kern0-cli 0.1.0

package/lib/mcp/server.ts

@@ -0,0 +1,216 @@
+import {
+  Server,
+} from "@modelcontextprotocol/sdk/server/index.js";
+import {
+  StdioServerTransport,
+} from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  ListResourcesRequestSchema,
+  ReadResourceRequestSchema,
+  ListToolsRequestSchema,
+  CallToolRequestSchema,
+  ErrorCode,
+  McpError,
+} from "@modelcontextprotocol/sdk/types.js";
+import { fetchAPI } from "./api-client.js";
+import {
+  getOrganizationResources,
+  getEnvironmentResources,
+  getAuditLogResources,
+  getTokenResources,
+} from "./resources.js";
+import {
+  listTools,
+  executeTool,
+} from "./tools.js";
+
+const server = new Server({
+  name: "kernzero-mcp",
+  version: "1.0.0",
+});
+
+// List available resources
+server.setRequestHandler(ListResourcesRequestSchema, async (request) => {
+  try {
+    const apiUrl = process.env.KERN0_API_URL || "https://staging.kernzero.com";
+    const token = process.env.KERN0_TOKEN;
+
+    if (!token) {
+      throw new McpError(
+        ErrorCode.InvalidRequest,
+        "KERN0_TOKEN environment variable is required"
+      );
+    }
+
+    // Fetch authenticated user and accessible orgs
+    const me = await fetchAPI("/api/v1/auth/me", token, apiUrl);
+    if (!me.authenticated) {
+      throw new McpError(ErrorCode.InvalidRequest, "Authentication failed");
+    }
+
+    const userId = me.userId;
+    const resources = [];
+
+    // Get organizations
+    const orgsResponse = await fetchAPI(
+      "/api/v1/orgs",
+      token,
+      apiUrl
+    );
+
+    if (Array.isArray(orgsResponse)) {
+      for (const org of orgsResponse) {
+        resources.push(...getOrganizationResources(org));
+        resources.push(...getEnvironmentResources(org.id));
+        resources.push(...getAuditLogResources(org.id));
+        resources.push(...getTokenResources(org.id));
+      }
+    }
+
+    return { resources };
+  } catch (error) {
+    throw new McpError(
+      ErrorCode.InternalError,
+      `Failed to list resources: ${error}`
+    );
+  }
+});
+
+// Read resource
+server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+  try {
+    const apiUrl = process.env.KERN0_API_URL || "https://staging.kernzero.com";
+    const token = process.env.KERN0_TOKEN;
+
+    if (!token) {
+      throw new McpError(
+        ErrorCode.InvalidRequest,
+        "KERN0_TOKEN environment variable is required"
+      );
+    }
+
+    const uri = request.params.uri;
+
+    // Parse URI format: kernzero://resource-type/id
+    const match = uri.match(/kernzero:\/\/([^/]+)\/(.+)/);
+    if (!match) {
+      throw new McpError(ErrorCode.InvalidRequest, `Invalid URI format: ${uri}`);
+    }
+
+    const [, resourceType, resourceId] = match;
+
+    let content = "";
+    switch (resourceType) {
+      case "organization": {
+        const org = await fetchAPI(
+          `/api/v1/orgs/${resourceId}`,
+          token,
+          apiUrl
+        );
+        content = JSON.stringify(org, null, 2);
+        break;
+      }
+
+      case "environments": {
+        const envs = await fetchAPI(
+          `/api/v1/orgs/${resourceId}/environments`,
+          token,
+          apiUrl
+        );
+        content = JSON.stringify(envs, null, 2);
+        break;
+      }
+
+      case "tokens": {
+        const tokens = await fetchAPI(
+          `/api/v1/orgs/${resourceId}/tokens`,
+          token,
+          apiUrl
+        );
+        content = JSON.stringify(tokens, null, 2);
+        break;
+      }
+
+      case "audit-logs": {
+        const logs = await fetchAPI(
+          `/api/v1/orgs/${resourceId}/audit-logs`,
+          token,
+          apiUrl
+        );
+        content = JSON.stringify(logs, null, 2);
+        break;
+      }
+
+      default:
+        throw new McpError(
+          ErrorCode.InvalidRequest,
+          `Unknown resource type: ${resourceType}`
+        );
+    }
+
+    return {
+      contents: [
+        {
+          uri,
+          mimeType: "application/json",
+          text: content,
+        },
+      ],
+    };
+  } catch (error) {
+    throw new McpError(
+      ErrorCode.InternalError,
+      `Failed to read resource: ${error}`
+    );
+  }
+});
+
+// List tools
+server.setRequestHandler(ListToolsRequestSchema, async () => {
+  return { tools: listTools() };
+});
+
+// Call tool
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+  try {
+    const apiUrl = process.env.KERN0_API_URL || "https://staging.kernzero.com";
+    const token = process.env.KERN0_TOKEN;
+
+    if (!token) {
+      throw new McpError(
+        ErrorCode.InvalidRequest,
+        "KERN0_TOKEN environment variable is required"
+      );
+    }
+
+    const result = await executeTool(
+      request.params.name,
+      request.params.arguments || {},
+      token,
+      apiUrl
+    );
+
+    return {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(result, null, 2),
+        },
+      ],
+    };
+  } catch (error) {
+    throw new McpError(
+      ErrorCode.InternalError,
+      `Tool execution failed: ${error}`
+    );
+  }
+});
+
+// Start server
+async function main() {
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  console.error("KernZero MCP server started");
+}
+
+main().catch(console.error);

package/lib/mcp/tools.ts

@@ -0,0 +1,288 @@
+/**
+ * MCP tool definitions for KernZero
+ * Tools represent actions that Claude can execute
+ */
+
+import { Tool } from "@modelcontextprotocol/sdk/types.js";
+import { fetchAPI, callAPI } from "./api-client.js";
+
+export function listTools(): Tool[] {
+  return [
+    {
+      name: "get_user_context",
+      description: "Get current authenticated user and organization context",
+      inputSchema: {
+        type: "object",
+        properties: {},
+        required: [],
+      },
+    },
+
+    {
+      name: "list_organizations",
+      description: "List all organizations the user has access to",
+      inputSchema: {
+        type: "object",
+        properties: {},
+        required: [],
+      },
+    },
+
+    {
+      name: "get_organization_details",
+      description: "Get detailed information about a specific organization",
+      inputSchema: {
+        type: "object",
+        properties: {
+          orgId: {
+            type: "string",
+            description: "Organization ID",
+          },
+        },
+        required: ["orgId"],
+      },
+    },
+
+    {
+      name: "list_environments",
+      description:
+        "List all monitored environments in an organization with their status",
+      inputSchema: {
+        type: "object",
+        properties: {
+          orgId: {
+            type: "string",
+            description: "Organization ID",
+          },
+        },
+        required: ["orgId"],
+      },
+    },
+
+    {
+      name: "get_environment_status",
+      description: "Get detailed status and health metrics for an environment",
+      inputSchema: {
+        type: "object",
+        properties: {
+          orgId: {
+            type: "string",
+            description: "Organization ID",
+          },
+          envId: {
+            type: "string",
+            description: "Environment ID",
+          },
+        },
+        required: ["orgId", "envId"],
+      },
+    },
+
+    {
+      name: "list_audit_logs",
+      description:
+        "Get audit trail showing who performed what actions and when",
+      inputSchema: {
+        type: "object",
+        properties: {
+          orgId: {
+            type: "string",
+            description: "Organization ID",
+          },
+          limit: {
+            type: "number",
+            description: "Number of logs to retrieve (default: 50)",
+          },
+        },
+        required: ["orgId"],
+      },
+    },
+
+    {
+      name: "list_tokens",
+      description: "List Personal Access Tokens and their scopes",
+      inputSchema: {
+        type: "object",
+        properties: {
+          orgId: {
+            type: "string",
+            description: "Organization ID",
+          },
+        },
+        required: ["orgId"],
+      },
+    },
+
+    {
+      name: "analyze_readiness",
+      description:
+        "Analyze recovery readiness for an organization based on environment status",
+      inputSchema: {
+        type: "object",
+        properties: {
+          orgId: {
+            type: "string",
+            description: "Organization ID to analyze",
+          },
+        },
+        required: ["orgId"],
+      },
+    },
+
+    {
+      name: "check_backup_health",
+      description: "Check backup health status for all environments",
+      inputSchema: {
+        type: "object",
+        properties: {
+          orgId: {
+            type: "string",
+            description: "Organization ID",
+          },
+        },
+        required: ["orgId"],
+      },
+    },
+  ];
+}
+
+export async function executeTool(
+  name: string,
+  args: Record<string, any>,
+  token: string,
+  apiUrl: string
+): Promise<any> {
+  switch (name) {
+    case "get_user_context": {
+      return await fetchAPI("/api/v1/auth/me", token, apiUrl);
+    }
+
+    case "list_organizations": {
+      const orgs = await fetchAPI("/api/v1/orgs", token, apiUrl);
+      return Array.isArray(orgs) ? orgs : orgs.organizations || [];
+    }
+
+    case "get_organization_details": {
+      if (!args.orgId) throw new Error("orgId is required");
+      return await fetchAPI(`/api/v1/orgs/${args.orgId}`, token, apiUrl);
+    }
+
+    case "list_environments": {
+      if (!args.orgId) throw new Error("orgId is required");
+      return await fetchAPI(
+        `/api/v1/orgs/${args.orgId}/environments`,
+        token,
+        apiUrl
+      );
+    }
+
+    case "get_environment_status": {
+      if (!args.orgId || !args.envId)
+        throw new Error("orgId and envId are required");
+      const envs = await fetchAPI(
+        `/api/v1/orgs/${args.orgId}/environments`,
+        token,
+        apiUrl
+      );
+      const env = (envs.environments || []).find(
+        (e: any) => e.id === args.envId
+      );
+      return env || { error: "Environment not found" };
+    }
+
+    case "list_audit_logs": {
+      if (!args.orgId) throw new Error("orgId is required");
+      return await fetchAPI(
+        `/api/v1/orgs/${args.orgId}/audit-logs?limit=${args.limit || 50}`,
+        token,
+        apiUrl
+      );
+    }
+
+    case "list_tokens": {
+      if (!args.orgId) throw new Error("orgId is required");
+      return await fetchAPI(`/api/v1/orgs/${args.orgId}/tokens`, token, apiUrl);
+    }
+
+    case "analyze_readiness": {
+      if (!args.orgId) throw new Error("orgId is required");
+      const envs = await fetchAPI(
+        `/api/v1/orgs/${args.orgId}/environments`,
+        token,
+        apiUrl
+      );
+
+      const environments = envs.environments || [];
+      const onlineCount = environments.filter(
+        (e: any) => e.status === "online"
+      ).length;
+      const offlineCount = environments.filter(
+        (e: any) => e.status === "offline"
+      ).length;
+      const validBackups = environments.filter(
+        (e: any) => e.hasValidBackup || e.hasValidBackupByPeer
+      ).length;
+
+      const readiness = environments.length > 0
+        ? Math.round(
+            ((validBackups / environments.length) * 100 +
+            (onlineCount / Math.max(1, environments.length)) * 50) / 1.5
+          )
+        : 0;
+
+      return {
+        totalEnvironments: environments.length,
+        onlineCount,
+        offlineCount,
+        validBackupsCount: validBackups,
+        readinessPercentage: readiness,
+        assessment:
+          readiness >= 80
+            ? "READY - High recovery readiness"
+            : readiness >= 60
+              ? "PARTIAL - Some gaps to address"
+              : readiness >= 40
+                ? "AT RISK - Multiple issues"
+                : "CRITICAL - Immediate attention needed",
+      };
+    }
+
+    case "check_backup_health": {
+      if (!args.orgId) throw new Error("orgId is required");
+      const envs = await fetchAPI(
+        `/api/v1/orgs/${args.orgId}/environments`,
+        token,
+        apiUrl
+      );
+
+      const environments = envs.environments || [];
+      const backupStatus = environments.map((env: any) => ({
+        environment: env.label,
+        status: env.status,
+        hasValidBackup: env.hasValidBackup,
+        hasValidBackupByPeer: env.hasValidBackupByPeer,
+        lastBackupTime: env.lastBackupTime,
+        backupHealth:
+          env.hasValidBackup || env.hasValidBackupByPeer ? "✅ HEALTHY" : "⚠️  NEEDS BACKUP",
+      }));
+
+      const unhealthy = backupStatus.filter(
+        (b: any) => b.backupHealth !== "✅ HEALTHY"
+      );
+
+      return {
+        totalEnvironments: environments.length,
+        healthyBackups: backupStatus.length - unhealthy.length,
+        unhealthyBackups: unhealthy.length,
+        details: backupStatus,
+        summary:
+          unhealthy.length === 0
+            ? "All backups are healthy"
+            : `${unhealthy.length} environment(s) need backup attention`,
+      };
+    }
+
+    default:
+      throw new Error(`Unknown tool: ${name}`);
+  }
+}

package/package.json

@@ -0,0 +1,76 @@
+{
+  "name": "kern0-cli",
+  "version": "0.1.0",
+  "description": "KernZero CLI - Recovery control plane management from the terminal",
+  "private": false,
+  "license": "MIT",
+  "author": "KernZero",
+  "homepage": "https://kernzero.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/santorres/kern0.git"
+  },
+  "keywords": [
+    "recovery",
+    "cli",
+    "backup",
+    "disaster-recovery",
+    "active-directory",
+    "zero-trust",
+    "passkeys",
+    "device-flow"
+  ],
+  "bin": {
+    "kern0": "./bin/kern0",
+    "kern0-mcp": "./bin/kern0-mcp"
+  },
+  "files": [
+    "lib/cli",
+    "lib/mcp",
+    "bin",
+    "package.json"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "type": "module",
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "lint": "eslint",
+    "typecheck": "tsc --noEmit",
+    "firebase:init": "node scripts/bootstrap.mjs",
+    "firebase:probe": "node scripts/probe.mjs",
+    "seed:v1": "node scripts/seed-v1-samples.mjs",
+    "patch:iroh": "node scripts/patch-iroh.mjs",
+    "postinstall": "node scripts/patch-iroh.mjs"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.1127.0",
+    "@modelcontextprotocol/sdk": "^1.30.1",
+    "@number0/iroh": "^1.1.0",
+    "@simplewebauthn/browser": "^14.0.0",
+    "@simplewebauthn/server": "^14.0.3",
+    "@types/qrcode": "^1.5.6",
+    "firebase": "^12.18.0",
+    "firebase-admin": "^14.5.0",
+    "lucide-react": "^1.41.0",
+    "next": "16.3.4",
+    "open": "^10.0.0",
+    "qrcode": "^1.5.4",
+    "react": "19.2.8",
+    "react-dom": "19.2.8"
+  },
+  "devDependencies": {
+    "@tailwindcss/postcss": "^4",
+    "@types/node": "^20",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "eslint": "^9",
+    "eslint-config-next": "16.3.4",
+    "tailwindcss": "^4",
+    "tsx": "^4.23.15",
+    "typescript": "^5"
+  }
+}