@viberaven/mcp 0.1.0-beta.1 → 1.0.1

package/README.md

@@ -4,20 +4,56 @@ Thin MCP wrapper for VibeRaven.
 
 This package exposes VibeRaven CLI actions as MCP tools for Codex, Claude Code, Cursor, and other agent runtimes. It does not contain VibeRaven backend logic and does not bypass VibeRaven login or scan quotas.
 
+The MCP server wraps the stable CLI package: `npx -y viberaven`.
+
 ## Run
 
 ```bash
-npx -y @viberaven/mcp@beta
+npx -y @viberaven/mcp
+```
+
+You can also start the MCP server from the main CLI package:
+
+```bash
+npx -y viberaven mcp
 ```
 
 ## Tools
 
-- `viberaven_scan` -> `npx -y @viberaven/cli@beta scan`
-- `viberaven_status` -> `npx -y @viberaven/cli@beta status`
-- `viberaven_next` -> `npx -y @viberaven/cli@beta next --json`
-- `viberaven_prompt` -> `npx -y @viberaven/cli@beta prompt`
-- `viberaven_login` -> `npx -y @viberaven/cli@beta login`
+- `viberaven_check_readiness` -> `npx -y viberaven --agent-mode`
+- `viberaven_verify` -> `npx -y viberaven --verify`
+- `viberaven_audit` -> `npx -y viberaven audit --vercel-supabase`
+- `viberaven_init_rules` -> `npx -y viberaven init`
+- `viberaven_clean_plan` -> `npx -y viberaven clean --plan`
+- `viberaven_strict_gate` -> `npx -y viberaven --agent-mode --strict --json`
+- `viberaven_gate_result` -> `npx -y viberaven --agent-mode --json`
+- `viberaven_context_map` -> `npx -y viberaven --condense`
+- `viberaven_heal_plan` -> `npx -y viberaven --heal --plan`
+- `viberaven_heal_prompt` -> `npx -y viberaven --heal --prompt`
+- `viberaven_heal_apply` -> `npx -y viberaven --heal --apply`
+
+`viberaven_check_readiness` is the canonical entrypoint. It runs VibeRaven as the Agent Context + Production Gate and writes `.viberaven/agent-tasklist.md`, `.viberaven/gate-result.json`, and `.viberaven/context-map.json`.
+
+After one fix, call `viberaven_verify`. Before deploy or CI pass, call `viberaven_strict_gate` or run:
+
+```bash
+npx -y viberaven --strict
+```
+
+## Machine Artifact Contract
+
+```text
+docs/contracts/artifacts.md
+https://viberaven.dev/schemas/gate-result.schema.json
+https://viberaven.dev/schemas/context-map.schema.json
+https://viberaven.dev/schemas/gap.schema.json
+https://viberaven.dev/schemas/heal-result.schema.json
+```
+
+## Login
+
+If VibeRaven prints `LOGIN_URL_READY`, open that exact URL for the user, keep the MCP call alive, and do not ask for passwords, tokens, cookies, or other secrets.
 
 ## Security
 
-The MCP package is public integration glue only. The CLI still calls the managed VibeRaven API after user login. Free and Pro quota rules still apply.
+The MCP package is public integration glue only. It returns CLI stdout/stderr and structured JSON content when available. It does not mutate provider dashboards and does not bypass VibeRaven login, managed API checks, or quota enforcement. Do not claim provider dashboard checks are fixed by repo-code edits.

package/bin/server.js

@@ -1,84 +1,116 @@
 #!/usr/bin/env node
 const { spawn } = require('node:child_process');
+let spawnChild = spawn;
 
-const SERVER_INFO = { name: 'viberaven-mcp', version: '0.1.0-beta.1' };
+const SERVER_INFO = { name: 'viberaven-mcp', version: '1.0.0' };
+const CLI_PACKAGE = '@viberaven/cli';
+
+const cwdSchema = {
+  type: 'object',
+  properties: {
+    cwd: { type: 'string', description: 'Project root. Defaults to the MCP server working directory.' }
+  },
+  additionalProperties: false
+};
+
+const healSchema = {
+  type: 'object',
+  properties: {
+    cwd: { type: 'string' },
+    target: { type: 'string' },
+    gap: { type: 'string' },
+    yes: { type: 'boolean' }
+  },
+  additionalProperties: false
+};
 
 const TOOLS = [
   {
-    name: 'viberaven_scan',
-    description: 'Run VibeRaven launch-readiness scan in a project. Opens VibeRaven login when required.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        cwd: { type: 'string', description: 'Project root to scan. Defaults to the MCP server working directory.' },
-        path: { type: 'string', description: 'Optional path argument passed to viberaven scan.' },
-        open: { type: 'boolean', description: 'Open the generated report after scan.' }
-      },
-      additionalProperties: false
-    }
+    name: 'viberaven_check_readiness',
+    description: 'Run the VibeRaven agent-mode production-readiness check and write .viberaven artifacts.',
+    inputSchema: cwdSchema
   },
   {
-    name: 'viberaven_status',
-    description: 'Show VibeRaven account, quota, and last scan status.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        cwd: { type: 'string', description: 'Project root. Defaults to the MCP server working directory.' },
-        json: { type: 'boolean', description: 'Return machine-readable status JSON.' }
-      },
-      additionalProperties: false
-    }
+    name: 'viberaven_verify',
+    description: 'Rescan and refresh VibeRaven production-readiness artifacts after a fix.',
+    inputSchema: cwdSchema
   },
   {
-    name: 'viberaven_next',
-    description: 'Return the next VibeRaven production action from the last scan.',
+    name: 'viberaven_audit',
+    description: 'Run local Vercel/Supabase production checks for RLS, service-role boundaries, and Vercel pooler usage.',
     inputSchema: {
       type: 'object',
       properties: {
-        cwd: { type: 'string', description: 'Project root. Defaults to the MCP server working directory.' }
+        cwd: { type: 'string', description: 'Project root. Defaults to current working directory.' },
+        json: { type: 'boolean', description: 'Return JSON output.' }
       },
       additionalProperties: false
     }
   },
   {
-    name: 'viberaven_prompt',
-    description: 'Return the focused VibeRaven fix prompt for the top or selected gap.',
+    name: 'viberaven_init_rules',
+    description: 'Install bounded VibeRaven rules into native AI instruction files.',
     inputSchema: {
       type: 'object',
       properties: {
-        cwd: { type: 'string', description: 'Project root. Defaults to the MCP server working directory.' },
-        gap: { type: 'string', description: 'Optional gap id.' },
-        area: { type: 'string', description: 'Optional production area.' },
-        provider: { type: 'string', description: 'Optional provider key.' }
+        cwd: { type: 'string', description: 'Project root. Defaults to current working directory.' },
+        agents: { type: 'string', description: 'Comma-separated agent targets, or all.' },
+        dryRun: { type: 'boolean', description: 'Preview changes without writing files.' }
       },
       additionalProperties: false
     }
   },
   {
-    name: 'viberaven_login',
-    description: 'Start VibeRaven browser sign-in and save local CLI credentials after approval.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        cwd: { type: 'string', description: 'Working directory. Defaults to the MCP server working directory.' }
-      },
-      additionalProperties: false
-    }
+    name: 'viberaven_clean_plan',
+    description: 'Write a non-destructive context cleanup plan for generated artifacts and logs.',
+    inputSchema: cwdSchema
+  },
+  {
+    name: 'viberaven_strict_gate',
+    description: 'Run VibeRaven agent-mode strict gate and return the machine verdict.',
+    inputSchema: cwdSchema
+  },
+  {
+    name: 'viberaven_gate_result',
+    description: 'Run VibeRaven agent-mode JSON output and return gate-result.json content.',
+    inputSchema: cwdSchema
+  },
+  {
+    name: 'viberaven_context_map',
+    description: 'Refresh .viberaven/context-map.json from the last scan.',
+    inputSchema: cwdSchema
+  },
+  {
+    name: 'viberaven_heal_plan',
+    description: 'Write a non-destructive VibeRaven heal plan for a target file or gap.',
+    inputSchema: healSchema
+  },
+  {
+    name: 'viberaven_heal_prompt',
+    description: 'Write an agent-ready VibeRaven heal prompt for a target file or gap.',
+    inputSchema: healSchema
+  },
+  {
+    name: 'viberaven_heal_apply',
+    description: 'Apply a guarded VibeRaven repo-code heal recipe when supported.',
+    inputSchema: healSchema
   }
 ];
 
-if (process.argv.includes('--help') || process.argv.includes('-h')) {
-  console.log(`${SERVER_INFO.name} ${SERVER_INFO.version}`);
-  console.log('MCP stdio server wrapping npx -y @viberaven/cli@beta.');
-  process.exit(0);
-}
-
 let buffer = Buffer.alloc(0);
 
-process.stdin.on('data', (chunk) => {
-  buffer = Buffer.concat([buffer, chunk]);
-  drainMessages();
-});
+function main() {
+  if (process.argv.includes('--help') || process.argv.includes('-h')) {
+    console.log(`${SERVER_INFO.name} ${SERVER_INFO.version}`);
+    console.log(`MCP stdio server wrapping npx -y ${CLI_PACKAGE}.`);
+    process.exit(0);
+  }
+
+  process.stdin.on('data', (chunk) => {
+    buffer = Buffer.concat([buffer, chunk]);
+    drainMessages();
+  });
+}
 
 function drainMessages() {
   while (true) {
@@ -146,41 +178,125 @@ async function handleRequest(method, params) {
     const name = params.name;
     const args = params.arguments || {};
     const text = await callTool(name, args);
-    return { content: [{ type: 'text', text }] };
+    const parsed = parseJsonObjectFromToolText(text);
+    return {
+      content: [{ type: 'text', text }],
+      ...(parsed ? { structuredContent: parsed } : {})
+    };
   }
 
   throw new Error(`Unsupported MCP method: ${method}`);
 }
 
 async function callTool(name, args) {
-  if (name === 'viberaven_scan') {
-    return runVibeRaven(['scan', ...(args.open ? ['--open'] : []), ...(args.path ? [String(args.path)] : [])], args.cwd);
+  return runVibeRaven(['-y', CLI_PACKAGE, ...buildToolArgs(name, args || {})], args && args.cwd);
+}
+
+function buildToolArgs(name, args) {
+  if (name === 'viberaven_check_readiness') {
+    return ['--agent-mode'];
+  }
+  if (name === 'viberaven_verify') {
+    return ['--verify'];
+  }
+  if (name === 'viberaven_audit') {
+    return ['audit', '--vercel-supabase', ...(args.json ? ['--json'] : [])];
+  }
+  if (name === 'viberaven_init_rules') {
+    const cliArgs = ['init'];
+    if (args.agents) cliArgs.push('--agents', safeStringArg(args.agents, 'agents'));
+    if (args.dryRun) cliArgs.push('--dry-run');
+    return cliArgs;
+  }
+  if (name === 'viberaven_clean_plan') {
+    return ['clean', '--plan'];
   }
-  if (name === 'viberaven_status') {
-    return runVibeRaven(['status', ...(args.json ? ['--json'] : [])], args.cwd);
+  if (name === 'viberaven_strict_gate') {
+    return ['--agent-mode', '--strict', '--json'];
   }
-  if (name === 'viberaven_next') {
-    return runVibeRaven(['next', '--json'], args.cwd);
+  if (name === 'viberaven_gate_result') {
+    return ['--agent-mode', '--json'];
   }
-  if (name === 'viberaven_prompt') {
-    const cliArgs = ['prompt'];
-    if (args.gap) cliArgs.push('--gap', String(args.gap));
-    if (args.area) cliArgs.push('--area', String(args.area));
-    if (args.provider) cliArgs.push('--provider', String(args.provider));
-    return runVibeRaven(cliArgs, args.cwd);
+  if (name === 'viberaven_context_map') {
+    return ['--condense'];
   }
-  if (name === 'viberaven_login') {
-    return runVibeRaven(['login'], args.cwd);
+  if (name === 'viberaven_heal_plan') {
+    return buildHealArgs(['--heal', '--plan'], args);
+  }
+  if (name === 'viberaven_heal_prompt') {
+    return buildHealArgs(['--heal', '--prompt'], args);
+  }
+  if (name === 'viberaven_heal_apply') {
+    const cliArgs = buildHealArgs(['--heal', '--apply'], args);
+    if (args.yes === true) cliArgs.push('--yes');
+    return cliArgs;
   }
   throw new Error(`Unknown VibeRaven tool: ${name}`);
 }
 
+function buildHealArgs(prefix, args) {
+  const cliArgs = [...prefix];
+  if (args.target) cliArgs.push('--target', safeStringArg(args.target, 'target'));
+  if (args.gap) cliArgs.push('--gap', safeStringArg(args.gap, 'gap'));
+  return cliArgs;
+}
+
+function safeStringArg(value, label) {
+  if (typeof value !== 'string') {
+    throw new Error(`Invalid ${label}: expected string`);
+  }
+
+  if (!value.trim()) {
+    throw new Error(`Invalid ${label}: expected non-empty string`);
+  }
+
+  if (/[&|<>^%!"\r\n]/.test(value)) {
+    throw new Error(`Unsafe characters in ${label}`);
+  }
+
+  return value;
+}
+
+function resolveCwd(cwd) {
+  if (cwd === undefined || cwd === null) {
+    return process.cwd();
+  }
+
+  if (typeof cwd !== 'string') {
+    throw new Error('Invalid cwd: expected string');
+  }
+
+  if (!cwd.trim()) {
+    throw new Error('Invalid cwd: expected non-empty string');
+  }
+
+  return cwd;
+}
+
+function buildNpxCommand(args) {
+  if (process.platform === 'win32') {
+    return {
+      command: 'cmd.exe',
+      args: ['/d', '/s', '/c', 'npx', ...args],
+      options: { shell: false }
+    };
+  }
+
+  return {
+    command: 'npx',
+    args,
+    options: { shell: false }
+  };
+}
+
 function runVibeRaven(args, cwd) {
   return new Promise((resolve) => {
-    const child = spawn('npx', ['-y', '@viberaven/cli@beta', ...args], {
-      cwd: typeof cwd === 'string' && cwd.trim() ? cwd : process.cwd(),
+    const built = buildNpxCommand(args);
+    const child = spawnChild(built.command, built.args, {
+      cwd: resolveCwd(cwd),
       env: process.env,
-      shell: process.platform === 'win32'
+      shell: built.options.shell,
+      stdio: ['ignore', 'pipe', 'pipe']
     });
     let stdout = '';
     let stderr = '';
@@ -195,12 +311,41 @@ function runVibeRaven(args, cwd) {
     });
     child.on('close', (code) => {
       const combined = `${stdout}${stderr}`.trim();
-      resolve(`exit ${code ?? 1}\n${combined}`);
+      resolve(`exit ${code ?? 1}${combined ? `\n${combined}` : ''}`);
     });
   });
 }
 
+function parseJsonObjectFromToolText(text) {
+  const jsonStart = text.indexOf('{');
+  if (jsonStart === -1) return undefined;
+  try {
+    return JSON.parse(text.slice(jsonStart));
+  } catch {
+    return undefined;
+  }
+}
+
 function send(message) {
   const body = JSON.stringify(message);
   process.stdout.write(`Content-Length: ${Buffer.byteLength(body, 'utf8')}\r\n\r\n${body}`);
 }
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  TOOLS,
+  buildNpxCommand,
+  callTool,
+  handleRequest,
+  parseJsonObjectFromToolText,
+  safeStringArg,
+  __setSpawnForTest(spawnForTest) {
+    spawnChild = spawnForTest;
+  },
+  __resetSpawnForTest() {
+    spawnChild = spawn;
+  }
+};

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@viberaven/mcp",
-  "version": "0.1.0-beta.1",
+  "version": "1.0.1",
   "description": "Thin MCP wrapper around the VibeRaven CLI for agent launch-readiness workflows.",
   "license": "UNLICENSED",
   "author": "VibeRaven",
+  "mcpName": "io.github.ohad6k/viberaven",
   "homepage": "https://viberaven.dev/mcp.md",
   "repository": {
     "type": "git",
@@ -24,7 +25,7 @@
   ],
   "publishConfig": {
     "access": "public",
-    "tag": "beta"
+    "tag": "latest"
   },
   "bin": {
     "viberaven-mcp": "bin/server.js"
@@ -37,6 +38,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "smoke": "node scripts/smoke.mjs"
+    "smoke": "node scripts/smoke.mjs",
+    "test": "vitest run"
   }
 }