@viberaven/mcp 1.0.2 → 1.0.5

package/README.md

@@ -1,59 +1,60 @@
-# @viberaven/mcp
-
-Thin MCP wrapper for VibeRaven.
-
-This package exposes VibeRaven CLI actions as MCP tools for Codex, Claude Code, Cursor, and other agent runtimes. It does not contain VibeRaven backend logic and does not bypass VibeRaven login or scan quotas.
-
-The MCP server wraps the stable CLI package: `npx -y viberaven`.
-
-## Run
-
-```bash
-npx -y @viberaven/mcp
-```
-
-You can also start the MCP server from the main CLI package:
-
-```bash
-npx -y viberaven mcp
-```
-
-## Tools
-
-- `viberaven_check_readiness` -> `npx -y viberaven --agent-mode`
-- `viberaven_verify` -> `npx -y viberaven --verify`
-- `viberaven_audit` -> `npx -y viberaven audit --vercel-supabase`
-- `viberaven_init_rules` -> `npx -y viberaven init`
-- `viberaven_clean_plan` -> `npx -y viberaven clean --plan`
-- `viberaven_strict_gate` -> `npx -y viberaven --agent-mode --strict --json`
-- `viberaven_gate_result` -> `npx -y viberaven --agent-mode --json`
-- `viberaven_context_map` -> `npx -y viberaven --condense`
-- `viberaven_heal_plan` -> `npx -y viberaven --heal --plan`
-- `viberaven_heal_prompt` -> `npx -y viberaven --heal --prompt`
-- `viberaven_heal_apply` -> `npx -y viberaven --heal --apply`
-
-`viberaven_check_readiness` is the canonical entrypoint. It runs VibeRaven as the Agent Context + Production Gate and writes `.viberaven/agent-tasklist.md`, `.viberaven/gate-result.json`, and `.viberaven/context-map.json`.
-
-After one fix, call `viberaven_verify`. Before deploy or CI pass, call `viberaven_strict_gate` or run:
-
-```bash
-npx -y viberaven --strict
-```
-
-## Machine Artifact Contract
-
-```text
-docs/contracts/artifacts.md
-https://viberaven.dev/schemas/gate-result.schema.json
-https://viberaven.dev/schemas/context-map.schema.json
-https://viberaven.dev/schemas/gap.schema.json
-https://viberaven.dev/schemas/heal-result.schema.json
-```
-
-## Login
-
-If VibeRaven prints `LOGIN_URL_READY`, open that exact URL for the user, keep the MCP call alive, and do not ask for passwords, tokens, cookies, or other secrets.
-
-## Security
-
-The MCP package is public integration glue only. It returns CLI stdout/stderr and structured JSON content when available. It does not mutate provider dashboards and does not bypass VibeRaven login, managed API checks, or quota enforcement. Do not claim provider dashboard checks are fixed by repo-code edits.
+# @viberaven/mcp
+
+Thin MCP wrapper for VibeRaven.
+
+This package exposes VibeRaven CLI actions as MCP tools for Codex, Claude Code, Cursor, and other agent runtimes. It does not contain VibeRaven backend logic and does not bypass VibeRaven login or scan quotas.
+
+The MCP server wraps the stable CLI package: `npx -y viberaven`.
+
+## Run
+
+```bash
+npx -y @viberaven/mcp
+```
+
+You can also start the MCP server from the main CLI package:
+
+```bash
+npx -y viberaven mcp
+```
+
+## Tools
+
+- `viberaven_check_readiness` -> `npx -y viberaven --agent-mode`
+- `viberaven_verify` -> `npx -y viberaven --verify`
+- `viberaven_audit` -> `npx -y viberaven audit --vercel-supabase`
+- `viberaven_init_rules` -> `npx -y viberaven init`
+- `viberaven_clean_plan` -> `npx -y viberaven clean --plan`
+- `viberaven_strict_gate` -> `npx -y viberaven --agent-mode --strict --json`
+- `viberaven_gate_result` -> `npx -y viberaven --agent-mode --json`
+- `viberaven_context_map` -> `npx -y viberaven --condense`
+- `viberaven_heal_plan` -> `npx -y viberaven --heal --plan`
+- `viberaven_heal_prompt` -> `npx -y viberaven --heal --prompt`
+- `viberaven_heal_apply` -> `npx -y viberaven --heal --apply`
+
+`viberaven_check_readiness` is the canonical entrypoint. It runs VibeRaven as the Agent Context + Production Gate and writes `.viberaven/agent-tasklist.md`, `.viberaven/gate-result.json`, and `.viberaven/context-map.json`.
+
+After one fix, call `viberaven_verify`. Before deploy or CI pass, call `viberaven_strict_gate` or run:
+
+```bash
+npx -y viberaven --strict
+```
+
+## Machine Artifact Contract
+
+```text
+docs/contracts/artifacts.md
+https://viberaven.dev/schemas/gate-result.schema.json
+https://viberaven.dev/schemas/context-map.schema.json
+https://viberaven.dev/schemas/gap.schema.json
+https://viberaven.dev/schemas/heal-result.schema.json
+```
+
+## Login
+
+If VibeRaven prints `LOGIN_URL_READY`, open that exact URL for the user, keep the MCP call alive, and do not ask for passwords, tokens, cookies, or other secrets.
+
+## Security
+
+The MCP package is public integration glue only. It returns CLI stdout/stderr and structured JSON content when available. It does not mutate provider dashboards and does not bypass VibeRaven login, managed API checks, or quota enforcement. Do not claim provider dashboard checks are fixed by repo-code edits.
+

package/bin/server.js

@@ -2,7 +2,7 @@
 const { spawn } = require('node:child_process');
 let spawnChild = spawn;
 
-const SERVER_INFO = { name: 'viberaven-mcp', version: '1.0.0' };
+const SERVER_INFO = { name: 'viberaven-mcp', version: '1.0.4' };
 const CLI_PACKAGE = '@viberaven/cli';
 
 const cwdSchema = {
@@ -94,6 +94,23 @@ const TOOLS = [
     name: 'viberaven_heal_apply',
     description: 'Apply a guarded VibeRaven repo-code heal recipe when supported.',
     inputSchema: healSchema
+  },
+  {
+    name: 'viberaven_validate_npm_package',
+    description:
+      'Check whether an npm package name exists and looks safe before install. Always run viberaven --agent-mode after adding dependencies.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        packageName: { type: 'string', description: 'Single npm package name to validate.' },
+        packageNames: {
+          type: 'array',
+          items: { type: 'string' },
+          description: 'Multiple npm package names to validate in one call.'
+        }
+      },
+      additionalProperties: false
+    }
   }
 ];
 
@@ -231,6 +248,21 @@ function buildToolArgs(name, args) {
     if (args.yes === true) cliArgs.push('--yes');
     return cliArgs;
   }
+  if (name === 'viberaven_validate_npm_package') {
+    const names = [];
+    if (args.packageName) {
+      names.push(safeStringArg(args.packageName, 'packageName'));
+    }
+    if (Array.isArray(args.packageNames)) {
+      for (const entry of args.packageNames) {
+        names.push(safeStringArg(entry, 'packageName'));
+      }
+    }
+    if (names.length === 0) {
+      throw new Error('packageName or packageNames is required');
+    }
+    return ['validate-npm-package', '--json', ...names];
+  }
   throw new Error(`Unknown VibeRaven tool: ${name}`);
 }
 

package/package.json

@@ -1,44 +1,44 @@
-{
-  "name": "@viberaven/mcp",
-  "version": "1.0.2",
-  "description": "Thin MCP wrapper around the VibeRaven CLI for agent launch-readiness workflows.",
-  "license": "UNLICENSED",
-  "author": "VibeRaven",
-  "mcpName": "io.github.ohad6k/viberaven",
-  "homepage": "https://viberaven.dev/mcp.md",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ohad6k/VibeRaven.git",
-    "directory": "packages/mcp"
-  },
-  "bugs": {
-    "url": "https://github.com/ohad6k/VibeRaven/issues"
-  },
-  "keywords": [
-    "viberaven",
-    "mcp",
-    "claude-code",
-    "codex",
-    "cursor",
-    "launch-readiness",
-    "production"
-  ],
-  "publishConfig": {
-    "access": "public",
-    "tag": "latest"
-  },
-  "bin": {
-    "viberaven-mcp": "bin/server.js"
-  },
-  "files": [
-    "bin",
-    "README.md"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "scripts": {
-    "smoke": "node scripts/smoke.mjs",
-    "test": "vitest run"
-  }
-}
+{
+  "name": "@viberaven/mcp",
+  "version": "1.0.5",
+  "description": "Thin MCP wrapper around the VibeRaven CLI for agent launch-readiness workflows.",
+  "license": "UNLICENSED",
+  "author": "VibeRaven",
+  "mcpName": "io.github.ohad6k/viberaven",
+  "homepage": "https://viberaven.dev/mcp.md",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ohad6k/VibeRaven.git",
+    "directory": "packages/mcp"
+  },
+  "bugs": {
+    "url": "https://github.com/ohad6k/VibeRaven/issues"
+  },
+  "keywords": [
+    "viberaven",
+    "mcp",
+    "claude-code",
+    "codex",
+    "cursor",
+    "launch-readiness",
+    "production"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "bin": {
+    "viberaven-mcp": "bin/server.js"
+  },
+  "files": [
+    "bin",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "smoke": "node scripts/smoke.mjs",
+    "test": "vitest run"
+  }
+}