autoremediator 0.2.1 → 0.3.0

package/dist/index.d.ts

@@ -48,8 +48,21 @@ interface PatchResult {
         error?: string;
     };
 }
+interface CorrelationContext {
+    requestId?: string;
+    sessionId?: string;
+    parentRunId?: string;
+}
+interface RemediationConstraints {
+    directDependenciesOnly?: boolean;
+    preferVersionBump?: boolean;
+}
+interface ProvenanceContext {
+    actor?: string;
+    source?: "cli" | "sdk" | "mcp" | "openapi" | "unknown";
+}
 /** Top-level options for the remediate() API and CLI */
-interface RemediateOptions {
+interface RemediateOptions extends CorrelationContext {
     /** Working directory of the consumer's project (defaults to process.cwd()) */
     cwd?: string;
     /** Package manager to use (defaults to auto-detect from lockfile) */
@@ -66,6 +79,17 @@ interface RemediateOptions {
     policyPath?: string;
     /** Directory to write .patch files (default: ./patches) */
     patchesDir?: string;
+    /** If true, run a non-mutating remediation preview (forces dryRun behavior for mutation tools). */
+    preview?: boolean;
+    /** Optional deterministic idempotency key for request replay handling. */
+    idempotencyKey?: string;
+    /** If true, return cached report for matching idempotency key + CVE when available. */
+    resume?: boolean;
+    /** Optional caller provenance fields for evidence and reporting. */
+    actor?: string;
+    source?: "cli" | "sdk" | "mcp" | "openapi" | "unknown";
+    /** Optional orchestration constraints for result enforcement. */
+    constraints?: RemediationConstraints;
 }
 /** Final report returned by the remediation pipeline */
 interface RemediationReport {
@@ -75,6 +99,10 @@ interface RemediationReport {
     results: PatchResult[];
     agentSteps: number;
     summary: string;
+    correlation?: CorrelationContext;
+    provenance?: ProvenanceContext;
+    constraints?: RemediationConstraints;
+    resumedFromCache?: boolean;
 }
 
 type ScanInputFormat = "npm-audit" | "yarn-audit" | "sarif" | "auto";
@@ -106,6 +134,10 @@ interface ScanReport {
         error: string;
     }>;
     patchStorageDir?: string;
+    correlation?: CorrelationContext;
+    provenance?: ProvenanceContext;
+    constraints?: RemediationConstraints;
+    idempotencyKey?: string;
 }
 interface CiSummary {
     schemaVersion: "1.0";
@@ -127,6 +159,10 @@ interface CiSummary {
         error: string;
     }>;
     patchStorageDir?: string;
+    correlation?: CorrelationContext;
+    provenance?: ProvenanceContext;
+    constraints?: RemediationConstraints;
+    idempotencyKey?: string;
 }
 /**
  * Main entry point for programmatic use.
@@ -136,6 +172,10 @@ interface CiSummary {
  * @returns       A RemediationReport describing what was found and done
  */
 declare function remediate(cveId: string, options?: RemediateOptions): Promise<RemediationReport>;
+/**
+ * Non-mutating preview entrypoint for planning and orchestration.
+ */
+declare function planRemediation(cveId: string, options?: RemediateOptions): Promise<RemediationReport>;
 /**
  * Scanner-first entrypoint: parse a scanner output file (npm audit JSON or SARIF),
  * extract CVEs, and run remediations one-by-one.
@@ -144,4 +184,4 @@ declare function remediateFromScan(inputPath: string, options?: ScanOptions): Pr
 declare function toCiSummary(report: ScanReport): CiSummary;
 declare function ciExitCode(summary: CiSummary): number;
 
-export { type AffectedPackage, type CiSummary, type CveDetails, type InventoryPackage, type PatchResult, type PatchStrategy, type RemediateOptions, type RemediationReport, type ScanInputFormat, type ScanOptions, type ScanReport, type VulnerablePackage, ciExitCode, remediate, remediateFromScan, runRemediationPipeline, toCiSummary };
+export { type AffectedPackage, type CiSummary, type CorrelationContext, type CveDetails, type InventoryPackage, type PatchResult, type PatchStrategy, type ProvenanceContext, type RemediateOptions, type RemediationConstraints, type RemediationReport, type ScanInputFormat, type ScanOptions, type ScanReport, type VulnerablePackage, ciExitCode, planRemediation, remediate, remediateFromScan, runRemediationPipeline, toCiSummary };

package/dist/index.js

@@ -1,12 +1,14 @@
 import {
   ciExitCode,
+  planRemediation,
   remediate,
   remediateFromScan,
   runRemediationPipeline,
   toCiSummary
-} from "./chunk-DQKT2CUG.js";
+} from "./chunk-URM53GSJ.js";
 export {
   ciExitCode,
+  planRemediation,
   remediate,
   remediateFromScan,
   runRemediationPipeline,

package/dist/mcp/server.d.ts

@@ -1 +1,278 @@
 #!/usr/bin/env node
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { remediate, planRemediation, remediateFromScan } from '../index.js';
+
+/**
+ * autoremediator MCP server
+ *
+ * Exposes all autoremediator tools via the Model Context Protocol so LLM hosts
+ * (Claude Desktop, Cursor, Copilot, etc.) can invoke them directly.
+ *
+ * Start: autoremediator-mcp   (stdio transport)
+ */
+
+interface McpApiDeps {
+    remediateFn: typeof remediate;
+    planRemediationFn: typeof planRemediation;
+    remediateFromScanFn: typeof remediateFromScan;
+}
+declare const TOOLS: ({
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        required: string[];
+        properties: {
+            cveId: {
+                type: string;
+                description: string;
+            };
+            cwd: {
+                type: string;
+                description: string;
+            };
+            packageManager: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            dryRun: {
+                type: string;
+                description: string;
+            };
+            preview: {
+                type: string;
+                description: string;
+            };
+            skipTests: {
+                type: string;
+                description: string;
+            };
+            llmProvider: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            patchesDir: {
+                type: string;
+                description: string;
+            };
+            requestId: {
+                type: string;
+                description: string;
+            };
+            sessionId: {
+                type: string;
+                description: string;
+            };
+            parentRunId: {
+                type: string;
+                description: string;
+            };
+            idempotencyKey: {
+                type: string;
+                description: string;
+            };
+            resume: {
+                type: string;
+                description: string;
+            };
+            actor: {
+                type: string;
+                description: string;
+            };
+            source: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            constraints: {
+                type: string;
+                properties: {
+                    directDependenciesOnly: {
+                        type: string;
+                    };
+                    preferVersionBump: {
+                        type: string;
+                    };
+                };
+            };
+            inputPath?: undefined;
+            format?: undefined;
+            writeEvidence?: undefined;
+        };
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        required: string[];
+        properties: {
+            cveId: {
+                type: string;
+                description: string;
+            };
+            cwd: {
+                type: string;
+                description: string;
+            };
+            packageManager: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            skipTests: {
+                type: string;
+                description: string;
+            };
+            llmProvider: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            patchesDir: {
+                type: string;
+                description: string;
+            };
+            requestId: {
+                type: string;
+                description: string;
+            };
+            sessionId: {
+                type: string;
+                description: string;
+            };
+            parentRunId: {
+                type: string;
+                description: string;
+            };
+            idempotencyKey: {
+                type: string;
+                description: string;
+            };
+            resume: {
+                type: string;
+                description: string;
+            };
+            actor: {
+                type: string;
+                description: string;
+            };
+            source: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            constraints: {
+                type: string;
+                properties: {
+                    directDependenciesOnly: {
+                        type: string;
+                    };
+                    preferVersionBump: {
+                        type: string;
+                    };
+                };
+            };
+            dryRun?: undefined;
+            preview?: undefined;
+            inputPath?: undefined;
+            format?: undefined;
+            writeEvidence?: undefined;
+        };
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        required: string[];
+        properties: {
+            inputPath: {
+                type: string;
+                description: string;
+            };
+            cwd: {
+                type: string;
+                description: string;
+            };
+            packageManager: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            format: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            dryRun: {
+                type: string;
+                description: string;
+            };
+            preview: {
+                type: string;
+                description: string;
+            };
+            writeEvidence: {
+                type: string;
+                description: string;
+            };
+            requestId: {
+                type: string;
+                description: string;
+            };
+            sessionId: {
+                type: string;
+                description: string;
+            };
+            parentRunId: {
+                type: string;
+                description: string;
+            };
+            idempotencyKey: {
+                type: string;
+                description: string;
+            };
+            resume: {
+                type: string;
+                description: string;
+            };
+            actor: {
+                type: string;
+                description: string;
+            };
+            source: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            constraints: {
+                type: string;
+                properties: {
+                    directDependenciesOnly: {
+                        type: string;
+                    };
+                    preferVersionBump: {
+                        type: string;
+                    };
+                };
+            };
+            cveId?: undefined;
+            skipTests?: undefined;
+            llmProvider?: undefined;
+            patchesDir?: undefined;
+        };
+    };
+})[];
+declare function handleToolCall(name: string, args?: Record<string, unknown>, deps?: McpApiDeps): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;
+declare function createMcpServer(): Server;
+
+export { TOOLS, createMcpServer, handleToolCall };

package/dist/mcp/server.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import {
+  planRemediation,
   remediate,
   remediateFromScan
-} from "../chunk-DQKT2CUG.js";
+} from "../chunk-URM53GSJ.js";
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -11,10 +12,18 @@ import {
   CallToolRequestSchema,
   ListToolsRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
-var server = new Server(
-  { name: "autoremediator", version: "0.1.2" },
-  { capabilities: { tools: {} } }
-);
+import { fileURLToPath } from "url";
+var defaultDeps = {
+  remediateFn: remediate,
+  planRemediationFn: planRemediation,
+  remediateFromScanFn: remediateFromScan
+};
+function createBaseServer() {
+  return new Server(
+    { name: "autoremediator", version: "0.1.2" },
+    { capabilities: { tools: {} } }
+  );
+}
 var TOOLS = [
   {
     name: "remediate",
@@ -27,9 +36,54 @@ var TOOLS = [
         cwd: { type: "string", description: "Absolute path to the project root (default: process.cwd())" },
         packageManager: { type: "string", enum: ["npm", "pnpm", "yarn"], description: "Package manager override (auto-detected by default)" },
         dryRun: { type: "boolean", description: "If true, plan changes but write nothing (default: false)" },
+        preview: { type: "boolean", description: "If true, enforce non-mutating preview mode" },
         skipTests: { type: "boolean", description: "Skip package-manager test command after applying fix (default: true)" },
         llmProvider: { type: "string", enum: ["openai", "anthropic", "local"], description: "LLM provider override" },
-        patchesDir: { type: "string", description: "Directory to write .patch files (default: ./patches)" }
+        patchesDir: { type: "string", description: "Directory to write .patch files (default: ./patches)" },
+        requestId: { type: "string", description: "Request correlation ID" },
+        sessionId: { type: "string", description: "Session correlation ID" },
+        parentRunId: { type: "string", description: "Parent run correlation ID" },
+        idempotencyKey: { type: "string", description: "Idempotency key for replay-safe execution" },
+        resume: { type: "boolean", description: "Return cached result for matching idempotency key when available" },
+        actor: { type: "string", description: "Actor identity for evidence provenance" },
+        source: { type: "string", enum: ["cli", "sdk", "mcp", "openapi", "unknown"], description: "Source system for provenance" },
+        constraints: {
+          type: "object",
+          properties: {
+            directDependenciesOnly: { type: "boolean" },
+            preferVersionBump: { type: "boolean" }
+          }
+        }
+      }
+    }
+  },
+  {
+    name: "planRemediation",
+    description: "Generate a non-mutating remediation preview for a single CVE in a Node.js project. Returns a RemediationReport with planned results.",
+    inputSchema: {
+      type: "object",
+      required: ["cveId"],
+      properties: {
+        cveId: { type: "string", description: "CVE ID, e.g. CVE-2021-23337" },
+        cwd: { type: "string", description: "Absolute path to the project root (default: process.cwd())" },
+        packageManager: { type: "string", enum: ["npm", "pnpm", "yarn"], description: "Package manager override (auto-detected by default)" },
+        skipTests: { type: "boolean", description: "Skip package-manager test command after applying fix (default: true)" },
+        llmProvider: { type: "string", enum: ["openai", "anthropic", "local"], description: "LLM provider override" },
+        patchesDir: { type: "string", description: "Directory to write .patch files (default: ./patches)" },
+        requestId: { type: "string", description: "Request correlation ID" },
+        sessionId: { type: "string", description: "Session correlation ID" },
+        parentRunId: { type: "string", description: "Parent run correlation ID" },
+        idempotencyKey: { type: "string", description: "Idempotency key for replay-safe execution" },
+        resume: { type: "boolean", description: "Return cached result for matching idempotency key when available" },
+        actor: { type: "string", description: "Actor identity for evidence provenance" },
+        source: { type: "string", enum: ["cli", "sdk", "mcp", "openapi", "unknown"], description: "Source system for provenance" },
+        constraints: {
+          type: "object",
+          properties: {
+            directDependenciesOnly: { type: "boolean" },
+            preferVersionBump: { type: "boolean" }
+          }
+        }
       }
     }
   },
@@ -45,23 +99,45 @@ var TOOLS = [
         packageManager: { type: "string", enum: ["npm", "pnpm", "yarn"], description: "Package manager override (auto-detected by default)" },
         format: { type: "string", enum: ["auto", "npm-audit", "yarn-audit", "sarif"], description: "Scanner format (default: auto)" },
         dryRun: { type: "boolean", description: "If true, plan changes but write nothing" },
-        writeEvidence: { type: "boolean", description: "Write evidence JSON to .autoremediator/evidence/ (default: true)" }
+        preview: { type: "boolean", description: "If true, enforce non-mutating preview mode" },
+        writeEvidence: { type: "boolean", description: "Write evidence JSON to .autoremediator/evidence/ (default: true)" },
+        requestId: { type: "string", description: "Request correlation ID" },
+        sessionId: { type: "string", description: "Session correlation ID" },
+        parentRunId: { type: "string", description: "Parent run correlation ID" },
+        idempotencyKey: { type: "string", description: "Idempotency key for replay-safe execution" },
+        resume: { type: "boolean", description: "Return cached result for matching idempotency key when available" },
+        actor: { type: "string", description: "Actor identity for evidence provenance" },
+        source: { type: "string", enum: ["cli", "sdk", "mcp", "openapi", "unknown"], description: "Source system for provenance" },
+        constraints: {
+          type: "object",
+          properties: {
+            directDependenciesOnly: { type: "boolean" },
+            preferVersionBump: { type: "boolean" }
+          }
+        }
       }
     }
   }
 ];
-server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
-server.setRequestHandler(CallToolRequestSchema, async (request) => {
-  const { name, arguments: args } = request.params;
+async function handleToolCall(name, args = {}, deps = defaultDeps) {
+  const withMcpSource = (options) => ({
+    ...options,
+    source: typeof options.source === "string" ? options.source : "mcp"
+  });
   try {
     if (name === "remediate") {
       const { cveId, ...options } = args;
-      const report = await remediate(cveId, options);
+      const report = await deps.remediateFn(cveId, withMcpSource(options));
+      return { content: [{ type: "text", text: JSON.stringify(report, null, 2) }] };
+    }
+    if (name === "planRemediation") {
+      const { cveId, ...options } = args;
+      const report = await deps.planRemediationFn(cveId, withMcpSource(options));
       return { content: [{ type: "text", text: JSON.stringify(report, null, 2) }] };
     }
     if (name === "remediateFromScan") {
       const { inputPath, ...options } = args;
-      const report = await remediateFromScan(inputPath, options);
+      const report = await deps.remediateFromScanFn(inputPath, withMcpSource(options));
       return { content: [{ type: "text", text: JSON.stringify(report, null, 2) }] };
     }
     return {
@@ -74,7 +150,31 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       isError: true
     };
   }
-});
-var transport = new StdioServerTransport();
-await server.connect(transport);
+}
+function createMcpServer() {
+  const server = createBaseServer();
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name, arguments: args } = request.params;
+    return handleToolCall(name, args ?? {});
+  });
+  return server;
+}
+async function startMcpServer() {
+  const transport = new StdioServerTransport();
+  const server = createMcpServer();
+  await server.connect(transport);
+}
+function isMainModule() {
+  if (!process.argv[1]) return false;
+  return fileURLToPath(import.meta.url) === process.argv[1];
+}
+if (isMainModule()) {
+  await startMcpServer();
+}
+export {
+  TOOLS,
+  createMcpServer,
+  handleToolCall
+};
 //# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/mcp/server.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * autoremediator MCP server\n *\n * Exposes all autoremediator tools via the Model Context Protocol so LLM hosts\n * (Claude Desktop, Cursor, Copilot, etc.) can invoke them directly.\n *\n * Start: autoremediator-mcp   (stdio transport)\n */\nimport { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport {\n  CallToolRequestSchema,\n  ListToolsRequestSchema,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { remediate, remediateFromScan } from \"../api.js\";\n\nconst server = new Server(\n  { name: \"autoremediator\", version: \"0.1.2\" },\n  { capabilities: { tools: {} } }\n);\n\n// ---------------------------------------------------------------------------\n// Tool definitions\n// ---------------------------------------------------------------------------\n\nconst TOOLS = [\n  {\n    name: \"remediate\",\n    description:\n      \"Remediate a single CVE in a Node.js project. Looks up the CVE, scans the project inventory, and applies a version bump or generates a patch file. Returns a RemediationReport.\",\n    inputSchema: {\n      type: \"object\",\n      required: [\"cveId\"],\n      properties: {\n        cveId: { type: \"string\", description: \"CVE ID, e.g. CVE-2021-23337\" },\n        cwd: { type: \"string\", description: \"Absolute path to the project root (default: process.cwd())\" },\n        packageManager: { type: \"string\", enum: [\"npm\", \"pnpm\", \"yarn\"], description: \"Package manager override (auto-detected by default)\" },\n        dryRun: { type: \"boolean\", description: \"If true, plan changes but write nothing (default: false)\" },\n        skipTests: { type: \"boolean\", description: \"Skip package-manager test command after applying fix (default: true)\" },\n        llmProvider: { type: \"string\", enum: [\"openai\", \"anthropic\", \"local\"], description: \"LLM provider override\" },\n        patchesDir: { type: \"string\", description: \"Directory to write .patch files (default: ./patches)\" },\n      },\n    },\n  },\n  {\n    name: \"remediateFromScan\",\n    description:\n      \"Parse an npm/pnpm/yarn audit JSON or SARIF scan file, extract all CVE IDs, and remediate each one. Returns a ScanReport.\",\n    inputSchema: {\n      type: \"object\",\n      required: [\"inputPath\"],\n      properties: {\n        inputPath: { type: \"string\", description: \"Absolute path to the scanner output file\" },\n        cwd: { type: \"string\", description: \"Absolute path to the project root\" },\n        packageManager: { type: \"string\", enum: [\"npm\", \"pnpm\", \"yarn\"], description: \"Package manager override (auto-detected by default)\" },\n        format: { type: \"string\", enum: [\"auto\", \"npm-audit\", \"yarn-audit\", \"sarif\"], description: \"Scanner format (default: auto)\" },\n        dryRun: { type: \"boolean\", description: \"If true, plan changes but write nothing\" },\n        writeEvidence: { type: \"boolean\", description: \"Write evidence JSON to .autoremediator/evidence/ (default: true)\" },\n      },\n    },\n  },\n];\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\nserver.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));\n\nserver.setRequestHandler(CallToolRequestSchema, async (request) => {\n  const { name, arguments: args } = request.params;\n\n  try {\n    if (name === \"remediate\") {\n      const { cveId, ...options } = args as { cveId: string; [key: string]: unknown };\n      const report = await remediate(cveId, options as Parameters<typeof remediate>[1]);\n      return { content: [{ type: \"text\", text: JSON.stringify(report, null, 2) }] };\n    }\n\n    if (name === \"remediateFromScan\") {\n      const { inputPath, ...options } = args as { inputPath: string; [key: string]: unknown };\n      const report = await remediateFromScan(inputPath, options as Parameters<typeof remediateFromScan>[1]);\n      return { content: [{ type: \"text\", text: JSON.stringify(report, null, 2) }] };\n    }\n\n    return {\n      content: [{ type: \"text\", text: `Unknown tool: ${name}` }],\n      isError: true,\n    };\n  } catch (err) {\n    return {\n      content: [{ type: \"text\", text: err instanceof Error ? err.message : String(err) }],\n      isError: true,\n    };\n  }\n});\n\n// ---------------------------------------------------------------------------\n// Start\n// ---------------------------------------------------------------------------\n\nconst transport = new StdioServerTransport();\nawait server.connect(transport);\n"],"mappings":";;;;;;;AASA,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAGP,IAAM,SAAS,IAAI;AAAA,EACjB,EAAE,MAAM,kBAAkB,SAAS,QAAQ;AAAA,EAC3C,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE;AAChC;AAMA,IAAM,QAAQ;AAAA,EACZ;AAAA,IACE,MAAM;AAAA,IACN,aACE;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,UAAU,CAAC,OAAO;AAAA,MAClB,YAAY;AAAA,QACV,OAAO,EAAE,MAAM,UAAU,aAAa,8BAA8B;AAAA,QACpE,KAAK,EAAE,MAAM,UAAU,aAAa,6DAA6D;AAAA,QACjG,gBAAgB,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,QAAQ,MAAM,GAAG,aAAa,sDAAsD;AAAA,QACpI,QAAQ,EAAE,MAAM,WAAW,aAAa,2DAA2D;AAAA,QACnG,WAAW,EAAE,MAAM,WAAW,aAAa,uEAAuE;AAAA,QAClH,aAAa,EAAE,MAAM,UAAU,MAAM,CAAC,UAAU,aAAa,OAAO,GAAG,aAAa,wBAAwB;AAAA,QAC5G,YAAY,EAAE,MAAM,UAAU,aAAa,uDAAuD;AAAA,MACpG;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aACE;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,UAAU,CAAC,WAAW;AAAA,MACtB,YAAY;AAAA,QACV,WAAW,EAAE,MAAM,UAAU,aAAa,2CAA2C;AAAA,QACrF,KAAK,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,QACxE,gBAAgB,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,QAAQ,MAAM,GAAG,aAAa,sDAAsD;AAAA,QACpI,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,QAAQ,aAAa,cAAc,OAAO,GAAG,aAAa,iCAAiC;AAAA,QAC5H,QAAQ,EAAE,MAAM,WAAW,aAAa,0CAA0C;AAAA,QAClF,eAAe,EAAE,MAAM,WAAW,aAAa,mEAAmE;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;AAMA,OAAO,kBAAkB,wBAAwB,aAAa,EAAE,OAAO,MAAM,EAAE;AAE/E,OAAO,kBAAkB,uBAAuB,OAAO,YAAY;AACjE,QAAM,EAAE,MAAM,WAAW,KAAK,IAAI,QAAQ;AAE1C,MAAI;AACF,QAAI,SAAS,aAAa;AACxB,YAAM,EAAE,OAAO,GAAG,QAAQ,IAAI;AAC9B,YAAM,SAAS,MAAM,UAAU,OAAO,OAA0C;AAChF,aAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,IAC9E;AAEA,QAAI,SAAS,qBAAqB;AAChC,YAAM,EAAE,WAAW,GAAG,QAAQ,IAAI;AAClC,YAAM,SAAS,MAAM,kBAAkB,WAAW,OAAkD;AACpG,aAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,IAC9E;AAEA,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,iBAAiB,IAAI,GAAG,CAAC;AAAA,MACzD,SAAS;AAAA,IACX;AAAA,EACF,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,CAAC;AAAA,MAClF,SAAS;AAAA,IACX;AAAA,EACF;AACF,CAAC;AAMD,IAAM,YAAY,IAAI,qBAAqB;AAC3C,MAAM,OAAO,QAAQ,SAAS;","names":[]}
+{"version":3,"sources":["../../src/mcp/server.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * autoremediator MCP server\n *\n * Exposes all autoremediator tools via the Model Context Protocol so LLM hosts\n * (Claude Desktop, Cursor, Copilot, etc.) can invoke them directly.\n *\n * Start: autoremediator-mcp   (stdio transport)\n */\nimport { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport {\n  CallToolRequestSchema,\n  ListToolsRequestSchema,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { fileURLToPath } from \"node:url\";\nimport { planRemediation, remediate, remediateFromScan } from \"../api.js\";\n\ninterface McpApiDeps {\n  remediateFn: typeof remediate;\n  planRemediationFn: typeof planRemediation;\n  remediateFromScanFn: typeof remediateFromScan;\n}\n\nconst defaultDeps: McpApiDeps = {\n  remediateFn: remediate,\n  planRemediationFn: planRemediation,\n  remediateFromScanFn: remediateFromScan,\n};\n\nfunction createBaseServer(): Server {\n  return new Server(\n    { name: \"autoremediator\", version: \"0.1.2\" },\n    { capabilities: { tools: {} } }\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Tool definitions\n// ---------------------------------------------------------------------------\n\nexport const TOOLS = [\n  {\n    name: \"remediate\",\n    description:\n      \"Remediate a single CVE in a Node.js project. Looks up the CVE, scans the project inventory, and applies a version bump or generates a patch file. Returns a RemediationReport.\",\n    inputSchema: {\n      type: \"object\",\n      required: [\"cveId\"],\n      properties: {\n        cveId: { type: \"string\", description: \"CVE ID, e.g. CVE-2021-23337\" },\n        cwd: { type: \"string\", description: \"Absolute path to the project root (default: process.cwd())\" },\n        packageManager: { type: \"string\", enum: [\"npm\", \"pnpm\", \"yarn\"], description: \"Package manager override (auto-detected by default)\" },\n        dryRun: { type: \"boolean\", description: \"If true, plan changes but write nothing (default: false)\" },\n        preview: { type: \"boolean\", description: \"If true, enforce non-mutating preview mode\" },\n        skipTests: { type: \"boolean\", description: \"Skip package-manager test command after applying fix (default: true)\" },\n        llmProvider: { type: \"string\", enum: [\"openai\", \"anthropic\", \"local\"], description: \"LLM provider override\" },\n        patchesDir: { type: \"string\", description: \"Directory to write .patch files (default: ./patches)\" },\n        requestId: { type: \"string\", description: \"Request correlation ID\" },\n        sessionId: { type: \"string\", description: \"Session correlation ID\" },\n        parentRunId: { type: \"string\", description: \"Parent run correlation ID\" },\n        idempotencyKey: { type: \"string\", description: \"Idempotency key for replay-safe execution\" },\n        resume: { type: \"boolean\", description: \"Return cached result for matching idempotency key when available\" },\n        actor: { type: \"string\", description: \"Actor identity for evidence provenance\" },\n        source: { type: \"string\", enum: [\"cli\", \"sdk\", \"mcp\", \"openapi\", \"unknown\"], description: \"Source system for provenance\" },\n        constraints: {\n          type: \"object\",\n          properties: {\n            directDependenciesOnly: { type: \"boolean\" },\n            preferVersionBump: { type: \"boolean\" },\n          },\n        },\n      },\n    },\n  },\n  {\n    name: \"planRemediation\",\n    description:\n      \"Generate a non-mutating remediation preview for a single CVE in a Node.js project. Returns a RemediationReport with planned results.\",\n    inputSchema: {\n      type: \"object\",\n      required: [\"cveId\"],\n      properties: {\n        cveId: { type: \"string\", description: \"CVE ID, e.g. CVE-2021-23337\" },\n        cwd: { type: \"string\", description: \"Absolute path to the project root (default: process.cwd())\" },\n        packageManager: { type: \"string\", enum: [\"npm\", \"pnpm\", \"yarn\"], description: \"Package manager override (auto-detected by default)\" },\n        skipTests: { type: \"boolean\", description: \"Skip package-manager test command after applying fix (default: true)\" },\n        llmProvider: { type: \"string\", enum: [\"openai\", \"anthropic\", \"local\"], description: \"LLM provider override\" },\n        patchesDir: { type: \"string\", description: \"Directory to write .patch files (default: ./patches)\" },\n        requestId: { type: \"string\", description: \"Request correlation ID\" },\n        sessionId: { type: \"string\", description: \"Session correlation ID\" },\n        parentRunId: { type: \"string\", description: \"Parent run correlation ID\" },\n        idempotencyKey: { type: \"string\", description: \"Idempotency key for replay-safe execution\" },\n        resume: { type: \"boolean\", description: \"Return cached result for matching idempotency key when available\" },\n        actor: { type: \"string\", description: \"Actor identity for evidence provenance\" },\n        source: { type: \"string\", enum: [\"cli\", \"sdk\", \"mcp\", \"openapi\", \"unknown\"], description: \"Source system for provenance\" },\n        constraints: {\n          type: \"object\",\n          properties: {\n            directDependenciesOnly: { type: \"boolean\" },\n            preferVersionBump: { type: \"boolean\" },\n          },\n        },\n      },\n    },\n  },\n  {\n    name: \"remediateFromScan\",\n    description:\n      \"Parse an npm/pnpm/yarn audit JSON or SARIF scan file, extract all CVE IDs, and remediate each one. Returns a ScanReport.\",\n    inputSchema: {\n      type: \"object\",\n      required: [\"inputPath\"],\n      properties: {\n        inputPath: { type: \"string\", description: \"Absolute path to the scanner output file\" },\n        cwd: { type: \"string\", description: \"Absolute path to the project root\" },\n        packageManager: { type: \"string\", enum: [\"npm\", \"pnpm\", \"yarn\"], description: \"Package manager override (auto-detected by default)\" },\n        format: { type: \"string\", enum: [\"auto\", \"npm-audit\", \"yarn-audit\", \"sarif\"], description: \"Scanner format (default: auto)\" },\n        dryRun: { type: \"boolean\", description: \"If true, plan changes but write nothing\" },\n        preview: { type: \"boolean\", description: \"If true, enforce non-mutating preview mode\" },\n        writeEvidence: { type: \"boolean\", description: \"Write evidence JSON to .autoremediator/evidence/ (default: true)\" },\n        requestId: { type: \"string\", description: \"Request correlation ID\" },\n        sessionId: { type: \"string\", description: \"Session correlation ID\" },\n        parentRunId: { type: \"string\", description: \"Parent run correlation ID\" },\n        idempotencyKey: { type: \"string\", description: \"Idempotency key for replay-safe execution\" },\n        resume: { type: \"boolean\", description: \"Return cached result for matching idempotency key when available\" },\n        actor: { type: \"string\", description: \"Actor identity for evidence provenance\" },\n        source: { type: \"string\", enum: [\"cli\", \"sdk\", \"mcp\", \"openapi\", \"unknown\"], description: \"Source system for provenance\" },\n        constraints: {\n          type: \"object\",\n          properties: {\n            directDependenciesOnly: { type: \"boolean\" },\n            preferVersionBump: { type: \"boolean\" },\n          },\n        },\n      },\n    },\n  },\n];\n\nexport async function handleToolCall(\n  name: string,\n  args: Record<string, unknown> = {},\n  deps: McpApiDeps = defaultDeps\n): Promise<{ content: Array<{ type: \"text\"; text: string }>; isError?: boolean }> {\n  const withMcpSource = (options: Record<string, unknown>): Record<string, unknown> => ({\n    ...options,\n    source: typeof options.source === \"string\" ? options.source : \"mcp\",\n  });\n\n  try {\n    if (name === \"remediate\") {\n      const { cveId, ...options } = args as { cveId: string; [key: string]: unknown };\n      const report = await deps.remediateFn(cveId, withMcpSource(options) as Parameters<typeof remediate>[1]);\n      return { content: [{ type: \"text\", text: JSON.stringify(report, null, 2) }] };\n    }\n\n    if (name === \"planRemediation\") {\n      const { cveId, ...options } = args as { cveId: string; [key: string]: unknown };\n      const report = await deps.planRemediationFn(cveId, withMcpSource(options) as Parameters<typeof planRemediation>[1]);\n      return { content: [{ type: \"text\", text: JSON.stringify(report, null, 2) }] };\n    }\n\n    if (name === \"remediateFromScan\") {\n      const { inputPath, ...options } = args as { inputPath: string; [key: string]: unknown };\n      const report = await deps.remediateFromScanFn(inputPath, withMcpSource(options) as Parameters<typeof remediateFromScan>[1]);\n      return { content: [{ type: \"text\", text: JSON.stringify(report, null, 2) }] };\n    }\n\n    return {\n      content: [{ type: \"text\", text: `Unknown tool: ${name}` }],\n      isError: true,\n    };\n  } catch (err) {\n    return {\n      content: [{ type: \"text\", text: err instanceof Error ? err.message : String(err) }],\n      isError: true,\n    };\n  }\n}\n\nexport function createMcpServer(): Server {\n  const server = createBaseServer();\n\n  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));\n\n  server.setRequestHandler(CallToolRequestSchema, async (request) => {\n    const { name, arguments: args } = request.params;\n    return handleToolCall(name, (args ?? {}) as Record<string, unknown>);\n  });\n\n  return server;\n}\n\n// ---------------------------------------------------------------------------\n// Start\n// ---------------------------------------------------------------------------\n\nasync function startMcpServer(): Promise<void> {\n  const transport = new StdioServerTransport();\n  const server = createMcpServer();\n  await server.connect(transport);\n}\n\nfunction isMainModule(): boolean {\n  if (!process.argv[1]) return false;\n  return fileURLToPath(import.meta.url) === process.argv[1];\n}\n\nif (isMainModule()) {\n  await startMcpServer();\n}\n"],"mappings":";;;;;;;;AASA,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAS9B,IAAM,cAA0B;AAAA,EAC9B,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,qBAAqB;AACvB;AAEA,SAAS,mBAA2B;AAClC,SAAO,IAAI;AAAA,IACT,EAAE,MAAM,kBAAkB,SAAS,QAAQ;AAAA,IAC3C,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EAChC;AACF;AAMO,IAAM,QAAQ;AAAA,EACnB;AAAA,IACE,MAAM;AAAA,IACN,aACE;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,UAAU,CAAC,OAAO;AAAA,MAClB,YAAY;AAAA,QACV,OAAO,EAAE,MAAM,UAAU,aAAa,8BAA8B;AAAA,QACpE,KAAK,EAAE,MAAM,UAAU,aAAa,6DAA6D;AAAA,QACjG,gBAAgB,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,QAAQ,MAAM,GAAG,aAAa,sDAAsD;AAAA,QACpI,QAAQ,EAAE,MAAM,WAAW,aAAa,2DAA2D;AAAA,QACnG,SAAS,EAAE,MAAM,WAAW,aAAa,6CAA6C;AAAA,QACtF,WAAW,EAAE,MAAM,WAAW,aAAa,uEAAuE;AAAA,QAClH,aAAa,EAAE,MAAM,UAAU,MAAM,CAAC,UAAU,aAAa,OAAO,GAAG,aAAa,wBAAwB;AAAA,QAC5G,YAAY,EAAE,MAAM,UAAU,aAAa,uDAAuD;AAAA,QAClG,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,aAAa,EAAE,MAAM,UAAU,aAAa,4BAA4B;AAAA,QACxE,gBAAgB,EAAE,MAAM,UAAU,aAAa,4CAA4C;AAAA,QAC3F,QAAQ,EAAE,MAAM,WAAW,aAAa,mEAAmE;AAAA,QAC3G,OAAO,EAAE,MAAM,UAAU,aAAa,yCAAyC;AAAA,QAC/E,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,OAAO,OAAO,WAAW,SAAS,GAAG,aAAa,+BAA+B;AAAA,QACzH,aAAa;AAAA,UACX,MAAM;AAAA,UACN,YAAY;AAAA,YACV,wBAAwB,EAAE,MAAM,UAAU;AAAA,YAC1C,mBAAmB,EAAE,MAAM,UAAU;AAAA,UACvC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aACE;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,UAAU,CAAC,OAAO;AAAA,MAClB,YAAY;AAAA,QACV,OAAO,EAAE,MAAM,UAAU,aAAa,8BAA8B;AAAA,QACpE,KAAK,EAAE,MAAM,UAAU,aAAa,6DAA6D;AAAA,QACjG,gBAAgB,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,QAAQ,MAAM,GAAG,aAAa,sDAAsD;AAAA,QACpI,WAAW,EAAE,MAAM,WAAW,aAAa,uEAAuE;AAAA,QAClH,aAAa,EAAE,MAAM,UAAU,MAAM,CAAC,UAAU,aAAa,OAAO,GAAG,aAAa,wBAAwB;AAAA,QAC5G,YAAY,EAAE,MAAM,UAAU,aAAa,uDAAuD;AAAA,QAClG,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,aAAa,EAAE,MAAM,UAAU,aAAa,4BAA4B;AAAA,QACxE,gBAAgB,EAAE,MAAM,UAAU,aAAa,4CAA4C;AAAA,QAC3F,QAAQ,EAAE,MAAM,WAAW,aAAa,mEAAmE;AAAA,QAC3G,OAAO,EAAE,MAAM,UAAU,aAAa,yCAAyC;AAAA,QAC/E,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,OAAO,OAAO,WAAW,SAAS,GAAG,aAAa,+BAA+B;AAAA,QACzH,aAAa;AAAA,UACX,MAAM;AAAA,UACN,YAAY;AAAA,YACV,wBAAwB,EAAE,MAAM,UAAU;AAAA,YAC1C,mBAAmB,EAAE,MAAM,UAAU;AAAA,UACvC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aACE;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,UAAU,CAAC,WAAW;AAAA,MACtB,YAAY;AAAA,QACV,WAAW,EAAE,MAAM,UAAU,aAAa,2CAA2C;AAAA,QACrF,KAAK,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,QACxE,gBAAgB,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,QAAQ,MAAM,GAAG,aAAa,sDAAsD;AAAA,QACpI,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,QAAQ,aAAa,cAAc,OAAO,GAAG,aAAa,iCAAiC;AAAA,QAC5H,QAAQ,EAAE,MAAM,WAAW,aAAa,0CAA0C;AAAA,QAClF,SAAS,EAAE,MAAM,WAAW,aAAa,6CAA6C;AAAA,QACtF,eAAe,EAAE,MAAM,WAAW,aAAa,mEAAmE;AAAA,QAClH,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,aAAa,EAAE,MAAM,UAAU,aAAa,4BAA4B;AAAA,QACxE,gBAAgB,EAAE,MAAM,UAAU,aAAa,4CAA4C;AAAA,QAC3F,QAAQ,EAAE,MAAM,WAAW,aAAa,mEAAmE;AAAA,QAC3G,OAAO,EAAE,MAAM,UAAU,aAAa,yCAAyC;AAAA,QAC/E,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,OAAO,OAAO,WAAW,SAAS,GAAG,aAAa,+BAA+B;AAAA,QACzH,aAAa;AAAA,UACX,MAAM;AAAA,UACN,YAAY;AAAA,YACV,wBAAwB,EAAE,MAAM,UAAU;AAAA,YAC1C,mBAAmB,EAAE,MAAM,UAAU;AAAA,UACvC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,eACpB,MACA,OAAgC,CAAC,GACjC,OAAmB,aAC6D;AAChF,QAAM,gBAAgB,CAAC,aAA+D;AAAA,IACpF,GAAG;AAAA,IACH,QAAQ,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS;AAAA,EAChE;AAEA,MAAI;AACF,QAAI,SAAS,aAAa;AACxB,YAAM,EAAE,OAAO,GAAG,QAAQ,IAAI;AAC9B,YAAM,SAAS,MAAM,KAAK,YAAY,OAAO,cAAc,OAAO,CAAoC;AACtG,aAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,IAC9E;AAEA,QAAI,SAAS,mBAAmB;AAC9B,YAAM,EAAE,OAAO,GAAG,QAAQ,IAAI;AAC9B,YAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,cAAc,OAAO,CAA0C;AAClH,aAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,IAC9E;AAEA,QAAI,SAAS,qBAAqB;AAChC,YAAM,EAAE,WAAW,GAAG,QAAQ,IAAI;AAClC,YAAM,SAAS,MAAM,KAAK,oBAAoB,WAAW,cAAc,OAAO,CAA4C;AAC1H,aAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,IAC9E;AAEA,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,iBAAiB,IAAI,GAAG,CAAC;AAAA,MACzD,SAAS;AAAA,IACX;AAAA,EACF,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,CAAC;AAAA,MAClF,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAEO,SAAS,kBAA0B;AACxC,QAAM,SAAS,iBAAiB;AAEhC,SAAO,kBAAkB,wBAAwB,aAAa,EAAE,OAAO,MAAM,EAAE;AAE/E,SAAO,kBAAkB,uBAAuB,OAAO,YAAY;AACjE,UAAM,EAAE,MAAM,WAAW,KAAK,IAAI,QAAQ;AAC1C,WAAO,eAAe,MAAO,QAAQ,CAAC,CAA6B;AAAA,EACrE,CAAC;AAED,SAAO;AACT;AAMA,eAAe,iBAAgC;AAC7C,QAAM,YAAY,IAAI,qBAAqB;AAC3C,QAAM,SAAS,gBAAgB;AAC/B,QAAM,OAAO,QAAQ,SAAS;AAChC;AAEA,SAAS,eAAwB;AAC/B,MAAI,CAAC,QAAQ,KAAK,CAAC,EAAG,QAAO;AAC7B,SAAO,cAAc,YAAY,GAAG,MAAM,QAAQ,KAAK,CAAC;AAC1D;AAEA,IAAI,aAAa,GAAG;AAClB,QAAM,eAAe;AACvB;","names":[]}