autoremediator 0.5.0 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/README.md +7 -3
  2. package/dist/chunk-7XSZTGU7.js +16 -0
  3. package/dist/chunk-7XSZTGU7.js.map +1 -0
  4. package/dist/{chunk-VLXGEH7U.js → chunk-MUFP2DQX.js} +2623 -1732
  5. package/dist/chunk-MUFP2DQX.js.map +1 -0
  6. package/dist/cli.js +114 -13
  7. package/dist/cli.js.map +1 -1
  8. package/dist/index.d.ts +5 -210
  9. package/dist/index.js +17 -1
  10. package/dist/mcp/server.d.ts +3 -241
  11. package/dist/mcp/server.js +14 -69
  12. package/dist/mcp/server.js.map +1 -1
  13. package/dist/openapi/server.d.ts +9 -242
  14. package/dist/openapi/server.js +16 -90
  15. package/dist/openapi/server.js.map +1 -1
  16. package/dist/options-schema-DfLBOsPI.d.ts +37 -0
  17. package/dist/remediate-from-scan-C-E7gqxF.d.ts +211 -0
  18. package/llms.txt +21 -6
  19. package/package.json +2 -2
  20. package/dist/chunk-VLXGEH7U.js.map +0 -1
package/dist/mcp/server.d.ts CHANGED
@@ -1,6 +1,6 @@
1
1
  #!/usr/bin/env node
2
2
  import { Server } from '@modelcontextprotocol/sdk/server/index.js';
3
- import { remediate, planRemediation, remediateFromScan } from '../index.js';
3
+ import { r as remediate, p as planRemediation, l as remediateFromScan } from '../remediate-from-scan-C-E7gqxF.js';
4
4
 
5
5
  /**
6
6
  * autoremediator MCP server
@@ -25,169 +25,8 @@ declare const TOOLS: ({
25
25
  properties: {
26
26
  cveId: {
27
27
  type: string;
28
- description: string;
28
+ description: "CVE ID, e.g. CVE-2021-23337";
29
29
  };
30
- cwd: {
31
- type: string;
32
- description: string;
33
- };
34
- packageManager: {
35
- type: string;
36
- enum: string[];
37
- description: string;
38
- };
39
- dryRun: {
40
- type: string;
41
- description: string;
42
- };
43
- preview: {
44
- type: string;
45
- description: string;
46
- };
47
- runTests: {
48
- type: string;
49
- description: string;
50
- };
51
- llmProvider: {
52
- type: string;
53
- enum: string[];
54
- description: string;
55
- };
56
- patchesDir: {
57
- type: string;
58
- description: string;
59
- };
60
- policy: {
61
- type: string;
62
- description: string;
63
- };
64
- requestId: {
65
- type: string;
66
- description: string;
67
- };
68
- sessionId: {
69
- type: string;
70
- description: string;
71
- };
72
- parentRunId: {
73
- type: string;
74
- description: string;
75
- };
76
- idempotencyKey: {
77
- type: string;
78
- description: string;
79
- };
80
- resume: {
81
- type: string;
82
- description: string;
83
- };
84
- actor: {
85
- type: string;
86
- description: string;
87
- };
88
- source: {
89
- type: string;
90
- enum: string[];
91
- description: string;
92
- };
93
- constraints: {
94
- type: string;
95
- properties: {
96
- directDependenciesOnly: {
97
- type: string;
98
- };
99
- preferVersionBump: {
100
- type: string;
101
- };
102
- };
103
- };
104
- inputPath?: undefined;
105
- format?: undefined;
106
- evidence?: undefined;
107
- };
108
- };
109
- } | {
110
- name: string;
111
- description: string;
112
- inputSchema: {
113
- type: string;
114
- required: string[];
115
- properties: {
116
- cveId: {
117
- type: string;
118
- description: string;
119
- };
120
- cwd: {
121
- type: string;
122
- description: string;
123
- };
124
- packageManager: {
125
- type: string;
126
- enum: string[];
127
- description: string;
128
- };
129
- runTests: {
130
- type: string;
131
- description: string;
132
- };
133
- llmProvider: {
134
- type: string;
135
- enum: string[];
136
- description: string;
137
- };
138
- patchesDir: {
139
- type: string;
140
- description: string;
141
- };
142
- policy: {
143
- type: string;
144
- description: string;
145
- };
146
- requestId: {
147
- type: string;
148
- description: string;
149
- };
150
- sessionId: {
151
- type: string;
152
- description: string;
153
- };
154
- parentRunId: {
155
- type: string;
156
- description: string;
157
- };
158
- idempotencyKey: {
159
- type: string;
160
- description: string;
161
- };
162
- resume: {
163
- type: string;
164
- description: string;
165
- };
166
- actor: {
167
- type: string;
168
- description: string;
169
- };
170
- source: {
171
- type: string;
172
- enum: string[];
173
- description: string;
174
- };
175
- constraints: {
176
- type: string;
177
- properties: {
178
- directDependenciesOnly: {
179
- type: string;
180
- };
181
- preferVersionBump: {
182
- type: string;
183
- };
184
- };
185
- };
186
- dryRun?: undefined;
187
- preview?: undefined;
188
- inputPath?: undefined;
189
- format?: undefined;
190
- evidence?: undefined;
191
30
  };
192
31
  };
193
32
  } | {
@@ -199,85 +38,8 @@ declare const TOOLS: ({
199
38
  properties: {
200
39
  inputPath: {
201
40
  type: string;
202
- description: string;
203
- };
204
- cwd: {
205
- type: string;
206
- description: string;
207
- };
208
- packageManager: {
209
- type: string;
210
- enum: string[];
211
- description: string;
212
- };
213
- format: {
214
- type: string;
215
- enum: string[];
216
- description: string;
217
- };
218
- dryRun: {
219
- type: string;
220
- description: string;
221
- };
222
- preview: {
223
- type: string;
224
- description: string;
225
- };
226
- evidence: {
227
- type: string;
228
- description: string;
229
- };
230
- runTests: {
231
- type: string;
232
- description: string;
233
- };
234
- policy: {
235
- type: string;
236
- description: string;
237
- };
238
- requestId: {
239
- type: string;
240
- description: string;
241
- };
242
- sessionId: {
243
- type: string;
244
- description: string;
245
- };
246
- parentRunId: {
247
- type: string;
248
- description: string;
249
- };
250
- idempotencyKey: {
251
- type: string;
252
- description: string;
253
- };
254
- resume: {
255
- type: string;
256
- description: string;
257
- };
258
- actor: {
259
- type: string;
260
- description: string;
261
- };
262
- source: {
263
- type: string;
264
- enum: string[];
265
- description: string;
266
- };
267
- constraints: {
268
- type: string;
269
- properties: {
270
- directDependenciesOnly: {
271
- type: string;
272
- };
273
- preferVersionBump: {
274
- type: string;
275
- };
276
- };
41
+ description: "Absolute path to the scanner output file";
277
42
  };
278
- cveId?: undefined;
279
- llmProvider?: undefined;
280
- patchesDir?: undefined;
281
43
  };
282
44
  };
283
45
  })[];
package/dist/mcp/server.js CHANGED
@@ -1,9 +1,15 @@
1
1
  #!/usr/bin/env node
2
2
  import {
3
+ PACKAGE_VERSION
4
+ } from "../chunk-7XSZTGU7.js";
5
+ import {
6
+ OPTION_DESCRIPTIONS,
7
+ createRemediateOptionSchemaProperties,
8
+ createScanOptionSchemaProperties,
3
9
  planRemediation,
4
10
  remediate,
5
11
  remediateFromScan
6
- } from "../chunk-VLXGEH7U.js";
12
+ } from "../chunk-MUFP2DQX.js";
7
13
 
8
14
  // src/mcp/server.ts
9
15
  import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -20,7 +26,7 @@ var defaultDeps = {
20
26
  };
21
27
  function createBaseServer() {
22
28
  return new Server(
23
- { name: "autoremediator", version: "0.1.2" },
29
+ { name: "autoremediator", version: PACKAGE_VERSION },
24
30
  { capabilities: { tools: {} } }
25
31
  );
26
32
  }
@@ -32,29 +38,8 @@ var TOOLS = [
32
38
  type: "object",
33
39
  required: ["cveId"],
34
40
  properties: {
35
- cveId: { type: "string", description: "CVE ID, e.g. CVE-2021-23337" },
36
- cwd: { type: "string", description: "Absolute path to the project root (default: process.cwd())" },
37
- packageManager: { type: "string", enum: ["npm", "pnpm", "yarn"], description: "Package manager override (auto-detected by default)" },
38
- dryRun: { type: "boolean", description: "If true, plan changes but write nothing (default: false)" },
39
- preview: { type: "boolean", description: "If true, enforce non-mutating preview mode" },
40
- runTests: { type: "boolean", description: "Run package-manager test command after applying fix (default: false)" },
41
- llmProvider: { type: "string", enum: ["openai", "anthropic", "local"], description: "LLM provider override" },
42
- patchesDir: { type: "string", description: "Directory to write .patch files (default: ./patches)" },
43
- policy: { type: "string", description: "Optional path to .autoremediator policy file" },
44
- requestId: { type: "string", description: "Request correlation ID" },
45
- sessionId: { type: "string", description: "Session correlation ID" },
46
- parentRunId: { type: "string", description: "Parent run correlation ID" },
47
- idempotencyKey: { type: "string", description: "Idempotency key for replay-safe execution" },
48
- resume: { type: "boolean", description: "Return cached result for matching idempotency key when available" },
49
- actor: { type: "string", description: "Actor identity for evidence provenance" },
50
- source: { type: "string", enum: ["cli", "sdk", "mcp", "openapi", "unknown"], description: "Source system for provenance" },
51
- constraints: {
52
- type: "object",
53
- properties: {
54
- directDependenciesOnly: { type: "boolean" },
55
- preferVersionBump: { type: "boolean" }
56
- }
57
- }
41
+ cveId: { type: "string", description: OPTION_DESCRIPTIONS.cveId },
42
+ ...createRemediateOptionSchemaProperties()
58
43
  }
59
44
  }
60
45
  },
@@ -65,27 +50,8 @@ var TOOLS = [
65
50
  type: "object",
66
51
  required: ["cveId"],
67
52
  properties: {
68
- cveId: { type: "string", description: "CVE ID, e.g. CVE-2021-23337" },
69
- cwd: { type: "string", description: "Absolute path to the project root (default: process.cwd())" },
70
- packageManager: { type: "string", enum: ["npm", "pnpm", "yarn"], description: "Package manager override (auto-detected by default)" },
71
- runTests: { type: "boolean", description: "Run package-manager test command after applying fix (default: false)" },
72
- llmProvider: { type: "string", enum: ["openai", "anthropic", "local"], description: "LLM provider override" },
73
- patchesDir: { type: "string", description: "Directory to write .patch files (default: ./patches)" },
74
- policy: { type: "string", description: "Optional path to .autoremediator policy file" },
75
- requestId: { type: "string", description: "Request correlation ID" },
76
- sessionId: { type: "string", description: "Session correlation ID" },
77
- parentRunId: { type: "string", description: "Parent run correlation ID" },
78
- idempotencyKey: { type: "string", description: "Idempotency key for replay-safe execution" },
79
- resume: { type: "boolean", description: "Return cached result for matching idempotency key when available" },
80
- actor: { type: "string", description: "Actor identity for evidence provenance" },
81
- source: { type: "string", enum: ["cli", "sdk", "mcp", "openapi", "unknown"], description: "Source system for provenance" },
82
- constraints: {
83
- type: "object",
84
- properties: {
85
- directDependenciesOnly: { type: "boolean" },
86
- preferVersionBump: { type: "boolean" }
87
- }
88
- }
53
+ cveId: { type: "string", description: OPTION_DESCRIPTIONS.cveId },
54
+ ...createRemediateOptionSchemaProperties({ includeDryRun: false, includePreview: false, includeEvidence: true })
89
55
  }
90
56
  }
91
57
  },
@@ -96,29 +62,8 @@ var TOOLS = [
96
62
  type: "object",
97
63
  required: ["inputPath"],
98
64
  properties: {
99
- inputPath: { type: "string", description: "Absolute path to the scanner output file" },
100
- cwd: { type: "string", description: "Absolute path to the project root" },
101
- packageManager: { type: "string", enum: ["npm", "pnpm", "yarn"], description: "Package manager override (auto-detected by default)" },
102
- format: { type: "string", enum: ["auto", "npm-audit", "yarn-audit", "sarif"], description: "Scanner format (default: auto)" },
103
- dryRun: { type: "boolean", description: "If true, plan changes but write nothing" },
104
- preview: { type: "boolean", description: "If true, enforce non-mutating preview mode" },
105
- evidence: { type: "boolean", description: "Write evidence JSON to .autoremediator/evidence/ (default: true)" },
106
- runTests: { type: "boolean", description: "Run package-manager test command after applying fix (default: false)" },
107
- policy: { type: "string", description: "Optional path to .autoremediator policy file" },
108
- requestId: { type: "string", description: "Request correlation ID" },
109
- sessionId: { type: "string", description: "Session correlation ID" },
110
- parentRunId: { type: "string", description: "Parent run correlation ID" },
111
- idempotencyKey: { type: "string", description: "Idempotency key for replay-safe execution" },
112
- resume: { type: "boolean", description: "Return cached result for matching idempotency key when available" },
113
- actor: { type: "string", description: "Actor identity for evidence provenance" },
114
- source: { type: "string", enum: ["cli", "sdk", "mcp", "openapi", "unknown"], description: "Source system for provenance" },
115
- constraints: {
116
- type: "object",
117
- properties: {
118
- directDependenciesOnly: { type: "boolean" },
119
- preferVersionBump: { type: "boolean" }
120
- }
121
- }
65
+ inputPath: { type: "string", description: OPTION_DESCRIPTIONS.inputPath },
66
+ ...createScanOptionSchemaProperties()
122
67
  }
123
68
  }
124
69
  }
package/dist/mcp/server.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../../src/mcp/server.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * autoremediator MCP server\n *\n * Exposes all autoremediator tools via the Model Context Protocol so LLM hosts\n * (Claude Desktop, Cursor, Copilot, etc.) can invoke them directly.\n *\n * Start: autoremediator-mcp (stdio transport)\n */\nimport { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { fileURLToPath } from \"node:url\";\nimport { planRemediation, remediate, remediateFromScan } from \"../api.js\";\n\ninterface McpApiDeps {\n remediateFn: typeof remediate;\n planRemediationFn: typeof planRemediation;\n remediateFromScanFn: typeof remediateFromScan;\n}\n\nconst defaultDeps: McpApiDeps = {\n remediateFn: remediate,\n planRemediationFn: planRemediation,\n remediateFromScanFn: remediateFromScan,\n};\n\nfunction createBaseServer(): Server {\n return new Server(\n { name: \"autoremediator\", version: \"0.1.2\" },\n { capabilities: { tools: {} } }\n );\n}\n\n// ---------------------------------------------------------------------------\n// Tool definitions\n// ---------------------------------------------------------------------------\n\nexport const TOOLS = [\n {\n name: \"remediate\",\n description:\n \"Remediate a single CVE in a Node.js project. Looks up the CVE, scans the project inventory, and applies a version bump or generates a patch file. Returns a RemediationReport.\",\n inputSchema: {\n type: \"object\",\n required: [\"cveId\"],\n properties: {\n cveId: { type: \"string\", description: \"CVE ID, e.g. CVE-2021-23337\" },\n cwd: { type: \"string\", description: \"Absolute path to the project root (default: process.cwd())\" },\n packageManager: { type: \"string\", enum: [\"npm\", \"pnpm\", \"yarn\"], description: \"Package manager override (auto-detected by default)\" },\n dryRun: { type: \"boolean\", description: \"If true, plan changes but write nothing (default: false)\" },\n preview: { type: \"boolean\", description: \"If true, enforce non-mutating preview mode\" },\n runTests: { type: \"boolean\", description: \"Run package-manager test command after applying fix (default: false)\" },\n llmProvider: { type: \"string\", enum: [\"openai\", \"anthropic\", \"local\"], description: \"LLM provider override\" },\n patchesDir: { type: \"string\", description: \"Directory to write .patch files (default: ./patches)\" },\n policy: { type: \"string\", description: \"Optional path to .autoremediator policy file\" },\n requestId: { type: \"string\", description: \"Request correlation ID\" },\n sessionId: { type: \"string\", description: \"Session correlation ID\" },\n parentRunId: { type: \"string\", description: \"Parent run correlation ID\" },\n idempotencyKey: { type: \"string\", description: \"Idempotency key for replay-safe execution\" },\n resume: { type: \"boolean\", description: \"Return cached result for matching idempotency key when available\" },\n actor: { type: \"string\", description: \"Actor identity for evidence provenance\" },\n source: { type: \"string\", enum: [\"cli\", \"sdk\", \"mcp\", \"openapi\", \"unknown\"], description: \"Source system for provenance\" },\n constraints: {\n type: \"object\",\n properties: {\n directDependenciesOnly: { type: \"boolean\" },\n preferVersionBump: { type: \"boolean\" },\n },\n },\n },\n },\n },\n {\n name: \"planRemediation\",\n description:\n \"Generate a non-mutating remediation preview for a single CVE in a Node.js project. Returns a RemediationReport with planned results.\",\n inputSchema: {\n type: \"object\",\n required: [\"cveId\"],\n properties: {\n cveId: { type: \"string\", description: \"CVE ID, e.g. CVE-2021-23337\" },\n cwd: { type: \"string\", description: \"Absolute path to the project root (default: process.cwd())\" },\n packageManager: { type: \"string\", enum: [\"npm\", \"pnpm\", \"yarn\"], description: \"Package manager override (auto-detected by default)\" },\n runTests: { type: \"boolean\", description: \"Run package-manager test command after applying fix (default: false)\" },\n llmProvider: { type: \"string\", enum: [\"openai\", \"anthropic\", \"local\"], description: \"LLM provider override\" },\n patchesDir: { type: \"string\", description: \"Directory to write .patch files (default: ./patches)\" },\n policy: { type: \"string\", description: \"Optional path to .autoremediator policy file\" },\n requestId: { type: \"string\", description: \"Request correlation ID\" },\n sessionId: { type: \"string\", description: \"Session correlation ID\" },\n parentRunId: { type: \"string\", description: \"Parent run correlation ID\" },\n idempotencyKey: { type: \"string\", description: \"Idempotency key for replay-safe execution\" },\n resume: { type: \"boolean\", description: \"Return cached result for matching idempotency key when available\" },\n actor: { type: \"string\", description: \"Actor identity for evidence provenance\" },\n source: { type: \"string\", enum: [\"cli\", \"sdk\", \"mcp\", \"openapi\", \"unknown\"], description: \"Source system for provenance\" },\n constraints: {\n type: \"object\",\n properties: {\n directDependenciesOnly: { type: \"boolean\" },\n preferVersionBump: { type: \"boolean\" },\n },\n },\n },\n },\n },\n {\n name: \"remediateFromScan\",\n description:\n \"Parse an npm/pnpm/yarn audit JSON or SARIF scan file, extract all CVE IDs, and remediate each one. Returns a ScanReport.\",\n inputSchema: {\n type: \"object\",\n required: [\"inputPath\"],\n properties: {\n inputPath: { type: \"string\", description: \"Absolute path to the scanner output file\" },\n cwd: { type: \"string\", description: \"Absolute path to the project root\" },\n packageManager: { type: \"string\", enum: [\"npm\", \"pnpm\", \"yarn\"], description: \"Package manager override (auto-detected by default)\" },\n format: { type: \"string\", enum: [\"auto\", \"npm-audit\", \"yarn-audit\", \"sarif\"], description: \"Scanner format (default: auto)\" },\n dryRun: { type: \"boolean\", description: \"If true, plan changes but write nothing\" },\n preview: { type: \"boolean\", description: \"If true, enforce non-mutating preview mode\" },\n evidence: { type: \"boolean\", description: \"Write evidence JSON to .autoremediator/evidence/ (default: true)\" },\n runTests: { type: \"boolean\", description: \"Run package-manager test command after applying fix (default: false)\" },\n policy: { type: \"string\", description: \"Optional path to .autoremediator policy file\" },\n requestId: { type: \"string\", description: \"Request correlation ID\" },\n sessionId: { type: \"string\", description: \"Session correlation ID\" },\n parentRunId: { type: \"string\", description: \"Parent run correlation ID\" },\n idempotencyKey: { type: \"string\", description: \"Idempotency key for replay-safe execution\" },\n resume: { type: \"boolean\", description: \"Return cached result for matching idempotency key when available\" },\n actor: { type: \"string\", description: \"Actor identity for evidence provenance\" },\n source: { type: \"string\", enum: [\"cli\", \"sdk\", \"mcp\", \"openapi\", \"unknown\"], description: \"Source system for provenance\" },\n constraints: {\n type: \"object\",\n properties: {\n directDependenciesOnly: { type: \"boolean\" },\n preferVersionBump: { type: \"boolean\" },\n },\n },\n },\n },\n },\n];\n\nexport async function handleToolCall(\n name: string,\n args: Record<string, unknown> = {},\n deps: McpApiDeps = defaultDeps\n): Promise<{ content: Array<{ type: \"text\"; text: string }>; isError?: boolean }> {\n const withMcpSource = (options: Record<string, unknown>): Record<string, unknown> => ({\n ...options,\n source: typeof options.source === \"string\" ? options.source : \"mcp\",\n });\n\n try {\n if (name === \"remediate\") {\n const { cveId, ...options } = args as { cveId: string; [key: string]: unknown };\n const report = await deps.remediateFn(cveId, withMcpSource(options) as Parameters<typeof remediate>[1]);\n return { content: [{ type: \"text\", text: JSON.stringify(report, null, 2) }] };\n }\n\n if (name === \"planRemediation\") {\n const { cveId, ...options } = args as { cveId: string; [key: string]: unknown };\n const report = await deps.planRemediationFn(cveId, withMcpSource(options) as Parameters<typeof planRemediation>[1]);\n return { content: [{ type: \"text\", text: JSON.stringify(report, null, 2) }] };\n }\n\n if (name === \"remediateFromScan\") {\n const { inputPath, ...options } = args as { inputPath: string; [key: string]: unknown };\n const report = await deps.remediateFromScanFn(inputPath, withMcpSource(options) as Parameters<typeof remediateFromScan>[1]);\n return { content: [{ type: \"text\", text: JSON.stringify(report, null, 2) }] };\n }\n\n return {\n content: [{ type: \"text\", text: `Unknown tool: ${name}` }],\n isError: true,\n };\n } catch (err) {\n return {\n content: [{ type: \"text\", text: err instanceof Error ? err.message : String(err) }],\n isError: true,\n };\n }\n}\n\nexport function createMcpServer(): Server {\n const server = createBaseServer();\n\n server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));\n\n server.setRequestHandler(CallToolRequestSchema, async (request) => {\n const { name, arguments: args } = request.params;\n return handleToolCall(name, (args ?? {}) as Record<string, unknown>);\n });\n\n return server;\n}\n\n// ---------------------------------------------------------------------------\n// Start\n// ---------------------------------------------------------------------------\n\nasync function startMcpServer(): Promise<void> {\n const transport = new StdioServerTransport();\n const server = createMcpServer();\n await server.connect(transport);\n}\n\nfunction isMainModule(): boolean {\n if (!process.argv[1]) return false;\n return fileURLToPath(import.meta.url) === process.argv[1];\n}\n\nif (isMainModule()) {\n await startMcpServer();\n}\n"],"mappings":";;;;;;;;AASA,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAS9B,IAAM,cAA0B;AAAA,EAC9B,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,qBAAqB;AACvB;AAEA,SAAS,mBAA2B;AAClC,SAAO,IAAI;AAAA,IACT,EAAE,MAAM,kBAAkB,SAAS,QAAQ;AAAA,IAC3C,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EAChC;AACF;AAMO,IAAM,QAAQ;AAAA,EACnB;AAAA,IACE,MAAM;AAAA,IACN,aACE;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,UAAU,CAAC,OAAO;AAAA,MAClB,YAAY;AAAA,QACV,OAAO,EAAE,MAAM,UAAU,aAAa,8BAA8B;AAAA,QACpE,KAAK,EAAE,MAAM,UAAU,aAAa,6DAA6D;AAAA,QACjG,gBAAgB,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,QAAQ,MAAM,GAAG,aAAa,sDAAsD;AAAA,QACpI,QAAQ,EAAE,MAAM,WAAW,aAAa,2DAA2D;AAAA,QACnG,SAAS,EAAE,MAAM,WAAW,aAAa,6CAA6C;AAAA,QACtF,UAAU,EAAE,MAAM,WAAW,aAAa,uEAAuE;AAAA,QACjH,aAAa,EAAE,MAAM,UAAU,MAAM,CAAC,UAAU,aAAa,OAAO,GAAG,aAAa,wBAAwB;AAAA,QAC5G,YAAY,EAAE,MAAM,UAAU,aAAa,uDAAuD;AAAA,QAClG,QAAQ,EAAE,MAAM,UAAU,aAAa,+CAA+C;AAAA,QACtF,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,aAAa,EAAE,MAAM,UAAU,aAAa,4BAA4B;AAAA,QACxE,gBAAgB,EAAE,MAAM,UAAU,aAAa,4CAA4C;AAAA,QAC3F,QAAQ,EAAE,MAAM,WAAW,aAAa,mEAAmE;AAAA,QAC3G,OAAO,EAAE,MAAM,UAAU,aAAa,yCAAyC;AAAA,QAC/E,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,OAAO,OAAO,WAAW,SAAS,GAAG,aAAa,+BAA+B;AAAA,QACzH,aAAa;AAAA,UACX,MAAM;AAAA,UACN,YAAY;AAAA,YACV,wBAAwB,EAAE,MAAM,UAAU;AAAA,YAC1C,mBAAmB,EAAE,MAAM,UAAU;AAAA,UACvC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aACE;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,UAAU,CAAC,OAAO;AAAA,MAClB,YAAY;AAAA,QACV,OAAO,EAAE,MAAM,UAAU,aAAa,8BAA8B;AAAA,QACpE,KAAK,EAAE,MAAM,UAAU,aAAa,6DAA6D;AAAA,QACjG,gBAAgB,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,QAAQ,MAAM,GAAG,aAAa,sDAAsD;AAAA,QACpI,UAAU,EAAE,MAAM,WAAW,aAAa,uEAAuE;AAAA,QACjH,aAAa,EAAE,MAAM,UAAU,MAAM,CAAC,UAAU,aAAa,OAAO,GAAG,aAAa,wBAAwB;AAAA,QAC5G,YAAY,EAAE,MAAM,UAAU,aAAa,uDAAuD;AAAA,QAClG,QAAQ,EAAE,MAAM,UAAU,aAAa,+CAA+C;AAAA,QACtF,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,aAAa,EAAE,MAAM,UAAU,aAAa,4BAA4B;AAAA,QACxE,gBAAgB,EAAE,MAAM,UAAU,aAAa,4CAA4C;AAAA,QAC3F,QAAQ,EAAE,MAAM,WAAW,aAAa,mEAAmE;AAAA,QAC3G,OAAO,EAAE,MAAM,UAAU,aAAa,yCAAyC;AAAA,QAC/E,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,OAAO,OAAO,WAAW,SAAS,GAAG,aAAa,+BAA+B;AAAA,QACzH,aAAa;AAAA,UACX,MAAM;AAAA,UACN,YAAY;AAAA,YACV,wBAAwB,EAAE,MAAM,UAAU;AAAA,YAC1C,mBAAmB,EAAE,MAAM,UAAU;AAAA,UACvC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aACE;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,UAAU,CAAC,WAAW;AAAA,MACtB,YAAY;AAAA,QACV,WAAW,EAAE,MAAM,UAAU,aAAa,2CAA2C;AAAA,QACrF,KAAK,EAAE,MAAM,UAAU,aAAa,oCAAoC;AAAA,QACxE,gBAAgB,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,QAAQ,MAAM,GAAG,aAAa,sDAAsD;AAAA,QACpI,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,QAAQ,aAAa,cAAc,OAAO,GAAG,aAAa,iCAAiC;AAAA,QAC5H,QAAQ,EAAE,MAAM,WAAW,aAAa,0CAA0C;AAAA,QAClF,SAAS,EAAE,MAAM,WAAW,aAAa,6CAA6C;AAAA,QACtF,UAAU,EAAE,MAAM,WAAW,aAAa,mEAAmE;AAAA,QAC7G,UAAU,EAAE,MAAM,WAAW,aAAa,uEAAuE;AAAA,QACjH,QAAQ,EAAE,MAAM,UAAU,aAAa,+CAA+C;AAAA,QACtF,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,WAAW,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,QACnE,aAAa,EAAE,MAAM,UAAU,aAAa,4BAA4B;AAAA,QACxE,gBAAgB,EAAE,MAAM,UAAU,aAAa,4CAA4C;AAAA,QAC3F,QAAQ,EAAE,MAAM,WAAW,aAAa,mEAAmE;AAAA,QAC3G,OAAO,EAAE,MAAM,UAAU,aAAa,yCAAyC;AAAA,QAC/E,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,OAAO,OAAO,OAAO,WAAW,SAAS,GAAG,aAAa,+BAA+B;AAAA,QACzH,aAAa;AAAA,UACX,MAAM;AAAA,UACN,YAAY;AAAA,YACV,wBAAwB,EAAE,MAAM,UAAU;AAAA,YAC1C,mBAAmB,EAAE,MAAM,UAAU;AAAA,UACvC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,eACpB,MACA,OAAgC,CAAC,GACjC,OAAmB,aAC6D;AAChF,QAAM,gBAAgB,CAAC,aAA+D;AAAA,IACpF,GAAG;AAAA,IACH,QAAQ,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS;AAAA,EAChE;AAEA,MAAI;AACF,QAAI,SAAS,aAAa;AACxB,YAAM,EAAE,OAAO,GAAG,QAAQ,IAAI;AAC9B,YAAM,SAAS,MAAM,KAAK,YAAY,OAAO,cAAc,OAAO,CAAoC;AACtG,aAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,IAC9E;AAEA,QAAI,SAAS,mBAAmB;AAC9B,YAAM,EAAE,OAAO,GAAG,QAAQ,IAAI;AAC9B,YAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,cAAc,OAAO,CAA0C;AAClH,aAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,IAC9E;AAEA,QAAI,SAAS,qBAAqB;AAChC,YAAM,EAAE,WAAW,GAAG,QAAQ,IAAI;AAClC,YAAM,SAAS,MAAM,KAAK,oBAAoB,WAAW,cAAc,OAAO,CAA4C;AAC1H,aAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,IAC9E;AAEA,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,iBAAiB,IAAI,GAAG,CAAC;AAAA,MACzD,SAAS;AAAA,IACX;AAAA,EACF,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,CAAC;AAAA,MAClF,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAEO,SAAS,kBAA0B;AACxC,QAAM,SAAS,iBAAiB;AAEhC,SAAO,kBAAkB,wBAAwB,aAAa,EAAE,OAAO,MAAM,EAAE;AAE/E,SAAO,kBAAkB,uBAAuB,OAAO,YAAY;AACjE,UAAM,EAAE,MAAM,WAAW,KAAK,IAAI,QAAQ;AAC1C,WAAO,eAAe,MAAO,QAAQ,CAAC,CAA6B;AAAA,EACrE,CAAC;AAED,SAAO;AACT;AAMA,eAAe,iBAAgC;AAC7C,QAAM,YAAY,IAAI,qBAAqB;AAC3C,QAAM,SAAS,gBAAgB;AAC/B,QAAM,OAAO,QAAQ,SAAS;AAChC;AAEA,SAAS,eAAwB;AAC/B,MAAI,CAAC,QAAQ,KAAK,CAAC,EAAG,QAAO;AAC7B,SAAO,cAAc,YAAY,GAAG,MAAM,QAAQ,KAAK,CAAC;AAC1D;AAEA,IAAI,aAAa,GAAG;AAClB,QAAM,eAAe;AACvB;","names":[]}
1
+ {"version":3,"sources":["../../src/mcp/server.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * autoremediator MCP server\n *\n * Exposes all autoremediator tools via the Model Context Protocol so LLM hosts\n * (Claude Desktop, Cursor, Copilot, etc.) can invoke them directly.\n *\n * Start: autoremediator-mcp (stdio transport)\n */\nimport { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n createRemediateOptionSchemaProperties,\n createScanOptionSchemaProperties,\n OPTION_DESCRIPTIONS,\n planRemediation,\n remediate,\n remediateFromScan,\n} from \"../api/index.js\";\nimport { PACKAGE_VERSION } from \"../version\";\n\ninterface McpApiDeps {\n remediateFn: typeof remediate;\n planRemediationFn: typeof planRemediation;\n remediateFromScanFn: typeof remediateFromScan;\n}\n\nconst defaultDeps: McpApiDeps = {\n remediateFn: remediate,\n planRemediationFn: planRemediation,\n remediateFromScanFn: remediateFromScan,\n};\n\nfunction createBaseServer(): Server {\n return new Server(\n { name: \"autoremediator\", version: PACKAGE_VERSION },\n { capabilities: { tools: {} } }\n );\n}\n\n// ---------------------------------------------------------------------------\n// Tool definitions\n// ---------------------------------------------------------------------------\n\nexport const TOOLS = [\n {\n name: \"remediate\",\n description:\n \"Remediate a single CVE in a Node.js project. Looks up the CVE, scans the project inventory, and applies a version bump or generates a patch file. Returns a RemediationReport.\",\n inputSchema: {\n type: \"object\",\n required: [\"cveId\"],\n properties: {\n cveId: { type: \"string\", description: OPTION_DESCRIPTIONS.cveId },\n ...createRemediateOptionSchemaProperties(),\n },\n },\n },\n {\n name: \"planRemediation\",\n description:\n \"Generate a non-mutating remediation preview for a single CVE in a Node.js project. Returns a RemediationReport with planned results.\",\n inputSchema: {\n type: \"object\",\n required: [\"cveId\"],\n properties: {\n cveId: { type: \"string\", description: OPTION_DESCRIPTIONS.cveId },\n ...createRemediateOptionSchemaProperties({ includeDryRun: false, includePreview: false, includeEvidence: true }),\n },\n },\n },\n {\n name: \"remediateFromScan\",\n description:\n \"Parse an npm/pnpm/yarn audit JSON or SARIF scan file, extract all CVE IDs, and remediate each one. Returns a ScanReport.\",\n inputSchema: {\n type: \"object\",\n required: [\"inputPath\"],\n properties: {\n inputPath: { type: \"string\", description: OPTION_DESCRIPTIONS.inputPath },\n ...createScanOptionSchemaProperties(),\n },\n },\n },\n];\n\nexport async function handleToolCall(\n name: string,\n args: Record<string, unknown> = {},\n deps: McpApiDeps = defaultDeps\n): Promise<{ content: Array<{ type: \"text\"; text: string }>; isError?: boolean }> {\n const withMcpSource = (options: Record<string, unknown>): Record<string, unknown> => ({\n ...options,\n source: typeof options.source === \"string\" ? options.source : \"mcp\",\n });\n\n try {\n if (name === \"remediate\") {\n const { cveId, ...options } = args as { cveId: string; [key: string]: unknown };\n const report = await deps.remediateFn(cveId, withMcpSource(options) as Parameters<typeof remediate>[1]);\n return { content: [{ type: \"text\", text: JSON.stringify(report, null, 2) }] };\n }\n\n if (name === \"planRemediation\") {\n const { cveId, ...options } = args as { cveId: string; [key: string]: unknown };\n const report = await deps.planRemediationFn(cveId, withMcpSource(options) as Parameters<typeof planRemediation>[1]);\n return { content: [{ type: \"text\", text: JSON.stringify(report, null, 2) }] };\n }\n\n if (name === \"remediateFromScan\") {\n const { inputPath, ...options } = args as { inputPath: string; [key: string]: unknown };\n const report = await deps.remediateFromScanFn(inputPath, withMcpSource(options) as Parameters<typeof remediateFromScan>[1]);\n return { content: [{ type: \"text\", text: JSON.stringify(report, null, 2) }] };\n }\n\n return {\n content: [{ type: \"text\", text: `Unknown tool: ${name}` }],\n isError: true,\n };\n } catch (err) {\n return {\n content: [{ type: \"text\", text: err instanceof Error ? err.message : String(err) }],\n isError: true,\n };\n }\n}\n\nexport function createMcpServer(): Server {\n const server = createBaseServer();\n\n server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));\n\n server.setRequestHandler(CallToolRequestSchema, async (request) => {\n const { name, arguments: args } = request.params;\n return handleToolCall(name, (args ?? {}) as Record<string, unknown>);\n });\n\n return server;\n}\n\n// ---------------------------------------------------------------------------\n// Start\n// ---------------------------------------------------------------------------\n\nasync function startMcpServer(): Promise<void> {\n const transport = new StdioServerTransport();\n const server = createMcpServer();\n await server.connect(transport);\n}\n\nfunction isMainModule(): boolean {\n if (!process.argv[1]) return false;\n return fileURLToPath(import.meta.url) === process.argv[1];\n}\n\nif (isMainModule()) {\n await startMcpServer();\n}\n"],"mappings":";;;;;;;;;;;;;;AASA,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAiB9B,IAAM,cAA0B;AAAA,EAC9B,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,qBAAqB;AACvB;AAEA,SAAS,mBAA2B;AAClC,SAAO,IAAI;AAAA,IACT,EAAE,MAAM,kBAAkB,SAAS,gBAAgB;AAAA,IACnD,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EAChC;AACF;AAMO,IAAM,QAAQ;AAAA,EACnB;AAAA,IACE,MAAM;AAAA,IACN,aACE;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,UAAU,CAAC,OAAO;AAAA,MAClB,YAAY;AAAA,QACV,OAAO,EAAE,MAAM,UAAU,aAAa,oBAAoB,MAAM;AAAA,QAChE,GAAG,sCAAsC;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aACE;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,UAAU,CAAC,OAAO;AAAA,MAClB,YAAY;AAAA,QACV,OAAO,EAAE,MAAM,UAAU,aAAa,oBAAoB,MAAM;AAAA,QAChE,GAAG,sCAAsC,EAAE,eAAe,OAAO,gBAAgB,OAAO,iBAAiB,KAAK,CAAC;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aACE;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,UAAU,CAAC,WAAW;AAAA,MACtB,YAAY;AAAA,QACV,WAAW,EAAE,MAAM,UAAU,aAAa,oBAAoB,UAAU;AAAA,QACxE,GAAG,iCAAiC;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,eACpB,MACA,OAAgC,CAAC,GACjC,OAAmB,aAC6D;AAChF,QAAM,gBAAgB,CAAC,aAA+D;AAAA,IACpF,GAAG;AAAA,IACH,QAAQ,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS;AAAA,EAChE;AAEA,MAAI;AACF,QAAI,SAAS,aAAa;AACxB,YAAM,EAAE,OAAO,GAAG,QAAQ,IAAI;AAC9B,YAAM,SAAS,MAAM,KAAK,YAAY,OAAO,cAAc,OAAO,CAAoC;AACtG,aAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,IAC9E;AAEA,QAAI,SAAS,mBAAmB;AAC9B,YAAM,EAAE,OAAO,GAAG,QAAQ,IAAI;AAC9B,YAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,cAAc,OAAO,CAA0C;AAClH,aAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,IAC9E;AAEA,QAAI,SAAS,qBAAqB;AAChC,YAAM,EAAE,WAAW,GAAG,QAAQ,IAAI;AAClC,YAAM,SAAS,MAAM,KAAK,oBAAoB,WAAW,cAAc,OAAO,CAA4C;AAC1H,aAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,IAC9E;AAEA,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,iBAAiB,IAAI,GAAG,CAAC;AAAA,MACzD,SAAS;AAAA,IACX;AAAA,EACF,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,CAAC;AAAA,MAClF,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAEO,SAAS,kBAA0B;AACxC,QAAM,SAAS,iBAAiB;AAEhC,SAAO,kBAAkB,wBAAwB,aAAa,EAAE,OAAO,MAAM,EAAE;AAE/E,SAAO,kBAAkB,uBAAuB,OAAO,YAAY;AACjE,UAAM,EAAE,MAAM,WAAW,KAAK,IAAI,QAAQ;AAC1C,WAAO,eAAe,MAAO,QAAQ,CAAC,CAA6B;AAAA,EACrE,CAAC;AAED,SAAO;AACT;AAMA,eAAe,iBAAgC;AAC7C,QAAM,YAAY,IAAI,qBAAqB;AAC3C,QAAM,SAAS,gBAAgB;AAC/B,QAAM,OAAO,QAAQ,SAAS;AAChC;AAEA,SAAS,eAAwB;AAC/B,MAAI,CAAC,QAAQ,KAAK,CAAC,EAAG,QAAO;AAC7B,SAAO,cAAc,YAAY,GAAG,MAAM,QAAQ,KAAK,CAAC;AAC1D;AAEA,IAAI,aAAa,GAAG;AAClB,QAAM,eAAe;AACvB;","names":[]}