codechef-mcp 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +94 -25
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
# codechef-mcp
|
|
2
2
|
|
|
3
3
|
[](https://www.npmjs.com/package/codechef-mcp)
|
|
4
|
+
[](https://github.com/sarthaksec/codechef-mcp/actions/workflows/ci.yml)
|
|
4
5
|
[](LICENSE)
|
|
5
6
|
[](package.json)
|
|
6
7
|
|
|
@@ -54,32 +55,12 @@ Or globally:
|
|
|
54
55
|
npm install -g codechef-mcp
|
|
55
56
|
```
|
|
56
57
|
|
|
57
|
-
## Quick start
|
|
58
|
-
|
|
59
|
-
```sh
|
|
60
|
-
cd codechef-mcp
|
|
61
|
-
npm install
|
|
62
|
-
npm test # unit + live + MCP handshake
|
|
63
|
-
```
|
|
64
|
-
|
|
65
|
-
Run the server directly (it speaks MCP over stdio):
|
|
66
|
-
|
|
67
|
-
```sh
|
|
68
|
-
npm start
|
|
69
|
-
```
|
|
70
|
-
|
|
71
|
-
Try the scraper without MCP:
|
|
72
|
-
|
|
73
|
-
```sh
|
|
74
|
-
node test/smoke.js aryanc403
|
|
75
|
-
```
|
|
76
|
-
|
|
77
58
|
## Wiring it into OpenCode (V2)
|
|
78
59
|
|
|
79
60
|
Config uses `mcp.servers`. Either run:
|
|
80
61
|
|
|
81
62
|
```sh
|
|
82
|
-
opencode mcp add codechef --global --
|
|
63
|
+
opencode mcp add codechef --global -- npx -y codechef-mcp
|
|
83
64
|
```
|
|
84
65
|
|
|
85
66
|
or add it by hand to `~/.config/opencode/opencode.jsonc`:
|
|
@@ -91,8 +72,7 @@ or add it by hand to `~/.config/opencode/opencode.jsonc`:
|
|
|
91
72
|
"servers": {
|
|
92
73
|
"codechef": {
|
|
93
74
|
"type": "local",
|
|
94
|
-
"command": ["
|
|
95
|
-
"cwd": "/path/to/codechef-mcp"
|
|
75
|
+
"command": ["npx", "-y", "codechef-mcp"]
|
|
96
76
|
}
|
|
97
77
|
}
|
|
98
78
|
}
|
|
@@ -110,13 +90,100 @@ Then check it with `opencode mcp list`. Under Code Mode the tools appear as
|
|
|
110
90
|
{
|
|
111
91
|
"mcpServers": {
|
|
112
92
|
"codechef": {
|
|
113
|
-
"command": "
|
|
114
|
-
"args": ["
|
|
93
|
+
"command": "npx",
|
|
94
|
+
"args": ["-y", "codechef-mcp"]
|
|
115
95
|
}
|
|
116
96
|
}
|
|
117
97
|
}
|
|
118
98
|
```
|
|
119
99
|
|
|
100
|
+
On Windows, if the client cannot find `npx`, use the shell form:
|
|
101
|
+
|
|
102
|
+
```json
|
|
103
|
+
{
|
|
104
|
+
"mcpServers": {
|
|
105
|
+
"codechef": {
|
|
106
|
+
"command": "cmd",
|
|
107
|
+
"args": ["/c", "npx", "-y", "codechef-mcp"]
|
|
108
|
+
}
|
|
109
|
+
}
|
|
110
|
+
}
|
|
111
|
+
```
|
|
112
|
+
|
|
113
|
+
## Run from source
|
|
114
|
+
|
|
115
|
+
```sh
|
|
116
|
+
git clone https://github.com/sarthaksec/codechef-mcp.git
|
|
117
|
+
cd codechef-mcp
|
|
118
|
+
npm install
|
|
119
|
+
npm start # speaks MCP over stdio
|
|
120
|
+
```
|
|
121
|
+
|
|
122
|
+
Point your MCP client at `src/server.js` inside the clone, or call the scraper directly:
|
|
123
|
+
|
|
124
|
+
```sh
|
|
125
|
+
node test/smoke.js aryanc403
|
|
126
|
+
```
|
|
127
|
+
|
|
128
|
+
## Development
|
|
129
|
+
|
|
130
|
+
```sh
|
|
131
|
+
npm install
|
|
132
|
+
npm run test:unit # offline parser + security tests
|
|
133
|
+
npm run test:live # live CodeChef scraper checks
|
|
134
|
+
npm run test:mcp # end-to-end MCP client handshake
|
|
135
|
+
npm test # all three
|
|
136
|
+
```
|
|
137
|
+
|
|
138
|
+
`test:unit` is fully offline and runs in CI on Node 20, 22 and 24. The live suites
|
|
139
|
+
depend on CodeChef being reachable and are not run in CI.
|
|
140
|
+
|
|
141
|
+
## Releasing
|
|
142
|
+
|
|
143
|
+
Releases are published from GitHub Actions using **trusted publishing (OIDC)** — there is
|
|
144
|
+
no `NPM_TOKEN` secret and no long-lived npm credential.
|
|
145
|
+
|
|
146
|
+
```sh
|
|
147
|
+
npm version patch # or minor / major
|
|
148
|
+
git push --follow-tags
|
|
149
|
+
```
|
|
150
|
+
|
|
151
|
+
Pushing the tag (for example `v0.1.1`) triggers `.github/workflows/publish.yml`, which:
|
|
152
|
+
|
|
153
|
+
1. checks that the tag matches `package.json`'s version,
|
|
154
|
+
2. installs with `npm ci` and runs the offline tests,
|
|
155
|
+
3. runs `npm publish` authenticated by a short-lived OIDC token,
|
|
156
|
+
4. publishes **provenance attestations automatically** (public package, public repo).
|
|
157
|
+
|
|
158
|
+
### One-time trusted publisher setup
|
|
159
|
+
|
|
160
|
+
On [npmjs.com](https://www.npmjs.com/package/codechef-mcp) → package **Settings** →
|
|
161
|
+
**Trusted publishing** → **Add trusted publisher** → GitHub Actions:
|
|
162
|
+
|
|
163
|
+
| Field | Value |
|
|
164
|
+
| --- | --- |
|
|
165
|
+
| Organization or user | `sarthaksec` |
|
|
166
|
+
| Repository | `codechef-mcp` |
|
|
167
|
+
| Workflow filename | `publish.yml` |
|
|
168
|
+
| Environment name | *(leave blank)* |
|
|
169
|
+
| Allowed actions | ✅ **Allow npm publish** (and optionally **Allow npm dist-tag**) |
|
|
170
|
+
|
|
171
|
+
Newer configurations default to *stage-only* publishing. If **Allow npm publish** is not
|
|
172
|
+
selected, the workflow's `npm publish` step is rejected; either enable it or change the
|
|
173
|
+
workflow to `npm stage publish` and approve each release manually with 2FA.
|
|
174
|
+
|
|
175
|
+
The first publish must succeed within **2 days** of creating the configuration, otherwise it
|
|
176
|
+
expires and has to be recreated.
|
|
177
|
+
|
|
178
|
+
### Verifying provenance
|
|
179
|
+
|
|
180
|
+
```sh
|
|
181
|
+
npm audit signatures
|
|
182
|
+
```
|
|
183
|
+
|
|
184
|
+
Or open the package on npmjs.com — a **Provenance** badge links the published tarball to the
|
|
185
|
+
exact commit and workflow run that built it.
|
|
186
|
+
|
|
120
187
|
## Behavior
|
|
121
188
|
|
|
122
189
|
- **Cache:** parsed pages are cached for 10 minutes per handle (max 200 entries).
|
|
@@ -138,6 +205,8 @@ Then check it with `opencode mcp list`. Under Code Mode the tools appear as
|
|
|
138
205
|
handle cannot alter the request path.
|
|
139
206
|
- **Null-prototype maps** for page-derived keys, so a crafted label cannot touch `Object.prototype`.
|
|
140
207
|
- Publishing is limited by the `files` field: only `src/` + docs ship to npm.
|
|
208
|
+
- **Releases use OIDC trusted publishing**, not a long-lived npm token, and ship with provenance
|
|
209
|
+
attestations from GitHub Actions.
|
|
141
210
|
|
|
142
211
|
## Caveats
|
|
143
212
|
|