break-anything 0.2.0 → 0.3.0

package/README.md

@@ -60,8 +60,9 @@ locally. Nothing is pointed anywhere you don't own.
 npx break-anything setup
 ```
 
-Pick your agent, approve the changes, restart. Works with Claude Code, Codex, Cursor, Gemini CLI,
-Windsurf, and anything that runs a local MCP server. Then just ask:
+One command. It auto-detects Claude Desktop, Claude Code, Cursor, Codex, Gemini CLI and Windsurf
+on your machine and registers Break Anything into each — backing up every file it touches,
+preserving your other servers, safe to re-run. Restart your agent, then just ask:
 
 ```text
 Use Break Anything on this project. Show me only the vulnerabilities that are

package/bin/brk.js

@@ -2,7 +2,7 @@
 import { scanDependencies } from "../src/scan.js";
 import { renderHuman } from "../src/report.js";
 
-const VERSION = "0.2.0";
+const VERSION = "0.3.0";
 
 const HELP = `Break Anything (brk) v${VERSION}
 点你的 Agent 指向你拥有或已授权的软件,找到漏洞、证明它、修好它。
@@ -14,7 +14,7 @@ const HELP = `Break Anything (brk) v${VERSION}
   brk sast [path]        静态代码分析找漏洞(需 semgrep)
   brk mcp                以 MCP server 模式启动(供 Agent 调用)
   brk doctor             检查运行环境与网络连通性
-  brk setup              打印把 Break Anything 接入 Agent 的 MCP 配置
+  brk setup              自动把 Break Anything 注册进本机各家 Agent(--dry-run 预演,--print 仅打印配置)
   brk --help             显示本帮助
   brk --version          显示版本
 
@@ -142,7 +142,38 @@ async function main() {
   }
 
   if (cmd === "setup") {
-    printSetup();
+    const { flags } = parseFlags(rest);
+    const { runSetup, manualConfig } = await import("../src/setup.js");
+    if (flags.print) {
+      process.stdout.write(
+        "把下面的配置加入你的 MCP 客户端,然后重启 Agent:\n\n" +
+          JSON.stringify(manualConfig, null, 2) + "\n",
+      );
+      return;
+    }
+    const dry = !!flags["dry-run"];
+    const { results, absent, anyPresent } = await runSetup({ dryRun: dry });
+    process.stdout.write(`Break Anything · setup${dry ? " (dry run)" : ""}\n\n`);
+    if (!anyPresent) {
+      process.stdout.write(
+        "未检测到受支持的 Agent。把下面的配置手动加入你的 MCP 客户端:\n\n" +
+          JSON.stringify(manualConfig, null, 2) + "\n",
+      );
+      return;
+    }
+    const label = {
+      created: "✓ 已注册(新建配置)", updated: "✓ 已注册", already: "• 已存在,无需改动",
+      "would-create": "将新建并注册", "would-update": "将注册",
+      skipped: "⚠ 跳过", error: "✗ 出错",
+    };
+    for (const r of results) {
+      process.stdout.write(`  ${label[r.status] || r.status}  ${r.agent.name}\n`);
+      process.stdout.write(`      ${r.agent.file}\n`);
+      if (r.backup) process.stdout.write(`      已备份原配置 → ${r.backup}\n`);
+      if (r.reason) process.stdout.write(`      ${r.reason}\n`);
+    }
+    if (absent.length) process.stdout.write(`\n未检测到(已跳过):${absent.map((a) => a.name).join("、")}\n`);
+    if (!dry) process.stdout.write(`\n重启你的 Agent,然后对它说:"用 Break Anything 扫描我的项目"。\n`);
     return;
   }
 
@@ -168,19 +199,6 @@ async function doctor() {
   process.stdout.write(out.join("\n") + "\n");
 }
 
-function printSetup() {
-  const config = {
-    mcpServers: {
-      "break-anything": { command: "npx", args: ["-y", "break-anything", "mcp"] },
-    },
-  };
-  process.stdout.write(
-    "把下面的配置加入你的 MCP 客户端(Claude Code / Cursor / Codex 等):\n\n" +
-      JSON.stringify(config, null, 2) +
-      "\n\n然后重启 Agent,对它说:用 Break Anything 扫描我的项目依赖。\n",
-  );
-}
-
 main().catch((err) => {
   process.stderr.write(`错误:${err instanceof Error ? err.stack || err.message : String(err)}\n`);
   process.exitCode = 1;

package/docs/readme/README_zh.md

@@ -47,7 +47,7 @@ Break Anything 把你的编码 Agent 指向你自己的代码、应用和基础
 npx break-anything setup
 ```
 
-选 Agent、确认改动、重启。支持 Claude Code、Codex、Cursor、Gemini CLI、Windsurf,以及任何能跑本地 MCP 的客户端。然后直接说:
+一行命令。它自动探测本机的 Claude Desktop、Claude Code、Cursor、Codex、Gemini CLI、Windsurf,把 Break Anything 注册进每一个——每个文件先备份、保留你原有的其它 server、可安全重复运行。重启 Agent,然后直接说:
 
 ```text
 用 Break Anything 扫这个项目。只给我代码里真正可达的漏洞,证明最严重的那条,给我修复方案。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "break-anything",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "One CLI and MCP server for coding agents to find vulnerabilities across code, dependencies, apps, and infrastructure — on targets you own or are authorized to test.",
   "type": "module",
   "keywords": [

package/src/mcp.js

@@ -79,7 +79,7 @@ const TOOLS = [
 
 export async function startMcpServer() {
   const server = new Server(
-    { name: "break-anything", version: "0.2.0" },
+    { name: "break-anything", version: "0.3.0" },
     { capabilities: { tools: {} } },
   );
 

package/src/setup.js

@@ -0,0 +1,109 @@
+import { readFile, writeFile, mkdir, copyFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// 一行把 Break Anything 的 MCP server 注册进本机各家编码 Agent。
+// 原则:只探测已安装的 Agent;先备份;只增/改 break-anything 这一个条目,绝不动别的;
+// 幂等、可重复运行;坏配置文件只跳过不破坏。
+
+const SERVER_NAME = "break-anything";
+const ENTRY = { command: "npx", args: ["-y", "break-anything", "mcp"] };
+
+// 各家 Agent 的配置文件与"已安装"标记目录(覆盖 macOS / Windows / Linux)
+export function agents(home = os.homedir(), platform = process.platform, env = process.env) {
+  const appData = env.APPDATA || path.join(home, "AppData", "Roaming");
+  const claudeDesktop =
+    platform === "darwin" ? path.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json")
+    : platform === "win32" ? path.join(appData, "Claude", "claude_desktop_config.json")
+    : path.join(home, ".config", "Claude", "claude_desktop_config.json");
+  return [
+    { id: "claude-desktop", name: "Claude Desktop", file: claudeDesktop, format: "json", markers: [path.dirname(claudeDesktop)] },
+    { id: "claude-code", name: "Claude Code", file: path.join(home, ".claude.json"), format: "json", markers: [path.join(home, ".claude.json"), path.join(home, ".claude")] },
+    { id: "cursor", name: "Cursor", file: path.join(home, ".cursor", "mcp.json"), format: "json", markers: [path.join(home, ".cursor")] },
+    { id: "windsurf", name: "Windsurf", file: path.join(home, ".codeium", "windsurf", "mcp_config.json"), format: "json", markers: [path.join(home, ".codeium", "windsurf"), path.join(home, ".codeium")] },
+    { id: "gemini", name: "Gemini CLI", file: path.join(home, ".gemini", "settings.json"), format: "json", markers: [path.join(home, ".gemini")] },
+    { id: "codex", name: "Codex", file: path.join(home, ".codex", "config.toml"), format: "toml", markers: [path.join(home, ".codex")] },
+  ];
+}
+
+function isPresent(agent) {
+  return existsSync(agent.file) || agent.markers.some((m) => existsSync(m));
+}
+
+// ---- 纯函数(便于单测)----
+
+// JSON:把 break-anything 合并进 mcpServers,保留其它所有内容
+export function mergeMcpJson(obj) {
+  const next = obj && typeof obj === "object" ? { ...obj } : {};
+  next.mcpServers = { ...(next.mcpServers || {}) };
+  next.mcpServers[SERVER_NAME] = { ...ENTRY };
+  return next;
+}
+
+// TOML:是否已有我们的 section
+export function tomlHasServer(text) {
+  return /\[mcp_servers\.break-anything\]/.test(text || "");
+}
+
+// TOML:追加我们的 section(不解析整个文件,只安全追加)
+export function appendTomlServer(text) {
+  const block =
+    `\n[mcp_servers.${SERVER_NAME}]\n` +
+    `command = "npx"\n` +
+    `args = ["-y", "break-anything", "mcp"]\n`;
+  const base = text && !text.endsWith("\n") ? text + "\n" : text || "";
+  return base + block;
+}
+
+// ---- 应用到单个 Agent ----
+async function applyOne(agent, { dryRun }) {
+  const existed = existsSync(agent.file);
+  let backup = null;
+
+  if (agent.format === "json") {
+    let obj = {};
+    if (existed) {
+      const raw = await readFile(agent.file, "utf8");
+      try { obj = raw.trim() ? JSON.parse(raw) : {}; }
+      catch { return { agent, status: "skipped", reason: "现有配置不是合法 JSON,未改动(请手动添加)" }; }
+      if (obj.mcpServers && obj.mcpServers[SERVER_NAME]) {
+        // 已存在且一致则跳过;否则更新
+        const cur = JSON.stringify(obj.mcpServers[SERVER_NAME]);
+        if (cur === JSON.stringify(ENTRY)) return { agent, status: "already" };
+      }
+    }
+    const next = mergeMcpJson(obj);
+    if (dryRun) return { agent, status: existed ? "would-update" : "would-create" };
+    await mkdir(path.dirname(agent.file), { recursive: true });
+    if (existed) { backup = agent.file + ".bak"; await copyFile(agent.file, backup); }
+    await writeFile(agent.file, JSON.stringify(next, null, 2) + "\n");
+    return { agent, status: existed ? "updated" : "created", backup };
+  }
+
+  // toml (Codex)
+  let text = existed ? await readFile(agent.file, "utf8") : "";
+  if (tomlHasServer(text)) return { agent, status: "already" };
+  if (dryRun) return { agent, status: existed ? "would-update" : "would-create" };
+  await mkdir(path.dirname(agent.file), { recursive: true });
+  if (existed) { backup = agent.file + ".bak"; await copyFile(agent.file, backup); }
+  await writeFile(agent.file, appendTomlServer(text));
+  return { agent, status: existed ? "updated" : "created", backup };
+}
+
+// ---- 入口 ----
+export async function runSetup({ dryRun = false, home, platform, env } = {}) {
+  const all = agents(home, platform, env);
+  const present = all.filter(isPresent);
+  const absent = all.filter((a) => !isPresent(a));
+  const results = [];
+  for (const a of present) {
+    try { results.push(await applyOne(a, { dryRun })); }
+    catch (e) { results.push({ agent: a, status: "error", reason: e instanceof Error ? e.message : String(e) }); }
+  }
+  return { results, absent, anyPresent: present.length > 0 };
+}
+
+export const manualConfig = {
+  mcpServers: { [SERVER_NAME]: ENTRY },
+};