
+    const lines = [
+        `## Document scan: \`${doc.filename}\``,
+        ``,
+        `| Field | Value |`,
+        `|-------|-------|`,
+        `| Classification | ${doc.classification || "n/a"} |`,
+        `| Severity | ${doc.severity || "n/a"} |`,
+        `| Policy action | ${doc.policyAction || "allow"} |`,
+        `| PII subjects | ${doc.subjectCount ?? 0} |`,
+        `| Detected labels | ${labels} |`,
+        `| File kind | ${doc.fileKind || "n/a"} |`,
+        ``,
+    ];
+    if (doc.warnings?.length) {
+        lines.push(`### Warnings`);
+        for (const w of doc.warnings)
+            lines.push(`- ${w}`);
+    }
+    return lines.join("\n");
+}
 // Render the Claude Code usage rollup as markdown. Pure (no I/O) so it is
 // unit-tested directly. Renders an empty-state line when no usage has been
 // reported yet rather than an empty table.
@@ -319,6 +469,27 @@ export function registerTools(server, client) {
             isError: result.recommendation === "DO_NOT_INSTALL",
         };
     });
+    // ── DSPM: classify a local document for PII / policy risk ────────────────
+    server.tool("venos_scan_document", "Classify a local document (PDF, image, or spreadsheet) for PII, secrets, and policy risk. Extracts text (OCR for scans) and runs it through the venos engine, then returns the classification, severity, policy action, detected PII labels, and per-row subject count.", {
+        path: z
+            .string()
+            .describe("Absolute or relative path to the document (e.g. ./contract.pdf, ./scan.png, ./people.xlsx)"),
+    }, async ({ path }) => {
+        try {
+            const doc = await client.classifyDocument(path);
+            return {
+                content: [{ type: "text", text: formatDocumentScan(doc) }],
+                isError: doc.policyAction === "block",
+            };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return {
+                content: [{ type: "text", text: `Error classifying ${path}: ${msg}` }],
+                isError: true,
+            };
+        }
+    });
     // ── Trivy: scan a container image ────────────────────────────────────────
     server.tool("trivy_scan_image", "Scan a container image for OS and library vulnerabilities using Trivy.", {
         image: z.string().describe("Container image reference (e.g. nginx:latest, node:20-alpine)"),
@@ -639,147 +810,10 @@ export function registerTools(server, client) {
         return { content: [{ type: "text", text: formatClosedLoop(loop) }] };
     });
     // ── Venos: setup instructions per tool ──────────────────────────────────
-    const SETUP_TEMPLATES = {
-        cursor: `## venos setup for Cursor
-
-**Coverage: best-effort** (no hook API — Cursor's AI calls venos_classify voluntarily)
-
-### 1. Add the MCP server to ~/.cursor/mcp.json
-
-\`\`\`json
-{
-  "mcpServers": {
-    "venos": {
-      "command": "npx",
-      "args": ["@venos/mcp-server"],
-      "env": {
-        "VENOS_URL": "http://localhost:8788",
-        "VENOS_ORG_ID": "your-org-id"
-      }
-    }
-  }
-}
-\`\`\`
-
-### 2. Add .cursorrules to your project
-
-Create \`.cursorrules\` with:
-
-> Before running shell commands that delete files, write outside the workspace,
-> fetch from unrecognized hosts, install packages, or rewrite git history — call
-> venos_classify with the exact command and abort if decision is deny.
-
-### 3. Verify
-
-In the Cursor agent panel: "list venos tools" → you should see venos_classify.
-Events will appear in the venos dashboard under source: cursor.`,
-        windsurf: `## venos setup for Windsurf
-
-**Coverage: best-effort** (no hook API — Cascade calls venos_classify voluntarily)
-
-### 1. Add the MCP server
-
-In Windsurf → Settings → MCP Servers, add:
-
-\`\`\`json
-{
-  "venos": {
-    "command": "npx",
-    "args": ["@venos/mcp-server"],
-    "env": {
-      "VENOS_URL": "http://localhost:8788",
-      "VENOS_ORG_ID": "your-org-id"
-    }
-  }
-}
-\`\`\`
-
-### 2. Add .windsurfrules to your project
-
-Create \`.windsurfrules\` with the venos policy directive (see template in
-packages/mcp-server/templates/windsurf-rules.md).
-
-Events will appear in the venos dashboard under source: windsurf.`,
-        cline: `## venos setup for Cline
-
-**Coverage: best-effort** (no hook API — Cline's AI calls venos_classify voluntarily)
-
-### 1. Add the MCP server in Cline settings
-
-Add to Cline's MCP configuration:
-
-\`\`\`json
-{
-  "venos": {
-    "command": "npx",
-    "args": ["@venos/mcp-server"],
-    "env": {
-      "VENOS_URL": "http://localhost:8788",
-      "VENOS_ORG_ID": "your-org-id"
-    }
-  }
-}
-\`\`\`
-
-### 2. Add .clinerules to your project
-
-Create \`.clinerules\` with the venos policy directive (see
-packages/mcp-server/templates/cline-rules.md).
-
-Events will appear in the venos dashboard under source: vscode-mcp.`,
-        vscode: `## venos setup for VS Code Copilot
-
-**Coverage: best-effort** (no hook API — Copilot calls venos_classify voluntarily)
-
-### 1. Add the MCP server in VS Code
-
-In VS Code settings (settings.json):
-
-\`\`\`json
-{
-  "mcp.servers": {
-    "venos": {
-      "command": "npx",
-      "args": ["@venos/mcp-server"],
-      "env": {
-        "VENOS_URL": "http://localhost:8788",
-        "VENOS_ORG_ID": "your-org-id"
-      }
-    }
-  }
-}
-\`\`\`
-
-### 2. Add Copilot instructions
-
-Create \`.github/copilot-instructions.md\` with the venos policy directive (see
-packages/mcp-server/templates/vscode-rules.md).
-
-Events will appear in the venos dashboard under source: vscode-mcp.`,
-        aider: `## venos setup for Aider
-
-**Coverage: best-effort** (system-prompt injection — Aider's AI may skip the call)
-
-### 1. Add to .aider.conf.yml
-
-\`\`\`yaml
-system-prompt: |
-  Before running any shell command that deletes files, writes outside the workspace,
-  fetches from an unrecognized host, installs packages, or rewrites git history,
-  call venos_classify with the exact command string and abort if decision is deny.
-\`\`\`
-
-### 2. For mandatory coverage
-
-Route Aider's LLM calls through the venos gateway (apps/mcp-proxy).
-Set: OPENAI_API_BASE=http://localhost:8080/v1 (where mcp-proxy listens).
-
-Events will appear in the venos dashboard under source: webhook.`,
-    };
     server.tool("venos_setup", "Return venos setup instructions for a specific AI tool.", {
         tool: z.enum(["cursor", "windsurf", "cline", "vscode", "aider"]).describe("The AI tool to get setup instructions for."),
     }, async ({ tool }) => {
-        const text = SETUP_TEMPLATES[tool] ?? `No setup instructions found for: ${tool}`;
+        const text = formatSetupTemplate(tool);
         return { content: [{ type: "text", text }] };
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venos-inc/venos",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Self-service CLI for venos — wire your AI client to the venos security gateway in one command.",
   "license": "UNLICENSED",
   "type": "module",