codeant-cli 0.5.4 → 0.5.5

package/README.md

@@ -8,14 +8,7 @@ A command-line tool for code review and security scanning.
 npm install -g codeant-cli
 ```
 
-Or run locally:
-
-```bash
-git clone https://github.com/codeantai/codeant-cli.git
-cd codeant-cli
-npm install
-npm link
-```
+For installation, authentication, and self-hosted setup, see the [CodeAnt CLI setup guide](https://docs.codeant.ai/cli/setup).
 
 ## Quick Start
 
@@ -131,6 +124,40 @@ Show the current API base URL and its source.
 codeant get-base-url
 ```
 
+#### `hotlist`
+
+Query the same organization-wide prioritized findings shown in the CodeAnt Hotlist, or fetch one finding by its stable ID.
+
+```bash
+codeant hotlist list --org CodeAnt-AI --service github --severity critical,high
+codeant hotlist get 0123456789abcdef0123456789abcdef --org CodeAnt-AI --service github
+```
+
+#### `findings`
+
+Access repository, organization Hotlist, cloud-security, anti-pattern, and pentest findings through one command group.
+
+```bash
+codeant findings repos --org CodeAnt-AI
+codeant findings repo --repo CodeAnt-AI/example --types sast,sca,iac,anti_patterns
+codeant findings list --severity critical,high
+codeant findings cloud history --provider all
+codeant findings pentest history
+```
+
+See the [CodeAnt findings documentation](https://docs.codeant.ai/cli/findings) for the complete command and agent manual.
+
+#### `api request`
+
+Call any CodeAnt application API using the saved bearer token. Only relative paths on the configured CodeAnt API host are accepted.
+
+```bash
+codeant api request GET /some/read/endpoint --org CodeAnt-AI --service github --query '{"page":1}'
+codeant api request POST /some/app/endpoint --org CodeAnt-AI --service github --body '{"repo":"CodeAnt-AI/example"}'
+```
+
+See the [CodeAnt findings documentation](https://docs.codeant.ai/cli/findings) for all finding commands, authentication, self-hosted provider, and agent/MCP details.
+
 ### Global Options
 
 ```bash
@@ -240,11 +267,11 @@ node src/index.js secrets --all
 
 This package also ships an MCP (Model Context Protocol) server that exposes CodeAnt's scan, review, and PR data as tools to Claude and other MCP clients. The same source tree is packaged as a Desktop Extension (`.mcpb`) for one-click install in Claude Desktop.
 
-See [mcp.md](mcp.md) for the tools listing, install paths (Claude Code CLI, Claude Desktop manual config, MCPB double-click), and bundling/submission instructions.
+See the [CodeAnt MCP server documentation](https://docs.codeant.ai/cli/mcp-server) for the tools listing and installation paths. See the [CodeAnt findings documentation](https://docs.codeant.ai/cli/findings) for Hotlist and authenticated API usage.
 
 ## Privacy Policy
 
-Full policy: **https://codeant.ai/privacy**
+Full policy: **https://www.codeant.ai/privacy-policy**
 
 Summary of what this CLI / MCP server sends and stores:
 

package/cli-api.md

@@ -0,0 +1,130 @@
+# CodeAnt application APIs from the CLI
+
+The CLI can call the authenticated application endpoints used by the CodeAnt web app without adding a second backend adapter for each endpoint. Sign in once, select one exact organization/provider connection, then use a first-class command or the generic API request command.
+
+```bash
+codeant login
+codeant scans orgs
+```
+
+`CODEANT_API_TOKEN` and `CODEANT_API_URL` can be used instead of the saved login for agents, CI, and self-hosted installations.
+
+The browser login binds the CLI key to the signed-in user and the exact connections visible to that user. For application API calls, the backend resolves the selected connection and injects the same verified user identity used by the app. The existing organization-membership, RBAC, repository-access, audit, and request guards still run. CLI keys expire after 90 days by default (`CLI_API_KEY_TTL_DAYS` controls the backend deployment value), and `codeant logout` revokes the key server-side before deleting it locally.
+
+Keys created before this authenticated application-API bridge do not contain the verified user identity. Run `codeant logout` followed by `codeant login` once after upgrading.
+
+## Hotlist findings
+
+Hotlist commands use the same organization-wide snapshot, ranking, filters, stable finding IDs, and cursor pagination as the app.
+
+```bash
+# First page; org/service are auto-selected when unambiguous
+codeant hotlist list
+
+# Highest-priority production findings for one authenticated connection
+codeant hotlist list \
+  --org CodeAnt-AI \
+  --service github \
+  --severity critical,high \
+  --validation exploit_confirmed \
+  --limit 50
+
+# Fetch every SCA finding across the organization
+codeant hotlist list --org CodeAnt-AI --service github --type SCA --all
+
+# Continue a page using next_cursor from the previous response
+codeant hotlist list --org CodeAnt-AI --service github --cursor '<cursor>'
+
+# Fetch exactly one finding using the stable ID shown in the app
+codeant hotlist get 0123456789abcdef0123456789abcdef \
+  --org CodeAnt-AI \
+  --service github
+```
+
+Supported `hotlist list` filters:
+
+| Option | Values |
+|---|---|
+| `--search` | title, repository/account, path, package, CVE, or check ID |
+| `--type` | `AI Exploitation`, `SCA`, `SAST`, `Secrets`, `IaC`, `Infrastructure` |
+| `--location` | repository full names or cloud accounts |
+| `--severity` | `critical`, `high`, `medium`, `low`, `unknown` |
+| `--ticket-status` | `created`, `not_created` |
+| `--compliance` | framework keys such as `soc2` |
+| `--validation` | `exploit_confirmed` |
+
+Comma-separated values are accepted. The default page size is 30 and the maximum is 100. `--all` follows every cursor. If the first organization snapshot is still being built, the command waits up to 60 seconds; change that with `--max-wait <seconds>`.
+
+For self-hosted GitHub, GitLab, Bitbucket, or Azure DevOps, the CLI normally discovers the provider base URL from the authenticated connection. Use `--provider-base-url` only to override it.
+
+## All findings
+
+Use `codeant findings` for first-class access to repository findings, organization Hotlist and anti-pattern findings, AWS/Azure/GCP cloud-security findings, and pentest engagements. The full command matrix, provider-specific fields, examples, and agent workflow are documented in the [CodeAnt findings documentation](https://docs.codeant.ai/cli/findings).
+
+## Any app API
+
+Use the generic request command when a first-class command does not exist yet:
+
+```bash
+codeant api request GET /some/read/endpoint \
+  --org CodeAnt-AI --service github \
+  --query '{"page":1}'
+
+codeant api request POST /some/app/endpoint \
+  --org CodeAnt-AI --service github \
+  --body '{"repo":"CodeAnt-AI/example"}'
+
+codeant api request PATCH /some/app/endpoint \
+  --org CodeAnt-AI --service github \
+  --body-file ./request.json \
+  --header 'If-Match: revision-123'
+```
+
+The output is JSON:
+
+```json
+{
+  "ok": true,
+  "status": 200,
+  "tenant": {
+    "org": "CodeAnt-AI",
+    "service": "github"
+  },
+  "data": {}
+}
+```
+
+Security properties:
+
+- The path must start with `/` and is always resolved against the configured CodeAnt API host. Absolute and protocol-relative URLs are rejected, so the bearer token cannot be forwarded to another host.
+- Authentication is supplied from `CODEANT_API_TOKEN` or the key saved by `codeant login`.
+- `--org`, `--service`, and the discovered provider base URL must match one saved login connection exactly. They are auto-selected only when unambiguous. Use `--provider-base-url` for a self-hosted override.
+- POST/PUT/PATCH/DELETE bodies must be JSON objects. The CLI adds the selected tenant fields before sending the request; conflicting tenant values are rejected by the backend.
+- `Authorization`, `Cookie`, `Host`, `Content-Length`, and the `X-CodeAnt-CLI-*` tenant headers cannot be overridden.
+- The backend remains authoritative for account access, organization membership, RBAC, and endpoint authorization.
+
+The generic command can call write endpoints. Review the method, path, and body before running it.
+
+## Agent and MCP access
+
+Run `codeant mcp` or install the CodeAnt MCP bundle. Agents receive dedicated read-only tools:
+
+- `codeant_hotlist_list` — filter and page through organization-wide findings.
+- `codeant_hotlist_get` — fetch one finding by stable ID.
+- `codeant_api_get` — authenticated GET access for newly-added read APIs.
+- `codeant_findings_antipatterns` — selected or all-repository anti-pattern findings.
+- `codeant_cloud_scan_history`, `codeant_cloud_findings_list`, `codeant_cloud_finding_get` — cloud scan discovery, findings, and detail.
+- `codeant_pentest_history`, `codeant_pentest_issues`, `codeant_pentest_report` — pentest engagement discovery and results.
+
+Set `CODEANT_READ_ONLY=0` to opt in to write tools, including `codeant_api_request` for POST/PUT/PATCH/DELETE. Read-only mode is the default. The MCP server never opens a browser during startup; the agent must explicitly call `codeant_login` when no token is configured.
+
+## Troubleshooting
+
+| Error | Resolution |
+|---|---|
+| No matching organization | Run `codeant scans orgs`, then pass its exact `organizationName` and `service`. |
+| Multiple organizations match | Pass both `--org` and `--service`. |
+| Access denied (403) | Run `codeant logout`, then `codeant login`, or replace `CODEANT_API_TOKEN`. |
+| Invalid token after upgrading | Older keys lack verified CLI identity metadata. Run `codeant logout`, then `codeant login`. |
+| Hotlist is still building | Retry, or increase `--max-wait`. |
+| Finding not found | Refresh the app/Hotlist and copy the current stable finding ID and tenant context. |

package/findings.md

@@ -0,0 +1,163 @@
+# CodeAnt findings CLI
+
+`codeant findings` is the unified, read-only entry point for findings visible in the CodeAnt app. It reuses the same authenticated backend endpoints and authorization checks as the UI.
+
+```bash
+codeant login
+codeant scans orgs
+codeant findings --help
+```
+
+When one login has multiple connections, pass the exact `--org` and `--service` values returned by `codeant scans orgs`. A self-hosted provider base URL is discovered from the selected connection; use `--provider-base-url` only as an explicit override.
+
+## Coverage
+
+| App data | CLI command | Scope |
+|---|---|---|
+| Repository list | `codeant findings repos` | organization |
+| SAST, SCA, IaC, Secrets, SBOM | `codeant findings repo` | repository + scan/branch |
+| Anti-patterns, dead code, docstrings, complex functions | `codeant findings repo` | repository + scan/branch |
+| Prioritized SAST/SCA/IaC/Secrets/Infrastructure/AI Exploitation | `codeant findings list/get` | organization Hotlist |
+| Anti-patterns across repositories | `codeant findings antipatterns` | selected repos or organization |
+| AWS/Azure/GCP CSPM, VM, and container findings | `codeant findings cloud history/list/get` | organization + cloud resource scope |
+| Pentest engagements, issues, reports | `codeant findings pentest history/issues/report` | organization + engagement |
+
+The existing `codeant scans repos`, `codeant scans results`, and `codeant hotlist list/get` commands remain supported. The unified commands are aliases or thin authenticated clients, so existing scripts do not need to migrate.
+
+## Repository list and repo-level findings
+
+```bash
+# List connected repositories
+codeant findings repos --org CodeAnt-AI
+
+# Latest scan, all supported finding types
+codeant findings repo --repo CodeAnt-AI/example --types all
+
+# Selected categories and severities
+codeant findings repo \
+  --repo CodeAnt-AI/example \
+  --branch main \
+  --types sast,sca,iac,anti_patterns \
+  --severity critical,high
+
+# A specific scan, formatted for another tool
+codeant findings repo \
+  --repo CodeAnt-AI/example \
+  --scan 0123456789abcdef \
+  --types sast,secrets \
+  --format sarif \
+  --output codeant.sarif
+```
+
+Supported repo types are `sast`, `sca`, `secrets`, `iac`, `dead_code`, `sbom`, `anti_patterns`, `docstring`, and `complex_functions`. Use `--types all` for all of them. Formats are `json`, `sarif`, `csv`, `md`, and `table`; JSON is the default.
+
+Use `--filter-dismissed` to exclude dismissed findings and `--no-false-positives` to exclude false positives. `--path`, `--check`, `--limit`, and `--offset` support agent-friendly filtering and pagination.
+
+## Organization Hotlist findings
+
+`findings list/get` exposes the same stable IDs, prioritization, filters, and cursor pagination as the app Hotlist.
+
+```bash
+codeant findings list --org CodeAnt-AI --service github --severity critical,high
+codeant findings list --type SCA,IaC --location CodeAnt-AI/example --all
+codeant findings get 0123456789abcdef0123456789abcdef --org CodeAnt-AI --service github
+```
+
+Hotlist types are `SAST`, `SCA`, `Secrets`, `IaC`, `Infrastructure`, and `AI Exploitation`. The last two cover prioritized cloud-security and pentest findings. Use the dedicated cloud and pentest commands below when complete scan/engagement data is required.
+
+## Organization anti-patterns
+
+```bash
+# Every repository in the selected organization
+codeant findings antipatterns --org CodeAnt-AI --service github
+
+# Only selected repositories
+codeant findings antipatterns \
+  --org CodeAnt-AI --service github \
+  --repos CodeAnt-AI/api,CodeAnt-AI/web
+```
+
+When `--repos` is omitted, the CLI first lists the organization's repositories and sends all of them to the same aggregate anti-pattern endpoint used by the Quality Report UI.
+
+## Cloud security findings
+
+Cloud findings are organization/account scoped rather than repository scoped.
+
+```bash
+# History across AWS, Azure, and GCP
+codeant findings cloud history --org CodeAnt-AI --service github
+
+# Latest scan per provider
+codeant findings cloud history --provider all --latest
+
+# VM and container vulnerability scan histories
+codeant findings cloud history --provider all --kind vm
+codeant findings cloud history --provider all --kind container
+
+# AWS findings and one full detail record
+codeant findings cloud list --provider aws --scan-id <scan-id> --account-id <account-id>
+codeant findings cloud get --provider aws --scan-id <scan-id> --uid <finding-uid> --cloud-service iam
+
+# VM and container vulnerabilities use the same list/detail flow
+codeant findings cloud list --provider aws --kind vm --scan-id <scan-id>
+codeant findings cloud get --provider gcp --kind container --scan-id <scan-id> --uid <finding-uid>
+
+# Azure requires the tenant ID
+codeant findings cloud list \
+  --provider azure --tenant-id <tenant-id> --scan-id <scan-id> \
+  --severity high --subscription-id <subscription-id>
+
+# GCP requires the project ID
+codeant findings cloud list \
+  --provider gcp --project-id <project-id> --scan-id <scan-id> \
+  --framework cis
+```
+
+`--kind` defaults to `cspm`; use `vm` or `container` for the other Cloud Security result views. CSPM `cloud list` supports `--cloud-service`, `--severity`, `--status`, `--framework`, and `--min-days-unused`. AWS additionally supports `--exploit-attempted-only`; Azure additionally supports `--subscription-id`. CSPM responses include `findings` and `dismissed_findings`; VM/container responses preserve their UI result payload unchanged.
+
+## Pentest findings
+
+```bash
+# Discover engagement IDs
+codeant findings pentest history --org CodeAnt-AI --service github
+
+# All available open issues for an engagement
+codeant findings pentest issues --report-id <report-id>
+
+# Full customer report
+codeant findings pentest report --report-id <report-id>
+
+# Test-environment variant
+codeant findings pentest issues --report-id <report-id> --variant test
+codeant findings pentest report --report-id <report-id> --variant test
+```
+
+`--variant prod` is the default. Pentest entitlements and critical/high redaction are enforced by the backend exactly as they are in the UI; the CLI does not bypass locked content.
+
+## Agent/MCP tools
+
+Agents can use these read-only MCP tools:
+
+| Tool | Purpose |
+|---|---|
+| `codeant_scans_repos` | List repositories. |
+| `codeant_scans_results` | Fetch repo-level SAST/SCA/IaC/Secrets/quality findings. |
+| `codeant_hotlist_list`, `codeant_hotlist_get` | Query prioritized org-wide findings and stable IDs. |
+| `codeant_findings_antipatterns` | Fetch selected or all-repo anti-pattern findings. |
+| `codeant_cloud_scan_history` | Discover AWS/Azure/GCP scan IDs and scopes. |
+| `codeant_cloud_findings_list`, `codeant_cloud_finding_get` | List cloud findings and retrieve full detail. |
+| `codeant_pentest_history`, `codeant_pentest_issues`, `codeant_pentest_report` | Discover and inspect pentest engagements. |
+
+All these tools are available in the default read-only MCP mode. A typical agent flow is discovery (`orgs` -> `repos`, cloud history, or pentest history), list/filter findings, then retrieve one detailed finding or report.
+
+## Errors and access
+
+| Error | Resolution |
+|---|---|
+| No or multiple matching organizations | Run `codeant scans orgs`; pass exact `--org` and `--service`. |
+| Access denied (403) | Run `codeant logout`, then `codeant login`. Older CLI keys must be refreshed once. |
+| Missing Azure/GCP scope | Pass `--tenant-id` for Azure or `--project-id` for GCP. |
+| Report or scan not found | Use the corresponding history command and verify the selected tenant/provider. |
+| Redacted pentest fields | Unlock the engagement in the app; CLI access follows the same entitlement. |
+
+For current authentication, finding coverage, and agent guidance, see the [CodeAnt findings documentation](https://docs.codeant.ai/cli/findings).

package/mcp.md

@@ -0,0 +1,207 @@
+# CodeAnt MCP Server
+
+The CodeAnt CLI ships an MCP (Model Context Protocol) server that exposes CodeAnt's scan/review/PR data as tools Claude (and any other MCP client) can call directly.
+
+- **Entrypoint:** `codeant mcp` — stdio transport, single subcommand registered in [src/index.js](src/index.js).
+- **Server:** [src/mcp/server.js](src/mcp/server.js) — uses `@modelcontextprotocol/sdk` and registers tools via `server.registerTool(...)`.
+- **Bundle:** the [mcpb/](mcpb/) directory + [scripts/build-mcpb.mjs](scripts/build-mcpb.mjs) produce a `.mcpb` Desktop Extension bundle (`dist/codeant.mcpb`).
+
+## Tools registered
+
+| Name | Read/Write | What it does |
+|------|------------|--------------|
+| `codeant_scans_orgs` | read | List authenticated CodeAnt orgs. |
+| `codeant_scans_repos` | read | List repos in an org. |
+| `codeant_scans_history` | read | Recent scan runs for a repo. |
+| `codeant_scans_get` | read | Severity/category summary for one scan. |
+| `codeant_scans_results` | read | Full findings (SAST, SCA, secrets, IaC, …) for one scan. |
+| `codeant_scans_dismissed` | read | Dismissed alerts for a repo. |
+| `codeant_hotlist_list` | read | Prioritized organization-wide Hotlist findings with stable IDs. |
+| `codeant_hotlist_get` | read | One complete Hotlist finding by stable ID. |
+| `codeant_findings_antipatterns` | read | Anti-pattern findings across selected or all organization repos. |
+| `codeant_cloud_scan_history` | read | AWS/Azure/GCP CSPM, VM, or container scan history. |
+| `codeant_cloud_findings_list` | read | Findings for one CSPM, VM, or container scan. |
+| `codeant_cloud_finding_get` | read | Full detail for one cloud finding UID. |
+| `codeant_pentest_history` | read | Pentest engagement history. |
+| `codeant_pentest_issues` | read | All available issues for a pentest engagement. |
+| `codeant_pentest_report` | read | Full pentest customer report. |
+| `codeant_api_get` | read | Authenticated GET request to any relative CodeAnt app API path, with exact org/provider context. |
+| `codeant_pr_list` | read | List PRs/MRs across GitHub, GitLab, Bitbucket, Azure DevOps. |
+| `codeant_pr_get` | read | Detail for a PR/MR. |
+| `codeant_pr_comments` | read | Comments on a PR, filtered. |
+| `codeant_comments_search` | read | Free-text search across CodeAnt review comments. |
+| `codeant_review_local` | read | Run a CodeAnt review on local working-copy changes. |
+| `codeant_scans_start` | **write** | Trigger a new scan. Gated. |
+| `codeant_pr_resolve` | **write** | Resolve a PR conversation thread. Gated. |
+| `codeant_api_request` | **write** | Authenticated POST/PUT/PATCH/DELETE request to a relative CodeAnt app API path, with exact org/provider context. Gated. |
+
+Write tools are only registered when `CODEANT_READ_ONLY=0`. Default = read-only.
+
+For complete finding coverage, examples, tenant/provider selection, and response details, see the [CodeAnt findings documentation](https://docs.codeant.ai/cli/findings).
+
+Every tool carries MCP annotations (`title`, `readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) so the client can decide whether to auto-approve calls.
+
+## Configuration (env vars)
+
+| Var | Purpose | Default |
+|-----|---------|---------|
+| `CODEANT_API_TOKEN` | API token (CodeAnt account → settings → API). Required. | — |
+| `CODEANT_API_URL` | API base URL. Override for self-hosted. | `https://api.codeant.ai` |
+| `CODEANT_READ_ONLY` | `1` to hide write tools, `0` to expose them. | `1` |
+
+The CLI also reads these from `~/.codeant/config.json` when not set in env. For MCP usage prefer env — it keeps per-client config explicit.
+
+---
+
+## Install paths
+
+### A — Claude Code CLI (terminal / VS Code extension)
+
+```bash
+claude mcp add codeant -s user -e CODEANT_READ_ONLY=1 -- codeant mcp
+```
+
+`-s user` puts it in your user-scope config so it works in every project. Use `-s project` to scope it to one repo (writes a `.mcp.json` at the repo root).
+
+For a single project, you can instead drop this `.mcp.json` next to the project root:
+
+```json
+{
+  "mcpServers": {
+    "codeant": {
+      "command": "codeant",
+      "args": ["mcp"],
+      "env": { "CODEANT_READ_ONLY": "1" }
+    }
+  }
+}
+```
+
+Verify with `/mcp` inside a Claude Code session.
+
+### B — Claude Desktop (manual config)
+
+Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or the equivalent on Windows and add a `codeant` block:
+
+```json
+{
+  "mcpServers": {
+    "codeant": {
+      "command": "codeant",
+      "args": ["mcp"],
+      "env": { "CODEANT_READ_ONLY": "1" }
+    }
+  }
+}
+```
+
+Requires the `codeant` CLI to be on the desktop app's PATH. If you hit "command not found" in `~/Library/Logs/Claude/mcp-server-codeant.log`, swap `"command": "codeant"` for `"command": "node"` with `"args": ["<absolute-path-to>/codeant-cli/src/index.js", "mcp"]`.
+
+Quit Claude Desktop (Cmd-Q — not just close the window) and relaunch. The server appears under **Settings → Connectors**.
+
+### C — Claude Desktop (MCPB double-click)
+
+The MCPB bundle is the only path that does not assume the user has the CodeAnt CLI installed — it ships everything in the bundle. This is what we submit to the Anthropic directory.
+
+```bash
+npm run mcpb:build
+open -a Claude dist/codeant.mcpb
+```
+
+Claude pops an install dialog asking for the `user_config` fields:
+- **CodeAnt API token** (sensitive, required)
+- **API base URL** (defaults to `https://api.codeant.ai`)
+- **Read-only mode** (defaults to on)
+
+After install, manage it in **Settings → Connectors**.
+
+If you also have a manual `claude_desktop_config.json` entry from path B, you'll see `codeant` listed twice — remove one to avoid duplicate tool listings.
+
+---
+
+## Packaging the MCPB bundle
+
+### What gets bundled
+
+```
+codeant.mcpb (zip)
+├── manifest.json          # from mcpb/manifest.json, version pinned to package.json
+├── icon.png               # 256×256, from mcpb/icon.png
+├── server/
+│   └── index.js           # thin entry wrapper, calls startMcpServer()
+├── src/                   # the entire CLI source tree
+├── node_modules/          # production deps only (npm install --omit=dev)
+└── package.json           # trimmed: only name/version/type/dependencies
+```
+
+The bundle is self-contained — Claude Desktop ships its own Node runtime, so no global install is required on the user's machine.
+
+### Build it
+
+```bash
+npm run mcpb:build
+```
+
+Under the hood this runs [scripts/build-mcpb.mjs](scripts/build-mcpb.mjs):
+
+1. Clean `dist/mcpb-stage/` and `dist/codeant.mcpb`.
+2. Copy `src/` and `mcpb/server/` into the staging dir.
+3. Write a trimmed `package.json` containing only production deps.
+4. Run `npm install --omit=dev` inside the staging dir.
+5. Copy `mcpb/manifest.json` (with `version` overridden from the root `package.json`) and `mcpb/icon.png`.
+6. Zip the staging dir as `dist/codeant.mcpb`.
+
+Result is typically ~11 MB. Verify the bundled server speaks MCP:
+
+```bash
+cd dist/mcpb-stage
+(printf '%s\n' \
+  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"smoke","version":"0"}}}' \
+  '{"jsonrpc":"2.0","method":"notifications/initialized"}' \
+  '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'; sleep 1) | node server/index.js
+```
+
+Expect 23 tools in the `tools/list` response (or 26 if `CODEANT_READ_ONLY=0`).
+
+### Bumping the version
+
+Edit `version` in [package.json](package.json). The build script pins the manifest's `version` field from there, so you do not need to touch [mcpb/manifest.json](mcpb/manifest.json) for normal bumps.
+
+### Replacing the icon
+
+`mcpb/icon.png` should be a 256×256 PNG. The current one was rasterized from `../vscode-build/assets/Logo.svg` via `qlmanage`. To regenerate from a new SVG:
+
+```bash
+qlmanage -t -s 256 -o /tmp /path/to/Logo.svg
+cp /tmp/Logo.svg.png mcpb/icon.png
+npm run mcpb:build
+```
+
+---
+
+## Submitting to the Anthropic directory
+
+CodeAnt's MCP server uses stdio + a packaged bundle, so the submission route is **Desktop Extensions (MCPB)**, not the remote-connector form.
+
+- **Submission URL:** https://claude.com/docs/connectors/building/submission
+- **Bundle:** upload `dist/codeant.mcpb`
+- **Required metadata:** already in [mcpb/manifest.json](mcpb/manifest.json) — display name, description, author, homepage, documentation, repository, license, keywords, `privacy_policies`, `tools` static listing, `user_config` schema.
+- **Privacy policy.** Linked from both [README.md](README.md#privacy-policy) and the manifest's `privacy_policies` field (`https://www.codeant.ai/privacy-policy`).
+
+Reviewer notes worth preparing:
+
+- **Auth model.** CodeAnt uses a user-scoped API token entered into `user_config.api_token`. The token never leaves the user's machine — the bundle talks to `api.codeant.ai` (or the user's self-hosted URL) directly. No third-party OAuth flow needed.
+- **Sandbox creds.** Email support@codeant.ai for a reviewer sandbox token; paste it into the submission form's reviewer-notes field along with an org slug that has scans + PRs to browse.
+- **Write tools.** Gated behind `user_config.read_only` (defaults to on). Reviewers can toggle off to test `codeant_scans_start` / `codeant_pr_resolve`.
+
+---
+
+## Troubleshooting
+
+| Symptom | Where to look |
+|---|---|
+| Server fails to start in Claude Desktop | `~/Library/Logs/Claude/mcp-server-codeant.log` |
+| Tool calls return errors | Same log — server stderr is captured there. |
+| Tool not listed at all | Check `CODEANT_READ_ONLY` — write tools are hidden when set to `1`. |
+| Auth errors on every tool | Confirm `CODEANT_API_TOKEN` is set in the MCP env (not just in `~/.codeant/config.json`). |
+| MCPB install dialog never appears | Open `.mcpb` with `open -a Claude dist/codeant.mcpb` to force the desktop app to handle it. |

package/package.json

@@ -1,10 +1,14 @@
 {
   "name": "codeant-cli",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "description": "Code review CLI tool",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/CodeAnt-AI/codeant-cli.git"
+  },
   "bin": {
-    "codeant": "./src/index.js"
+    "codeant": "src/index.js"
   },
   "scripts": {
     "start": "node src/index.js",
@@ -19,10 +23,7 @@
   ],
   "author": "",
   "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/CodeAnt-AI/codeant-cli"
-  },
+  "homepage": "https://docs.codeant.ai/cli/setup",
   "main": "./src/reviewHeadless.js",
   "exports": {
     ".": "./src/reviewHeadless.js",
@@ -34,10 +35,19 @@
     "./scans/scan-history": "./src/scans/getScanHistory.js",
     "./scans/fetch-results": "./src/scans/fetchScanResults.js",
     "./scans/fetch-advanced-results": "./src/scans/fetchAdvancedScanResults.js",
-    "./scans/dismissed-alerts": "./src/scans/fetchDismissedAlerts.js"
+    "./scans/dismissed-alerts": "./src/scans/fetchDismissedAlerts.js",
+    "./hotlist": "./src/hotlist/client.js",
+    "./findings/cloud": "./src/findings/cloud.js",
+    "./findings/pentest": "./src/findings/pentest.js",
+    "./findings/antipatterns": "./src/findings/antipatterns.js",
+    "./api": "./src/commands/api/request.js"
   },
   "files": [
-    "src"
+    "src",
+    "findings.md",
+    "cli-api.md",
+    "scans.md",
+    "mcp.md"
   ],
   "dependencies": {
     "@gitbeaker/rest": "^43.8.0",