@vibekiln/cutline-mcp-cli 0.4.2 → 0.4.4

package/dist/commands/init.js

@@ -94,7 +94,7 @@ Skip: Pure styling, docs, formatting, non-security dep bumps.
 ## Magic Phrase
 
 If the user invokes Cutline naturally (for example: **"use cutline"**, **"use cutline to..."**, **"using cutline..."**, **"with cutline..."**), route automatically based on tier and intent:
-- Free/default intent: run \`code_audit(project_root)\`
+- Free/default intent: run \`code_audit(project_root)\` (aka "security vibe check")
 - Premium product-linked intent: run \`engineering_audit(product_id, project_root)\`
 - Feature implementation intent: run \`rgr_plan(...)\` then \`constraints_auto(...)\`
 `;
@@ -109,7 +109,7 @@ alwaysApply: true
 
 # Cutline Constraints
 
-Run \`code_audit(project_root)\` before major implementations to check constraint coverage.
+Run \`code_audit(project_root)\` before major implementations to run a security vibe check on constraint coverage.
 
 Severity levels:
 - **CRITICAL**: Must address before proceeding
@@ -184,7 +184,7 @@ Skip for: pure styling, docs, formatting, non-security dep bumps.
 ## Magic Phrase
 
 If the user invokes Cutline naturally (for example: **"use cutline"**, **"use cutline to..."**, **"using cutline..."**, **"with cutline..."**), route automatically based on tier and intent:
-- Free/default intent: \`code_audit(project_root)\`
+- Free/default intent: \`code_audit(project_root)\` (aka "security vibe check")
 - Premium product-linked intent: \`engineering_audit(product_id, project_root)\`
 - Feature implementation intent: \`rgr_plan(...)\` then \`constraints_auto(...)\`
 `;
@@ -204,6 +204,9 @@ function ensureGitignore(projectRoot, patterns) {
 export async function initCommand(options) {
     const projectRoot = resolve(options.projectRoot ?? process.cwd());
     const config = readCutlineConfig(projectRoot);
+    const scanUrl = options.staging
+        ? 'https://cutline-staging.web.app/scan'
+        : 'https://thecutline.ai/scan';
     console.log(chalk.bold('\n🔧 Cutline Init\n'));
     // Authenticate and determine tier
     const spinner = ora('Checking authentication...').start();
@@ -212,6 +215,8 @@ export async function initCommand(options) {
     if (!auth) {
         spinner.warn(chalk.yellow('Not authenticated — generating free-tier rules'));
         console.log(chalk.dim('  Run `cutline-mcp login` to authenticate for richer config.\n'));
+        console.log(chalk.dim('  Or run a quick scan in the web app:'), chalk.cyan(scanUrl));
+        console.log();
     }
     else {
         tier = auth.tier;
@@ -292,6 +297,7 @@ export async function initCommand(options) {
     else if (tier === 'free') {
         console.log(chalk.dim('\n  Upgrade to Premium for product-specific constraint graphs and .cutline.md'));
         console.log(chalk.dim('  →'), chalk.cyan('cutline-mcp upgrade'), chalk.dim('or https://thecutline.ai/upgrade'));
+        console.log(chalk.dim('  Free scan in browser:'), chalk.cyan(scanUrl));
     }
     if (generatedApiKey) {
         console.log();

package/dist/commands/setup.js

@@ -392,8 +392,8 @@ export async function setupCommand(options) {
             { cmd: 'use cutline', desc: 'Magic phrase (also works with "use cutline to...", "using cutline...", "with cutline...") — Cutline infers intent and routes to the right flow' },
             { cmd: 'Run a deep dive on my product idea', desc: 'Pre-mortem analysis — risks, assumptions, experiments' },
             { cmd: 'Plan this feature with constraints from my product', desc: 'RGR plan — constraint-aware implementation roadmap' },
-            { cmd: 'Run a code audit on this codebase', desc: 'Free code audit — security, reliability, and scalability (generic, not product-linked)' },
-            { cmd: 'Run an engineering audit for my product', desc: 'Premium deep audit — product-linked analysis + RGR remediation plan' },
+            { cmd: 'Run a security vibe check on this codebase', desc: 'Free security vibe check (`code_audit`) — security, reliability, and scalability (generic, not product-linked)' },
+            { cmd: 'Run an engineering vibe check for my product', desc: 'Premium deep vibe check (`engineering_audit`) — product-linked analysis + RGR remediation plan' },
             { cmd: 'Check constraints for src/api/upload.ts', desc: 'Get NFR boundaries for a specific file' },
             { cmd: 'Generate .cutline.md for my product', desc: 'Write the constraint routing engine' },
             { cmd: 'What does my persona think about X?', desc: 'AI persona feedback on features' },
@@ -407,7 +407,7 @@ export async function setupCommand(options) {
     else {
         const items = [
             { cmd: 'use cutline', desc: 'Magic phrase (also works with "use cutline to...", "using cutline...", "with cutline...") — Cutline routes to the highest-value free flow for your intent' },
-            { cmd: 'Run a code audit on this codebase', desc: 'Free code audit — security, reliability, and scalability scan (3/month free)' },
+            { cmd: 'Run a security vibe check on this codebase', desc: 'Free security vibe check (`code_audit`) — security, reliability, and scalability scan (3/month free)' },
             { cmd: 'Explore a product idea', desc: 'Free 6-act discovery flow to identify pain points and opportunities' },
             { cmd: 'Continue my exploration session', desc: 'Resume and refine an existing free exploration conversation' },
         ];

package/dist/servers/{chunk-6Y3AEXE3.js → chunk-X2B5QUWO.js}

@@ -305,13 +305,17 @@ function getHiddenAuditDimensions() {
   const normalized = [...new Set(hidden.map((d) => String(d).trim().toLowerCase()).filter((d) => allowed.has(d)))];
   return normalized;
 }
-function getStoredApiKey() {
+function getStoredApiKey(options) {
+  const includeConfig = options?.includeConfig ?? true;
   if (process.env.CUTLINE_API_KEY) {
     return {
       apiKey: process.env.CUTLINE_API_KEY,
       environment: process.env.CUTLINE_ENV === "staging" ? "staging" : "production"
     };
   }
+  if (!includeConfig) {
+    return null;
+  }
   const config = readLocalCutlineConfig();
   if (config?.apiKey) {
     return { apiKey: config.apiKey, environment: config.environment };
@@ -406,12 +410,15 @@ function getSiteUrl(environment) {
   return environment === "staging" ? "https://cutline-staging.web.app" : "https://thecutline.ai";
 }
 async function getPublicSiteUrlForCurrentAuth() {
+  const stored = await getStoredToken();
+  if (stored?.environment) {
+    return getSiteUrl(stored.environment);
+  }
   const apiKeyInfo = getStoredApiKey();
   if (apiKeyInfo?.environment) {
     return getSiteUrl(apiKeyInfo.environment);
   }
-  const stored = await getStoredToken();
-  return getSiteUrl(stored?.environment);
+  return getSiteUrl();
 }
 var cachedBaseUrl;
 var cachedIdToken;
@@ -455,27 +462,34 @@ async function exchangeRefreshForId(refreshToken, environment) {
   return data.id_token;
 }
 async function resolveAuth() {
-  const apiKeyInfo = getStoredApiKey();
-  if (apiKeyInfo) {
+  const envApiKeyInfo = getStoredApiKey({ includeConfig: false });
+  if (envApiKeyInfo) {
     return {
-      baseUrl: getBaseUrl(apiKeyInfo.environment),
-      idToken: apiKeyInfo.apiKey
+      baseUrl: getBaseUrl(envApiKeyInfo.environment),
+      idToken: envApiKeyInfo.apiKey
     };
   }
   if (cachedIdToken && Date.now() < tokenExpiresAt && cachedBaseUrl) {
     return { baseUrl: cachedBaseUrl, idToken: cachedIdToken };
   }
   const stored = await getStoredToken();
-  if (!stored) {
-    throw new Error("Not authenticated. Run 'cutline-mcp login' or set CUTLINE_API_KEY.");
+  if (stored) {
+    const env = stored.environment || "production";
+    const baseUrl = getBaseUrl(env);
+    const idToken = await exchangeRefreshForId(stored.refreshToken, env);
+    cachedBaseUrl = baseUrl;
+    cachedIdToken = idToken;
+    tokenExpiresAt = Date.now() + 50 * 60 * 1e3;
+    return { baseUrl, idToken };
+  }
+  const configApiKeyInfo = getStoredApiKey();
+  if (configApiKeyInfo) {
+    return {
+      baseUrl: getBaseUrl(configApiKeyInfo.environment),
+      idToken: configApiKeyInfo.apiKey
+    };
   }
-  const env = stored.environment || "production";
-  const baseUrl = getBaseUrl(env);
-  const idToken = await exchangeRefreshForId(stored.refreshToken, env);
-  cachedBaseUrl = baseUrl;
-  cachedIdToken = idToken;
-  tokenExpiresAt = Date.now() + 50 * 60 * 1e3;
-  return { baseUrl, idToken };
+  throw new Error("Not authenticated. Run 'cutline-mcp login' or set CUTLINE_API_KEY.");
 }
 async function proxy(action, params = {}) {
   const { baseUrl, idToken } = await resolveAuth();

package/dist/servers/cutline-server.js

@@ -75,7 +75,7 @@ import {
   upsertEntities,
   upsertNodes,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 import {
   GraphTraverser,
   computeGenericGraphMetrics,
@@ -8106,7 +8106,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "code_audit",
-        description: "\u{1F513} FREE - Code audit. Evaluates your codebase against a stack-aware constraint graph covering security, reliability, and scalability. No deep dive or product_id required \u2014 just point at your codebase. Shows aggregate readiness scores and top critical findings; detailed analysis and remediation require Premium. Requires a Cutline account (free). 3 scans/month.",
+        description: "\u{1F513} FREE - Security vibe check (code audit). Evaluates your codebase against a stack-aware constraint graph covering security, reliability, and scalability. No deep dive or product_id required \u2014 just point at your codebase. Shows aggregate readiness scores and top critical findings; detailed analysis and remediation require Premium. Requires a Cutline account (free). 3 scans/month.",
         inputSchema: {
           type: "object",
           properties: {
@@ -8119,7 +8119,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "engineering_audit",
-        description: "\u{1F512} PREMIUM - Engineering audit for your product. Security-focused deep audit that scans local code, cross-references the product constraint graph, extracts security gaps, builds an RGR remediation plan, and optionally queues a deep dive job.",
+        description: "\u{1F512} PREMIUM - Engineering vibe check (engineering audit) for your product. Security-focused deep audit that scans local code, cross-references the product constraint graph, extracts security gaps, builds an RGR remediation plan, and optionally queues a deep dive job.",
         inputSchema: {
           type: "object",
           properties: {

package/dist/servers/{data-client-PPEF2XUI.js → data-client-AQ5DGSAR.js}

@@ -78,7 +78,7 @@ import {
   upsertEdges,
   upsertEntities,
   upsertNodes
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 export {
   addEdges,
   addEntity,

package/dist/servers/exploration-server.js

@@ -14,7 +14,7 @@ import {
   requirePremiumWithAutoAuth,
   updateExplorationSession,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 
 // ../mcp/dist/mcp/src/exploration-server.js
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/dist/servers/integrations-server.js

@@ -13,7 +13,7 @@ import {
   requirePremiumWithAutoAuth,
   validateAuth,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 
 // ../mcp/dist/mcp/src/integrations-server.js
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/dist/servers/output-server.js

@@ -13,7 +13,7 @@ import {
   mapErrorToMcp,
   requirePremiumWithAutoAuth,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 
 // ../mcp/dist/mcp/src/output-server.js
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/dist/servers/premortem-server.js

@@ -27,7 +27,7 @@ import {
   updatePremortem,
   validateAuth,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 
 // ../mcp/dist/mcp/src/premortem-server.js
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/dist/servers/tools-server.js

@@ -21,7 +21,7 @@ import {
   requirePremiumWithAutoAuth,
   validateAuth,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 
 // ../mcp/dist/mcp/src/tools-server.js
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@vibekiln/cutline-mcp-cli",
-    "version": "0.4.2",
+    "version": "0.4.4",
     "description": "CLI and MCP servers for Cutline — authenticate, then run constraint-aware MCP servers in Cursor or any MCP client.",
     "type": "module",
     "main": "dist/index.js",