auditor-mcp 0.1.4 → 0.1.6

package/dist/index.js

@@ -2,9 +2,11 @@
 
 // src/index.ts
 import { config as loadEnv } from "dotenv";
-import { dirname, resolve } from "path";
+import { dirname, resolve, join } from "path";
 import { fileURLToPath } from "url";
-import { readFile } from "fs/promises";
+import { readFile, writeFile, mkdir, readdir, stat } from "fs/promises";
+import { randomUUID } from "crypto";
+import { homedir } from "os";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { wrapFetchWithPayment, x402Client, x402HTTPClient, decodePaymentResponseHeader } from "@x402/fetch";
@@ -206,6 +208,46 @@ var mppClient = MppxClient.create({
   methods: [stellarMpp.charge({ secretKey: STELLAR_SECRET_KEY })],
   polyfill: false
 });
+var REPORTS_DIR = join(homedir(), ".auditor-mcp", "reports");
+async function findRsFiles(dir) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...await findRsFiles(full));
+    } else if (entry.isFile() && entry.name.endsWith(".rs")) {
+      files.push(full);
+    }
+  }
+  return files.sort();
+}
+async function loadContractCode(filePath) {
+  const info = await stat(filePath);
+  if (info.isDirectory()) {
+    const rsFiles = await findRsFiles(filePath);
+    if (rsFiles.length === 0)
+      throw new Error(`No .rs files found in directory: ${filePath}`);
+    const sections = await Promise.all(
+      rsFiles.map(async (f) => {
+        const content = await readFile(f, "utf8");
+        const relative = f.slice(filePath.length).replace(/^\//, "");
+        return `// === FILE: ${relative} ===
+
+${content}`;
+      })
+    );
+    return { code: sections.join("\n\n"), filesAudited: rsFiles };
+  }
+  const code = await readFile(filePath, "utf8");
+  return { code, filesAudited: [filePath] };
+}
+async function saveReport(auditId, report) {
+  await mkdir(REPORTS_DIR, { recursive: true });
+  const reportPath = join(REPORTS_DIR, `${auditId}.json`);
+  await writeFile(reportPath, JSON.stringify(report, null, 2), "utf8");
+  return reportPath;
+}
 var server = new McpServer({
   name: process.env.MCP_SERVER_NAME || "auditor-mcp",
   version: process.env.MCP_SERVER_VERSION || "0.1.0"
@@ -213,30 +255,36 @@ var server = new McpServer({
 server.tool(
   "audit_soroban_contract",
   [
-    "Reads a local Soroban smart contract (.rs file) and submits it for a paid security audit.",
-    "Charges 0.15 USDC on Stellar Testnet via the x402 protocol.",
-    "Returns a structured audit report with vulnerabilities, warnings, and recommendations."
+    "Reads a local Soroban smart contract and submits it for a paid AI security audit.",
+    "Cost: 0.15 USDC per audit, charged autonomously on Stellar Testnet via the x402 protocol.",
+    "Accepts a single .rs file OR a project directory (all .rs files are included automatically).",
+    "Returns a structured report with CWE IDs, severity levels, fix recommendations,",
+    "a unique audit ID, and a downloadable report saved to ~/.auditor-mcp/reports/."
   ].join(" "),
   {
-    file_path: z.string().describe("Absolute or relative path to the Soroban .rs contract file to audit")
+    file_path: z.string().describe(
+      "Absolute path to a Soroban .rs file, OR a directory containing Soroban contract source files. When a directory is provided, all .rs files are discovered recursively and audited together."
+    )
   },
   async ({ file_path }) => {
     let code;
+    let filesAudited;
     try {
-      code = await readFile(file_path, "utf8");
+      ({ code, filesAudited } = await loadContractCode(file_path));
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       return {
-        content: [{ type: "text", text: `Failed to read file "${file_path}": ${message}` }],
+        content: [{ type: "text", text: `Failed to read "${file_path}": ${message}` }],
         isError: true
       };
     }
     if (code.trim().length === 0) {
       return {
-        content: [{ type: "text", text: `File "${file_path}" is empty.` }],
+        content: [{ type: "text", text: `No contract code found at "${file_path}".` }],
         isError: true
       };
     }
+    const auditId = randomUUID();
     let response;
     try {
       response = await fetchWithPayment(AUDIT_GATEWAY_URL, {
@@ -298,23 +346,28 @@ ${rawBody}` }],
       }
     }
     const summary = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"].filter((s) => counts[s]).map((s) => `${s}: ${counts[s]}`).join(" | ");
+    const output = {
+      auditId,
+      file: file_path,
+      filesAudited,
+      protocol: "x402 / Stellar Testnet",
+      walletAddress: signer.address,
+      stellarTxUrl,
+      model: report?.model,
+      summary: summary || "No vulnerabilities found",
+      findings,
+      reasoning: report?.reasoning ?? null
+    };
+    let reportFile = null;
+    try {
+      reportFile = await saveReport(auditId, output);
+    } catch {
+    }
     return {
       content: [
         {
           type: "text",
-          text: JSON.stringify(
-            {
-              file: file_path,
-              protocol: "x402 / Stellar Testnet",
-              walletAddress: signer.address,
-              stellarTxUrl,
-              model: report?.model,
-              summary: summary || "No vulnerabilities found",
-              findings
-            },
-            null,
-            2
-          )
+          text: JSON.stringify({ ...output, reportFile }, null, 2)
         }
       ]
     };
@@ -323,30 +376,36 @@ ${rawBody}` }],
 server.tool(
   "audit_soroban_contract_mpp",
   [
-    "Reads a local Soroban smart contract (.rs file) and submits it for a paid security audit.",
-    "Charges 0.15 USDC on Stellar Testnet via the Stripe Machine Payments Protocol (MPP).",
-    "Returns a structured audit report with vulnerabilities, CWE IDs, severity levels, and fixes."
+    "Reads a local Soroban smart contract and submits it for a paid AI security audit.",
+    "Cost: 0.15 USDC per audit, charged autonomously on Stellar Testnet via the Stripe Machine Payments Protocol (MPP).",
+    "Accepts a single .rs file OR a project directory (all .rs files are included automatically).",
+    "Returns a structured report with CWE IDs, severity levels, fix recommendations,",
+    "a unique audit ID, and a downloadable report saved to ~/.auditor-mcp/reports/."
   ].join(" "),
   {
-    file_path: z.string().describe("Absolute or relative path to the Soroban .rs contract file to audit")
+    file_path: z.string().describe(
+      "Absolute path to a Soroban .rs file, OR a directory containing Soroban contract source files. When a directory is provided, all .rs files are discovered recursively and audited together."
+    )
   },
   async ({ file_path }) => {
     let code;
+    let filesAudited;
     try {
-      code = await readFile(file_path, "utf8");
+      ({ code, filesAudited } = await loadContractCode(file_path));
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       return {
-        content: [{ type: "text", text: `Failed to read file "${file_path}": ${message}` }],
+        content: [{ type: "text", text: `Failed to read "${file_path}": ${message}` }],
         isError: true
       };
     }
     if (code.trim().length === 0) {
       return {
-        content: [{ type: "text", text: `File "${file_path}" is empty.` }],
+        content: [{ type: "text", text: `No contract code found at "${file_path}".` }],
         isError: true
       };
     }
+    const auditId = randomUUID();
     let response;
     try {
       response = await mppClient.fetch(MPP_GATEWAY_URL, {
@@ -409,23 +468,28 @@ ${rawBody}` }],
       }
     }
     const summary = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"].filter((s) => counts[s]).map((s) => `${s}: ${counts[s]}`).join(" | ");
+    const output = {
+      auditId,
+      file: file_path,
+      filesAudited,
+      protocol: "Stripe MPP / Stellar Testnet",
+      walletAddress: signer.address,
+      stellarTxUrl: mppStellarTxUrl,
+      model: report?.model,
+      summary: summary || "No vulnerabilities found",
+      findings,
+      reasoning: report?.reasoning ?? null
+    };
+    let reportFile = null;
+    try {
+      reportFile = await saveReport(auditId, output);
+    } catch {
+    }
     return {
       content: [
         {
           type: "text",
-          text: JSON.stringify(
-            {
-              file: file_path,
-              protocol: "Stripe MPP / Stellar Testnet",
-              walletAddress: signer.address,
-              stellarTxUrl: mppStellarTxUrl,
-              model: report?.model,
-              summary: summary || "No vulnerabilities found",
-              findings
-            },
-            null,
-            2
-          )
+          text: JSON.stringify({ ...output, reportFile }, null, 2)
         }
       ]
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditor-mcp",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "description": "MCP server that audits Soroban smart contracts via autonomous x402 / Stripe MPP payments on Stellar Testnet",
   "keywords": [