general-coding-tools-mcp 1.0.0 → 1.0.2

package/dist/content.json.sha256

@@ -0,0 +1 @@
+3dd6626a96cf9447752a73c7ba0ce2c8fa696e640c3f55ebefb41e6788781af1

package/dist/index.d.ts

@@ -3,4 +3,7 @@
  * General Coding Tools MCP Server
  * Exposes skills and subagents as MCP resources and tools for use in Cursor, Claude, and Smithery.
  */
-export {};
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/** Returns a server instance for Smithery capability scanning. Loads real content when dist/content.json exists (e.g. when scan runs from project dir), otherwise uses empty content so the scan still succeeds. */
+export declare function createSandboxServer(): McpServer;
+export default createSandboxServer;

package/dist/index.js

@@ -7,159 +7,207 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { readFileSync, existsSync } from "fs";
+import { createHash } from "crypto";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
-const __dirname = dirname(fileURLToPath(import.meta.url));
-// Load bundled content (generated by scripts/bundle-content.cjs)
+// Support both ESM (import.meta.url) and CJS bundles (e.g. Smithery stdio scan) where it may be undefined
+function getContentDir() {
+    if (typeof import.meta !== "undefined" && import.meta.url) {
+        return dirname(fileURLToPath(import.meta.url));
+    }
+    if (typeof process !== "undefined" && process.cwd) {
+        return join(process.cwd(), "dist");
+    }
+    return ".";
+}
+const __dirname = getContentDir();
+/** Escape HTML special chars so embedded user input cannot inject script if client renders as HTML. */
+function escapeForEmbedding(s) {
+    return s
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+const EMPTY_CONTENT = {
+    skills: [],
+    subagents: [],
+    content: { skills: {}, subagents: {} },
+};
+// Load bundled content (generated by scripts/bundle-content.cjs); verify integrity via SHA-256
 function loadContent() {
     const contentPath = join(__dirname, "content.json");
+    const hashPath = join(__dirname, "content.json.sha256");
     if (!existsSync(contentPath)) {
-        throw new Error("content.json not found. Run 'npm run build' from mcp-server to bundle Skills and Subagents.");
+        // Allow running without content.json for capability scanning (e.g. Smithery build)
+        return EMPTY_CONTENT;
+    }
+    const raw = readFileSync(contentPath, "utf8");
+    if (existsSync(hashPath)) {
+        const expectedHash = readFileSync(hashPath, "utf8").trim();
+        const actualHash = createHash("sha256").update(raw, "utf8").digest("hex");
+        if (expectedHash !== actualHash) {
+            throw new Error("content.json integrity check failed (hash mismatch). Rebuild with 'npm run build' or ensure the file was not modified.");
+        }
     }
-    return JSON.parse(readFileSync(contentPath, "utf8"));
+    return JSON.parse(raw);
 }
-const DATA = loadContent();
 const RESOURCE_PREFIX = "general-coding-tools-mcp://";
-const server = new McpServer({
-    name: "general-coding-tools-mcp",
-    version: "1.0.0",
-});
-// --- Resources: one per skill, skill/reference, and subagent ---
-for (const s of DATA.skills) {
-    const uri = `${RESOURCE_PREFIX}skill/${s.id}`;
-    server.registerResource(`skill-${s.id}`, uri, {
-        title: `Skill: ${s.name}`,
-        description: `General Coding Tools skill: ${s.name}`,
-        mimeType: "text/markdown",
-    }, async () => {
-        const entry = DATA.content.skills[s.name];
-        return {
-            contents: [{ uri, mimeType: "text/markdown", text: entry.content }],
-        };
+/** Create an MCP server with the given content (or load from disk if not provided). Used for normal run and for Smithery createSandboxServer. */
+function createServer(contentOverride) {
+    const DATA = contentOverride ?? loadContent();
+    const server = new McpServer({
+        name: "general-coding-tools-mcp",
+        version: "1.0.0",
     });
-    if (DATA.content.skills[s.name]?.reference) {
-        const refUri = `${RESOURCE_PREFIX}skill/${s.id}/reference`;
-        server.registerResource(`skill-${s.id}-reference`, refUri, {
-            title: `Skill reference: ${s.name}`,
-            description: `Reference material for skill ${s.name}`,
+    // --- Resources: one per skill, skill/reference, and subagent ---
+    for (const s of DATA.skills) {
+        const uri = `${RESOURCE_PREFIX}skill/${s.id}`;
+        server.registerResource(`skill-${s.id}`, uri, {
+            title: `Skill: ${s.name}`,
+            description: `General Coding Tools skill: ${s.name}`,
             mimeType: "text/markdown",
         }, async () => {
             const entry = DATA.content.skills[s.name];
             return {
-                contents: [{ uri: refUri, mimeType: "text/markdown", text: entry.reference }],
+                contents: [{ uri, mimeType: "text/markdown", text: entry.content }],
             };
         });
+        if (DATA.content.skills[s.name]?.reference) {
+            const refUri = `${RESOURCE_PREFIX}skill/${s.id}/reference`;
+            server.registerResource(`skill-${s.id}-reference`, refUri, {
+                title: `Skill reference: ${s.name}`,
+                description: `Reference material for skill ${s.name}`,
+                mimeType: "text/markdown",
+            }, async () => {
+                const entry = DATA.content.skills[s.name];
+                return {
+                    contents: [{ uri: refUri, mimeType: "text/markdown", text: entry.reference }],
+                };
+            });
+        }
     }
-}
-for (const a of DATA.subagents) {
-    const uri = `${RESOURCE_PREFIX}subagent/${a.id}`;
-    server.registerResource(`subagent-${a.id}`, uri, {
-        title: `Subagent: ${a.name}`,
-        description: `General Coding Tools subagent: ${a.name}`,
-        mimeType: "text/markdown",
+    for (const a of DATA.subagents) {
+        const uri = `${RESOURCE_PREFIX}subagent/${a.id}`;
+        server.registerResource(`subagent-${a.id}`, uri, {
+            title: `Subagent: ${a.name}`,
+            description: `General Coding Tools subagent: ${a.name}`,
+            mimeType: "text/markdown",
+        }, async () => {
+            const entry = DATA.content.subagents[a.name];
+            return {
+                contents: [{ uri, mimeType: "text/markdown", text: entry.content }],
+            };
+        });
+    }
+    // --- Tools ---
+    server.registerTool("list_skills", {
+        title: "List skills",
+        description: "List all available General Coding Tools skills (e.g. systematic-debugging, correctness-audit).",
+        inputSchema: z.object({}),
     }, async () => {
-        const entry = DATA.content.subagents[a.name];
-        return {
-            contents: [{ uri, mimeType: "text/markdown", text: entry.content }],
-        };
+        const list = DATA.skills.map((s) => ({ id: s.id, name: s.name, hasReference: s.hasReference }));
+        return { content: [{ type: "text", text: JSON.stringify(list, null, 2) }] };
     });
-}
-// --- Tools ---
-server.registerTool("list_skills", {
-    title: "List skills",
-    description: "List all available General Coding Tools skills (e.g. systematic-debugging, correctness-audit).",
-    inputSchema: z.object({}),
-}, async () => {
-    const list = DATA.skills.map((s) => ({ id: s.id, name: s.name, hasReference: s.hasReference }));
-    return { content: [{ type: "text", text: JSON.stringify(list, null, 2) }] };
-});
-server.registerTool("list_subagents", {
-    title: "List subagents",
-    description: "List all available General Coding Tools subagents (e.g. deep-research, update-docs, verifier).",
-    inputSchema: z.object({}),
-}, async () => {
-    const list = DATA.subagents.map((a) => ({ id: a.id, name: a.name }));
-    return { content: [{ type: "text", text: JSON.stringify(list, null, 2) }] };
-});
-server.registerTool("get_skill", {
-    title: "Get skill content",
-    description: "Get the full content of a skill by name (id). Use list_skills to see available names.",
-    inputSchema: z.object({
-        name: z.string().describe("Skill id (e.g. systematic-debugging, correctness-audit)"),
-        include_reference: z.boolean().optional().default(false).describe("Include REFERENCE.md if present"),
-    }),
-}, async ({ name, include_reference }) => {
-    const skill = DATA.skills.find((s) => s.id === name || s.name === name);
-    if (!skill) {
-        return {
-            content: [{ type: "text", text: `Unknown skill: ${name}. Use list_skills to see available skills.` }],
-            isError: true,
-        };
-    }
-    const entry = DATA.content.skills[skill.name];
-    let text = entry.content;
-    if (include_reference && entry.reference) {
-        text += "\n\n---\n\n## Reference\n\n" + entry.reference;
+    server.registerTool("list_subagents", {
+        title: "List subagents",
+        description: "List all available General Coding Tools subagents (e.g. deep-research, update-docs, verifier).",
+        inputSchema: z.object({}),
+    }, async () => {
+        const list = DATA.subagents.map((a) => ({ id: a.id, name: a.name }));
+        return { content: [{ type: "text", text: JSON.stringify(list, null, 2) }] };
+    });
+    server.registerTool("get_skill", {
+        title: "Get skill content",
+        description: "Get the full content of a skill by name (id). Use list_skills to see available names.",
+        inputSchema: z.object({
+            name: z.string().max(200).describe("Skill id (e.g. systematic-debugging, correctness-audit)"),
+            include_reference: z.boolean().optional().default(false).describe("Include REFERENCE.md if present"),
+        }),
+    }, async ({ name, include_reference }) => {
+        const skill = DATA.skills.find((s) => s.id === name || s.name === name);
+        if (!skill) {
+            return {
+                content: [{ type: "text", text: `Unknown skill: ${escapeForEmbedding(name)}. Use list_skills to see available skills.` }],
+                isError: true,
+            };
+        }
+        const entry = DATA.content.skills[skill.name];
+        let text = entry.content;
+        if (include_reference && entry.reference) {
+            text += "\n\n---\n\n## Reference\n\n" + entry.reference;
+        }
+        return { content: [{ type: "text", text }] };
+    });
+    server.registerTool("get_subagent", {
+        title: "Get subagent content",
+        description: "Get the full content of a subagent by name (id). Use list_subagents to see available names.",
+        inputSchema: z.object({
+            name: z.string().max(200).describe("Subagent id (e.g. deep-research, update-docs, verifier)"),
+        }),
+    }, async ({ name }) => {
+        const subagent = DATA.subagents.find((a) => a.id === name || a.name === name);
+        if (!subagent) {
+            return {
+                content: [{ type: "text", text: `Unknown subagent: ${escapeForEmbedding(name)}. Use list_subagents to see available subagents.` }],
+                isError: true,
+            };
+        }
+        const entry = DATA.content.subagents[subagent.name];
+        return { content: [{ type: "text", text: entry.content }] };
+    });
+    // --- Prompts: apply skill / subagent with user message ---
+    for (const s of DATA.skills) {
+        const promptName = `apply_skill_${s.id.replace(/-/g, "_")}`;
+        server.registerPrompt(promptName, {
+            title: `Apply skill: ${s.name}`,
+            description: `Apply the "${s.name}" skill. Use when the user wants to follow this skill's process.`,
+            argsSchema: {
+                user_message: z.string().describe("What the user asked or the current task"),
+            },
+        }, async ({ user_message }) => {
+            const entry = DATA.content.skills[s.name];
+            const safeMessage = escapeForEmbedding(String(user_message ?? "(no message provided)"));
+            const text = `I will follow the **${s.name}** skill.\n\n---\n\n${entry.content}\n\n---\n\nUser request: ${safeMessage}`;
+            return {
+                messages: [
+                    { role: "user", content: { type: "text", text: String(user_message ?? "") } },
+                    { role: "assistant", content: { type: "text", text } },
+                ],
+            };
+        });
     }
-    return { content: [{ type: "text", text }] };
-});
-server.registerTool("get_subagent", {
-    title: "Get subagent content",
-    description: "Get the full content of a subagent by name (id). Use list_subagents to see available names.",
-    inputSchema: z.object({
-        name: z.string().describe("Subagent id (e.g. deep-research, update-docs, verifier)"),
-    }),
-}, async ({ name }) => {
-    const subagent = DATA.subagents.find((a) => a.id === name || a.name === name);
-    if (!subagent) {
-        return {
-            content: [{ type: "text", text: `Unknown subagent: ${name}. Use list_subagents to see available subagents.` }],
-            isError: true,
-        };
+    for (const a of DATA.subagents) {
+        const promptName = `apply_subagent_${a.id.replace(/-/g, "_")}`;
+        server.registerPrompt(promptName, {
+            title: `Apply subagent: ${a.name}`,
+            description: `Apply the "${a.name}" subagent. Use when the user wants this agent's behavior.`,
+            argsSchema: {
+                user_message: z.string().describe("What the user asked or the current task"),
+            },
+        }, async ({ user_message }) => {
+            const entry = DATA.content.subagents[a.name];
+            const safeMessage = escapeForEmbedding(String(user_message ?? "(no message provided)"));
+            const text = `I will follow the **${a.name}** subagent.\n\n---\n\n${entry.content}\n\n---\n\nUser request: ${safeMessage}`;
+            return {
+                messages: [
+                    { role: "user", content: { type: "text", text: String(user_message ?? "") } },
+                    { role: "assistant", content: { type: "text", text } },
+                ],
+            };
+        });
     }
-    const entry = DATA.content.subagents[subagent.name];
-    return { content: [{ type: "text", text: entry.content }] };
-});
-// --- Prompts: apply skill / subagent with user message ---
-for (const s of DATA.skills) {
-    const promptName = `apply_skill_${s.id.replace(/-/g, "_")}`;
-    server.registerPrompt(promptName, {
-        title: `Apply skill: ${s.name}`,
-        description: `Apply the "${s.name}" skill. Use when the user wants to follow this skill's process.`,
-        argsSchema: {
-            user_message: z.string().describe("What the user asked or the current task"),
-        },
-    }, async ({ user_message }) => {
-        const entry = DATA.content.skills[s.name];
-        const text = `I will follow the **${s.name}** skill.\n\n---\n\n${entry.content}\n\n---\n\nUser request: ${user_message ?? "(no message provided)"}`;
-        return {
-            messages: [
-                { role: "user", content: { type: "text", text: String(user_message ?? "") } },
-                { role: "assistant", content: { type: "text", text } },
-            ],
-        };
-    });
+    return server;
 }
-for (const a of DATA.subagents) {
-    const promptName = `apply_subagent_${a.id.replace(/-/g, "_")}`;
-    server.registerPrompt(promptName, {
-        title: `Apply subagent: ${a.name}`,
-        description: `Apply the "${a.name}" subagent. Use when the user wants this agent's behavior.`,
-        argsSchema: {
-            user_message: z.string().describe("What the user asked or the current task"),
-        },
-    }, async ({ user_message }) => {
-        const entry = DATA.content.subagents[a.name];
-        const text = `I will follow the **${a.name}** subagent.\n\n---\n\n${entry.content}\n\n---\n\nUser request: ${user_message ?? "(no message provided)"}`;
-        return {
-            messages: [
-                { role: "user", content: { type: "text", text: String(user_message ?? "") } },
-                { role: "assistant", content: { type: "text", text } },
-            ],
-        };
-    });
+/** Returns a server instance for Smithery capability scanning. Loads real content when dist/content.json exists (e.g. when scan runs from project dir), otherwise uses empty content so the scan still succeeds. */
+export function createSandboxServer() {
+    return createServer();
 }
-// --- Run ---
+// Default export for Smithery CLI (expects default to be a function that returns the server)
+export default createSandboxServer;
+// --- Run when executed as main ---
+const server = createServer();
 async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "general-coding-tools-mcp",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "MCP server exposing General Coding Tools (skills and subagents) for use in Cursor, Claude, and Smithery",
   "type": "module",
   "main": "dist/index.js",
@@ -19,7 +19,13 @@
   "engines": {
     "node": ">=18"
   },
-  "keywords": ["mcp", "cursor", "smithery", "skills", "general-coding-tools"],
+  "keywords": [
+    "mcp",
+    "cursor",
+    "smithery",
+    "skills",
+    "general-coding-tools"
+  ],
   "license": "MIT",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",