agentaudit 3.4.0 → 3.6.0

package/cli.mjs

@@ -14,6 +14,7 @@
  */
 
 import fs from 'fs';
+import os from 'os';
 import path from 'path';
 import { execSync } from 'child_process';
 import { createInterface } from 'readline';
@@ -573,15 +574,18 @@ async function scanRepo(url) {
   process.stdout.write(`${icons.scan}  Scanning ${c.bold}${slug}${c.reset} ${c.dim}...${c.reset}`);
   
   // Clone
-  const tmpDir = fs.mkdtempSync('/tmp/agentaudit-');
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentaudit-'));
   const repoPath = path.join(tmpDir, 'repo');
   try {
-    execSync(`git clone --depth 1 "${url}" "${repoPath}" 2>/dev/null`, {
+    execSync(`git clone --depth 1 "${url}" "${repoPath}"`, {
       timeout: 30_000,
       stdio: 'pipe',
     });
   } catch (err) {
     process.stdout.write(`  ${c.red}✖ clone failed${c.reset}\n`);
+    const msg = err.stderr?.toString().trim() || err.message?.split('\n')[0] || '';
+    if (msg) console.log(`    ${c.dim}${msg}${c.reset}`);
+    console.log(`    ${c.dim}Make sure git is installed and the URL is accessible.${c.reset}`);
     return null;
   }
   
@@ -598,7 +602,7 @@ async function scanRepo(url) {
   const registryData = await checkRegistry(slug);
   
   // Cleanup
-  try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+  try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
   
   const duration = elapsed(start);
   
@@ -702,6 +706,19 @@ function extractServersFromConfig(config) {
     const pyMatch = allArgs.match(/(?:uvx|pip run|python -m)\s+(@?[a-z0-9][\w./-]*)/i);
     if (pyMatch) info.pyPackage = pyMatch[1];
     
+    // URL-based MCP server (remote HTTP)
+    if (info.url && !info.npmPackage && !info.pyPackage) {
+      try {
+        const parsed = new URL(info.url);
+        // Extract service name from hostname: mcp.supabase.com → supabase
+        const hostParts = parsed.hostname.split('.');
+        if (hostParts.length >= 2) {
+          const serviceName = hostParts.length === 3 ? hostParts[1] : hostParts[0];
+          info.remoteService = serviceName;
+        }
+      } catch {}
+    }
+    
     result.push(info);
   }
   return result;
@@ -753,6 +770,39 @@ async function resolveSourceUrl(server) {
     return `https://pypi.org/project/${server.pyPackage}/`;
   }
   
+  // URL-based remote MCP server — try GitHub search by service name
+  if (server.remoteService) {
+    // Try npm registry with common MCP naming patterns
+    for (const tryName of [
+      `@${server.remoteService}/mcp-server-${server.remoteService}`,
+      `${server.remoteService}-mcp`,
+      `mcp-server-${server.remoteService}`,
+      server.remoteService,
+    ]) {
+      try {
+        const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(tryName)}`, {
+          signal: AbortSignal.timeout(3000),
+        });
+        if (res.ok) {
+          const data = await res.json();
+          let repoUrl = data.repository?.url;
+          if (repoUrl) {
+            repoUrl = repoUrl.replace(/^git\+/, '').replace(/\.git$/, '').replace(/^ssh:\/\/git@github\.com/, 'https://github.com');
+            if (repoUrl.startsWith('http')) return repoUrl;
+          }
+        }
+      } catch {}
+    }
+  }
+  
+  // Last resort: if server has a url, show it as context
+  if (server.url) {
+    try {
+      const parsed = new URL(server.url);
+      return `https://github.com/search?q=${encodeURIComponent(parsed.hostname + ' MCP')}&type=repositories`;
+    } catch {}
+  }
+  
   return null;
 }
 
@@ -821,6 +871,7 @@ async function discoverCommand() {
       let sourceLabel = '';
       if (server.npmPackage) sourceLabel = `${c.dim}npm:${server.npmPackage}${c.reset}`;
       else if (server.pyPackage) sourceLabel = `${c.dim}pip:${server.pyPackage}${c.reset}`;
+      else if (server.url) sourceLabel = `${c.dim}${server.url.length > 60 ? server.url.slice(0, 57) + '...' : server.url}${c.reset}`;
       else if (server.command) sourceLabel = `${c.dim}${[server.command, ...server.args.slice(0, 2)].join(' ')}${c.reset}`;
       
       if (regData) {
@@ -890,15 +941,18 @@ async function auditRepo(url) {
   
   // Step 1: Clone
   process.stdout.write(`  ${c.dim}[1/4]${c.reset} Cloning repository...`);
-  const tmpDir = fs.mkdtempSync('/tmp/agentaudit-');
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentaudit-'));
   const repoPath = path.join(tmpDir, 'repo');
   try {
-    execSync(`git clone --depth 1 "${url}" "${repoPath}" 2>/dev/null`, {
+    execSync(`git clone --depth 1 "${url}" "${repoPath}"`, {
       timeout: 30_000, stdio: 'pipe',
     });
     console.log(` ${c.green}done${c.reset}`);
-  } catch {
+  } catch (err) {
     console.log(` ${c.red}failed${c.reset}`);
+    const msg = err.stderr?.toString().trim() || err.message?.split('\n')[0] || '';
+    if (msg) console.log(`    ${c.dim}${msg}${c.reset}`);
+    console.log(`    ${c.dim}Make sure git is installed and the URL is accessible.${c.reset}`);
     return null;
   }
   
@@ -938,6 +992,10 @@ async function auditRepo(url) {
     console.log(`  ${c.dim}$env:ANTHROPIC_API_KEY = "sk-ant-..."${c.reset}`);
     console.log(`  ${c.dim}$env:OPENAI_API_KEY = "sk-..."${c.reset}`);
     console.log();
+    console.log(`  ${c.dim}# Windows (CMD):${c.reset}`);
+    console.log(`  ${c.dim}set ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
+    console.log(`  ${c.dim}set OPENAI_API_KEY=sk-...${c.reset}`);
+    console.log();
     console.log(`  ${c.bold}Option 2: Export for manual review${c.reset}`);
     console.log(`  ${c.cyan}agentaudit audit ${url} --export${c.reset}`);
     console.log(`  ${c.dim}Creates a markdown file you can paste into any LLM (Claude, ChatGPT, etc.)${c.reset}`);
@@ -976,7 +1034,7 @@ async function auditRepo(url) {
     }
     
     // Cleanup
-    try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
     return null;
   }
   
@@ -1050,12 +1108,12 @@ async function auditRepo(url) {
   } catch (err) {
     console.log(` ${c.red}failed${c.reset}`);
     console.log(`  ${c.red}${err.message}${c.reset}`);
-    try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
     return null;
   }
   
   // Cleanup repo
-  try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+  try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
   
   if (!report) {
     console.log(`  ${c.red}Could not parse LLM response as JSON${c.reset}`);
@@ -1142,6 +1200,11 @@ async function checkPackage(name) {
 async function main() {
   const args = process.argv.slice(2);
   
+  if (args[0] === '-v' || args[0] === '--version') {
+    console.log(`agentaudit ${getVersion()}`);
+    process.exit(0);
+  }
+  
   if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
     banner();
     console.log(`  ${c.bold}Commands:${c.reset}`);
@@ -1162,6 +1225,19 @@ async function main() {
     console.log(`    agentaudit audit https://github.com/owner/repo`);
     console.log(`    agentaudit check fastmcp`);
     console.log();
+    console.log(`  ${c.bold}For deep audits,${c.reset} set an LLM API key:`);
+    if (process.platform === 'win32') {
+      console.log(`    ${c.dim}PowerShell:  $env:ANTHROPIC_API_KEY = "sk-ant-..."${c.reset}`);
+      console.log(`    ${c.dim}CMD:         set ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
+      console.log(`    ${c.dim}(or use OPENAI_API_KEY instead)${c.reset}`);
+    } else {
+      console.log(`    ${c.dim}export ANTHROPIC_API_KEY=sk-ant-...${c.reset}    ${c.dim}(or OPENAI_API_KEY)${c.reset}`);
+    }
+    console.log();
+    console.log(`  ${c.bold}Or use as MCP server${c.reset} in Cursor/Claude ${c.dim}(no extra API key needed):${c.reset}`);
+    console.log(`    ${c.dim}Add to your MCP config:${c.reset}`);
+    console.log(`    ${c.dim}{ "agentaudit": { "command": "npx", "args": ["-y", "agentaudit"] } }${c.reset}`);
+    console.log();
     process.exit(0);
   }
   

package/index.mjs

@@ -25,6 +25,7 @@ import {
   ListToolsRequestSchema,
 } from '@modelcontextprotocol/sdk/types.js';
 import fs from 'fs';
+import os from 'os';
 import path from 'path';
 import { execSync } from 'child_process';
 import { fileURLToPath } from 'url';
@@ -124,9 +125,9 @@ function collectFiles(dir, basePath = '', collected = [], totalSize = { bytes: 0
 // ── Repo Helpers ────────────────────────────────────────
 
 function cloneRepo(sourceUrl) {
-  const tmpDir = fs.mkdtempSync('/tmp/agentaudit-');
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentaudit-'));
   try {
-    execSync(`git clone --depth 1 "${sourceUrl}" "${tmpDir}/repo" 2>/dev/null`, {
+    execSync(`git clone --depth 1 "${sourceUrl}" "${tmpDir}/repo"`, {
       timeout: 30_000, stdio: 'pipe',
     });
     return path.join(tmpDir, 'repo');
@@ -136,7 +137,7 @@ function cloneRepo(sourceUrl) {
 }
 
 function cleanupRepo(repoPath) {
-  try { execSync(`rm -rf "${path.dirname(repoPath)}"`, { stdio: 'pipe' }); } catch {}
+  try { fs.rmSync(path.dirname(repoPath), { recursive: true, force: true }); } catch {}
 }
 
 function slugFromUrl(url) {
@@ -176,12 +177,21 @@ function discoverMcpServers() {
       const allArgs = [cfg.command, ...(cfg.args || [])].filter(Boolean).join(' ');
       const npxMatch = allArgs.match(/npx\s+(?:-y\s+)?(@?[a-z0-9][\w./-]*)/i);
       const pyMatch = allArgs.match(/(?:uvx|pip run|python -m)\s+(@?[a-z0-9][\w./-]*)/i);
+      let remoteService = null;
+      if (cfg.url) {
+        try {
+          const hostParts = new URL(cfg.url).hostname.split('.');
+          remoteService = hostParts.length === 3 ? hostParts[1] : hostParts[0];
+        } catch {}
+      }
       servers.push({
         name,
         command: cfg.command || null,
         args: cfg.args || [],
+        url: cfg.url || null,
         npm_package: npxMatch?.[1] || null,
         pip_package: pyMatch?.[1] || null,
+        remote_service: remoteService,
       });
     }
     results.push({ platform: c.platform, config_path: c.path, status: 'found', server_count: servers.length, servers });
@@ -221,6 +231,28 @@ async function resolveSourceUrl(server) {
     } catch {}
     return `https://pypi.org/project/${server.pip_package}/`;
   }
+  // URL-based remote MCP — try npm with common naming patterns
+  if (server.remote_service) {
+    for (const tryName of [
+      `@${server.remote_service}/mcp-server-${server.remote_service}`,
+      `${server.remote_service}-mcp`,
+      `mcp-server-${server.remote_service}`,
+    ]) {
+      try {
+        const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(tryName)}`, {
+          signal: AbortSignal.timeout(3000),
+        });
+        if (res.ok) {
+          const data = await res.json();
+          let repoUrl = data.repository?.url;
+          if (repoUrl) {
+            repoUrl = repoUrl.replace(/^git\+/, '').replace(/\.git$/, '');
+            if (repoUrl.startsWith('http')) return repoUrl;
+          }
+        }
+      } catch {}
+    }
+  }
   return null;
 }
 
@@ -332,9 +364,14 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             || srv.name.toLowerCase().replace(/[^a-z0-9-]/gi, '-');
 
           text += `### ${srv.name}\n`;
-          text += `- Command: \`${[srv.command, ...srv.args].join(' ')}\`\n`;
+          if (srv.url) {
+            text += `- URL: \`${srv.url}\`\n`;
+          } else {
+            text += `- Command: \`${[srv.command, ...srv.args].filter(Boolean).join(' ')}\`\n`;
+          }
           if (srv.npm_package) text += `- npm: ${srv.npm_package}\n`;
           if (srv.pip_package) text += `- pip: ${srv.pip_package}\n`;
+          if (srv.remote_service) text += `- Service: ${srv.remote_service}\n`;
 
           if (doRegistryCheck) {
             const regData = await checkRegistry(slug);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.4.0",
+  "version": "3.6.0",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {