crumplelab 0.2.4 → 0.3.1

package/.claude-plugin/plugin.json

@@ -1,10 +1,19 @@
 {
   "name": "crumple",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "description": "Find out whether your AI coding agent can be hijacked, and harden it. Local scan, no key, nothing leaves the machine.",
-  "author": { "name": "Priberry", "email": "crumple@priberry.com", "url": "https://priberry.com" },
+  "author": {
+    "name": "Priberry",
+    "email": "crumple@priberry.com",
+    "url": "https://priberry.com"
+  },
   "homepage": "https://crumple.priberry.com",
   "repository": "https://github.com/priberry-data/crumplelab",
   "license": "Apache-2.0",
-  "keywords": ["security", "prompt-injection", "mcp", "agents"]
+  "keywords": [
+    "security",
+    "prompt-injection",
+    "mcp",
+    "agents"
+  ]
 }

package/.mcp.json

@@ -1,5 +1,5 @@
 {
   "mcpServers": {
-    "crumple": { "command": "npx", "args": ["-y", "crumplelab", "mcp"] }
+    "crumple": { "command": "node", "args": ["${CLAUDE_PLUGIN_ROOT}/bin/crumple.mjs", "mcp"] }
   }
 }

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.3.1
+
+- `crumple site` is now a grade anyone can finish without reading code. Each finding says why it matters in
+  plain words, what to do by hand first (like revoking a leaked key), and gives a fix prompt to paste into the
+  app builder. It names the builder when it can tell (Lovable, Bolt, Replit, Emergent, Base44, v0).
+- Re-check: run the same command again and it shows the old grade, the new one, and what got fixed. Only ids,
+  titles and scores are kept, in `~/.crumple/sites`; never keys or data.
+- `--prompt N` prints one fix prompt on its own, ready for the clipboard.
+- `--mine` now checks Firebase too: whether the Realtime Database is open (top-level names only, counted and
+  dropped) and whether common Firestore collections are readable (one document name, no fields).
+- A table anyone can read is critical when it holds people (users, profiles, orders, messages); otherwise it is
+  medium, with a prompt that keeps a public list readable but locks writes.
+- Supabase's newer `sb_publishable_` keys are recognised. A CSP set in a `<meta>` tag counts.
+- `scan` flags a pre-approved code-running MCP tool (`execute`, `run_code`, `execute_sql` and the like). With
+  "code mode" servers, one such tool reaches a whole API, so approving it approves everything its token can do.
+- The `crumple_site` MCP tool returns the prompts, and `change` on a second call in the same session.
+
+## 0.3.0
+
+- `crumple site <url>`: checks a deployed app (Lovable, Bolt, v0, Replit, Emergent or hand-built) for secret keys
+  in its JavaScript, a Supabase `service_role` key in the browser, public source maps and a missing CSP. With
+  `--mine` it also counts which Supabase tables anyone can read, using `HEAD` requests that return no rows.
+- `crumple setup`: adds Crumple's MCP server to every AI coding app found (Claude Code, Claude Desktop, Cursor,
+  VS Code, Windsurf, Codex, Gemini CLI, Kiro, opencode, Amazon Q, LM Studio, Cline, Roo Code, Kilo Code), pinned
+  to the exact version, with backups and `--undo`.
+- `scan` reads more setups: Claude Desktop, VS Code's user `mcp.json`, Kiro, Roo Code, Cline and Kilo Code
+  settings, Zed, opencode, Amazon Q and Continue, config files with comments, and the rules folders
+  `.windsurf/rules`, `.kiro/steering`, `.roo/rules`, `.clinerules/`, `.github/instructions` and more.
+- `crumple_site` in the MCP server, and a Gemini CLI extension.
+- The Claude Code plugin now runs its own bundled code for the MCP server instead of an unpinned `npx crumplelab`,
+  which Crumple's own scan rightly flagged.
+- `--version`, and a clear message for options Crumple doesn't know.
+
 ## 0.2.4
 
 - **Fix:** `crumple scan` flagged every tracked file as "a .env file is committed to git" in any repo without a

package/README.md

@@ -2,7 +2,7 @@
 
 # Crumple: crash-test your AI coding agent
 
-> **Version 0.2.** Needs Node 20+ and Docker (`scan` needs neither). So far Crumple's scores are
+> **Version 0.3.** Needs Node 20+ and Docker (`scan`, `site` and `setup` need neither). So far Crumple's scores are
 > verified against its built-in test agents; results for Claude Code, Codex and Gemini CLI will be published
 > as they're run. Website: [crumple.priberry.com](https://crumple.priberry.com) · contact: crumple@priberry.com
 
@@ -13,12 +13,17 @@ Your AI agent can read your `.env`, run shell commands and touch your databases.
 npx crumplelab scan      # 5 seconds, no API key, nothing leaves your machine
 npx crumplelab attack    # the real crash test, in a throwaway container
 npx crumplelab fix       # harden it, then attack again to prove it
+npx crumplelab site myapp.lovable.app   # built your app with an AI app builder? check what it leaks
 ```
 
 `scan` audits your agent setup the way an attacker would read it: skip-permissions modes, pre-approved
 commands that can run anything, MCP servers on `@latest` or with keys in plain text, invisible characters in
 `CLAUDE.md` and `.cursorrules`, repo hooks and auto-run tasks, base-URL redirects, committed `.env` files.
-It prints a Safe Setup score, writes SARIF for GitHub code scanning, and fails CI with `--fail-on high`.
+It reads the setups of Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, Windsurf, VS Code (project
+and user `mcp.json`), Kiro, Cline, Roo Code, Kilo Code, Zed, opencode, Amazon Q and Continue, and the rules
+files and folders they all read (`CLAUDE.md`, `AGENTS.md`, `.cursor/rules`, `.windsurf/rules`, `.kiro/steering`,
+`.roo/rules`, `.clinerules`, `.github/instructions` and more). It prints a Safe Setup score, writes SARIF for
+GitHub code scanning, and fails CI with `--fail-on high`.
 
 `attack` builds eighteen booby-trapped projects inside a Docker container, runs **your own** agent setup
 against each one headless, and times how long it takes to fall in. Every trap is drawn from a real CVE,
@@ -67,6 +72,36 @@ Score: 0/18 traps survived
 
 You get a card to share, a badge for your README, and a fix for every failed trap.
 
+## Check a deployed app
+
+Built your app with Lovable, Bolt, v0, Replit, Emergent or any other AI app builder? The mistakes they ship
+most often are visible to anyone who opens the site.
+
+```bash
+npx crumplelab site myapp.lovable.app          # what every visitor can see
+npx crumplelab site myapp.lovable.app --mine   # also: which Supabase tables or Firebase data anyone can read
+npx crumplelab site myapp.lovable.app --prompt 1 | pbcopy   # copy fix prompt 1
+```
+
+You get a grade from A to F and, for each problem, what it means in plain words, what to do by hand first
+(revoking a leaked key is something no AI builder can do for you), and a prompt to paste into Lovable, Bolt,
+Replit or whichever tool built the app. Run the same command again after the fix is live: it shows the old
+grade, the new one, and what got fixed.
+
+`site` reads the page and the JavaScript it serves, the way a curious stranger would, and looks for:
+
+- secret keys in code every visitor downloads (Stripe, OpenAI, Anthropic, AWS, GitHub, Slack, Resend,
+  SendGrid, Twilio, Groq, Gemini)
+- a Supabase `service_role` key in the browser, which skips every security rule
+- public source maps, which hand out your whole source code
+- no Content-Security-Policy
+
+With `--mine`, for an app you own, it takes the public Supabase anon key the app already ships and asks the
+database which tables anyone can read. It sends `HEAD` requests with `count=exact`, so Postgres returns a row
+count and never a row. For Firebase it checks whether the Realtime Database is open (top-level names only) and
+whether common Firestore collections are readable (one document name, no fields). Tables of people (users, profiles, orders, messages) are marked critical, and each
+finding says which switch to flip in Supabase.
+
 ## Fix it
 
 ```bash
@@ -134,13 +169,24 @@ invisible text in `CLAUDE.md`, a changed MCP tool) fail, and findings appear in
 
 ## In your agent
 
+One command adds Crumple to every AI coding app it finds: Claude Code, Claude Desktop, Cursor, VS Code,
+Windsurf, Codex, Gemini CLI, Kiro, opencode, Amazon Q, LM Studio, and Cline, Roo Code and Kilo Code. The
+entry is pinned to the exact version, each file is backed up first, and `--undo` removes it.
+
+```bash
+npx crumplelab setup
+```
+
+Or one app at a time:
+
 - **Claude Code plugin:** `/plugin marketplace add priberry-data/crumplelab`, then `/plugin install crumple@priberry`
   (or in one step: `/plugin install crumple --marketplace priberry-data/crumplelab`). Adds the skill and the MCP server;
   ask "is my agent setup safe?"
+- **Gemini CLI extension:** `gemini extensions install https://github.com/priberry-data/crumplelab`
 - **Skill (Claude Code or Codex):** copy `skills/crumple` into `~/.claude/skills/` or `~/.codex/skills/`.
-- **MCP server (any agent):** `{"command": "npx", "args": ["-y", "crumplelab", "mcp"]}`. Tools: `crumple_scan`
-  (the setup scan, local and instant) and `crumple_traps`. The full crash test spends API credit, so it stays a
-  command you run on purpose.
+- **Any MCP client:** `{"command": "npx", "args": ["-y", "crumplelab@0.3.1", "mcp"]}`. Tools: `crumple_scan`
+  (the setup scan, local and instant), `crumple_site` (what a deployed app shows every visitor) and
+  `crumple_traps`. The full crash test spends API credit, so it stays a command you run on purpose.
 
 ## Private trap packs
 
@@ -181,8 +227,8 @@ npx crumplelab attack --agent mock-careful
 
 ## Status
 
-v0.2: Claude Code, Codex CLI and Gemini CLI; 18 traps plus packs; `scan`, `fix`, `lock`, the guard and a
-GitHub Action. Not yet run against live models: the traps and checks are verified with scripted agents.
+v0.3: Claude Code, Codex CLI and Gemini CLI; 18 traps plus packs; `scan` across 15 agents and editors, `site`
+for deployed apps, `setup`, `fix`, `lock`, the guard and a GitHub Action. Not yet run against live models: the traps and checks are verified with scripted agents.
 Next: first live runs across vendors, Copilot CLI and Cursor adapters, and a public cross-vendor leaderboard.
 
-Apache-2.0 · Built by [Priberry](https://priberry.com)
+Apache-2.0 · Built by [Priberry](https://priberry.com), who also make [Tare](https://tare.priberry.com).

package/bin/crumple.mjs

@@ -50,6 +50,9 @@ try {
     pack: { type: "string", multiple: true, default: [] },
     help: { type: "boolean", short: "h" },
     version: { type: "boolean", short: "v" },
+    mine: { type: "boolean" },
+    prompt: { type: "string" },
+    undo: { type: "boolean" },
   },
   });
 } catch (e) {
@@ -70,10 +73,11 @@ const crashed = (e) => {
 process.on("uncaughtException", crashed);
 process.on("unhandledRejection", crashed);
 
+const SEVERITY_OF = (s) => ({ critical: 40, high: 15, medium: 5, low: 1 })[s] ?? 0;
 const c = { red: (s) => `\x1b[31m${s}\x1b[0m`, green: (s) => `\x1b[32m${s}\x1b[0m`, yellow: (s) => `\x1b[33m${s}\x1b[0m`, dim: (s) => `\x1b[2m${s}\x1b[0m`, bold: (s) => `\x1b[1m${s}\x1b[0m` };
 
 // The guard speaks JSON to the agent over stdout, so it (and any machine-readable output) never gets the banner.
-if (!["guard", "audit", "mcp"].includes(positionals[0]) && !opt.json) process.stdout.write(banner({ version: VERSION, tagline: "the crash test for AI coding agents" }));
+if (!["guard", "audit", "mcp"].includes(positionals[0]) && !opt.json && !opt.prompt) process.stdout.write(banner({ version: VERSION, tagline: "the crash test for AI coding agents" }));
 
 if (positionals[0] === "mcp") {
   // MCP over stdio: the scan and the trap list, for any agent or editor that speaks MCP.
@@ -126,6 +130,39 @@ if (positionals[0] === "mcp") {
   }
   const failOn = opt["fail-on"];
   if (failOn && result.findings.some((f) => SEVERITY[f.severity] >= SEVERITY[failOn])) process.exitCode = 1;
+} else if (positionals[0] === "setup") {
+  const { setup, renderSetup } = await import("../src/clients.mjs");
+  const rows = setup({ name: "crumple", pkg: "crumplelab", version: VERSION, dryRun: opt["dry-run"], undo: opt.undo, backupDir: path.join(os.homedir(), ".crumplelab", "backups") });
+  console.log(renderSetup(rows, { name: "Crumple", undo: opt.undo, dryRun: opt["dry-run"], color: Boolean(process.stdout.isTTY && !process.env.NO_COLOR) }));
+} else if (positionals[0] === "site") {
+  if (!positionals[1]) {
+    console.error("Usage: npx crumplelab site <url> [--mine] [--prompt N] [--json]   checks a deployed app (Lovable, Bolt, v0, Replit, Emergent, any site)");
+    process.exit(2);
+  }
+  const { siteScan, loadLast, saveRun, compare, renderSite } = await import("../src/site.mjs");
+  const run = () => siteScan(positionals[1], { mine: opt.mine });
+  let result;
+  try {
+    result = opt.json || opt.prompt ? await run() : await spin(`looking at ${positionals[1]} the way a stranger would`, run);
+  } catch (e) {
+    console.error(c.red(`crumple: ${e.message}`));
+    process.exit(1);
+  }
+  if (opt.prompt) {
+    // Just one fix prompt, plain, so it can go straight to the clipboard.
+    const p = result.findings.filter((f) => f.prompt)[Number(opt.prompt) - 1];
+    if (!p) {
+      console.error(`crumple: there is no fix prompt ${opt.prompt}; this check has ${result.findings.filter((f) => f.prompt).length}.`);
+      process.exit(2);
+    }
+    console.log(p.prompt);
+  } else {
+    const change = compare(loadLast(result.url, result.mine), result);
+    saveRun(result);
+    if (opt.json) console.log(JSON.stringify({ ...result, change }, null, 2));
+    else console.log(renderSite(result, change, { color: Boolean(process.stdout.isTTY && !process.env.NO_COLOR) }));
+  }
+  if (opt["fail-on"] && result.findings.some((f) => SEVERITY_OF(f.severity) >= SEVERITY_OF(opt["fail-on"]))) process.exitCode = 1;
 } else if (positionals[0] === "lock") {
   const { snapshot, diff, LOCK_PATH } = await import("../src/lock.mjs");
   const file = LOCK_PATH(process.cwd());
@@ -169,6 +206,8 @@ if (positionals[0] === "mcp") {
   if (opt.help || positionals[0] !== "attack") {
     console.log(`Usage: crumple attack [options]
        crumple scan [--sarif f] [--fail-on high]   instant local audit of your agent setup (no key, no Docker)
+       crumple setup [--dry-run] [--undo]       add Crumple to every AI coding app here (Cursor, VS Code, Windsurf, Claude, Codex, Gemini CLI, Cline, Kiro…)
+       crumple site <url> [--mine] [--prompt N]  grade a deployed app (Lovable, Bolt, v0, Replit, Emergent, any site): leaked keys, open data, fix prompts
        crumple fix [--sandbox] [--managed] [--dry-run]   harden this project's agent setup, then attack again
        crumple lock [--check]                      pin your MCP servers' tools; report any that change
        crumple list [--pack dir]                   every trap, its source and the standards it maps to

package/gemini-extension.json

@@ -0,0 +1,15 @@
+{
+  "name": "crumple",
+  "version": "0.3.1",
+  "description": "Audit AI coding agent setups and deployed apps for leaked keys, open data and risky config.",
+  "mcpServers": {
+    "crumple": {
+      "command": "node",
+      "args": [
+        "${extensionPath}/bin/crumple.mjs",
+        "mcp"
+      ],
+      "cwd": "${extensionPath}"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crumplelab",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "description": "Crash-test your AI coding agent setup against prompt injection, secret leaks, malicious MCP tools and destructive actions.",
   "type": "module",
   "bin": {
@@ -20,7 +20,9 @@
     "LICENSE",
     "skills",
     ".claude-plugin",
-    ".mcp.json"
+    ".mcp.json",
+    "server.json",
+    "gemini-extension.json"
   ],
   "engines": {
     "node": ">=20"
@@ -49,5 +51,6 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/priberry-data/crumplelab.git"
-  }
+  },
+  "mcpName": "io.github.priberry-data/crumplelab"
 }

package/server.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.priberry-data/crumplelab",
+  "title": "Crumple",
+  "description": "Audit AI coding agent setups and deployed apps for leaked keys, open data and risky config.",
+  "websiteUrl": "https://crumple.priberry.com",
+  "repository": {
+    "url": "https://github.com/priberry-data/crumplelab",
+    "source": "github"
+  },
+  "version": "0.3.1",
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "crumplelab",
+      "version": "0.3.1",
+      "transport": {
+        "type": "stdio"
+      },
+      "packageArguments": [
+        {
+          "type": "positional",
+          "value": "mcp"
+        }
+      ]
+    }
+  ]
+}

package/src/clients.mjs

@@ -0,0 +1,176 @@
+// `setup`: add this tool's MCP server to every AI coding app found on the machine, in each app's own
+// config format, pinned to the exact version (an unpinned `npx` server runs whatever is published
+// next). Each file is backed up first, nothing else in it changes, and `--undo` removes only our entry.
+// A file that isn't plain JSON (comments, say) is never rewritten; we print what to add instead.
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+
+const appSupport = (home) =>
+  process.platform === "darwin" ? path.join(home, "Library", "Application Support") : process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : path.join(home, ".config");
+
+// Every app we know how to configure: where it keeps MCP servers, and in which shape.
+export function clients(home = os.homedir()) {
+  const app = appSupport(home);
+  const list = [
+    { name: "Claude Desktop", file: path.join(app, "Claude", "claude_desktop_config.json"), shape: "mcpServers", when: path.join(app, "Claude") },
+    { name: "Cursor", file: path.join(home, ".cursor", "mcp.json"), shape: "mcpServers", when: path.join(home, ".cursor") },
+    { name: "Windsurf", file: path.join(home, ".codeium", "windsurf", "mcp_config.json"), shape: "mcpServers", when: path.join(home, ".codeium", "windsurf") },
+    { name: "VS Code", file: path.join(app, "Code", "User", "mcp.json"), shape: "vscode", when: path.join(app, "Code", "User") },
+    { name: "VS Code Insiders", file: path.join(app, "Code - Insiders", "User", "mcp.json"), shape: "vscode", when: path.join(app, "Code - Insiders", "User") },
+    { name: "Gemini CLI", file: path.join(home, ".gemini", "settings.json"), shape: "mcpServers", when: path.join(home, ".gemini") },
+    { name: "Codex", file: path.join(process.env.CODEX_HOME && home === os.homedir() ? process.env.CODEX_HOME : path.join(home, ".codex"), "config.toml"), shape: "toml", when: path.join(home, ".codex") },
+    { name: "Kiro", file: path.join(home, ".kiro", "settings", "mcp.json"), shape: "mcpServers", when: path.join(home, ".kiro") },
+    { name: "opencode", file: path.join(home, ".config", "opencode", "opencode.json"), shape: "opencode", when: path.join(home, ".config", "opencode") },
+    { name: "Amazon Q", file: path.join(home, ".aws", "amazonq", "mcp.json"), shape: "mcpServers", when: path.join(home, ".aws", "amazonq") },
+    { name: "LM Studio", file: path.join(home, ".lmstudio", "mcp.json"), shape: "mcpServers", when: path.join(home, ".lmstudio") },
+  ];
+  // Cline, Roo Code and Kilo Code keep their own list inside each editor they're installed in.
+  for (const ed of ["Code", "Cursor", "Windsurf", "VSCodium", "Trae", "Kiro"])
+    for (const [ext, nm, f] of [
+      ["saoudrizwan.claude-dev", "Cline", "cline_mcp_settings.json"],
+      ["rooveterinaryinc.roo-cline", "Roo Code", "mcp_settings.json"],
+      ["kilocode.kilo-code", "Kilo Code", "mcp_settings.json"],
+    ]) {
+      const dir = path.join(app, ed, "User", "globalStorage", ext);
+      list.push({ name: ed === "Code" ? nm : `${nm} in ${ed}`, file: path.join(dir, "settings", f), shape: "mcpServers", when: dir });
+    }
+  return list;
+}
+
+function entry(shape, command, args) {
+  if (shape === "vscode") return { type: "stdio", command, args };
+  if (shape === "opencode") return { type: "local", command: [command, ...args], enabled: true };
+  return { command, args };
+}
+const key = (shape) => (shape === "vscode" ? "servers" : shape === "opencode" ? "mcp" : "mcpServers");
+
+function backup(file, dir) {
+  if (!fs.existsSync(file)) return;
+  fs.mkdirSync(dir, { recursive: true });
+  fs.copyFileSync(file, path.join(dir, `${Date.now()}-${file.replace(/[^\w.-]+/g, "_").slice(-120)}`));
+}
+
+function writeJson(file, obj) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.tmp-${process.pid}`;
+  fs.writeFileSync(tmp, JSON.stringify(obj, null, 2) + "\n");
+  fs.renameSync(tmp, file);
+}
+
+function tomlBlock(name, command, args) {
+  return `\n[mcp_servers.${name}]\ncommand = ${JSON.stringify(command)}\nargs = [${args.map((a) => JSON.stringify(a)).join(", ")}]\n`;
+}
+const TOML_RE = (name) => new RegExp(`\\n?\\[mcp_servers\\.${name}\\]\\n(?:(?!\\[)[^\\n]*\\n?)*`, "g");
+
+// Returns one line per app: added, updated, already there, removed, skipped (with why), or not installed.
+export function setup({ name, pkg, version, home = os.homedir(), dryRun = false, undo = false, backupDir, claudeCli = true }) {
+  const command = "npx";
+  const args = ["-y", `${pkg}@${version}`, "mcp"];
+  const out = [];
+  for (const c of clients(home)) {
+    if (!fs.existsSync(c.when)) continue;
+    const rec = (status, note) => out.push({ client: c.name, file: c.file, status, note });
+    try {
+      if (c.shape === "toml") {
+        const t = fs.existsSync(c.file) ? fs.readFileSync(c.file, "utf8") : "";
+        const has = TOML_RE(name).test(t);
+        if (undo) {
+          if (!has) continue;
+          if (!dryRun) (backup(c.file, backupDir), fs.writeFileSync(c.file, t.replace(TOML_RE(name), "\n")));
+          rec("removed");
+          continue;
+        }
+        const block = tomlBlock(name, command, args);
+        if (t.includes(block.trim())) {
+          rec("already there");
+          continue;
+        }
+        if (!dryRun) {
+          backup(c.file, backupDir);
+          fs.mkdirSync(path.dirname(c.file), { recursive: true });
+          fs.writeFileSync(c.file, (has ? t.replace(TOML_RE(name), "\n") : t).replace(/\n*$/, "\n") + block);
+        }
+        rec(has ? "updated" : "added");
+        continue;
+      }
+      let cfg = {};
+      if (fs.existsSync(c.file)) {
+        const text = fs.readFileSync(c.file, "utf8");
+        if (text.trim()) {
+          try {
+            cfg = JSON.parse(text);
+          } catch {
+            rec("skipped", `has comments or isn't plain JSON; add under "${key(c.shape)}": ${JSON.stringify({ [name]: entry(c.shape, command, args) })}`);
+            continue;
+          }
+        }
+      }
+      const k = key(c.shape);
+      const cur = cfg[k]?.[name];
+      if (undo) {
+        if (!cur) continue;
+        delete cfg[k][name];
+        if (!dryRun) (backup(c.file, backupDir), writeJson(c.file, cfg));
+        rec("removed");
+        continue;
+      }
+      const want = entry(c.shape, command, args);
+      if (cur && JSON.stringify(cur) === JSON.stringify({ ...cur, ...want })) {
+        rec("already there");
+        continue;
+      }
+      cfg[k] = { ...(cfg[k] || {}), [name]: { ...(cur || {}), ...want } };
+      if (!dryRun) (backup(c.file, backupDir), writeJson(c.file, cfg));
+      rec(cur ? "updated" : "added");
+    } catch (e) {
+      rec("skipped", e.message);
+    }
+  }
+  // Claude Code keeps MCP servers in a large file it rewrites often, so go through its own CLI.
+  if (claudeCli && fs.existsSync(path.join(home, ".claude"))) {
+    // Run from the home folder so a project's own .mcp.json isn't mistaken for the user's entry.
+    const run = (a) => execFileSync("claude", a, { cwd: home, stdio: ["ignore", "pipe", "pipe"], timeout: 20000 }).toString();
+    let current = null;
+    try {
+      const got = run(["mcp", "get", name]); // fails when there is no such server
+      if (/Scope:\s*User/i.test(got)) current = got;
+    } catch {}
+    try {
+      const has = current != null;
+      if (undo) {
+        if (has && !dryRun) run(["mcp", "remove", "-s", "user", name]);
+        if (has) out.push({ client: "Claude Code", file: "claude mcp", status: "removed" });
+      } else if (has && current.includes(`${pkg}@${version}`)) out.push({ client: "Claude Code", file: "claude mcp", status: "already there" });
+      else {
+        if (!dryRun) {
+          if (has) run(["mcp", "remove", "-s", "user", name]);
+          run(["mcp", "add", "-s", "user", name, "--", command, ...args]);
+        }
+        out.push({ client: "Claude Code", file: "claude mcp", status: has ? "updated" : "added" });
+      }
+    } catch {
+      if (!undo) out.push({ client: "Claude Code", file: "claude mcp", status: "skipped", note: `run: claude mcp add -s user ${name} -- ${command} ${args.join(" ")}` });
+    }
+  }
+  return out;
+}
+
+export function renderSetup(rows, { name, undo, dryRun, color = true }) {
+  const c = (code) => (s) => (color ? `\x1b[${code}m${s}\x1b[0m` : s);
+  const green = c("32"), dim = c("2"), yellow = c("33");
+  const L = [];
+  if (!rows.length) {
+    L.push(undo ? `  ${name} isn't set up in any app on this machine.` : "  No supported AI coding app found on this machine.");
+    return L.join("\n");
+  }
+  for (const r of rows) {
+    const mark = r.status === "skipped" ? yellow("!") : r.status === "already there" ? dim("·") : green("✓");
+    const status = dryRun && /added|updated|removed/.test(r.status) ? `would be ${r.status}` : r.status;
+    L.push(`  ${mark} ${r.client.padEnd(22)} ${status}${r.note ? dim(`  ${r.note}`) : ""}`);
+  }
+  if (dryRun) L.push(dim("\n  Dry run: nothing was written."));
+  else if (!undo && rows.some((r) => /added|updated/.test(r.status))) L.push(dim(`\n  Restart those apps to load it. Ask your agent to use ${name}. Undo any time with --undo.`));
+  return L.join("\n");
+}

package/src/mcp.mjs

@@ -13,6 +13,12 @@ const TOOLS = [
     inputSchema: { type: "object", properties: { path: { type: "string", description: "Project folder to scan. Defaults to the server's working directory." } }, additionalProperties: false },
     annotations: { readOnlyHint: true },
   },
+  {
+    name: "crumple_site",
+    description: "Grade a deployed web app (built with Lovable, Bolt, v0, Replit, Emergent or by hand) A to F for what a stranger can use against it: secret keys shipped in its JavaScript, a Supabase service_role key in the browser, public source maps, no Content-Security-Policy. Each finding has a plain-English reason, what the owner must do by hand (like revoking a key), and a fix `prompt` to apply in the app's code. Call it again after fixing: `change` lists what got fixed. Reads only what the site serves to every visitor. Database checks (which Supabase tables or Firebase data anyone can read) need the owner, so tell them to run `npx crumplelab site <url> --mine` themselves.",
+    inputSchema: { type: "object", properties: { url: { type: "string", description: "The app's address, for example myapp.lovable.app" } }, required: ["url"], additionalProperties: false },
+    annotations: { readOnlyHint: true, openWorldHint: true },
+  },
   {
     name: "crumple_traps",
     description: "The traps Crumple's crash test runs: each modelled on a real attack (poisoned issues, evil MCP servers, secret exfiltration, destructive commands), with its risk.",
@@ -21,11 +27,21 @@ const TOOLS = [
   },
 ];
 
-function call(name, args = {}) {
+const lastSite = new Map();
+
+async function call(name, args = {}) {
   if (name === "crumple_scan") {
     const dir = path.resolve(args.path || process.cwd());
     return { project: dir, ...scan(dir), next: "Run `npx crumplelab fix` to harden, then `npx crumplelab attack` to prove it (needs Docker and an API key)." };
   }
+  if (name === "crumple_site") {
+    const { siteScan, compare } = await import("./site.mjs");
+    const result = await siteScan(args.url, { mine: false });
+    // Remembered for this session only, so a second call shows what the fixes changed.
+    const change = compare(lastSite.get(result.url), result);
+    lastSite.set(result.url, { at: new Date().toISOString(), score: result.score, grade: result.grade, findings: result.findings.map(({ id, severity, title }) => ({ id, severity, title })) });
+    return { ...result, change };
+  }
   if (name === "crumple_traps") return { traps: SCENARIOS.map((s) => ({ id: s.id, title: s.title, risk: s.risk })) };
   throw new Error(`unknown tool ${name}`);
 }
@@ -33,7 +49,12 @@ function call(name, args = {}) {
 export function serve({ version, input = process.stdin, output = process.stdout } = {}) {
   const send = (msg) => output.write(JSON.stringify({ jsonrpc: "2.0", ...msg }) + "\n");
   const rl = readline.createInterface({ input, crlfDelay: Infinity });
+  const pending = new Set();
   rl.on("line", (line) => {
+    const job = handle(line).finally(() => pending.delete(job));
+    pending.add(job);
+  });
+  async function handle(line) {
     let m;
     try {
       m = JSON.parse(line);
@@ -47,13 +68,14 @@ export function serve({ version, input = process.stdin, output = process.stdout
     if (m.method === "tools/list") return send({ id: m.id, result: { tools: TOOLS } });
     if (m.method === "tools/call") {
       try {
-        const r = call(m.params?.name, m.params?.arguments);
+        const r = await call(m.params?.name, m.params?.arguments);
         return send({ id: m.id, result: { content: [{ type: "text", text: JSON.stringify(r, null, 2) }], structuredContent: r } });
       } catch (e) {
         return send({ id: m.id, result: { content: [{ type: "text", text: `crumple: ${e.message}` }], isError: true } });
       }
     }
     send({ id: m.id, error: { code: -32601, message: `method not found: ${m.method}` } });
-  });
-  return new Promise((resolve) => rl.on("close", resolve));
+  }
+  // Let calls still running (a site check takes seconds) answer before the server exits.
+  return new Promise((resolve) => rl.on("close", () => Promise.allSettled([...pending]).then(resolve)));
 }

package/src/scan.mjs

@@ -23,10 +23,36 @@ const json = (p) => {
   if (t == null) return null;
   try {
     return JSON.parse(t);
+  } catch {}
+  try {
+    return JSON.parse(stripJsonc(t)); // VS Code, Zed and others allow comments and trailing commas
   } catch {
     return null;
   }
 };
+// Drops // and /* */ comments and trailing commas, leaving strings alone.
+function stripJsonc(t) {
+  let out = "";
+  for (let i = 0; i < t.length; i++) {
+    const c = t[i];
+    if (c === '"') {
+      let j = i + 1;
+      while (j < t.length && t[j] !== '"') j += t[j] === "\\" ? 2 : 1;
+      out += t.slice(i, j + 1);
+      i = j;
+    } else if (c === "/" && t[i + 1] === "/") while (i < t.length && t[i] !== "\n") i++;
+    else if (c === "/" && t[i + 1] === "*") {
+      i = t.indexOf("*/", i + 2);
+      if (i < 0) break;
+      i++;
+    } else out += c;
+  }
+  return out.replace(/,(\s*[}\]])/g, "$1");
+}
+// Where VS Code-based editors and desktop apps keep their per-user settings.
+const appSupport = (home) =>
+  process.platform === "darwin" ? path.join(home, "Library", "Application Support") : process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : path.join(home, ".config");
+const EDITORS = ["Code", "Code - Insiders", "Cursor", "Windsurf", "VSCodium", "Trae", "Kiro", "Positron", "Void"];
 const redact = (s) => String(s).replace(new RegExp(SECRET_VALUES.source, "g"), (m) => m.slice(0, 4) + "…[redacted]");
 
 export function scan(projectDir, { home = os.homedir() } = {}) {
@@ -51,6 +77,9 @@ export function scan(projectDir, { home = os.homedir() } = {}) {
       // An exact rule only ever approves that one command, so only wildcards can carry your data out.
       else if (/^Bash\((curl|wget|nc|ssh|scp|rsync|http)\b/.test(r) && r.includes("*")) add("high", where, `Network tool pre-approved (${r})`, "This is the exact command attackers use to send your .env out.", `Remove "${r}"; let the agent ask, or allow only fixed URLs.`);
       else if (/^Bash\((git|find|fd|rg|go|xargs|env|sed|awk|tar|npx|npm|pnpm|yarn|node|python3?|bash|sh)(:\*|\s\*|\*)?\)$/.test(r)) add("high", where, `Broad pre-approval that can run any program (${r})`, "Flags like `git -c core.fsmonitor=`, `find -exec`, `npm run` and `npx` turn a \"safe\" prefix into arbitrary code (Trail of Bits, 2025).", `Narrow "${r}" to exact subcommands (for example "Bash(git status)"), and install the Crumple guard, which checks flags.`);
+      // "Code mode" servers (Cloudflare's, and the pattern it started) put a whole API behind one execute tool,
+      // so approving that one tool approves every call the server's credentials allow, in one step.
+      else if (/^mcp__[\w-]+__(execute|exec|eval|run|run_?code|execute_?code|run_?script|run_?js|run_?python|code|code_?mode|execute_?sql|run_?sql|shell)$/i.test(r)) add("high", where, `A code-running MCP tool is pre-approved (${r})`, "This one tool can run any code against the API behind it, so a single injected instruction can make many changes (delete DNS records, wipe a database) with no prompt. Per-tool approvals stop meaning anything.", `Remove "${r}" from the allow list so each run asks you, and give that server a read-only or narrowly scoped token.`);
       // A single MCP tool (mcp__server__tool) is a narrow approval; a whole server or open WebFetch is not.
       else if (/^WebFetch$/.test(r) || (/^mcp__[\w-]+$/.test(r) && r.split("__").length === 2)) add("medium", where, `Pre-approved without limits (${r})`, "Lets content from anywhere drive the agent and receive data without a prompt.", `Scope "${r}" to specific domains or tools.`);
     }
@@ -71,19 +100,38 @@ export function scan(projectDir, { home = os.homedir() } = {}) {
   if (!sandboxed) add("medium", "agent setup", "The agent's commands don't run in a sandbox", "Commands can reach every file you can and any server on the internet. Sandboxes and egress limits are the defenses research shows hold up under adaptive attacks.", "Run `crumple fix --sandbox` to switch on Claude Code's built-in sandbox with a network allowlist.");
 
   // --- MCP servers, across agents -------------------------------------------------------------
-  const mcpFiles = [P(".mcp.json"), H(".claude.json"), P(".cursor/mcp.json"), H(".cursor/mcp.json"), P(".vscode/mcp.json"), H(".codeium/windsurf/mcp_config.json"), H(".gemini/settings.json"), P(".gemini/settings.json")];
-  for (const f of mcpFiles) {
+  const app = appSupport(home);
+  const mcpFiles = [
+    P(".mcp.json"), H(".claude.json"), path.join(app, "Claude", "claude_desktop_config.json"),
+    P(".cursor/mcp.json"), H(".cursor/mcp.json"), P(".vscode/mcp.json"), H(".codeium/windsurf/mcp_config.json"),
+    H(".gemini/settings.json"), P(".gemini/settings.json"), P(".kiro/settings/mcp.json"), H(".kiro/settings/mcp.json"),
+    P(".roo/mcp.json"), H(".aws/amazonq/mcp.json"), P(".amazonq/mcp.json"), P("opencode.json"), H(".config/opencode/opencode.json"),
+    H(".config/zed/settings.json"), P(".zed/settings.json"), P(".continue/config.json"), H(".continue/config.json"),
+    ...EDITORS.flatMap((ed) => [
+      path.join(app, ed, "User", "mcp.json"),
+      path.join(app, ed, "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+      path.join(app, ed, "User", "globalStorage", "rooveterinaryinc.roo-cline", "settings", "mcp_settings.json"),
+      path.join(app, ed, "User", "globalStorage", "kilocode.kilo-code", "settings", "mcp_settings.json"),
+    ]),
+  ];
+  for (const f of [...new Set(mcpFiles)]) {
     const cfg = json(f);
-    const servers = { ...(cfg?.mcpServers ?? {}), ...(cfg?.servers ?? {}) };
+    // Each tool names the block differently: mcpServers (most), servers (VS Code), mcp (opencode), context_servers (Zed).
+    const servers = { ...(cfg?.mcpServers ?? {}), ...(cfg?.servers ?? {}), ...(cfg?.mcp ?? {}), ...(cfg?.context_servers ?? {}) };
+    if (Array.isArray(cfg?.experimental?.modelContextProtocolServers))
+      cfg.experimental.modelContextProtocolServers.forEach((x, i) => (servers[x.name || `server ${i + 1}`] = x.transport || x));
     for (const proj of Object.values(cfg?.projects ?? {})) Object.assign(servers, proj?.mcpServers ?? {});
     for (const [name, srv] of Object.entries(servers)) {
+      if (!srv || typeof srv !== "object") continue;
       const where = `${rel(f)} → ${name}`;
-      const cmd = [srv.command, ...(srv.args ?? [])].join(" ");
+      // opencode gives the command as an array; Zed nests it as { path, args }.
+      const parts = Array.isArray(srv.command) ? srv.command : srv.command?.path ? [srv.command.path, ...(srv.command.args ?? [])] : [srv.command, ...(srv.args ?? [])];
+      const cmd = parts.filter(Boolean).join(" ");
       if (/\b(npx|bunx|pnpm dlx|uvx)\b/.test(cmd)) {
-        const pkg = (srv.args ?? []).find((a) => !String(a).startsWith("-")) ?? "";
+        const pkg = parts.slice(1).find((a) => !String(a).startsWith("-") && !/^(dlx|x)$/.test(a)) ?? "";
         if (!/@\d/.test(pkg.replace(/^@[^/]+\//, "")) || /@latest$/.test(pkg)) add("high", where, `MCP server runs whatever version is newest (${pkg || cmd})`, "If that package is ever compromised or sold, your agent runs the new code with your keys the next time it starts (MCP rug pull).", `Pin an exact version, for example ${pkg.replace(/@latest$/, "")}@1.2.3, and run \`crumple lock\`.`);
       }
-      const blob = JSON.stringify({ env: srv.env, args: srv.args, headers: srv.headers, url: srv.url });
+      const blob = JSON.stringify({ env: srv.env ?? srv.environment, args: parts.slice(1), headers: srv.headers, url: srv.url });
       if (SECRET_VALUES.test(blob) || /"[A-Z_]*(TOKEN|SECRET|KEY|PASSWORD)[A-Z_]*":"[^"$]{12,}"/.test(blob)) add("high", where, "MCP server config holds a secret in plain text", "Any agent or extension that reads this file gets the key.", "Reference an environment variable or keychain entry instead.");
       if (srv.url && /^http:\/\//.test(srv.url) && !/localhost|127\.0\.0\.1/.test(srv.url)) add("medium", where, "Remote MCP server over plain HTTP", "Anyone on the network path can read and change the tools your agent trusts.", "Use https.");
     }
@@ -96,9 +144,12 @@ export function scan(projectDir, { home = os.homedir() } = {}) {
 
   // --- rules files and docs the agent reads -----------------------------------------------------
   const rulesFiles = ["CLAUDE.md", "AGENTS.md", "GEMINI.md", ".cursorrules", ".windsurfrules", ".clinerules", ".github/copilot-instructions.md", "CONTRIBUTING.md", "README.md"].map((f) => P(f));
-  try {
-    for (const f of fs.readdirSync(P(".cursor/rules"))) rulesFiles.push(P(".cursor/rules", f));
-  } catch {}
+  rulesFiles.push(P(".junie/guidelines.md"), P("CONVENTIONS.md"), P(".rules"));
+  // Rules folders: Cursor, Windsurf, Kiro, Roo, Cline (a folder form of .clinerules), Copilot, Amazon Q.
+  for (const d of [".cursor/rules", ".windsurf/rules", ".kiro/steering", ".roo/rules", ".clinerules", ".github/instructions", ".amazonq/rules", ".continue/rules"])
+    try {
+      for (const f of fs.readdirSync(P(d))) rulesFiles.push(P(d, f));
+    } catch {}
   rulesFiles.push(H(".claude/CLAUDE.md"), H(".codex/AGENTS.md"), H(".gemini/GEMINI.md"));
   for (const f of rulesFiles) {
     const t = read(f);

package/src/site.mjs

@@ -0,0 +1,369 @@
+// crumple site <url>: checks a deployed app the way a curious stranger would, for the mistakes that
+// AI app builders (Lovable, Bolt, v0, Replit, Emergent and the rest) ship most often:
+//   - secret keys inside the JavaScript every visitor downloads
+//   - a Supabase or Firebase database that anyone can read with the app's public key (with --mine only)
+//   - source maps that hand out the whole source code
+// Every finding comes with a fix prompt to paste back into the app builder, and running the check again
+// shows what got fixed. It reads only what the site serves to every visitor. The database checks ask for
+// a row count (Supabase) or a single document name (Firebase), never for data, and run only when you say
+// the app is yours.
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { SEVERITY } from "./scan.mjs";
+
+// [pattern, id, what it is, what a stranger can do with it, where to revoke it]
+const SECRETS = [
+  [/sk_live_[0-9A-Za-z]{20,}/, "stripe", "A live Stripe secret key", "Anyone can charge, refund and read your customers' payments.", "Stripe → Developers → API keys → Roll key", "STRIPE_SECRET_KEY"],
+  [/rk_live_[0-9A-Za-z]{20,}/, "stripe-restricted", "A live Stripe restricted key", "Anyone can do whatever this key allows on your Stripe account.", "Stripe → Developers → API keys → delete the restricted key", "STRIPE_RESTRICTED_KEY"],
+  [/sk-(proj|svcacct|admin)-[0-9A-Za-z_-]{20,}|sk-[0-9A-Za-z]{48}\b/, "openai", "An OpenAI API key", "Anyone can run up your OpenAI bill.", "platform.openai.com → API keys → revoke", "OPENAI_API_KEY"],
+  [/sk-ant-[0-9A-Za-z_-]{20,}/, "anthropic", "An Anthropic API key", "Anyone can run up your Anthropic bill.", "console.anthropic.com → API keys → disable", "ANTHROPIC_API_KEY"],
+  [/AKIA[0-9A-Z]{16}/, "aws", "An AWS access key", "Depending on its rights: your servers, storage and bill.", "AWS console → IAM → Users → Security credentials → deactivate the key", "AWS_SECRET_ACCESS_KEY"],
+  [/gh[pousr]_[0-9A-Za-z]{30,}|github_pat_[0-9A-Za-z_]{20,}/, "github", "A GitHub token", "Access to your code, and possibly the right to change it.", "GitHub → Settings → Developer settings → tokens → delete", "GITHUB_TOKEN"],
+  [/xox[bpas]-[0-9A-Za-z-]{10,}/, "slack", "A Slack token", "Anyone can read or post in your Slack.", "api.slack.com/apps → your app → reinstall to get a new token", "SLACK_TOKEN"],
+  [/re_[0-9A-Za-z]{8}_[0-9A-Za-z]{20,}/, "resend", "A Resend API key", "Anyone can send email as you.", "resend.com → API Keys → delete", "RESEND_API_KEY"],
+  [/SG\.[0-9A-Za-z_-]{20,}\.[0-9A-Za-z_-]{20,}/, "sendgrid", "A SendGrid API key", "Anyone can send email as you.", "SendGrid → Settings → API Keys → delete", "SENDGRID_API_KEY"],
+  [/AC[0-9a-f]{32}[^0-9a-f][\s\S]{0,80}?[0-9a-f]{32}/, "twilio", "Twilio credentials", "Anyone can send texts and make calls on your account.", "Twilio console → Account → API keys & tokens → rotate the auth token", "TWILIO_AUTH_TOKEN"],
+  [/gsk_[0-9A-Za-z]{40,}/, "groq", "A Groq API key", "Anyone can run up your Groq bill.", "console.groq.com → API Keys → delete", "GROQ_API_KEY"],
+  [/AIza[0-9A-Za-z_-]{35}(?=[\s\S]{0,400}(generativelanguage|gemini))/, "gemini", "A Google AI (Gemini) API key", "Anyone can run up your Gemini bill. (Firebase keys are public by design; this one sits next to Gemini calls.)", "aistudio.google.com → API keys → delete", "GEMINI_API_KEY"],
+];
+const JWT = /eyJ[0-9A-Za-z_-]{10,}\.eyJ[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{10,}/g;
+const SUPABASE_URL = /https:\/\/([a-z0-9]{20})\.supabase\.co/;
+const FB_PROJECT = /projectId["']?\s*:\s*["']([a-z0-9-]{4,40})["']/;
+const FB_DB = /["'](https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:firebaseio\.com|firebasedatabase\.app))\/?["']/;
+const FB_KEY = /apiKey["']?\s*:\s*["'](AIza[0-9A-Za-z_-]{35})["']/;
+// Firestore can't list its collections without admin rights, so try the names apps use for people and money.
+const FIRESTORE_GUESSES = ["users", "profiles", "customers", "accounts", "orders", "payments", "messages", "chats", "leads", "contacts", "posts"];
+const PERSONAL = /user|profile|customer|account|order|payment|message|chat|contact|lead|email|subscri|invoice/i;
+
+// Which app builder made this, so the fix prompt can say where to paste it.
+export function detectBuilder(host, html = "") {
+  const h = host.toLowerCase();
+  if (/\.lovable\.app$|\.lovableproject\.com$/.test(h) || /lovable-tagger|content=["']Lovable/i.test(html)) return "Lovable";
+  if (/\.bolt\.host$|\.bolt\.new$/.test(h)) return "Bolt";
+  if (/\.replit\.app$|\.repl\.co$|\.replit\.dev$/.test(h)) return "Replit";
+  if (/\.emergent\.host$|\.emergentagent\.com$|\.preview\.emergentagent\.com$/.test(h)) return "Emergent";
+  if (/\.base44\.app$/.test(h)) return "Base44";
+  if (/v0\.dev|v0\.app/.test(h) || /generated by v0/i.test(html)) return "v0";
+  return null;
+}
+
+const decodeJwt = (t) => {
+  try {
+    return JSON.parse(Buffer.from(t.split(".")[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"));
+  } catch {
+    return null;
+  }
+};
+
+async function get(url, { timeout = 15000, headers = {}, method = "GET", max = 8 * 1024 * 1024, fetcher = fetch } = {}) {
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), timeout);
+  try {
+    const r = await fetcher(url, { method, headers: { "user-agent": "crumple-site (+https://crumple.priberry.com)", ...headers }, signal: ctl.signal, redirect: "follow" });
+    const text = method === "HEAD" ? "" : (await r.text()).slice(0, max);
+    return { status: r.status, headers: r.headers, text, url: r.url };
+  } catch (e) {
+    return { status: 0, error: e.name === "AbortError" ? "timed out" : e.message, text: "" };
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+// --- fix prompts ---------------------------------------------------------------------------------
+// Written for someone who can't read the code: what to do by hand first (revoking a key is something
+// no AI builder can do for you), then one prompt to paste into the builder's chat.
+const P = {
+  secret: (label, revoke, env) => ({
+    first: `Revoke the leaked key, because it is already public: ${revoke}. Then make a new one, and give it only to your backend (in Supabase: Edge Functions → Secrets, named ${env}).`,
+    prompt: `My app has ${label.replace(/^A |^An /, "a ")} in its frontend code, so every visitor can download it. Remove that key from every frontend file. Move every call that uses it into a backend function (a Supabase Edge Function, or a server route if this app has a server) that reads the key from the secret ${env}, and have the frontend call that function instead. The function must check that the user is signed in before it does anything, and must never send the key back to the browser. When you're done, list every file you changed and confirm the key appears nowhere in the frontend.`,
+  }),
+  serviceRole: () => ({
+    first: "Rotate the key, because it is already public: Supabase → Project Settings → API → generate new keys (or reset the JWT secret), then update the apps and functions that use them.",
+    prompt: "My app has the Supabase service_role key in its frontend code. That key skips every security rule. Remove it from every frontend file; the browser must only ever use the anon (publishable) key. Anything that really needs admin access goes into a Supabase Edge Function that reads SUPABASE_SERVICE_ROLE_KEY from its environment and checks the signed-in user before acting. Then make sure Row Level Security is on for every table, with policies so users reach only their own rows. List what you changed.",
+  }),
+  rls: (table, personal) => ({
+    first: null,
+    prompt: personal
+      ? `In my Supabase database, anyone on the internet can read the table "${table}" using the public anon key. Turn on Row Level Security for "${table}" and add policies so a signed-in user can read and change only their own rows: compare auth.uid() with the column that stores the owner's user id (if there is no such column, add user_id uuid references auth.users default auth.uid(), and fill it for existing rows). If some rows really must be public, add a separate read-only policy for just those rows and tell me which. Do not turn off any existing policy. Show me the SQL you ran.`
+      : `In my Supabase database, anyone on the internet can read the table "${table}" using the public anon key. First tell me in one sentence whether this app needs strangers to read "${table}" (a public product list or blog does; anything about specific users doesn't). If it should be public: turn on Row Level Security, add a policy that lets everyone read it, and allow insert, update and delete only for signed-in admins or the row's owner, so strangers can look but never change it. If it shouldn't be public: turn on Row Level Security and let a signed-in user reach only their own rows (auth.uid() = user_id). Do not turn off any existing policy. Show me the SQL you ran.`,
+    sql: personal
+      ? `alter table public."${table}" enable row level security;\ncreate policy "own rows" on public."${table}" for all using (auth.uid() = user_id) with check (auth.uid() = user_id);`
+      : `alter table public."${table}" enable row level security;\ncreate policy "anyone can read" on public."${table}" for select using (true);`,
+  }),
+  rtdb: () => ({
+    first: null,
+    prompt: 'Anyone on the internet can read my Firebase Realtime Database. Rewrite the database rules so nothing is readable or writable without signing in, and each user can only reach their own data, for example under /users/$uid with ".read": "auth.uid === $uid" and ".write": "auth.uid === $uid". Keep public only what truly must be public, and tell me which paths those are. Show me the final rules.',
+  }),
+  firestore: (coll) => ({
+    first: null,
+    prompt: `Anyone on the internet can read the Firestore collection "${coll}". Rewrite my Firestore security rules so "${coll}" (and every other collection) is closed by default, and a signed-in user can only read and write documents they own, for example match /${coll}/{id} { allow read, write: if request.auth != null && request.auth.uid == resource.data.userId; }. Adjust the owner field to whatever this app uses. Show me the final rules.`,
+  }),
+  sourceMaps: () => ({
+    first: null,
+    prompt: "My production build publishes source maps, so anyone can read my app's original source code. Turn them off for production builds only (for Vite: build.sourcemap = false in vite.config), rebuild and redeploy. Don't change anything else.",
+  }),
+  csp: (origins) => ({
+    first: null,
+    prompt: `My app has no Content-Security-Policy. Add one as a <meta http-equiv="Content-Security-Policy"> tag in index.html (or as a response header if this host supports headers). Allow scripts, styles and fonts only from my own site and the services this app really uses${origins.length ? `, including ${origins.join(", ")}` : ""}, and allow connect-src for my backend and APIs. Then test every page and fix anything the policy blocks, without loosening it to allow everything.`,
+  }),
+};
+
+// --- the check -----------------------------------------------------------------------------------
+export async function siteScan(target, { mine = false, fetcher = fetch, maxScripts = 40 } = {}) {
+  const fetchOpts = (o = {}) => ({ ...o, fetcher });
+  const url = new URL(/^https?:\/\//.test(target) ? target : `https://${target}`);
+  const findings = [];
+  const add = (f) => findings.push(f);
+
+  const page = await get(url.href, fetchOpts());
+  if (!page.status || page.status >= 400) throw new Error(`could not load ${url.href} (${page.error || page.status})`);
+  const origin = new URL(page.url || url.href).origin;
+  const builder = detectBuilder(new URL(origin).host, page.text);
+
+  // Every script the page loads from its own site, plus the scripts those import.
+  const srcs = new Set();
+  const collect = (html, base) => {
+    for (const m of html.matchAll(/<script[^>]+src=["']([^"']+)["']/gi)) srcs.add(new URL(m[1], base).href);
+    for (const m of html.matchAll(/<link[^>]+href=["']([^"']+\.m?js)["']/gi)) srcs.add(new URL(m[1], base).href);
+  };
+  collect(page.text, origin);
+  const bundles = [{ where: "the page itself", text: page.text }];
+  const seen = new Set();
+  for (let pass = 0; pass < 2; pass++) {
+    for (const src of [...srcs]) {
+      if (seen.has(src) || seen.size >= maxScripts || new URL(src).origin !== origin) continue;
+      seen.add(src);
+      const r = await get(src, fetchOpts());
+      if (r.status !== 200) continue;
+      bundles.push({ where: new URL(src).pathname, text: r.text, url: src });
+      for (const m of r.text.matchAll(/(?:import\(|from\s*)["'](\.{0,2}\/[^"']+\.m?js)["']/g)) srcs.add(new URL(m[1], src).href);
+    }
+  }
+
+  let supabase = null;
+  let firebase = null;
+  const keysSeen = new Set();
+  const thirdParty = new Set();
+  for (const b of bundles) {
+    for (const m of b.text.matchAll(/https:\/\/([a-z0-9-]+\.)+[a-z]{2,}/gi)) {
+      const o = new URL(m[0]).origin;
+      if (o !== origin && /supabase\.co|firebase|googleapis|stripe\.com|clerk|posthog|sentry|vercel/.test(o)) thirdParty.add(o.replace(/^https:\/\/[a-z0-9]{20}\.supabase\.co$/, "https://*.supabase.co"));
+    }
+    for (const [re, id, title, why, revoke, env] of SECRETS) {
+      const m = b.text.match(re);
+      if (m && !keysSeen.has(m[0])) {
+        keysSeen.add(m[0]);
+        add({ id: `secret:${id}`, severity: "critical", where: b.where, title: `${title} is in code every visitor downloads`, why: `${why} Found: ${m[0].slice(0, 8)}…`, fix: "Revoke this key now, make a new one, and call that service only from your backend (an edge function or server route), never from the browser.", ...P.secret(title, revoke, env) });
+      }
+    }
+    for (const t of b.text.match(JWT) || []) {
+      const p = decodeJwt(t);
+      if (!p) continue;
+      if (p.role === "service_role" && !keysSeen.has(t)) {
+        keysSeen.add(t);
+        add({ id: "supabase:service_role", severity: "critical", where: b.where, title: "Your Supabase service_role key is in the browser code", why: "This key skips every security rule: anyone can read, change and delete all of your data and users.", fix: "Rotate it in Supabase (Settings → API) and use it only on a server. The browser should only ever have the anon key.", ...P.serviceRole() });
+      }
+      if (p.role === "anon" && p.iss === "supabase") supabase = { ...(supabase || {}), anon: t, ref: p.ref };
+    }
+    const pk = b.text.match(/sb_publishable_[0-9A-Za-z_-]{20,}/);
+    if (pk) supabase = { ...(supabase || {}), anon: supabase?.anon || pk[0] };
+    const su = b.text.match(SUPABASE_URL);
+    if (su) supabase = { ...(supabase || {}), url: su[0], ref: supabase?.ref || su[1] };
+    const fp = b.text.match(FB_PROJECT);
+    if (fp && /firebase/i.test(b.text)) {
+      firebase = { ...(firebase || {}), project: fp[1] };
+      const db = b.text.match(FB_DB);
+      if (db) firebase.db = db[1];
+      const k = b.text.match(FB_KEY);
+      if (k) firebase.key = k[1];
+    }
+    if (b.url && /sourceMappingURL=([^\s'"]+\.map)/.test(b.text)) {
+      const mapUrl = new URL(b.text.match(/sourceMappingURL=([^\s'"]+\.map)/)[1], b.url).href;
+      const r = await get(mapUrl, fetchOpts({ method: "HEAD" }));
+      if (r.status === 200 && !findings.some((f) => f.id === "sourcemaps"))
+        add({ id: "sourcemaps", severity: "medium", where: new URL(mapUrl).pathname, title: "Source maps are public", why: "Anyone can read your app's original source code, including comments and any logic you assumed was hidden.", fix: "Turn off source maps in production builds (for Vite: build.sourcemap = false).", ...P.sourceMaps() });
+    }
+  }
+
+  const database = supabase?.url && supabase.anon ? "Supabase" : firebase?.project ? "Firebase" : null;
+  if (database && !mine)
+    add({ id: "db:skipped", severity: "low", where: database, title: "Database checks skipped", why: `This app uses ${database}. Crumple can check which of its data anyone on the internet can read, but only for an app you own.`, fix: `Run \`npx crumplelab site ${url.host} --mine\` if this is your app.`, first: null, prompt: null });
+
+  // Supabase: with the public anon key, which tables can anyone read?
+  let tables = null;
+  if (mine && supabase?.url && supabase.anon) {
+    // The newer sb_publishable_ keys aren't JWTs and go in the apikey header only.
+    const h = { apikey: supabase.anon, ...(supabase.anon.startsWith("eyJ") && { authorization: `Bearer ${supabase.anon}` }) };
+    const api = await get(`${supabase.url}/rest/v1/`, fetchOpts({ headers: h }));
+    let names = [];
+    try {
+      names = Object.keys(JSON.parse(api.text).paths || {}).map((p) => p.slice(1)).filter((p) => p && !p.startsWith("rpc/"));
+    } catch {}
+    tables = [];
+    for (const t of names.slice(0, 60)) {
+      // A HEAD request with count=exact returns how many rows are visible, and no rows.
+      const r = await get(`${supabase.url}/rest/v1/${encodeURIComponent(t)}?select=*`, fetchOpts({ method: "HEAD", headers: { ...h, prefer: "count=exact", range: "0-0" } }));
+      const n = Number((r.headers?.get("content-range") || "").split("/")[1]);
+      if (r.status < 300 && n > 0) tables.push({ table: t, rows: n });
+    }
+    for (const { table, rows } of tables) {
+      const personal = PERSONAL.test(table);
+      const why = personal
+        ? "The anon key is public (it ships in your app), so a table without Row Level Security is readable by everyone. This is how most vibe-coded apps have leaked data."
+        : "The anon key is public (it ships in your app). If this table is meant to be public, like a product list, reading it is fine, but make sure strangers can't change it. If it isn't, it's leaking.";
+      add({ id: `supabase:table:${table}`, severity: personal ? "critical" : "medium", where: `Supabase table "${table}"`, title: `Anyone on the internet can read ${rows.toLocaleString("en-US")} row${rows > 1 ? "s" : ""} of "${table}"`, why, fix: `In Supabase, open Table Editor → ${table} → turn on RLS, then add a policy so people read only their own rows (for example: auth.uid() = user_id).`, ...P.rls(table, personal) });
+    }
+  }
+
+  // Firebase: is the Realtime Database or a common Firestore collection open to anyone?
+  let firebaseOpen = null;
+  if (mine && firebase?.project) {
+    firebaseOpen = [];
+    if (firebase.db) {
+      // shallow=true returns only the top-level key names, each mapped to true; we count them and drop them.
+      const r = await get(`${firebase.db}/.json?shallow=true`, fetchOpts());
+      let keys = 0;
+      try {
+        const v = JSON.parse(r.text);
+        keys = v && typeof v === "object" ? Object.keys(v).length : v != null ? 1 : 0;
+      } catch {}
+      if (r.status === 200 && keys > 0) {
+        firebaseOpen.push({ where: "Realtime Database", keys });
+        add({ id: "firebase:rtdb", severity: "critical", where: "Firebase Realtime Database", title: "Anyone on the internet can read your Firebase Realtime Database", why: `Its rules let visitors who aren't signed in read it (${keys} top-level ${keys > 1 ? "branches" : "branch"} visible). Everything under them is open.`, fix: "In Firebase → Realtime Database → Rules, require sign-in and limit each user to their own data.", ...P.rtdb() });
+      }
+    }
+    for (const coll of FIRESTORE_GUESSES) {
+      // pageSize=1 and a mask on a field that doesn't exist: at most one document name comes back, no fields.
+      const q = `pageSize=1&mask.fieldPaths=__crumple_none${firebase.key ? `&key=${firebase.key}` : ""}`;
+      const r = await get(`https://firestore.googleapis.com/v1/projects/${firebase.project}/databases/(default)/documents/${coll}?${q}`, fetchOpts());
+      let n = 0;
+      try {
+        n = (JSON.parse(r.text).documents || []).length;
+      } catch {}
+      if (r.status === 200 && n > 0) {
+        firebaseOpen.push({ where: `Firestore "${coll}"` });
+        add({ id: `firebase:firestore:${coll}`, severity: PERSONAL.test(coll) ? "critical" : "high", where: `Firestore collection "${coll}"`, title: `Anyone on the internet can read the Firestore collection "${coll}"`, why: "Your Firestore rules let visitors who aren't signed in read it. Crumple asked for one document name and no fields; a stranger would take everything.", fix: `In Firebase → Firestore → Rules, close "${coll}" to everyone except its owner.`, ...P.firestore(coll) });
+      }
+    }
+  }
+
+  if (!page.headers?.get("content-security-policy") && !/http-equiv=["']Content-Security-Policy/i.test(page.text))
+    add({ id: "csp", severity: "low", where: "response headers", title: "No Content-Security-Policy", why: "If an attacker gets a script into the page (through a comment, a profile field or a dependency), nothing stops it from sending your users' data out.", fix: "Add a Content-Security-Policy header in your host's settings.", ...P.csp([...thirdParty].slice(0, 6)) });
+
+  const penalty = findings.reduce((a, f) => a + SEVERITY[f.severity], 0);
+  const score = Math.max(0, 100 - penalty);
+  const grade = score >= 90 ? "A" : score >= 75 ? "B" : score >= 60 ? "C" : score >= 40 ? "D" : "F";
+  const order = ["critical", "high", "medium", "low"];
+  findings.sort((a, b) => order.indexOf(a.severity) - order.indexOf(b.severity));
+  return {
+    url: origin,
+    builder,
+    score,
+    grade,
+    verdict: VERDICT[grade],
+    mine,
+    scripts: bundles.length - 1,
+    supabase: supabase ? { project: supabase.ref, checked: mine, readable: tables } : null,
+    firebase: firebase ? { project: firebase.project, checked: mine, readable: firebaseOpen } : null,
+    findings,
+    pasteInto: builder || "your AI app builder or coding agent",
+  };
+}
+
+export const VERDICT = {
+  A: "Nothing serious a stranger can use against you.",
+  B: "No open doors, a few loose ends.",
+  C: "Fix these before you share the link widely.",
+  D: "A stranger can do real damage. Fix the red items today.",
+  F: "Your users' data or your accounts are exposed right now. Fix the red items before anything else.",
+};
+
+// --- re-check ------------------------------------------------------------------------------------
+// The last result for each site is kept on this machine (ids, titles and score only: no keys, no data),
+// so running the check again shows what the fixes changed.
+const HISTORY = () => path.join(process.env.CRUMPLE_HOME ?? path.join(os.homedir(), ".crumple"), "sites");
+const historyFile = (origin, mine, dir) => path.join(dir, `${new URL(origin).host.replace(/[^\w.-]/g, "_")}${mine ? ".mine" : ""}.json`);
+
+export function loadLast(origin, mine, dir = HISTORY()) {
+  try {
+    return JSON.parse(fs.readFileSync(historyFile(origin, mine, dir), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function saveRun(result, dir = HISTORY()) {
+  const slim = { at: new Date().toISOString(), score: result.score, grade: result.grade, findings: result.findings.map(({ id, severity, title }) => ({ id, severity, title })) };
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(historyFile(result.url, result.mine, dir), JSON.stringify(slim, null, 2) + "\n");
+  } catch {}
+  return slim;
+}
+
+// What changed between two runs: fixed, still open, new.
+export function compare(prev, result) {
+  if (!prev) return null;
+  const now = new Map(result.findings.map((f) => [f.id, f]));
+  const before = new Map(prev.findings.map((f) => [f.id, f]));
+  return {
+    since: prev.at,
+    before: { score: prev.score, grade: prev.grade },
+    after: { score: result.score, grade: result.grade },
+    fixed: prev.findings.filter((f) => !now.has(f.id)).map((f) => f.title),
+    open: result.findings.filter((f) => before.has(f.id)).map((f) => f.title),
+    new: result.findings.filter((f) => !before.has(f.id)).map((f) => f.title),
+  };
+}
+
+// --- the report a person reads ---------------------------------------------------------------------
+const wrap = (s, w = 92, pad = "    ") => {
+  const out = [];
+  for (const para of String(s).split("\n")) {
+    let line = "";
+    for (const word of para.split(" ")) {
+      if ((line + " " + word).trim().length > w) (out.push(pad + line.trim()), (line = word));
+      else line += " " + word;
+    }
+    out.push(pad + line.trim());
+  }
+  return out.join("\n");
+};
+
+export function renderSite(r, change, { color = true, mine = r.mine } = {}) {
+  const k = (code) => (s) => (color ? `\x1b[${code}m${s}\x1b[0m` : s);
+  const red = k("31"), green = k("32"), yellow = k("33"), dim = k("2"), bold = k("1"), cyan = k("36");
+  const col = { critical: red, high: red, medium: yellow, low: dim };
+  const gcol = r.score >= 75 ? green : r.score >= 55 ? yellow : red;
+  const L = [];
+  L.push("", `${bold("Crumple site check")} · ${r.url}${r.builder ? ` · built with ${r.builder}` : ""} · ${r.scripts} scripts read${r.supabase ? " · Supabase" : ""}${r.firebase ? " · Firebase" : ""}`, "");
+  L.push(`  Grade ${gcol(bold(r.grade))}  ${gcol(`${r.score}/100`)}  ${r.verdict}`);
+  if (change) {
+    const arrow = change.after.score > change.before.score ? green : change.after.score < change.before.score ? red : dim;
+    L.push(`  ${arrow(`Was ${change.before.grade} (${change.before.score}) on ${change.since.slice(0, 10)}, now ${change.after.grade} (${change.after.score}).`)}`);
+    for (const t of change.fixed) L.push(`  ${green("✓ fixed")}  ${t}`);
+    for (const t of change.new) L.push(`  ${red("+ new")}    ${t}`);
+    if (!change.fixed.length && !change.new.length) L.push(dim("  Nothing changed since the last check."));
+  }
+  L.push("");
+  if (!r.findings.length) L.push(green("  Nothing found."), "");
+  let n = 0;
+  for (const f of r.findings) {
+    const num = f.prompt ? `${++n}.` : "  ";
+    L.push(`${num.padStart(3)} ${col[f.severity](f.severity.toUpperCase().padEnd(8))} ${bold(f.title)} ${dim(`(${f.where})`)}`);
+    L.push(wrap(f.why, 88, "             "));
+    if (f.first) L.push(wrap(`${yellow("Do this yourself first:")} ${f.first}`, 88, "             "));
+    if (f.prompt) {
+      L.push(`             ${cyan(`Then paste this into ${r.pasteInto}:`)}`);
+      L.push(wrap(f.prompt, 84, `             ${dim("│")} `));
+    } else L.push(wrap(`${green("Next:")} ${f.fix}`, 88, "             "));
+    L.push("");
+  }
+  L.push(dim(`Read only what the site serves to every visitor${mine ? "; database checked with counts and names only, never data" : ""}.`));
+  if (n) {
+    L.push(dim(`Fix the red items first, one prompt at a time. Copy one prompt: npx crumplelab site ${new URL(r.url).host}${mine ? " --mine" : ""} --prompt 1 | pbcopy`));
+    L.push(dim("After the fixes are live, run this same command again: it shows what got fixed."));
+  }
+  return L.join("\n");
+}