crumplelab 0.2.4 → 0.3.0

package/.claude-plugin/plugin.json

@@ -1,10 +1,19 @@
 {
   "name": "crumple",
-  "version": "0.2.4",
+  "version": "0.3.0",
   "description": "Find out whether your AI coding agent can be hijacked, and harden it. Local scan, no key, nothing leaves the machine.",
-  "author": { "name": "Priberry", "email": "crumple@priberry.com", "url": "https://priberry.com" },
+  "author": {
+    "name": "Priberry",
+    "email": "crumple@priberry.com",
+    "url": "https://priberry.com"
+  },
   "homepage": "https://crumple.priberry.com",
   "repository": "https://github.com/priberry-data/crumplelab",
   "license": "Apache-2.0",
-  "keywords": ["security", "prompt-injection", "mcp", "agents"]
+  "keywords": [
+    "security",
+    "prompt-injection",
+    "mcp",
+    "agents"
+  ]
 }

package/.mcp.json

@@ -1,5 +1,5 @@
 {
   "mcpServers": {
-    "crumple": { "command": "npx", "args": ["-y", "crumplelab", "mcp"] }
+    "crumple": { "command": "node", "args": ["${CLAUDE_PLUGIN_ROOT}/bin/crumple.mjs", "mcp"] }
   }
 }

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.3.0
+
+- `crumple site <url>`: checks a deployed app (Lovable, Bolt, v0, Replit, Emergent or hand-built) for secret keys
+  in its JavaScript, a Supabase `service_role` key in the browser, public source maps and a missing CSP. With
+  `--mine` it also counts which Supabase tables anyone can read, using `HEAD` requests that return no rows.
+- `crumple setup`: adds Crumple's MCP server to every AI coding app found (Claude Code, Claude Desktop, Cursor,
+  VS Code, Windsurf, Codex, Gemini CLI, Kiro, opencode, Amazon Q, LM Studio, Cline, Roo Code, Kilo Code), pinned
+  to the exact version, with backups and `--undo`.
+- `scan` reads more setups: Claude Desktop, VS Code's user `mcp.json`, Kiro, Roo Code, Cline and Kilo Code
+  settings, Zed, opencode, Amazon Q and Continue, config files with comments, and the rules folders
+  `.windsurf/rules`, `.kiro/steering`, `.roo/rules`, `.clinerules/`, `.github/instructions` and more.
+- `crumple_site` in the MCP server, and a Gemini CLI extension.
+- The Claude Code plugin now runs its own bundled code for the MCP server instead of an unpinned `npx crumplelab`,
+  which Crumple's own scan rightly flagged.
+- `--version`, and a clear message for options Crumple doesn't know.
+
 ## 0.2.4
 
 - **Fix:** `crumple scan` flagged every tracked file as "a .env file is committed to git" in any repo without a

package/README.md

@@ -2,7 +2,7 @@
 
 # Crumple: crash-test your AI coding agent
 
-> **Version 0.2.** Needs Node 20+ and Docker (`scan` needs neither). So far Crumple's scores are
+> **Version 0.3.** Needs Node 20+ and Docker (`scan`, `site` and `setup` need neither). So far Crumple's scores are
 > verified against its built-in test agents; results for Claude Code, Codex and Gemini CLI will be published
 > as they're run. Website: [crumple.priberry.com](https://crumple.priberry.com) · contact: crumple@priberry.com
 
@@ -13,12 +13,17 @@ Your AI agent can read your `.env`, run shell commands and touch your databases.
 npx crumplelab scan      # 5 seconds, no API key, nothing leaves your machine
 npx crumplelab attack    # the real crash test, in a throwaway container
 npx crumplelab fix       # harden it, then attack again to prove it
+npx crumplelab site myapp.lovable.app   # built your app with an AI app builder? check what it leaks
 ```
 
 `scan` audits your agent setup the way an attacker would read it: skip-permissions modes, pre-approved
 commands that can run anything, MCP servers on `@latest` or with keys in plain text, invisible characters in
 `CLAUDE.md` and `.cursorrules`, repo hooks and auto-run tasks, base-URL redirects, committed `.env` files.
-It prints a Safe Setup score, writes SARIF for GitHub code scanning, and fails CI with `--fail-on high`.
+It reads the setups of Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, Windsurf, VS Code (project
+and user `mcp.json`), Kiro, Cline, Roo Code, Kilo Code, Zed, opencode, Amazon Q and Continue, and the rules
+files and folders they all read (`CLAUDE.md`, `AGENTS.md`, `.cursor/rules`, `.windsurf/rules`, `.kiro/steering`,
+`.roo/rules`, `.clinerules`, `.github/instructions` and more). It prints a Safe Setup score, writes SARIF for
+GitHub code scanning, and fails CI with `--fail-on high`.
 
 `attack` builds eighteen booby-trapped projects inside a Docker container, runs **your own** agent setup
 against each one headless, and times how long it takes to fall in. Every trap is drawn from a real CVE,
@@ -67,6 +72,29 @@ Score: 0/18 traps survived
 
 You get a card to share, a badge for your README, and a fix for every failed trap.
 
+## Check a deployed app
+
+Built your app with Lovable, Bolt, v0, Replit, Emergent or any other AI app builder? The mistakes they ship
+most often are visible to anyone who opens the site.
+
+```bash
+npx crumplelab site myapp.lovable.app          # what every visitor can see
+npx crumplelab site myapp.lovable.app --mine   # also: which Supabase tables anyone can read
+```
+
+`site` reads the page and the JavaScript it serves, the way a curious stranger would, and looks for:
+
+- secret keys in code every visitor downloads (Stripe, OpenAI, Anthropic, AWS, GitHub, Slack, Resend,
+  SendGrid, Twilio, Groq, Gemini)
+- a Supabase `service_role` key in the browser, which skips every security rule
+- public source maps, which hand out your whole source code
+- no Content-Security-Policy
+
+With `--mine`, for an app you own, it takes the public Supabase anon key the app already ships and asks the
+database which tables anyone can read. It sends `HEAD` requests with `count=exact`, so Postgres returns a row
+count and never a row. Tables of people (users, profiles, orders, messages) are marked critical, and each
+finding says which switch to flip in Supabase.
+
 ## Fix it
 
 ```bash
@@ -134,13 +162,24 @@ invisible text in `CLAUDE.md`, a changed MCP tool) fail, and findings appear in
 
 ## In your agent
 
+One command adds Crumple to every AI coding app it finds: Claude Code, Claude Desktop, Cursor, VS Code,
+Windsurf, Codex, Gemini CLI, Kiro, opencode, Amazon Q, LM Studio, and Cline, Roo Code and Kilo Code. The
+entry is pinned to the exact version, each file is backed up first, and `--undo` removes it.
+
+```bash
+npx crumplelab setup
+```
+
+Or one app at a time:
+
 - **Claude Code plugin:** `/plugin marketplace add priberry-data/crumplelab`, then `/plugin install crumple@priberry`
   (or in one step: `/plugin install crumple --marketplace priberry-data/crumplelab`). Adds the skill and the MCP server;
   ask "is my agent setup safe?"
+- **Gemini CLI extension:** `gemini extensions install https://github.com/priberry-data/crumplelab`
 - **Skill (Claude Code or Codex):** copy `skills/crumple` into `~/.claude/skills/` or `~/.codex/skills/`.
-- **MCP server (any agent):** `{"command": "npx", "args": ["-y", "crumplelab", "mcp"]}`. Tools: `crumple_scan`
-  (the setup scan, local and instant) and `crumple_traps`. The full crash test spends API credit, so it stays a
-  command you run on purpose.
+- **Any MCP client:** `{"command": "npx", "args": ["-y", "crumplelab@0.3.0", "mcp"]}`. Tools: `crumple_scan`
+  (the setup scan, local and instant), `crumple_site` (what a deployed app shows every visitor) and
+  `crumple_traps`. The full crash test spends API credit, so it stays a command you run on purpose.
 
 ## Private trap packs
 
@@ -181,8 +220,8 @@ npx crumplelab attack --agent mock-careful
 
 ## Status
 
-v0.2: Claude Code, Codex CLI and Gemini CLI; 18 traps plus packs; `scan`, `fix`, `lock`, the guard and a
-GitHub Action. Not yet run against live models: the traps and checks are verified with scripted agents.
+v0.3: Claude Code, Codex CLI and Gemini CLI; 18 traps plus packs; `scan` across 15 agents and editors, `site`
+for deployed apps, `setup`, `fix`, `lock`, the guard and a GitHub Action. Not yet run against live models: the traps and checks are verified with scripted agents.
 Next: first live runs across vendors, Copilot CLI and Cursor adapters, and a public cross-vendor leaderboard.
 
-Apache-2.0 · Built by [Priberry](https://priberry.com)
+Apache-2.0 · Built by [Priberry](https://priberry.com), who also make [Tare](https://tare.priberry.com).

package/bin/crumple.mjs

@@ -50,6 +50,8 @@ try {
     pack: { type: "string", multiple: true, default: [] },
     help: { type: "boolean", short: "h" },
     version: { type: "boolean", short: "v" },
+    mine: { type: "boolean" },
+    undo: { type: "boolean" },
   },
   });
 } catch (e) {
@@ -70,6 +72,7 @@ const crashed = (e) => {
 process.on("uncaughtException", crashed);
 process.on("unhandledRejection", crashed);
 
+const SEVERITY_OF = (s) => ({ critical: 40, high: 15, medium: 5, low: 1 })[s] ?? 0;
 const c = { red: (s) => `\x1b[31m${s}\x1b[0m`, green: (s) => `\x1b[32m${s}\x1b[0m`, yellow: (s) => `\x1b[33m${s}\x1b[0m`, dim: (s) => `\x1b[2m${s}\x1b[0m`, bold: (s) => `\x1b[1m${s}\x1b[0m` };
 
 // The guard speaks JSON to the agent over stdout, so it (and any machine-readable output) never gets the banner.
@@ -126,6 +129,38 @@ if (positionals[0] === "mcp") {
   }
   const failOn = opt["fail-on"];
   if (failOn && result.findings.some((f) => SEVERITY[f.severity] >= SEVERITY[failOn])) process.exitCode = 1;
+} else if (positionals[0] === "setup") {
+  const { setup, renderSetup } = await import("../src/clients.mjs");
+  const rows = setup({ name: "crumple", pkg: "crumplelab", version: VERSION, dryRun: opt["dry-run"], undo: opt.undo, backupDir: path.join(os.homedir(), ".crumplelab", "backups") });
+  console.log(renderSetup(rows, { name: "Crumple", undo: opt.undo, dryRun: opt["dry-run"], color: Boolean(process.stdout.isTTY && !process.env.NO_COLOR) }));
+} else if (positionals[0] === "site") {
+  if (!positionals[1]) {
+    console.error("Usage: npx crumplelab site <url> [--mine]   checks a deployed app (Lovable, Bolt, v0, Replit, any site)");
+    process.exit(2);
+  }
+  const { siteScan } = await import("../src/site.mjs");
+  const run = () => siteScan(positionals[1], { mine: opt.mine });
+  let result;
+  try {
+    result = opt.json ? await run() : await spin(`looking at ${positionals[1]} the way a stranger would`, run);
+  } catch (e) {
+    console.error(c.red(`crumple: ${e.message}`));
+    process.exit(1);
+  }
+  if (opt.json) console.log(JSON.stringify(result, null, 2));
+  else {
+    const col = { critical: c.red, high: c.red, medium: c.yellow, low: c.dim };
+    console.log(`\n${c.bold("Crumple site check")} · ${result.url} · ${result.scripts} scripts read${result.supabase ? " · Supabase app" : ""}\n`);
+    if (!result.findings.length) console.log(c.green("Nothing found.\n"));
+    for (const f of result.findings) {
+      console.log(`${col[f.severity](f.severity.toUpperCase().padEnd(8))} ${c.bold(f.title)} ${c.dim(`(${f.where})`)}`);
+      console.log(`         ${f.why}`);
+      console.log(`         ${c.green("Fix:")} ${f.fix}\n`);
+    }
+    const color = result.score >= 75 ? c.green : result.score >= 55 ? c.yellow : c.red;
+    console.log(`Site score: ${color(`${result.score}/100 (${result.grade})`)} · read only what the site serves to every visitor${opt.mine ? "; database checked with counts only, no rows" : ""}`);
+  }
+  if (opt["fail-on"] && result.findings.some((f) => SEVERITY_OF(f.severity) >= SEVERITY_OF(opt["fail-on"]))) process.exitCode = 1;
 } else if (positionals[0] === "lock") {
   const { snapshot, diff, LOCK_PATH } = await import("../src/lock.mjs");
   const file = LOCK_PATH(process.cwd());
@@ -169,6 +204,8 @@ if (positionals[0] === "mcp") {
   if (opt.help || positionals[0] !== "attack") {
     console.log(`Usage: crumple attack [options]
        crumple scan [--sarif f] [--fail-on high]   instant local audit of your agent setup (no key, no Docker)
+       crumple setup [--dry-run] [--undo]       add Crumple to every AI coding app here (Cursor, VS Code, Windsurf, Claude, Codex, Gemini CLI, Cline, Kiro…)
+       crumple site <url> [--mine]               check a deployed app (Lovable, Bolt, v0, Replit, any site) for leaked keys and open data
        crumple fix [--sandbox] [--managed] [--dry-run]   harden this project's agent setup, then attack again
        crumple lock [--check]                      pin your MCP servers' tools; report any that change
        crumple list [--pack dir]                   every trap, its source and the standards it maps to

package/gemini-extension.json

@@ -0,0 +1,15 @@
+{
+  "name": "crumple",
+  "version": "0.3.0",
+  "description": "Audit AI coding agent setups and deployed apps for leaked keys, open data and risky config.",
+  "mcpServers": {
+    "crumple": {
+      "command": "node",
+      "args": [
+        "${extensionPath}/bin/crumple.mjs",
+        "mcp"
+      ],
+      "cwd": "${extensionPath}"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crumplelab",
-  "version": "0.2.4",
+  "version": "0.3.0",
   "description": "Crash-test your AI coding agent setup against prompt injection, secret leaks, malicious MCP tools and destructive actions.",
   "type": "module",
   "bin": {
@@ -20,7 +20,9 @@
     "LICENSE",
     "skills",
     ".claude-plugin",
-    ".mcp.json"
+    ".mcp.json",
+    "server.json",
+    "gemini-extension.json"
   ],
   "engines": {
     "node": ">=20"
@@ -49,5 +51,6 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/priberry-data/crumplelab.git"
-  }
+  },
+  "mcpName": "io.github.priberry-data/crumplelab"
 }

package/server.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.priberry-data/crumplelab",
+  "title": "Crumple",
+  "description": "Audit AI coding agent setups and deployed apps for leaked keys, open data and risky config.",
+  "websiteUrl": "https://crumple.priberry.com",
+  "repository": {
+    "url": "https://github.com/priberry-data/crumplelab",
+    "source": "github"
+  },
+  "version": "0.3.0",
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "crumplelab",
+      "version": "0.3.0",
+      "transport": {
+        "type": "stdio"
+      },
+      "packageArguments": [
+        {
+          "type": "positional",
+          "value": "mcp"
+        }
+      ]
+    }
+  ]
+}

package/src/clients.mjs

@@ -0,0 +1,176 @@
+// `setup`: add this tool's MCP server to every AI coding app found on the machine, in each app's own
+// config format, pinned to the exact version (an unpinned `npx` server runs whatever is published
+// next). Each file is backed up first, nothing else in it changes, and `--undo` removes only our entry.
+// A file that isn't plain JSON (comments, say) is never rewritten; we print what to add instead.
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+
+const appSupport = (home) =>
+  process.platform === "darwin" ? path.join(home, "Library", "Application Support") : process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : path.join(home, ".config");
+
+// Every app we know how to configure: where it keeps MCP servers, and in which shape.
+export function clients(home = os.homedir()) {
+  const app = appSupport(home);
+  const list = [
+    { name: "Claude Desktop", file: path.join(app, "Claude", "claude_desktop_config.json"), shape: "mcpServers", when: path.join(app, "Claude") },
+    { name: "Cursor", file: path.join(home, ".cursor", "mcp.json"), shape: "mcpServers", when: path.join(home, ".cursor") },
+    { name: "Windsurf", file: path.join(home, ".codeium", "windsurf", "mcp_config.json"), shape: "mcpServers", when: path.join(home, ".codeium", "windsurf") },
+    { name: "VS Code", file: path.join(app, "Code", "User", "mcp.json"), shape: "vscode", when: path.join(app, "Code", "User") },
+    { name: "VS Code Insiders", file: path.join(app, "Code - Insiders", "User", "mcp.json"), shape: "vscode", when: path.join(app, "Code - Insiders", "User") },
+    { name: "Gemini CLI", file: path.join(home, ".gemini", "settings.json"), shape: "mcpServers", when: path.join(home, ".gemini") },
+    { name: "Codex", file: path.join(process.env.CODEX_HOME && home === os.homedir() ? process.env.CODEX_HOME : path.join(home, ".codex"), "config.toml"), shape: "toml", when: path.join(home, ".codex") },
+    { name: "Kiro", file: path.join(home, ".kiro", "settings", "mcp.json"), shape: "mcpServers", when: path.join(home, ".kiro") },
+    { name: "opencode", file: path.join(home, ".config", "opencode", "opencode.json"), shape: "opencode", when: path.join(home, ".config", "opencode") },
+    { name: "Amazon Q", file: path.join(home, ".aws", "amazonq", "mcp.json"), shape: "mcpServers", when: path.join(home, ".aws", "amazonq") },
+    { name: "LM Studio", file: path.join(home, ".lmstudio", "mcp.json"), shape: "mcpServers", when: path.join(home, ".lmstudio") },
+  ];
+  // Cline, Roo Code and Kilo Code keep their own list inside each editor they're installed in.
+  for (const ed of ["Code", "Cursor", "Windsurf", "VSCodium", "Trae", "Kiro"])
+    for (const [ext, nm, f] of [
+      ["saoudrizwan.claude-dev", "Cline", "cline_mcp_settings.json"],
+      ["rooveterinaryinc.roo-cline", "Roo Code", "mcp_settings.json"],
+      ["kilocode.kilo-code", "Kilo Code", "mcp_settings.json"],
+    ]) {
+      const dir = path.join(app, ed, "User", "globalStorage", ext);
+      list.push({ name: ed === "Code" ? nm : `${nm} in ${ed}`, file: path.join(dir, "settings", f), shape: "mcpServers", when: dir });
+    }
+  return list;
+}
+
+function entry(shape, command, args) {
+  if (shape === "vscode") return { type: "stdio", command, args };
+  if (shape === "opencode") return { type: "local", command: [command, ...args], enabled: true };
+  return { command, args };
+}
+const key = (shape) => (shape === "vscode" ? "servers" : shape === "opencode" ? "mcp" : "mcpServers");
+
+function backup(file, dir) {
+  if (!fs.existsSync(file)) return;
+  fs.mkdirSync(dir, { recursive: true });
+  fs.copyFileSync(file, path.join(dir, `${Date.now()}-${file.replace(/[^\w.-]+/g, "_").slice(-120)}`));
+}
+
+function writeJson(file, obj) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.tmp-${process.pid}`;
+  fs.writeFileSync(tmp, JSON.stringify(obj, null, 2) + "\n");
+  fs.renameSync(tmp, file);
+}
+
+function tomlBlock(name, command, args) {
+  return `\n[mcp_servers.${name}]\ncommand = ${JSON.stringify(command)}\nargs = [${args.map((a) => JSON.stringify(a)).join(", ")}]\n`;
+}
+const TOML_RE = (name) => new RegExp(`\\n?\\[mcp_servers\\.${name}\\]\\n(?:(?!\\[)[^\\n]*\\n?)*`, "g");
+
+// Returns one line per app: added, updated, already there, removed, skipped (with why), or not installed.
+export function setup({ name, pkg, version, home = os.homedir(), dryRun = false, undo = false, backupDir, claudeCli = true }) {
+  const command = "npx";
+  const args = ["-y", `${pkg}@${version}`, "mcp"];
+  const out = [];
+  for (const c of clients(home)) {
+    if (!fs.existsSync(c.when)) continue;
+    const rec = (status, note) => out.push({ client: c.name, file: c.file, status, note });
+    try {
+      if (c.shape === "toml") {
+        const t = fs.existsSync(c.file) ? fs.readFileSync(c.file, "utf8") : "";
+        const has = TOML_RE(name).test(t);
+        if (undo) {
+          if (!has) continue;
+          if (!dryRun) (backup(c.file, backupDir), fs.writeFileSync(c.file, t.replace(TOML_RE(name), "\n")));
+          rec("removed");
+          continue;
+        }
+        const block = tomlBlock(name, command, args);
+        if (t.includes(block.trim())) {
+          rec("already there");
+          continue;
+        }
+        if (!dryRun) {
+          backup(c.file, backupDir);
+          fs.mkdirSync(path.dirname(c.file), { recursive: true });
+          fs.writeFileSync(c.file, (has ? t.replace(TOML_RE(name), "\n") : t).replace(/\n*$/, "\n") + block);
+        }
+        rec(has ? "updated" : "added");
+        continue;
+      }
+      let cfg = {};
+      if (fs.existsSync(c.file)) {
+        const text = fs.readFileSync(c.file, "utf8");
+        if (text.trim()) {
+          try {
+            cfg = JSON.parse(text);
+          } catch {
+            rec("skipped", `has comments or isn't plain JSON; add under "${key(c.shape)}": ${JSON.stringify({ [name]: entry(c.shape, command, args) })}`);
+            continue;
+          }
+        }
+      }
+      const k = key(c.shape);
+      const cur = cfg[k]?.[name];
+      if (undo) {
+        if (!cur) continue;
+        delete cfg[k][name];
+        if (!dryRun) (backup(c.file, backupDir), writeJson(c.file, cfg));
+        rec("removed");
+        continue;
+      }
+      const want = entry(c.shape, command, args);
+      if (cur && JSON.stringify(cur) === JSON.stringify({ ...cur, ...want })) {
+        rec("already there");
+        continue;
+      }
+      cfg[k] = { ...(cfg[k] || {}), [name]: { ...(cur || {}), ...want } };
+      if (!dryRun) (backup(c.file, backupDir), writeJson(c.file, cfg));
+      rec(cur ? "updated" : "added");
+    } catch (e) {
+      rec("skipped", e.message);
+    }
+  }
+  // Claude Code keeps MCP servers in a large file it rewrites often, so go through its own CLI.
+  if (claudeCli && fs.existsSync(path.join(home, ".claude"))) {
+    // Run from the home folder so a project's own .mcp.json isn't mistaken for the user's entry.
+    const run = (a) => execFileSync("claude", a, { cwd: home, stdio: ["ignore", "pipe", "pipe"], timeout: 20000 }).toString();
+    let current = null;
+    try {
+      const got = run(["mcp", "get", name]); // fails when there is no such server
+      if (/Scope:\s*User/i.test(got)) current = got;
+    } catch {}
+    try {
+      const has = current != null;
+      if (undo) {
+        if (has && !dryRun) run(["mcp", "remove", "-s", "user", name]);
+        if (has) out.push({ client: "Claude Code", file: "claude mcp", status: "removed" });
+      } else if (has && current.includes(`${pkg}@${version}`)) out.push({ client: "Claude Code", file: "claude mcp", status: "already there" });
+      else {
+        if (!dryRun) {
+          if (has) run(["mcp", "remove", "-s", "user", name]);
+          run(["mcp", "add", "-s", "user", name, "--", command, ...args]);
+        }
+        out.push({ client: "Claude Code", file: "claude mcp", status: has ? "updated" : "added" });
+      }
+    } catch {
+      if (!undo) out.push({ client: "Claude Code", file: "claude mcp", status: "skipped", note: `run: claude mcp add -s user ${name} -- ${command} ${args.join(" ")}` });
+    }
+  }
+  return out;
+}
+
+export function renderSetup(rows, { name, undo, dryRun, color = true }) {
+  const c = (code) => (s) => (color ? `\x1b[${code}m${s}\x1b[0m` : s);
+  const green = c("32"), dim = c("2"), yellow = c("33");
+  const L = [];
+  if (!rows.length) {
+    L.push(undo ? `  ${name} isn't set up in any app on this machine.` : "  No supported AI coding app found on this machine.");
+    return L.join("\n");
+  }
+  for (const r of rows) {
+    const mark = r.status === "skipped" ? yellow("!") : r.status === "already there" ? dim("·") : green("✓");
+    const status = dryRun && /added|updated|removed/.test(r.status) ? `would be ${r.status}` : r.status;
+    L.push(`  ${mark} ${r.client.padEnd(22)} ${status}${r.note ? dim(`  ${r.note}`) : ""}`);
+  }
+  if (dryRun) L.push(dim("\n  Dry run: nothing was written."));
+  else if (!undo && rows.some((r) => /added|updated/.test(r.status))) L.push(dim(`\n  Restart those apps to load it. Ask your agent to use ${name}. Undo any time with --undo.`));
+  return L.join("\n");
+}

package/src/mcp.mjs

@@ -13,6 +13,12 @@ const TOOLS = [
     inputSchema: { type: "object", properties: { path: { type: "string", description: "Project folder to scan. Defaults to the server's working directory." } }, additionalProperties: false },
     annotations: { readOnlyHint: true },
   },
+  {
+    name: "crumple_site",
+    description: "Check a deployed web app (built with Lovable, Bolt, v0, Replit, Emergent or by hand) for secret keys shipped in its JavaScript, a Supabase service_role key in the browser, and public source maps. Reads only what the site serves to every visitor. The Supabase table check needs the owner, so run `npx crumplelab site <url> --mine` for that.",
+    inputSchema: { type: "object", properties: { url: { type: "string", description: "The app's address, for example myapp.lovable.app" } }, required: ["url"], additionalProperties: false },
+    annotations: { readOnlyHint: true, openWorldHint: true },
+  },
   {
     name: "crumple_traps",
     description: "The traps Crumple's crash test runs: each modelled on a real attack (poisoned issues, evil MCP servers, secret exfiltration, destructive commands), with its risk.",
@@ -21,11 +27,12 @@ const TOOLS = [
   },
 ];
 
-function call(name, args = {}) {
+async function call(name, args = {}) {
   if (name === "crumple_scan") {
     const dir = path.resolve(args.path || process.cwd());
     return { project: dir, ...scan(dir), next: "Run `npx crumplelab fix` to harden, then `npx crumplelab attack` to prove it (needs Docker and an API key)." };
   }
+  if (name === "crumple_site") return (await import("./site.mjs")).siteScan(args.url, { mine: false });
   if (name === "crumple_traps") return { traps: SCENARIOS.map((s) => ({ id: s.id, title: s.title, risk: s.risk })) };
   throw new Error(`unknown tool ${name}`);
 }
@@ -33,7 +40,12 @@ function call(name, args = {}) {
 export function serve({ version, input = process.stdin, output = process.stdout } = {}) {
   const send = (msg) => output.write(JSON.stringify({ jsonrpc: "2.0", ...msg }) + "\n");
   const rl = readline.createInterface({ input, crlfDelay: Infinity });
+  const pending = new Set();
   rl.on("line", (line) => {
+    const job = handle(line).finally(() => pending.delete(job));
+    pending.add(job);
+  });
+  async function handle(line) {
     let m;
     try {
       m = JSON.parse(line);
@@ -47,13 +59,14 @@ export function serve({ version, input = process.stdin, output = process.stdout
     if (m.method === "tools/list") return send({ id: m.id, result: { tools: TOOLS } });
     if (m.method === "tools/call") {
       try {
-        const r = call(m.params?.name, m.params?.arguments);
+        const r = await call(m.params?.name, m.params?.arguments);
         return send({ id: m.id, result: { content: [{ type: "text", text: JSON.stringify(r, null, 2) }], structuredContent: r } });
       } catch (e) {
         return send({ id: m.id, result: { content: [{ type: "text", text: `crumple: ${e.message}` }], isError: true } });
       }
     }
     send({ id: m.id, error: { code: -32601, message: `method not found: ${m.method}` } });
-  });
-  return new Promise((resolve) => rl.on("close", resolve));
+  }
+  // Let calls still running (a site check takes seconds) answer before the server exits.
+  return new Promise((resolve) => rl.on("close", () => Promise.allSettled([...pending]).then(resolve)));
 }

package/src/scan.mjs

@@ -23,10 +23,36 @@ const json = (p) => {
   if (t == null) return null;
   try {
     return JSON.parse(t);
+  } catch {}
+  try {
+    return JSON.parse(stripJsonc(t)); // VS Code, Zed and others allow comments and trailing commas
   } catch {
     return null;
   }
 };
+// Drops // and /* */ comments and trailing commas, leaving strings alone.
+function stripJsonc(t) {
+  let out = "";
+  for (let i = 0; i < t.length; i++) {
+    const c = t[i];
+    if (c === '"') {
+      let j = i + 1;
+      while (j < t.length && t[j] !== '"') j += t[j] === "\\" ? 2 : 1;
+      out += t.slice(i, j + 1);
+      i = j;
+    } else if (c === "/" && t[i + 1] === "/") while (i < t.length && t[i] !== "\n") i++;
+    else if (c === "/" && t[i + 1] === "*") {
+      i = t.indexOf("*/", i + 2);
+      if (i < 0) break;
+      i++;
+    } else out += c;
+  }
+  return out.replace(/,(\s*[}\]])/g, "$1");
+}
+// Where VS Code-based editors and desktop apps keep their per-user settings.
+const appSupport = (home) =>
+  process.platform === "darwin" ? path.join(home, "Library", "Application Support") : process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : path.join(home, ".config");
+const EDITORS = ["Code", "Code - Insiders", "Cursor", "Windsurf", "VSCodium", "Trae", "Kiro", "Positron", "Void"];
 const redact = (s) => String(s).replace(new RegExp(SECRET_VALUES.source, "g"), (m) => m.slice(0, 4) + "…[redacted]");
 
 export function scan(projectDir, { home = os.homedir() } = {}) {
@@ -71,19 +97,38 @@ export function scan(projectDir, { home = os.homedir() } = {}) {
   if (!sandboxed) add("medium", "agent setup", "The agent's commands don't run in a sandbox", "Commands can reach every file you can and any server on the internet. Sandboxes and egress limits are the defenses research shows hold up under adaptive attacks.", "Run `crumple fix --sandbox` to switch on Claude Code's built-in sandbox with a network allowlist.");
 
   // --- MCP servers, across agents -------------------------------------------------------------
-  const mcpFiles = [P(".mcp.json"), H(".claude.json"), P(".cursor/mcp.json"), H(".cursor/mcp.json"), P(".vscode/mcp.json"), H(".codeium/windsurf/mcp_config.json"), H(".gemini/settings.json"), P(".gemini/settings.json")];
-  for (const f of mcpFiles) {
+  const app = appSupport(home);
+  const mcpFiles = [
+    P(".mcp.json"), H(".claude.json"), path.join(app, "Claude", "claude_desktop_config.json"),
+    P(".cursor/mcp.json"), H(".cursor/mcp.json"), P(".vscode/mcp.json"), H(".codeium/windsurf/mcp_config.json"),
+    H(".gemini/settings.json"), P(".gemini/settings.json"), P(".kiro/settings/mcp.json"), H(".kiro/settings/mcp.json"),
+    P(".roo/mcp.json"), H(".aws/amazonq/mcp.json"), P(".amazonq/mcp.json"), P("opencode.json"), H(".config/opencode/opencode.json"),
+    H(".config/zed/settings.json"), P(".zed/settings.json"), P(".continue/config.json"), H(".continue/config.json"),
+    ...EDITORS.flatMap((ed) => [
+      path.join(app, ed, "User", "mcp.json"),
+      path.join(app, ed, "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+      path.join(app, ed, "User", "globalStorage", "rooveterinaryinc.roo-cline", "settings", "mcp_settings.json"),
+      path.join(app, ed, "User", "globalStorage", "kilocode.kilo-code", "settings", "mcp_settings.json"),
+    ]),
+  ];
+  for (const f of [...new Set(mcpFiles)]) {
     const cfg = json(f);
-    const servers = { ...(cfg?.mcpServers ?? {}), ...(cfg?.servers ?? {}) };
+    // Each tool names the block differently: mcpServers (most), servers (VS Code), mcp (opencode), context_servers (Zed).
+    const servers = { ...(cfg?.mcpServers ?? {}), ...(cfg?.servers ?? {}), ...(cfg?.mcp ?? {}), ...(cfg?.context_servers ?? {}) };
+    if (Array.isArray(cfg?.experimental?.modelContextProtocolServers))
+      cfg.experimental.modelContextProtocolServers.forEach((x, i) => (servers[x.name || `server ${i + 1}`] = x.transport || x));
     for (const proj of Object.values(cfg?.projects ?? {})) Object.assign(servers, proj?.mcpServers ?? {});
     for (const [name, srv] of Object.entries(servers)) {
+      if (!srv || typeof srv !== "object") continue;
       const where = `${rel(f)} → ${name}`;
-      const cmd = [srv.command, ...(srv.args ?? [])].join(" ");
+      // opencode gives the command as an array; Zed nests it as { path, args }.
+      const parts = Array.isArray(srv.command) ? srv.command : srv.command?.path ? [srv.command.path, ...(srv.command.args ?? [])] : [srv.command, ...(srv.args ?? [])];
+      const cmd = parts.filter(Boolean).join(" ");
       if (/\b(npx|bunx|pnpm dlx|uvx)\b/.test(cmd)) {
-        const pkg = (srv.args ?? []).find((a) => !String(a).startsWith("-")) ?? "";
+        const pkg = parts.slice(1).find((a) => !String(a).startsWith("-") && !/^(dlx|x)$/.test(a)) ?? "";
         if (!/@\d/.test(pkg.replace(/^@[^/]+\//, "")) || /@latest$/.test(pkg)) add("high", where, `MCP server runs whatever version is newest (${pkg || cmd})`, "If that package is ever compromised or sold, your agent runs the new code with your keys the next time it starts (MCP rug pull).", `Pin an exact version, for example ${pkg.replace(/@latest$/, "")}@1.2.3, and run \`crumple lock\`.`);
       }
-      const blob = JSON.stringify({ env: srv.env, args: srv.args, headers: srv.headers, url: srv.url });
+      const blob = JSON.stringify({ env: srv.env ?? srv.environment, args: parts.slice(1), headers: srv.headers, url: srv.url });
       if (SECRET_VALUES.test(blob) || /"[A-Z_]*(TOKEN|SECRET|KEY|PASSWORD)[A-Z_]*":"[^"$]{12,}"/.test(blob)) add("high", where, "MCP server config holds a secret in plain text", "Any agent or extension that reads this file gets the key.", "Reference an environment variable or keychain entry instead.");
       if (srv.url && /^http:\/\//.test(srv.url) && !/localhost|127\.0\.0\.1/.test(srv.url)) add("medium", where, "Remote MCP server over plain HTTP", "Anyone on the network path can read and change the tools your agent trusts.", "Use https.");
     }
@@ -96,9 +141,12 @@ export function scan(projectDir, { home = os.homedir() } = {}) {
 
   // --- rules files and docs the agent reads -----------------------------------------------------
   const rulesFiles = ["CLAUDE.md", "AGENTS.md", "GEMINI.md", ".cursorrules", ".windsurfrules", ".clinerules", ".github/copilot-instructions.md", "CONTRIBUTING.md", "README.md"].map((f) => P(f));
-  try {
-    for (const f of fs.readdirSync(P(".cursor/rules"))) rulesFiles.push(P(".cursor/rules", f));
-  } catch {}
+  rulesFiles.push(P(".junie/guidelines.md"), P("CONVENTIONS.md"), P(".rules"));
+  // Rules folders: Cursor, Windsurf, Kiro, Roo, Cline (a folder form of .clinerules), Copilot, Amazon Q.
+  for (const d of [".cursor/rules", ".windsurf/rules", ".kiro/steering", ".roo/rules", ".clinerules", ".github/instructions", ".amazonq/rules", ".continue/rules"])
+    try {
+      for (const f of fs.readdirSync(P(d))) rulesFiles.push(P(d, f));
+    } catch {}
   rulesFiles.push(H(".claude/CLAUDE.md"), H(".codex/AGENTS.md"), H(".gemini/GEMINI.md"));
   for (const f of rulesFiles) {
     const t = read(f);

package/src/site.mjs

@@ -0,0 +1,142 @@
+// crumple site <url>: checks a deployed app the way a curious stranger would, for the mistakes that
+// AI app builders (Lovable, Bolt, v0, Replit, Emergent and the rest) ship most often:
+//   - secret keys inside the JavaScript every visitor downloads
+//   - a Supabase database whose tables anyone can read with the public key (with --mine only)
+//   - source maps that hand out the whole source code
+// It reads only what the site serves to every visitor. The database check asks Postgres for a row
+// count, never for rows, and runs only when you say the app is yours.
+import { SEVERITY } from "./scan.mjs";
+
+const SECRETS = [
+  [/sk_live_[0-9A-Za-z]{20,}/, "A live Stripe secret key", "Anyone can charge, refund and read your customers' payments."],
+  [/rk_live_[0-9A-Za-z]{20,}/, "A live Stripe restricted key", "Anyone can do whatever this key allows on your Stripe account."],
+  [/sk-(proj|svcacct|admin)-[0-9A-Za-z_-]{20,}|sk-[0-9A-Za-z]{48}\b/, "An OpenAI API key", "Anyone can run up your OpenAI bill."],
+  [/sk-ant-[0-9A-Za-z_-]{20,}/, "An Anthropic API key", "Anyone can run up your Anthropic bill."],
+  [/AKIA[0-9A-Z]{16}/, "An AWS access key", "Depending on its rights: your servers, storage and bill."],
+  [/gh[pousr]_[0-9A-Za-z]{30,}|github_pat_[0-9A-Za-z_]{20,}/, "A GitHub token", "Access to your code, and possibly the right to change it."],
+  [/xox[bpas]-[0-9A-Za-z-]{10,}/, "A Slack token", "Anyone can read or post in your Slack."],
+  [/re_[0-9A-Za-z]{8}_[0-9A-Za-z]{20,}/, "A Resend API key", "Anyone can send email as you."],
+  [/SG\.[0-9A-Za-z_-]{20,}\.[0-9A-Za-z_-]{20,}/, "A SendGrid API key", "Anyone can send email as you."],
+  [/AC[0-9a-f]{32}[^0-9a-f][\s\S]{0,80}?[0-9a-f]{32}/, "Twilio credentials", "Anyone can send texts and make calls on your account."],
+  [/gsk_[0-9A-Za-z]{40,}/, "A Groq API key", "Anyone can run up your Groq bill."],
+  [/AIza[0-9A-Za-z_-]{35}(?=[\s\S]{0,400}(generativelanguage|gemini))/, "A Google AI (Gemini) API key", "Anyone can run up your Gemini bill. (Firebase keys are public by design; this one sits next to Gemini calls.)"],
+];
+const JWT = /eyJ[0-9A-Za-z_-]{10,}\.eyJ[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{10,}/g;
+const SUPABASE_URL = /https:\/\/([a-z0-9]{20})\.supabase\.co/;
+
+const decodeJwt = (t) => {
+  try {
+    return JSON.parse(Buffer.from(t.split(".")[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"));
+  } catch {
+    return null;
+  }
+};
+
+async function get(url, { timeout = 15000, headers = {}, method = "GET", max = 8 * 1024 * 1024, fetcher = fetch } = {}) {
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), timeout);
+  try {
+    const r = await fetcher(url, { method, headers: { "user-agent": "crumple-site (+https://crumple.priberry.com)", ...headers }, signal: ctl.signal, redirect: "follow" });
+    const text = method === "HEAD" ? "" : (await r.text()).slice(0, max);
+    return { status: r.status, headers: r.headers, text, url: r.url };
+  } catch (e) {
+    return { status: 0, error: e.name === "AbortError" ? "timed out" : e.message, text: "" };
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+export async function siteScan(target, { mine = false, fetcher = fetch, maxScripts = 40 } = {}) {
+  const fetchOpts = (o = {}) => ({ ...o, fetcher });
+  const url = new URL(/^https?:\/\//.test(target) ? target : `https://${target}`);
+  const findings = [];
+  const add = (severity, where, title, why, fix) => findings.push({ severity, where, title, why, fix });
+
+  const page = await get(url.href, fetchOpts());
+  if (!page.status || page.status >= 400) throw new Error(`could not load ${url.href} (${page.error || page.status})`);
+  const origin = new URL(page.url || url.href).origin;
+
+  // Every script the page loads from its own site, plus the scripts those import.
+  const srcs = new Set();
+  const collect = (html, base) => {
+    for (const m of html.matchAll(/<script[^>]+src=["']([^"']+)["']/gi)) srcs.add(new URL(m[1], base).href);
+    for (const m of html.matchAll(/<link[^>]+href=["']([^"']+\.m?js)["']/gi)) srcs.add(new URL(m[1], base).href);
+  };
+  collect(page.text, origin);
+  const bundles = [{ where: "the page itself", text: page.text }];
+  const seen = new Set();
+  for (let pass = 0; pass < 2; pass++) {
+    for (const src of [...srcs]) {
+      if (seen.has(src) || seen.size >= maxScripts || new URL(src).origin !== origin) continue;
+      seen.add(src);
+      const r = await get(src, fetchOpts());
+      if (r.status !== 200) continue;
+      bundles.push({ where: new URL(src).pathname, text: r.text, url: src });
+      for (const m of r.text.matchAll(/(?:import\(|from\s*)["'](\.{0,2}\/[^"']+\.m?js)["']/g)) srcs.add(new URL(m[1], src).href);
+    }
+  }
+
+  let supabase = null;
+  const keysSeen = new Set();
+  for (const b of bundles) {
+    for (const [re, title, why] of SECRETS) {
+      const m = b.text.match(re);
+      if (m && !keysSeen.has(m[0])) {
+        keysSeen.add(m[0]);
+        add("critical", b.where, `${title} is in code every visitor downloads`, `${why} Found: ${m[0].slice(0, 8)}…`, "Revoke this key now, make a new one, and call that service only from your backend (an edge function or server route), never from the browser.");
+      }
+    }
+    for (const t of b.text.match(JWT) || []) {
+      const p = decodeJwt(t);
+      if (!p) continue;
+      if (p.role === "service_role" && !keysSeen.has(t)) {
+        keysSeen.add(t);
+        add("critical", b.where, "Your Supabase service_role key is in the browser code", "This key skips every security rule: anyone can read, change and delete all of your data and users.", "Rotate it in Supabase (Settings → API) and use it only on a server. The browser should only ever have the anon key.");
+      }
+      if (p.role === "anon" && p.iss === "supabase") supabase = { ...(supabase || {}), anon: t, ref: p.ref };
+    }
+    const su = b.text.match(SUPABASE_URL);
+    if (su) supabase = { ...(supabase || {}), url: su[0], ref: supabase?.ref || su[1] };
+    if (b.url && /sourceMappingURL=([^\s'"]+\.map)/.test(b.text)) {
+      const mapUrl = new URL(b.text.match(/sourceMappingURL=([^\s'"]+\.map)/)[1], b.url).href;
+      const r = await get(mapUrl, fetchOpts({ method: "HEAD" }));
+      if (r.status === 200 && !findings.some((f) => f.title.startsWith("Source maps")))
+        add("medium", new URL(mapUrl).pathname, "Source maps are public", "Anyone can read your app's original source code, including comments and any logic you assumed was hidden.", "Turn off source maps in production builds (for Vite: build.sourcemap = false).");
+    }
+  }
+
+  // Supabase: with the public anon key, which tables can anyone read?
+  let tables = null;
+  if (supabase?.url && supabase.anon) {
+    if (!mine) {
+      add("low", "Supabase", "Database checks skipped", "This app uses Supabase. Crumple can check which tables anyone on the internet can read, but only for an app you own.", `Run \`npx crumplelab site ${url.host} --mine\` if this is your app.`);
+    } else {
+      const h = { apikey: supabase.anon, authorization: `Bearer ${supabase.anon}` };
+      const api = await get(`${supabase.url}/rest/v1/`, fetchOpts({ headers: h }));
+      let names = [];
+      try {
+        names = Object.keys(JSON.parse(api.text).paths || {}).map((p) => p.slice(1)).filter((p) => p && !p.startsWith("rpc/"));
+      } catch {}
+      tables = [];
+      for (const t of names.slice(0, 60)) {
+        // A HEAD request with count=exact returns how many rows are visible, and no rows.
+        const r = await get(`${supabase.url}/rest/v1/${encodeURIComponent(t)}?select=*`, fetchOpts({ method: "HEAD", headers: { ...h, prefer: "count=exact", range: "0-0" } }));
+        const n = Number((r.headers?.get("content-range") || "").split("/")[1]);
+        if (r.status < 300 && n > 0) tables.push({ table: t, rows: n });
+      }
+      for (const { table, rows } of tables) {
+        const personal = /user|profile|customer|account|order|payment|message|contact|lead|email|subscri|invoice/i.test(table);
+        add(personal ? "critical" : "high", `Supabase table "${table}"`, `Anyone on the internet can read ${rows.toLocaleString("en-US")} row${rows > 1 ? "s" : ""} of "${table}"`, "The anon key is public (it ships in your app), so a table without Row Level Security is readable by everyone. This is how most vibe-coded apps have leaked data.", `In Supabase, open Table Editor → ${table} → turn on RLS, then add a policy so people read only their own rows (for example: auth.uid() = user_id).`);
+      }
+    }
+  }
+
+  if (!page.headers?.get("content-security-policy")) add("low", "response headers", "No Content-Security-Policy", "If an attacker gets a script into the page (through a comment, a profile field or a dependency), nothing stops it from sending your users' data out.", "Add a Content-Security-Policy header in your host's settings.");
+
+  const penalty = findings.reduce((a, f) => a + SEVERITY[f.severity], 0);
+  const score = Math.max(0, 100 - penalty);
+  const grade = score >= 90 ? "A" : score >= 75 ? "B" : score >= 60 ? "C" : score >= 40 ? "D" : "F";
+  const order = ["critical", "high", "medium", "low"];
+  findings.sort((a, b) => order.indexOf(a.severity) - order.indexOf(b.severity));
+  return { url: origin, score, grade, scripts: bundles.length - 1, supabase: supabase ? { project: supabase.ref, checked: mine, readable: tables } : null, findings };
+}