fullcourtdefense-cli 1.14.8 → 1.14.10

package/dist/commands/discover.js

@@ -39,6 +39,7 @@ const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
 const config_1 = require("../config");
 const discoverProxy_1 = require("./discoverProxy");
 const discoverSchedule_1 = require("./discoverSchedule");
@@ -361,7 +362,94 @@ async function mcpJsonRpc(endpoint, method, params, timeoutMs, sessionId) {
         clearTimeout(timer);
     }
 }
-/** Best-effort live tools/list for HTTP/SSE MCP servers (stdio skipped — would spawn processes). */
+function extractJsonRpcMessages(chunk) {
+    const messages = [];
+    let buffer = chunk;
+    while (true) {
+        const headerEnd = buffer.indexOf('\r\n\r\n');
+        if (headerEnd < 0)
+            break;
+        const header = buffer.slice(0, headerEnd);
+        const match = header.match(/Content-Length:\s*(\d+)/i);
+        if (!match)
+            break;
+        const length = Number(match[1]);
+        const bodyStart = headerEnd + 4;
+        const bodyEnd = bodyStart + length;
+        if (buffer.length < bodyEnd)
+            break;
+        try {
+            messages.push(JSON.parse(buffer.slice(bodyStart, bodyEnd)));
+        }
+        catch {
+            // Ignore malformed frames from noisy local servers.
+        }
+        buffer = buffer.slice(bodyEnd);
+    }
+    for (const line of chunk.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith('{'))
+            continue;
+        try {
+            messages.push(JSON.parse(trimmed));
+        }
+        catch {
+            // Ignore logs or partial lines.
+        }
+    }
+    return messages;
+}
+function normalizeMcpToolList(tools) {
+    if (!Array.isArray(tools))
+        return [];
+    return tools
+        .map((t) => (t && typeof t.name === 'string'
+        ? { name: t.name, description: typeof t.description === 'string' ? t.description : undefined }
+        : null))
+        .filter(Boolean);
+}
+async function probeStdioMcpTools(command, args = [], timeoutMs = 8000) {
+    return new Promise(resolve => {
+        const child = (0, child_process_1.spawn)(command, args, {
+            cwd: process.cwd(),
+            env: process.env,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            windowsHide: true,
+        });
+        let done = false;
+        const finish = (tools = []) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            child.kill();
+            resolve(tools);
+        };
+        const timer = setTimeout(() => finish([]), timeoutMs);
+        child.on('error', () => finish([]));
+        child.on('exit', () => finish([]));
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', chunk => {
+            for (const message of extractJsonRpcMessages(String(chunk))) {
+                if (message?.id !== 2)
+                    continue;
+                const tools = normalizeMcpToolList(message?.result?.tools);
+                finish(tools);
+            }
+        });
+        const send = (id, method, params = {}) => {
+            child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id, method, params }) + '\n');
+        };
+        send(1, 'initialize', {
+            protocolVersion: '2024-11-05',
+            capabilities: {},
+            clientInfo: { name: 'fullcourtdefense-discover', version: '1.0.0' },
+        });
+        child.stdin.write(JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized', params: {} }) + '\n');
+        send(2, 'tools/list');
+    });
+}
+/** Best-effort live tools/list for HTTP/SSE MCP servers. */
 async function probeHttpMcpTools(url, timeoutMs = 8000) {
     const normalized = url.replace(/\/$/, '');
     const candidates = [...new Set([
@@ -384,9 +472,7 @@ async function probeHttpMcpTools(url, timeoutMs = 8000) {
             const listed = await mcpJsonRpc(endpoint, 'tools/list', {}, timeoutMs, sid);
             const tools = listed.json?.result?.tools;
             if (Array.isArray(tools) && tools.length > 0) {
-                return tools
-                    .map((t) => (t && typeof t.name === 'string' ? { name: t.name, description: typeof t.description === 'string' ? t.description : undefined } : null))
-                    .filter(Boolean);
+                return normalizeMcpToolList(tools);
             }
         }
         catch {
@@ -398,8 +484,23 @@ async function probeHttpMcpTools(url, timeoutMs = 8000) {
 async function enrichWithDeepProbe(servers, silent) {
     for (const server of servers) {
         if (server.transport !== 'http' && server.transport !== 'sse') {
-            if (!silent && server.transport === 'stdio') {
-                server.warnings.push('Deep probe skipped for stdio server (config-only inventory).');
+            if (server.transport === 'stdio' && server.command) {
+                const downstream = (0, discoverProxy_1.isFcdGatewayServer)(server) ? (0, discoverProxy_1.extractGatewayDownstream)(server) : null;
+                const command = downstream?.command || server.command;
+                const args = downstream?.args || server.args || [];
+                const liveTools = await probeStdioMcpTools(command, args);
+                if (liveTools.length > 0) {
+                    const byName = new Map(server.tools.map(t => [t.name, t]));
+                    for (const tool of liveTools)
+                        byName.set(tool.name, tool);
+                    server.tools = [...byName.values()];
+                    server.probeMode = 'deep';
+                    continue;
+                }
+                server.warnings.push('Deep probe could not list tools from stdio server (server may require auth or failed to start).');
+            }
+            else if (!silent && server.transport === 'stdio') {
+                server.warnings.push('Deep probe skipped for stdio server without a command.');
             }
             continue;
         }
@@ -638,7 +739,8 @@ function printPostureReport(posture, silent) {
 async function discoverCommand(args, config) {
     const surfaces = parseSurfaces(args);
     const silent = args.silent === 'true';
-    const deep = args.deep === 'true';
+    const uploadRequested = args.upload === 'true';
+    const deep = args.deep === 'false' ? false : (args.deep === 'true' || uploadRequested);
     if (args.unschedule === 'true') {
         (0, discoverSchedule_1.uninstallDailyDiscoverSchedule)();
         if (!silent)
@@ -656,7 +758,7 @@ async function discoverCommand(args, config) {
         });
         if (!silent) {
             const when = args.schedule === 'logon' ? 'at logon' : `daily at ${String(Number.isFinite(hour) ? hour : 9).padStart(2, '0')}:00`;
-            console.log(`Desktop discovery scheduled ${when} (runs discover --surface ${surface} --upload --silent${args.userEmail ? ` --user-email ${args.userEmail}` : ''}).`);
+            console.log(`Desktop discovery scheduled ${when} (runs discover --surface ${surface} --upload --deep --silent${args.userEmail ? ` --user-email ${args.userEmail}` : ''}).`);
             console.log('Uses login Shield credentials or an explicit org API key.');
         }
         return;
@@ -678,7 +780,7 @@ async function discoverCommand(args, config) {
         clientCoverage = applyProxyClassification(found, scanned, cwd);
         if (deep && found.length > 0) {
             if (!silent)
-                console.log(`${COLOR.gray}Running deep probe (HTTP/SSE tools/list)…${COLOR.reset}`);
+                console.log(`${COLOR.gray}Running deep probe (HTTP/SSE/stdio tools/list)…${COLOR.reset}`);
             await enrichWithDeepProbe(found, silent);
         }
     }
@@ -736,7 +838,7 @@ async function discoverCommand(args, config) {
         },
     };
     async function maybeUpload() {
-        if (args.upload !== 'true')
+        if (!uploadRequested)
             return;
         const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
         // Either an org API key OR an enrolled Shield key (from `login`) is enough.
@@ -750,7 +852,7 @@ async function discoverCommand(args, config) {
         await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey, preferApiKey: !!args.apiKey }, args.connectorName, uploadExtras);
     }
     if (silent) {
-        if (args.upload === 'true') {
+        if (uploadRequested) {
             const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
             if (!creds.apiKey && !(creds.shieldId && creds.shieldKey))
                 process.exit(1);
@@ -802,14 +904,14 @@ async function discoverCommand(args, config) {
         printAgentFilesReport(agentFiles, silent);
     if (posture)
         printPostureReport(posture, silent);
-    if (args.upload === 'true') {
+    if (uploadRequested) {
         console.log('');
         await maybeUpload();
     }
     else {
         console.log(`${COLOR.gray}Run with --upload to push results into AI Fleet.${COLOR.reset}`);
         if (runMcp && !deep)
-            console.log(`${COLOR.gray}Add --deep to live-probe HTTP/SSE MCP servers.${COLOR.reset}`);
+            console.log(`${COLOR.gray}Add --deep to live-probe HTTP/SSE/stdio MCP servers.${COLOR.reset}`);
         if (!surfaces.has('secrets'))
             console.log(`${COLOR.gray}Add --surface secrets for .env / credential store scan (local-only).${COLOR.reset}`);
         if (surfaces.size < 4)

package/dist/commands/discoverSchedule.js

@@ -49,7 +49,7 @@ function discoverCommandLine(userEmail, surface) {
     const node = process.execPath;
     const script = path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
     const q = (value) => (/\s/.test(value) ? `"${value}"` : value);
-    const parts = [q(node), q(script), 'discover', '--upload', '--silent'];
+    const parts = [q(node), q(script), 'discover', '--upload', '--deep', '--silent'];
     if (surface)
         parts.push('--surface', q(surface));
     if (userEmail)

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.8"
+  "version": "1.14.10"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.8",
+  "version": "1.14.10",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -23,6 +23,7 @@
     "test:secret-posture": "npm run build && node scripts/test-secret-posture-fixtures.js",
     "test:agent-file-posture": "npm run build && node scripts/test-agent-file-posture.js",
     "test:realworld-posture": "npm run build && node scripts/test-realworld-posture-fixtures.js",
+    "test:discover-stdio-mcp": "npm run build && node scripts/test-discover-stdio-mcp-tools.js",
     "test:posture-blast": "npm run build && node scripts/test-posture-blast-radius.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"