fullcourtdefense-cli 1.14.13 → 1.14.14

package/dist/commands/discover.d.ts

@@ -12,6 +12,10 @@ export interface DiscoverArgs {
     agentCiGate?: AgentCiGateUpload;
     extraPath?: string;
     deep?: string;
+    /** Optional comma-separated dev roots (or "auto") to sweep for project MCP configs in OTHER repos. */
+    scanRoot?: string;
+    /** Allow deep stdio probing (process spawn) for servers found via --scan-root. Default: off. */
+    deepRoots?: string;
     silent?: string;
     userEmail?: string;
     schedule?: string;

package/dist/commands/discover.js

@@ -482,10 +482,18 @@ async function probeHttpMcpTools(url, timeoutMs = 8000) {
     }
     return [];
 }
-async function enrichWithDeepProbe(servers, silent) {
+async function enrichWithDeepProbe(servers, silent, options = {}) {
     for (const server of servers) {
         if (server.transport !== 'http' && server.transport !== 'sse') {
             if (server.transport === 'stdio' && server.command) {
+                // Safety: never auto-spawn stdio server processes discovered in OTHER
+                // projects via --scan-root; inventory them without live tools unless
+                // the user opts in with --deep-roots. (HTTP probing below is fine —
+                // it's a network call, not a process spawn.)
+                if (options.skipStdioForConfigPaths?.has(path.resolve(server.configPath).toLowerCase())) {
+                    server.warnings.push('Deep stdio probe skipped for config outside the current project (--scan-root). Pass --deep-roots true to probe these too.');
+                    continue;
+                }
                 const downstream = (0, discoverProxy_1.isFcdGatewayServer)(server) ? (0, discoverProxy_1.extractGatewayDownstream)(server) : null;
                 const command = downstream?.command || server.command;
                 const args = downstream?.args || server.args || [];
@@ -769,8 +777,30 @@ async function discoverCommand(args, config) {
     const scanned = [];
     let found = [];
     let clientCoverage = [];
+    const scanRootConfigPaths = new Set();
     if (runMcp) {
         const candidates = candidateConfigPaths(cwd, args.extraPath);
+        // Optional --scan-root sweep: find project-scoped MCP configs in OTHER repos
+        // under the given dev roots (bounded walk — see scanRootsForProjectConfigs).
+        // Without the flag, behavior is exactly the known-locations scan.
+        const scanRoots = (0, discoverPaths_1.resolveScanRoots)(args.scanRoot);
+        if (scanRoots.length > 0) {
+            const sweep = (0, discoverPaths_1.scanRootsForProjectConfigs)(scanRoots);
+            const known = new Set(candidates.map(c => path.resolve(c.path).toLowerCase()));
+            let added = 0;
+            for (const candidate of sweep.candidates) {
+                const key = path.resolve(candidate.path).toLowerCase();
+                if (known.has(key))
+                    continue;
+                known.add(key);
+                candidates.push(candidate);
+                scanRootConfigPaths.add(key);
+                added += 1;
+            }
+            if (!silent) {
+                console.log(`${COLOR.gray}Scan-root sweep: checked ${sweep.scannedDirs} folder(s) under ${scanRoots.length} root(s) — found ${added} additional project config(s).${COLOR.reset}`);
+            }
+        }
         // Self-heal BEFORE parsing: configs written by old CLI versions can carry a stale
         // generic `--agent-name` that breaks dashboard policy matching. Fix them in place so
         // every discovery run converges the fleet to the per-server identity contract.
@@ -793,7 +823,9 @@ async function discoverCommand(args, config) {
         if (deep && found.length > 0) {
             if (!silent)
                 console.log(`${COLOR.gray}Running deep probe (HTTP/SSE/stdio tools/list)…${COLOR.reset}`);
-            await enrichWithDeepProbe(found, silent);
+            await enrichWithDeepProbe(found, silent, {
+                skipStdioForConfigPaths: args.deepRoots === 'true' ? undefined : scanRootConfigPaths,
+            });
         }
     }
     const secrets = surfaces.has('secrets') || surfaces.has('posture')

package/dist/commands/discoverPaths.d.ts

@@ -14,5 +14,22 @@ export declare function claudeDesktopLikelyInstalled(): boolean;
 export declare function claudeDesktopInstallTargets(configPath?: string): ClaudeDesktopConfigCandidate[];
 /** All MCP client config locations discover / install should check. */
 export declare function candidateConfigPaths(cwd: string, extra?: string): ConfigPathCandidate[];
+/** Common places developers keep code, used by `--scan-root auto`. */
+export declare function defaultScanRoots(): string[];
+/**
+ * Bounded walk of developer folders looking for project-scoped MCP configs
+ * (`--scan-root`). Depth- and volume-capped so it stays fast and predictable —
+ * this is a repo-root sweep, not a disk scan. Hidden/dependency/build folders
+ * are pruned; only the known project config filenames are checked.
+ */
+export declare function scanRootsForProjectConfigs(roots: string[], options?: {
+    maxDepth?: number;
+    maxDirs?: number;
+}): {
+    candidates: ConfigPathCandidate[];
+    scannedDirs: number;
+};
+/** Resolve the --scan-root flag: comma-separated paths, or "auto" for common dev folders. */
+export declare function resolveScanRoots(flag: string | undefined): string[];
 /** Include config paths for apps that exist on disk even when the MCP file is not created yet. */
 export declare function discoverScanTargets(cwd: string, extra?: string): ConfigPathCandidate[];

package/dist/commands/discoverPaths.js

@@ -38,6 +38,9 @@ exports.claudeDesktopConfigCandidates = claudeDesktopConfigCandidates;
 exports.claudeDesktopLikelyInstalled = claudeDesktopLikelyInstalled;
 exports.claudeDesktopInstallTargets = claudeDesktopInstallTargets;
 exports.candidateConfigPaths = candidateConfigPaths;
+exports.defaultScanRoots = defaultScanRoots;
+exports.scanRootsForProjectConfigs = scanRootsForProjectConfigs;
+exports.resolveScanRoots = resolveScanRoots;
 exports.discoverScanTargets = discoverScanTargets;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -176,6 +179,122 @@ function candidateConfigPaths(cwd, extra) {
         return true;
     });
 }
+/** Project-scoped MCP config files that can sit at any repo root. */
+const PROJECT_CONFIG_FILES = [
+    { rel: path.join('.cursor', 'mcp.json'), source: 'Cursor (project)', clientKey: 'cursor' },
+    { rel: '.mcp.json', source: 'Claude Code (.mcp.json project)', clientKey: 'claude_code' },
+    { rel: path.join('.claude', 'settings.json'), source: 'Claude Code (project)', clientKey: 'claude_code' },
+    { rel: path.join('.vscode', 'mcp.json'), source: 'VS Code (project)', clientKey: 'vscode' },
+    { rel: path.join('.codex', 'config.toml'), source: 'Codex (project)', clientKey: 'codex' },
+    { rel: path.join('.gemini', 'settings.json'), source: 'Gemini CLI (project)', clientKey: 'gemini_cli' },
+    { rel: 'mcp.json', source: 'Repo (mcp.json)', clientKey: 'other' },
+];
+/** Dependency/build/VCS folders that never contain project MCP configs. */
+const SCAN_SKIP_DIRS = new Set([
+    'node_modules', 'dist', 'build', 'out', 'vendor', 'venv', 'env', '__pycache__',
+    'target', 'coverage', 'tmp', 'temp', 'obj', 'bin', 'packages', 'bower_components',
+    'site-packages', 'deps', '.terraform',
+]);
+/** Common places developers keep code, used by `--scan-root auto`. */
+function defaultScanRoots() {
+    const home = os.homedir();
+    const roots = [
+        path.join(home, 'repos'),
+        path.join(home, 'projects'),
+        path.join(home, 'code'),
+        path.join(home, 'dev'),
+        path.join(home, 'src'),
+        path.join(home, 'work'),
+        path.join(home, 'Documents', 'GitHub'),
+        path.join(home, 'Documents', 'repos'),
+        path.join(home, 'Documents', 'projects'),
+    ];
+    if (process.platform === 'win32') {
+        const drive = (process.env.SystemDrive || 'C:') + path.sep;
+        for (const name of ['dev', 'src', 'repos', 'code', 'projects', 'work', 'git']) {
+            roots.push(path.join(drive, name));
+        }
+    }
+    return roots.filter(root => {
+        try {
+            return fs.statSync(root).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/**
+ * Bounded walk of developer folders looking for project-scoped MCP configs
+ * (`--scan-root`). Depth- and volume-capped so it stays fast and predictable —
+ * this is a repo-root sweep, not a disk scan. Hidden/dependency/build folders
+ * are pruned; only the known project config filenames are checked.
+ */
+function scanRootsForProjectConfigs(roots, options = {}) {
+    const maxDepth = options.maxDepth ?? 4;
+    const maxDirs = options.maxDirs ?? 25000;
+    const candidates = [];
+    const visited = new Set();
+    let scannedDirs = 0;
+    const queue = [];
+    for (const root of roots) {
+        try {
+            const resolved = path.resolve(root);
+            if (fs.statSync(resolved).isDirectory())
+                queue.push({ dir: resolved, depth: 0 });
+        }
+        catch { /* missing root — skip */ }
+    }
+    while (queue.length > 0 && scannedDirs < maxDirs) {
+        const { dir, depth } = queue.shift();
+        const key = dir.toLowerCase();
+        if (visited.has(key))
+            continue;
+        visited.add(key);
+        scannedDirs += 1;
+        for (const config of PROJECT_CONFIG_FILES) {
+            const file = path.join(dir, config.rel);
+            try {
+                if (fs.existsSync(file) && fs.statSync(file).isFile()) {
+                    candidates.push({ path: file, source: config.source, clientKey: config.clientKey });
+                }
+            }
+            catch { /* unreadable — skip */ }
+        }
+        if (depth >= maxDepth)
+            continue;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue; // permission denied etc.
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const name = entry.name;
+            if (name.startsWith('.') || SCAN_SKIP_DIRS.has(name.toLowerCase()))
+                continue;
+            queue.push({ dir: path.join(dir, name), depth: depth + 1 });
+        }
+    }
+    return { candidates, scannedDirs };
+}
+/** Resolve the --scan-root flag: comma-separated paths, or "auto" for common dev folders. */
+function resolveScanRoots(flag) {
+    if (!flag?.trim())
+        return [];
+    const parts = flag.split(',').map(part => part.trim()).filter(Boolean);
+    const roots = [];
+    for (const part of parts) {
+        if (part.toLowerCase() === 'auto')
+            roots.push(...defaultScanRoots());
+        else
+            roots.push(path.resolve(part));
+    }
+    return [...new Set(roots.map(root => root))];
+}
 /** Include config paths for apps that exist on disk even when the MCP file is not created yet. */
 function discoverScanTargets(cwd, extra) {
     const candidates = candidateConfigPaths(cwd, extra);

package/dist/index.js

@@ -327,6 +327,8 @@ function printHelp() {
     $ fullcourtdefense discover --surface secrets
     $ fullcourtdefense discover --surface agent-files
     $ fullcourtdefense discover --deep --upload --silent --user-email you@company.com
+    $ fullcourtdefense discover --surface mcp --scan-root auto --upload
+    $ fullcourtdefense discover --surface mcp --scan-root "C:\dev,D:\work" --upload
     $ fullcourtdefense discover --type mcp --json
     $ fullcourtdefense install-cursor-hook
     $ fullcourtdefense install-cursor-hook --shadow true        # monitor only
@@ -526,6 +528,8 @@ async function main() {
                 connectorName: flags['connector-name'],
                 extraPath: flags.path,
                 deep: flags.deep,
+                scanRoot: flags['scan-root'],
+                deepRoots: flags['deep-roots'],
                 silent: flags.silent,
                 userEmail: flags['user-email'],
                 schedule: flags.schedule,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.13"
+  "version": "1.14.14"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.13",
+  "version": "1.14.14",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {