hakira-mcp 0.1.0

package/dist/upload/presigned.js

@@ -0,0 +1,32 @@
+/**
+ * Upload the ZIP and return the R2 key `start_audit` passes to POST /mcp/audits.
+ *
+ * On `firstBind` this uploads TWICE (00 §3 note / G5): once to drive the one-shot
+ * `/bootstrap` (consumed + deleted after AR extracts), then again for the scan's
+ * re-sync — the returned key is always a FRESH, unconsumed object.
+ *
+ * NON-BLOCKING (Option B): we do NOT wait for the first-bind bootstrap to finish.
+ * `completeUpload` enqueues it and returns; `start_audit` then POSTs to CP, which
+ * ACCEPTS the audit while the workspace is still provisioning and drives it via
+ * the deferred-kickoff worker once bootstrap completes. Honoring `start_audit`'s
+ * "returns immediately" promise is the whole point — the agent polls
+ * `get_audit_status` through provisioning → running → ready instead of the tool
+ * call blocking for the multi-minute provision window.
+ */
+export async function upload(cp, wsId, buffer, opts) {
+    if (opts.firstBind) {
+        const boot = await cp.getUploadUrl(wsId, { size: buffer.length, contentType: 'application/zip' });
+        await cp.putUpload(boot.uploadUrl, buffer);
+        await cp.completeUpload(wsId, {
+            key: boot.key,
+            filename: boot.filename,
+            excludeFolders: opts.excludeFolders ?? [],
+        });
+        // Deliberately no bootstrap wait — see the docstring (Option B).
+    }
+    // Fresh upload for the scan's re-sync (never reuse the bootstrap object). The
+    // object persists in R2 until the deferred drive consumes it via /re-sync.
+    const scan = await cp.getUploadUrl(wsId, { size: buffer.length, contentType: 'application/zip' });
+    await cp.putUpload(scan.uploadUrl, buffer);
+    return { r2_key: scan.key };
+}

package/dist/upload/zip.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Default secret deny-list applied ON TOP of .gitignore. One exported const so
+ * tests + docs share it. Extensible via a `.hakiraignore` at the project root.
+ */
+export declare const SECRET_DENY_LIST: readonly [".env*", "*.pem", "*.key", "id_rsa*", "id_ed25519*", "id_ecdsa*", "id_dsa*", ".git-credentials", "*.p12", "*.pfx", "*.pkcs12", "*.jks", "*.p8", "service-account*.json", ".ssh/", ".aws/", ".npmrc", "*.keystore"];
+export interface ZipResult {
+    buffer: Buffer;
+    manifest: string;
+    files: string[];
+    excluded: string[];
+}
+export interface BuildZipOptions {
+    ref?: string;
+    extraExcludes?: string[];
+}
+export declare function buildZip(root: string, opts?: BuildZipOptions): ZipResult;
+/**
+ * Match a POSIX relative path against a deny-list pattern set.
+ *  - `foo/` (trailing slash) → directory: any path SEGMENT equals `foo`.
+ *  - else → basename glob (`*` = any run of chars).
+ */
+export declare function isDenied(relPath: string, patterns: string[]): boolean;

package/dist/upload/zip.js

@@ -0,0 +1,182 @@
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+import AdmZip from 'adm-zip';
+import { tryGit, gitBuffer, isGitRepo } from '../git/exec.js';
+// gitignore-respecting ZIP + secret deny-list + manifest (ticket S7, spec §9/§9.1).
+// The user's real .git is NEVER shipped (the git-substrate is built server-side).
+/**
+ * Default secret deny-list applied ON TOP of .gitignore. One exported const so
+ * tests + docs share it. Extensible via a `.hakiraignore` at the project root.
+ */
+export const SECRET_DENY_LIST = [
+    '.env*',
+    '*.pem',
+    '*.key',
+    'id_rsa*',
+    'id_ed25519*', // non-RSA SSH private keys at repo root (the `.ssh/` rule only
+    'id_ecdsa*', // catches keys UNDER a .ssh/ dir; bare ones would slip)
+    'id_dsa*',
+    '.git-credentials', // git stores creds here in plaintext
+    '*.p12',
+    '*.pfx',
+    '*.pkcs12',
+    '*.jks', // Java keystore
+    '*.p8', // PKCS#8 / Apple auth keys
+    'service-account*.json', // GCP service-account keys
+    '.ssh/',
+    '.aws/',
+    '.npmrc',
+    '*.keystore',
+];
+export function buildZip(root, opts = {}) {
+    const patterns = [...SECRET_DENY_LIST, ...readHakiraIgnore(root), ...(opts.extraExcludes ?? [])];
+    if (opts.ref)
+        return buildFromRef(root, opts.ref, patterns);
+    if (isGitRepo(root))
+        return buildFromWorkingTree(root, patterns);
+    return buildFromWalk(root, patterns);
+}
+/**
+ * Add one filesystem path to the zip unless it is deny-listed or a symlink.
+ * Records the path in `kept` (added) or `excluded` (denied / symlink); an
+ * unreadable or vanished file is silently skipped. Returns the byte count added.
+ *
+ * NEVER dereferences a symlink: readFileSync would follow it and ship the
+ * TARGET's bytes (e.g. a `link.txt -> ~/.aws/credentials`), which the name-based
+ * deny-list cannot see. This lstat + isSymbolicLink gate is the ONE place both
+ * the git-working-tree and the non-git-walk builders route files through, so the
+ * symlink-safety logic lives in a single spot.
+ */
+function addFileIfSafe(zip, abs, rel, patterns, kept, excluded) {
+    if (isDenied(rel, patterns)) {
+        excluded.push(rel);
+        return 0;
+    }
+    try {
+        if (lstatSync(abs).isSymbolicLink()) {
+            excluded.push(rel);
+            return 0;
+        }
+        const buf = readFileSync(abs);
+        zip.addFile(rel, buf);
+        kept.push(rel);
+        return buf.length;
+    }
+    catch {
+        return 0; // unreadable / deleted-since-listing
+    }
+}
+// ── git working tree (default): honors .gitignore, includes untracked-but-un-
+//    ignored files (the uncommitted files we DO scan) — G12 incantation. ──────
+function buildFromWorkingTree(root, patterns) {
+    const out = tryGit(root, ['ls-files', '--cached', '--others', '--exclude-standard']);
+    const files = out ? out.split('\n').filter(Boolean) : [];
+    const zip = new AdmZip();
+    const excluded = [];
+    const kept = [];
+    let bytes = 0;
+    for (const rel of files) {
+        if (isGitPath(rel))
+            continue;
+        bytes += addFileIfSafe(zip, join(root, rel), rel, patterns, kept, excluded);
+    }
+    return finalize(zip, kept, bytes, excluded);
+}
+// ── explicit ref: `git archive` reads blob contents AT that ref (correct even
+//    if the working tree differs). Deny-list applied on top. ─────────────────
+function buildFromRef(root, ref, patterns) {
+    const srcBuf = gitBuffer(root, ['archive', '--format=zip'], ref);
+    const src = new AdmZip(srcBuf);
+    const out = new AdmZip();
+    const excluded = [];
+    const kept = [];
+    let bytes = 0;
+    for (const e of src.getEntries()) {
+        if (e.isDirectory)
+            continue;
+        const rel = e.entryName;
+        if (isGitPath(rel))
+            continue;
+        if (isDenied(rel, patterns)) {
+            excluded.push(rel);
+            continue;
+        }
+        const data = e.getData();
+        out.addFile(rel, data);
+        bytes += data.length;
+        kept.push(rel);
+    }
+    return finalize(out, kept, bytes, excluded);
+}
+// ── non-git folder: recursive walk, skipping .git / node_modules + deny-list. ─
+function buildFromWalk(root, patterns) {
+    const zip = new AdmZip();
+    const excluded = [];
+    const kept = [];
+    let bytes = 0;
+    const walk = (dir) => {
+        for (const name of readdirSync(dir)) {
+            if (name === '.git' || name === 'node_modules')
+                continue;
+            const abs = join(dir, name);
+            const rel = relative(root, abs).split(sep).join('/');
+            // lstat, not stat: a symlink must NOT be followed. isDirectory() is false
+            // for a symlink under lstat, so a dir-symlink is never walked (can't escape
+            // the tree or loop); everything else routes through the shared guard, which
+            // excludes file-symlinks rather than shipping their target's bytes.
+            if (lstatSync(abs).isDirectory()) {
+                walk(abs);
+                continue;
+            }
+            bytes += addFileIfSafe(zip, abs, rel, patterns, kept, excluded);
+        }
+    };
+    walk(root);
+    return finalize(zip, kept, bytes, excluded);
+}
+function finalize(zip, kept, bytes, excluded) {
+    const mb = (bytes / 1_048_576).toFixed(2);
+    const manifest = `uploading ${kept.length} files / ${mb} MB` +
+        (excluded.length ? `; excluded (secret/ignore): ${excluded.join(', ')}` : '; excluded: none');
+    return { buffer: zip.toBuffer(), manifest, files: kept, excluded };
+}
+function isGitPath(rel) {
+    return rel === '.git' || rel.startsWith('.git/');
+}
+function readHakiraIgnore(root) {
+    const file = join(root, '.hakiraignore');
+    if (!existsSync(file))
+        return [];
+    try {
+        return readFileSync(file, 'utf8')
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l.length > 0 && !l.startsWith('#'));
+    }
+    catch {
+        return [];
+    }
+}
+function globToRegExp(glob) {
+    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+    return new RegExp('^' + escaped + '$');
+}
+/**
+ * Match a POSIX relative path against a deny-list pattern set.
+ *  - `foo/` (trailing slash) → directory: any path SEGMENT equals `foo`.
+ *  - else → basename glob (`*` = any run of chars).
+ */
+export function isDenied(relPath, patterns) {
+    const parts = relPath.split('/');
+    const base = parts[parts.length - 1];
+    for (const p of patterns) {
+        if (p.endsWith('/')) {
+            if (parts.includes(p.slice(0, -1)))
+                return true;
+        }
+        else if (globToRegExp(p).test(base)) {
+            return true;
+        }
+    }
+    return false;
+}

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const version: string;

package/dist/version.js

@@ -0,0 +1,16 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+// Read the package version at runtime from the installed package.json (one level
+// up from dist/). Avoids a JSON import that tsc would try to place outside rootDir.
+function readVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url)); // dist/
+        const pkg = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8'));
+        return typeof pkg.version === 'string' ? pkg.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+export const version = readVersion();

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "hakira-mcp",
+  "version": "0.1.0",
+  "description": "Hakira MCP server — trigger Hakira cloud security audits from a coding agent",
+  "type": "module",
+  "license": "MIT",
+  "author": "Hakira",
+  "homepage": "https://hakira.io",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "security",
+    "security-audit",
+    "sast",
+    "pentest",
+    "claude",
+    "ai",
+    "hakira"
+  ],
+  "bin": { "hakira-mcp": "dist/index.js" },
+  "files": ["dist", "README.md", "LICENSE"],
+  "engines": { "node": ">=18" },
+  "publishConfig": { "access": "public" },
+  "scripts": {
+    "build": "rm -rf dist && tsc && chmod +x dist/index.js",
+    "dev": "tsx src/index.ts",
+    "test": "node --import tsx --test tests/*.test.ts",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "adm-zip": "^0.5.17",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@types/adm-zip": "^0.5.8",
+    "@types/node": "^20.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.0.0"
+  }
+}