agentaudit 3.5.0 → 3.7.0

package/cli.mjs

@@ -14,6 +14,7 @@
  */
 
 import fs from 'fs';
+import os from 'os';
 import path from 'path';
 import { execSync } from 'child_process';
 import { createInterface } from 'readline';
@@ -573,15 +574,18 @@ async function scanRepo(url) {
   process.stdout.write(`${icons.scan}  Scanning ${c.bold}${slug}${c.reset} ${c.dim}...${c.reset}`);
   
   // Clone
-  const tmpDir = fs.mkdtempSync('/tmp/agentaudit-');
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentaudit-'));
   const repoPath = path.join(tmpDir, 'repo');
   try {
-    execSync(`git clone --depth 1 "${url}" "${repoPath}" 2>/dev/null`, {
+    execSync(`git clone --depth 1 "${url}" "${repoPath}"`, {
       timeout: 30_000,
       stdio: 'pipe',
     });
   } catch (err) {
     process.stdout.write(`  ${c.red}✖ clone failed${c.reset}\n`);
+    const msg = err.stderr?.toString().trim() || err.message?.split('\n')[0] || '';
+    if (msg) console.log(`    ${c.dim}${msg}${c.reset}`);
+    console.log(`    ${c.dim}Make sure git is installed and the URL is accessible.${c.reset}`);
     return null;
   }
   
@@ -598,7 +602,7 @@ async function scanRepo(url) {
   const registryData = await checkRegistry(slug);
   
   // Cleanup
-  try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+  try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
   
   const duration = elapsed(start);
   
@@ -802,7 +806,9 @@ async function resolveSourceUrl(server) {
   return null;
 }
 
-async function discoverCommand() {
+async function discoverCommand(options = {}) {
+  const autoScan = options.scan || false;
+  
   console.log(`  ${c.bold}Discovering local MCP servers...${c.reset}`);
   console.log();
   
@@ -826,6 +832,7 @@ async function discoverCommand() {
   let auditedServers = 0;
   let unauditedServers = 0;
   const unauditedWithUrls = [];
+  const allServersWithUrls = []; // For --scan: all servers we can scan
   
   for (const config of configs) {
     const servers = extractServersFromConfig(config.content);
@@ -870,20 +877,23 @@ async function discoverCommand() {
       else if (server.url) sourceLabel = `${c.dim}${server.url.length > 60 ? server.url.slice(0, 57) + '...' : server.url}${c.reset}`;
       else if (server.command) sourceLabel = `${c.dim}${[server.command, ...server.args.slice(0, 2)].join(' ')}${c.reset}`;
       
+      // Always resolve source URL (needed for --scan)
+      const resolvedUrl = await resolveSourceUrl(server);
+      
       if (regData) {
         auditedServers++;
         const riskScore = regData.risk_score ?? regData.latest_risk_score ?? 0;
         const hasOfficial = regData.has_official_audit;
         console.log(`${branch}  ${c.bold}${server.name}${c.reset}    ${sourceLabel}`);
         console.log(`${pipe}  ${riskBadge(riskScore)} Risk ${riskScore}  ${hasOfficial ? `${c.green}✔ official${c.reset}  ` : ''}${c.dim}${REGISTRY_URL}/skills/${slug}${c.reset}`);
+        if (resolvedUrl) allServersWithUrls.push({ name: server.name, sourceUrl: resolvedUrl, hasAudit: true, regData });
       } else {
         unauditedServers++;
-        // Resolve source URL
-        const resolvedUrl = await resolveSourceUrl(server);
         console.log(`${branch}  ${c.bold}${server.name}${c.reset}    ${sourceLabel}`);
         if (resolvedUrl) {
           console.log(`${pipe}  ${c.yellow}⚠ not audited${c.reset}  ${c.dim}Run: ${c.cyan}agentaudit audit ${resolvedUrl}${c.reset}`);
           unauditedWithUrls.push({ name: server.name, sourceUrl: resolvedUrl });
+          allServersWithUrls.push({ name: server.name, sourceUrl: resolvedUrl, hasAudit: false });
         } else {
           console.log(`${pipe}  ${c.yellow}⚠ not audited${c.reset}  ${c.dim}Source URL unknown — check the package's GitHub/npm page${c.reset}`);
         }
@@ -905,7 +915,55 @@ async function discoverCommand() {
   if (unauditedServers > 0) console.log(`  ${icons.caution}  ${c.yellow}${unauditedServers} not audited${c.reset}`);
   console.log();
   
-  if (unauditedServers > 0) {
+  // --scan: automatically scan all servers with resolved source URLs
+  if (autoScan) {
+    const scanTargets = allServersWithUrls.filter(s => s.sourceUrl && s.sourceUrl.startsWith('http'));
+    if (scanTargets.length > 0) {
+      console.log(`${c.dim}${'─'.repeat(60)}${c.reset}`);
+      console.log(`  ${c.bold}${icons.scan}  Auto-scanning ${scanTargets.length} server${scanTargets.length !== 1 ? 's' : ''}...${c.reset}`);
+      console.log();
+      
+      const scanResults = [];
+      for (const target of scanTargets) {
+        const result = await scanRepo(target.sourceUrl);
+        if (result) scanResults.push({ ...result, serverName: target.name });
+      }
+      
+      if (scanResults.length > 1) {
+        // Print combined scan summary
+        console.log(`${c.dim}${'─'.repeat(60)}${c.reset}`);
+        console.log(`  ${c.bold}Scan Summary${c.reset}  ${scanResults.length} server${scanResults.length !== 1 ? 's' : ''} scanned`);
+        console.log();
+        
+        let totalFindings = 0;
+        let serversWithFindings = 0;
+        
+        for (const r of scanResults) {
+          const findingCount = r.findings ? r.findings.length : 0;
+          totalFindings += findingCount;
+          if (findingCount > 0) serversWithFindings++;
+          
+          const status = findingCount === 0
+            ? `${icons.safe}  ${c.green}clean${c.reset}`
+            : `${icons.caution}  ${c.yellow}${findingCount} finding${findingCount !== 1 ? 's' : ''}${c.reset}`;
+          console.log(`  ${status}  ${c.bold}${r.serverName || r.slug}${c.reset}  ${c.dim}(${r.duration})${c.reset}`);
+        }
+        
+        console.log();
+        if (serversWithFindings > 0) {
+          console.log(`  ${c.yellow}${serversWithFindings}/${scanResults.length} server${scanResults.length !== 1 ? 's' : ''} with findings (${totalFindings} total)${c.reset}`);
+          console.log(`  ${c.dim}Run ${c.cyan}agentaudit audit <url>${c.dim} for deep LLM analysis on flagged servers${c.reset}`);
+        } else {
+          console.log(`  ${c.green}All servers passed quick scan${c.reset}`);
+          console.log(`  ${c.dim}Run ${c.cyan}agentaudit audit <url>${c.dim} for thorough LLM-powered analysis${c.reset}`);
+        }
+        console.log();
+      }
+    } else {
+      console.log(`  ${c.dim}No scannable source URLs found.${c.reset}`);
+      console.log();
+    }
+  } else if (unauditedServers > 0) {
     if (unauditedWithUrls.length > 0) {
       console.log(`  ${c.dim}To audit unaudited servers:${c.reset}`);
       for (const { name, sourceUrl } of unauditedWithUrls) {
@@ -916,6 +974,8 @@ async function discoverCommand() {
       console.log(`  ${c.cyan}agentaudit audit <source-url>${c.reset}`);
     }
     console.log();
+    console.log(`  ${c.dim}Or run ${c.cyan}agentaudit discover --scan${c.dim} to auto-scan all servers${c.reset}`);
+    console.log();
   }
 }
 
@@ -937,15 +997,18 @@ async function auditRepo(url) {
   
   // Step 1: Clone
   process.stdout.write(`  ${c.dim}[1/4]${c.reset} Cloning repository...`);
-  const tmpDir = fs.mkdtempSync('/tmp/agentaudit-');
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentaudit-'));
   const repoPath = path.join(tmpDir, 'repo');
   try {
-    execSync(`git clone --depth 1 "${url}" "${repoPath}" 2>/dev/null`, {
+    execSync(`git clone --depth 1 "${url}" "${repoPath}"`, {
       timeout: 30_000, stdio: 'pipe',
     });
     console.log(` ${c.green}done${c.reset}`);
-  } catch {
+  } catch (err) {
     console.log(` ${c.red}failed${c.reset}`);
+    const msg = err.stderr?.toString().trim() || err.message?.split('\n')[0] || '';
+    if (msg) console.log(`    ${c.dim}${msg}${c.reset}`);
+    console.log(`    ${c.dim}Make sure git is installed and the URL is accessible.${c.reset}`);
     return null;
   }
   
@@ -985,6 +1048,10 @@ async function auditRepo(url) {
     console.log(`  ${c.dim}$env:ANTHROPIC_API_KEY = "sk-ant-..."${c.reset}`);
     console.log(`  ${c.dim}$env:OPENAI_API_KEY = "sk-..."${c.reset}`);
     console.log();
+    console.log(`  ${c.dim}# Windows (CMD):${c.reset}`);
+    console.log(`  ${c.dim}set ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
+    console.log(`  ${c.dim}set OPENAI_API_KEY=sk-...${c.reset}`);
+    console.log();
     console.log(`  ${c.bold}Option 2: Export for manual review${c.reset}`);
     console.log(`  ${c.cyan}agentaudit audit ${url} --export${c.reset}`);
     console.log(`  ${c.dim}Creates a markdown file you can paste into any LLM (Claude, ChatGPT, etc.)${c.reset}`);
@@ -1023,7 +1090,7 @@ async function auditRepo(url) {
     }
     
     // Cleanup
-    try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
     return null;
   }
   
@@ -1097,12 +1164,12 @@ async function auditRepo(url) {
   } catch (err) {
     console.log(` ${c.red}failed${c.reset}`);
     console.log(`  ${c.red}${err.message}${c.reset}`);
-    try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
     return null;
   }
   
   // Cleanup repo
-  try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+  try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
   
   if (!report) {
     console.log(`  ${c.red}Could not parse LLM response as JSON${c.reset}`);
@@ -1189,11 +1256,17 @@ async function checkPackage(name) {
 async function main() {
   const args = process.argv.slice(2);
   
+  if (args[0] === '-v' || args[0] === '--version') {
+    console.log(`agentaudit ${getVersion()}`);
+    process.exit(0);
+  }
+  
   if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
     banner();
     console.log(`  ${c.bold}Commands:${c.reset}`);
     console.log();
     console.log(`    ${c.cyan}agentaudit discover${c.reset}                         Find local MCP servers + check registry`);
+    console.log(`    ${c.cyan}agentaudit discover --scan${c.reset}                  Discover + auto-scan all servers`);
     console.log(`    ${c.cyan}agentaudit scan${c.reset} <url> [url...]               Quick static scan (regex, local)`);
     console.log(`    ${c.cyan}agentaudit audit${c.reset} <url> [url...]              Deep LLM-powered security audit`);
     console.log(`    ${c.cyan}agentaudit check${c.reset} <name>                      Look up package in registry`);
@@ -1205,10 +1278,24 @@ async function main() {
     console.log();
     console.log(`  ${c.bold}Examples:${c.reset}`);
     console.log(`    agentaudit discover`);
+    console.log(`    agentaudit discover --scan`);
     console.log(`    agentaudit scan https://github.com/owner/repo`);
     console.log(`    agentaudit audit https://github.com/owner/repo`);
     console.log(`    agentaudit check fastmcp`);
     console.log();
+    console.log(`  ${c.bold}For deep audits,${c.reset} set an LLM API key:`);
+    if (process.platform === 'win32') {
+      console.log(`    ${c.dim}PowerShell:  $env:ANTHROPIC_API_KEY = "sk-ant-..."${c.reset}`);
+      console.log(`    ${c.dim}CMD:         set ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
+      console.log(`    ${c.dim}(or use OPENAI_API_KEY instead)${c.reset}`);
+    } else {
+      console.log(`    ${c.dim}export ANTHROPIC_API_KEY=sk-ant-...${c.reset}    ${c.dim}(or OPENAI_API_KEY)${c.reset}`);
+    }
+    console.log();
+    console.log(`  ${c.bold}Or use as MCP server${c.reset} in Cursor/Claude ${c.dim}(no extra API key needed):${c.reset}`);
+    console.log(`    ${c.dim}Add to your MCP config:${c.reset}`);
+    console.log(`    ${c.dim}{ "agentaudit": { "command": "npx", "args": ["-y", "agentaudit"] } }${c.reset}`);
+    console.log();
     process.exit(0);
   }
   
@@ -1223,7 +1310,8 @@ async function main() {
   }
   
   if (command === 'discover') {
-    await discoverCommand();
+    const scanFlag = targets.includes('--scan') || targets.includes('-s');
+    await discoverCommand({ scan: scanFlag });
     return;
   }
   

package/index.mjs

@@ -25,6 +25,7 @@ import {
   ListToolsRequestSchema,
 } from '@modelcontextprotocol/sdk/types.js';
 import fs from 'fs';
+import os from 'os';
 import path from 'path';
 import { execSync } from 'child_process';
 import { fileURLToPath } from 'url';
@@ -124,9 +125,9 @@ function collectFiles(dir, basePath = '', collected = [], totalSize = { bytes: 0
 // ── Repo Helpers ────────────────────────────────────────
 
 function cloneRepo(sourceUrl) {
-  const tmpDir = fs.mkdtempSync('/tmp/agentaudit-');
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentaudit-'));
   try {
-    execSync(`git clone --depth 1 "${sourceUrl}" "${tmpDir}/repo" 2>/dev/null`, {
+    execSync(`git clone --depth 1 "${sourceUrl}" "${tmpDir}/repo"`, {
       timeout: 30_000, stdio: 'pipe',
     });
     return path.join(tmpDir, 'repo');
@@ -136,7 +137,7 @@ function cloneRepo(sourceUrl) {
 }
 
 function cleanupRepo(repoPath) {
-  try { execSync(`rm -rf "${path.dirname(repoPath)}"`, { stdio: 'pipe' }); } catch {}
+  try { fs.rmSync(path.dirname(repoPath), { recursive: true, force: true }); } catch {}
 }
 
 function slugFromUrl(url) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.5.0",
+  "version": "3.7.0",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {