fullcourtdefense-cli 1.5.1 → 1.5.3

package/dist/commands/mcpGateway.d.ts

@@ -61,6 +61,7 @@ export declare function installMcpGatewayCommand(args: InstallMcpGatewayArgs, co
 export interface ProtectAllArgs extends McpGatewayArgs {
     dryRun?: string;
     config?: string;
+    clients?: string;
 }
 export declare function protectAllCommand(args: ProtectAllArgs, config: BotGuardConfig): Promise<void>;
 export declare function unprotectAllCommand(args: ProtectAllArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/mcpGateway.js

@@ -811,7 +811,9 @@ function parseClientList(value) {
     };
     const requested = raw === 'all'
         ? exports.ALL_GATEWAY_CLIENTS.slice()
-        : raw.split(',').map(part => part.trim()).filter(Boolean);
+        // Accept commas OR whitespace: some shells (PowerShell) split a comma list
+        // into separate argv tokens that get re-joined with spaces.
+        : raw.split(/[\s,]+/).map(part => part.trim()).filter(Boolean);
     const clients = requested.map(client => aliases[client]);
     const unknown = requested.filter((part, index) => !clients[index]);
     if (unknown.length > 0) {
@@ -942,6 +944,24 @@ async function installMcpGatewayCommand(args, config) {
         console.log('Add --upload to refresh AI Fleet after install.');
     }
 }
+/** Map a high-level client to the discovery clientKey(s) its config files use. */
+const AGENT_TO_CLIENT_KEYS = {
+    cursor: ['cursor'],
+    'claude-code': ['claude_code'],
+    'claude-desktop': ['claude_desktop'],
+    codex: ['codex'],
+    'gemini-cli': ['gemini_cli'],
+    windsurf: ['windsurf'],
+    vscode: ['vscode'],
+};
+/** Resolve the optional --clients filter into a set of clientKeys, or undefined for "all". */
+function resolveProtectClientKeys(clients) {
+    const raw = (clients || '').trim().toLowerCase();
+    if (!raw || raw === 'auto' || raw === 'all')
+        return undefined; // no filter — process every client
+    const selection = parseClientList(clients);
+    return new Set(selection.flatMap(client => AGENT_TO_CLIENT_KEYS[client] || []));
+}
 const CLIENT_KEY_TO_AGENT = {
     cursor: 'cursor',
     claude_code: 'claude-code',
@@ -1218,24 +1238,29 @@ function transformCodexToml(file, mode, gatewayConfig, dryRun) {
     }
     return stats;
 }
-function protectAllTargetFiles(extra) {
+function protectAllTargetFiles(extra, allowedClientKeys) {
     const cwd = process.cwd();
     const seen = new Set();
+    const allow = (clientKey) => !allowedClientKeys || allowedClientKeys.has(clientKey);
     const files = [];
     for (const candidate of (0, discoverPaths_1.candidateConfigPaths)(cwd, extra)) {
         const key = path.resolve(candidate.path).toLowerCase();
         if (seen.has(key))
             continue;
+        if (!allow(candidate.clientKey))
+            continue;
         if (!fs.existsSync(candidate.path))
             continue;
         seen.add(key);
         files.push(candidate);
     }
-    for (const target of (0, discoverPaths_1.claudeDesktopInstallTargets)()) {
-        const key = path.resolve(target.file).toLowerCase();
-        if (target.exists && !seen.has(key)) {
-            seen.add(key);
-            files.push({ path: target.file, source: target.source, clientKey: 'claude_desktop' });
+    if (allow('claude_desktop')) {
+        for (const target of (0, discoverPaths_1.claudeDesktopInstallTargets)()) {
+            const key = path.resolve(target.file).toLowerCase();
+            if (target.exists && !seen.has(key)) {
+                seen.add(key);
+                files.push({ path: target.file, source: target.source, clientKey: 'claude_desktop' });
+            }
         }
     }
     return files;
@@ -1244,11 +1269,14 @@ async function protectAllCommand(args, config) {
     (0, config_1.requireCliSetup)(config, { shieldId: args.shieldId, shieldKey: args.shieldKey, apiUrl: args.apiUrl }, { requireOrganizationId: false });
     const gatewayConfig = resolveGatewayConfig(args, config);
     const dryRun = args.dryRun === 'true';
-    const files = protectAllTargetFiles(args.config);
+    const allowedClientKeys = resolveProtectClientKeys(args.clients);
+    const files = protectAllTargetFiles(args.config, allowedClientKeys);
     console.log('\n\x1b[1m\x1b[36mFullCourtDefense — protect every MCP server in every client\x1b[0m');
     console.log(`\x1b[2mRuntime identity: ${gatewayConfig.developerName}  |  Shield: ${gatewayConfig.shieldId}${dryRun ? '  |  DRY RUN' : ''}\x1b[0m\n`);
     if (files.length === 0) {
-        console.log('No MCP client config files found on this machine. Configure an MCP server in any client, then re-run.');
+        console.log(allowedClientKeys
+            ? 'No matching client config files found for the requested --clients. Try without --clients, or pick a client that is installed.'
+            : 'No MCP client config files found on this machine. Configure an MCP server in any client, then re-run.');
         return;
     }
     let totalWrapped = 0;
@@ -1285,7 +1313,8 @@ async function protectAllCommand(args, config) {
 }
 async function unprotectAllCommand(args, config) {
     const dryRun = args.dryRun === 'true';
-    const files = protectAllTargetFiles(args.config);
+    const allowedClientKeys = resolveProtectClientKeys(args.clients);
+    const files = protectAllTargetFiles(args.config, allowedClientKeys);
     let gatewayConfig;
     try {
         gatewayConfig = resolveGatewayConfig(args, config);

package/dist/index.js

@@ -128,8 +128,11 @@ function printHelp() {
                 (Cursor, Claude Code/Desktop, Codex, Gemini, Windsurf, VS Code)
                 and wrap each through the Shield proxy — no --mcp-command needed.
                 Enforces your org Action Policies on every tool. --dry-run to preview.
+                Per-tool: --clients cursor (or claude-code, claude-desktop, codex,
+                gemini-cli, windsurf, vscode; comma-separated). Default: all tools.
     unprotect-all
                 Reverse protect-all: restore every server to its original command.
+                Also supports --clients to target one tool, and --dry-run.
     install-mcp-gateway
                 Install MCP gateway into selected clients (--clients all for every tool).
     install-cursor-mcp-gateway
@@ -511,6 +514,7 @@ async function main() {
                 ...buildGatewayArgs(),
                 dryRun: flags['dry-run'],
                 config: flags.config,
+                clients: flags.clients,
             };
             await (0, mcpGateway_1.protectAllCommand)(args, config);
             break;
@@ -521,6 +525,7 @@ async function main() {
                 ...buildGatewayArgs(),
                 dryRun: flags['dry-run'],
                 config: flags.config,
+                clients: flags.clients,
             };
             await (0, mcpGateway_1.unprotectAllCommand)(args, config);
             break;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.5.1"
+  "version": "1.5.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.5.1",
+  "version": "1.5.3",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {