cataam-mcp-server 0.1.0

package/README.md

@@ -0,0 +1,57 @@
+# cataam-mcp-server
+
+The MCP connector for Cataam. TypeScript, built on `@modelcontextprotocol/sdk`.
+Exposes Cataam's `/api/audit/**` compliance surface as MCP tools.
+
+## Layout
+
+```
+src/
+  config.ts   — env-var config + auth-mode selection (apiKey | jwt)
+  client.ts   — typed HTTP client for /api/audit (handles X-API-Key and JWT+refresh)
+  tools.ts    — the 6 MCP tools (one-tool-per-action; write tools require confirm:true)
+  index.ts    — entry point: stdio (default) or streamable-HTTP transport
+test/
+  smoke.mjs   — end-to-end test (spawns server over stdio, calls a read tool live)
+```
+
+## Develop
+
+```bash
+npm install
+npm run build          # tsc → dist/
+npm run dev            # run from source via tsx (stdio)
+npm run smoke          # end-to-end smoke test (needs auth env vars + a built dist/)
+```
+
+## Configuration (env vars)
+
+| Var | Purpose |
+|---|---|
+| `CATAAM_BASE_URL` | API base URL. Default `https://service.cataam.com`. |
+| `CATAAM_API_KEY` | `X-API-Key` auth (preferred). |
+| `CATAAM_USERNAME` / `CATAAM_PASSWORD` | JWT login auth (works today). |
+| `MCP_TRANSPORT` | `stdio` (default) or `http`. |
+| `PORT` | HTTP port (default 3000) when `MCP_TRANSPORT=http`. |
+
+If `CATAAM_API_KEY` is set it wins; otherwise username+password are used. Startup fails
+fast with a clear message if neither is configured.
+
+## Transports
+
+- **stdio** — what the Claude plugin and `claude mcp add` use. Auth comes from env.
+- **streamable-HTTP** — for remote/hosted SaaS deployment. Stateless: a fresh server is
+  built per request, and an incoming `X-API-Key` request header overrides the env key,
+  so one hosted process can serve many Cataam orgs. `GET`/`DELETE /mcp` return 405.
+
+## Auth scoping note
+
+Cataam's `X-API-Key` filter only covers `/api/audit/**` (and a reserved `/api/iasm/**`).
+All tools are intentionally scoped to `/api/audit/**` for **both** auth modes — even
+though JWT could reach more — so migrating customers from JWT to API keys is seamless.
+
+## Tools
+
+See [`../README.md`](../README.md#mcp-tools). Read tools: `list_compliance_tests`,
+`get_compliance_overview`, `list_failing_alerts`. Write tools (require `confirm:true`):
+`rerun_compliance_test`, `update_test_due_date`, `link_test_to_jira`.

package/dist/client.js

@@ -0,0 +1,138 @@
+/**
+ * Thin typed HTTP client for the CATAAM `/api/audit/**` compliance surface.
+ *
+ * Handles both auth modes:
+ *   - apiKey: sends `X-API-Key` on every request.
+ *   - jwt:    logs in at POST /api/login, caches the token, and transparently
+ *             re-authenticates once on a 401 (short-lived tokens expire).
+ */
+import { authMode } from "./config.js";
+export class CataamError extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+        this.name = "CataamError";
+    }
+}
+export class CataamClient {
+    cfg;
+    token;
+    constructor(cfg) {
+        this.cfg = cfg;
+    }
+    // ---- auth -------------------------------------------------------------
+    async authHeaders() {
+        if (this.cfg.apiKey)
+            return { "X-API-Key": this.cfg.apiKey };
+        if (!this.token)
+            await this.login();
+        return { Authorization: `Bearer ${this.token}` };
+    }
+    async login() {
+        const res = await fetch(`${this.cfg.baseUrl}/api/login`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                userName: this.cfg.username,
+                password: this.cfg.password,
+            }),
+        });
+        if (!res.ok) {
+            throw new CataamError(`Login failed for user "${this.cfg.username}"`, res.status, await safeText(res));
+        }
+        const data = (await res.json());
+        if (!data.token) {
+            throw new CataamError("Login response missing token", res.status);
+        }
+        this.token = data.token;
+    }
+    // ---- core request -----------------------------------------------------
+    async request(method, path, opts = {}) {
+        const url = new URL(this.cfg.baseUrl + path);
+        if (opts.query) {
+            for (const [k, v] of Object.entries(opts.query)) {
+                if (v !== undefined && v !== "")
+                    url.searchParams.set(k, String(v));
+            }
+        }
+        const headers = { ...(await this.authHeaders()) };
+        let body;
+        if (opts.body !== undefined) {
+            headers["Content-Type"] = "application/json";
+            body = JSON.stringify(opts.body);
+        }
+        const res = await fetch(url, { method, headers, body });
+        // JWT expired mid-session — re-login once and retry.
+        if (res.status === 401 &&
+            authMode(this.cfg) === "jwt" &&
+            opts.retryOn401 !== false) {
+            this.token = undefined;
+            await this.login();
+            return this.request(method, path, { ...opts, retryOn401: false });
+        }
+        if (!res.ok) {
+            throw new CataamError(`${method} ${path} → ${res.status}`, res.status, await safeText(res));
+        }
+        if (res.status === 204)
+            return undefined;
+        const text = await res.text();
+        return (text ? JSON.parse(text) : undefined);
+    }
+    // ---- read endpoints ---------------------------------------------------
+    /** GET /api/audit/tests — paginated compliance tests + aggregate stats. */
+    listComplianceTests(params) {
+        return this.request("GET", "/api/audit/tests", { query: { ...params } });
+    }
+    /** GET /api/audit/{frameworkId}/audit-progress — per-framework progress stats. */
+    getFrameworkProgress(frameworkId) {
+        return this.request("GET", `/api/audit/${frameworkId}/audit-progress`);
+    }
+    /** GET /api/audit/compliance-summary — per-framework totals & pass rate. */
+    getComplianceSummary() {
+        return this.request("GET", "/api/audit/compliance-summary");
+    }
+    /** GET /api/audit/readiness-score — overall readiness score breakdown. */
+    getReadinessScore() {
+        return this.request("GET", "/api/audit/readiness-score");
+    }
+    /** GET /api/audit/latest-failed-tests-alert — most recent failing-test alerts. */
+    getFailedTestAlerts() {
+        return this.request("GET", "/api/audit/latest-failed-tests-alert");
+    }
+    /** GET /api/audit/ccm-alerts — continuous control monitoring alerts. */
+    getCcmAlerts() {
+        return this.request("GET", "/api/audit/ccm-alerts");
+    }
+    // ---- write endpoints (callers must confirm first) ---------------------
+    /** POST /api/audit/tests/{auditProgressId}/rerun — re-execute one compliance test. */
+    rerunTest(auditProgressId) {
+        return this.request("POST", `/api/audit/tests/${auditProgressId}/rerun`);
+    }
+    /**
+     * PUT /api/audit/tests/{auditProgressId}/update-due-date?newDueDate=...
+     * The backend parses the value with Instant.parse(), so it requires a full
+     * ISO-8601 instant. A bare YYYY-MM-DD is expanded to UTC midnight.
+     */
+    updateDueDate(auditProgressId, newDueDate) {
+        const instant = /^\d{4}-\d{2}-\d{2}$/.test(newDueDate)
+            ? `${newDueDate}T00:00:00Z`
+            : newDueDate;
+        return this.request("PUT", `/api/audit/tests/${auditProgressId}/update-due-date`, { query: { newDueDate: instant } });
+    }
+    /** PATCH /api/audit/tests/{auditProgressId}/jira-link — body { jiraId }. */
+    linkToJira(auditProgressId, jiraId) {
+        return this.request("PATCH", `/api/audit/tests/${auditProgressId}/jira-link`, { body: { jiraId } });
+    }
+}
+async function safeText(res) {
+    try {
+        return await res.text();
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAgB,QAAQ,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGzB;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,IAAa;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;QAGtB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAID,MAAM,OAAO,YAAY;IAGM;IAFrB,KAAK,CAAU;IAEvB,YAA6B,GAAiB;QAAjB,QAAG,GAAH,GAAG,CAAc;IAAG,CAAC;IAElD,0EAA0E;IAElE,KAAK,CAAC,WAAW;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IACnD,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,YAAY,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;aAC5B,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CACnB,0BAA0B,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,EAC9C,GAAG,CAAC,MAAM,EACV,MAAM,QAAQ,CAAC,GAAG,CAAC,CACpB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,WAAW,CAAC,8BAA8B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED,0EAA0E;IAElE,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,OAAgE,EAAE;QAElE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,IAAwB,CAAC;QAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAExD,qDAAqD;QACrD,IACE,GAAG,CAAC,MAAM,KAAK,GAAG;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK;YAC5B,IAAI,CAAC,UAAU,KAAK,KAAK,EACzB,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CACnB,GAAG,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE,EACnC,GAAG,CAAC,MAAM,EACV,MAAM,QAAQ,CAAC,GAAG,CAAC,CACpB,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAM,CAAC;IACpD,CAAC;IAED,0EAA0E;IAE1E,2EAA2E;IAC3E,mBAAmB,CAAC,MAQnB;QACC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,kFAAkF;IAClF,oBAAoB,CAAC,WAAmB;QACtC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,WAAW,iBAAiB,CAAC,CAAC;IACzE,CAAC;IAED,4EAA4E;IAC5E,oBAAoB;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC9D,CAAC;IAED,0EAA0E;IAC1E,iBAAiB;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAC3D,CAAC;IAED,kFAAkF;IAClF,mBAAmB;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;IACrE,CAAC;IAED,wEAAwE;IACxE,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IACtD,CAAC;IAED,0EAA0E;IAE1E,sFAAsF;IACtF,SAAS,CAAC,eAAuB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,eAAe,QAAQ,CAAC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,eAAuB,EAAE,UAAkB;QACvD,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC;YACpD,CAAC,CAAC,GAAG,UAAU,YAAY;YAC3B,CAAC,CAAC,UAAU,CAAC;QACf,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,oBAAoB,eAAe,kBAAkB,EACrD,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CACnC,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,UAAU,CAAC,eAAuB,EAAE,MAAc;QAChD,OAAO,IAAI,CAAC,OAAO,CACjB,OAAO,EACP,oBAAoB,eAAe,YAAY,EAC/C,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,CAAC;IACJ,CAAC;CACF;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/config.js

@@ -0,0 +1,32 @@
+/**
+ * Runtime configuration for the CATAAM MCP connector.
+ *
+ * Two auth modes are supported (see README "Authentication"):
+ *   1. API key   — `X-API-Key` header. Preferred long-term integration path.
+ *                  Set CATAAM_API_KEY. (Backend supports it; UI provisioning is WIP.)
+ *   2. JWT login — username/password exchanged at POST /api/login for a short-lived
+ *                  bearer token. Works today. Set CATAAM_USERNAME + CATAAM_PASSWORD.
+ *
+ * Secrets are NEVER hardcoded — they are read from env vars only.
+ */
+/**
+ * Build config from env vars, with optional per-request overrides
+ * (used by the HTTP transport to pass a per-request X-API-Key).
+ */
+export function loadConfig(overrides = {}) {
+    const baseUrl = (overrides.baseUrl ??
+        process.env.CATAAM_BASE_URL ??
+        "https://service.cataam.com").replace(/\/+$/, "");
+    const apiKey = overrides.apiKey ?? process.env.CATAAM_API_KEY ?? undefined;
+    const username = overrides.username ?? process.env.CATAAM_USERNAME ?? undefined;
+    const password = overrides.password ?? process.env.CATAAM_PASSWORD ?? undefined;
+    if (!apiKey && !(username && password)) {
+        throw new Error("CATAAM auth not configured. Set CATAAM_API_KEY (recommended), " +
+            "or CATAAM_USERNAME and CATAAM_PASSWORD for JWT login.");
+    }
+    return { baseUrl, apiKey, username, password };
+}
+export function authMode(cfg) {
+    return cfg.apiKey ? "apiKey" : "jwt";
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAeH;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,YAAmC,EAAE;IAC9D,MAAM,OAAO,GAAG,CACd,SAAS,CAAC,OAAO;QACjB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,4BAA4B,CAC7B,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEtB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS,CAAC;IAC3E,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAAC;IAChF,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAAC;IAEhF,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAiB;IACxC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACvC,CAAC"}

package/dist/index.js

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+/**
+ * CATAAM MCP connector — entry point.
+ *
+ * Transports (select with MCP_TRANSPORT):
+ *   - stdio (default)         — used by the Claude plugin / `claude mcp add`.
+ *   - http  (streamable-HTTP) — used for remote/hosted SaaS deployment.
+ *                               Reads a per-request `X-API-Key` header so a single
+ *                               hosted server can serve many CATAAM orgs.
+ */
+import express from "express";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { loadConfig } from "./config.js";
+import { CataamClient } from "./client.js";
+import { registerTools } from "./tools.js";
+const NAME = "cataam";
+const VERSION = "0.1.0";
+function buildServer(overrides = {}) {
+    const cfg = loadConfig(overrides);
+    const client = new CataamClient(cfg);
+    const server = new McpServer({ name: NAME, version: VERSION });
+    registerTools(server, client);
+    return server;
+}
+async function runStdio() {
+    // Validate env auth up front so misconfig fails fast with a clear message.
+    loadConfig();
+    const server = buildServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error(`[cataam-mcp] stdio transport ready`);
+}
+async function runHttp(port) {
+    const app = express();
+    app.use(express.json());
+    app.get("/healthz", (_req, res) => res.json({ status: "ok", server: NAME }));
+    // Stateless: a fresh server+transport per request, so each can use its own
+    // X-API-Key without cross-request session state.
+    app.post("/mcp", async (req, res) => {
+        try {
+            const headerKey = req.header("x-api-key");
+            const server = buildServer(headerKey ? { apiKey: headerKey } : {});
+            const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+            res.on("close", () => {
+                transport.close();
+                server.close();
+            });
+            await server.connect(transport);
+            await transport.handleRequest(req, res, req.body);
+        }
+        catch (err) {
+            if (!res.headersSent) {
+                res.status(500).json({
+                    jsonrpc: "2.0",
+                    error: { code: -32603, message: `Internal error: ${err.message}` },
+                    id: null,
+                });
+            }
+        }
+    });
+    const methodNotAllowed = (_req, res) => res.status(405).json({
+        jsonrpc: "2.0",
+        error: { code: -32000, message: "Method not allowed (stateless server; use POST)." },
+        id: null,
+    });
+    app.get("/mcp", methodNotAllowed);
+    app.delete("/mcp", methodNotAllowed);
+    app.listen(port, () => console.error(`[cataam-mcp] streamable-http transport on :${port}/mcp`));
+}
+async function main() {
+    const transport = (process.env.MCP_TRANSPORT ?? "stdio").toLowerCase();
+    if (transport === "http" || transport === "streamable-http") {
+        await runHttp(Number(process.env.PORT ?? 3000));
+    }
+    else {
+        await runStdio();
+    }
+}
+main().catch((err) => {
+    console.error(`[cataam-mcp] fatal: ${err.message}`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,OAAwC,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,UAAU,EAAqB,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,IAAI,GAAG,QAAQ,CAAC;AACtB,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,SAAS,WAAW,CAAC,YAAmC,EAAE;IACxD,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,2EAA2E;IAC3E,UAAU,EAAE,CAAC;IACb,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEhG,2EAA2E;IAC3E,iDAAiD;IACjD,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACrD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,SAAS,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAoB,GAAa,CAAC,OAAO,EAAE,EAAE;oBAC7E,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE,CACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,kDAAkD,EAAE;QACpF,EAAE,EAAE,IAAI;KACT,CAAC,CAAC;IACL,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAClC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAErC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,8CAA8C,IAAI,MAAM,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/tools.js

@@ -0,0 +1,147 @@
+/**
+ * MCP tool definitions for the CATAAM connector.
+ *
+ * Design: one-tool-per-action (the API surface is small — ~ a dozen
+ * `/api/audit` endpoints — so search+execute would add overhead for no gain).
+ * Tools follow a list → context → act shape.
+ *
+ * Write tools (rerun / due-date / jira-link) require an explicit `confirm: true`
+ * argument. The server refuses the call without it, so a model cannot mutate
+ * compliance state without a deliberate, logged decision. The slash-command
+ * skills instruct the model to confirm with the human before passing it.
+ */
+import { z } from "zod";
+import { CataamError } from "./client.js";
+/** Wrap a handler so CataamErrors become readable MCP error results. */
+function ok(data) {
+    return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+}
+function fail(message) {
+    return { isError: true, content: [{ type: "text", text: message }] };
+}
+async function guard(fn) {
+    try {
+        return ok(await fn());
+    }
+    catch (e) {
+        if (e instanceof CataamError) {
+            return fail(`CATAAM API error (${e.status}): ${e.message}\n${e.body ?? ""}`.trim());
+        }
+        return fail(`Unexpected error: ${e.message}`);
+    }
+}
+const CONFIRM = z
+    .boolean()
+    .describe("Must be true to execute this state-changing action. Confirm intent with the user before setting.");
+export function registerTools(server, client) {
+    // ---- LIST -------------------------------------------------------------
+    server.registerTool("list_compliance_tests", {
+        title: "List compliance tests",
+        description: "List CATAAM compliance tests (controls) with their pass/fail status and aggregate " +
+            "stats, paginated. Use this to see which automated and manual checks exist for a " +
+            "framework (SOC2, GDPR, ISO27001) and which are passing or failing. Returns the " +
+            "auditProgressId for each test — needed by the write tools.",
+        inputSchema: {
+            page: z.number().int().min(0).default(0).describe("0-based page index."),
+            size: z.number().int().min(1).max(500).default(20).describe("Page size (max 500)."),
+            testName: z.string().optional().describe("Filter by test name substring."),
+            frameWork: z
+                .string()
+                .optional()
+                .describe("Filter by framework, e.g. 'SOC2', 'GDPR', 'ISO27001'."),
+            category: z.string().optional().describe("Filter by requirement category, e.g. 'CC1'."),
+            status: z
+                .enum(["PASS", "FAIL", "IN_PROGRESS", "COMPLETED"])
+                .optional()
+                .describe("Filter by last audit status."),
+            auditId: z.string().optional().describe("Filter by a specific audit id."),
+        },
+    }, async (args) => guard(() => client.listComplianceTests(args)));
+    // ---- CONTEXT / OVERVIEW ----------------------------------------------
+    server.registerTool("get_compliance_overview", {
+        title: "Get compliance overview",
+        description: "Get a high-level compliance posture for the organization: overall readiness score " +
+            "(with test/policy/evidence breakdown), per-framework pass-rate summary, and — when a " +
+            "frameworkId is given — that framework's detailed audit-progress stats. Use this to " +
+            "answer 'how compliant are we?' or 'are we audit-ready for SOC2?'.",
+        inputSchema: {
+            frameworkId: z
+                .number()
+                .int()
+                .positive()
+                .optional()
+                .describe("Optional framework id to include detailed per-framework progress."),
+        },
+    }, async ({ frameworkId }) => guard(async () => {
+        const [readiness, summary, progress] = await Promise.all([
+            client.getReadinessScore(),
+            client.getComplianceSummary(),
+            frameworkId ? client.getFrameworkProgress(frameworkId) : Promise.resolve(null),
+        ]);
+        return { readinessScore: readiness, complianceSummary: summary, frameworkProgress: progress };
+    }));
+    // ---- ALERTS -----------------------------------------------------------
+    server.registerTool("list_failing_alerts", {
+        title: "List failing / monitoring alerts",
+        description: "List the organization's open compliance problems: the latest failing-test alerts plus " +
+            "continuous-control-monitoring (CCM) alerts. Use this to triage what needs remediation. " +
+            "Each failing test includes its auditProgressId for use with rerun_compliance_test.",
+        inputSchema: {},
+    }, async () => guard(async () => {
+        const [failedTests, ccmAlerts] = await Promise.all([
+            client.getFailedTestAlerts(),
+            client.getCcmAlerts(),
+        ]);
+        return { failedTests, ccmAlerts };
+    }));
+    // ---- ACT: rerun (the "fix/verify" action) -----------------------------
+    server.registerTool("rerun_compliance_test", {
+        title: "Re-run a compliance test",
+        description: "Re-execute a single compliance test to verify a remediation. This MUTATES compliance " +
+            "state: it runs the underlying automated check and updates the test's pass/fail status. " +
+            "Requires confirm=true. Returns { id, status, passed }. Find auditProgressId via " +
+            "list_compliance_tests or list_failing_alerts.",
+        inputSchema: {
+            auditProgressId: z.number().int().positive().describe("The test's auditProgressId."),
+            confirm: CONFIRM,
+        },
+    }, async ({ auditProgressId, confirm }) => {
+        if (!confirm)
+            return fail("Refused: rerun_compliance_test requires confirm=true.");
+        return guard(() => client.rerunTest(auditProgressId));
+    });
+    // ---- ACT: update due date --------------------------------------------
+    server.registerTool("update_test_due_date", {
+        title: "Update a compliance test's due date",
+        description: "Set the remediation due date for a compliance test. This MUTATES the record. " +
+            "Requires confirm=true.",
+        inputSchema: {
+            auditProgressId: z.number().int().positive().describe("The test's auditProgressId."),
+            newDueDate: z
+                .string()
+                .regex(/^\d{4}-\d{2}-\d{2}$/, "Use ISO date YYYY-MM-DD.")
+                .describe("New due date, ISO format YYYY-MM-DD."),
+            confirm: CONFIRM,
+        },
+    }, async ({ auditProgressId, newDueDate, confirm }) => {
+        if (!confirm)
+            return fail("Refused: update_test_due_date requires confirm=true.");
+        return guard(() => client.updateDueDate(auditProgressId, newDueDate));
+    });
+    // ---- ACT: link to Jira ------------------------------------------------
+    server.registerTool("link_test_to_jira", {
+        title: "Link a compliance test to a Jira issue",
+        description: "Associate a compliance test with a Jira issue key (e.g. 'SEC-123') for remediation " +
+            "tracking. This MUTATES the record. Requires confirm=true.",
+        inputSchema: {
+            auditProgressId: z.number().int().positive().describe("The test's auditProgressId."),
+            jiraId: z.string().min(1).describe("Jira issue key, e.g. 'SEC-123'."),
+            confirm: CONFIRM,
+        },
+    }, async ({ auditProgressId, jiraId, confirm }) => {
+        if (!confirm)
+            return fail("Refused: link_test_to_jira requires confirm=true.");
+        return guard(() => client.linkToJira(auditProgressId, jiraId));
+    });
+}
+//# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgB,WAAW,EAAE,MAAM,aAAa,CAAC;AAExD,wEAAwE;AACxE,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC;AACD,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,EAA0B;IAC7C,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,WAAW,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,IAAI,CAAC,qBAAsB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,CAAC;KACd,OAAO,EAAE;KACT,QAAQ,CACP,kGAAkG,CACnG,CAAC;AAEJ,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,MAAoB;IACnE,0EAA0E;IAC1E,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,oFAAoF;YACpF,kFAAkF;YAClF,iFAAiF;YACjF,4DAA4D;QAC9D,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACxE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACnF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YAC1E,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,uDAAuD,CAAC;YACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YACvF,MAAM,EAAE,CAAC;iBACN,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;iBAClD,QAAQ,EAAE;iBACV,QAAQ,CAAC,8BAA8B,CAAC;YAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;SAC1E;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAC9D,CAAC;IAEF,yEAAyE;IACzE,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,oFAAoF;YACpF,uFAAuF;YACvF,qFAAqF;YACrF,mEAAmE;QACrE,WAAW,EAAE;YACX,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,QAAQ,EAAE;iBACV,QAAQ,CAAC,mEAAmE,CAAC;SACjF;KACF,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CACxB,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,MAAM,CAAC,iBAAiB,EAAE;YAC1B,MAAM,CAAC,oBAAoB,EAAE;YAC7B,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SAC/E,CAAC,CAAC;QACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;IAChG,CAAC,CAAC,CACL,CAAC;IAEF,0EAA0E;IAC1E,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,wFAAwF;YACxF,yFAAyF;YACzF,oFAAoF;QACtF,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CACT,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,MAAM,CAAC,mBAAmB,EAAE;YAC5B,MAAM,CAAC,YAAY,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACpC,CAAC,CAAC,CACL,CAAC;IAEF,0EAA0E;IAC1E,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,uFAAuF;YACvF,yFAAyF;YACzF,kFAAkF;YAClF,+CAA+C;QACjD,WAAW,EAAE;YACX,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YACpF,OAAO,EAAE,OAAO;SACjB;KACF,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE;QACrC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;IACxD,CAAC,CACF,CAAC;IAEF,yEAAyE;IACzE,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EACT,+EAA+E;YAC/E,wBAAwB;QAC1B,WAAW,EAAE;YACX,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YACpF,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,KAAK,CAAC,qBAAqB,EAAE,0BAA0B,CAAC;iBACxD,QAAQ,CAAC,sCAAsC,CAAC;YACnD,OAAO,EAAE,OAAO;SACjB;KACF,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;QACjD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,sDAAsD,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC,CACF,CAAC;IAEF,0EAA0E;IAC1E,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EACT,qFAAqF;YACrF,2DAA2D;QAC7D,WAAW,EAAE;YACX,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YACpF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACrE,OAAO,EAAE,OAAO;SACjB;KACF,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC,CACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "cataam-mcp-server",
+  "version": "0.1.0",
+  "description": "MCP connector for Cataam — the GRC/compliance-automation platform (SOC2, GDPR, ISO27001). Exposes the /api/audit compliance surface as MCP tools.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "cataam-mcp-server": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/themarkups/claude-plugin.git",
+    "directory": "mcp-server"
+  },
+  "homepage": "https://github.com/themarkups/claude-plugin#readme",
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/index.js",
+    "dev": "node --import tsx src/index.ts",
+    "smoke": "node test/smoke.mjs",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.18.0",
+    "express": "^4.21.2",
+    "zod": "^3.25.0"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.21",
+    "@types/node": "^22.10.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0"
+  }
+}