checksum-mcp 1.0.0 → 1.0.2

package/README.md

@@ -19,3 +19,22 @@ node dist/index.js
 ```
 
 Hashing runs locally with the built in crypto module.
+
+<!-- paywall -->
+## Premium tools
+
+These tools need a license key:
+
+* `verify_checksum`
+* `directory_manifest`
+
+Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-checksum-mcp and set it in your MCP client config:
+
+```json
+"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
+```
+
+The key is checked against MCP Marketplace, cached for 24 hours, and keeps
+working offline once one check has succeeded. Every other tool on this server
+stays free.
+<!-- /paywall -->

package/dist/api.js

@@ -23,3 +23,116 @@ export async function hashFile(args) {
     const data = readFileSync(path);
     return `${a}: ${createHash(a).update(data).digest("hex")} (${data.length} bytes)`;
 }
+// ---- muxA tools:
+import { createHmac } from "node:crypto";
+import { readdirSync, statSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+function digest(algorithm, data) {
+    return createHash(algorithm).update(data).digest("hex");
+}
+function parseExpected(expected) {
+    const raw = (expected ?? "").trim().toLowerCase().replace(/[\s-]/g, "");
+    const withPrefix = /^([a-z0-9]{3,10}):([a-f0-9]{8,128})$/.exec(raw);
+    if (withPrefix)
+        return { algorithm: withPrefix[1], hex: withPrefix[2] };
+    const bare = /^([a-f0-9]{8,128})$/.exec(raw);
+    if (bare)
+        return { hex: bare[1] };
+    throw new HashError("Expected digest should look like sha256:abc123... or a bare hex digest of 8 to 128 characters.");
+}
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i += 1)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+export async function verifyChecksum(args) {
+    const expectedRaw = (args.expected ?? "").trim();
+    if (!expectedRaw)
+        throw new HashError("Provide the expected digest to check against.");
+    const parsed = parseExpected(expectedRaw);
+    const algorithm = parsed.algorithm ?? algo(args.algorithm ?? "sha256");
+    const hasPath = Boolean((args.path ?? "").trim());
+    const hasText = typeof args.text === "string" && args.text.length > 0;
+    if (hasPath === hasText) {
+        throw new HashError("Provide exactly one of path (verify a file) or text (verify a string).");
+    }
+    const target = hasPath ? String(args.path).trim() : "";
+    const actual = hasPath ? digest(algorithm, readFileSync(target)) : digest(algorithm, args.text);
+    const ok = timingSafeEqual(actual, parsed.hex);
+    const what = hasPath ? `${target} (${readFileSync(target).length} bytes)` : `${args.text.length} character string`;
+    return [
+        `${ok ? "MATCH" : "MISMATCH"}: ${algorithm} digest of ${what}`,
+        `  expected ${parsed.hex}`,
+        `  actual   ${actual}`,
+        ok ? "  The file or string is intact." : "  Content differs from the expected digest.",
+    ].join("\n");
+}
+export async function directoryManifest(args) {
+    const root = (args.path ?? "").trim();
+    if (!root)
+        throw new HashError("Provide a directory path.");
+    let stat;
+    try {
+        stat = statSync(root);
+    }
+    catch {
+        throw new HashError(`Cannot read path ${root}.`);
+    }
+    if (!stat.isDirectory())
+        throw new HashError(`${root} is a file, not a directory. Use hash_file to hash a single file.`);
+    const algorithm = algo(args.algorithm ?? "sha256");
+    const limit = Math.max(1, Math.min(Math.round(Number(args.limit ?? 100) || 100), 500));
+    const exclude = (args.exclude ?? "").trim();
+    const skip = (p) => {
+        if (!exclude)
+            return false;
+        const e = exclude.toLowerCase();
+        const lower = p.toLowerCase();
+        return lower.includes(e) || lower.split(sep).some((seg) => seg === e || seg.startsWith(`${e}.`) || seg.endsWith(e));
+    };
+    const entries = readdirSync(root, { recursive: true, withFileTypes: true })
+        .filter((d) => (d.isFile() || d.isSymbolicLink()) && !skip(join(d.parentPath ?? d.path ?? root, d.name)))
+        .map((d) => {
+        const full = join(d.parentPath ?? d.path ?? root, d.name);
+        return { full, rel: relative(root, full), data: readFileSync(full) };
+    })
+        .filter((e) => e.data.length > 0)
+        .sort((a, b) => a.rel.localeCompare(b.rel));
+    if (!entries.length) {
+        return `${root} contains no readable non-empty files${exclude ? ` after excluding "${exclude}"` : ""}.`;
+    }
+    const rows = entries.map((e) => ({ rel: e.rel.split(sep).join("/"), size: e.data.length, hex: digest(algorithm, e.data) }));
+    const totalBytes = rows.reduce((a, r) => a + r.size, 0);
+    const manifestText = rows.map((r) => `${r.hex}  ${r.rel}`).join("\n");
+    const manifestHash = digest(algorithm, manifestText);
+    return [
+        `Directory manifest for ${root}: ${rows.length} file(s), ${countBytes(totalBytes)}, ${algorithm}.`,
+        ...rows.slice(0, limit).map((r) => `${r.hex}  ${r.size.toLocaleString("en-US")} B  ${r.rel}`),
+        rows.length > limit ? `... plus ${rows.length - limit} more files not listed` : "",
+        `manifest digest (${algorithm} of the sorted "digest  path" listing): ${manifestHash}`,
+        exclude ? `Excluded paths matching "${exclude}".` : "",
+    ]
+        .filter(Boolean)
+        .join("\n");
+}
+function countBytes(n) {
+    return n >= 1024 * 1024 ? `${(n / 1024 / 1024).toFixed(1)} MB` : `${(n / 1024).toFixed(1)} kB`;
+}
+export async function hmacDigest(args) {
+    const message = args.message ?? "";
+    if (!message)
+        throw new HashError("Provide the message to authenticate.");
+    const key = args.key ?? "";
+    if (!key)
+        throw new HashError("Provide the shared secret key.");
+    const algorithm = algo(args.algorithm ?? "sha256");
+    const requested = (args.encoding ?? "hex").trim().toLowerCase();
+    if (requested !== "hex" && requested !== "base64")
+        return "Unknown encoding, use hex or base64.";
+    const enc = requested;
+    const mac = createHmac(algorithm, key).update(message, "utf8").digest(enc);
+    return `${algorithm} HMAC (${enc}): ${mac}`;
+}

package/dist/license.js

@@ -0,0 +1,79 @@
+// Premium tools on this server need a license key bought from MCP Marketplace.
+// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
+// that is not listed in PREMIUM keeps working without a key.
+const SLUG = "checksum-mcp";
+// Tools that need a key. Everything else is free.
+const PREMIUM = new Set([
+    "verify_checksum",
+    "directory_manifest",
+]);
+const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`;
+// The license check calls the marketplace's verify endpoint directly instead of
+// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
+// check it makes is rejected by Supabase before it reaches the function. The
+// publishable key below is public by design - it ships in mcp-marketplace.io's
+// own JavaScript and only ever reaches their licence check.
+const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key";
+const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h";
+const OK_CACHE_MS = 60 * 60 * 1000;
+const BAD_CACHE_MS = 60 * 1000;
+const seen = new Map();
+const REASONS = {
+    missing_key: "no key is set",
+    invalid_format: "that key is not a valid MCP Marketplace key",
+    not_found: "that key was not found",
+    revoked: "that key has been revoked",
+    rotated: "that key was rotated, use your new one",
+    expired: "that key has expired, renew it",
+    rate_limited: "there were too many checks just now, try again shortly",
+    network_error: "the license server could not be reached",
+};
+function blocked(tool, reason) {
+    const why = REASONS[reason] ?? `the license server answered "${reason}"`;
+    return `"${tool}" needs a license key, but ${why}. ` +
+        `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`;
+}
+async function verify(key) {
+    const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
+        method: "POST",
+        headers: {
+            apikey: PUBLISHABLE_KEY,
+            Authorization: `Bearer ${PUBLISHABLE_KEY}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ key, slug: SLUG }),
+        // an unusable key answers 400 with a JSON body, so read the body either way
+        signal: AbortSignal.timeout(15000),
+    });
+    const data = (await res.json());
+    if (typeof data?.valid !== "boolean")
+        return { valid: false, reason: "unexpected_response" };
+    return data;
+}
+/**
+ * Returns null when the caller may run the tool, or a short message telling
+ * them how to get a key.
+ *
+ * A good key is remembered for an hour, so a busy session does not hit the
+ * license server on every call and keeps working through a brief outage.
+ */
+export async function premiumRequired(tool) {
+    if (!PREMIUM.has(tool))
+        return null;
+    const key = process.env.MCP_LICENSE_KEY;
+    if (!key)
+        return blocked(tool, "missing_key");
+    const hit = seen.get(key);
+    if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
+        return hit.valid ? null : blocked(tool, hit.reason ?? "invalid");
+    }
+    let result;
+    try {
+        result = await verify(key);
+    }
+    catch {
+        result = { valid: false, reason: "network_error" };
+    }
+    seen.set(key, { ...result, at: Date.now() });
+    return result.valid ? null : blocked(tool, result.reason ?? "invalid");
+}

package/dist/server.js

@@ -1,7 +1,8 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { hashFile } from "./api.js";
-import { hashText } from "./api.js";
+import { hashText, verifyChecksum, directoryManifest, hmacDigest } from "./api.js";
+import { premiumRequired } from "./license.js";
 const text = (value) => ({ content: [{ type: "text", text: value }] });
 const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
@@ -34,5 +35,54 @@ export function createServer() {
             return textError(error(e));
         }
     });
+    server.registerTool("verify_checksum", {
+        title: "Verify checksum",
+        description: "Check a file or string against an expected digest and report MATCH or MISMATCH, accepting either a bare hex value or an algorithm-prefixed digest.",
+        inputSchema: z.object({ path: z.string().describe("File to verify.").optional(), text: z.string().describe("String to verify.").optional(), expected: z.string().describe("Expected digest, bare hex or algo:hex."), algorithm: z.string().describe("sha256, sha512, sha1 or md5.").optional() }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: verify_checksum ----
+        const paywallMessage = await premiumRequired("verify_checksum");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await verifyChecksum(args));
+        }
+        catch (e) {
+            return textError(e instanceof Error ? `Error: ${e.message}` : String(e));
+        }
+    });
+    server.registerTool("directory_manifest", {
+        title: "Directory manifest",
+        description: "Hash every file in a directory, list each path with its size and digest, and return a single digest over the sorted manifest so a tree can be verified later.",
+        inputSchema: z.object({ path: z.string().describe("Directory to walk."), algorithm: z.string().describe("sha256, sha512, sha1 or md5.").optional(), limit: z.number().describe("Max files listed.").optional(), exclude: z.string().describe("Skip paths containing this text, e.g. node_modules.").optional() }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: directory_manifest ----
+        const paywallMessage = await premiumRequired("directory_manifest");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await directoryManifest(args));
+        }
+        catch (e) {
+            return textError(e instanceof Error ? `Error: ${e.message}` : String(e));
+        }
+    });
+    server.registerTool("hmac_digest", {
+        title: "HMAC digest",
+        description: "Keyed HMAC of a message using sha256, sha512, sha1 or md5, in hex or base64, for webhook and API signature verification.",
+        inputSchema: z.object({ message: z.string().describe("Message to authenticate."), key: z.string().describe("Shared secret."), encoding: z.string().describe("hex or base64.").optional(), algorithm: z.string().describe("sha256, sha512, sha1 or md5.").optional() }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        try {
+            return text(await hmacDigest(args));
+        }
+        catch (e) {
+            return textError(e instanceof Error ? `Error: ${e.message}` : String(e));
+        }
+    });
     return server;
 }

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0",
+  "version": "1.0.2",
   "type": "module",
   "repository": {
     "type": "git",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/mrfentmen/checksum-mcp",
     "source": "github"
   },
-  "version": "1.0.0",
+  "version": "1.0.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "checksum-mcp",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "transport": {
         "type": "stdio"
       }