@viberqc/mcp-server 0.1.0

package/dist/security/redaction.js

@@ -0,0 +1,63 @@
+const SENSITIVE_KEY = /^(?:absolutePath|authorization|cookie|password|privateKey|secret|sourceCode|token)$/i;
+const WINDOWS_ABSOLUTE_PATH = /(?:^|[\s"'(])[a-zA-Z]:[\\/][^\s"']+/;
+const WINDOWS_ABSOLUTE_PATH_GLOBAL = /(?:^|[\s"'(])[a-zA-Z]:[\\/][^\s"']+/g;
+const POSIX_ABSOLUTE_PATH = /(?:^|[\s"'(])\/(?!\/)[^\s"']+/;
+const POSIX_ABSOLUTE_PATH_GLOBAL = /(?:^|[\s"'(])\/(?!\/)[^\s"']+/g;
+const PROJECT_TOKEN = /\bvqc_pt_[A-Za-z0-9_-]+\b/g;
+const BEARER_TOKEN = /\bBearer\s+[A-Za-z0-9._~+/-]+=*\b/gi;
+const PRIVATE_KEY_BLOCK = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
+const SECRET_ASSIGNMENT = /\b(?:api[_-]?key|client[_-]?secret|password|token)\s*[:=]\s*[^\s,;]+/gi;
+export class ExternalPayloadRejectedError extends Error {
+    code = 'EXTERNAL_PAYLOAD_REJECTED';
+    constructor() {
+        super('The external payload contains local or sensitive data.');
+        this.name = 'ExternalPayloadRejectedError';
+    }
+}
+function stringContainsLocalOrSensitiveData(value) {
+    return (WINDOWS_ABSOLUTE_PATH.test(value) ||
+        POSIX_ABSOLUTE_PATH.test(value) ||
+        /\bvqc_pt_[A-Za-z0-9_-]+\b/.test(value) ||
+        /\bBearer\s+[A-Za-z0-9._~+/-]+=*\b/i.test(value) ||
+        /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/.test(value) ||
+        /\b(?:api[_-]?key|client[_-]?secret|password|token)\s*[:=]\s*[^\s,;]+/i.test(value));
+}
+function inspectExternalValue(value, seen) {
+    if (typeof value === 'string') {
+        if (stringContainsLocalOrSensitiveData(value)) {
+            throw new ExternalPayloadRejectedError();
+        }
+        return;
+    }
+    if (value === null || typeof value !== 'object') {
+        return;
+    }
+    if (seen.has(value)) {
+        throw new ExternalPayloadRejectedError();
+    }
+    seen.add(value);
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            inspectExternalValue(item, seen);
+        }
+        return;
+    }
+    for (const [key, item] of Object.entries(value)) {
+        if (SENSITIVE_KEY.test(key)) {
+            throw new ExternalPayloadRejectedError();
+        }
+        inspectExternalValue(item, seen);
+    }
+}
+export function assertExternalPayloadSafe(value) {
+    inspectExternalValue(value, new Set());
+}
+export function redactSensitiveText(value) {
+    return value
+        .replace(PRIVATE_KEY_BLOCK, '[REDACTED_PRIVATE_KEY]')
+        .replace(BEARER_TOKEN, 'Bearer [REDACTED]')
+        .replace(PROJECT_TOKEN, '[REDACTED_PROJECT_TOKEN]')
+        .replace(SECRET_ASSIGNMENT, '[REDACTED_SECRET]')
+        .replace(WINDOWS_ABSOLUTE_PATH_GLOBAL, ' [REDACTED_LOCAL_PATH]')
+        .replace(POSIX_ABSOLUTE_PATH_GLOBAL, ' [REDACTED_LOCAL_PATH]');
+}

package/dist/tools/register.js

@@ -0,0 +1,100 @@
+import { getSessionInputSchema, getSessionOutputSchema, inspectRepoInputSchema, inspectRepoOutputSchema, listProfilesInputSchema, listProfilesOutputSchema, prepareScanInputSchema, prepareScanOutputSchema, statusInputSchema, statusOutputSchema, } from '../contracts/tools.js';
+import { redactSensitiveText } from '../security/redaction.js';
+import { inspectRepository, repositoryContext } from './repository-inspection.js';
+const LOCAL_READ_ONLY = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false,
+};
+const NETWORK_READ_ONLY = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true,
+};
+function success(value) {
+    return {
+        content: [{ type: 'text', text: JSON.stringify(value) }],
+        structuredContent: value,
+    };
+}
+function failure(error) {
+    const record = typeof error === 'object' && error !== null
+        ? error
+        : {};
+    const code = typeof record.code === 'string' &&
+        /^[A-Z][A-Z0-9_]{2,63}$/.test(record.code)
+        ? record.code
+        : 'MCP_REQUEST_FAILED';
+    const rawMessage = typeof record.code === 'string' && typeof record.message === 'string'
+        ? record.message
+        : 'The ViberQC request could not be completed.';
+    const message = redactSensitiveText(rawMessage).slice(0, 500);
+    return {
+        content: [{ type: 'text', text: JSON.stringify({ code, message }) }],
+        isError: true,
+    };
+}
+async function run(operation) {
+    try {
+        return success(await operation());
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+export function registerP2Tools(server, dependencies) {
+    server.registerTool('viberqc_status', {
+        title: 'ViberQC status',
+        description: 'Check the MCP version, account, plan, Project, Repository, and allowed actions.',
+        inputSchema: statusInputSchema,
+        outputSchema: statusOutputSchema,
+        annotations: NETWORK_READ_ONLY,
+    }, async () => run(async () => {
+        const context = await repositoryContext(await dependencies.rootSources(), 'changed');
+        return dependencies.api.status(context);
+    }));
+    server.registerTool('viberqc_list_profiles', {
+        title: 'List ViberQC scan profiles',
+        description: 'List profiles and classify supported, unsupported, and manual item IDs.',
+        inputSchema: listProfilesInputSchema,
+        outputSchema: listProfilesOutputSchema,
+        annotations: NETWORK_READ_ONLY,
+    }, async (input) => run(() => dependencies.api.listProfiles(listProfilesInputSchema.parse(input))));
+    server.registerTool('viberqc_inspect_repo', {
+        title: 'Inspect the current repository',
+        description: 'Read local Git metadata, detected tools, and file counts without producing pass or fail findings.',
+        inputSchema: inspectRepoInputSchema,
+        outputSchema: inspectRepoOutputSchema,
+        annotations: LOCAL_READ_ONLY,
+    }, async (input) => run(async () => {
+        const parsed = inspectRepoInputSchema.parse(input);
+        return inspectRepository(await dependencies.rootSources(), parsed.scope);
+    }));
+    server.registerTool('viberqc_prepare_scan', {
+        title: 'Prepare a ViberQC scan session',
+        description: 'Create a scan session from safe Repository metadata without uploading Source Code.',
+        inputSchema: prepareScanInputSchema,
+        outputSchema: prepareScanOutputSchema,
+        annotations: NETWORK_READ_ONLY,
+    }, async (input) => run(async () => {
+        const parsed = prepareScanInputSchema.parse(input);
+        const repository = await repositoryContext(await dependencies.rootSources(), parsed.scope);
+        return dependencies.api.prepareScan({
+            ...parsed,
+            repository,
+            sourceUpload: false,
+        });
+    }));
+    server.registerTool('viberqc_get_session', {
+        title: 'Get a ViberQC scan session',
+        description: 'Read a prepared scan session and its evidence summary without changing files.',
+        inputSchema: getSessionInputSchema,
+        outputSchema: getSessionOutputSchema,
+        annotations: NETWORK_READ_ONLY,
+    }, async (input) => run(() => {
+        const parsed = getSessionInputSchema.parse(input);
+        return dependencies.api.getSession(parsed.sessionId);
+    }));
+}

package/dist/tools/repository-inspection.js

@@ -0,0 +1,223 @@
+import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
+import { promisify } from 'node:util';
+import { buildExternalRepositorySummary, buildRepositoryInventory, } from '../repository/inventory.js';
+import { RepositoryIdentityError, resolveRepositoryIdentity, } from '../repository/identity.js';
+import { validateRepositoryFile, validateRepositoryRoot, } from '../security/path-policy.js';
+import { assertExternalPayloadSafe } from '../security/redaction.js';
+const execFileAsync = promisify(execFile);
+const MANIFEST_LIMIT_BYTES = 1024 * 1024;
+async function git(root, args) {
+    const result = await execFileAsync('git', ['-C', root.absolutePath, ...args], {
+        encoding: 'utf8',
+        maxBuffer: 20 * 1024 * 1024,
+    });
+    return result.stdout;
+}
+async function readGitState(root) {
+    const [branchText, commitText, statusText] = await Promise.all([
+        git(root, ['branch', '--show-current']),
+        git(root, ['rev-parse', 'HEAD']),
+        git(root, ['status', '--porcelain=v1', '-z', '--untracked-files=all']),
+    ]);
+    const dirtyStatus = { staged: 0, unstaged: 0, untracked: 0 };
+    const records = statusText.split('\0').filter(Boolean);
+    for (let index = 0; index < records.length; index += 1) {
+        const record = records[index] ?? '';
+        const x = record[0] ?? ' ';
+        const y = record[1] ?? ' ';
+        if (x === '?' && y === '?') {
+            dirtyStatus.untracked += 1;
+            continue;
+        }
+        if (x !== ' ') {
+            dirtyStatus.staged += 1;
+        }
+        if (y !== ' ') {
+            dirtyStatus.unstaged += 1;
+        }
+        if (x === 'R' || x === 'C') {
+            index += 1;
+        }
+    }
+    return {
+        branch: branchText.trim() || 'detached',
+        commitSha: commitText.trim(),
+        dirtyStatus,
+    };
+}
+async function trackedPaths(root) {
+    return (await git(root, ['ls-files', '-z']))
+        .split('\0')
+        .filter((entry) => entry.length > 0);
+}
+function detectLanguages(paths) {
+    const extensions = new Map([
+        ['.c', 'c'],
+        ['.cpp', 'cpp'],
+        ['.cs', 'csharp'],
+        ['.go', 'go'],
+        ['.java', 'java'],
+        ['.js', 'javascript'],
+        ['.jsx', 'javascript'],
+        ['.kt', 'kotlin'],
+        ['.php', 'php'],
+        ['.py', 'python'],
+        ['.rb', 'ruby'],
+        ['.rs', 'rust'],
+        ['.swift', 'swift'],
+        ['.ts', 'typescript'],
+        ['.tsx', 'typescript'],
+    ]);
+    const detected = new Set();
+    for (const filePath of paths) {
+        const dot = filePath.lastIndexOf('.');
+        const extension = dot >= 0 ? filePath.slice(dot).toLowerCase() : '';
+        const language = extensions.get(extension);
+        if (language) {
+            detected.add(language);
+        }
+    }
+    return [...detected].sort();
+}
+function detectFrameworks(paths) {
+    const names = new Set(paths.map((value) => value.toLowerCase()));
+    const frameworks = new Set();
+    if ([...names].some((name) => /(^|\/)next\.config\.[^/]+$/.test(name))) {
+        frameworks.add('nextjs');
+    }
+    if (names.has('angular.json')) {
+        frameworks.add('angular');
+    }
+    if ([...names].some((name) => /(^|\/)(nuxt|svelte|vite)\.config\.[^/]+$/.test(name))) {
+        if ([...names].some((name) => /(^|\/)nuxt\.config\.[^/]+$/.test(name))) {
+            frameworks.add('nuxt');
+        }
+        if ([...names].some((name) => /(^|\/)svelte\.config\.[^/]+$/.test(name))) {
+            frameworks.add('svelte');
+        }
+        if ([...names].some((name) => /(^|\/)vite\.config\.[^/]+$/.test(name))) {
+            frameworks.add('vite');
+        }
+    }
+    return [...frameworks].sort();
+}
+function detectPackageManagers(paths) {
+    const names = new Set(paths.map((value) => value.toLowerCase()));
+    const managers = [];
+    if (names.has('pnpm-lock.yaml'))
+        managers.push('pnpm');
+    if (names.has('yarn.lock'))
+        managers.push('yarn');
+    if (names.has('bun.lock') || names.has('bun.lockb'))
+        managers.push('bun');
+    if (names.has('package-lock.json'))
+        managers.push('npm');
+    if (names.has('poetry.lock'))
+        managers.push('poetry');
+    if (names.has('uv.lock'))
+        managers.push('uv');
+    if (names.has('cargo.lock'))
+        managers.push('cargo');
+    if (names.has('go.sum'))
+        managers.push('go');
+    return managers;
+}
+async function detectTestCommands(root, paths, packageManagers) {
+    if (!paths.includes('package.json')) {
+        return [];
+    }
+    try {
+        const manifest = await validateRepositoryFile(root, 'package.json');
+        const raw = await readFile(manifest.absolutePath, 'utf8');
+        if (Buffer.byteLength(raw, 'utf8') > MANIFEST_LIMIT_BYTES) {
+            return [];
+        }
+        const parsed = JSON.parse(raw);
+        const scriptNames = Object.keys(parsed.scripts ?? {});
+        const allowed = [
+            'test',
+            'lint',
+            'build',
+            'typecheck',
+            'scan:inventory',
+            'typecheck:service-scan',
+        ].filter((name) => scriptNames.includes(name));
+        const manager = packageManagers[0] ?? 'npm';
+        return allowed.map((name) => {
+            if (manager === 'pnpm')
+                return `pnpm ${name}`;
+            if (manager === 'yarn')
+                return `yarn ${name}`;
+            if (manager === 'bun')
+                return `bun run ${name}`;
+            return name === 'test' ? 'npm test' : `npm run ${name}`;
+        });
+    }
+    catch {
+        return [];
+    }
+}
+async function repositoryFingerprint(root) {
+    let material;
+    try {
+        const identity = await resolveRepositoryIdentity(root);
+        material = `${identity.kind}:${identity.value}`;
+    }
+    catch (error) {
+        if (!(error instanceof RepositoryIdentityError) ||
+            error.code !== 'LOCAL_ID_REQUIRED') {
+            throw error;
+        }
+        const firstCommit = (await git(root, [
+            'rev-list',
+            '--max-parents=0',
+            '--reverse',
+            'HEAD',
+        ]))
+            .split('\n')
+            .find(Boolean);
+        if (!firstCommit) {
+            throw error;
+        }
+        material = `local-history:${firstCommit}`;
+    }
+    return createHash('sha256').update(material).digest('hex');
+}
+export async function inspectRepository(sources, scope) {
+    const root = await validateRepositoryRoot(sources);
+    const [gitState, inventory, paths, fingerprint] = await Promise.all([
+        readGitState(root),
+        buildRepositoryInventory(root, { scope }),
+        trackedPaths(root),
+        repositoryFingerprint(root),
+    ]);
+    const summary = buildExternalRepositorySummary(inventory);
+    const packageManagers = detectPackageManagers(paths);
+    const output = {
+        ...gitState,
+        techStack: {
+            languages: detectLanguages(paths),
+            frameworks: detectFrameworks(paths),
+            packageManagers,
+            testCommands: await detectTestCommands(root, paths, packageManagers),
+        },
+        scope: summary.scope,
+        fileCount: summary.fileCount,
+        skippedCount: summary.skippedCount,
+        skipReasons: summary.skipReasons,
+        repoFingerprint: fingerprint,
+    };
+    assertExternalPayloadSafe(output);
+    return output;
+}
+export async function repositoryContext(sources, scope) {
+    const inspected = await inspectRepository(sources, scope);
+    return {
+        repositoryFingerprint: inspected.repoFingerprint,
+        branch: inspected.branch,
+        commitSha: inspected.commitSha,
+        scope: inspected.scope,
+    };
+}

package/dist/tools/server.js

@@ -0,0 +1,43 @@
+import { fileURLToPath } from 'node:url';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { MCP_PACKAGE_VERSION, MCP_SERVER_NAME, } from '../contracts/tools.js';
+import { HttpViberQcApi } from '../client/api.js';
+import { registerP2Tools } from './register.js';
+function fileRoots(roots) {
+    const paths = [];
+    for (const root of roots) {
+        try {
+            const parsed = new URL(root.uri);
+            if (parsed.protocol === 'file:') {
+                paths.push(fileURLToPath(parsed));
+            }
+        }
+        catch {
+            // An invalid or non-file root is not trusted.
+        }
+    }
+    return paths;
+}
+export function createViberQcServer(options = {}) {
+    const server = new McpServer({
+        name: MCP_SERVER_NAME,
+        version: MCP_PACKAGE_VERSION,
+    });
+    const rootSources = options.rootSources ??
+        (async () => {
+            let mcpRoots = [];
+            if (server.server.getClientCapabilities()?.roots) {
+                const result = await server.server.listRoots();
+                mcpRoots = fileRoots(result.roots);
+            }
+            return {
+                mcpRoots,
+                configuredRoot: process.env.VIBERQC_REPO_ROOT,
+            };
+        });
+    registerP2Tools(server, {
+        api: options.api ?? new HttpViberQcApi(),
+        rootSources,
+    });
+    return server;
+}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@viberqc/mcp-server",
+  "version": "0.1.0",
+  "description": "Read-only ViberQC MCP server for repository inspection and scan-session preparation",
+  "license": "Apache-2.0",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "code-quality",
+    "ai-generated-code",
+    "viberqc"
+  ],
+  "homepage": "https://www.viberqc.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.dev.jigsawgroups.work/newbiz-lab/products/ViberQC.git",
+    "directory": "packages/viberqc-mcp"
+  },
+  "bugs": {
+    "url": "https://gitlab.dev.jigsawgroups.work/newbiz-lab/products/ViberQC/-/issues"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/",
+    "tag": "next"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22.14.0"
+  },
+  "bin": {
+    "viberqc-mcp-server": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "clean": "node --input-type=module -e \"import { rmSync } from 'node:fs'; rmSync('dist', { recursive: true, force: true })\"",
+    "build": "npm run clean && tsc",
+    "test": "npm run build && vitest run",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "zod": "4.4.3"
+  },
+  "devDependencies": {
+    "@emnapi/core": "1.11.3",
+    "@emnapi/runtime": "1.11.3",
+    "@types/node": "22.20.0",
+    "typescript": "5.9.3",
+    "vitest": "4.1.10"
+  },
+  "overrides": {
+    "@hono/node-server": "2.0.12",
+    "fast-uri": "3.1.4"
+  }
+}