@vulnify/cli 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,45 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @vulnify/cli
+
+## Audit the AI agents on your machine
+
+```bash
+npx @vulnify/cli audit                     # this machine + the current project
+npx @vulnify/cli audit --json              # machine-readable
+npx @vulnify/cli audit --fail-on high      # exit 1 in CI if anything is high or critical
+npx @vulnify/cli audit --dir path/to/repo  # check another project folder
+```
+
+Local and read-only: it reads agent config files, never changes them, never starts an MCP server and makes no network calls. Secrets are always masked (first 4 characters + `***`), in text and in `--json`.
+
+It checks Claude Code (`~/.claude/settings.json`, `.claude/settings*.json`, `~/.claude.json`, `.mcp.json`, `CLAUDE.md`, managed settings), Cursor (`~/.cursor/mcp.json`, `.cursor/mcp.json`, `~/.cursor/cli-config.json`, `.cursorrules`, `.cursor/rules/`), Codex (`~/.codex/config.toml`, `AGENTS.md`), Claude Desktop (`claude_desktop_config.json` on macOS, Windows and Linux) and VS Code / Copilot (`.vscode/mcp.json`, user `mcp.json`, `~/.copilot/mcp-config.json`, `.github/copilot-instructions.md`). `CLAUDE_CONFIG_DIR`, `CODEX_HOME` and `COPILOT_HOME` are honored.
+
+| Rule | Severity |
+| --- | --- |
+| Approvals bypassed (`bypassPermissions`, Codex `danger-full-access`) or `Bash(*)` / wildcard allow | critical |
+| Destructive command pre-approved (`rm`, `curl \| sh`, `git push --force`, `chmod`, `sudo`) | high |
+| Plaintext secret in MCP `env`, `headers`, `args` or URL | high |
+| Token (AWS, GitHub, OpenAI, Anthropic, Slack, Stripe, ...) in an agent config file | high |
+| MCP server exposing shell / command execution | high |
+| Filesystem MCP server with `/` or home access | high |
+| Prompt injection in instruction files: "ignore the rules", "don't tell the user", exfiltration URLs, invisible Unicode, hidden HTML comments | high |
+| Remote HTTP MCP server with no auth | medium |
+| No Claude Code deny rules for `.env`, `~/.ssh`, `~/.aws` | medium |
+| `.env` in the project | medium |
+| Agent config with secrets readable by other users (POSIX) | medium |
+| `npx` / `uvx` MCP server with no pinned version | low |
+
+Each finding shows severity, `file:line`, why it matters and how to fix it, followed by a score out of 100.
+
+## Install the Vulnify hook into Claude Code
+
+```bash
+npx @vulnify/cli hook claude-code            # this project (.claude/)
+npx @vulnify/cli hook claude-code --user     # every project (~/.claude/)
+npx @vulnify/cli hook claude-code --uninstall [--user]
+```
+
+The API key comes from `VULNIFY_API_KEY`, or a hidden prompt. It is never printed. A prompted key is saved in `.claude/settings.local.json` (git-ignored, mode 600) for a project, or in `~/.claude/settings.json` with `--user`.
+
+Before each shell command, file write, web fetch or MCP tool call, Claude Code asks Vulnify. ALLOW runs, REVIEW waits for a person, BLOCK stops it, and if Vulnify can't be reached the call is held.
+
+Docs: https://docs.vulnify.io/mcp/audit/ · https://docs.vulnify.io/mcp/claude-code-hook/

package/bin/vulnify-cli.mjs

@@ -0,0 +1,234 @@
+#!/usr/bin/env node
+/**
+ * npx @vulnify/cli hook claude-code [--user] [--uninstall] [--yes]
+ * npx @vulnify/cli audit [--json] [--fail-on <severity>] [--dir <path>]
+ *
+ * Installs the fail-closed Vulnify PreToolUse hook into Claude Code settings.
+ * The API key comes from VULNIFY_API_KEY or a hidden prompt, and is never printed.
+ */
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, appendFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createInterface } from 'node:readline';
+import { audit, format, shouldFail, SEVERITIES, CTA } from '../lib/audit.mjs';
+
+const HOOK_FILE = 'vulnify-hook.mjs';
+const MATCHER = 'Bash|PowerShell|Write|Edit|MultiEdit|NotebookEdit|WebFetch|mcp__.*';
+const DOCS = 'https://docs.vulnify.io/mcp/claude-code-hook/';
+const here = dirname(fileURLToPath(import.meta.url));
+
+export function paths({ user = false, cwd = process.cwd(), home = homedir() } = {}) {
+  const base = user ? join(home, '.claude') : join(resolve(cwd), '.claude');
+  return {
+    base,
+    hook: join(base, 'hooks', HOOK_FILE),
+    settings: join(base, 'settings.json'),
+    // Project scope keeps the key out of the committed settings.json.
+    keyFile: user ? join(base, 'settings.json') : join(base, 'settings.local.json'),
+    hookArg: user ? join(base, 'hooks', HOOK_FILE) : `\${CLAUDE_PROJECT_DIR}/.claude/hooks/${HOOK_FILE}`,
+  };
+}
+
+function readJson(file) {
+  if (!existsSync(file)) return {};
+  const raw = readFileSync(file, 'utf8').trim();
+  if (!raw) return {};
+  try {
+    const v = JSON.parse(raw);
+    if (v && typeof v === 'object' && !Array.isArray(v)) return v;
+  } catch {
+    /* fall through */
+  }
+  throw new Error(`${file} is not valid JSON. Fix it first; nothing was changed.`);
+}
+
+function writeJson(file, value, secret = false) {
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`, secret ? { mode: 0o600 } : undefined);
+  if (secret) chmodSync(file, 0o600);
+}
+
+const isVulnify = (h) => typeof h === 'object' && h && [h.command, ...(Array.isArray(h.args) ? h.args : [])].some((x) => typeof x === 'string' && x.includes(HOOK_FILE));
+
+/** Remove every Vulnify hook entry from settings.hooks.PreToolUse. Returns true when something changed. */
+export function removeHook(settings) {
+  const list = settings.hooks?.PreToolUse;
+  if (!Array.isArray(list)) return false;
+  let changed = false;
+  const next = [];
+  for (const group of list) {
+    const hooks = Array.isArray(group?.hooks) ? group.hooks : [];
+    const kept = hooks.filter((h) => !isVulnify(h));
+    if (kept.length !== hooks.length) changed = true;
+    if (kept.length) next.push({ ...group, hooks: kept });
+    else if (!hooks.length) next.push(group);
+  }
+  if (!changed) return false;
+  if (next.length) settings.hooks.PreToolUse = next;
+  else delete settings.hooks.PreToolUse;
+  if (!Object.keys(settings.hooks).length) delete settings.hooks;
+  return true;
+}
+
+export function addHook(settings, hookArg) {
+  removeHook(settings);
+  settings.hooks ??= {};
+  settings.hooks.PreToolUse ??= [];
+  settings.hooks.PreToolUse.push({
+    matcher: MATCHER,
+    hooks: [{ type: 'command', command: 'node', args: [hookArg], timeout: 30, onFailure: 'block' }],
+  });
+  return settings;
+}
+
+function ask(question, { hidden = false } = {}) {
+  return new Promise((done) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    if (hidden) {
+      // Echo nothing while the key is typed.
+      rl._writeToOutput = (s) => {
+        if (s.startsWith(question)) process.stdout.write(question);
+      };
+    }
+    rl.question(question, (answer) => {
+      rl.close();
+      if (hidden) process.stdout.write('\n');
+      done(answer.trim());
+    });
+  });
+}
+
+function ensureGitignored(cwd, entry) {
+  if (!existsSync(join(cwd, '.git'))) return;
+  const file = join(cwd, '.gitignore');
+  const body = existsSync(file) ? readFileSync(file, 'utf8') : '';
+  if (body.split(/\r?\n/).some((l) => l.trim() === entry)) return;
+  appendFileSync(file, `${body && !body.endsWith('\n') ? '\n' : ''}${entry}\n`);
+}
+
+export async function install({ user, yes, cwd = process.cwd(), home = homedir(), env = process.env, prompt = ask, log = console.log, interactive = !!process.stdin.isTTY }) {
+  const p = paths({ user, cwd, home });
+  const settings = readJson(p.settings);
+  const keySettings = p.keyFile === p.settings ? settings : readJson(p.keyFile);
+
+  let key = '';
+  let saveKey = false;
+  if (env.VULNIFY_API_KEY) {
+    log('Using VULNIFY_API_KEY from your environment (not saved; keep it exported where you start Claude Code).');
+  } else if (keySettings.env?.VULNIFY_API_KEY) {
+    log(`Keeping the API key already saved in ${p.keyFile}.`);
+  } else if (yes || !interactive) {
+    throw new Error('No API key. Export VULNIFY_API_KEY (a TEST key from app.vulnify.io/api-keys works) and run again.');
+  } else {
+    key = await prompt('Vulnify API key (input hidden, from app.vulnify.io/api-keys): ', { hidden: true });
+    if (!key) throw new Error('No API key entered; nothing was changed.');
+    if (!/^vln_/.test(key)) log('Note: Vulnify keys usually start with vln_. Saving it anyway.');
+    saveKey = true;
+  }
+
+  mkdirSync(dirname(p.hook), { recursive: true });
+  copyFileSync(join(here, '..', 'hook', HOOK_FILE), p.hook);
+  addHook(settings, p.hookArg);
+  if (saveKey) {
+    keySettings.env = { ...(keySettings.env || {}), VULNIFY_API_KEY: key };
+  }
+  writeJson(p.settings, settings, p.keyFile === p.settings && saveKey);
+  if (saveKey && p.keyFile !== p.settings) {
+    writeJson(p.keyFile, keySettings, true);
+    ensureGitignored(cwd, '.claude/settings.local.json');
+  }
+  log(`Installed the Vulnify hook (${user ? 'user' : 'project'} scope):`);
+  log(`  hook      ${p.hook}`);
+  log(`  settings  ${p.settings}`);
+  if (saveKey) log(`  API key   saved in ${p.keyFile} (file mode 600${p.keyFile !== p.settings ? ', git-ignored' : ''})`);
+  log('Fail closed: if Vulnify cannot be reached, checked tool calls are held. Restart Claude Code, then run /hooks to confirm.');
+  log(`Docs: ${DOCS}`);
+}
+
+export function uninstall({ user, cwd = process.cwd(), home = homedir(), log = console.log }) {
+  const p = paths({ user, cwd, home });
+  const settings = readJson(p.settings);
+  const removed = removeHook(settings);
+  let keyRemoved = false;
+  const keySettings = p.keyFile === p.settings ? settings : readJson(p.keyFile);
+  if (keySettings.env?.VULNIFY_API_KEY) {
+    delete keySettings.env.VULNIFY_API_KEY;
+    if (!Object.keys(keySettings.env).length) delete keySettings.env;
+    keyRemoved = true;
+  }
+  if (removed || (keyRemoved && p.keyFile === p.settings)) writeJson(p.settings, settings);
+  if (keyRemoved && p.keyFile !== p.settings) writeJson(p.keyFile, keySettings, true);
+  const hadFile = existsSync(p.hook);
+  if (hadFile) rmSync(p.hook);
+  log(removed || hadFile || keyRemoved ? `Removed the Vulnify hook (${user ? 'user' : 'project'} scope)${keyRemoved ? ' and the saved API key' : ''}.` : 'No Vulnify hook found here.');
+}
+
+const AUDIT_HELP = `Usage: npx @vulnify/cli audit [options]
+
+Read-only audit of the AI agents on this machine and in this project
+(Claude Code, Cursor, Codex, Claude Desktop, VS Code). No network calls;
+secrets are always masked.
+
+Options:
+  --json                 machine-readable output
+  --fail-on <severity>   exit 1 if any finding is at or above: ${SEVERITIES.join(', ')}
+  --dir <path>           project folder to check (default: current folder)
+  -h, --help             show this help`;
+
+export function runAudit(argv, { log = console.log, err = console.error, home, cwd = process.cwd(), env = process.env, platform = process.platform, color = !!process.stdout.isTTY && !env.NO_COLOR } = {}) {
+  let json = false, failOn = null, dir = cwd;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '-h' || a === '--help') { log(AUDIT_HELP); return 0; }
+    else if (a === '--json') json = true;
+    else if (a === '--fail-on' || a.startsWith('--fail-on=')) failOn = (a.includes('=') ? a.split('=')[1] : argv[++i] || '').toLowerCase();
+    else if (a === '--dir' || a.startsWith('--dir=')) dir = resolve(cwd, a.includes('=') ? a.split('=')[1] : argv[++i] || '.');
+    else { err(`Unknown option: ${a}\n\n${AUDIT_HELP}`); return 2; }
+  }
+  if (failOn !== null && !SEVERITIES.includes(failOn)) { err(`--fail-on must be one of: ${SEVERITIES.join(', ')}`); return 2; }
+  const h = home || homedir();
+  const result = audit({ home: h, cwd: dir, env, platform });
+  if (json) log(JSON.stringify({ ...result, cta: CTA }, null, 2));
+  else log(format(result, { home: h, cwd: dir, color }));
+  return shouldFail(result, failOn) ? 1 : 0;
+}
+
+const HELP = `Usage: npx @vulnify/cli hook claude-code [options]
+       npx @vulnify/cli audit [--json] [--fail-on <severity>]
+
+Installs the fail-closed Vulnify PreToolUse hook into Claude Code.
+
+Options:
+  --user        install in ~/.claude (every project) instead of ./.claude
+  --uninstall   remove the hook (and a key this tool saved)
+  --yes         no prompts; needs VULNIFY_API_KEY in the environment
+  -h, --help    show this help
+
+Docs: ${DOCS}`;
+
+export async function main(argv = process.argv.slice(2)) {
+  if (argv[0] === 'audit') return runAudit(argv.slice(1));
+  const flags = new Set(argv.filter((a) => a.startsWith('-')));
+  const words = argv.filter((a) => !a.startsWith('-'));
+  if (flags.has('-h') || flags.has('--help') || words[0] !== 'hook' || words[1] !== 'claude-code') {
+    console.log(HELP);
+    return words.length && !(flags.has('-h') || flags.has('--help')) ? 1 : 0;
+  }
+  const unknown = [...flags].filter((f) => !['--user', '--uninstall', '--yes', '-y', '--project'].includes(f));
+  if (unknown.length) {
+    console.error(`Unknown option: ${unknown.join(' ')}\n\n${HELP}`);
+    return 1;
+  }
+  const opts = { user: flags.has('--user'), yes: flags.has('--yes') || flags.has('-y') };
+  if (flags.has('--uninstall')) uninstall(opts);
+  else await install(opts);
+  return 0;
+}
+
+if (process.argv[1] && resolve(process.argv[1]).replace(/\\/g, '/').match(/vulnify-cli(\.mjs)?$/)) {
+  main().then((code) => process.exit(code), (e) => {
+    console.error(`vulnify-cli: ${String(e?.message || e)}`);
+    process.exit(1);
+  });
+}

package/hook/vulnify-hook.mjs

@@ -0,0 +1,327 @@
+#!/usr/bin/env node
+/**
+ * Vulnify PreToolUse hook for Claude Code.
+ *
+ * Reads the PreToolUse JSON from stdin, maps the tool call to a Vulnify event,
+ * calls POST /v1/events, and prints a Claude Code hook decision:
+ *   ALLOW  -> no decision (Claude Code's normal permission flow), or "allow" with VULNIFY_HOOK_ALLOW_MODE=allow
+ *   REVIEW -> deny: waiting for approval in Vulnify (optionally waits VULNIFY_HOOK_REVIEW_WAIT_MS)
+ *   BLOCK  -> deny with the reasons
+ * Errors fail closed (deny) unless VULNIFY_HOOK_FAIL_OPEN=true.
+ * No dependencies. Node 18+.
+ */
+
+const DEFAULT_SKIP = [
+  'Read', 'Glob', 'Grep', 'LS', 'NotebookRead', 'TodoWrite', 'Task', 'Agent', 'WebSearch',
+  'BashOutput', 'KillShell', 'KillBash', 'ExitPlanMode', 'AskUserQuestion', 'ListMcpResourcesTool', 'ReadMcpResourceTool',
+];
+
+// Bash commands that only read. A command is skipped only when every part of it is in this list.
+const SAFE_BASH = new Set([
+  'ls', 'cat', 'head', 'tail', 'less', 'more', 'grep', 'rg', 'egrep', 'fgrep', 'find', 'fd', 'pwd', 'echo', 'printf',
+  'wc', 'sort', 'uniq', 'cut', 'tr', 'diff', 'stat', 'file', 'which', 'whoami', 'date', 'env', 'printenv', 'tree',
+  'du', 'df', 'true', 'false', 'test', 'cd', 'jq', 'basename', 'dirname', 'realpath', 'type', 'uname', 'sleep',
+]);
+const SAFE_GIT = new Set(['status', 'diff', 'log', 'show', 'branch', 'rev-parse', 'ls-files', 'blame', 'remote', 'fetch', 'grep', 'describe', 'tag']);
+const SAFE_NPM = new Set(['test', 'run', 'ls', 'view', 'outdated', 'audit']);
+
+function envList(name, env = process.env) {
+  return (env[name] || '').split(',').map((s) => s.trim()).filter(Boolean);
+}
+
+export function config(env = process.env) {
+  const skip = new Set([...(env.VULNIFY_HOOK_SKIP_DEFAULTS === 'false' ? [] : DEFAULT_SKIP), ...envList('VULNIFY_HOOK_SKIP', env)]);
+  return {
+    apiKey: env.VULNIFY_API_KEY || '',
+    baseUrl: (env.VULNIFY_BASE_URL || 'https://api.vulnify.io').replace(/\/+$/, ''),
+    agent: env.VULNIFY_AGENT || 'claude-code',
+    skip,
+    checkReads: env.VULNIFY_HOOK_CHECK_READS === 'true',
+    failOpen: env.VULNIFY_HOOK_FAIL_OPEN === 'true',
+    allowMode: env.VULNIFY_HOOK_ALLOW_MODE === 'allow' ? 'allow' : 'defer',
+    timeoutMs: Number(env.VULNIFY_HOOK_TIMEOUT_MS) || 8000,
+    reviewWaitMs: Math.min(Number(env.VULNIFY_HOOK_REVIEW_WAIT_MS) || 0, 120000),
+    sendContent: ['never', 'risky', 'always'].includes(env.VULNIFY_HOOK_SEND_CONTENT) ? env.VULNIFY_HOOK_SEND_CONTENT : 'risky',
+  };
+}
+
+const clip = (s, n) => (s.length > n ? s.slice(0, n) : s);
+
+function bashParts(command) {
+  return command.split(/&&|\|\||[;|\n]/).map((p) => p.trim().replace(/^(\w+=\S*\s+)+/, '')).filter(Boolean);
+}
+
+const MAX_RECORDS = 1_000_000;
+const BIG = 10_000; // "the whole table": DELETE without WHERE, DROP, TRUNCATE
+const FS_TREE = 5_000; // a recursive or wildcard filesystem delete: a whole directory tree
+
+/** Files that grant an AI agent permissions, tools or MCP servers. */
+export const AGENT_CONFIG_PATH = /(^|[\\/\s'"=])(\.claude[\\/](settings(\.local)?\.json|commands|agents|hooks)|claude_desktop_config\.json|\.mcp\.json|mcp\.json|\.cursor[\\/](mcp\.json|cli\.json|permissions\.json|rules)|\.vscode[\\/](mcp|settings)\.json|\.codex[\\/]config\.toml|\.gemini[\\/]settings\.json|\.codeium[\\/]windsurf[\\/]mcp_config\.json|\.continue[\\/]config\.(json|ya?ml)|\.aider\.conf\.yml)/i;
+
+/** A recursive or wildcard filesystem delete (rm -rf, rm *, find -delete, find -exec rm, shred -r, git clean -fdx...). */
+export function isTreeDelete(c) {
+  for (const part of bashParts(c)) {
+    const words = part.replace(/^((sudo|doas|nice|nohup|time|command|exec)\s+(-\S+\s+)*)+/, '').split(/\s+/);
+    const cmd = words[0].replace(/^.*\//, '');
+    const args = words.slice(1).filter((w) => w && !w.startsWith('-'));
+    if (['rm', 'shred', 'unlink', 'rmdir', 'Remove-Item', 'del', 'rd'].includes(cmd)) {
+      if (words.some((w) => /^-\w*[rR]/.test(w) || /^--recursive$/.test(w) || /^-Recurse$/i.test(w) || /^\/s$/i.test(w))) return true;
+      if (args.some((a) => /[*?[]/.test(a) || a === '/' || a === '~' || a === '.' || a === '..')) return true;
+    }
+    if (cmd === 'find' && (words.includes('-delete') || /-exec(dir)?\s+(\S*\/)?(rm|shred|unlink)\b/.test(part))) return true;
+    if (cmd === 'xargs' && /\b(rm|shred|unlink)\b/.test(part)) return true;
+    if (cmd === 'git' && /^clean\b/.test(words.slice(1).join(' ')) && words.some((w) => /^-\w*f/.test(w))) return true;
+  }
+  return false;
+}
+
+/** A shell command that writes an agent permission/config file (redirect, tee, sed -i, cp/mv onto it, jq > ...). */
+export function writesAgentConfig(c) {
+  if (!AGENT_CONFIG_PATH.test(c)) return false;
+  return /(>>?|\btee\b|\bsed\s+-i|\bperl\s+-pi|\b(cp|mv|install|ln)\b|\btouch\b|\bcat\s*<<|Set-Content|Out-File|Add-Content)/.test(c);
+}
+const num = (v) => {
+  const n = Number(String(v).replace(/[_,]/g, ''));
+  return Number.isFinite(n) && n > 0 ? Math.min(Math.floor(n), MAX_RECORDS) : 0;
+};
+
+const EMAIL_API = /\b(api\.sendgrid\.com|api\.mailgun\.net|api\.resend\.com|api\.postmarkapp\.com|api\.mailjet\.com|api\.brevo\.com|api\.sendinblue\.com|email(-smtp)?\.[a-z0-9-]+\.amazonaws\.com|mandrillapp\.com|api\.sparkpost\.com|smtp\.)/i;
+const EMAIL_ADDR = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+
+/** Rough number of records a shell command touches. 1 when nothing says otherwise. */
+export function estimateBashRecords(c) {
+  const counts = [];
+  const sql = c.match(/\blimit\s+(\d+)/i);
+  if (sql) counts.push(num(sql[1]));
+  if (/\b(drop\s+(table|database|schema)|truncate(\s+table)?\s+\w)/i.test(c)) counts.push(BIG);
+  const del = c.match(/\b(delete\s+from|update)\s+[\w."]+([^;'"]*)/i);
+  if (del && !/\bwhere\b/i.test(del[2] || '') && !sql) counts.push(BIG);
+  for (const m of c.matchAll(/(?:--(?:limit|count|max-results|max-count|page-size|per-page|batch-size|records|rows|number)|(?:^|\s)-n)[=\s]+(\d[\d_,]*)/gi)) counts.push(num(m[1]));
+  if (isTreeDelete(c)) counts.push(FS_TREE);
+  for (const m of c.matchAll(/\bseq\s+(?:\d+\s+)?(\d+)/g)) counts.push(num(m[1]));
+  for (const m of c.matchAll(/\{\d+\.\.(\d+)\}/g)) counts.push(num(m[1]));
+  for (const part of bashParts(c)) {
+    const words = part.split(/\s+/);
+    const cmd = words[0];
+    const args = words.slice(1).filter((w) => w && !w.startsWith('-'));
+    if (['rm', 'shred', 'unlink', 'rmdir'].includes(cmd)) {
+      const recursive = words.some((w) => /^-\w*[rR]/.test(w) || w === '--recursive');
+      const glob = args.some((a) => /[*?[]/.test(a));
+      counts.push(Math.max(args.length, recursive || glob ? FS_TREE : 0));
+    }
+    if (['scp', 'rsync', 'sftp'].includes(cmd) && args.length > 1) {
+      const recursive = words.some((w) => /^-\w*[ra]/.test(w));
+      counts.push(Math.max(args.length - 1, recursive ? 100 : 0));
+    }
+    if (['mail', 'mailx', 'mutt', 'sendmail', 'msmtp', 'ssmtp'].includes(cmd)) {
+      const rcpts = args.filter((a) => /@/.test(a)).length;
+      if (rcpts) counts.push(rcpts);
+    }
+  }
+  const rcpt = (c.match(/--mail-rcpt\b/g) || []).length;
+  if (rcpt) counts.push(rcpt);
+  return Math.max(1, ...counts.filter(Boolean));
+}
+
+function isEmailCommand(c) {
+  return /(^|[\s;&|(])(sendmail|mailx?|mutt|swaks|msmtp|ssmtp|mpack|mail\.py)(\s|$)/.test(c)
+    || /\bsmtps?:\/\//i.test(c) || /--mail-(rcpt|from)\b/.test(c)
+    || /\baws\s+sesv?2?\s+send-(raw-)?email\b/.test(c) || /\bsmtplib\b|\bnodemailer\b|\bnet\/smtp\b|Send-MailMessage/i.test(c)
+    || (/\b(curl|wget|http|httpie|xh)\b/.test(c) && EMAIL_API.test(c));
+}
+
+function classifyBash(command) {
+  const c = command;
+  if (isTreeDelete(c) || /(^|[\s;&|(])(rm|rmdir|shred|unlink)\s/.test(c) || /\b(drop\s+(table|database|schema)|truncate\s+table|delete\s+from)\b/i.test(c)
+    || /git\s+(push\s+.*(--force|-f\b)|reset\s+--hard|clean\s+-\w*f|branch\s+-D)/.test(c)
+    || /\b(curl|http|httpie|xh)\b.*\s-X\s*DELETE\b/i.test(c) || /\baws\s+s3\s+(rm|rb)\b|\bgsutil\s+rm\b|\bkubectl\s+delete\b/.test(c)) {
+    return { action: 'DELETE_DATA', destination: /\b(curl|http|httpie|xh|aws|gsutil|kubectl)\b/.test(c) && !/(^|[\s;&|(])rm\s/.test(c) ? 'EXTERNAL_API' : 'INTERNAL' };
+  }
+  if (writesAgentConfig(c)) return { action: 'WRITE_DATA', destination: 'INTERNAL' };
+  if (isEmailCommand(c)) return { action: 'SEND_EMAIL', destination: 'EXTERNAL_EMAIL' };
+  if (/\b(curl|wget|http|httpie|xh)\b.*(\s-X\s*(POST|PUT|PATCH)|\s(-d|--data\S*|-F|--form\S*|-T|--upload-file|--json|--post-file|--post-data|--body-file)\b|\s\S+=@)/i.test(c)
+    || /\b(scp|rsync|sftp|ftp|lftp|nc|ncat|netcat|socat)\b/.test(c) || /git\s+push\b/.test(c) || /\b(npm|pnpm|yarn)\s+publish\b|\btwine\s+upload\b|\bdocker\s+push\b/.test(c)
+    || /\b(aws\s+s3\s+(cp|sync|mv)|gsutil\s+(cp|rsync|mv)|rclone|azcopy|az\s+storage\s+blob\s+upload)\b/.test(c)
+    || /\bgh\s+(release\s+upload|gist\s+create)\b/.test(c) || /hooks\.slack\.com|discord(app)?\.com\/api\/webhooks/.test(c)) {
+    return { action: 'EXPORT_DATA', destination: 'EXTERNAL_API' };
+  }
+  const parts = bashParts(c);
+  const readOnly = parts.length > 0 && parts.every((p) => {
+    if (/[^>]>[^&]|^>|>>/.test(p)) return false; // redirect writes a file
+    const [cmd, sub] = p.split(/\s+/);
+    if (cmd === 'git') return SAFE_GIT.has(sub);
+    if (cmd === 'npm' || cmd === 'pnpm' || cmd === 'yarn') return SAFE_NPM.has(sub);
+    return SAFE_BASH.has(cmd);
+  });
+  if (readOnly) return { action: 'READ_DATA', destination: 'INTERNAL' };
+  return { action: 'WRITE_DATA', destination: 'INTERNAL' };
+}
+
+const COUNT_KEYS = /^(limit|count|max_?results|max_?count|page_?size|per_?page|batch_?size|num_?records|records|rows|quantity|top|first|last|n)$/i;
+const RCPT_KEYS = /^(to|cc|bcc|recipients?|emails?|addresses|attendees|invitees|members|users|user_?ids|channels?)$/i;
+const ID_LIST_KEYS = /(ids|items|records|rows|messages|files|documents|contacts|entries|keys|objects)$/i;
+
+/** Recipients with an email address in an MCP tool input (to/cc/bcc/recipients...). */
+function mcpRecipients(ti) {
+  let n = 0;
+  for (const [k, v] of Object.entries(ti || {})) {
+    if (!RCPT_KEYS.test(k)) continue;
+    const text = Array.isArray(v) ? v.map((x) => (typeof x === 'string' ? x : JSON.stringify(x))).join(',') : typeof v === 'string' ? v : '';
+    n += (text.match(EMAIL_ADDR) || []).length;
+  }
+  return n;
+}
+
+/** Rough number of records an MCP call touches: list lengths, limit/count fields, recipients. */
+export function estimateMcpRecords(ti) {
+  const counts = [];
+  const walk = (v, key, depth) => {
+    if (depth > 3 || v == null) return;
+    if (Array.isArray(v)) {
+      if (ID_LIST_KEYS.test(key) || RCPT_KEYS.test(key) || v.length > 1) counts.push(Math.min(v.length, MAX_RECORDS));
+      for (const x of v.slice(0, 50)) walk(x, key, depth + 1);
+      return;
+    }
+    if (typeof v === 'object') {
+      for (const [k, x] of Object.entries(v)) walk(x, k, depth + 1);
+      return;
+    }
+    if (COUNT_KEYS.test(key) && (typeof v === 'number' || /^\d+$/.test(String(v)))) counts.push(num(v));
+    if (typeof v === 'string' && /^(query|sql|statement)$/i.test(key)) counts.push(estimateBashRecords(v));
+  };
+  walk(ti, '', 0);
+  counts.push(mcpRecipients(ti));
+  return Math.max(1, ...counts.filter(Boolean));
+}
+
+function classifyMcp(toolName, ti = {}) {
+  const [, server = 'mcp', ...rest] = toolName.split('__');
+  const rawTool = rest.join('__');
+  const tool = rawTool.toLowerCase();
+  const words = rawTool.split(/[^A-Za-z0-9]+|(?=[A-Z])/).map((w) => w.toLowerCase());
+  const has = (re) => words.some((w) => re.test(w));
+  const mailish = /mail|gmail|outlook|smtp|sendgrid|resend|mailgun|postmark|ses\b|brevo|mailchimp/i.test(server) || /mail/.test(tool) || mcpRecipients(ti) > 0;
+  const sqlish = typeof (ti.sql ?? ti.query) === 'string' ? String(ti.sql ?? ti.query) : '';
+  let out;
+  if (has(/^(delete|remove|drop|purge|destroy|trash|archive|revoke|cancel|truncate)/) || /\b(delete\s+from|drop\s+table|truncate)\b/i.test(sqlish)) out = { action: 'DELETE_DATA', destination: 'EXTERNAL_API' };
+  else if (has(/^(send|reply|forward|post|message|notify|email|dm|chat|draft)/)) out = mailish ? { action: 'SEND_EMAIL', destination: 'EXTERNAL_EMAIL' } : { action: 'EXPORT_DATA', destination: 'EXTERNAL_API' };
+  else if (has(/^(export|share|upload|publish|invite|transfer|pay|charge|refund|payout|deploy|sync|backup|dump)/)) out = mailish && has(/^(share|invite)/) ? { action: 'EXPORT_DATA', destination: 'EXTERNAL_EMAIL' } : { action: 'EXPORT_DATA', destination: 'EXTERNAL_API' };
+  else if (has(/^(get|list|search|read|fetch|query|find|describe|lookup|view|show|check|count|retrieve|download)$/) && !/\b(insert|update|delete|drop|alter|create)\b/i.test(sqlish)) out = { action: 'READ_DATA', destination: 'EXTERNAL_API' };
+  else out = { action: 'WRITE_DATA', destination: 'EXTERNAL_API' };
+  return { ...out, resource: clip(`mcp:${server}`, 100) };
+}
+
+/** Map a PreToolUse input to a Vulnify event body, or null when the tool is skipped. */
+export function describe(input, cfg = config()) {
+  const name = String(input.tool_name || '');
+  const ti = input.tool_input || {};
+  if (!name || cfg.skip.has(name)) return null;
+  if (/^mcp__vulnify__/.test(name)) return null; // Vulnify's own tools
+  let ev;
+  let content = '';
+  if (name === 'Bash' || name === 'PowerShell') {
+    const command = String(ti.command || '');
+    ev = { ...classifyBash(command), resource: 'shell', records: estimateBashRecords(command) };
+    const hints = [];
+    if (isTreeDelete(command)) hints.push('recursive or wildcard filesystem delete');
+    if (writesAgentConfig(command)) { hints.push('writes an agent permission/config file'); ev.agentConfig = true; }
+    content = hints.length ? `# vulnify-hint: ${hints.join('; ')}\n${command}` : command;
+  } else if (['Write', 'Edit', 'MultiEdit', 'NotebookEdit'].includes(name)) {
+    const path = String(ti.file_path ?? ti.notebook_path ?? ti.path ?? '');
+    ev = { action: 'WRITE_DATA', destination: 'INTERNAL', resource: 'local files', agentConfig: AGENT_CONFIG_PATH.test(path) };
+    const edits = Array.isArray(ti.edits) ? ti.edits.map((e) => String(e?.new_string ?? '')).join('\n') : '';
+    const body = String(ti.content ?? ti.new_string ?? ti.new_source ?? '') || edits;
+    content = path ? `file_path: ${path}\n${body}` : body;
+  } else if (name === 'WebFetch') {
+    ev = { action: 'READ_DATA', destination: 'EXTERNAL_API', resource: 'web' };
+    content = String(ti.url || '');
+  } else if (name.startsWith('mcp__')) {
+    ev = { ...classifyMcp(name, ti), records: estimateMcpRecords(ti) };
+    content = JSON.stringify(ti);
+  } else {
+    ev = { action: 'WRITE_DATA', destination: 'INTERNAL', resource: clip(`tool:${name}`, 100) };
+    content = JSON.stringify(ti);
+  }
+  if (ev.action === 'READ_DATA' && !cfg.checkReads && name !== 'WebFetch') return null;
+  const body = { agent: cfg.agent, action: ev.action, resource: ev.resource, destination: ev.destination, recordsAffected: ev.records || 1 };
+  // Agent config edits always carry path + content: the engine needs them to flag "Agent permission change".
+  const risky = ['SEND_EMAIL', 'EXPORT_DATA', 'DELETE_DATA'].includes(ev.action) || name === 'WebFetch' || !!ev.agentConfig;
+  if (content && (cfg.sendContent === 'always' || (cfg.sendContent === 'risky' && risky) || (cfg.sendContent !== 'never' && ev.agentConfig))) body.content = clip(content, 20000);
+  return body;
+}
+
+function out(decision, reason, extra = {}) {
+  const hookSpecificOutput = { hookEventName: 'PreToolUse', permissionDecision: decision, permissionDecisionReason: reason };
+  return { hookSpecificOutput, ...extra };
+}
+
+async function call(cfg, fetchImpl, method, path, body, idem) {
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), cfg.timeoutMs);
+  try {
+    const headers = { Authorization: `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json', 'User-Agent': 'vulnify-claude-code-hook/0.2' };
+    if (idem) headers['Idempotency-Key'] = idem;
+    const res = await fetchImpl(cfg.baseUrl + path, { method, headers, body: body ? JSON.stringify(body) : undefined, signal: ctrl.signal });
+    const json = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(`HTTP ${res.status}${json.message ? `: ${String(json.message).slice(0, 200)}` : ''}`);
+    return json;
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+/** Decide one PreToolUse input. Returns the JSON to print, or null for "no decision". */
+export async function decide(input, { cfg = config(), fetchImpl = globalThis.fetch, sleep = (ms) => new Promise((r) => setTimeout(r, ms)) } = {}) {
+  const body = describe(input, cfg);
+  if (!body) return null;
+  const degraded = (why) => cfg.failOpen
+    ? { systemMessage: `Vulnify degraded (${why}); ${input.tool_name} ran without a check because VULNIFY_HOOK_FAIL_OPEN=true.` }
+    : out('deny', `Vulnify could not check this action (${why}), so it was held (fail closed). Tell the user; do not try to work around it.`);
+  if (!cfg.apiKey) return degraded('VULNIFY_API_KEY is not set');
+  let d;
+  try {
+    d = await call(cfg, fetchImpl, 'POST', '/v1/events', body, input.tool_use_id ? `cc-${input.tool_use_id}` : undefined);
+    let final = d.finalDecision ?? d.decision;
+    const deadline = Date.now() + cfg.reviewWaitMs;
+    while (final === 'REVIEW' && d.id && Date.now() < deadline) {
+      await sleep(Math.min(3000, Math.max(0, deadline - Date.now())));
+      d = await call(cfg, fetchImpl, 'GET', `/v1/events/${encodeURIComponent(d.id)}`);
+      final = d.finalDecision ?? d.decision;
+    }
+  } catch (e) {
+    return degraded(e?.name === 'AbortError' ? 'timeout' : String(e?.message || e).slice(0, 200));
+  }
+  const final = d.finalDecision ?? d.decision;
+  const reasons = Array.isArray(d.reasons) && d.reasons.length ? d.reasons.join('; ') : 'no reasons given';
+  const tag = `${body.action}${body.destination ? ` -> ${body.destination}` : ''}`;
+  if (final === 'ALLOW') return cfg.allowMode === 'allow' ? out('allow', `Vulnify ALLOW (${tag}, event ${d.id})`) : null;
+  if (final === 'REVIEW') {
+    return out('deny', `Vulnify REVIEW (${tag}, event ${d.id}): waiting for approval in Vulnify. Reasons: ${reasons}. Tell the user a person must approve it at app.vulnify.io/approvals, then retry after approval.`);
+  }
+  if (final === 'BLOCK') return out('deny', `Vulnify BLOCK (${tag}, event ${d.id}): ${reasons}. Do not retry or work around this; tell the user.`);
+  return degraded(`unexpected decision ${String(final).slice(0, 40)}`);
+}
+
+async function main() {
+  let raw = '';
+  for await (const chunk of process.stdin) raw += chunk;
+  let input;
+  try {
+    input = JSON.parse(raw || '{}');
+  } catch {
+    const cfg = config();
+    if (cfg.failOpen) return;
+    process.stderr.write('Vulnify hook: could not parse PreToolUse input; holding the action (fail closed).\n');
+    process.exit(2);
+  }
+  const result = await decide(input);
+  if (result) process.stdout.write(JSON.stringify(result));
+}
+
+if (import.meta.url === `file://${process.argv[1]}` || process.argv[1]?.endsWith('vulnify-hook.mjs')) {
+  main().catch((e) => {
+    if (process.env.VULNIFY_HOOK_FAIL_OPEN === 'true') return;
+    process.stderr.write(`Vulnify hook failed: ${String(e?.message || e).slice(0, 200)}. Holding the action (fail closed).\n`);
+    process.exit(2);
+  });
+}

package/lib/audit.mjs

@@ -0,0 +1,446 @@
+/**
+ * vulnify audit: a local, read-only audit of the AI agents configured on this machine
+ * and in the current project. It reads config files, never writes, never runs a server,
+ * and makes no network calls. Secrets are always masked (first 4 characters + ***).
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, join, posix, relative, resolve, sep, win32 } from 'node:path';
+
+export const SEVERITIES = ['low', 'medium', 'high', 'critical'];
+const WEIGHT = { critical: 25, high: 15, medium: 7, low: 3 };
+const MAX_BYTES = 2 * 1024 * 1024;
+
+export const mask = (s) => `${String(s).slice(0, 4)}***`;
+
+// ---------- secret patterns ----------
+const TOKEN_PATTERNS = [
+  ['AWS access key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],
+  ['GitHub token', /\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,})\b/],
+  ['Anthropic key', /\bsk-ant-[A-Za-z0-9_-]{20,}/],
+  ['OpenAI key', /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{32,}/],
+  ['Slack token', /\bxox[abposr]-[A-Za-z0-9-]{10,}/],
+  ['Google API key', /\bAIza[0-9A-Za-z_-]{35}\b/],
+  ['GitLab token', /\bglpat-[A-Za-z0-9_-]{20,}/],
+  ['Stripe key', /\b[sr]k_live_[A-Za-z0-9]{20,}/],
+  ['npm token', /\bnpm_[A-Za-z0-9]{36}\b/],
+  ['Vulnify key', /\bvln_(?:live|test)_[A-Za-z0-9_]{12,}/],
+  ['Private key', /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/],
+];
+export function findToken(text) {
+  for (const [name, re] of TOKEN_PATTERNS) {
+    const m = re.exec(String(text));
+    if (m) return { name, value: m[0] };
+  }
+  return null;
+}
+const SECRET_NAME = /(?:^|_|-)(?:API_?KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|PAT|AUTH|CREDENTIALS?|PRIVATE)(?:$|_|-)/i;
+const isReference = (v) => /^\$\{?[A-Za-z_][\w:.-]*\}?$|^\$\{(?:env|input):[^}]+\}$|^<.*>$|^your[-_ ]|^xxx|^\*+$|^(?:changeme|placeholder|todo|none|null|true|false)$/i.test(String(v).trim());
+
+// ---------- tiny TOML reader (enough for ~/.codex/config.toml) ----------
+export function parseToml(text) {
+  const root = {};
+  let cur = root;
+  const setPath = (obj, keys) => keys.reduce((o, k) => (o[k] ??= {}), obj);
+  const splitKey = (k) => (k.match(/"[^"]*"|'[^']*'|[^.\s]+/g) || []).map((p) => p.replace(/^["']|["']$/g, ''));
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    let line = lines[i].trim();
+    if (!line || line.startsWith('#')) continue;
+    const t = line.match(/^\[\[?\s*([^\]]+?)\s*\]\]?$/);
+    if (t) { cur = setPath(root, splitKey(t[1])); continue; }
+    const eq = line.indexOf('=');
+    if (eq < 0) continue;
+    const key = line.slice(0, eq).trim();
+    let raw = line.slice(eq + 1).trim();
+    // Multi-line arrays / triple-quoted strings
+    const opens = (s) => (s.match(/\[/g) || []).length - (s.match(/\]/g) || []).length;
+    if (raw.startsWith('[')) { while (opens(stripStrings(raw)) > 0 && i + 1 < lines.length) raw += '\n' + lines[++i]; }
+    else if (/^("""|''')/.test(raw)) { const q = raw.slice(0, 3); while (!raw.slice(3).includes(q) && i + 1 < lines.length) raw += '\n' + lines[++i]; }
+    const keys = splitKey(key);
+    setPath(cur, keys.slice(0, -1))[keys.at(-1)] = tomlValue(raw);
+  }
+  return root;
+}
+function stripStrings(s) { return s.replace(/"(?:\\.|[^"\\])*"|'[^']*'/g, '""').replace(/#.*$/gm, ''); }
+function tomlValue(raw) {
+  raw = raw.trim();
+  if (/^("""|''')/.test(raw)) return raw.slice(3, raw.lastIndexOf(raw.slice(0, 3)));
+  if (raw.startsWith('"')) { const m = raw.match(/^"((?:\\.|[^"\\])*)"/); try { return JSON.parse(`"${m ? m[1] : ''}"`); } catch { return m ? m[1] : ''; } }
+  if (raw.startsWith("'")) { const m = raw.match(/^'([^']*)'/); return m ? m[1] : ''; }
+  if (raw.startsWith('[')) return splitTop(raw.slice(1, raw.lastIndexOf(']'))).map(tomlValue);
+  if (raw.startsWith('{')) {
+    const o = {};
+    for (const part of splitTop(raw.slice(1, raw.lastIndexOf('}')))) {
+      const eq = part.indexOf('=');
+      if (eq > 0) o[part.slice(0, eq).trim().replace(/^["']|["']$/g, '')] = tomlValue(part.slice(eq + 1));
+    }
+    return o;
+  }
+  const v = raw.replace(/\s+#.*$/, '');
+  if (v === 'true') return true;
+  if (v === 'false') return false;
+  return /^[+-]?\d+(\.\d+)?$/.test(v) ? Number(v) : v;
+}
+function splitTop(s) {
+  const out = []; let depth = 0, q = null, buf = '';
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (q) { buf += c; if (c === '\\' && q === '"') { buf += s[++i] ?? ''; continue; } if (c === q) q = null; continue; }
+    if (c === '"' || c === "'") { q = c; buf += c; continue; }
+    if (c === '#') { while (i < s.length && s[i] !== '\n') i++; continue; }
+    if (c === '[' || c === '{') depth++;
+    if (c === ']' || c === '}') depth--;
+    if (c === ',' && depth === 0) { if (buf.trim()) out.push(buf.trim()); buf = ''; continue; }
+    buf += c;
+  }
+  if (buf.trim()) out.push(buf.trim());
+  return out;
+}
+
+// ---------- discovery ----------
+/** Every config location we know, per tool. Paths confirmed against each tool's docs (Oct 2026). */
+export function locations({ home = homedir(), cwd = process.cwd(), platform = process.platform, env = process.env } = {}) {
+  // Build paths for the target OS, not the host (so a simulated win32/darwin run is correct anywhere).
+  const join = (platform === 'win32' ? win32 : posix).join;
+  const claudeHome = env.CLAUDE_CONFIG_DIR || join(home, '.claude');
+  const codexHome = env.CODEX_HOME || join(home, '.codex');
+  const appData = env.APPDATA || join(home, 'AppData', 'Roaming');
+  const desktop = platform === 'darwin' ? join(home, 'Library', 'Application Support', 'Claude')
+    : platform === 'win32' ? join(appData, 'Claude') : join(env.XDG_CONFIG_HOME || join(home, '.config'), 'Claude');
+  const vscodeUser = platform === 'darwin' ? join(home, 'Library', 'Application Support', 'Code', 'User')
+    : platform === 'win32' ? join(appData, 'Code', 'User') : join(env.XDG_CONFIG_HOME || join(home, '.config'), 'Code', 'User');
+  const managed = platform === 'darwin' ? '/Library/Application Support/ClaudeCode/managed-settings.json'
+    : platform === 'win32' ? 'C:\\Program Files\\ClaudeCode\\managed-settings.json' : '/etc/claude-code/managed-settings.json';
+  const p = (rel) => join(cwd, rel);
+  return [
+    // Claude Code
+    { tool: 'Claude Code', kind: 'claude-settings', scope: 'user', path: join(claudeHome, 'settings.json') },
+    { tool: 'Claude Code', kind: 'claude-settings', scope: 'managed', path: managed },
+    { tool: 'Claude Code', kind: 'claude-settings', scope: 'project', path: p('.claude/settings.json') },
+    { tool: 'Claude Code', kind: 'claude-settings', scope: 'project', path: p('.claude/settings.local.json') },
+    { tool: 'Claude Code', kind: 'claude-json', scope: 'user', path: join(home, '.claude.json') },
+    { tool: 'Claude Code', kind: 'mcp', scope: 'project', path: p('.mcp.json') },
+    { tool: 'Claude Code', kind: 'instructions', scope: 'user', path: join(claudeHome, 'CLAUDE.md') },
+    { tool: 'Claude Code', kind: 'instructions', scope: 'project', path: p('CLAUDE.md') },
+    { tool: 'Claude Code', kind: 'instructions', scope: 'project', path: p('CLAUDE.local.md') },
+    { tool: 'Claude Code', kind: 'instructions', scope: 'project', path: p('.claude/CLAUDE.md') },
+    // Cursor
+    { tool: 'Cursor', kind: 'mcp', scope: 'user', path: join(home, '.cursor', 'mcp.json') },
+    { tool: 'Cursor', kind: 'mcp', scope: 'project', path: p('.cursor/mcp.json') },
+    { tool: 'Cursor', kind: 'cursor-cli', scope: 'user', path: join(home, '.cursor', 'cli-config.json') },
+    { tool: 'Cursor', kind: 'instructions', scope: 'project', path: p('.cursorrules') },
+    { tool: 'Cursor', kind: 'instructions-dir', scope: 'project', path: p('.cursor/rules') },
+    // Codex
+    { tool: 'Codex', kind: 'codex', scope: 'user', path: join(codexHome, 'config.toml') },
+    { tool: 'Codex', kind: 'codex', scope: 'project', path: p('.codex/config.toml') },
+    { tool: 'Codex', kind: 'instructions', scope: 'user', path: join(codexHome, 'AGENTS.md') },
+    { tool: 'Codex', kind: 'instructions', scope: 'project', path: p('AGENTS.md') },
+    // Claude Desktop
+    { tool: 'Claude Desktop', kind: 'mcp', scope: 'user', path: join(desktop, 'claude_desktop_config.json') },
+    // VS Code / Copilot
+    { tool: 'VS Code', kind: 'mcp', scope: 'project', path: p('.vscode/mcp.json') },
+    { tool: 'VS Code', kind: 'mcp', scope: 'user', path: join(vscodeUser, 'mcp.json') },
+    { tool: 'VS Code', kind: 'mcp', scope: 'user', path: join(env.COPILOT_HOME || join(home, '.copilot'), 'mcp-config.json') },
+    { tool: 'VS Code', kind: 'instructions', scope: 'project', path: p('.github/copilot-instructions.md') },
+  ];
+}
+
+function readText(path) {
+  try {
+    const st = statSync(path);
+    if (!st.isFile() || st.size > MAX_BYTES) return null;
+    return { text: readFileSync(path, 'utf8'), mode: st.mode };
+  } catch { return null; }
+}
+const parseJsonLoose = (t) => {
+  try { return JSON.parse(t); } catch { /* JSONC: drop comments and trailing commas */ }
+  try { return JSON.parse(t.replace(/("(?:\\.|[^"\\])*")|\/\/[^\n]*|\/\*[\s\S]*?\*\//g, (m, s) => s ?? '').replace(/,(\s*[}\]])/g, '$1')); } catch { return undefined; }
+};
+
+/** 1-based line of the first needle, then each following needle after it. */
+export function lineOf(text, ...needles) {
+  let at = 0, found = -1;
+  for (const n of needles.filter(Boolean)) {
+    const i = text.indexOf(n, at);
+    if (i < 0) break;
+    found = i; at = i + n.length;
+  }
+  return found < 0 ? 1 : text.slice(0, found).split('\n').length;
+}
+
+// ---------- rules ----------
+const FIX_CTA = 'Vulnify can hold this at runtime: npx @vulnify/cli hook claude-code';
+const R = {
+  'mcp-remote-no-auth': { severity: 'medium', title: 'Remote MCP server with no auth', why: 'Anyone who knows the URL can use it, and you cannot tell who is on the other side or revoke access.', fix: 'Use an MCP server that requires OAuth or a bearer token (headers / bearer_token_env_var), or remove it.' },
+  'mcp-unpinned': { severity: 'low', title: 'MCP server runs an unpinned package', why: 'npx/uvx downloads the latest version on every start, so a compromised release runs on your machine with no review (supply chain).', fix: 'Pin a version, e.g. "@scope/server@1.2.3" or "pkg==1.2.3", and update on purpose.' },
+  'mcp-fs-broad': { severity: 'high', title: 'Filesystem MCP server can reach your whole disk or home', why: 'The agent can read ~/.ssh, ~/.aws, browser profiles and every repo, and can overwrite them.', fix: 'Limit it to the project folder (e.g. "${workspaceFolder}" or "."), never "/" or "~".' },
+  'mcp-shell': { severity: 'high', title: 'MCP server exposes shell / command execution', why: 'Any prompt injection that reaches the agent can run arbitrary commands, outside the agent\'s own permission prompts.', fix: 'Remove it or gate it with per-call approval. ' + FIX_CTA },
+  'mcp-plaintext-secret': { severity: 'high', title: 'Plaintext secret in MCP server config', why: 'The key sits in a config file that gets synced, backed up, pasted into issues and read by other tools and agents.', fix: 'Move it to an env var or OS keychain and reference it (${env:NAME}, ${input:...}, bearer_token_env_var), then rotate the key.' },
+  'perm-bypass': { severity: 'critical', title: 'Approvals are bypassed or every command is allowed', why: 'The agent runs any shell command and edits any file without asking, so one bad prompt is enough to do damage.', fix: 'Remove bypass mode / wildcard allow rules and allow only the specific commands you need. ' + FIX_CTA },
+  'perm-dangerous-allow': { severity: 'high', title: 'Destructive command pre-approved', why: 'rm, curl|sh, git push --force, chmod and sudo can destroy work or open the machine, and they run with no prompt.', fix: 'Delete the allow rule (or move it to "ask"), so a person confirms each time.' },
+  'perm-no-deny-secrets': { severity: 'medium', title: 'No deny rules for secret files', why: 'Nothing stops the agent from reading .env, ~/.ssh or ~/.aws and putting them into a prompt, a commit or a web request.', fix: 'Add to permissions.deny: "Read(./.env)", "Read(./.env.*)", "Read(~/.ssh/**)", "Read(~/.aws/**)".' },
+  'project-dotenv': { severity: 'medium', title: '.env file in the project', why: 'Agents working here can read it unless denied, and it ends up in context, logs and generated code.', fix: 'Keep it git-ignored, deny Read(./.env*) for agents, and prefer a secrets manager for real credentials.' },
+  'config-token': { severity: 'high', title: 'Token in an agent config file', why: 'Agent configs are often committed, synced and readable by every agent and extension on the machine.', fix: 'Remove the token from the file, load it from the environment or a keychain, and rotate it.' },
+  'instructions-injection': { severity: 'high', title: 'Suspicious text in an agent instruction file', why: 'Instruction files are obeyed on every session. Hidden or "ignore the rules" text is how repos hijack agents and exfiltrate data.', fix: 'Read the file, remove the text, and check where it came from (cloned repo, PR, package).' },
+  'config-world-readable': { severity: 'medium', title: 'Agent config readable by other users', why: 'Other accounts and processes on this machine can read the config and any keys or tokens in it.', fix: 'chmod 600 the file (and 700 its folder).' },
+};
+export const RULES = R;
+
+const HOME_LIKE = /^(?:\/|~\/?|\$HOME\/?|\$\{(?:env:)?(?:HOME|USERPROFILE|userHome)\}\/?|[A-Za-z]:\\?|\/(?:Users|home)\/[^/]+\/?|[A-Za-z]:\\Users\\[^\\]+\\?|\/root\/?)$/;
+const SHELL_NAME = /(?:^|[-_@/ ])(?:shell|bash|zsh|powershell|terminal|exec|cmd|command|commands|run[-_]?command|desktop-commander|ssh|process)(?:$|[-_/ @.])/i;
+
+function* servers(cfg) {
+  if (!cfg || typeof cfg !== 'object') return;
+  for (const key of ['mcpServers', 'servers', 'mcp_servers']) {
+    const s = cfg[key];
+    if (s && typeof s === 'object' && !Array.isArray(s)) for (const [name, def] of Object.entries(s)) if (def && typeof def === 'object') yield [name, def];
+  }
+}
+
+function pkgOf(command, args) {
+  const cmd = basename(String(command || '')).replace(/\.(cmd|exe)$/i, '').toLowerCase();
+  if (!['npx', 'uvx', 'bunx', 'pnpx'].includes(cmd) && !(cmd === 'pnpm' && args[0] === 'dlx') && !(cmd === 'uv' && args[0] === 'tool')) return null;
+  const rest = args.filter((a) => typeof a === 'string');
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (['dlx', 'tool', 'run'].includes(a) && i < 2) continue;
+    if (a === '--from' || a === '-p' || a === '--package') return { cmd, pkg: rest[i + 1] || '' };
+    if (a.startsWith('-')) continue;
+    return { cmd, pkg: a };
+  }
+  return null;
+}
+export function isPinned(cmd, pkg) {
+  if (!pkg) return true;
+  if (/^(?:\.|\/|[A-Za-z]:\\|git\+|https?:|file:)/.test(pkg)) return true;
+  if (cmd === 'uvx' || cmd === 'uv') return /==\d|@\d/.test(pkg);
+  const at = pkg.startsWith('@') ? pkg.indexOf('@', 1) : pkg.indexOf('@');
+  if (at < 0) return false;
+  const ver = pkg.slice(at + 1);
+  return /^\d/.test(ver) && !/[\^~*x]|latest|next/.test(ver);
+}
+
+function checkServer(add, file, text, name, def) {
+  const args = Array.isArray(def.args) ? def.args.map(String) : [];
+  const url = def.url || def.serverUrl || def.httpUrl;
+  const at = (...n) => lineOf(text, `"${name}"`, ...n) || lineOf(text, name);
+  const where = (...n) => (file.endsWith('.toml') ? lineOf(text, `mcp_servers.${name}`, ...n) : at(...n));
+  // remote, no auth
+  if (url && /^https?:/i.test(url) && !/^https?:\/\/(?:localhost|127\.|\[::1\])/i.test(url)) {
+    const headers = def.headers || def.http_headers || def.env_http_headers || {};
+    const hasAuth = Object.keys(headers).some((h) => /auth|token|key/i.test(h)) || def.bearer_token_env_var || def.bearer_token || def.oauth || def.auth || /[?&](?:key|token|api_key|apikey)=/i.test(url);
+    if (!hasAuth) add('mcp-remote-no-auth', file, where('url'), `server "${name}" → ${url.replace(/[?#].*$/, '')}`);
+  }
+  // unpinned
+  const p = pkgOf(def.command, args);
+  if (p && !isPinned(p.cmd, p.pkg)) add('mcp-unpinned', file, where(p.pkg), `server "${name}": ${p.cmd} ${p.pkg}`);
+  // filesystem broad
+  const ident = `${name} ${def.command || ''} ${args.join(' ')}`;
+  if (/filesystem|file-system|\bfs\b|fs-mcp|mcp-fs/i.test(ident)) {
+    const broad = args.find((a) => HOME_LIKE.test(a.trim()));
+    if (broad) add('mcp-fs-broad', file, where(broad), `server "${name}" can access "${broad}"`);
+  }
+  // shell / exec
+  if (SHELL_NAME.test(name) || (p && SHELL_NAME.test(p.pkg)) || /mcp-server-commands|desktop-commander|mcp-shell|shell-mcp|terminal-mcp|mcp-server-shell/i.test(args.join(' ')))
+    add('mcp-shell', file, where(), `server "${name}"${p ? ` (${p.pkg})` : ''}`);
+  // plaintext secrets
+  const env = { ...(def.env || {}), ...(def.headers || {}), ...(def.http_headers || {}) };
+  for (const [k, v] of Object.entries(env)) {
+    if (typeof v !== 'string' || !v.trim() || isReference(v)) continue;
+    const tok = findToken(v);
+    const bearer = /^Bearer\s+(\S{8,})$/i.exec(v);
+    if (tok || bearer || (SECRET_NAME.test(k) && v.length >= 8 && !/\$\{/.test(v)))
+      add('mcp-plaintext-secret', file, where(k), `server "${name}", ${k} = ${mask(tok ? tok.value : bearer ? bearer[1] : v)}`, (tok || bearer || { value: v }).value);
+  }
+  const done = new Set();
+  args.forEach((a, i) => {
+    const tok = findToken(a);
+    const kv = /^--?(?:api[-_]?key|token|secret|password|auth)(?:=(.+))?$/i.exec(a);
+    const val = tok ? tok.value : kv ? kv[1] || args[i + 1] : null;
+    if (val && !done.has(val) && !isReference(val) && val.length >= 8 && done.add(val)) add('mcp-plaintext-secret', file, where(val), `server "${name}", args[${i}] = ${mask(val)}`, val);
+  });
+  if (url) { const t = findToken(url) || (/[?&](?:key|token|api_key|apikey)=([^&]{8,})/i.exec(url) || [])[1] && { value: /[?&](?:key|token|api_key|apikey)=([^&]+)/i.exec(url)[1] }; if (t) add('mcp-plaintext-secret', file, where('url'), `server "${name}", key in URL = ${mask(t.value)}`, t.value); }
+}
+
+const DANGER = [
+  [/\brm\b/, 'rm'], [/\b(?:curl|wget)\b.*\|\s*(?:ba|z)?sh\b|\|\s*(?:ba|z)?sh\b/, 'curl | sh'],
+  [/\bgit\s+push\b.*(?:--force|-f\b|\*)/, 'git push --force'], [/\bchmod\b/, 'chmod'], [/\bsudo\b/, 'sudo'],
+  [/\bRemove-Item\b/i, 'Remove-Item'],
+];
+function checkPermissions(add, file, text, allow, toolName = 'Bash') {
+  for (const rule of allow) {
+    if (typeof rule !== 'string') continue;
+    const r = rule.trim();
+    const m = /^(\w+)(?:\((.*)\))?$/s.exec(r);
+    const tool = m?.[1] || '';
+    const arg = (m?.[2] ?? '').trim();
+    if (r === '*' || ((/^(?:Bash|Shell|PowerShell)$/i.test(tool)) && (m[2] === undefined || /^[*:\s]*$/.test(arg) || arg === '**'))) {
+      add('perm-bypass', file, lineOf(text, JSON.stringify(rule)), `allow rule ${JSON.stringify(rule)}`); continue;
+    }
+    if (!/^(?:Bash|Shell|PowerShell)$/i.test(tool)) continue;
+    const hit = DANGER.find(([re]) => re.test(arg));
+    if (hit) add('perm-dangerous-allow', file, lineOf(text, JSON.stringify(rule)), `allow rule ${JSON.stringify(rule)} (${hit[1]})`);
+  }
+}
+
+const INJECTION = [
+  [/\b(?:ignore|disregard|forget|override)\b[^.\n]{0,40}\b(?:previous|prior|above|earlier|all|any|system|safety|security|user'?s?)\b[^.\n]{0,20}\b(?:instructions?|rules?|prompts?|guidelines?|polic(?:y|ies))\b/i, 'tells the agent to ignore its rules'],
+  [/\b(?:do not|don'?t|never)\s+(?:tell|inform|mention|show|reveal|notify|ask)\b[^.\n]{0,30}\b(?:user|human|developer|anyone|owner)\b/i, 'tells the agent to hide actions from the user'],
+  [/\b(?:silently|secretly|covertly|without (?:telling|asking|notifying|informing))\b/i, 'asks for silent or covert actions'],
+  [/\b(?:curl|wget|fetch|invoke-webrequest|iwr|nc)\b[^\n]{0,120}(?:\$\{?[A-Z_]*(?:KEY|TOKEN|SECRET|PASS)|\.env\b|\.ssh|\.aws|id_rsa|credentials)/i, 'sends secrets or credentials to a URL'],
+  [/\b(?:send|post|upload|exfiltrate|forward|copy)\b[^.\n]{0,60}\b(?:env|secrets?|credentials?|tokens?|keys?|\.env|ssh)\b[^.\n]{0,60}https?:\/\//i, 'asks to send secrets to an external URL'],
+  [/https?:\/\/[^\s)"']*(?:webhook\.site|requestbin|pipedream\.net|ngrok(?:-free)?\.(?:io|app)|pastebin\.com|interact\.sh|oast\.|burpcollaborator|trycloudflare\.com)/i, 'points to a known data-capture endpoint'],
+];
+const INVISIBLE = /[\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF]|[\u{E0000}-\u{E007F}]/u;
+function checkInstructions(add, file, text) {
+  const lines = text.split('\n');
+  lines.forEach((l, i) => {
+    const inv = INVISIBLE.exec(l.replace(/^\uFEFF/, i === 0 ? '' : '\uFEFF'));
+    if (inv) add('instructions-injection', file, i + 1, `invisible Unicode U+${inv[0].codePointAt(0).toString(16).toUpperCase().padStart(4, '0')}`);
+    for (const [re, label] of INJECTION) if (re.test(l)) { add('instructions-injection', file, i + 1, label); break; }
+  });
+  const hidden = /<!--[\s\S]*?-->/g; let m;
+  while ((m = hidden.exec(text))) if (INJECTION.some(([re]) => re.test(m[0])) || /\b(?:instruction|agent|assistant|AI)\b/i.test(m[0])) add('instructions-injection', file, text.slice(0, m.index).split('\n').length, 'instructions hidden in an HTML comment');
+}
+
+function listDir(dir, depth = 2) {
+  const out = [];
+  try {
+    for (const e of readdirSync(dir, { withFileTypes: true })) {
+      const f = join(dir, e.name);
+      if (e.isDirectory() && depth > 0) out.push(...listDir(f, depth - 1));
+      else if (e.isFile() && /\.(md|mdc|txt)$/i.test(e.name)) out.push(f);
+    }
+  } catch { /* unreadable */ }
+  return out;
+}
+
+// ---------- main ----------
+export function audit({ home = homedir(), cwd = process.cwd(), platform = process.platform, env = process.env } = {}) {
+  home = resolve(home); cwd = resolve(cwd);
+  const findings = []; const seen = new Set(); const files = []; const tools = new Set();
+  const add = (id, file, line, detail, secret) => {
+    const key = `${id}|${file}|${line}|${detail}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    if (secret && detail.includes(secret)) throw new Error('internal: unmasked secret');
+    findings.push({ id, severity: R[id].severity, title: R[id].title, file, line, detail, why: R[id].why, fix: R[id].fix });
+  };
+  let claudeSeen = false; const claudeDeny = []; const claudeFiles = [];
+  const visited = new Set();
+  for (const loc of locations({ home, cwd, platform, env })) {
+    const paths = loc.kind === 'instructions-dir' ? listDir(loc.path) : [loc.path];
+    for (const path of paths) {
+      if (visited.has(path)) continue; visited.add(path);
+      const r = readText(path);
+      if (!r) continue;
+      const { text, mode } = r;
+      files.push({ tool: loc.tool, scope: loc.scope, path });
+      tools.add(loc.tool);
+      const isInstr = loc.kind.startsWith('instructions');
+      if (isInstr) { checkInstructions(add, path, text); continue; }
+      let cfg;
+      if (loc.kind === 'codex') cfg = parseToml(text); else cfg = parseJsonLoose(text);
+      // tokens anywhere in the file (MCP-specific findings come first and win dedupe below)
+      const before = findings.length;
+      if (cfg) {
+        for (const [name, def] of servers(cfg)) checkServer(add, path, text, name, def);
+        if (loc.kind === 'claude-json') {
+          const proj = cfg.projects?.[cwd] || cfg.projects?.[cwd.split(sep).join('/')];
+          if (proj) for (const [name, def] of servers(proj)) checkServer(add, path, text, name, def);
+        }
+        if (loc.kind === 'claude-settings') {
+          claudeSeen = true; claudeFiles.push(path);
+          const perm = cfg.permissions || {};
+          const deny = Array.isArray(perm.deny) ? perm.deny : [];
+          claudeDeny.push(...deny);
+          if (perm.defaultMode === 'bypassPermissions' && (loc.scope === 'user' || loc.scope === 'managed')) add('perm-bypass', path, lineOf(text, 'defaultMode'), 'permissions.defaultMode = "bypassPermissions"');
+          if (cfg.skipDangerousModePermissionPrompt === true) add('perm-bypass', path, lineOf(text, 'skipDangerousModePermissionPrompt'), 'skipDangerousModePermissionPrompt = true');
+          checkPermissions(add, path, text, Array.isArray(perm.allow) ? perm.allow : []);
+          for (const [k, v] of Object.entries(cfg.env || {})) {
+            if (typeof v === 'string' && !isReference(v) && (findToken(v) || (SECRET_NAME.test(k) && v.length >= 12))) add('config-token', path, lineOf(text, `"${k}"`), `env.${k} = ${mask(findToken(v)?.value || v)}`, findToken(v)?.value || v);
+          }
+        }
+        if (loc.kind === 'claude-json' && cfg.bypassPermissionsModeAccepted === true) { /* informational only */ }
+        if (loc.kind === 'cursor-cli') checkPermissions(add, path, text, Array.isArray(cfg.permissions?.allow) ? cfg.permissions.allow : [], 'Shell');
+        if (loc.kind === 'codex') {
+          const ap = cfg.approval_policy, sb = cfg.sandbox_mode;
+          if (ap === 'never' && sb === 'danger-full-access') add('perm-bypass', path, lineOf(text, 'sandbox_mode'), 'approval_policy = "never" with sandbox_mode = "danger-full-access"');
+          else if (sb === 'danger-full-access') add('perm-bypass', path, lineOf(text, 'sandbox_mode'), 'sandbox_mode = "danger-full-access" (no sandbox)');
+          for (const [pname, prof] of Object.entries(cfg.profiles || {})) if (prof?.sandbox_mode === 'danger-full-access') add('perm-bypass', path, lineOf(text, `profiles.${pname}`, 'sandbox_mode'), `profile "${pname}": sandbox_mode = "danger-full-access"`);
+        }
+      }
+      // generic token scan for every config file, skipping lines already reported as a secret
+      const reported = new Set(findings.slice(before).filter((f) => f.id === 'mcp-plaintext-secret' || f.id === 'config-token').map((f) => f.line));
+      text.split('\n').forEach((l, i) => {
+        if (reported.has(i + 1)) return;
+        const t = findToken(l);
+        if (t) add('config-token', path, i + 1, `${t.name} = ${mask(t.value)}`, t.value);
+      });
+      // POSIX permissions: home-dir agent configs readable by group/others
+      if (platform !== 'win32' && (loc.scope === 'user') && (mode & 0o044)) {
+        const secretInside = findings.some((f) => f.file === path && (f.id === 'config-token' || f.id === 'mcp-plaintext-secret'));
+        if (secretInside || loc.kind === 'claude-json') add('config-world-readable', path, 1, `mode ${(mode & 0o777).toString(8)}${secretInside ? ', contains secrets' : ', holds your sign-in session'}`);
+      }
+    }
+  }
+  // Claude Code deny rules for secret files (only if Claude Code settings exist)
+  if (claudeSeen) {
+    const d = claudeDeny.join(' ');
+    const missing = [['.env', /\.env/], ['~/.ssh', /\.ssh/], ['~/.aws', /\.aws/]].filter(([, re]) => !re.test(d)).map(([n]) => n);
+    if (missing.length) add('perm-no-deny-secrets', claudeFiles[0], 1, `no deny rule for ${missing.join(', ')}`);
+  }
+  // .env in the project (top level and one level down)
+  if (cwd !== home) {
+    const envs = [];
+    const scan = (dir, depth) => {
+      try {
+        for (const e of readdirSync(dir, { withFileTypes: true })) {
+          if (e.isFile() && /^\.env(?:\.(?!example$|sample$|template$|dist$|defaults$)[\w.-]+)?$/.test(e.name)) envs.push(join(dir, e.name));
+          else if (e.isDirectory() && depth > 0 && !/^(?:node_modules|\.git|dist|build|\.venv|venv|vendor)$/.test(e.name) && !e.name.startsWith('.')) scan(join(dir, e.name), depth - 1);
+        }
+      } catch { /* unreadable */ }
+    };
+    scan(cwd, 1);
+    for (const f of envs) add('project-dotenv', f, 1, relative(cwd, f));
+  }
+  findings.sort((a, b) => SEVERITIES.indexOf(b.severity) - SEVERITIES.indexOf(a.severity) || a.file.localeCompare(b.file) || a.line - b.line);
+  const counts = Object.fromEntries(SEVERITIES.map((s) => [s, findings.filter((f) => f.severity === s).length]));
+  // Each rule costs its full weight once, then 2 points per extra occurrence.
+  const byRule = {};
+  for (const f of findings) byRule[f.id] = (byRule[f.id] || 0) + 1;
+  const score = Math.max(0, 100 - Object.entries(byRule).reduce((n, [id, k]) => n + WEIGHT[R[id].severity] + 2 * (k - 1), 0));
+  return { score, grade: score >= 90 ? 'A' : score >= 75 ? 'B' : score >= 60 ? 'C' : score >= 40 ? 'D' : 'F', counts, tools: [...tools], files, findings };
+}
+
+// ---------- output ----------
+export const CTA = 'Turn these into enforced policies: npx @vulnify/cli hook claude-code / vulnify.io';
+export function format(result, { home = homedir(), cwd = process.cwd(), color = false } = {}) {
+  const c = (code, s) => (color ? `\x1b[${code}m${s}\x1b[0m` : s);
+  const SEV = { critical: '1;31', high: '31', medium: '33', low: '36' };
+  const under = (p, base) => p.startsWith(base + sep) || p.startsWith(base + '/');
+  const short = (p) => (under(p, cwd) && cwd !== home ? '.' + p.slice(cwd.length) : under(p, home) ? '~' + p.slice(home.length) : p);
+  const out = [c('1', 'Vulnify audit') + c('2', '  read-only, nothing left this machine')];
+  out.push(c('2', `Checked ${result.files.length} config file${result.files.length === 1 ? '' : 's'}` + (result.tools.length ? ` (${result.tools.join(', ')})` : ' (no AI agent configs found)')));
+  out.push('');
+  if (!result.findings.length) out.push(c('32', 'No findings.'), '');
+  const groups = new Map();
+  for (const f of result.findings) groups.set(f.id, [...(groups.get(f.id) || []), f]);
+  for (const [, fs] of groups) {
+    const f = fs[0];
+    out.push(`${c(SEV[f.severity], f.severity.toUpperCase().padEnd(8))} ${c('1', f.title)}`);
+    for (const x of fs) out.push(`  ${short(x.file)}:${x.line}  ${c('2', x.detail)}`);
+    out.push(`  Why: ${f.why}`, `  Fix: ${f.fix}`, '');
+  }
+  const parts = SEVERITIES.slice().reverse().filter((s) => result.counts[s]).map((s) => `${result.counts[s]} ${s}`);
+  out.push(`${c('1', `Score ${result.score}/100 (${result.grade})`)}${parts.length ? '  ' + parts.join(', ') : ''}`);
+  out.push(CTA);
+  return out.join('\n');
+}
+
+export function shouldFail(result, failOn) {
+  if (!failOn) return false;
+  const min = SEVERITIES.indexOf(failOn);
+  return result.findings.some((f) => SEVERITIES.indexOf(f.severity) >= min);
+}

package/package.json

@@ -1,6 +1,19 @@
-{
-  "name": "@vulnify/cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "@vulnify/cli",
+  "version": "0.2.0",
+  "description": "Vulnify CLI: audit the AI agents on your machine (read-only, local) and install the fail-closed Vulnify hook into Claude Code.",
+  "license": "MIT",
+  "type": "module",
+  "bin": { "vulnify-cli": "bin/vulnify-cli.mjs" },
+  "files": ["bin", "lib", "hook", "README.md"],
+  "engines": { "node": ">=18" },
+  "repository": { "type": "git", "url": "git+https://github.com/vulnify/vulnify-examples.git", "directory": "cli" },
+  "homepage": "https://docs.vulnify.io/mcp/claude-code-hook/",
+  "keywords": ["vulnify", "claude-code", "hooks", "pretooluse", "ai-agents", "guardrails", "security", "audit", "mcp", "cursor", "codex"],
+  "publishConfig": { "access": "public" },
+  "scripts": {
+    "sync-hook": "node -e \"require('fs').mkdirSync('hook',{recursive:true});require('fs').copyFileSync('../claude-code-hook/vulnify-hook.mjs','hook/vulnify-hook.mjs')\"",
+    "prepack": "npm run sync-hook",
+    "test": "npm run sync-hook && node --test"
+  }
+}