fullcourtdefense-cli 1.3.0 → 1.3.1

package/dist/commands/discover.js

@@ -103,6 +103,55 @@ function scoreRisk(s) {
     }
     return { level, tags };
 }
+function pushDiscoveredServer(out, name, cfgRaw, source, configPath) {
+    const cfg = (cfgRaw || {});
+    const command = typeof cfg.command === 'string' ? cfg.command : undefined;
+    const args = Array.isArray(cfg.args) ? cfg.args.map(String) : undefined;
+    const url = typeof cfg.url === 'string' ? cfg.url : (typeof cfg.serverUrl === 'string' ? cfg.serverUrl : undefined);
+    const env = (cfg.env && typeof cfg.env === 'object') ? cfg.env : {};
+    const envKeys = Object.keys(env);
+    const transport = url
+        ? (/\/sse(\b|$)/.test(url) ? 'sse' : 'http')
+        : command ? 'stdio' : 'unknown';
+    const tools = Array.isArray(cfg.tools)
+        ? cfg.tools
+            .map((t) => {
+            if (typeof t === 'string')
+                return { name: t };
+            if (t && typeof t.name === 'string')
+                return { name: t.name, description: typeof t.description === 'string' ? t.description : undefined };
+            return null;
+        })
+            .filter(Boolean)
+        : [];
+    const { level, tags } = scoreRisk({ serverName: name, command, args, url });
+    const warnings = [];
+    const blob = `${command || ''} ${(args || []).join(' ')} ${JSON.stringify(env)}`;
+    if (SECRET_VALUE.test(blob))
+        warnings.push('Hardcoded secret/API token detected in config (rotate + use env var).');
+    for (const [k, v] of Object.entries(env)) {
+        const val = String(v ?? '');
+        if (SECRET_KEY.test(k) && val && !/^\$\{?[A-Za-z0-9_]+\}?$/.test(val)) {
+            warnings.push(`Env "${k}" appears to contain a literal secret value.`);
+        }
+    }
+    out.push({
+        serverName: name,
+        command,
+        args,
+        url,
+        transport,
+        envKeys,
+        tools,
+        source,
+        configPath,
+        riskLevel: level,
+        riskTags: tags,
+        warnings,
+        probeMode: 'config',
+        proxyStatus: 'unknown',
+    });
+}
 function parseConfigFile(filePath, source) {
     let raw;
     try {
@@ -118,56 +167,21 @@ function parseConfigFile(filePath, source) {
     catch {
         return [];
     }
-    const servers = extractServerMap(parsed);
     const out = [];
-    for (const [name, cfgRaw] of Object.entries(servers)) {
-        const cfg = (cfgRaw || {});
-        const command = typeof cfg.command === 'string' ? cfg.command : undefined;
-        const args = Array.isArray(cfg.args) ? cfg.args.map(String) : undefined;
-        const url = typeof cfg.url === 'string' ? cfg.url : (typeof cfg.serverUrl === 'string' ? cfg.serverUrl : undefined);
-        const env = (cfg.env && typeof cfg.env === 'object') ? cfg.env : {};
-        const envKeys = Object.keys(env);
-        const transport = url
-            ? (/\/sse(\b|$)/.test(url) ? 'sse' : 'http')
-            : command ? 'stdio' : 'unknown';
-        const tools = Array.isArray(cfg.tools)
-            ? cfg.tools
-                .map((t) => {
-                if (typeof t === 'string')
-                    return { name: t };
-                if (t && typeof t.name === 'string')
-                    return { name: t.name, description: typeof t.description === 'string' ? t.description : undefined };
-                return null;
-            })
-                .filter(Boolean)
-            : [];
-        const { level, tags } = scoreRisk({ serverName: name, command, args, url });
-        const warnings = [];
-        const blob = `${command || ''} ${(args || []).join(' ')} ${JSON.stringify(env)}`;
-        if (SECRET_VALUE.test(blob))
-            warnings.push('Hardcoded secret/API token detected in config (rotate + use env var).');
-        for (const [k, v] of Object.entries(env)) {
-            const val = String(v ?? '');
-            if (SECRET_KEY.test(k) && val && !/^\$\{?[A-Za-z0-9_]+\}?$/.test(val)) {
-                warnings.push(`Env "${k}" appears to contain a literal secret value.`);
+    for (const [name, cfgRaw] of Object.entries(extractServerMap(parsed))) {
+        pushDiscoveredServer(out, name, cfgRaw, source, filePath);
+    }
+    // Claude Code stores MCP per-project inside ~/.claude.json
+    if (/claude code/i.test(source) && parsed?.projects && typeof parsed.projects === 'object') {
+        for (const [projectPath, projectCfg] of Object.entries(parsed.projects)) {
+            const projectServers = projectCfg?.mcpServers;
+            if (!projectServers || typeof projectServers !== 'object')
+                continue;
+            const projectLabel = projectPath.split(/[/\\]/).filter(Boolean).slice(-1)[0] || projectPath;
+            for (const [name, cfgRaw] of Object.entries(projectServers)) {
+                pushDiscoveredServer(out, name, cfgRaw, `${source} · ${projectLabel}`, filePath);
             }
         }
-        out.push({
-            serverName: name,
-            command,
-            args,
-            url,
-            transport,
-            envKeys,
-            tools,
-            source,
-            configPath: filePath,
-            riskLevel: level,
-            riskTags: tags,
-            warnings,
-            probeMode: 'config',
-            proxyStatus: 'unknown',
-        });
     }
     return out;
 }
@@ -256,13 +270,14 @@ async function enrichWithDeepProbe(servers, silent) {
         server.probeMode = 'deep';
     }
 }
-/** Merge servers found in multiple files; keep richest record, union sources. */
+/** Dedupe within the same config file + server name only (keep separate entries per client config path). */
 function dedupe(servers) {
-    const byName = new Map();
+    const byKey = new Map();
     for (const s of servers) {
-        const existing = byName.get(s.serverName);
+        const key = `${s.configPath.toLowerCase()}::${s.serverName.toLowerCase()}`;
+        const existing = byKey.get(key);
         if (!existing) {
-            byName.set(s.serverName, { ...s, source: s.source });
+            byKey.set(key, { ...s });
             continue;
         }
         if (!existing.source.includes(s.source))
@@ -277,7 +292,7 @@ function dedupe(servers) {
         if (s.probeMode === 'deep')
             existing.probeMode = 'deep';
     }
-    return [...byName.values()];
+    return [...byKey.values()];
 }
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {