agentaudit 3.10.8 → 3.10.10

package/cli.mjs

@@ -435,26 +435,31 @@ function singleSelect(items, { title = 'Select', hint = '↑↓=move  Enter=sele
   });
 }
 
-async function registerAgent(agentName) {
-  const res = await fetch(`${REGISTRY_URL}/api/register`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ agent_name: agentName }),
-    signal: AbortSignal.timeout(15_000),
-  });
-  if (!res.ok) throw new Error(`Registration failed (HTTP ${res.status}): ${await res.text()}`);
-  return res.json();
+async function validateApiKey(apiKey) {
+  try {
+    const res = await fetch(`${REGISTRY_URL}/api/auth/validate`, {
+      headers: { 'Authorization': `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(10_000),
+    });
+    if (res.ok) {
+      const data = await res.json();
+      return { valid: true, agent_name: data.agent_name || null };
+    }
+    return { valid: false, agent_name: null };
+  } catch {
+    return { valid: false, agent_name: null };
+  }
 }
 
 async function setupCommand() {
-  console.log(`  ${c.bold}AgentAudit Login${c.reset}`);
-  console.log(`  ${c.dim}Create an account to upload audit reports to agentaudit.dev${c.reset}`);
+  console.log(`  ${c.bold}AgentAudit Setup${c.reset}`);
+  console.log(`  ${c.dim}Link your API key to upload audit reports to agentaudit.dev${c.reset}`);
   console.log();
 
   const existing = loadCredentials();
   if (existing) {
-    console.log(`  ${icons.safe}  Already logged in as ${c.bold}${existing.agent_name}${c.reset}`);
-    console.log(`  ${c.dim}Key: ${existing.api_key.slice(0, 8)}...${c.reset}`);
+    console.log(`  ${icons.safe}  Already configured as ${c.bold}${existing.agent_name}${c.reset}`);
+    console.log(`  ${c.dim}Key: ${existing.api_key.slice(0, 12)}...${c.reset}`);
     console.log();
     const answer = await askQuestion(`  Reconfigure? ${c.dim}(y/N)${c.reset} `);
     if (answer.toLowerCase() !== 'y') {
@@ -464,39 +469,28 @@ async function setupCommand() {
     console.log();
   }
 
-  console.log(`  ${c.bold}1)${c.reset} Register new agent ${c.dim}(free, creates API key automatically)${c.reset}`);
-  console.log(`  ${c.bold}2)${c.reset} Enter existing API key`);
-  console.log();
-  const choice = await askQuestion(`  Choice ${c.dim}(1/2)${c.reset}: `);
+  console.log(`  ${c.bold}Step 1:${c.reset} Create an API key at ${c.cyan}${REGISTRY_URL}/profile${c.reset}`);
+  console.log(`  ${c.dim}Sign in with GitHub, then click "Create API Key".${c.reset}`);
   console.log();
+  const key = await askQuestion(`  ${c.bold}Step 2:${c.reset} Paste your API key here: `);
+  if (!key || !key.trim()) {
+    console.log(`  ${c.red}No key entered.${c.reset}`);
+    return;
+  }
 
-  if (choice === '2') {
-    const key = await askQuestion(`  API Key: `);
-    if (!key) { console.log(`  ${c.red}No key entered.${c.reset}`); return; }
-    const name = await askQuestion(`  Agent name ${c.dim}(optional)${c.reset}: `);
-    saveCredentials({ api_key: key, agent_name: name || 'custom' });
+  process.stdout.write(`  Validating...`);
+  const validation = await validateApiKey(key.trim());
+  if (validation.valid) {
+    const agentName = validation.agent_name || 'agent';
+    saveCredentials({ api_key: key.trim(), agent_name: agentName });
+    console.log(` ${c.green}valid!${c.reset}`);
     console.log();
-    console.log(`  ${icons.safe}  Saved! Key stored in ${c.dim}${USER_CRED_FILE}${c.reset}`);
+    console.log(`  ${icons.safe}  Logged in as ${c.bold}${agentName}${c.reset}`);
+    console.log(`  ${c.dim}Key saved to: ${USER_CRED_FILE}${c.reset}`);
   } else {
-    const name = await askQuestion(`  Agent name ${c.dim}(e.g. my-scanner, claude-desktop)${c.reset}: `);
-    if (!name || !/^[a-zA-Z0-9._-]{2,64}$/.test(name)) {
-      console.log(`  ${c.red}Invalid name. Use 2-64 chars: letters, numbers, dash, underscore, dot.${c.reset}`);
-      return;
-    }
-    process.stdout.write(`  Registering ${c.bold}${name}${c.reset}...`);
-    try {
-      const data = await registerAgent(name);
-      saveCredentials({ api_key: data.api_key, agent_name: data.agent_name });
-      console.log(` ${c.green}done!${c.reset}`);
-      console.log();
-      console.log(`  ${icons.safe}  Registered as ${c.bold}${data.agent_name}${c.reset}`);
-      console.log(`  ${c.dim}Key: ${data.api_key.slice(0, 12)}...${c.reset}`);
-      console.log(`  ${c.dim}Saved to: ${USER_CRED_FILE}${c.reset}`);
-    } catch (err) {
-      console.log(` ${c.red}failed${c.reset}`);
-      console.log(`  ${c.red}${err.message}${c.reset}`);
-      return;
-    }
+    console.log(` ${c.red}invalid${c.reset}`);
+    console.log(`  ${c.red}Key not recognized. Make sure you copied the full key from ${REGISTRY_URL}/profile${c.reset}`);
+    return;
   }
 
   console.log();
@@ -1056,7 +1050,7 @@ function quickChecks(files) {
 
 async function checkRegistry(slug) {
   try {
-    const res = await fetch(`${REGISTRY_URL}/api/skills/${encodeURIComponent(slug)}`, {
+    const res = await fetch(`${REGISTRY_URL}/api/packages/${encodeURIComponent(slug)}`, {
       signal: AbortSignal.timeout(5000),
     });
     if (res.ok) return await res.json();
@@ -1146,7 +1140,7 @@ function printScanResult(url, info, files, findings, registryData, duration) {
   if (registryData) {
     const rd = registryData;
     const riskScore = rd.risk_score ?? rd.latest_risk_score ?? 0;
-    console.log(`${icons.treeLast}  ${c.dim}registry${c.reset}  ${riskBadge(riskScore)} Risk ${riskScore}  ${c.dim}${REGISTRY_URL}/skills/${slug}${c.reset}`);
+    console.log(`${icons.treeLast}  ${c.dim}registry${c.reset}  ${riskBadge(riskScore)} Risk ${riskScore}  ${c.dim}${REGISTRY_URL}/packages/${slug}${c.reset}`);
   } else {
     console.log(`${icons.treeLast}  ${c.dim}registry${c.reset}  ${c.dim}not audited yet${c.reset}`);
   }
@@ -1533,7 +1527,7 @@ async function discoverCommand(options = {}) {
         const riskScore = regData.risk_score ?? regData.latest_risk_score ?? 0;
         const hasOfficial = regData.has_official_audit;
         console.log(`${branch}  ${c.bold}${server.name}${c.reset}    ${sourceLabel}`);
-        console.log(`${pipe}  ${riskBadge(riskScore)} Risk ${riskScore}  ${hasOfficial ? `${c.green}✔ official${c.reset}  ` : ''}${c.dim}${REGISTRY_URL}/skills/${slug}${c.reset}`);
+        console.log(`${pipe}  ${riskBadge(riskScore)} Risk ${riskScore}  ${hasOfficial ? `${c.green}✔ official${c.reset}  ` : ''}${c.dim}${REGISTRY_URL}/packages/${slug}${c.reset}`);
         if (resolvedUrl) allServersWithUrls.push({ name: server.name, sourceUrl: resolvedUrl, hasAudit: true, regData });
       } else {
         unauditedServers++;
@@ -1970,7 +1964,12 @@ async function auditRepo(url) {
   ).digest('hex');
   // Code-based type detection (uses files array in memory + repoPath for context)
   const pkgInfo = detectPackageInfo(repoPath, files);
-  const detectedType = pkgInfo.type === 'unknown' ? 'other' : pkgInfo.type;
+  // Known MCP frameworks are libraries, not servers (they contain MCP patterns but ARE the SDK)
+  const KNOWN_MCP_LIBS = new Set(['fastmcp', 'jlowin-fastmcp', 'mcp-go', 'fastapi-mcp', 'fastapi_mcp', 'mcp-use', 'mcp-agent']);
+  const KNOWN_CLI = new Set(['mcp-cli', 'mcp-scan', 'inspector']);
+  let detectedType = pkgInfo.type === 'unknown' ? 'other' : pkgInfo.type;
+  if (KNOWN_MCP_LIBS.has(slug)) detectedType = 'library';
+  if (KNOWN_CLI.has(slug)) detectedType = 'cli-tool';
 
   // Cleanup repo (safe now — provenance data captured above)
   try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
@@ -2041,7 +2040,7 @@ async function auditRepo(url) {
       if (res.ok) {
         const data = await res.json();
         console.log(` ${c.green}done${c.reset}`);
-        console.log(`  ${c.dim}Report: ${REGISTRY_URL}/skills/${slug}${c.reset}`);
+        console.log(`  ${c.dim}Report: ${REGISTRY_URL}/packages/${slug}${c.reset}`);
       } else {
         let errBody = '';
         try { errBody = await res.text(); } catch {}
@@ -2054,27 +2053,22 @@ async function auditRepo(url) {
       console.log(` ${c.yellow}failed${c.reset}`);
     }
   } else if (process.stdin.isTTY) {
-    // No credentials — offer inline registration
-    console.log();
-    console.log(`  ${c.bold}Share this audit with the community?${c.reset}`);
-    console.log(`  ${c.dim}Uploading helps others assess package security. Account is free.${c.reset}`);
+    // No credentials — prompt to paste key or set up
     console.log();
-    console.log(`  ${c.bold}1)${c.reset} Create account + upload ${c.dim}(free)${c.reset}`);
-    console.log(`  ${c.bold}2)${c.reset} Skip`);
+    console.log(`  ${c.bold}Want to upload this report to agentaudit.dev?${c.reset}`);
+    console.log(`  ${c.dim}Create an API key at ${c.cyan}${REGISTRY_URL}/profile${c.dim} (sign in with GitHub)${c.reset}`);
     console.log();
-    const uploadChoice = await askQuestion(`  Choice ${c.dim}(1/2)${c.reset}: `);
-    if (uploadChoice === '1') {
-      const name = await askQuestion(`  Agent name ${c.dim}(e.g. my-scanner, claude-desktop)${c.reset}: `);
-      if (!name || !/^[a-zA-Z0-9._-]{2,64}$/.test(name)) {
-        console.log(`  ${c.red}Invalid name. Use 2-64 chars: letters, numbers, dash, underscore, dot.${c.reset}`);
-      } else {
+    const pastedKey = await askQuestion(`  Paste API key ${c.dim}(or Enter to skip)${c.reset}: `);
+    if (pastedKey && pastedKey.trim()) {
+      process.stdout.write(`  Validating...`);
+      const validation = await validateApiKey(pastedKey.trim());
+      if (validation.valid) {
+        const agentName = validation.agent_name || 'agent';
+        saveCredentials({ api_key: pastedKey.trim(), agent_name: agentName });
+        creds = { api_key: pastedKey.trim(), agent_name: agentName };
+        console.log(` ${c.green}valid!${c.reset}`);
+        process.stdout.write(`  Uploading report...`);
         try {
-          process.stdout.write(`  Registering ${c.bold}${name}${c.reset}...`);
-          const regData = await registerAgent(name);
-          saveCredentials({ api_key: regData.api_key, agent_name: regData.agent_name });
-          console.log(` ${c.green}done!${c.reset}`);
-          creds = { api_key: regData.api_key, agent_name: regData.agent_name };
-          process.stdout.write(`  Uploading report...`);
           const res = await fetch(`${REGISTRY_URL}/api/reports`, {
             method: 'POST',
             headers: {
@@ -2086,7 +2080,7 @@ async function auditRepo(url) {
           });
           if (res.ok) {
             console.log(` ${c.green}done${c.reset}`);
-            console.log(`  ${c.dim}Report: ${REGISTRY_URL}/skills/${slug}${c.reset}`);
+            console.log(`  ${c.dim}Report: ${REGISTRY_URL}/packages/${slug}${c.reset}`);
           } else {
             console.log(` ${c.yellow}failed (HTTP ${res.status})${c.reset}`);
           }
@@ -2094,10 +2088,13 @@ async function auditRepo(url) {
           console.log(` ${c.red}failed${c.reset}`);
           console.log(`  ${c.dim}${err.message}${c.reset}`);
         }
+      } else {
+        console.log(` ${c.red}invalid key${c.reset}`);
+        console.log(`  ${c.dim}Run ${c.cyan}agentaudit setup${c.dim} to configure.${c.reset}`);
       }
     }
   } else {
-    console.log(`  ${c.dim}Run ${c.cyan}agentaudit setup${c.dim} to create an account and upload reports${c.reset}`);
+    console.log(`  ${c.dim}Run ${c.cyan}agentaudit setup${c.dim} to configure your API key and upload reports${c.reset}`);
   }
   
   console.log();
@@ -2126,7 +2123,7 @@ async function checkPackage(name) {
     console.log(`  ${c.bold}${name}${c.reset}  ${riskBadge(riskScore)}`);
     console.log(`  ${c.dim}Risk Score: ${riskScore}/100${c.reset}`);
     if (data.source_url) console.log(`  ${c.dim}Source: ${data.source_url}${c.reset}`);
-    console.log(`  ${c.dim}Registry: ${REGISTRY_URL}/skills/${name}${c.reset}`);
+    console.log(`  ${c.dim}Registry: ${REGISTRY_URL}/packages/${name}${c.reset}`);
     if (data.has_official_audit) console.log(`  ${c.green}✔ Officially audited${c.reset}`);
     console.log();
   }

package/index.mjs

@@ -292,7 +292,7 @@ async function resolveSourceUrl(server) {
 
 async function checkRegistry(slug) {
   try {
-    const res = await fetch(`${REGISTRY_URL}/api/skills/${encodeURIComponent(slug)}`, {
+    const res = await fetch(`${REGISTRY_URL}/api/packages/${encodeURIComponent(slug)}`, {
       signal: AbortSignal.timeout(5000),
     });
     if (res.ok) return await res.json();
@@ -303,7 +303,7 @@ async function checkRegistry(slug) {
 // ── MCP Server ───────────────────────────────────────────
 
 const server = new Server(
-  { name: 'agentaudit', version: '3.9.8' },
+  { name: 'agentaudit', version: '3.10.9' },
   { capabilities: { tools: {} } }
 );
 
@@ -413,7 +413,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
               const risk = regData.risk_score ?? regData.latest_risk_score ?? 0;
               const official = regData.has_official_audit ? ' (official)' : '';
               text += `- **Registry: ✅ Audited** — Risk ${risk}/100${official}\n`;
-              text += `- Report: ${REGISTRY_URL}/skills/${slug}\n`;
+              text += `- Report: ${REGISTRY_URL}/packages/${slug}\n`;
             } else {
               const sourceUrl = await resolveSourceUrl(srv);
               text += `- **Registry: ⚠️ Not audited** — no audit report found\n`;
@@ -457,7 +457,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
         // Compute provenance data
         const pkgInfo = detectPackageInfo(repoPath, files);
-        const detectedType = pkgInfo.type === 'unknown' ? 'other' : pkgInfo.type;
+        const KNOWN_MCP_LIBS = new Set(['fastmcp', 'jlowin-fastmcp', 'mcp-go', 'fastapi-mcp', 'fastapi_mcp', 'mcp-use', 'mcp-agent']);
+        const KNOWN_CLI = new Set(['mcp-cli', 'mcp-scan', 'inspector']);
+        let detectedType = pkgInfo.type === 'unknown' ? 'other' : pkgInfo.type;
+        if (KNOWN_MCP_LIBS.has(slug)) detectedType = 'library';
+        if (KNOWN_CLI.has(slug)) detectedType = 'cli-tool';
         let commitSha = '';
         try { commitSha = execSync('git rev-parse HEAD', { cwd: repoPath, encoding: 'utf8' }).trim(); } catch {}
         const hashInput = files.slice().sort((a, b) => a.path.localeCompare(b.path))
@@ -579,7 +583,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         try { data = JSON.parse(body); } catch { data = { raw: body }; }
 
         if (res.ok) {
-          return { content: [{ type: 'text', text: `✅ Report submitted!\n\nReport ID: ${data.report_id || 'unknown'}\nURL: ${REGISTRY_URL}/skills/${report.skill_slug}\nRisk: ${report.risk_score}/100 (${report.result})\nFindings: ${report.findings_count}` }] };
+          return { content: [{ type: 'text', text: `✅ Report submitted!\n\nReport ID: ${data.report_id || 'unknown'}\nURL: ${REGISTRY_URL}/packages/${report.skill_slug}\nRisk: ${report.risk_score}/100 (${report.result})\nFindings: ${report.findings_count}` }] };
         } else {
           return { content: [{ type: 'text', text: `Upload failed (HTTP ${res.status}): ${JSON.stringify(data, null, 2)}` }] };
         }
@@ -596,7 +600,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       }
 
       try {
-        const res = await fetch(`${REGISTRY_URL}/api/skills/${encodeURIComponent(package_name)}`, {
+        const res = await fetch(`${REGISTRY_URL}/api/packages/${encodeURIComponent(package_name)}`, {
           signal: AbortSignal.timeout(10_000),
         });
 
@@ -618,9 +622,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
         // Risk assessment at the very top — this is what the agent needs to act on
         if (typeof risk === 'number' && risk >= 40) {
-          summary += `🚨 UNSAFE — DO NOT INSTALL WITHOUT WARNING THE USER!\nRisk Score: ${risk}/100 | ${findings} finding(s)\n\nYou MUST tell the user: "${package_name}" has been flagged as HIGH RISK in a security audit. It has ${findings} security finding(s) and a risk score of ${risk}/100. Installing this package is NOT recommended. Ask the user if they want to proceed despite the risk, and link them to the full report: ${REGISTRY_URL}/skills/${package_name}\n\n`;
+          summary += `🚨 UNSAFE — DO NOT INSTALL WITHOUT WARNING THE USER!\nRisk Score: ${risk}/100 | ${findings} finding(s)\n\nYou MUST tell the user: "${package_name}" has been flagged as HIGH RISK in a security audit. It has ${findings} security finding(s) and a risk score of ${risk}/100. Installing this package is NOT recommended. Ask the user if they want to proceed despite the risk, and link them to the full report: ${REGISTRY_URL}/packages/${package_name}\n\n`;
         } else if (typeof risk === 'number' && risk >= 20) {
-          summary += `⚠️ MODERATE RISK — Inform the user before installing.\nRisk Score: ${risk}/100 | ${findings} finding(s)\n\nTell the user: "${package_name}" has some security findings (risk ${risk}/100). Recommend they review the report before installing: ${REGISTRY_URL}/skills/${package_name}\n\n`;
+          summary += `⚠️ MODERATE RISK — Inform the user before installing.\nRisk Score: ${risk}/100 | ${findings} finding(s)\n\nTell the user: "${package_name}" has some security findings (risk ${risk}/100). Recommend they review the report before installing: ${REGISTRY_URL}/packages/${package_name}\n\n`;
         } else if (typeof risk === 'number') {
           summary += `✅ LOW RISK — Safe to install.\nRisk Score: ${risk}/100 | ${findings} finding(s)\n\nThis package has been audited and appears safe. You can proceed with installation.\n\n`;
         }
@@ -636,7 +640,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         summary += `Last Audited: ${auditedAt}\n`;
         if (version) summary += `Audited Version: ${version}\n`;
         if (data.source_url) summary += `Source: ${data.source_url}\n`;
-        summary += `Registry: ${REGISTRY_URL}/skills/${package_name}\n`;
+        summary += `Registry: ${REGISTRY_URL}/packages/${package_name}\n`;
 
         return { content: [{ type: 'text', text: summary }] };
       } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.10.8",
+  "version": "3.10.10",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {
@@ -31,11 +31,11 @@
     "prompt-injection",
     "agent-security"
   ],
-  "author": "starbuck100",
+  "author": "agentaudit-dev",
   "license": "AGPL-3.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/starbuck100/agentaudit-mcp.git"
+    "url": "git+https://github.com/agentaudit-dev/agentaudit-mcp.git"
   },
   "homepage": "https://agentaudit.dev",
   "engines": {