cyberark-mcp 1.0.0

package/README.md

@@ -0,0 +1,19 @@
+# cyberark-mcp
+
+CyberArk PVWA API: logon, safes, accounts. Token cached per process.
+
+## Setup
+
+```bash
+export CYBERARK_BASE_URL=...
+```
+
+Needs CYBERARK_BASE_URL (PVWA host) plus CYBERARK_USERNAME and CYBERARK_PASSWORD.
+
+## Tools
+
+- `list_safes` — CyberArk safes visible to the logon user.
+- `list_accounts` — CyberArk accounts, optionally filtered by safe.
+- `get_account` — One CyberArk account by id (metadata, not the password value).
+
+Part of [awesome-mcps](https://github.com/mrfentmen/awesome-mcps).

package/dist/api.d.ts

@@ -0,0 +1,7 @@
+export declare class CyberarkError extends Error {
+    constructor(message: string);
+}
+export declare function errorMessage(e: unknown): string;
+export declare function listSafes(): Promise<string>;
+export declare function listAccounts(safeName?: string): Promise<string>;
+export declare function getAccount(accountId: string): Promise<string>;

package/dist/api.js

@@ -0,0 +1,75 @@
+export class CyberarkError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CyberarkError";
+    }
+}
+export function errorMessage(e) {
+    return e instanceof Error ? e.message : String(e);
+}
+const UA = { "User-Agent": "awesome-mcps/1.0" };
+function envStrict(name) {
+    const v = process.env[name];
+    if (!v)
+        throw new CyberarkError(`Set the ${name} environment variable.`);
+    return v;
+}
+async function apiBase() {
+    return envStrict("CYBERARK_BASE_URL").replace(/\/$/, "");
+}
+let cachedToken = "";
+async function authHeaders() {
+    if (!cachedToken) {
+        const base = await apiBase();
+        const res = await fetch(`${base}/PasswordVault/API/Auth/Cyberark/Logon`, {
+            method: "POST",
+            headers: { ...UA, "Content-Type": "application/json" },
+            body: JSON.stringify({ username: envStrict("CYBERARK_USERNAME"), password: envStrict("CYBERARK_PASSWORD") }),
+        });
+        if (!res.ok)
+            throw new CyberarkError(`CyberArk logon failed: HTTP ${res.status}`);
+        const data = (await res.json());
+        if (!data.CyberArkLogonResult)
+            throw new CyberarkError("CyberArk logon returned no token");
+        cachedToken = data.CyberArkLogonResult;
+    }
+    return { Authorization: cachedToken };
+}
+function pretty(data) {
+    const t = typeof data === "string" ? data : JSON.stringify(data, null, 2);
+    return t.length > 12000 ? t.slice(0, 12000) + "\n…(truncated)" : t;
+}
+async function req(url, init = {}) {
+    const res = await fetch(url, { headers: { ...UA, ...(await authHeaders()), ...(init.headers ?? {}) }, ...init });
+    const ct = res.headers.get("content-type") ?? "";
+    const data = ct.includes("json") ? await res.json() : await res.text();
+    if (!res.ok) {
+        const detail = typeof data === "string" ? data.slice(0, 300) : JSON.stringify(data).slice(0, 300);
+        throw new CyberarkError(`HTTP ${res.status}: ${detail}`);
+    }
+    return data;
+}
+export async function listSafes() {
+    const base = await apiBase();
+    let url = `${base}/PasswordVault/API/Safes`;
+    const data = await req(url);
+    return pretty(data);
+}
+export async function listAccounts(safeName) {
+    const base = await apiBase();
+    let url = `${base}/PasswordVault/API/Accounts`;
+    const qs = new URLSearchParams();
+    if (safeName !== undefined)
+        qs.append("safeName", String(safeName));
+    const qstr = qs.toString();
+    if (qstr)
+        url += (url.includes('?') ? '&' : '?') + qstr;
+    const data = await req(url);
+    return pretty(data);
+}
+export async function getAccount(accountId) {
+    const base = await apiBase();
+    let url = `${base}/PasswordVault/API/Accounts/${encodeURIComponent(String(accountId))}`;
+    const data = await req(url);
+    return pretty(data);
+}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.js

@@ -0,0 +1,12 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createServer } from "./server.js";
+async function main() {
+    const server = createServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error("MCP server running on stdio");
+}
+main().catch((err) => {
+    console.error("Fatal error:", err);
+    process.exit(1);
+});

package/dist/server.d.ts

@@ -0,0 +1,2 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function createServer(): McpServer;

package/dist/server.js

@@ -0,0 +1,56 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+import { errorMessage, listSafes, listAccounts, getAccount, } from "./api.js";
+const text = (t) => ({ content: [{ type: "text", text: t }] });
+const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
+const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
+export function createServer() {
+    const server = new McpServer({
+        name: "cyberark-mcp",
+        version: "1.0.0",
+    });
+    server.registerTool("list_safes", {
+        title: "List safes",
+        description: "CyberArk safes visible to the logon user.",
+        inputSchema: z.object({}),
+        annotations: READ_ONLY,
+    }, async ({}) => {
+        try {
+            return text(await listSafes());
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("list_accounts", {
+        title: "List accounts",
+        description: "CyberArk accounts, optionally filtered by safe.",
+        inputSchema: z.object({
+            safeName: z.string().optional().describe("Safe name filter"),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ safeName }) => {
+        try {
+            return text(await listAccounts(safeName));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("get_account", {
+        title: "Get account",
+        description: "One CyberArk account by id (metadata, not the password value).",
+        inputSchema: z.object({
+            accountId: z.string().describe("Account id"),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ accountId }) => {
+        try {
+            return text(await getAccount(accountId));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    return server;
+}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "cyberark-mcp",
+  "version": "1.0.0",
+  "description": "CyberArk PVWA API: logon, safes, accounts. Token cached per process.",
+  "type": "module",
+  "mcpName": "io.github.mrfentmen/cyberark-mcp",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mrfentmen/awesome-mcps.git"
+  },
+  "bin": {
+    "cyberark-mcp": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/index.js",
+    "dev": "rm -rf dist && tsc -p tsconfig.json && node dist/index.js",
+    "inspect": "npx @modelcontextprotocol/inspector node dist/index.js"
+  },
+  "keywords": [
+    "mcp",
+    "cyberark",
+    "secrets",
+    "vault",
+    "security"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.4",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}