fullcourtdefense-cli 1.7.5 → 1.7.7

package/dist/commands/local-scan.js

@@ -972,7 +972,7 @@ function compactScanHtml(args) {
     .eyebrow { color: #1d4ed8; font-size: 12px; font-weight: 900; letter-spacing: .08em; text-transform: uppercase; }
     h1 { margin: 6px 0 8px; font-size: 26px; line-height: 1.15; }
     p { color: #475569; line-height: 1.55; }
-    .grid { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 12px; margin-top: 18px; }
+    .grid { display: grid; grid-template-columns: repeat(5, minmax(0, 1fr)); gap: 12px; margin-top: 18px; }
     .steps { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 10px; margin-top: 18px; }
     .step { border: 1px solid #e2e8f0; background: white; color: #64748b; border-radius: 16px; padding: 12px; font-size: 12px; font-weight: 900; }
     .step.active { border-color: #2563eb; background: #eff6ff; color: #1d4ed8; }
@@ -1011,6 +1011,17 @@ function compactScanHtml(args) {
     .resultMetric span { font-size: 16px; font-weight: 800; color: #0f172a; }
     .resultMeta { margin-top: 10px; color: #334155; font-size: 12px; line-height: 1.5; }
     .resultMeta a { color: #1d4ed8; }
+    .mcpBanner { margin-top: 10px; border-radius: 14px; padding: 12px; font-size: 13px; line-height: 1.45; }
+    .mcpBanner.ok { border: 1px solid #bbf7d0; background: #f0fdf4; color: #166534; }
+    .mcpBanner.blocked { border: 1px solid #fecaca; background: #fef2f2; color: #991b1b; }
+    .mcpCards { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 10px; margin-top: 10px; }
+    .mcpCard { border: 1px solid #e2e8f0; background: white; border-radius: 12px; padding: 10px; }
+    .mcpCard b { display: block; color: #64748b; font-size: 11px; text-transform: uppercase; letter-spacing: .05em; margin-bottom: 4px; }
+    .mcpCard span { color: #0f172a; font-size: 13px; font-weight: 750; overflow-wrap: anywhere; }
+    .localTable { width: 100%; border-collapse: collapse; margin-top: 10px; font-size: 12px; overflow: hidden; border-radius: 12px; }
+    .localTable th, .localTable td { border-bottom: 1px solid #e2e8f0; padding: 8px; text-align: left; vertical-align: top; }
+    .localTable th { color: #475569; background: #f8fafc; font-size: 11px; text-transform: uppercase; letter-spacing: .05em; }
+    .copyBox { margin-top: 10px; }
     .hidden { display: none; }
     @media (max-width: 800px) { .grid, .two { grid-template-columns: 1fr; } }
   </style>
@@ -1049,7 +1060,8 @@ function compactScanHtml(args) {
         <div class="step" id="step-dot-3">3. Run red-team scan</div>
       </div>
       <div class="grid" id="cards">
-        <button class="card active" data-target="endpoint"><b>Endpoint</b><span>Internal agent/chat API</span></button>
+        <button class="card active" data-target="runner"><b>Run MCP Tool</b><span>Direct local call through proxy</span></button>
+        <button class="card" data-target="endpoint"><b>Endpoint</b><span>Internal agent/chat API</span></button>
         <button class="card" data-target="rag"><b>RAG</b><span>Retrieval URL or corpus path</span></button>
         <button class="card" data-target="mcp"><b>MCP</b><span>Tool server via stdio or HTTP</span></button>
         <button class="card" data-target="help"><b>Options</b><span>Same modes as web red-team scan</span></button>
@@ -1064,7 +1076,44 @@ function compactScanHtml(args) {
           <div class="muted">Choose Endpoint, RAG, or MCP. This runs from inside your organization.</div>
         </div>
       </div>
-      <div id="endpoint-fields">
+      <div id="runner-fields">
+        <div class="note">Run one MCP tool call from this machine. Use a protected proxy/gateway command or local MCP URL. Results stay local in this browser page.</div>
+        <div class="two">
+          <div>
+            <label>Protected MCP HTTP/SSE URL</label>
+            <input id="runnerMcpUrl" placeholder="http://127.0.0.1:5066/mcp" />
+          </div>
+          <div>
+            <label>Tool name</label>
+            <input id="runnerTool" placeholder="lookup_customer" />
+          </div>
+        </div>
+        <div class="two">
+          <div><label>Or stdio command</label><input id="runnerMcpCommand" placeholder="fullcourtdefense" /></div>
+          <div><label>Command args</label><input id="runnerMcpArgs" placeholder='mcp-gateway --mcp-command node --mcp-args "[&quot;./server.js&quot;]"' /></div>
+        </div>
+        <label>Tool arguments JSON</label>
+        <textarea id="runnerToolArgs" spellcheck="false">{
+  "customerId": "cus_123"
+}</textarea>
+        <div class="actions">
+          <button class="primary" id="runMcpTool">Run MCP tool</button>
+          <button class="secondary" id="copyMcpResult">Copy result</button>
+        </div>
+        <div id="mcpResultCard" class="resultCard hidden">
+          <div class="resultHead">
+            <div class="resultTitle">MCP tool result</div>
+            <span id="mcpResultStatus" class="statusTag">READY</span>
+          </div>
+          <div id="mcpResultTable"></div>
+          <div class="copyBox">
+            <label>Copyable JSON</label>
+            <textarea id="mcpResultJson" spellcheck="false" readonly></textarea>
+          </div>
+        </div>
+      </div>
+
+      <div id="endpoint-fields" class="hidden">
         <label>Internal endpoint URL</label>
         <input id="endpoint" placeholder="http://127.0.0.1:3000/chat" />
         <div class="two">
@@ -1098,7 +1147,7 @@ function compactScanHtml(args) {
       <div id="help-fields" class="hidden">
         <div class="note">Use Endpoint for internal chat APIs, RAG for retrieval/corpus injection checks, and MCP for tool output and tool-abuse red-team scans. Reports save back to the normal web report history when Shield key is configured.</div>
       </div>
-      <div class="actions">
+      <div class="actions" id="scanActions">
         <button class="secondary" id="command">Show CLI command</button>
         <button class="primary" id="connectNext">Continue to scan type</button>
       </div>
@@ -1170,14 +1219,15 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
     </section>
   </main>
   <script>
-    let target = 'endpoint';
+    let target = 'runner';
     let step = 1;
     const qs = new URLSearchParams(location.search);
-    if (['endpoint','rag','mcp'].includes(qs.get('target'))) target = qs.get('target');
+    if (['runner','endpoint','rag','mcp'].includes(qs.get('target'))) target = qs.get('target');
     const byId = id => document.getElementById(id);
     const sync = () => {
       document.querySelectorAll('.card').forEach(c => c.classList.toggle('active', c.dataset.target === target));
-      ['endpoint','rag','mcp','help'].forEach(id => byId(id + '-fields').classList.toggle('hidden', id !== target));
+      ['runner','endpoint','rag','mcp','help'].forEach(id => byId(id + '-fields').classList.toggle('hidden', id !== target));
+      byId('scanActions').classList.toggle('hidden', target === 'runner');
     };
     const setStep = next => {
       step = next;
@@ -1195,12 +1245,23 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
     byId('mcpUrl').value = qs.get('mcpUrl') || '';
     byId('mcpCommand').value = qs.get('mcpCommand') || '';
     byId('mcpArgs').value = qs.get('mcpArgs') || '';
+    byId('runnerMcpUrl').value = qs.get('mcpUrl') || '';
+    byId('runnerMcpCommand').value = qs.get('mcpCommand') || 'fullcourtdefense';
+    byId('runnerMcpArgs').value = qs.get('mcpArgs') || '';
+    byId('runnerTool').value = qs.get('mcpTool') || '';
     const payload = () => ({
       target, mode: byId('mode').value, format: byId('format').value,
       endpoint: byId('endpoint').value, inputField: byId('inputField').value, outputField: byId('outputField').value,
       ragUrl: byId('ragUrl').value, ragPath: byId('ragPath').value, ragInputField: byId('ragInputField').value, ragOutputField: byId('ragOutputField').value,
       mcpUrl: byId('mcpUrl').value, mcpCommand: byId('mcpCommand').value, mcpArgs: byId('mcpArgs').value, mcpTool: byId('mcpTool').value
     });
+    const mcpRunnerPayload = () => ({
+      mcpUrl: byId('runnerMcpUrl').value,
+      mcpCommand: byId('runnerMcpCommand').value,
+      mcpArgs: byId('runnerMcpArgs').value,
+      toolName: byId('runnerTool').value,
+      toolArgs: byId('runnerToolArgs').value
+    });
     const renderCommand = p => {
       const parts = ['fullcourtdefense scan --local --type', p.target, '--mode', p.mode, '--format', p.format, '--no-open'];
       if (p.target === 'endpoint') parts.push('--endpoint', JSON.stringify(p.endpoint), '--method POST --request-format custom --input-field', p.inputField || 'message', '--output-field', p.outputField || 'response');
@@ -1255,7 +1316,7 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
         : 'No saved web report URL found in this output.';
     };
     const resetForNewScan = () => {
-      target = 'endpoint';
+      target = 'runner';
       sync();
       setStep(1);
       byId('endpoint').value = '';
@@ -1269,6 +1330,14 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
       byId('mcpCommand').value = '';
       byId('mcpArgs').value = '';
       byId('mcpTool').value = 'all';
+      byId('runnerMcpUrl').value = '';
+      byId('runnerMcpCommand').value = 'fullcourtdefense';
+      byId('runnerMcpArgs').value = '';
+      byId('runnerTool').value = '';
+      byId('runnerToolArgs').value = '{\\n  "customerId": "cus_123"\\n}';
+      byId('mcpResultCard').classList.add('hidden');
+      byId('mcpResultJson').value = '';
+      byId('mcpResultTable').innerHTML = '';
       byId('mode').value = 'quick';
       byId('format').value = 'report';
       clearScanSummary();
@@ -1331,6 +1400,116 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
     };
     byId('checkBackend').onclick = checkBackend;
     checkBackend().catch(() => {});
+    function mcpRows(value) {
+      if (Array.isArray(value)) return value;
+      const content = value && value.content;
+      if (Array.isArray(content)) {
+        const textItem = content.find(item => item && typeof item.text === 'string');
+        if (textItem) {
+          try {
+            const parsed = JSON.parse(textItem.text);
+            if (Array.isArray(parsed)) return parsed;
+            if (parsed && Array.isArray(parsed.data)) return parsed.data;
+            if (parsed && Array.isArray(parsed.results)) return parsed.results;
+          } catch {}
+        }
+      }
+      if (value && Array.isArray(value.data)) return value.data;
+      if (value && Array.isArray(value.results)) return value.results;
+      return null;
+    }
+    function mcpText(value) {
+      if (value == null) return '';
+      if (typeof value === 'string') return value;
+      if (typeof value === 'number' || typeof value === 'boolean') return String(value);
+      const content = value.content;
+      if (Array.isArray(content)) {
+        return content
+          .map(item => item && typeof item.text === 'string' ? item.text : '')
+          .filter(Boolean)
+          .join('\\n');
+      }
+      return '';
+    }
+    function mcpObject(value) {
+      if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+      const contentText = mcpText(value);
+      if (contentText) {
+        try {
+          const parsed = JSON.parse(contentText);
+          if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) return parsed;
+        } catch {}
+      }
+      if (value.data && typeof value.data === 'object' && !Array.isArray(value.data)) return value.data;
+      if (value.result && typeof value.result === 'object' && !Array.isArray(value.result)) return value.result;
+      return value;
+    }
+    function cellValue(value) {
+      if (value == null) return '';
+      if (typeof value === 'object') return JSON.stringify(value);
+      return String(value);
+    }
+    function renderObjectCards(obj) {
+      const preferred = ['id', 'customerId', 'name', 'title', 'status', 'plan', 'email', 'decision', 'matchedPolicy', 'reason', 'ok'];
+      const keys = Array.from(new Set([...preferred.filter(k => Object.prototype.hasOwnProperty.call(obj, k)), ...Object.keys(obj)])).slice(0, 12);
+      return '<div class="mcpCards">' + keys.map(k => '<div class="mcpCard"><b>' + htmlEscape(k) + '</b><span>' + htmlEscape(cellValue(obj[k])) + '</span></div>').join('') + '</div>';
+    }
+    function renderMcpTable(rows) {
+      const preferred = ['id', 'customerId', 'name', 'title', 'status', 'plan', 'email', 'createdAt', 'updatedAt'];
+      const keys = Array.from(new Set([...preferred.filter(k => rows.some(row => row && Object.prototype.hasOwnProperty.call(row, k))), ...rows.flatMap(row => Object.keys(row || {}))])).slice(0, 10);
+      return '<table class="localTable"><thead><tr>' + keys.map(k => '<th>' + htmlEscape(k) + '</th>').join('') + '</tr></thead><tbody>' +
+        rows.slice(0, 50).map(row => '<tr>' + keys.map(k => '<td>' + htmlEscape(cellValue(row[k])) + '</td>').join('') + '</tr>').join('') +
+        '</tbody></table>' +
+        (rows.length > 50 ? '<div class="resultMeta">Showing first 50 rows. Full result is in raw JSON below.</div>' : '');
+    }
+    function renderMcpResult(data) {
+      byId('mcpResultCard').classList.remove('hidden');
+      byId('mcpResultStatus').textContent = data.blocked ? 'BLOCKED' : data.success ? 'ALLOW / RESULT' : 'ERROR';
+      byId('mcpResultStatus').className = data.success ? 'statusTag pass' : 'statusTag fail';
+      byId('mcpResultJson').value = JSON.stringify(data, null, 2);
+      const rows = data.success ? mcpRows(data.result) : null;
+      if (rows && rows.length && rows.every(row => row && typeof row === 'object' && !Array.isArray(row))) {
+        byId('mcpResultTable').innerHTML = '<div class="mcpBanner ok"><b>Allowed.</b> Tool returned ' + rows.length + ' row(s).</div>' + renderMcpTable(rows);
+      } else if (data.success) {
+        const obj = mcpObject(data.result);
+        const text = mcpText(data.result);
+        byId('mcpResultTable').innerHTML = '<div class="mcpBanner ok"><b>Allowed.</b> Tool call completed through the configured MCP server/proxy.</div>' +
+          (obj ? renderObjectCards(obj) : '<div class="resultMeta">' + htmlEscape(text || 'Result is shown as raw JSON below.') + '</div>');
+      } else {
+        const blockedCopy = data.blocked
+          ? 'Blocked because a FullCourtDefense policy or local safety rule is defined for this tool/action.'
+          : 'The MCP call failed before a successful tool result was returned.';
+        byId('mcpResultTable').innerHTML = '<div class="mcpBanner blocked"><b>' + (data.blocked ? 'Blocked by policy.' : 'MCP error.') + '</b> ' + htmlEscape(blockedCopy) + '<br/><span>' + htmlEscape(data.reason || data.error || 'No reason returned.') + '</span></div>';
+      }
+    }
+    byId('copyMcpResult').onclick = async () => {
+      await navigator.clipboard?.writeText(byId('mcpResultJson').value || '').catch(() => undefined);
+      byId('copyMcpResult').textContent = 'Copied';
+      setTimeout(() => { byId('copyMcpResult').textContent = 'Copy result'; }, 1200);
+    };
+    byId('runMcpTool').onclick = async () => {
+      byId('runMcpTool').disabled = true;
+      byId('runMcpTool').textContent = 'Running...';
+      byId('mcpResultCard').classList.add('hidden');
+      setConsole('Calling MCP tool locally through configured proxy/server...\\n', 'Running MCP');
+      try {
+        const res = await fetch('/mcp/run', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(mcpRunnerPayload())
+        });
+        const data = await res.json();
+        renderMcpResult(data);
+        setConsole(JSON.stringify(data, null, 2), data.success ? 'MCP complete' : 'MCP blocked/error');
+      } catch (error) {
+        const data = { success: false, error: error && error.message ? error.message : String(error) };
+        renderMcpResult(data);
+        setConsole(JSON.stringify(data, null, 2), 'MCP error');
+      } finally {
+        byId('runMcpTool').disabled = false;
+        byId('runMcpTool').textContent = 'Run MCP tool';
+      }
+    };
     byId('run').onclick = async () => {
       if (byId('run').disabled) return;
       byId('run').disabled = true;
@@ -1455,6 +1634,107 @@ async function runCliFromBrowser(body, onChunk) {
         });
     });
 }
+function createMcpClient(options) {
+    if (options.transport === 'sse')
+        return new SseMcpClient(options);
+    if (options.transport === 'http')
+        return new HttpMcpClient(options);
+    return new StdioMcpClient(options.command || '', options.args || []);
+}
+function parseMcpErrorResult(result) {
+    if (!result || typeof result !== 'object' || !result.isError)
+        return null;
+    const content = result.content;
+    const text = Array.isArray(content)
+        ? content.map(item => item && typeof item === 'object' && typeof item.text === 'string' ? item.text : '').filter(Boolean).join('\n')
+        : '';
+    if (text) {
+        try {
+            const parsed = JSON.parse(text);
+            if (parsed && typeof parsed === 'object') {
+                return {
+                    blocked: parsed.blocked === true || /policy|blocked|approval/i.test(text),
+                    reason: typeof parsed.reason === 'string' ? parsed.reason : text,
+                    details: parsed,
+                };
+            }
+        }
+        catch {
+            // plain-text MCP error
+        }
+    }
+    return {
+        blocked: /policy|blocked|approval|not allowed|denied/i.test(text),
+        reason: text || 'The MCP server returned an error result.',
+        details: result,
+    };
+}
+async function runMcpToolFromBrowser(body) {
+    const rawUrl = typeof body.mcpUrl === 'string' ? body.mcpUrl.trim() : '';
+    const rawCommand = typeof body.mcpCommand === 'string' ? body.mcpCommand.trim() : '';
+    const rawArgs = typeof body.mcpArgs === 'string' ? body.mcpArgs.trim() : '';
+    const toolName = typeof body.toolName === 'string' ? body.toolName.trim() : '';
+    if (!toolName)
+        throw new Error('Tool name is required.');
+    if (!rawUrl && !rawCommand)
+        throw new Error('Provide either a protected MCP URL or stdio command.');
+    const transport = rawUrl
+        ? (/\/sse\/?$/.test(new URL(rawUrl).pathname) ? 'sse' : 'http')
+        : 'stdio';
+    const toolArgs = parseJsonObject(typeof body.toolArgs === 'string' ? body.toolArgs : JSON.stringify(body.toolArgs || {}));
+    const options = {
+        transport,
+        url: rawUrl || undefined,
+        command: rawCommand || undefined,
+        args: parseArgsList(rawArgs),
+        authType: 'none',
+        toolName,
+        toolArgs,
+    };
+    const client = createMcpClient(options);
+    const startedAt = Date.now();
+    try {
+        await client.initialize();
+        const result = await client.callTool(toolName, toolArgs);
+        const errorResult = parseMcpErrorResult(result);
+        if (errorResult) {
+            return {
+                success: false,
+                blocked: errorResult.blocked,
+                toolName,
+                transport,
+                destination: rawUrl || `${rawCommand} ${options.args?.join(' ') || ''}`.trim(),
+                elapsedMs: Date.now() - startedAt,
+                reason: errorResult.reason,
+                result,
+                details: errorResult.details,
+            };
+        }
+        return {
+            success: true,
+            toolName,
+            transport,
+            destination: rawUrl || `${rawCommand} ${options.args?.join(' ') || ''}`.trim(),
+            elapsedMs: Date.now() - startedAt,
+            result,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            blocked: /policy|blocked|approval|not allowed|denied/i.test(error instanceof Error ? error.message : String(error)),
+            toolName,
+            transport,
+            destination: rawUrl || `${rawCommand} ${options.args?.join(' ') || ''}`.trim(),
+            elapsedMs: Date.now() - startedAt,
+            reason: error instanceof Error ? error.message : String(error),
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+    finally {
+        client.close();
+    }
+}
 function startCompactWebServer(args) {
     const server = http.createServer(async (req, res) => {
         try {
@@ -1504,6 +1784,13 @@ function startCompactWebServer(args) {
                 res.end(JSON.stringify(check));
                 return;
             }
+            if (req.method === 'POST' && url.pathname === '/mcp/run') {
+                const body = await readRequestBody(req);
+                const result = await runMcpToolFromBrowser(body);
+                res.writeHead(result.success ? 200 : 400, { 'content-type': 'application/json; charset=utf-8' });
+                res.end(JSON.stringify(result));
+                return;
+            }
             if (req.method === 'POST' && url.pathname === '/run') {
                 const body = await readRequestBody(req);
                 res.writeHead(200, {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.7.5"
+  "version": "1.7.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.7.5",
+  "version": "1.7.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {