fullcourtdefense-cli 1.2.0 → 1.3.1

package/dist/commands/discover.d.ts

@@ -23,3 +23,11 @@ export interface DesktopDiscoveryHost {
     probeMode: 'config' | 'deep';
 }
 export declare function discoverCommand(args: DiscoverArgs, config: BotGuardConfig): Promise<void>;
+/** Upload-only discover — used after install-mcp-gateway --upload. */
+export declare function runDiscoverUpload(args: {
+    apiKey?: string;
+    apiUrl?: string;
+    userEmail?: string;
+    silent?: boolean;
+    connectorName?: string;
+}, config: BotGuardConfig): Promise<void>;

package/dist/commands/discover.js

@@ -34,12 +34,14 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.discoverCommand = discoverCommand;
+exports.runDiscoverUpload = runDiscoverUpload;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
-const path = __importStar(require("path"));
 const discoverProxy_1 = require("./discoverProxy");
 const discoverSchedule_1 = require("./discoverSchedule");
+const discoverPaths_1 = require("./discoverPaths");
+const knownMcpServers_1 = require("./knownMcpServers");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 const SECRET_VALUE = /sk-[A-Za-z0-9_-]{12,}|ghp_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{20,}/;
 const SECRET_KEY = /key|token|secret|password|credential|api[_-]?key/i;
@@ -58,68 +60,9 @@ function buildHostMetadata(userEmail, probeMode = 'config') {
         probeMode,
     };
 }
-/** Where MCP client configs live, by client + OS. */
+/** Where MCP client configs live — see discoverPaths.ts for the canonical list. */
 function candidateConfigPaths(cwd, extra) {
-    const home = os.homedir();
-    const appData = process.env.APPDATA || path.join(home, 'AppData', 'Roaming');
-    const localAppData = process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
-    const xdg = process.env.XDG_CONFIG_HOME || path.join(home, '.config');
-    const list = [
-        // Cursor
-        { path: path.join(home, '.cursor', 'mcp.json'), source: 'Cursor (global)' },
-        { path: path.join(cwd, '.cursor', 'mcp.json'), source: 'Cursor (project)' },
-        // Cursor managed (enterprise)
-        { path: path.join(appData, 'Cursor', 'managed-mcp.json'), source: 'Cursor (managed, win)' },
-        { path: path.join(home, 'Library', 'Application Support', 'Cursor', 'managed-mcp.json'), source: 'Cursor (managed, mac)' },
-        { path: '/etc/cursor/managed-mcp.json', source: 'Cursor (managed, linux)' },
-        // Claude Desktop
-        { path: path.join(appData, 'Claude', 'claude_desktop_config.json'), source: 'Claude Desktop (win)' },
-        { path: path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json'), source: 'Claude Desktop (mac)' },
-        { path: path.join(xdg, 'Claude', 'claude_desktop_config.json'), source: 'Claude Desktop (linux)' },
-        // Claude Code
-        { path: path.join(home, '.claude.json'), source: 'Claude Code' },
-        { path: path.join(home, '.claude', 'settings.json'), source: 'Claude Code (global)' },
-        { path: path.join(cwd, '.claude', 'settings.json'), source: 'Claude Code (project)' },
-        { path: path.join(cwd, '.mcp.json'), source: 'Claude Code (.mcp.json project)' },
-        // Gemini CLI
-        { path: path.join(home, '.gemini', 'settings.json'), source: 'Gemini CLI' },
-        { path: path.join(xdg, 'gemini', 'settings.json'), source: 'Gemini CLI (xdg)' },
-        // OpenAI Codex
-        { path: path.join(home, '.codex', 'mcp.json'), source: 'Codex' },
-        { path: path.join(xdg, 'codex', 'mcp.json'), source: 'Codex (xdg)' },
-        // VS Code (project + user settings)
-        { path: path.join(cwd, '.vscode', 'mcp.json'), source: 'VS Code (project)' },
-        { path: path.join(appData, 'Code', 'User', 'settings.json'), source: 'VS Code (user, win)' },
-        { path: path.join(home, 'Library', 'Application Support', 'Code', 'User', 'settings.json'), source: 'VS Code (user, mac)' },
-        { path: path.join(xdg, 'Code', 'User', 'settings.json'), source: 'VS Code (user, linux)' },
-        // Windsurf
-        { path: path.join(home, '.codeium', 'windsurf', 'mcp_config.json'), source: 'Windsurf' },
-        // Kiro / generic
-        { path: path.join(home, '.kiro', 'mcp.json'), source: 'Kiro' },
-        // Generic / repo-root
-        { path: path.join(cwd, '.mcp.json'), source: 'Repo (.mcp.json)' },
-        { path: path.join(cwd, 'mcp.json'), source: 'Repo (mcp.json)' },
-    ];
-    if (process.platform === 'win32') {
-        list.push({ path: path.join(process.env.ProgramData || 'C:\\ProgramData', 'Cursor', 'managed-mcp.json'), source: 'Cursor (managed, program data)' });
-        const packagesDir = path.join(localAppData, 'Packages');
-        try {
-            for (const packageName of fs.readdirSync(packagesDir)) {
-                if (!/^Claude_/i.test(packageName))
-                    continue;
-                list.push({
-                    path: path.join(packagesDir, packageName, 'LocalCache', 'Roaming', 'Claude', 'claude_desktop_config.json'),
-                    source: 'Claude Desktop (win MSIX)',
-                });
-            }
-        }
-        catch {
-            // Missing Packages directory is normal on non-Store installs.
-        }
-    }
-    if (extra)
-        list.push({ path: path.resolve(extra), source: 'Custom path' });
-    return list;
+    return (0, discoverPaths_1.discoverScanTargets)(cwd, extra);
 }
 /** MCP servers can be declared under several keys across clients. */
 function extractServerMap(parsed) {
@@ -160,6 +103,55 @@ function scoreRisk(s) {
     }
     return { level, tags };
 }
+function pushDiscoveredServer(out, name, cfgRaw, source, configPath) {
+    const cfg = (cfgRaw || {});
+    const command = typeof cfg.command === 'string' ? cfg.command : undefined;
+    const args = Array.isArray(cfg.args) ? cfg.args.map(String) : undefined;
+    const url = typeof cfg.url === 'string' ? cfg.url : (typeof cfg.serverUrl === 'string' ? cfg.serverUrl : undefined);
+    const env = (cfg.env && typeof cfg.env === 'object') ? cfg.env : {};
+    const envKeys = Object.keys(env);
+    const transport = url
+        ? (/\/sse(\b|$)/.test(url) ? 'sse' : 'http')
+        : command ? 'stdio' : 'unknown';
+    const tools = Array.isArray(cfg.tools)
+        ? cfg.tools
+            .map((t) => {
+            if (typeof t === 'string')
+                return { name: t };
+            if (t && typeof t.name === 'string')
+                return { name: t.name, description: typeof t.description === 'string' ? t.description : undefined };
+            return null;
+        })
+            .filter(Boolean)
+        : [];
+    const { level, tags } = scoreRisk({ serverName: name, command, args, url });
+    const warnings = [];
+    const blob = `${command || ''} ${(args || []).join(' ')} ${JSON.stringify(env)}`;
+    if (SECRET_VALUE.test(blob))
+        warnings.push('Hardcoded secret/API token detected in config (rotate + use env var).');
+    for (const [k, v] of Object.entries(env)) {
+        const val = String(v ?? '');
+        if (SECRET_KEY.test(k) && val && !/^\$\{?[A-Za-z0-9_]+\}?$/.test(val)) {
+            warnings.push(`Env "${k}" appears to contain a literal secret value.`);
+        }
+    }
+    out.push({
+        serverName: name,
+        command,
+        args,
+        url,
+        transport,
+        envKeys,
+        tools,
+        source,
+        configPath,
+        riskLevel: level,
+        riskTags: tags,
+        warnings,
+        probeMode: 'config',
+        proxyStatus: 'unknown',
+    });
+}
 function parseConfigFile(filePath, source) {
     let raw;
     try {
@@ -175,56 +167,21 @@ function parseConfigFile(filePath, source) {
     catch {
         return [];
     }
-    const servers = extractServerMap(parsed);
     const out = [];
-    for (const [name, cfgRaw] of Object.entries(servers)) {
-        const cfg = (cfgRaw || {});
-        const command = typeof cfg.command === 'string' ? cfg.command : undefined;
-        const args = Array.isArray(cfg.args) ? cfg.args.map(String) : undefined;
-        const url = typeof cfg.url === 'string' ? cfg.url : (typeof cfg.serverUrl === 'string' ? cfg.serverUrl : undefined);
-        const env = (cfg.env && typeof cfg.env === 'object') ? cfg.env : {};
-        const envKeys = Object.keys(env);
-        const transport = url
-            ? (/\/sse(\b|$)/.test(url) ? 'sse' : 'http')
-            : command ? 'stdio' : 'unknown';
-        const tools = Array.isArray(cfg.tools)
-            ? cfg.tools
-                .map((t) => {
-                if (typeof t === 'string')
-                    return { name: t };
-                if (t && typeof t.name === 'string')
-                    return { name: t.name, description: typeof t.description === 'string' ? t.description : undefined };
-                return null;
-            })
-                .filter(Boolean)
-            : [];
-        const { level, tags } = scoreRisk({ serverName: name, command, args, url });
-        const warnings = [];
-        const blob = `${command || ''} ${(args || []).join(' ')} ${JSON.stringify(env)}`;
-        if (SECRET_VALUE.test(blob))
-            warnings.push('Hardcoded secret/API token detected in config (rotate + use env var).');
-        for (const [k, v] of Object.entries(env)) {
-            const val = String(v ?? '');
-            if (SECRET_KEY.test(k) && val && !/^\$\{?[A-Za-z0-9_]+\}?$/.test(val)) {
-                warnings.push(`Env "${k}" appears to contain a literal secret value.`);
+    for (const [name, cfgRaw] of Object.entries(extractServerMap(parsed))) {
+        pushDiscoveredServer(out, name, cfgRaw, source, filePath);
+    }
+    // Claude Code stores MCP per-project inside ~/.claude.json
+    if (/claude code/i.test(source) && parsed?.projects && typeof parsed.projects === 'object') {
+        for (const [projectPath, projectCfg] of Object.entries(parsed.projects)) {
+            const projectServers = projectCfg?.mcpServers;
+            if (!projectServers || typeof projectServers !== 'object')
+                continue;
+            const projectLabel = projectPath.split(/[/\\]/).filter(Boolean).slice(-1)[0] || projectPath;
+            for (const [name, cfgRaw] of Object.entries(projectServers)) {
+                pushDiscoveredServer(out, name, cfgRaw, `${source} · ${projectLabel}`, filePath);
             }
         }
-        out.push({
-            serverName: name,
-            command,
-            args,
-            url,
-            transport,
-            envKeys,
-            tools,
-            source,
-            configPath: filePath,
-            riskLevel: level,
-            riskTags: tags,
-            warnings,
-            probeMode: 'config',
-            proxyStatus: 'unknown',
-        });
     }
     return out;
 }
@@ -313,13 +270,14 @@ async function enrichWithDeepProbe(servers, silent) {
         server.probeMode = 'deep';
     }
 }
-/** Merge servers found in multiple files; keep richest record, union sources. */
+/** Dedupe within the same config file + server name only (keep separate entries per client config path). */
 function dedupe(servers) {
-    const byName = new Map();
+    const byKey = new Map();
     for (const s of servers) {
-        const existing = byName.get(s.serverName);
+        const key = `${s.configPath.toLowerCase()}::${s.serverName.toLowerCase()}`;
+        const existing = byKey.get(key);
         if (!existing) {
-            byName.set(s.serverName, { ...s, source: s.source });
+            byKey.set(key, { ...s });
             continue;
         }
         if (!existing.source.includes(s.source))
@@ -334,7 +292,7 @@ function dedupe(servers) {
         if (s.probeMode === 'deep')
             existing.probeMode = 'deep';
     }
-    return [...byName.values()];
+    return [...byKey.values()];
 }
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
@@ -353,6 +311,16 @@ function applyProxyClassification(servers, scanned, cwd) {
         if (server.proxyStatus === 'direct' && server.riskLevel !== 'low') {
             server.warnings.push('Direct MCP — not proxied through Full Court Defense gateway.');
         }
+        const info = (0, knownMcpServers_1.knownMcpServerInfo)(server.serverName, server.command);
+        if (info) {
+            server.serverKind = info.category;
+            server.serverDescription = info.description;
+        }
+        if (server.proxyStatus === 'direct') {
+            const hint = (0, knownMcpServers_1.directServerFixHint)(server.serverName);
+            if (hint && !server.warnings.includes(hint))
+                server.warnings.push(hint);
+        }
     }
     return (0, discoverProxy_1.buildClientCoverage)(scanned, servers, cwd);
 }
@@ -383,6 +351,8 @@ async function upload(servers, host, clientCoverage, apiUrl, apiKey, connectorNa
             probeMode: s.probeMode,
             proxyStatus: s.proxyStatus,
             wrapsServerName: s.wrapsServerName,
+            serverKind: s.serverKind,
+            serverDescription: s.serverDescription,
             tools: s.tools,
         })),
     };
@@ -427,10 +397,10 @@ async function discoverCommand(args, config) {
     const scanned = [];
     let found = [];
     for (const c of candidates) {
-        if (!fs.existsSync(c.path))
-            continue;
         scanned.push({ path: c.path, source: c.source });
-        found.push(...parseConfigFile(c.path, c.source));
+        if (fs.existsSync(c.path)) {
+            found.push(...parseConfigFile(c.path, c.source));
+        }
     }
     found = dedupe(found);
     const clientCoverage = applyProxyClassification(found, scanned, cwd);
@@ -455,7 +425,7 @@ async function discoverCommand(args, config) {
             const apiUrl = args.apiUrl || config.apiUrl || DEFAULT_API_URL;
             if (!apiKey)
                 process.exit(1);
-            if (found.length === 0)
+            if (scanned.length === 0)
                 return;
             await upload(found, host, clientCoverage, apiUrl, apiKey, args.connectorName);
         }
@@ -469,16 +439,12 @@ async function discoverCommand(args, config) {
         console.log(`${COLOR.gray}Looked in Cursor, Claude Desktop/Code, VS Code, Windsurf, Codex, Gemini CLI, and repo-root configs.${COLOR.reset}`);
         return;
     }
-    console.log(`${COLOR.bold}Config files found:${COLOR.reset}`);
-    for (const s of scanned)
-        console.log(`  ${COLOR.dim}•${COLOR.reset} ${s.source} → ${s.path}`);
-    console.log('');
-    if (found.length === 0) {
-        console.log(`${COLOR.yellow}Config files exist but declare no MCP servers.${COLOR.reset}`);
-        return;
+    console.log(`${COLOR.bold}AI clients checked (${scanned.length}):${COLOR.reset}`);
+    for (const s of scanned) {
+        const exists = fs.existsSync(s.path);
+        console.log(`  ${COLOR.dim}•${COLOR.reset} ${s.source} → ${s.path}${exists ? '' : ` ${COLOR.yellow}(not created yet)${COLOR.reset}`}`);
     }
-    const order = { critical: 0, high: 1, medium: 2, low: 3 };
-    found.sort((a, b) => order[a.riskLevel] - order[b.riskLevel]);
+    console.log('');
     if (clientCoverage.length > 0) {
         console.log(`${COLOR.bold}Client coverage:${COLOR.reset}`);
         for (const row of clientCoverage) {
@@ -487,15 +453,40 @@ async function discoverCommand(args, config) {
                 ? (row.cursorHooksInstalled ? `${COLOR.green}hooks ✓ (${row.cursorHookEvents.join(', ')})${COLOR.reset}` : `${COLOR.yellow}no hooks${COLOR.reset}`)
                 : '';
             console.log(`  ${COLOR.dim}•${COLOR.reset} ${row.client} — ${row.mcpServerCount} MCP · ${gateway}${hooks ? ` · ${hooks}` : ''}`);
+            if (row.clientKey === 'claude_desktop' && !row.mcpGatewayInstalled && row.mcpServerCount === 0) {
+                console.log(`        ${COLOR.gray}Install: fullcourtdefense install-claude-desktop-mcp-gateway --shield-id ... --mcp-command npm --mcp-args "run mcp"${COLOR.reset}`);
+            }
         }
         console.log('');
     }
+    if (found.length === 0) {
+        console.log(`${COLOR.yellow}No MCP servers configured in these clients yet.${COLOR.reset}`);
+        console.log(`${COLOR.gray}Install gateway everywhere: fullcourtdefense install-mcp-gateway --clients all --shield-id ... --shield-key ... --mcp-command npm --mcp-args "run mcp"${COLOR.reset}`);
+        if (args.upload === 'true') {
+            const apiKey = args.apiKey || config.apiKey || process.env.FULLCOURTDEFENSE_API_KEY;
+            const apiUrl = args.apiUrl || config.apiUrl || DEFAULT_API_URL;
+            if (!apiKey) {
+                console.error(`\n${COLOR.red}--upload requires an API key.${COLOR.reset}`);
+                process.exit(1);
+            }
+            console.log('');
+            await upload(found, host, clientCoverage, apiUrl, apiKey, args.connectorName);
+        }
+        else {
+            console.log(`${COLOR.gray}Run with --upload to push client coverage into AI Inventory.${COLOR.reset}`);
+        }
+        return;
+    }
+    const order = { critical: 0, high: 1, medium: 2, low: 3 };
+    found.sort((a, b) => order[a.riskLevel] - order[b.riskLevel]);
     console.log(`${COLOR.bold}${found.length} MCP server(s) discovered:${COLOR.reset}\n`);
     for (const s of found) {
         const col = riskColor(s.riskLevel);
         const target = s.command ? `${s.command} ${(s.args || []).join(' ')}`.trim() : (s.url || 'unknown');
         const proxyCol = s.proxyStatus === 'direct' ? COLOR.red : s.proxyStatus === 'proxied' || s.proxyStatus === 'fcd_gateway' ? COLOR.green : COLOR.yellow;
         console.log(`  ${col}${COLOR.bold}[${s.riskLevel.toUpperCase()}]${COLOR.reset} ${COLOR.bold}${s.serverName}${COLOR.reset} ${COLOR.gray}(${s.transport}${s.probeMode === 'deep' ? ', deep' : ''})${COLOR.reset} ${proxyCol}${proxyStatusLabel(s.proxyStatus)}${COLOR.reset}`);
+        if (s.serverDescription)
+            console.log(`        ${COLOR.gray}about:${COLOR.reset} ${s.serverDescription}`);
         console.log(`        ${COLOR.gray}target:${COLOR.reset} ${target}`);
         if (s.riskTags.length)
             console.log(`        ${COLOR.gray}tags:${COLOR.reset} ${s.riskTags.join(', ')}`);
@@ -527,3 +518,15 @@ async function discoverCommand(args, config) {
         console.log(`${COLOR.gray}Add --schedule daily for automatic daily upload (MDM/fleet).${COLOR.reset}`);
     }
 }
+/** Upload-only discover — used after install-mcp-gateway --upload. */
+async function runDiscoverUpload(args, config) {
+    await discoverCommand({
+        type: 'mcp',
+        upload: 'true',
+        silent: args.silent ? 'true' : undefined,
+        apiKey: args.apiKey,
+        apiUrl: args.apiUrl,
+        userEmail: args.userEmail,
+        connectorName: args.connectorName,
+    }, config);
+}

package/dist/commands/discoverPaths.d.ts

@@ -0,0 +1,18 @@
+export interface ConfigPathCandidate {
+    path: string;
+    source: string;
+    clientKey: string;
+}
+export interface ClaudeDesktopConfigCandidate {
+    file: string;
+    source: string;
+    exists: boolean;
+}
+export declare function claudeDesktopMsixCandidates(): ClaudeDesktopConfigCandidate[];
+export declare function claudeDesktopConfigCandidates(): ClaudeDesktopConfigCandidate[];
+export declare function claudeDesktopLikelyInstalled(): boolean;
+export declare function claudeDesktopInstallTargets(configPath?: string): ClaudeDesktopConfigCandidate[];
+/** All MCP client config locations discover / install should check. */
+export declare function candidateConfigPaths(cwd: string, extra?: string): ConfigPathCandidate[];
+/** Include config paths for apps that exist on disk even when the MCP file is not created yet. */
+export declare function discoverScanTargets(cwd: string, extra?: string): ConfigPathCandidate[];

package/dist/commands/discoverPaths.js

@@ -0,0 +1,194 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudeDesktopMsixCandidates = claudeDesktopMsixCandidates;
+exports.claudeDesktopConfigCandidates = claudeDesktopConfigCandidates;
+exports.claudeDesktopLikelyInstalled = claudeDesktopLikelyInstalled;
+exports.claudeDesktopInstallTargets = claudeDesktopInstallTargets;
+exports.candidateConfigPaths = candidateConfigPaths;
+exports.discoverScanTargets = discoverScanTargets;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+function claudeDesktopDocumentedPath() {
+    const home = os.homedir();
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA || path.join(home, 'AppData', 'Roaming');
+        return path.join(appData, 'Claude', 'claude_desktop_config.json');
+    }
+    if (process.platform === 'darwin') {
+        return path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
+    }
+    const xdg = process.env.XDG_CONFIG_HOME || path.join(home, '.config');
+    return path.join(xdg, 'Claude', 'claude_desktop_config.json');
+}
+function claudeDesktopMsixCandidates() {
+    if (process.platform !== 'win32')
+        return [];
+    const localAppData = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+    const packagesDir = path.join(localAppData, 'Packages');
+    try {
+        return fs.readdirSync(packagesDir)
+            .filter(name => /^Claude_/i.test(name))
+            .map(name => ({
+            file: path.join(packagesDir, name, 'LocalCache', 'Roaming', 'Claude', 'claude_desktop_config.json'),
+            source: 'Claude Desktop (win MSIX)',
+            exists: fs.existsSync(path.join(packagesDir, name, 'LocalCache', 'Roaming', 'Claude', 'claude_desktop_config.json')),
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+function claudeDesktopConfigCandidates() {
+    const documented = claudeDesktopDocumentedPath();
+    const normal = {
+        file: documented,
+        source: process.platform === 'win32'
+            ? 'Claude Desktop (win)'
+            : process.platform === 'darwin'
+                ? 'Claude Desktop (mac)'
+                : 'Claude Desktop (linux)',
+        exists: fs.existsSync(documented),
+    };
+    const seen = new Set();
+    return [...claudeDesktopMsixCandidates(), normal].filter(candidate => {
+        const key = path.resolve(candidate.file).toLowerCase();
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+function claudeDesktopLikelyInstalled() {
+    if (claudeDesktopConfigCandidates().some(candidate => candidate.exists))
+        return true;
+    if (claudeDesktopMsixCandidates().length > 0)
+        return true;
+    if (process.platform === 'darwin' && fs.existsSync('/Applications/Claude.app'))
+        return true;
+    if (process.platform === 'win32') {
+        const pf = process.env.ProgramFiles || 'C:\\Program Files';
+        if (fs.existsSync(path.join(pf, 'Claude', 'Claude.exe')))
+            return true;
+    }
+    return fs.existsSync(path.dirname(claudeDesktopDocumentedPath()));
+}
+function claudeDesktopInstallTargets(configPath) {
+    if (configPath) {
+        const file = path.resolve(configPath);
+        return [{ file, source: 'Claude Desktop (custom)', exists: fs.existsSync(file) }];
+    }
+    const candidates = claudeDesktopConfigCandidates();
+    const existing = candidates.filter(candidate => candidate.exists);
+    if (existing.length > 0)
+        return existing;
+    const msix = candidates.find(candidate => candidate.source.includes('MSIX'));
+    if (msix)
+        return [msix];
+    return [candidates[candidates.length - 1] || {
+            file: claudeDesktopDocumentedPath(),
+            source: 'Claude Desktop',
+            exists: false,
+        }];
+}
+/** All MCP client config locations discover / install should check. */
+function candidateConfigPaths(cwd, extra) {
+    const home = os.homedir();
+    const appData = process.env.APPDATA || path.join(home, 'AppData', 'Roaming');
+    const xdg = process.env.XDG_CONFIG_HOME || path.join(home, '.config');
+    const list = [
+        { path: path.join(home, '.cursor', 'mcp.json'), source: 'Cursor (global)', clientKey: 'cursor' },
+        { path: path.join(cwd, '.cursor', 'mcp.json'), source: 'Cursor (project)', clientKey: 'cursor' },
+        { path: path.join(appData, 'Cursor', 'managed-mcp.json'), source: 'Cursor (managed, win)', clientKey: 'cursor' },
+        { path: path.join(home, 'Library', 'Application Support', 'Cursor', 'managed-mcp.json'), source: 'Cursor (managed, mac)', clientKey: 'cursor' },
+        { path: '/etc/cursor/managed-mcp.json', source: 'Cursor (managed, linux)', clientKey: 'cursor' },
+        { path: path.join(home, '.claude.json'), source: 'Claude Code', clientKey: 'claude_code' },
+        { path: path.join(home, '.claude', 'settings.json'), source: 'Claude Code (global)', clientKey: 'claude_code' },
+        { path: path.join(cwd, '.claude', 'settings.json'), source: 'Claude Code (project)', clientKey: 'claude_code' },
+        { path: path.join(cwd, '.mcp.json'), source: 'Claude Code (.mcp.json project)', clientKey: 'claude_code' },
+        { path: path.join(home, '.gemini', 'settings.json'), source: 'Gemini CLI', clientKey: 'gemini_cli' },
+        { path: path.join(xdg, 'gemini', 'settings.json'), source: 'Gemini CLI (xdg)', clientKey: 'gemini_cli' },
+        { path: path.join(home, '.codex', 'mcp.json'), source: 'Codex', clientKey: 'codex' },
+        { path: path.join(xdg, 'codex', 'mcp.json'), source: 'Codex (xdg)', clientKey: 'codex' },
+        { path: path.join(cwd, '.vscode', 'mcp.json'), source: 'VS Code (project)', clientKey: 'vscode' },
+        { path: path.join(appData, 'Code', 'User', 'settings.json'), source: 'VS Code (user, win)', clientKey: 'vscode' },
+        { path: path.join(home, 'Library', 'Application Support', 'Code', 'User', 'settings.json'), source: 'VS Code (user, mac)', clientKey: 'vscode' },
+        { path: path.join(xdg, 'Code', 'User', 'settings.json'), source: 'VS Code (user, linux)', clientKey: 'vscode' },
+        { path: path.join(home, '.codeium', 'windsurf', 'mcp_config.json'), source: 'Windsurf', clientKey: 'windsurf' },
+        { path: path.join(home, '.kiro', 'mcp.json'), source: 'Kiro', clientKey: 'kiro' },
+        { path: path.join(cwd, '.mcp.json'), source: 'Repo (.mcp.json)', clientKey: 'other' },
+        { path: path.join(cwd, 'mcp.json'), source: 'Repo (mcp.json)', clientKey: 'other' },
+    ];
+    for (const candidate of claudeDesktopConfigCandidates()) {
+        list.push({ path: candidate.file, source: candidate.source, clientKey: 'claude_desktop' });
+    }
+    if (process.platform === 'win32') {
+        list.push({
+            path: path.join(process.env.ProgramData || 'C:\\ProgramData', 'Cursor', 'managed-mcp.json'),
+            source: 'Cursor (managed, program data)',
+            clientKey: 'cursor',
+        });
+    }
+    if (extra) {
+        list.push({ path: path.resolve(extra), source: 'Custom path', clientKey: 'other' });
+    }
+    const seen = new Set();
+    return list.filter(item => {
+        const key = path.resolve(item.path).toLowerCase();
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/** Include config paths for apps that exist on disk even when the MCP file is not created yet. */
+function discoverScanTargets(cwd, extra) {
+    const candidates = candidateConfigPaths(cwd, extra);
+    const existing = candidates.filter(item => fs.existsSync(item.path));
+    const implicit = [];
+    if (claudeDesktopLikelyInstalled()) {
+        for (const target of claudeDesktopInstallTargets()) {
+            if (!existing.some(item => path.resolve(item.path).toLowerCase() === path.resolve(target.file).toLowerCase())) {
+                implicit.push({ path: target.file, source: target.source, clientKey: 'claude_desktop' });
+            }
+        }
+    }
+    const cursorGlobal = path.join(os.homedir(), '.cursor', 'mcp.json');
+    if (fs.existsSync(path.join(os.homedir(), '.cursor')) && !existing.some(item => path.resolve(item.path).toLowerCase() === cursorGlobal.toLowerCase())) {
+        implicit.push({ path: cursorGlobal, source: 'Cursor (global)', clientKey: 'cursor' });
+    }
+    return [...existing, ...implicit];
+}

package/dist/commands/knownMcpServers.d.ts

@@ -0,0 +1,8 @@
+export interface KnownMcpServerInfo {
+    title: string;
+    description: string;
+    category: 'browser' | 'filesystem' | 'database' | 'gateway' | 'other';
+    recommendGateway: boolean;
+}
+export declare function knownMcpServerInfo(serverName: string, command?: string): KnownMcpServerInfo | undefined;
+export declare function directServerFixHint(serverName: string): string | undefined;

package/dist/commands/knownMcpServers.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.knownMcpServerInfo = knownMcpServerInfo;
+exports.directServerFixHint = directServerFixHint;
+const KNOWN = [
+    {
+        match: /playwright/i,
+        info: {
+            title: 'Playwright',
+            description: 'Browser automation — AI can open sites, click, and act as the logged-in user.',
+            category: 'browser',
+            recommendGateway: true,
+        },
+    },
+    {
+        match: /puppeteer|selenium|browser/i,
+        info: {
+            title: 'Browser automation',
+            description: 'Controls a web browser on the developer machine.',
+            category: 'browser',
+            recommendGateway: true,
+        },
+    },
+    {
+        match: /filesystem|server-filesystem/i,
+        info: {
+            title: 'Filesystem',
+            description: 'Reads and writes local files — high exfiltration risk.',
+            category: 'filesystem',
+            recommendGateway: true,
+        },
+    },
+    {
+        match: /postgres|mysql|sqlite|database|supabase/i,
+        info: {
+            title: 'Database',
+            description: 'Queries databases directly from the AI client.',
+            category: 'database',
+            recommendGateway: true,
+        },
+    },
+    {
+        match: /agentguard-gateway|fullcourtdefense-gateway|fcd-gateway/i,
+        info: {
+            title: 'FCD MCP gateway',
+            description: 'Full Court Defense proxy — tool calls checked by Shield and Action Policies.',
+            category: 'gateway',
+            recommendGateway: false,
+        },
+    },
+];
+function knownMcpServerInfo(serverName, command) {
+    const hay = `${serverName} ${command || ''}`;
+    for (const entry of KNOWN) {
+        if (entry.match.test(hay))
+            return entry.info;
+    }
+    return undefined;
+}
+function directServerFixHint(serverName) {
+    const info = knownMcpServerInfo(serverName);
+    if (!info?.recommendGateway)
+        return undefined;
+    if (/playwright/i.test(serverName)) {
+        return 'Remove Playwright from mcp.json or route it through: fullcourtdefense install-mcp-gateway --clients all --mcp-command ...';
+    }
+    return 'Route through FCD gateway: fullcourtdefense install-mcp-gateway --clients all --mcp-command npm --mcp-args "run mcp"';
+}

package/dist/commands/mcpGateway.d.ts

@@ -34,6 +34,8 @@ export interface InstallMcpGatewayArgs extends McpGatewayArgs {
     cursorProject?: string;
     claudeCodeScope?: string;
     serverName?: string;
+    upload?: string;
+    apiKey?: string;
 }
 export declare function mcpGatewayCommand(args: McpGatewayArgs, config: BotGuardConfig): Promise<void>;
 export declare function installCursorMcpGatewayCommand(args: InstallCursorMcpGatewayArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/mcpGateway.js

@@ -42,6 +42,8 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
+const discoverPaths_1 = require("./discoverPaths");
+const discover_1 = require("./discover");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 const MANAGED_SERVER_NAME = 'agentguard-gateway';
 function parseArgsList(value) {
@@ -672,83 +674,6 @@ function writeMcpServerConfig(file, serverName, nodeExe, commandArgs) {
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, `${JSON.stringify(json, null, 2)}\n`, 'utf8');
 }
-function dedupePaths(candidates) {
-    const seen = new Set();
-    return candidates.filter(candidate => {
-        const key = path.resolve(candidate.file).toLowerCase();
-        if (seen.has(key))
-            return false;
-        seen.add(key);
-        return true;
-    });
-}
-function claudeDesktopMcpPath() {
-    const home = os.homedir();
-    if (process.platform === 'win32') {
-        const appData = process.env.APPDATA || path.join(home, 'AppData', 'Roaming');
-        return path.join(appData, 'Claude', 'claude_desktop_config.json');
-    }
-    if (process.platform === 'darwin') {
-        return path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
-    }
-    const xdg = process.env.XDG_CONFIG_HOME || path.join(home, '.config');
-    return path.join(xdg, 'Claude', 'claude_desktop_config.json');
-}
-function claudeDesktopMsixCandidates() {
-    if (process.platform !== 'win32')
-        return [];
-    const localAppData = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
-    const packagesDir = path.join(localAppData, 'Packages');
-    let packageNames = [];
-    try {
-        packageNames = fs.readdirSync(packagesDir)
-            .filter(name => /^Claude_/i.test(name));
-    }
-    catch {
-        return [];
-    }
-    return packageNames.map(name => {
-        const file = path.join(packagesDir, name, 'LocalCache', 'Roaming', 'Claude', 'claude_desktop_config.json');
-        return {
-            file,
-            source: 'Claude Desktop (Microsoft Store/MSIX)',
-            exists: fs.existsSync(file),
-        };
-    });
-}
-function claudeDesktopMcpCandidates() {
-    const documented = claudeDesktopMcpPath();
-    const normal = {
-        file: documented,
-        source: process.platform === 'win32'
-            ? 'Claude Desktop (Windows documented AppData)'
-            : process.platform === 'darwin'
-                ? 'Claude Desktop (macOS)'
-                : 'Claude Desktop (Linux/XDG)',
-        exists: fs.existsSync(documented),
-    };
-    // Store/MSIX Claude Desktop reads a virtualized AppData path. Prefer it when present.
-    return dedupePaths([
-        ...claudeDesktopMsixCandidates(),
-        normal,
-    ]);
-}
-function claudeDesktopInstallTargets(configPath) {
-    if (configPath) {
-        const file = path.resolve(configPath);
-        return [{ file, source: 'Claude Desktop (custom config path)', exists: fs.existsSync(file) }];
-    }
-    const candidates = claudeDesktopMcpCandidates();
-    const existing = candidates.filter(candidate => candidate.exists);
-    if (existing.length > 0)
-        return existing;
-    const msix = candidates.find(candidate => candidate.source.includes('MSIX'));
-    return [msix || candidates[candidates.length - 1] || {
-            file: claudeDesktopMcpPath(),
-            source: 'Claude Desktop',
-            exists: false,
-        }];
-}
 function normalizeClaudeCodeScope(scope) {
     if (scope === 'project' || scope === 'user' || scope === 'local')
         return scope;
@@ -791,9 +716,8 @@ function detectInstallClients(cursorProject) {
         clients.push('cursor');
     if (commandAvailable('claude'))
         clients.push('claude-code');
-    if (claudeDesktopMcpCandidates().some(candidate => candidate.exists) || fs.existsSync(path.dirname(claudeDesktopMcpPath()))) {
+    if ((0, discoverPaths_1.claudeDesktopLikelyInstalled)())
         clients.push('claude-desktop');
-    }
     return clients;
 }
 function clientInstallArgs(args) {
@@ -841,7 +765,9 @@ async function installCursorMcpGatewayCommand(args, config) {
 async function installMcpGatewayCommand(args, config) {
     const cursorProject = args.cursorProject === 'true';
     const selection = parseClientList(args.clients);
-    const clients = selection === 'auto' ? detectInstallClients(cursorProject) : selection;
+    const clients = selection === 'auto'
+        ? detectInstallClients(cursorProject)
+        : selection;
     if (clients.length === 0) {
         throw new Error('No supported MCP clients detected. Re-run with --clients all or a comma list such as cursor,claude-desktop.');
     }
@@ -876,6 +802,19 @@ async function installMcpGatewayCommand(args, config) {
     console.log(`Runtime identity: ${detectedDeveloperName(args)}`);
     console.log('Restart/reload each client to use the protected tools.');
     console.log('Smoke test prompt: "Use lookup_customer to look up customer C-1001."');
+    if (args.upload === 'true') {
+        console.log('');
+        console.log('Uploading desktop inventory to AI Inventory…');
+        await (0, discover_1.runDiscoverUpload)({
+            apiKey: args.apiKey || config.apiKey,
+            apiUrl: args.apiUrl,
+            userEmail: args.developerName,
+            silent: false,
+        }, config);
+    }
+    else {
+        console.log('Run with --upload to refresh AI Inventory / Desktop MCP coverage in the app.');
+    }
 }
 async function installClaudeCodeMcpGatewayCommand(args, config) {
     const gatewayConfig = resolveGatewayConfig(args, config, {
@@ -940,7 +879,7 @@ async function installClaudeDesktopMcpGatewayCommand(args, config) {
         agentNamePrefix: 'claude-desktop',
         userObjective: 'Developer requested this action from Claude Desktop.',
     });
-    const targets = claudeDesktopInstallTargets(args.configPath);
+    const targets = (0, discoverPaths_1.claudeDesktopInstallTargets)(args.configPath);
     const nodeExe = process.execPath;
     const serverName = args.serverName || MANAGED_SERVER_NAME;
     const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;

package/dist/index.js

@@ -208,7 +208,7 @@ function printHelp() {
     $ fullcourtdefense install-cursor-hook --project true       # this repo only
     $ fullcourtdefense uninstall-cursor-hook
     $ fullcourtdefense install-mcp-gateway --clients auto --shield-id <id> --shield-key <key> --mcp-command npm --mcp-args "run mcp"
-    $ fullcourtdefense install-mcp-gateway --clients all --mcp-command node --mcp-args ./server.js
+    $ fullcourtdefense install-mcp-gateway --clients all --shield-id <id> --shield-key <key> --mcp-command npm --mcp-args "run mcp" --upload --api-key <key>
     $ fullcourtdefense install-cursor-mcp-gateway --project true --shield-id <id> --shield-key <key> --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense install-claude-code-mcp-gateway --scope local --shield-id <id> --shield-key <key> --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense install-claude-code-mcp-gateway --scope project --shield-id <id> --mcp-command npm --mcp-args "run mcp"
@@ -406,6 +406,8 @@ async function main() {
                 approvalPollMs: flags['approval-poll-ms'],
                 scanResponse: flags['scan-response'],
                 failClosed: flags['fail-closed'],
+                upload: flags.upload,
+                apiKey: flags['api-key'],
             };
             await (0, mcpGateway_1.installMcpGatewayCommand)(args, config);
             break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {