@verglos/mcp 0.7.0

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @verglos/mcp — Model Context Protocol server for Verglos.
+ *
+ * Exposes the free-tier scanner surface to AI agents (Claude Code,
+ * Cursor, Cline, Windsurf, …) as MCP tools:
+ *
+ *   verglos_check_before_write   the killer, <300ms, runs in the
+ *                                agent's write loop
+ *   verglos_check_package        slopsquat / typosquat / CVE check
+ *                                before an install
+ *   verglos_scan                 full project scan
+ *   verglos_explain_finding      why + fix, framework-aware
+ *
+ * All tools are free forever per architecture spec §7. No network
+ * calls on the free path except registry lookups (which run against
+ * the public npm registry, not Verglos infra).
+ */
+export { createVerglosMcpServer, startStdioServer } from "./server.js";
+export type { CheckBeforeWriteInput, CheckBeforeWriteResult } from "./server.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvE,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+/**
+ * @verglos/mcp — Model Context Protocol server for Verglos.
+ *
+ * Exposes the free-tier scanner surface to AI agents (Claude Code,
+ * Cursor, Cline, Windsurf, …) as MCP tools:
+ *
+ *   verglos_check_before_write   the killer, <300ms, runs in the
+ *                                agent's write loop
+ *   verglos_check_package        slopsquat / typosquat / CVE check
+ *                                before an install
+ *   verglos_scan                 full project scan
+ *   verglos_explain_finding      why + fix, framework-aware
+ *
+ * All tools are free forever per architecture spec §7. No network
+ * calls on the free path except registry lookups (which run against
+ * the public npm registry, not Verglos infra).
+ */
+export { createVerglosMcpServer, startStdioServer } from "./server.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,25 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import type { CheckBeforeWriteInput as ToolInput, CheckBeforeWriteResult as ToolResult } from "./tools/check-before-write.js";
+/**
+ * MCP server for Verglos.
+ *
+ * All tool handlers are stubs in W6-1 — they respond with a shape
+ * that describes the tool but doesn't execute yet. Real handlers
+ * land in W6-2 (check_before_write), W6-3 (check_package),
+ * W6-4 (scan), W6-5 (explain_finding).
+ *
+ * Design constraints from architecture spec §7:
+ *   - Speaks JSON-RPC over stdio
+ *   - Startup banner goes to stderr; stdout is reserved for MCP transport
+ *   - Zero extra install (bundled in the CLI)
+ *   - Free-tier only: no license check, no network on the hot path
+ */
+export type CheckBeforeWriteInput = ToolInput;
+export type CheckBeforeWriteResult = ToolResult;
+export declare function createVerglosMcpServer(): Server;
+/**
+ * Start an MCP server over stdio. Prints a startup banner to stderr
+ * so stdout stays clean for the MCP transport (arch spec §7).
+ */
+export declare function startStdioServer(): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAQnE,OAAO,KAAK,EACV,qBAAqB,IAAI,SAAS,EAClC,sBAAsB,IAAI,UAAU,EACrC,MAAM,+BAA+B,CAAC;AAKvC;;;;;;;;;;;;;GAaG;AAIH,MAAM,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAC9C,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAsJhD,wBAAgB,sBAAsB,IAAI,MAAM,CA8B/C;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAKtD"}

package/dist/server.js

@@ -0,0 +1,167 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { checkBeforeWrite } from "./tools/check-before-write.js";
+import { checkPackage } from "./tools/check-package.js";
+import { scanProject } from "./tools/scan.js";
+import { explainFinding } from "./tools/explain-finding.js";
+// ─── Tool registration ────────────────────────────────────────────────────
+const TOOLS = [
+    {
+        name: "verglos_check_before_write",
+        description: "The killer tool. Agent submits code it's about to write; Verglos returns allow/warn/block and (when possible) a corrected version. Runs only AI-* rules + secret patterns + high-confidence injection checks. <300ms, no network, free forever.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                code: { type: "string", description: "The code the agent is about to write." },
+                targetPath: {
+                    type: "string",
+                    description: "Target file path (relative or absolute). Verglos uses the extension for language inference.",
+                },
+                language: {
+                    type: "string",
+                    description: "Optional language hint (e.g. 'ts', 'tsx').",
+                },
+                context: {
+                    type: "string",
+                    description: "Optional freeform description of what the code is for.",
+                },
+            },
+            required: ["code", "targetPath"],
+        },
+    },
+    {
+        name: "verglos_check_package",
+        description: "Before `npm install`. Checks whether a package exists on npm (AI-005 slopsquat), whether it looks like a typo of a top-N package (AI-006), and whether it has known CVEs.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                packageName: {
+                    type: "string",
+                    description: "The npm package name (e.g. 'reqeusts' or '@stripee/js').",
+                },
+                version: {
+                    type: "string",
+                    description: "Optional version to check for CVEs. Defaults to 'latest'.",
+                },
+            },
+            required: ["packageName"],
+        },
+    },
+    {
+        name: "verglos_scan",
+        description: "Full project scan. Returns findings, score, and AI-provenance summary. Slower than check_before_write — use for pre-PR review, not per-line checks.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                projectRoot: {
+                    type: "string",
+                    description: "Absolute path to the project root. Defaults to cwd.",
+                },
+            },
+        },
+    },
+    {
+        name: "verglos_explain_finding",
+        description: "Explain a Verglos rule id (e.g. 'AI-002') — why it matters, how to fix, and an example when available. Same explain-bank the CLI uses.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                rule: {
+                    type: "string",
+                    description: "Rule id: 'AI-002', 'D4-001', etc.",
+                },
+            },
+            required: ["rule"],
+        },
+    },
+];
+// ─── Handler dispatch ─────────────────────────────────────────────────────
+async function stubResponse(name) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: `verglos:mcp: ${name} is registered but the handler ships in a later commit. Try again after the next release.`,
+            },
+        ],
+    };
+}
+function jsonResponse(payload) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
+    };
+}
+async function dispatchTool(name, args) {
+    const input = args ?? {};
+    switch (name) {
+        case "verglos_check_before_write": {
+            const parsed = {
+                code: String(input.code ?? ""),
+                targetPath: String(input.targetPath ?? "input.ts"),
+                language: typeof input.language === "string" ? input.language : undefined,
+                context: typeof input.context === "string" ? input.context : undefined,
+            };
+            const result = await checkBeforeWrite(parsed);
+            return jsonResponse(result);
+        }
+        case "verglos_check_package": {
+            const result = await checkPackage({
+                packageName: String(input.packageName ?? ""),
+                version: typeof input.version === "string" ? input.version : undefined,
+            });
+            return jsonResponse(result);
+        }
+        case "verglos_scan": {
+            const result = await scanProject({
+                projectRoot: typeof input.projectRoot === "string" ? input.projectRoot : undefined,
+                limit: typeof input.limit === "number" ? input.limit : undefined,
+                noProvenance: typeof input.noProvenance === "boolean"
+                    ? input.noProvenance
+                    : undefined,
+            });
+            return jsonResponse(result);
+        }
+        case "verglos_explain_finding": {
+            const result = explainFinding({ rule: String(input.rule ?? "") });
+            return jsonResponse(result);
+        }
+        default:
+            return stubResponse(name);
+    }
+}
+// ─── Server factory ───────────────────────────────────────────────────────
+export function createVerglosMcpServer() {
+    const server = new Server({
+        name: "verglos",
+        version: "0.6.0",
+    }, {
+        capabilities: {
+            tools: {},
+        },
+    });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: TOOLS.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.inputSchema,
+        })),
+    }));
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const name = request.params.name;
+        const args = request.params.arguments;
+        return dispatchTool(name, args);
+    });
+    return server;
+}
+/**
+ * Start an MCP server over stdio. Prints a startup banner to stderr
+ * so stdout stays clean for the MCP transport (arch spec §7).
+ */
+export async function startStdioServer() {
+    const server = createVerglosMcpServer();
+    const transport = new StdioServerTransport();
+    process.stderr.write("verglos:mcp: server started on stdio\n");
+    await server.connect(transport);
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAKjE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAsB5D,6EAA6E;AAE7E,MAAM,KAAK,GAAG;IACZ;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,iPAAiP;QACnP,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uCAAuC,EAAE;gBAC9E,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,6FAA6F;iBAChG;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,4CAA4C;iBAC1D;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,wDAAwD;iBACtE;aACF;YACD,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;SACjC;KACF;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,2KAA2K;QAC7K,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0DAA0D;iBACxE;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2DAA2D;iBACzE;aACF;YACD,QAAQ,EAAE,CAAC,aAAa,CAAC;SAC1B;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,qJAAqJ;QACvJ,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qDAAqD;iBACnE;aACF;SACF;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,wIAAwI;QAC1I,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,mCAAmC;iBACjD;aACF;YACD,QAAQ,EAAE,CAAC,MAAM,CAAC;SACnB;KACF;CACO,CAAC;AAEX,6EAA6E;AAE7E,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,gBAAgB,IAAI,2FAA2F;aACtH;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IAGpC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,IAAyC;IAEzC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;IACzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,4BAA4B,CAAC,CAAC,CAAC;YAClC,MAAM,MAAM,GAA0B;gBACpC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC9B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC;gBAClD,QAAQ,EACN,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACjE,OAAO,EACL,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aAChE,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,uBAAuB,CAAC,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;gBAC5C,OAAO,EACL,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aAChE,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;gBAC/B,WAAW,EACT,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBACvE,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAChE,YAAY,EACV,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS;oBACrC,CAAC,CAAC,KAAK,CAAC,YAAY;oBACpB,CAAC,CAAC,SAAS;aAChB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAClE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD;YACE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,6EAA6E;AAE7E,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,OAAO;KACjB,EACD;QACE,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;SACV;KACF,CACF,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAEf,CAAC;QACd,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC/D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/tools/check-before-write.d.ts

@@ -0,0 +1,36 @@
+import type { Finding } from "@verglos/shared";
+/**
+ * check_before_write — the killer MCP tool.
+ *
+ * Runs a narrow subset of Verglos detectors on a single piece of
+ * code the agent is about to write:
+ *
+ *   secrets      Any pattern-matched credential in the snippet.
+ *   injection    High-confidence SQL/command/XSS/NoSQL/path/SSRF.
+ *   ai-patterns  AI-001..010 — the wedge. All the flagship rules.
+ *
+ * Skipped in this hot path (spec §7):
+ *   - dependencies (needs a lockfile, network to OSV)
+ *   - misconfig    (needs project-wide context — .env, headers)
+ *   - git-history  (needs a git repo)
+ *   - slopsquat    (needs package.json + network)
+ *   - provenance   (needs git log + repo scan)
+ *
+ * Target budget: <300ms per architecture spec §9. On a fresh temp
+ * dir + one file the sync detectors run in ~15-40ms; total round-
+ * trip is dominated by the mkdtemp/rm calls (~5ms each on tmpfs).
+ */
+export interface CheckBeforeWriteInput {
+    code: string;
+    targetPath: string;
+    language?: string;
+    context?: string;
+}
+export interface CheckBeforeWriteResult {
+    verdict: "allow" | "warn" | "block";
+    findings: Finding[];
+    correctedCode?: string;
+    reasoning: string;
+}
+export declare function checkBeforeWrite(input: CheckBeforeWriteInput): Promise<CheckBeforeWriteResult>;
+//# sourceMappingURL=check-before-write.d.ts.map

package/dist/tools/check-before-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-before-write.d.ts","sourceRoot":"","sources":["../../src/tools/check-before-write.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACpC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAoFD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CA8CjC"}

package/dist/tools/check-before-write.js

@@ -0,0 +1,102 @@
+import { basename, join } from "node:path";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { aiPatternsDetector, injectionDetector, secretsDetector, } from "@verglos/scanner";
+/**
+ * Try to auto-correct known AI-* patterns. Currently only handles
+ * AI-002 (Math.random / Date.now → token/OTP). Others land in a
+ * follow-up commit — spec §7's "correctedCode is best-effort".
+ */
+function tryCorrectCode(original, findings) {
+    const ai002 = findings.find((f) => f.rule === "AI-002");
+    if (!ai002)
+        return undefined;
+    // Two common shapes we can rewrite deterministically:
+    //   const otp = Math.floor(100000 + Math.random() * 900000);
+    //   const token = Math.random().toString(36).slice(2);
+    let corrected = original;
+    // 6-digit OTP shape
+    corrected = corrected.replace(/Math\.floor\s*\(\s*(\d+)\s*\+\s*Math\.random\s*\(\s*\)\s*\*\s*(\d+)\s*\)/g, (_, start, range) => {
+        const s = Number(start);
+        const r = Number(range);
+        return `crypto.randomInt(${s}, ${s + r})`;
+    });
+    // Direct token generation shape
+    corrected = corrected.replace(/Math\.random\s*\(\s*\)\s*\.\s*toString\s*\(\s*36\s*\)\s*\.\s*(slice|substring|substr)\s*\(\s*2\s*\)/g, "crypto.randomBytes(32).toString('base64url')");
+    // Plain `Math.random()` in an obvious token/OTP context — inject a comment
+    // pointing at the safer API rather than rewriting silently, since we
+    // don't know the desired range.
+    if (corrected === original) {
+        corrected = original.replace(/Math\.random\s*\(\s*\)/g, "/* verglos AI-002: replace with crypto.randomInt / crypto.randomBytes */ Math.random()");
+    }
+    // If the transform added a `crypto.` call and the source doesn't already
+    // import node:crypto, prepend a hint import at the top.
+    if (/\bcrypto\.(randomInt|randomBytes)\b/.test(corrected) &&
+        !/import\s+\*?\s*(?:crypto|\{[^}]*crypto[^}]*\})\s*from\s*['"]node:crypto['"]/.test(corrected) &&
+        !/require\s*\(\s*['"]node:crypto['"]\s*\)/.test(corrected)) {
+        corrected = `import * as crypto from "node:crypto";\n${corrected}`;
+    }
+    return corrected === original ? undefined : corrected;
+}
+function summarize(finding) {
+    const rule = finding.rule ? `[${finding.rule}] ` : "";
+    return `${rule}${finding.title}`;
+}
+function buildReasoning(verdict, findings) {
+    if (verdict === "allow") {
+        return "No fast-path detector flagged this snippet. Verglos has not run the slower full-project checks (deps, git-history, provenance) — those come from `verglos_scan`.";
+    }
+    const worst = findings
+        .filter((f) => f.severity === "critical" || f.severity === "high")
+        .slice(0, 5)
+        .map((f) => `  - ${summarize(f)}`)
+        .join("\n");
+    const bypassHint = verdict === "block"
+        ? "Do not write this code as-is. Suggest the corrected version if provided, or ask the human to override."
+        : "This code will land but the flagged concern should be addressed before shipping.";
+    return `Verdict: ${verdict.toUpperCase()}\n${bypassHint}\n\nFindings:\n${worst}`;
+}
+export async function checkBeforeWrite(input) {
+    const tmpRoot = await mkdtemp(join(tmpdir(), "verglos-cbw-"));
+    try {
+        // Preserve extension so language-aware detectors (AI-* code-shape
+        // checks, injection regex) pick the right rule set.
+        const safeName = basename(input.targetPath) || "input.ts";
+        const abs = join(tmpRoot, safeName);
+        await writeFile(abs, input.code, "utf8");
+        const scannedFile = {
+            path: abs,
+            relativePath: safeName,
+        };
+        const detectorResults = await Promise.all([
+            secretsDetector.run([scannedFile], tmpRoot),
+            injectionDetector.run([scannedFile], tmpRoot),
+            aiPatternsDetector.run([scannedFile], tmpRoot),
+        ]);
+        const findings = detectorResults.flat();
+        // Only certain/high-confidence findings drive the verdict per
+        // arch spec §3 (medium/low sit in "worth a look").
+        const scoreable = findings.filter((f) => {
+            const conf = typeof f.confidence === "string"
+                ? f.confidence
+                : f.confidence >= 0.9
+                    ? "certain"
+                    : f.confidence >= 0.7
+                        ? "high"
+                        : "medium";
+            return conf === "certain" || conf === "high";
+        });
+        let verdict = "allow";
+        if (scoreable.some((f) => f.severity === "critical"))
+            verdict = "block";
+        else if (scoreable.some((f) => f.severity === "high"))
+            verdict = "warn";
+        const correctedCode = tryCorrectCode(input.code, findings);
+        const reasoning = buildReasoning(verdict, findings);
+        return { verdict, findings, correctedCode, reasoning };
+    }
+    finally {
+        await rm(tmpRoot, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=check-before-write.js.map

package/dist/tools/check-before-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-before-write.js","sourceRoot":"","sources":["../../src/tools/check-before-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GAEhB,MAAM,kBAAkB,CAAC;AAuC1B;;;;GAIG;AACH,SAAS,cAAc,CACrB,QAAgB,EAChB,QAAmB;IAEnB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,sDAAsD;IACtD,6DAA6D;IAC7D,uDAAuD;IACvD,IAAI,SAAS,GAAG,QAAQ,CAAC;IAEzB,oBAAoB;IACpB,SAAS,GAAG,SAAS,CAAC,OAAO,CAC3B,2EAA2E,EAC3E,CAAC,CAAC,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;IAC5C,CAAC,CACF,CAAC;IAEF,gCAAgC;IAChC,SAAS,GAAG,SAAS,CAAC,OAAO,CAC3B,sGAAsG,EACtG,8CAA8C,CAC/C,CAAC;IAEF,2EAA2E;IAC3E,qEAAqE;IACrE,gCAAgC;IAChC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,SAAS,GAAG,QAAQ,CAAC,OAAO,CAC1B,yBAAyB,EACzB,wFAAwF,CACzF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,wDAAwD;IACxD,IACE,qCAAqC,CAAC,IAAI,CAAC,SAAS,CAAC;QACrD,CAAC,6EAA6E,CAAC,IAAI,CACjF,SAAS,CACV;QACD,CAAC,yCAAyC,CAAC,IAAI,CAAC,SAAS,CAAC,EAC1D,CAAC;QACD,SAAS,GAAG,2CAA2C,SAAS,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CACrB,OAAmC,EACnC,QAAmB;IAEnB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,kKAAkK,CAAC;IAC5K,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;SACjE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,UAAU,GACd,OAAO,KAAK,OAAO;QACjB,CAAC,CAAC,wGAAwG;QAC1G,CAAC,CAAC,kFAAkF,CAAC;IACzF,OAAO,YAAY,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU,kBAAkB,KAAK,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,kEAAkE;QAClE,oDAAoD;QACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAEzC,MAAM,WAAW,GAAgB;YAC/B,IAAI,EAAE,GAAG;YACT,YAAY,EAAE,QAAQ;SACvB,CAAC;QAEF,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxC,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;YAC3C,iBAAiB,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;YAC7C,kBAAkB,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;SAC/C,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC;QAExC,8DAA8D;QAC9D,mDAAmD;QACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,IAAI,GACR,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;gBAC9B,CAAC,CAAC,CAAC,CAAC,UAAU;gBACd,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG;oBACnB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG;wBACnB,CAAC,CAAC,MAAM;wBACR,CAAC,CAAC,QAAQ,CAAC;YACnB,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,GAA+B,OAAO,CAAC;QAClD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;YAAE,OAAO,GAAG,OAAO,CAAC;aACnE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;YAAE,OAAO,GAAG,MAAM,CAAC;QAExE,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEpD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;IACzD,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/tools/check-package.d.ts

@@ -0,0 +1,34 @@
+/**
+ * check_package — pre-install verdict for a single npm package.
+ *
+ * Answers three questions before an agent runs `npm install`:
+ *   1. Does this package exist? (AI-005 slopsquat)
+ *   2. Does it look like a typo of a top-N package? (AI-006)
+ *   3. Does the requested version have known CVEs? (D6-001, OSV)
+ *
+ * Each question is a lightweight network call. No temp files, no
+ * detector orchestration — this is a straight lookup.
+ */
+export interface CheckPackageInput {
+    packageName: string;
+    version?: string;
+}
+export type CheckPackageVerdict = "safe" | "warn" | "block";
+export interface CheckPackageResult {
+    verdict: CheckPackageVerdict;
+    packageName: string;
+    version: string;
+    exists: boolean;
+    typosquat?: {
+        top: string;
+        distance: number;
+    };
+    cves: {
+        id: string;
+        severity: string;
+        summary?: string;
+    }[];
+    reasoning: string;
+}
+export declare function checkPackage(input: CheckPackageInput): Promise<CheckPackageResult>;
+//# sourceMappingURL=check-package.d.ts.map

package/dist/tools/check-package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-package.d.ts","sourceRoot":"","sources":["../../src/tools/check-package.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA2CH,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE5D,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3D,SAAS,EAAE,MAAM,CAAC;CACnB;AAkGD,wBAAsB,YAAY,CAChC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAwF7B"}

package/dist/tools/check-package.js

@@ -0,0 +1,204 @@
+/**
+ * check_package — pre-install verdict for a single npm package.
+ *
+ * Answers three questions before an agent runs `npm install`:
+ *   1. Does this package exist? (AI-005 slopsquat)
+ *   2. Does it look like a typo of a top-N package? (AI-006)
+ *   3. Does the requested version have known CVEs? (D6-001, OSV)
+ *
+ * Each question is a lightweight network call. No temp files, no
+ * detector orchestration — this is a straight lookup.
+ */
+const NPM_REGISTRY = "https://registry.npmjs.org";
+const OSV_URL = "https://api.osv.dev/v1/query";
+const HTTP_TIMEOUT_MS = 4000;
+/**
+ * Small top-N list — same shape as slopsquat.ts. Kept private to
+ * the MCP hot path so the tool can answer without loading the full
+ * scanner list. Refresh occasionally.
+ */
+const TOP_NPM_PACKAGES = [
+    "react", "react-dom", "next", "vue", "svelte", "solid-js",
+    "express", "fastify", "koa", "nestjs", "hono",
+    "lodash", "underscore", "ramda", "immer",
+    "axios", "node-fetch", "got", "ky",
+    "moment", "dayjs", "date-fns", "luxon",
+    "typescript", "eslint", "prettier", "vite", "webpack", "rollup", "esbuild",
+    "vitest", "jest", "mocha", "playwright", "cypress",
+    "chalk", "commander", "yargs", "inquirer", "ora",
+    "chokidar", "fs-extra", "fast-glob", "globby",
+    "dotenv",
+    "zod", "yup", "joi", "ajv", "valibot",
+    "prisma", "@prisma/client", "drizzle-orm", "sequelize", "typeorm", "mongoose", "kysely",
+    "pg", "mysql2", "sqlite3", "better-sqlite3", "postgres",
+    "redis", "ioredis",
+    "socket.io", "ws",
+    "graphql", "@apollo/client", "@tanstack/react-query", "swr",
+    "next-auth", "@clerk/nextjs", "passport", "jsonwebtoken", "jose",
+    "bcrypt", "bcryptjs", "argon2",
+    "stripe",
+    "@aws-sdk/client-s3",
+    "@sentry/nextjs", "@sentry/node",
+    "openai", "@anthropic-ai/sdk", "ai",
+    "tsx", "ts-node", "tsup",
+    "react-router", "@tanstack/react-router",
+    "tailwindcss", "postcss",
+    "clsx", "tailwind-merge",
+    "uuid", "nanoid",
+    "pino", "winston",
+];
+const TYPOSQUAT_MAX_DISTANCE = 2;
+async function withTimeout(p, ms) {
+    return Promise.race([
+        p,
+        new Promise((resolve) => setTimeout(() => resolve(null), ms)),
+    ]);
+}
+async function packageExists(name) {
+    const res = await withTimeout(fetch(`${NPM_REGISTRY}/${encodeURIComponent(name)}`, { method: "HEAD" }), HTTP_TIMEOUT_MS);
+    if (!res)
+        return null;
+    if (res.status === 200)
+        return true;
+    if (res.status === 404)
+        return false;
+    return null;
+}
+function levenshtein(a, b) {
+    if (a === b)
+        return 0;
+    if (!a.length)
+        return b.length;
+    if (!b.length)
+        return a.length;
+    const prev = new Array(b.length + 1);
+    const curr = new Array(b.length + 1);
+    for (let j = 0; j <= b.length; j++)
+        prev[j] = j;
+    for (let i = 1; i <= a.length; i++) {
+        curr[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            curr[j] = Math.min((curr[j - 1] ?? 0) + 1, (prev[j] ?? 0) + 1, (prev[j - 1] ?? 0) + cost);
+        }
+        for (let j = 0; j <= b.length; j++)
+            prev[j] = curr[j] ?? 0;
+    }
+    return prev[b.length] ?? 0;
+}
+function findTyposquat(name) {
+    const lower = name.toLowerCase();
+    let best = null;
+    for (const top of TOP_NPM_PACKAGES) {
+        const d = levenshtein(lower, top.toLowerCase());
+        if (d === 0)
+            return null;
+        if (d > TYPOSQUAT_MAX_DISTANCE)
+            continue;
+        if (!best || d < best.distance)
+            best = { top, distance: d };
+    }
+    return best;
+}
+async function queryOsv(name, version) {
+    try {
+        const res = await withTimeout(fetch(OSV_URL, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                package: { name, ecosystem: "npm" },
+                version,
+            }),
+        }), HTTP_TIMEOUT_MS);
+        if (!res || !res.ok)
+            return [];
+        const data = (await res.json());
+        return data.vulns ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+async function resolveLatest(name) {
+    const res = await withTimeout(fetch(`${NPM_REGISTRY}/${encodeURIComponent(name)}/latest`), HTTP_TIMEOUT_MS);
+    if (!res || !res.ok)
+        return null;
+    try {
+        const data = (await res.json());
+        return data.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function checkPackage(input) {
+    const packageName = input.packageName.trim();
+    const exists = await packageExists(packageName);
+    if (exists === false) {
+        // AI-005 — package doesn't exist. Block.
+        return {
+            verdict: "block",
+            packageName,
+            version: input.version ?? "unknown",
+            exists: false,
+            cves: [],
+            reasoning: `\`${packageName}\` does not exist on the public npm registry. This is the AI-005 slopsquat failure mode — either the install will fail, or worse, an attacker has registered the exact hallucinated name and is now shipping malware to anyone who runs \`npm install\`. Do not install.`,
+        };
+    }
+    if (exists === null) {
+        // Network flaky — respond with a soft warn so the agent can proceed at its own risk.
+        return {
+            verdict: "warn",
+            packageName,
+            version: input.version ?? "unknown",
+            exists: false,
+            cves: [],
+            reasoning: `Could not reach registry.npmjs.org to verify \`${packageName}\`. Retry later, or check manually before installing.`,
+        };
+    }
+    // Resolve version if not given (we need it for OSV).
+    const version = input.version && input.version !== "latest"
+        ? input.version
+        : ((await resolveLatest(packageName)) ?? "latest");
+    const typosquat = findTyposquat(packageName);
+    const cves = await queryOsv(packageName, version);
+    const cvesFmt = cves.map((v) => ({
+        id: v.id,
+        severity: v.database_specific?.severity ?? "UNKNOWN",
+        summary: v.summary,
+    }));
+    const criticals = cvesFmt.filter((v) => v.severity === "CRITICAL" || v.severity === "HIGH");
+    let verdict = "safe";
+    const notes = [];
+    if (criticals.length > 0) {
+        verdict = "block";
+        notes.push(`${criticals.length} critical/high CVE${criticals.length === 1 ? "" : "s"} for ${packageName}@${version}: ${criticals
+            .slice(0, 3)
+            .map((c) => c.id)
+            .join(", ")}${criticals.length > 3 ? "…" : ""}`);
+    }
+    else if (cvesFmt.length > 0) {
+        verdict = "warn";
+        notes.push(`${cvesFmt.length} known vulnerabilit${cvesFmt.length === 1 ? "y" : "ies"} in ${packageName}@${version}. Review before installing.`);
+    }
+    if (typosquat) {
+        // Typosquat elevates from safe → warn; if a CVE already put us at
+        // block or warn, we compound but don't downgrade.
+        if (verdict === "safe")
+            verdict = "warn";
+        notes.push(`\`${packageName}\` is Levenshtein distance ${typosquat.distance} from \`${typosquat.top}\`. If you meant \`${typosquat.top}\`, install that instead — the near-miss is exactly what squatters register.`);
+    }
+    if (notes.length === 0) {
+        notes.push(`\`${packageName}@${version}\` exists on npm and has no known CVEs recorded by OSV.dev.`);
+    }
+    return {
+        verdict,
+        packageName,
+        version,
+        exists: true,
+        typosquat: typosquat ?? undefined,
+        cves: cvesFmt,
+        reasoning: notes.join("\n\n"),
+    };
+}
+//# sourceMappingURL=check-package.js.map

package/dist/tools/check-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-package.js","sourceRoot":"","sources":["../../src/tools/check-package.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAC/C,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;;GAIG;AACH,MAAM,gBAAgB,GAAG;IACvB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU;IACzD,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;IAC7C,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO;IACxC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI;IAClC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO;IACtC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS;IAC1E,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS;IAClD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK;IAChD,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ;IAC7C,QAAQ;IACR,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS;IACrC,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ;IACvF,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU;IACvD,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,IAAI;IACjB,SAAS,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,KAAK;IAC3D,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM;IAChE,QAAQ,EAAE,UAAU,EAAE,QAAQ;IAC9B,QAAQ;IACR,oBAAoB;IACpB,gBAAgB,EAAE,cAAc;IAChC,QAAQ,EAAE,mBAAmB,EAAE,IAAI;IACnC,KAAK,EAAE,SAAS,EAAE,MAAM;IACxB,cAAc,EAAE,wBAAwB;IACxC,aAAa,EAAE,SAAS;IACxB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,SAAS;CAClB,CAAC;AACF,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAmBjC,KAAK,UAAU,WAAW,CAAI,CAAa,EAAE,EAAU;IACrD,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,MAAM,WAAW,CAC3B,KAAK,CAAC,GAAG,YAAY,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACxE,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAChB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EACtB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAClB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAC1B,CAAC;QACJ,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,IAAI,GAA6C,IAAI,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC,GAAG,sBAAsB;YAAE,SAAS;QACzC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ;YAAE,IAAI,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAC3B,KAAK,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;gBACnC,OAAO;aACR,CAAC;SACH,CAAC,EACF,eAAe,CAChB,CAAC;QACF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,MAAM,WAAW,CAC3B,KAAK,CAAC,GAAG,YAAY,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAC3D,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAwB;IAExB,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAE7C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,yCAAyC;QACzC,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,WAAW;YACX,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS;YACnC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,KAAK,WAAW,0QAA0Q;SACtS,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,qFAAqF;QACrF,OAAO;YACL,OAAO,EAAE,MAAM;YACf,WAAW;YACX,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS;YACnC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,kDAAkD,WAAW,uDAAuD;SAChI,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ;QACzC,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAElD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,iBAAiB,EAAE,QAAQ,IAAI,SAAS;QACpD,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC,CAAC,CAAC;IAEJ,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAC1D,CAAC;IAEF,IAAI,OAAO,GAAwB,MAAM,CAAC;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,OAAO,CAAC;QAClB,KAAK,CAAC,IAAI,CACR,GAAG,SAAS,CAAC,MAAM,qBAAqB,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,WAAW,IAAI,OAAO,KAAK,SAAS;aAClH,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChB,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClD,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,MAAM,CAAC;QACjB,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,CAAC,MAAM,sBAAsB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,WAAW,IAAI,OAAO,6BAA6B,CACpI,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,kEAAkE;QAClE,kDAAkD;QAClD,IAAI,OAAO,KAAK,MAAM;YAAE,OAAO,GAAG,MAAM,CAAC;QACzC,KAAK,CAAC,IAAI,CACR,KAAK,WAAW,8BAA8B,SAAS,CAAC,QAAQ,WAAW,SAAS,CAAC,GAAG,sBAAsB,SAAS,CAAC,GAAG,8EAA8E,CAC1M,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,KAAK,WAAW,IAAI,OAAO,6DAA6D,CACzF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO;QACP,WAAW;QACX,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;KAC9B,CAAC;AACJ,CAAC"}

package/dist/tools/explain-finding.d.ts

@@ -0,0 +1,18 @@
+import { type ExplainEntry } from "@verglos/shared";
+/**
+ * verglos_explain_finding MCP tool — same explain-bank the CLI
+ * (verglos explain <rule>) consumes. Returns the full rule entry
+ * as structured JSON so the agent can format it however it wants
+ * or hand the human a link to a docs URL.
+ */
+export interface ExplainFindingInput {
+    rule: string;
+}
+export interface ExplainFindingResult {
+    found: boolean;
+    rule: string;
+    entry?: ExplainEntry;
+    message?: string;
+}
+export declare function explainFinding(input: ExplainFindingInput): ExplainFindingResult;
+//# sourceMappingURL=explain-finding.d.ts.map

package/dist/tools/explain-finding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain-finding.d.ts","sourceRoot":"","sources":["../../src/tools/explain-finding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEhE;;;;;GAKG;AAEH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,CAc/E"}

package/dist/tools/explain-finding.js

@@ -0,0 +1,17 @@
+import { lookupRule } from "@verglos/shared";
+export function explainFinding(input) {
+    const entry = lookupRule(input.rule);
+    if (!entry) {
+        return {
+            found: false,
+            rule: input.rule,
+            message: `Unknown rule id \`${input.rule}\`. Run \`verglos explain --list\` for every rule Verglos knows about.`,
+        };
+    }
+    return {
+        found: true,
+        rule: entry.rule,
+        entry,
+    };
+}
+//# sourceMappingURL=explain-finding.js.map

package/dist/tools/explain-finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain-finding.js","sourceRoot":"","sources":["../../src/tools/explain-finding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAqB,MAAM,iBAAiB,CAAC;AAoBhE,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,qBAAqB,KAAK,CAAC,IAAI,wEAAwE;SACjH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/tools/scan.d.ts

@@ -0,0 +1,33 @@
+import type { Finding, RepoProvenance, ScanScore } from "@verglos/shared";
+/**
+ * verglos_scan MCP tool — full project scan wrapped for agent use.
+ *
+ * Runs the same scan as `verglos scan` (all detectors, provenance,
+ * OSV, git history). Slower than check_before_write — use for
+ * pre-PR review or on-demand agent queries, not per-line checks.
+ *
+ * Returns a summarized shape (score + counts + provenance headline
+ * + top findings). The full findings list would blow up an MCP
+ * response for large repos; the agent can call this tool with
+ * `limit` set higher when it actually wants the full list.
+ */
+export interface ScanInput {
+    projectRoot?: string;
+    /** Cap on findings returned. Default 20; 0 = no cap. */
+    limit?: number;
+    /** Opt out of the provenance engine — same as `verglos scan --no-provenance`. */
+    noProvenance?: boolean;
+}
+export interface ScanResultSummary {
+    projectRoot: string;
+    scannedAt: string;
+    durationMs: number;
+    score: ScanScore;
+    provenance?: RepoProvenance;
+    findingCount: number;
+    findings: Finding[];
+    truncated: boolean;
+    headline: string;
+}
+export declare function scanProject(input: ScanInput): Promise<ScanResultSummary>;
+//# sourceMappingURL=scan.d.ts.map

package/dist/tools/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/tools/scan.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE1E;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AA2CD,wBAAsB,WAAW,CAC/B,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,iBAAiB,CAAC,CA0B5B"}

package/dist/tools/scan.js

@@ -0,0 +1,56 @@
+import { runScan } from "@verglos/scanner";
+function severityRank(sev) {
+    switch (sev) {
+        case "critical":
+            return 4;
+        case "high":
+            return 3;
+        case "medium":
+            return 2;
+        case "low":
+            return 1;
+        default:
+            return 0;
+    }
+}
+function buildHeadline(score, provenance) {
+    const parts = [
+        `Score ${score.value}/100 — ${score.counts.critical} critical, ${score.counts.high} high, ${score.counts.medium} medium.`,
+    ];
+    if (provenance && provenance.aiAuthoredPercent > 0) {
+        if (provenance.densityRatio !== null) {
+            parts.push(`${provenance.aiAuthoredPercent}% AI-authored; AI files carry ${provenance.densityRatio}× the finding density of human files.`);
+        }
+        else {
+            parts.push(`${provenance.aiAuthoredPercent}% AI-authored (density ratio hidden — not enough LOC per bucket).`);
+        }
+        if (provenance.criticalsTotal > 0) {
+            parts.push(`${provenance.criticalsInAIFiles} of ${provenance.criticalsTotal} criticals live in AI-authored files.`);
+        }
+    }
+    return parts.join(" ");
+}
+export async function scanProject(input) {
+    const projectRoot = input.projectRoot ?? process.cwd();
+    const limit = input.limit ?? 20;
+    const result = await runScan({
+        projectRoot,
+        unlocked: true,
+        includeGitHistory: true,
+        noProvenance: input.noProvenance,
+    });
+    const sorted = [...result.findings].sort((a, b) => severityRank(b.severity) - severityRank(a.severity));
+    const capped = limit === 0 ? sorted : sorted.slice(0, limit);
+    return {
+        projectRoot: result.projectRoot,
+        scannedAt: result.scannedAt,
+        durationMs: result.durationMs,
+        score: result.score,
+        provenance: result.provenance,
+        findingCount: result.findings.length,
+        findings: capped,
+        truncated: capped.length < result.findings.length,
+        headline: buildHeadline(result.score, result.provenance),
+    };
+}
+//# sourceMappingURL=scan.js.map

package/dist/tools/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/tools/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAoC3C,SAAS,YAAY,CAAC,GAAwB;IAC5C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,CAAC,CAAC;QACX,KAAK,MAAM;YACT,OAAO,CAAC,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC;QACX,KAAK,KAAK;YACR,OAAO,CAAC,CAAC;QACX;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAgB,EAChB,UAAsC;IAEtC,MAAM,KAAK,GAAG;QACZ,SAAS,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,MAAM,CAAC,QAAQ,cAAc,KAAK,CAAC,MAAM,CAAC,IAAI,UAAU,KAAK,CAAC,MAAM,CAAC,MAAM,UAAU;KAC1H,CAAC;IACF,IAAI,UAAU,IAAI,UAAU,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CACR,GAAG,UAAU,CAAC,iBAAiB,iCAAiC,UAAU,CAAC,YAAY,uCAAuC,CAC/H,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CACR,GAAG,UAAU,CAAC,iBAAiB,mEAAmE,CACnG,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CACR,GAAG,UAAU,CAAC,kBAAkB,OAAO,UAAU,CAAC,cAAc,uCAAuC,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAgB;IAEhB,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAC3B,WAAW;QACX,QAAQ,EAAE,IAAI;QACd,iBAAiB,EAAE,IAAI;QACvB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC9D,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAE7D,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QACpC,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM;QACjD,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC;KACzD,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@verglos/mcp",
+  "version": "0.7.0",
+  "description": "Model Context Protocol server for Verglos — lets AI agents scan and get security verdicts before writing code.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./server": {
+      "import": "./dist/server.js",
+      "types": "./dist/server.d.ts"
+    }
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.4",
+    "@verglos/scanner": "0.7.0",
+    "@verglos/shared": "0.7.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.29",
+    "typescript": "^5.8.3"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}