fullcourtdefense-cli 1.7.4 → 1.7.6

package/dist/commands/discover.js

@@ -511,6 +511,7 @@ async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName
         } : undefined,
         secrets: extras?.secrets?.findings.slice(0, 100).map(sanitizeSecretForUpload),
         agentFiles: extras?.agentFiles?.slice(0, 100).map(sanitizeAgentFileForUpload),
+        scanScope: extras?.scanScope,
         servers: servers.map(s => ({
             serverName: s.serverName,
             command: s.command,
@@ -691,7 +692,30 @@ async function discoverCommand(args, config) {
         }, null, 2));
         return;
     }
-    const uploadExtras = { secrets, agentFiles, posture };
+    const home = os.homedir();
+    const uploadExtras = {
+        secrets,
+        agentFiles,
+        posture,
+        scanScope: {
+            surfaces: [...surfaces],
+            workingDirectory: cwd,
+            mcpConfigPaths: scanned.map(s => ({ ...s, exists: fs.existsSync(s.path) })),
+            included: [
+                `Current command folder: ${cwd}`,
+                'Known MCP/AI client config files for Cursor, Claude, Codex, Gemini, Windsurf, and VS Code',
+                `User-level AI rules, skills, hooks, and instruction files under ${home}`,
+                `Credential stores and shell history under ${home}`,
+                `Environment files under ${cwd}, ${path.join(home, 'dev')}, ${path.join(home, 'repos')}, ${path.join(home, 'projects')}, ${path.join(home, 'Documents')}, and ${path.join(home, 'code')}`,
+            ],
+            excluded: [
+                'Unrelated project folders outside the listed roots',
+                'Large/generated dependency and build folders such as node_modules, .git, dist, build, vendor, caches, and temp folders',
+                'Full disk contents, browser profiles, email/chat archives, binary files, and operating-system folders',
+            ],
+            note: 'Desktop posture is a targeted AI-development exposure scan, not a full-device forensic scan. Run the command from the project folder you want represented.',
+        },
+    };
     async function maybeUpload() {
         if (args.upload !== 'true')
             return;

package/dist/commands/local-scan.js

@@ -972,7 +972,7 @@ function compactScanHtml(args) {
     .eyebrow { color: #1d4ed8; font-size: 12px; font-weight: 900; letter-spacing: .08em; text-transform: uppercase; }
     h1 { margin: 6px 0 8px; font-size: 26px; line-height: 1.15; }
     p { color: #475569; line-height: 1.55; }
-    .grid { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 12px; margin-top: 18px; }
+    .grid { display: grid; grid-template-columns: repeat(5, minmax(0, 1fr)); gap: 12px; margin-top: 18px; }
     .steps { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 10px; margin-top: 18px; }
     .step { border: 1px solid #e2e8f0; background: white; color: #64748b; border-radius: 16px; padding: 12px; font-size: 12px; font-weight: 900; }
     .step.active { border-color: #2563eb; background: #eff6ff; color: #1d4ed8; }
@@ -1011,6 +1011,10 @@ function compactScanHtml(args) {
     .resultMetric span { font-size: 16px; font-weight: 800; color: #0f172a; }
     .resultMeta { margin-top: 10px; color: #334155; font-size: 12px; line-height: 1.5; }
     .resultMeta a { color: #1d4ed8; }
+    .localTable { width: 100%; border-collapse: collapse; margin-top: 10px; font-size: 12px; overflow: hidden; border-radius: 12px; }
+    .localTable th, .localTable td { border-bottom: 1px solid #e2e8f0; padding: 8px; text-align: left; vertical-align: top; }
+    .localTable th { color: #475569; background: #f8fafc; font-size: 11px; text-transform: uppercase; letter-spacing: .05em; }
+    .copyBox { margin-top: 10px; }
     .hidden { display: none; }
     @media (max-width: 800px) { .grid, .two { grid-template-columns: 1fr; } }
   </style>
@@ -1049,7 +1053,8 @@ function compactScanHtml(args) {
         <div class="step" id="step-dot-3">3. Run red-team scan</div>
       </div>
       <div class="grid" id="cards">
-        <button class="card active" data-target="endpoint"><b>Endpoint</b><span>Internal agent/chat API</span></button>
+        <button class="card active" data-target="runner"><b>Run MCP Tool</b><span>Direct local call through proxy</span></button>
+        <button class="card" data-target="endpoint"><b>Endpoint</b><span>Internal agent/chat API</span></button>
         <button class="card" data-target="rag"><b>RAG</b><span>Retrieval URL or corpus path</span></button>
         <button class="card" data-target="mcp"><b>MCP</b><span>Tool server via stdio or HTTP</span></button>
         <button class="card" data-target="help"><b>Options</b><span>Same modes as web red-team scan</span></button>
@@ -1064,7 +1069,44 @@ function compactScanHtml(args) {
           <div class="muted">Choose Endpoint, RAG, or MCP. This runs from inside your organization.</div>
         </div>
       </div>
-      <div id="endpoint-fields">
+      <div id="runner-fields">
+        <div class="note">Run one MCP tool call from this machine. Use a protected proxy/gateway command or local MCP URL. Results stay local in this browser page.</div>
+        <div class="two">
+          <div>
+            <label>Protected MCP HTTP/SSE URL</label>
+            <input id="runnerMcpUrl" placeholder="http://127.0.0.1:5066/mcp" />
+          </div>
+          <div>
+            <label>Tool name</label>
+            <input id="runnerTool" placeholder="lookup_customer" />
+          </div>
+        </div>
+        <div class="two">
+          <div><label>Or stdio command</label><input id="runnerMcpCommand" placeholder="fullcourtdefense" /></div>
+          <div><label>Command args</label><input id="runnerMcpArgs" placeholder='mcp-gateway --mcp-command node --mcp-args "[&quot;./server.js&quot;]"' /></div>
+        </div>
+        <label>Tool arguments JSON</label>
+        <textarea id="runnerToolArgs" spellcheck="false">{
+  "customerId": "cus_123"
+}</textarea>
+        <div class="actions">
+          <button class="primary" id="runMcpTool">Run MCP tool</button>
+          <button class="secondary" id="copyMcpResult">Copy result</button>
+        </div>
+        <div id="mcpResultCard" class="resultCard hidden">
+          <div class="resultHead">
+            <div class="resultTitle">MCP tool result</div>
+            <span id="mcpResultStatus" class="statusTag">READY</span>
+          </div>
+          <div id="mcpResultTable"></div>
+          <div class="copyBox">
+            <label>Copyable JSON</label>
+            <textarea id="mcpResultJson" spellcheck="false" readonly></textarea>
+          </div>
+        </div>
+      </div>
+
+      <div id="endpoint-fields" class="hidden">
         <label>Internal endpoint URL</label>
         <input id="endpoint" placeholder="http://127.0.0.1:3000/chat" />
         <div class="two">
@@ -1098,7 +1140,7 @@ function compactScanHtml(args) {
       <div id="help-fields" class="hidden">
         <div class="note">Use Endpoint for internal chat APIs, RAG for retrieval/corpus injection checks, and MCP for tool output and tool-abuse red-team scans. Reports save back to the normal web report history when Shield key is configured.</div>
       </div>
-      <div class="actions">
+      <div class="actions" id="scanActions">
         <button class="secondary" id="command">Show CLI command</button>
         <button class="primary" id="connectNext">Continue to scan type</button>
       </div>
@@ -1170,14 +1212,15 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
     </section>
   </main>
   <script>
-    let target = 'endpoint';
+    let target = 'runner';
     let step = 1;
     const qs = new URLSearchParams(location.search);
-    if (['endpoint','rag','mcp'].includes(qs.get('target'))) target = qs.get('target');
+    if (['runner','endpoint','rag','mcp'].includes(qs.get('target'))) target = qs.get('target');
     const byId = id => document.getElementById(id);
     const sync = () => {
       document.querySelectorAll('.card').forEach(c => c.classList.toggle('active', c.dataset.target === target));
-      ['endpoint','rag','mcp','help'].forEach(id => byId(id + '-fields').classList.toggle('hidden', id !== target));
+      ['runner','endpoint','rag','mcp','help'].forEach(id => byId(id + '-fields').classList.toggle('hidden', id !== target));
+      byId('scanActions').classList.toggle('hidden', target === 'runner');
     };
     const setStep = next => {
       step = next;
@@ -1195,12 +1238,23 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
     byId('mcpUrl').value = qs.get('mcpUrl') || '';
     byId('mcpCommand').value = qs.get('mcpCommand') || '';
     byId('mcpArgs').value = qs.get('mcpArgs') || '';
+    byId('runnerMcpUrl').value = qs.get('mcpUrl') || '';
+    byId('runnerMcpCommand').value = qs.get('mcpCommand') || 'fullcourtdefense';
+    byId('runnerMcpArgs').value = qs.get('mcpArgs') || '';
+    byId('runnerTool').value = qs.get('mcpTool') || '';
     const payload = () => ({
       target, mode: byId('mode').value, format: byId('format').value,
       endpoint: byId('endpoint').value, inputField: byId('inputField').value, outputField: byId('outputField').value,
       ragUrl: byId('ragUrl').value, ragPath: byId('ragPath').value, ragInputField: byId('ragInputField').value, ragOutputField: byId('ragOutputField').value,
       mcpUrl: byId('mcpUrl').value, mcpCommand: byId('mcpCommand').value, mcpArgs: byId('mcpArgs').value, mcpTool: byId('mcpTool').value
     });
+    const mcpRunnerPayload = () => ({
+      mcpUrl: byId('runnerMcpUrl').value,
+      mcpCommand: byId('runnerMcpCommand').value,
+      mcpArgs: byId('runnerMcpArgs').value,
+      toolName: byId('runnerTool').value,
+      toolArgs: byId('runnerToolArgs').value
+    });
     const renderCommand = p => {
       const parts = ['fullcourtdefense scan --local --type', p.target, '--mode', p.mode, '--format', p.format, '--no-open'];
       if (p.target === 'endpoint') parts.push('--endpoint', JSON.stringify(p.endpoint), '--method POST --request-format custom --input-field', p.inputField || 'message', '--output-field', p.outputField || 'response');
@@ -1255,7 +1309,7 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
         : 'No saved web report URL found in this output.';
     };
     const resetForNewScan = () => {
-      target = 'endpoint';
+      target = 'runner';
       sync();
       setStep(1);
       byId('endpoint').value = '';
@@ -1269,6 +1323,14 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
       byId('mcpCommand').value = '';
       byId('mcpArgs').value = '';
       byId('mcpTool').value = 'all';
+      byId('runnerMcpUrl').value = '';
+      byId('runnerMcpCommand').value = 'fullcourtdefense';
+      byId('runnerMcpArgs').value = '';
+      byId('runnerTool').value = '';
+      byId('runnerToolArgs').value = '{\\n  "customerId": "cus_123"\\n}';
+      byId('mcpResultCard').classList.add('hidden');
+      byId('mcpResultJson').value = '';
+      byId('mcpResultTable').innerHTML = '';
       byId('mode').value = 'quick';
       byId('format').value = 'report';
       clearScanSummary();
@@ -1331,6 +1393,67 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
     };
     byId('checkBackend').onclick = checkBackend;
     checkBackend().catch(() => {});
+    function mcpRows(value) {
+      if (Array.isArray(value)) return value;
+      const content = value && value.content;
+      if (Array.isArray(content)) {
+        const textItem = content.find(item => item && typeof item.text === 'string');
+        if (textItem) {
+          try {
+            const parsed = JSON.parse(textItem.text);
+            if (Array.isArray(parsed)) return parsed;
+            if (parsed && Array.isArray(parsed.data)) return parsed.data;
+            if (parsed && Array.isArray(parsed.results)) return parsed.results;
+          } catch {}
+        }
+      }
+      if (value && Array.isArray(value.data)) return value.data;
+      if (value && Array.isArray(value.results)) return value.results;
+      return null;
+    }
+    function renderMcpResult(data) {
+      byId('mcpResultCard').classList.remove('hidden');
+      byId('mcpResultStatus').textContent = data.success ? 'ALLOW / RESULT' : 'ERROR / BLOCK';
+      byId('mcpResultStatus').className = data.success ? 'statusTag pass' : 'statusTag fail';
+      byId('mcpResultJson').value = JSON.stringify(data, null, 2);
+      const rows = data.success ? mcpRows(data.result) : null;
+      if (rows && rows.length && rows.every(row => row && typeof row === 'object' && !Array.isArray(row))) {
+        const keys = Array.from(new Set(rows.flatMap(row => Object.keys(row)))).slice(0, 8);
+        byId('mcpResultTable').innerHTML = '<table class="localTable"><thead><tr>' + keys.map(k => '<th>' + htmlEscape(k) + '</th>').join('') + '</tr></thead><tbody>' +
+          rows.slice(0, 25).map(row => '<tr>' + keys.map(k => '<td>' + htmlEscape(typeof row[k] === 'object' ? JSON.stringify(row[k]) : String(row[k] ?? '')) + '</td>').join('') + '</tr>').join('') +
+          '</tbody></table>';
+      } else {
+        byId('mcpResultTable').innerHTML = '<div class="resultMeta">' + (data.success ? 'Result is shown as copyable JSON below.' : htmlEscape(data.error || 'MCP call failed.')) + '</div>';
+      }
+    }
+    byId('copyMcpResult').onclick = async () => {
+      await navigator.clipboard?.writeText(byId('mcpResultJson').value || '').catch(() => undefined);
+      byId('copyMcpResult').textContent = 'Copied';
+      setTimeout(() => { byId('copyMcpResult').textContent = 'Copy result'; }, 1200);
+    };
+    byId('runMcpTool').onclick = async () => {
+      byId('runMcpTool').disabled = true;
+      byId('runMcpTool').textContent = 'Running...';
+      byId('mcpResultCard').classList.add('hidden');
+      setConsole('Calling MCP tool locally through configured proxy/server...\\n', 'Running MCP');
+      try {
+        const res = await fetch('/mcp/run', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(mcpRunnerPayload())
+        });
+        const data = await res.json();
+        renderMcpResult(data);
+        setConsole(JSON.stringify(data, null, 2), data.success ? 'MCP complete' : 'MCP blocked/error');
+      } catch (error) {
+        const data = { success: false, error: error && error.message ? error.message : String(error) };
+        renderMcpResult(data);
+        setConsole(JSON.stringify(data, null, 2), 'MCP error');
+      } finally {
+        byId('runMcpTool').disabled = false;
+        byId('runMcpTool').textContent = 'Run MCP tool';
+      }
+    };
     byId('run').onclick = async () => {
       if (byId('run').disabled) return;
       byId('run').disabled = true;
@@ -1455,6 +1578,63 @@ async function runCliFromBrowser(body, onChunk) {
         });
     });
 }
+function createMcpClient(options) {
+    if (options.transport === 'sse')
+        return new SseMcpClient(options);
+    if (options.transport === 'http')
+        return new HttpMcpClient(options);
+    return new StdioMcpClient(options.command || '', options.args || []);
+}
+async function runMcpToolFromBrowser(body) {
+    const rawUrl = typeof body.mcpUrl === 'string' ? body.mcpUrl.trim() : '';
+    const rawCommand = typeof body.mcpCommand === 'string' ? body.mcpCommand.trim() : '';
+    const rawArgs = typeof body.mcpArgs === 'string' ? body.mcpArgs.trim() : '';
+    const toolName = typeof body.toolName === 'string' ? body.toolName.trim() : '';
+    if (!toolName)
+        throw new Error('Tool name is required.');
+    if (!rawUrl && !rawCommand)
+        throw new Error('Provide either a protected MCP URL or stdio command.');
+    const transport = rawUrl
+        ? (/\/sse\/?$/.test(new URL(rawUrl).pathname) ? 'sse' : 'http')
+        : 'stdio';
+    const toolArgs = parseJsonObject(typeof body.toolArgs === 'string' ? body.toolArgs : JSON.stringify(body.toolArgs || {}));
+    const options = {
+        transport,
+        url: rawUrl || undefined,
+        command: rawCommand || undefined,
+        args: parseArgsList(rawArgs),
+        authType: 'none',
+        toolName,
+        toolArgs,
+    };
+    const client = createMcpClient(options);
+    const startedAt = Date.now();
+    try {
+        await client.initialize();
+        const result = await client.callTool(toolName, toolArgs);
+        return {
+            success: true,
+            toolName,
+            transport,
+            destination: rawUrl || `${rawCommand} ${options.args?.join(' ') || ''}`.trim(),
+            elapsedMs: Date.now() - startedAt,
+            result,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            toolName,
+            transport,
+            destination: rawUrl || `${rawCommand} ${options.args?.join(' ') || ''}`.trim(),
+            elapsedMs: Date.now() - startedAt,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+    finally {
+        client.close();
+    }
+}
 function startCompactWebServer(args) {
     const server = http.createServer(async (req, res) => {
         try {
@@ -1504,6 +1684,13 @@ function startCompactWebServer(args) {
                 res.end(JSON.stringify(check));
                 return;
             }
+            if (req.method === 'POST' && url.pathname === '/mcp/run') {
+                const body = await readRequestBody(req);
+                const result = await runMcpToolFromBrowser(body);
+                res.writeHead(result.success ? 200 : 400, { 'content-type': 'application/json; charset=utf-8' });
+                res.end(JSON.stringify(result));
+                return;
+            }
             if (req.method === 'POST' && url.pathname === '/run') {
                 const body = await readRequestBody(req);
                 res.writeHead(200, {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.7.4"
+  "version": "1.7.6"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.7.4",
+  "version": "1.7.6",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {