mobbdev 1.0.85 → 1.0.87

package/dist/index.mjs

@@ -7,7 +7,7 @@ var __export = (target, all) => {
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 
 // src/index.ts
-import Debug20 from "debug";
+import Debug21 from "debug";
 import { hideBin } from "yargs/helpers";
 
 // src/args/commands/convert_to_sarif.ts
@@ -553,16 +553,16 @@ var GetVulnerabilityReportPathsDocument = `
   }
 }
     `;
-var GetAnalysisDocument = `
-    subscription getAnalysis($analysisId: uuid!) {
+var GetAnalysisSubscriptionDocument = `
+    subscription getAnalysisSubscription($analysisId: uuid!) {
   analysis: fixReport_by_pk(id: $analysisId) {
     id
     state
   }
 }
     `;
-var GetAnalsyisDocument = `
-    query getAnalsyis($analysisId: uuid!) {
+var GetAnalysisDocument = `
+    query getAnalysis($analysisId: uuid!) {
   analysis: fixReport_by_pk(id: $analysisId) {
     id
     state
@@ -913,6 +913,37 @@ var AutoPrAnalysisDocument = `
   }
 }
     `;
+var GetMcpFixesDocument = `
+    query GetMCPFixes($fixReportId: uuid!) {
+  fix(where: {fixReportId: {_eq: $fixReportId}}) {
+    id
+    confidence
+    safeIssueType
+    severityText
+    vulnerabilityReportIssues {
+      parsedIssueType
+      parsedSeverity
+      vulnerabilityReportIssueTags {
+        vulnerability_report_issue_tag_value
+      }
+    }
+    patchAndQuestions {
+      __typename
+      ... on FixData {
+        patch
+        patchOriginalEncodingBase64
+        extraContext {
+          extraContext {
+            key
+            value
+          }
+          fixDescription
+        }
+      }
+    }
+  }
+}
+    `;
 var defaultWrapper = (action, _operationName, _operationType, _variables) => action();
 function getSdk(client, withWrapper = defaultWrapper) {
   return {
@@ -931,11 +962,11 @@ function getSdk(client, withWrapper = defaultWrapper) {
     GetVulnerabilityReportPaths(variables, requestHeaders) {
       return withWrapper((wrappedRequestHeaders) => client.request(GetVulnerabilityReportPathsDocument, variables, { ...requestHeaders, ...wrappedRequestHeaders }), "GetVulnerabilityReportPaths", "query", variables);
     },
-    getAnalysis(variables, requestHeaders) {
-      return withWrapper((wrappedRequestHeaders) => client.request(GetAnalysisDocument, variables, { ...requestHeaders, ...wrappedRequestHeaders }), "getAnalysis", "subscription", variables);
+    getAnalysisSubscription(variables, requestHeaders) {
+      return withWrapper((wrappedRequestHeaders) => client.request(GetAnalysisSubscriptionDocument, variables, { ...requestHeaders, ...wrappedRequestHeaders }), "getAnalysisSubscription", "subscription", variables);
     },
-    getAnalsyis(variables, requestHeaders) {
-      return withWrapper((wrappedRequestHeaders) => client.request(GetAnalsyisDocument, variables, { ...requestHeaders, ...wrappedRequestHeaders }), "getAnalsyis", "query", variables);
+    getAnalysis(variables, requestHeaders) {
+      return withWrapper((wrappedRequestHeaders) => client.request(GetAnalysisDocument, variables, { ...requestHeaders, ...wrappedRequestHeaders }), "getAnalysis", "query", variables);
     },
     getFixes(variables, requestHeaders) {
       return withWrapper((wrappedRequestHeaders) => client.request(GetFixesDocument, variables, { ...requestHeaders, ...wrappedRequestHeaders }), "getFixes", "query", variables);
@@ -978,6 +1009,9 @@ function getSdk(client, withWrapper = defaultWrapper) {
     },
     autoPrAnalysis(variables, requestHeaders) {
       return withWrapper((wrappedRequestHeaders) => client.request(AutoPrAnalysisDocument, variables, { ...requestHeaders, ...wrappedRequestHeaders }), "autoPrAnalysis", "mutation", variables);
+    },
+    GetMCPFixes(variables, requestHeaders) {
+      return withWrapper((wrappedRequestHeaders) => client.request(GetMcpFixesDocument, variables, { ...requestHeaders, ...wrappedRequestHeaders }), "GetMCPFixes", "query", variables);
     }
   };
 }
@@ -4545,7 +4579,7 @@ async function getAdoSdk(params) {
       const git = await api2.getGitApi();
       try {
         const branchStatus = await git.getBranch(repo, branch, projectName);
-        if (!branchStatus || !branchStatus.commit) {
+        if (!branchStatus?.commit) {
           console.log(`no branch status: ${JSON.stringify(branchStatus)}`);
           throw new InvalidRepoUrlError("no branch status");
         }
@@ -4596,7 +4630,7 @@ async function getAdoSdk(params) {
       const url = new URL(repoUrl);
       const origin2 = url.origin.toLowerCase().endsWith(".visualstudio.com") ? DEFUALT_ADO_ORIGIN : url.origin.toLowerCase();
       const params2 = `path=/&versionDescriptor[versionOptions]=0&versionDescriptor[versionType]=commit&versionDescriptor[version]=${branch}&resolveLfs=true&$format=zip&api-version=5.0&download=true`;
-      const path9 = [
+      const path12 = [
         prefixPath,
         owner,
         projectName,
@@ -4607,7 +4641,7 @@ async function getAdoSdk(params) {
         "items",
         "items"
       ].filter(Boolean).join("/");
-      return new URL(`${path9}?${params2}`, origin2).toString();
+      return new URL(`${path12}?${params2}`, origin2).toString();
     },
     async getAdoBranchList({ repoUrl }) {
       try {
@@ -4674,7 +4708,7 @@ async function getAdoSdk(params) {
       const results = await Promise.allSettled([
         (async () => {
           const res = await git.getBranch(repo, ref, projectName);
-          if (!res.commit || !res.commit.commitId) {
+          if (!res.commit?.commitId) {
             throw new InvalidRepoUrlError("no commit on branch");
           }
           return {
@@ -4694,7 +4728,7 @@ async function getAdoSdk(params) {
             projectName
           );
           const commit = res[0];
-          if (!commit || !commit.commitId) {
+          if (!commit?.commitId) {
             throw new Error("no commit");
           }
           return {
@@ -6065,14 +6099,14 @@ function getGithubSdk(params = {}) {
       };
     },
     async getGithubBlameRanges(params2) {
-      const { ref, gitHubUrl, path: path9 } = params2;
+      const { ref, gitHubUrl, path: path12 } = params2;
       const { owner, repo } = parseGithubOwnerAndRepo(gitHubUrl);
       const res = await octokit.graphql(
         GET_BLAME_DOCUMENT,
         {
           owner,
           repo,
-          path: path9,
+          path: path12,
           ref
         }
       );
@@ -6378,11 +6412,11 @@ var GithubSCMLib = class extends SCMLib {
       markdownComment: comment
     });
   }
-  async getRepoBlameRanges(ref, path9) {
+  async getRepoBlameRanges(ref, path12) {
     this._validateUrl();
     return await this.githubSdk.getGithubBlameRanges({
       ref,
-      path: path9,
+      path: path12,
       gitHubUrl: this.url
     });
   }
@@ -6784,13 +6818,13 @@ function parseGitlabOwnerAndRepo(gitlabUrl) {
   const { organization, repoName, projectPath } = parsingResult;
   return { owner: organization, repo: repoName, projectPath };
 }
-async function getGitlabBlameRanges({ ref, gitlabUrl, path: path9 }, options) {
+async function getGitlabBlameRanges({ ref, gitlabUrl, path: path12 }, options) {
   const { projectPath } = parseGitlabOwnerAndRepo(gitlabUrl);
   const api2 = getGitBeaker({
     url: gitlabUrl,
     gitlabAuthToken: options?.gitlabAuthToken
   });
-  const resp = await api2.RepositoryFiles.allFileBlames(projectPath, path9, ref);
+  const resp = await api2.RepositoryFiles.allFileBlames(projectPath, path12, ref);
   let lineNumber = 1;
   return resp.filter((range) => range.lines).map((range) => {
     const oldLineNumber = lineNumber;
@@ -6966,10 +7000,10 @@ var GitlabSCMLib = class extends SCMLib {
       markdownComment: comment
     });
   }
-  async getRepoBlameRanges(ref, path9) {
+  async getRepoBlameRanges(ref, path12) {
     this._validateUrl();
     return await getGitlabBlameRanges(
-      { ref, path: path9, gitlabUrl: this.url },
+      { ref, path: path12, gitlabUrl: this.url },
       {
         url: this.url,
         gitlabAuthToken: this.accessToken
@@ -7352,10 +7386,11 @@ function filterSarifResult(sarifResult, codePathPatterns) {
   const paths = sarifResult.locations.map(
     (l) => l.physicalLocation.artifactLocation.uri
   );
-  const matchPaths = multimatch(paths, codePathPatterns, {
+  const uniquePaths = [...new Set(paths)];
+  const matchPaths = multimatch(uniquePaths, codePathPatterns, {
     dot: true
   });
-  return matchPaths.length > 0;
+  return matchPaths.length === uniquePaths.length;
 }
 function fortifyVulnerabilityToSarifResult(vulnerability, auditMetadataParser, reportMetadataParser, unifiedNodePoolParser) {
   const suppressed = auditMetadataParser?.getAuditMetadata()[vulnerability.instanceID] || "false";
@@ -7440,7 +7475,7 @@ var SCANNERS = {
   Semgrep: "semgrep",
   Datadog: "datadog"
 };
-var scannerToVulnerability_Report_Vendor_Enum = {
+var scannerToVulnerabilityReportVendorEnum = {
   [SCANNERS.Checkmarx]: "checkmarx" /* Checkmarx */,
   [SCANNERS.Snyk]: "snyk" /* Snyk */,
   [SCANNERS.Sonarqube]: "sonarqube" /* Sonarqube */,
@@ -7662,7 +7697,8 @@ var mobbCliCommand = {
   scan: "scan",
   analyze: "analyze",
   review: "review",
-  convertToSarif: "convert-to-sarif"
+  convertToSarif: "convert-to-sarif",
+  mcp: "mcp"
 };
 
 // src/args/yargs.ts
@@ -7838,7 +7874,7 @@ function buildFixCommentBody({
   }
   const subTitle = validFixParseRes.success ? getCommitDescription({
     issueType: validFixParseRes.data.safeIssueType,
-    vendor: scannerToVulnerability_Report_Vendor_Enum[scanner],
+    vendor: scannerToVulnerabilityReportVendorEnum[scanner],
     severity: validFixParseRes.data.severityText,
     guidances: getGuidances({
       questions: validFixParseRes.data.patchAndQuestions.questions.map(toQuestion),
@@ -7884,7 +7920,7 @@ function buildIssueCommentBody({
   const title = `# ${MobbIconMarkdown} Irrelevant issues were spotted - no action required \u{1F9F9}`;
   const subTitle = getCommitIssueDescription({
     issueType,
-    vendor: scannerToVulnerability_Report_Vendor_Enum[scanner],
+    vendor: scannerToVulnerabilityReportVendorEnum[scanner],
     irrelevantIssueWithTags,
     fpDescription
   });
@@ -7963,7 +7999,7 @@ async function postIssueComment(params) {
     fpDescription
   } = params;
   const {
-    path: path9,
+    path: path12,
     startLine,
     vulnerabilityReportIssue: {
       vulnerabilityReportIssueTags,
@@ -7978,7 +8014,7 @@ async function postIssueComment(params) {
 Refresh the page in order to see the changes.`,
     pull_number: pullRequest,
     commit_id: commitSha,
-    path: path9,
+    path: path12,
     line: startLine
   });
   const commentId = commentRes.data.id;
@@ -8012,7 +8048,7 @@ async function postFixComment(params) {
     scanner
   } = params;
   const {
-    path: path9,
+    path: path12,
     startLine,
     vulnerabilityReportIssue: { fixId, vulnerabilityReportIssueTags, category },
     vulnerabilityReportIssueId
@@ -8030,7 +8066,7 @@ async function postFixComment(params) {
 Refresh the page in order to see the changes.`,
     pull_number: pullRequest,
     commit_id: commitSha,
-    path: path9,
+    path: path12,
     line: startLine
   });
   const commentId = commentRes.data.id;
@@ -8163,7 +8199,7 @@ async function addFixCommentsForPr({
       project: { organizationId }
     }
   } = getAnalysisRes;
-  if (!getAnalysisRes.repo || !getAnalysisRes.repo.commitSha || !getAnalysisRes.repo.pullRequest) {
+  if (!getAnalysisRes.repo?.commitSha || !getAnalysisRes.repo.pullRequest) {
     throw new Error("repo not found");
   }
   const { commitSha, pullRequest } = getAnalysisRes.repo;
@@ -8806,7 +8842,7 @@ var GQLClient = class {
   async subscribeToAnalysis(params) {
     const { callbackStates } = params;
     return subscribe(
-      GetAnalysisDocument,
+      GetAnalysisSubscriptionDocument,
       params.subscribeToAnalysisParams,
       async (resolve, reject, data) => {
         if (!data.analysis?.state || data.analysis?.state === "Failed" /* Failed */) {
@@ -8830,7 +8866,7 @@ var GQLClient = class {
     );
   }
   async getAnalysis(analysisId) {
-    const res = await this._clientSdk.getAnalsyis({
+    const res = await this._clientSdk.getAnalysis({
       analysisId
     });
     if (!res.analysis) {
@@ -8897,7 +8933,7 @@ function endsWithAny(str, suffixes) {
     return str.endsWith(suffix);
   });
 }
-function _get_manifest_files_suffixes() {
+function getManifestFilesSuffixes() {
   return ["package.json", "pom.xml"];
 }
 async function pack(srcDirPath, vulnFiles, isIncludeAllFiles = false) {
@@ -8938,7 +8974,7 @@ async function pack(srcDirPath, vulnFiles, isIncludeAllFiles = false) {
   for (const filepath of filepaths) {
     const absFilepath = path5.join(srcDirPath, filepath.toString());
     if (!isIncludeAllFiles) {
-      vulnFiles = vulnFiles.concat(_get_manifest_files_suffixes());
+      vulnFiles = vulnFiles.concat(getManifestFilesSuffixes());
       if (!endsWithAny(
         absFilepath.toString().replaceAll(path5.win32.sep, path5.posix.sep),
         vulnFiles
@@ -9072,16 +9108,16 @@ function createSpawn({ args, processPath, name, cwd }, options) {
   return createChildProcess({ childProcess: child, name }, options);
 }
 function createChildProcess({ childProcess, name }, options) {
-  const debug20 = Debug14(`mobbdev:${name}`);
+  const debug21 = Debug14(`mobbdev:${name}`);
   const { display } = options;
   return new Promise((resolve, reject) => {
     let out = "";
     const onData = (chunk) => {
-      debug20(`chunk received from ${name} std ${chunk}`);
+      debug21(`chunk received from ${name} std ${chunk}`);
       out += chunk;
     };
-    if (!childProcess || !childProcess?.stdout || !childProcess?.stderr) {
-      debug20(`unable to fork ${name}`);
+    if (!childProcess?.stdout || !childProcess?.stderr) {
+      debug21(`unable to fork ${name}`);
       reject(new Error(`unable to fork ${name}`));
     }
     childProcess.stdout?.on("data", onData);
@@ -9091,11 +9127,11 @@ function createChildProcess({ childProcess, name }, options) {
       childProcess.stderr?.pipe(process2.stderr);
     }
     childProcess.on("exit", (code) => {
-      debug20(`${name} exit code ${code}`);
+      debug21(`${name} exit code ${code}`);
       resolve({ message: out, code });
     });
     childProcess.on("error", (err) => {
-      debug20(`${name} error %o`, err);
+      debug21(`${name} error %o`, err);
       reject(err);
     });
   });
@@ -10339,8 +10375,1371 @@ async function analyzeHandler(args) {
   await analyze(args, { skipPrompts: args.yes });
 }
 
-// src/args/commands/review.ts
+// src/mcp/core/McpServer.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+
+// src/mcp/Logger.ts
+var logglerUrl = "http://localhost:4444/log";
+var Logger = class {
+  log(message, level = "info", data) {
+    const logMessage = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      level,
+      message,
+      data
+    };
+    try {
+      fetch(logglerUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(logMessage)
+      });
+    } catch (error) {
+    }
+  }
+};
+var logger = new Logger();
+var logInfo = (message, data) => logger.log(message, "info", data);
+var logError = (message, data) => logger.log(message, "error", data);
+var logWarn = (message, data) => logger.log(message, "warn", data);
+var logDebug = (message, data) => logger.log(message, "debug", data);
+var Logger_default = logger.log;
+
+// src/mcp/core/ToolRegistry.ts
+var ToolRegistry = class {
+  constructor() {
+    __publicField(this, "tools", /* @__PURE__ */ new Map());
+  }
+  registerTool(tool) {
+    if (this.tools.has(tool.name)) {
+      logWarn(`Tool ${tool.name} is already registered, overwriting`, {
+        toolName: tool.name
+      });
+    }
+    this.tools.set(tool.name, tool);
+    logDebug(`Tool registered: ${tool.name}`, {
+      toolName: tool.name,
+      description: tool.definition.description
+    });
+  }
+  getTool(name) {
+    return this.tools.get(name);
+  }
+  getAllTools() {
+    return Array.from(this.tools.values()).map((tool) => tool.definition);
+  }
+  getToolNames() {
+    return Array.from(this.tools.keys());
+  }
+  hasTool(name) {
+    return this.tools.has(name);
+  }
+  getToolCount() {
+    return this.tools.size;
+  }
+};
+
+// src/mcp/core/McpServer.ts
+var McpServer = class {
+  constructor(config4) {
+    __publicField(this, "server");
+    __publicField(this, "toolRegistry");
+    __publicField(this, "isEventHandlersSetup", false);
+    this.server = new Server(
+      {
+        name: config4.name,
+        version: config4.version
+      },
+      {
+        capabilities: {
+          tools: {}
+        }
+      }
+    );
+    this.toolRegistry = new ToolRegistry();
+    this.setupHandlers();
+    this.setupProcessEventHandlers();
+    logInfo("MCP server instance created", config4);
+  }
+  setupProcessEventHandlers() {
+    if (this.isEventHandlersSetup) {
+      logDebug("Process event handlers already setup, skipping");
+      return;
+    }
+    const signals = {
+      SIGINT: "MCP server interrupted",
+      SIGTERM: "MCP server terminated",
+      exit: "MCP server exiting",
+      uncaughtException: "Uncaught exception in MCP server",
+      unhandledRejection: "Unhandled promise rejection in MCP server",
+      warning: "Warning in MCP server"
+    };
+    Object.entries(signals).forEach(([signal, message]) => {
+      process.on(
+        signal,
+        (error) => {
+          if (error && signal !== "exit") {
+            logError(`${message}`, { error, signal });
+          } else {
+            logInfo(message, { signal });
+          }
+          if (signal === "SIGINT" || signal === "SIGTERM") {
+            process.exit(0);
+          }
+          if (signal === "uncaughtException") {
+            process.exit(1);
+          }
+        }
+      );
+    });
+    this.isEventHandlersSetup = true;
+    logDebug("Process event handlers registered");
+  }
+  createShutdownPromise() {
+    return new Promise((resolve) => {
+      const cleanup = () => {
+        logInfo("Process shutdown initiated");
+        resolve();
+      };
+      process.once("SIGINT", cleanup);
+      process.once("SIGTERM", cleanup);
+    });
+  }
+  setupHandlers() {
+    this.server.setRequestHandler(
+      ListToolsRequestSchema,
+      async (request) => {
+        logInfo("Received list_tools request", { params: request.params });
+        const tools = this.toolRegistry.getAllTools();
+        const response = { tools };
+        logInfo("Returning list_tools response", {
+          toolCount: tools.length,
+          toolNames: tools.map((t) => t.name),
+          response
+        });
+        return response;
+      }
+    );
+    this.server.setRequestHandler(
+      CallToolRequestSchema,
+      async (request) => {
+        const { name, arguments: args } = request.params;
+        logInfo(`Received call tool request for ${name}`, { name, args });
+        try {
+          const tool = this.toolRegistry.getTool(name);
+          if (!tool) {
+            const errorMsg = `Unknown tool: ${name}`;
+            logWarn(errorMsg, {
+              name,
+              availableTools: this.toolRegistry.getToolNames()
+            });
+            throw new Error(errorMsg);
+          }
+          logDebug(`Executing tool: ${name}`, { args });
+          const response = await tool.execute(args);
+          const serializedResponse = JSON.parse(JSON.stringify(response));
+          logInfo(`Tool ${name} executed successfully`, {
+            responseType: typeof response,
+            hasContent: !!serializedResponse.content
+          });
+          return serializedResponse;
+        } catch (error) {
+          const errorMessage = error instanceof Error ? error.message : String(error);
+          logError(`Error executing tool ${name}: ${errorMessage}`, {
+            error,
+            toolName: name,
+            args
+          });
+          throw error;
+        }
+      }
+    );
+    logDebug("MCP server handlers registered");
+  }
+  registerTool(tool) {
+    this.toolRegistry.registerTool({
+      name: tool.name,
+      definition: tool.definition,
+      execute: tool.execute
+    });
+    logDebug(`Tool registered: ${tool.name}`);
+  }
+  async start() {
+    try {
+      logDebug("Starting MCP server");
+      const transport = new StdioServerTransport();
+      await this.server.connect(transport);
+      logInfo("MCP server is running on stdin/stdout");
+      process.stdin.resume();
+      await this.createShutdownPromise();
+      await this.stop();
+    } catch (error) {
+      logError("Failed to start MCP server", { error });
+      throw error;
+    }
+  }
+  async stop() {
+    logInfo("MCP server shutting down");
+  }
+};
+
+// src/mcp/services/GitService.ts
+import * as path9 from "path";
+import { simpleGit as simpleGit4 } from "simple-git";
+var GitService = class {
+  constructor(repositoryPath) {
+    __publicField(this, "git");
+    __publicField(this, "repositoryPath");
+    this.git = simpleGit4(repositoryPath, { binary: "git" });
+    this.repositoryPath = repositoryPath;
+    logDebug("Git service initialized", { repositoryPath });
+  }
+  /**
+   * Validates that the path is a valid git repository
+   */
+  async validateRepository() {
+    logDebug("Validating git repository");
+    try {
+      const isRepo = await this.git.checkIsRepo();
+      if (!isRepo) {
+        const error = "Path is not a valid git repository";
+        logError(error);
+        return { isValid: false, error };
+      }
+      logDebug("Git repository validation successful");
+      return { isValid: true };
+    } catch (error) {
+      const errorMessage = `Failed to verify git repository: ${error.message}`;
+      logError(errorMessage, { error });
+      return { isValid: false, error: errorMessage };
+    }
+  }
+  /**
+   * Gets the current git status and returns changed files
+   */
+  async getChangedFiles() {
+    logDebug("Getting git status");
+    try {
+      const status = await this.git.status();
+      const gitRoot = await this.git.revparse(["--show-toplevel"]);
+      const relativePathFromGitRoot = path9.relative(
+        gitRoot,
+        this.repositoryPath
+      );
+      const files = status.files.map((file) => {
+        const gitRelativePath = file.path;
+        if (relativePathFromGitRoot === "") {
+          return gitRelativePath;
+        }
+        if (gitRelativePath.startsWith(relativePathFromGitRoot + "/")) {
+          return gitRelativePath.substring(relativePathFromGitRoot.length + 1);
+        }
+        return path9.relative(
+          this.repositoryPath,
+          path9.join(gitRoot, gitRelativePath)
+        );
+      });
+      logInfo("Git status retrieved", {
+        fileCount: files.length,
+        files: files.slice(0, 10),
+        // Log first 10 files to avoid spam
+        gitRoot,
+        workingDir: this.repositoryPath,
+        relativePathFromGitRoot
+      });
+      return { files, status };
+    } catch (error) {
+      const errorMessage = `Failed to get git status: ${error.message}`;
+      logError(errorMessage, { error });
+      throw new Error(errorMessage);
+    }
+  }
+};
+
+// src/mcp/services/PathValidation.ts
 import fs8 from "node:fs";
+import path10 from "node:path";
+var PathValidation = class {
+  /**
+   * Validates a path for MCP usage - combines security and existence checks
+   */
+  async validatePath(inputPath) {
+    logDebug("Validating MCP path", { inputPath });
+    if (inputPath.includes("..")) {
+      const error = `Path contains path traversal patterns: ${inputPath}`;
+      logError(error);
+      return { isValid: false, error };
+    }
+    const normalizedPath = path10.normalize(inputPath);
+    if (normalizedPath.includes("..")) {
+      const error = `Normalized path contains path traversal patterns: ${inputPath}`;
+      logError(error);
+      return { isValid: false, error };
+    }
+    const decodedPath = decodeURIComponent(inputPath);
+    if (decodedPath.includes("..") || decodedPath !== inputPath) {
+      const error = `Path contains encoded traversal attempts: ${inputPath}`;
+      logError(error);
+      return { isValid: false, error };
+    }
+    if (inputPath.includes("\0") || inputPath.includes("\0")) {
+      const error = `Path contains dangerous characters: ${inputPath}`;
+      logError(error);
+      return { isValid: false, error };
+    }
+    logDebug("Path validation successful", { inputPath });
+    logDebug("Checking path existence", { inputPath });
+    try {
+      await fs8.promises.access(inputPath);
+      logDebug("Path exists and is accessible", { inputPath });
+      return { isValid: true };
+    } catch (error) {
+      const errorMessage = `Path does not exist or is not accessible: ${inputPath}`;
+      logError(errorMessage, { error });
+      return { isValid: false, error: errorMessage };
+    }
+  }
+};
+
+// src/mcp/services/FilePacking.ts
+import fs9 from "node:fs";
+import path11 from "node:path";
+import AdmZip3 from "adm-zip";
+import { isBinary as isBinary2 } from "istextorbinary";
+var MAX_FILE_SIZE2 = 1024 * 1024 * 5;
+var EXCLUDED_FILE_PATTERNS = [
+  // Configuration files
+  ".json",
+  ".yaml",
+  ".yml",
+  ".toml",
+  ".ini",
+  ".conf",
+  ".config",
+  ".xml",
+  ".env",
+  // Documentation
+  ".md",
+  ".txt",
+  ".rst",
+  ".adoc",
+  // Lock/dependency files
+  ".lock",
+  // Images and media
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".svg",
+  ".ico",
+  ".webp",
+  ".bmp",
+  ".tiff",
+  // Fonts
+  ".ttf",
+  ".otf",
+  ".woff",
+  ".woff2",
+  ".eot",
+  // Archives
+  ".zip",
+  ".tar",
+  ".gz",
+  ".rar",
+  ".7z",
+  // Logs and databases
+  ".log",
+  ".db",
+  ".sqlite",
+  ".sql",
+  // Certificates and keys
+  ".pem",
+  ".crt",
+  ".key",
+  ".p12",
+  ".pfx",
+  // IDE/Editor files
+  ".editorconfig",
+  ".sublime-project",
+  ".sublime-workspace",
+  // System files
+  ".DS_Store",
+  "Thumbs.db",
+  // Coverage reports
+  ".lcov",
+  // Compiled/binary files
+  ".exe",
+  ".dll",
+  ".so",
+  ".dylib",
+  ".class",
+  ".pyc",
+  ".pyo",
+  ".o",
+  ".obj",
+  // Minified files
+  ".min.js",
+  ".min.css",
+  ".min.html",
+  // Test files
+  ".test.js",
+  ".test.ts",
+  ".test.jsx",
+  ".test.tsx",
+  ".spec.js",
+  ".spec.ts",
+  ".spec.jsx",
+  ".spec.tsx",
+  // TypeScript declaration files
+  ".d.ts",
+  // Build/generated files
+  ".bundle.js",
+  ".chunk.js",
+  // Build/CI files (exact filenames)
+  "dockerfile",
+  "jenkinsfile",
+  // Lock files (ones without standard extensions)
+  "go.sum",
+  // Version control
+  ".gitignore",
+  ".gitattributes",
+  ".gitmodules",
+  ".gitkeep",
+  ".keep",
+  ".hgignore",
+  // Node.js specific
+  ".nvmrc",
+  ".node-version",
+  ".npmrc",
+  ".yarnrc",
+  ".pnpmfile.cjs",
+  // Language version files
+  ".ruby-version",
+  ".python-version",
+  ".rvmrc",
+  ".rbenv-version",
+  ".gvmrc",
+  // Build tools and task runners
+  "makefile",
+  "rakefile",
+  "gulpfile.js",
+  "gruntfile.js",
+  "webpack.config.js",
+  "webpack.config.ts",
+  "rollup.config.js",
+  "vite.config.js",
+  "vite.config.ts",
+  "next.config.js",
+  "nuxt.config.js",
+  "tailwind.config.js",
+  "postcss.config.js",
+  // JavaScript/TypeScript config
+  ".babelrc",
+  ".babelrc.js",
+  ".swcrc",
+  ".browserslistrc",
+  // Testing frameworks
+  "jest.config.js",
+  "jest.config.ts",
+  "vitest.config.js",
+  "karma.conf.js",
+  "protractor.conf.js",
+  "cypress.config.js",
+  "playwright.config.js",
+  ".nycrc",
+  ".c8rc",
+  // Linting/formatting configs
+  ".eslintrc",
+  ".eslintrc.js",
+  ".prettierrc",
+  ".prettierrc.js",
+  ".stylelintrc",
+  ".stylelintrc.js",
+  // Package manager configs (ones without standard extensions)
+  "pipfile",
+  "gemfile",
+  "go.mod",
+  "project.clj",
+  // Python specific
+  "setup.py",
+  "setup.cfg",
+  "manifest.in",
+  ".pythonrc",
+  // Documentation files (ones without standard extensions)
+  "readme",
+  "changelog",
+  "authors",
+  "contributors",
+  // License and legal (ones without standard extensions)
+  "license",
+  "notice",
+  "copyright",
+  // Web specific
+  ".htaccess"
+];
+var FilePacking = class {
+  isExcludedFileType(filepath) {
+    const basename = path11.basename(filepath).toLowerCase();
+    if (basename === ".env" || basename.startsWith(".env.")) {
+      return true;
+    }
+    if (EXCLUDED_FILE_PATTERNS.some((pattern) => basename.endsWith(pattern))) {
+      return true;
+    }
+    return false;
+  }
+  async packFiles(sourceDirectoryPath, filesToPack) {
+    logInfo(`FilePacking: packing files from ${sourceDirectoryPath}`);
+    const zip = new AdmZip3();
+    let packedFilesCount = 0;
+    logInfo("FilePacking: compressing files");
+    for (const filepath of filesToPack) {
+      const absoluteFilepath = path11.join(sourceDirectoryPath, filepath);
+      if (this.isExcludedFileType(filepath)) {
+        logInfo(
+          `FilePacking: ignoring ${filepath} because it is an excluded file type`
+        );
+        continue;
+      }
+      if (!fs9.existsSync(absoluteFilepath)) {
+        logInfo(`FilePacking: ignoring ${filepath} because it does not exist`);
+        continue;
+      }
+      if (fs9.lstatSync(absoluteFilepath).size > MAX_FILE_SIZE2) {
+        logInfo(
+          `FilePacking: ignoring ${filepath} because the size is > ${MAX_FILE_SIZE2 / (1024 * 1024)}MB`
+        );
+        continue;
+      }
+      let data;
+      try {
+        data = fs9.readFileSync(absoluteFilepath);
+      } catch (fsError) {
+        logInfo(
+          `FilePacking: failed to read ${filepath} from filesystem: ${fsError}`
+        );
+        continue;
+      }
+      if (isBinary2(null, data)) {
+        logInfo(
+          `FilePacking: ignoring ${filepath} because it seems to be a binary file`
+        );
+        continue;
+      }
+      zip.addFile(filepath, data);
+      packedFilesCount++;
+    }
+    const zipBuffer = zip.toBuffer();
+    logInfo(
+      `FilePacking: read ${packedFilesCount} source files. total size: ${zipBuffer.length} bytes`
+    );
+    logInfo("FilePacking: Files packed successfully");
+    return zipBuffer;
+  }
+};
+
+// src/mcp/services/FileUpload.ts
+import { HttpProxyAgent as HttpProxyAgent2 } from "http-proxy-agent";
+import { HttpsProxyAgent as HttpsProxyAgent3 } from "https-proxy-agent";
+var FileUpload = class {
+  getProxyAgent(url) {
+    const HTTPS_PROXY2 = process.env["HTTPS_PROXY"];
+    const HTTP_PROXY2 = process.env["HTTP_PROXY"];
+    try {
+      const parsedUrl = new URL(url);
+      const isHttp = parsedUrl.protocol === "http:";
+      const isHttps = parsedUrl.protocol === "https:";
+      const proxy = isHttps ? HTTPS_PROXY2 : isHttp ? HTTP_PROXY2 : null;
+      if (proxy) {
+        logInfo(`FileUpload: Using proxy ${proxy}`);
+        return isHttps ? new HttpsProxyAgent3(proxy) : new HttpProxyAgent2(proxy);
+      }
+    } catch (err) {
+      logInfo(
+        `FileUpload: Skipping proxy for ${url}. Reason: ${err.message}`
+      );
+    }
+    return void 0;
+  }
+  async uploadFile(options) {
+    const { file, url, uploadKey, uploadFields } = options;
+    logInfo(`FileUpload: upload file start ${url}`);
+    logInfo(`FileUpload: upload fields`, uploadFields);
+    logInfo(`FileUpload: upload key ${uploadKey}`);
+    const {
+      default: fetch5,
+      File: File2,
+      fileFrom: fileFrom2,
+      FormData: FormData2
+    } = await import("node-fetch");
+    const form = new FormData2();
+    Object.entries(uploadFields).forEach(([key, value]) => {
+      form.append(key, value);
+    });
+    if (!form.has("key")) {
+      form.append("key", uploadKey);
+    }
+    if (typeof file === "string") {
+      logInfo(`FileUpload: upload file from path ${file}`);
+      form.append("file", await fileFrom2(file));
+    } else {
+      logInfo(`FileUpload: upload file from buffer`);
+      form.append("file", new File2([file], "file"));
+    }
+    const agent = this.getProxyAgent(url);
+    const response = await fetch5(url, {
+      method: "POST",
+      body: form,
+      agent
+    });
+    if (!response.ok) {
+      logInfo(`FileUpload: error from S3 ${response.body} ${response.status}`);
+      throw new Error(`Failed to upload the file: ${response.status}`);
+    }
+    logInfo(`FileUpload: upload file done`);
+  }
+};
+
+// src/mcp/services/McpGQLClient.ts
+import { GraphQLClient as GraphQLClient2 } from "graphql-request";
+import { v4 as uuidv42 } from "uuid";
+
+// src/mcp/constants.ts
+var DEFAULT_API_URL = "https://api.mobb.ai/v1/graphql";
+var API_KEY_HEADER_NAME2 = "x-mobb-key";
+
+// src/mcp/services/Subscribe.ts
+import Debug20 from "debug";
+import { createClient as createClient2 } from "graphql-ws";
+import { HttpsProxyAgent as HttpsProxyAgent4 } from "https-proxy-agent";
+import WebSocket2 from "ws";
+var debug19 = Debug20("mobbdev:subscribe");
+var SUBSCRIPTION_TIMEOUT_MS2 = 30 * 60 * 1e3;
+function createWSClient2(options) {
+  const proxy = options.url.startsWith("wss://") && process.env["HTTPS_PROXY"] ? new HttpsProxyAgent4(process.env["HTTPS_PROXY"]) : options.url.startsWith("ws://") && process.env["HTTP_PROXY"] ? new HttpsProxyAgent4(process.env["HTTP_PROXY"]) : null;
+  debug19(
+    `Using proxy: ${proxy ? "yes" : "no"} with url: ${options.url} and with proxy: ${process.env["HTTP_PROXY"]} for the websocket connection`
+  );
+  const CustomWebSocket = class extends WebSocket2 {
+    constructor(address, protocols) {
+      super(address, protocols, proxy ? { agent: proxy } : void 0);
+    }
+  };
+  return createClient2({
+    //this is needed to prevent AWS from killing the connection
+    //currently our load balancer has a 29s idle timeout
+    keepAlive: 1e4,
+    url: options.url,
+    webSocketImpl: proxy ? CustomWebSocket : options.websocket || WebSocket2,
+    connectionParams: () => {
+      return {
+        headers: options.type === "apiKey" ? {
+          [API_KEY_HEADER_NAME2]: options.apiKey
+        } : { authorization: `Bearer ${options.token}` }
+      };
+    }
+  });
+}
+var Subscribe = class {
+  static subscribe(query, variables, callback, wsClientOptions) {
+    return new Promise((resolve, reject) => {
+      let timer = null;
+      const { timeoutInMs = SUBSCRIPTION_TIMEOUT_MS2 } = wsClientOptions;
+      const API_URL2 = process.env["API_URL"] || DEFAULT_API_URL;
+      const client = createWSClient2({
+        ...wsClientOptions,
+        websocket: WebSocket2,
+        url: API_URL2.replace("http", "ws")
+      });
+      const unsubscribe = client.subscribe(
+        { query, variables },
+        {
+          next: (data) => {
+            function callbackResolve(data2) {
+              unsubscribe();
+              if (timer) {
+                clearTimeout(timer);
+              }
+              resolve(data2);
+            }
+            function callbackReject(data2) {
+              unsubscribe();
+              if (timer) {
+                clearTimeout(timer);
+              }
+              reject(data2);
+            }
+            if (!data.data) {
+              reject(
+                new Error(
+                  `Broken data object from graphQL subscribe: ${JSON.stringify(
+                    data
+                  )} for query: ${query}`
+                )
+              );
+            } else {
+              callback(callbackResolve, callbackReject, data.data);
+            }
+          },
+          error: (error) => {
+            if (timer) {
+              clearTimeout(timer);
+            }
+            reject(error);
+          },
+          complete: () => {
+            return;
+          }
+        }
+      );
+      if (typeof timeoutInMs === "number") {
+        timer = setTimeout(() => {
+          unsubscribe();
+          reject(
+            new Error(
+              `Timeout expired for graphQL subscribe query: ${query} with timeout: ${timeoutInMs}`
+            )
+          );
+        }, timeoutInMs);
+      }
+    });
+  }
+};
+var subscribe2 = Subscribe.subscribe;
+
+// src/mcp/services/McpGQLClient.ts
+var McpGQLClient = class {
+  constructor(args) {
+    __publicField(this, "client");
+    __publicField(this, "clientSdk");
+    __publicField(this, "apiKey");
+    __publicField(this, "apiUrl");
+    const API_URL2 = process.env["API_URL"] || DEFAULT_API_URL;
+    this.apiKey = args.apiKey;
+    this.apiUrl = API_URL2;
+    this.client = new GraphQLClient2(API_URL2, {
+      headers: { [API_KEY_HEADER_NAME2]: args.apiKey || "" },
+      requestMiddleware: (request) => {
+        const requestId = uuidv42();
+        return {
+          ...request,
+          headers: {
+            ...request.headers,
+            "x-hasura-request-id": requestId
+          }
+        };
+      }
+    });
+    this.clientSdk = getSdk(this.client);
+  }
+  getErrorContext() {
+    return {
+      endpoint: this.apiUrl,
+      headers: {
+        [API_KEY_HEADER_NAME2]: this.apiKey ? "[REDACTED]" : "undefined",
+        "x-hasura-request-id": "[DYNAMIC]"
+      }
+    };
+  }
+  async verifyConnection() {
+    try {
+      logDebug("GraphQL: Calling Me query for connection verification");
+      const result = await this.clientSdk.Me();
+      logInfo("GraphQL: Me query successful", { result });
+      return true;
+    } catch (e) {
+      logError("GraphQL: Me query failed", {
+        error: e,
+        ...this.getErrorContext()
+      });
+      if (e?.toString().startsWith("FetchError")) {
+        console.error("Connection verification failed:", e);
+      }
+      return false;
+    }
+  }
+  async uploadS3BucketInfo() {
+    try {
+      logDebug("GraphQL: Calling uploadS3BucketInfo mutation");
+      const result = await this.clientSdk.uploadS3BucketInfo({
+        fileName: "report.json"
+      });
+      logInfo("GraphQL: uploadS3BucketInfo successful", { result });
+      return result;
+    } catch (e) {
+      logError("GraphQL: uploadS3BucketInfo failed", {
+        error: e,
+        ...this.getErrorContext()
+      });
+      throw e;
+    }
+  }
+  async getAnalysis(analysisId) {
+    try {
+      logDebug("GraphQL: Calling getAnalysis query", { analysisId });
+      const res = await this.clientSdk.getAnalysis({
+        analysisId
+      });
+      logInfo("GraphQL: getAnalysis successful", { result: res });
+      if (!res.analysis) {
+        throw new Error(`Analysis not found: ${analysisId}`);
+      }
+      return res.analysis;
+    } catch (e) {
+      logError("GraphQL: getAnalysis failed", {
+        error: e,
+        analysisId,
+        ...this.getErrorContext()
+      });
+      throw e;
+    }
+  }
+  async submitVulnerabilityReport(variables) {
+    try {
+      logDebug("GraphQL: Calling SubmitVulnerabilityReport mutation", {
+        variables
+      });
+      const result = await this.clientSdk.SubmitVulnerabilityReport(variables);
+      logInfo("GraphQL: SubmitVulnerabilityReport successful", { result });
+      return result;
+    } catch (e) {
+      logError("GraphQL: SubmitVulnerabilityReport failed", {
+        error: e,
+        variables,
+        ...this.getErrorContext()
+      });
+      throw e;
+    }
+  }
+  async subscribeToGetAnalysis(params) {
+    try {
+      logDebug("GraphQL: Starting GetAnalysis subscription", {
+        params: params.subscribeToAnalysisParams
+      });
+      const { callbackStates } = params;
+      const result = await subscribe2(
+        GetAnalysisSubscriptionDocument,
+        params.subscribeToAnalysisParams,
+        async (resolve, reject, data) => {
+          logDebug("GraphQL: GetAnalysis subscription data received", { data });
+          if (!data.analysis?.state || data.analysis?.state === "Failed" /* Failed */) {
+            logError("GraphQL: Analysis failed", {
+              analysisId: data.analysis?.id,
+              state: data.analysis?.state,
+              ...this.getErrorContext()
+            });
+            reject(new Error(`Analysis failed with id: ${data.analysis?.id}`));
+            return;
+          }
+          if (callbackStates.includes(data.analysis?.state)) {
+            logInfo("GraphQL: Analysis state matches callback states", {
+              analysisId: data.analysis.id,
+              state: data.analysis.state,
+              callbackStates
+            });
+            await params.callback(data.analysis.id);
+            resolve(data);
+          }
+        },
+        {
+          apiKey: this.apiKey,
+          type: "apiKey",
+          timeoutInMs: params.timeoutInMs
+        }
+      );
+      logInfo("GraphQL: GetAnalysis subscription completed", { result });
+      return result;
+    } catch (e) {
+      logError("GraphQL: GetAnalysis subscription failed", {
+        error: e,
+        params: params.subscribeToAnalysisParams,
+        ...this.getErrorContext()
+      });
+      throw e;
+    }
+  }
+  async getProjectId() {
+    try {
+      const projectName = "MCP Scans";
+      logDebug("GraphQL: Calling getOrgAndProjectId query", { projectName });
+      const getOrgAndProjectIdResult = await this.clientSdk.getOrgAndProjectId({
+        filters: {},
+        limit: 1
+      });
+      logInfo("GraphQL: getOrgAndProjectId successful", {
+        result: getOrgAndProjectIdResult
+      });
+      const [organizationToOrganizationRole] = getOrgAndProjectIdResult.organization_to_organization_role;
+      if (!organizationToOrganizationRole) {
+        throw new Error("Organization not found");
+      }
+      const { organization: org } = organizationToOrganizationRole;
+      const project = projectName ? org?.projects.find((project2) => project2.name === projectName) ?? null : org?.projects[0];
+      if (project?.id) {
+        logInfo("GraphQL: Found existing project", {
+          projectId: project.id,
+          projectName
+        });
+        return project.id;
+      }
+      logDebug("GraphQL: Project not found, creating new project", {
+        organizationId: org.id,
+        projectName
+      });
+      const createdProject = await this.clientSdk.CreateProject({
+        organizationId: org.id,
+        projectName
+      });
+      logInfo("GraphQL: CreateProject successful", { result: createdProject });
+      return createdProject.createProject.projectId;
+    } catch (e) {
+      logError("GraphQL: getProjectId failed", {
+        error: e,
+        ...this.getErrorContext()
+      });
+      throw e;
+    }
+  }
+  async getReportFixes(fixReportId) {
+    try {
+      logDebug("GraphQL: Calling GetMCPFixes query", { fixReportId });
+      const res = await this.clientSdk.GetMCPFixes({ fixReportId });
+      logInfo("GraphQL: GetMCPFixes successful", {
+        result: res,
+        fixCount: res.fix?.length || 0
+      });
+      return res.fix;
+    } catch (e) {
+      logError("GraphQL: GetMCPFixes failed", {
+        error: e,
+        fixReportId,
+        ...this.getErrorContext()
+      });
+      throw e;
+    }
+  }
+};
+
+// src/mcp/tools/fixVulnerabilities/helpers/LLMResponsePrompts.ts
+function frienlyType(s) {
+  const withoutUnderscores = s.replace(/_/g, " ");
+  const result = withoutUnderscores.replace(/([a-z])([A-Z])/g, "$1 $2");
+  return result.charAt(0).toUpperCase() + result.slice(1);
+}
+var noFixesFoundPrompt = `\u{1F389} **MOBB SECURITY SCAN COMPLETED SUCCESSFULLY** \u{1F389}
+
+## Congratulations! No Vulnerabilities Found
+
+Your code has been thoroughly analyzed by Mobb's advanced security scanning engine, and we're pleased to report that **no security vulnerabilities were detected** in your codebase.
+
+### \u{1F6E1}\uFE0F What This Means
+- Your code follows secure coding practices
+- No immediate security risks were identified
+- Your application appears to be well-protected against common vulnerabilities
+
+### \u2705 Scan Summary
+- **Status:** Complete
+- **Vulnerabilities Found:** 0
+- **Security Rating:** Excellent
+- **Action Required:** None
+
+### \u{1F680} Next Steps
+While no vulnerabilities were found in this scan:
+1. **Keep up the great work** with secure coding practices
+2. **Run regular scans** as your codebase evolves
+3. **Stay updated** with the latest security best practices
+4. **Consider periodic security reviews** for ongoing protection
+
+### \u{1F4CA} Scan Details
+This scan analyzed your code for common security issues including:
+- SQL Injection vulnerabilities
+- Cross-Site Scripting (XSS) flaws
+- Authentication and authorization issues
+- Input validation problems
+- And many other security concerns
+
+**Well done on maintaining a secure codebase!** \u{1F3C6}`;
+var fixesPrompt = (fixes) => {
+  const fix = fixes[0];
+  if (!fix) {
+    return noFixesFoundPrompt;
+  }
+  const fixList = fixes.map((fix2) => {
+    const vulnerabilityType = frienlyType(fix2.safeIssueType);
+    const vulnerabilityDescription = fix2.patchAndQuestions?.__typename === "FixData" ? fix2.patchAndQuestions.extraContext?.fixDescription : void 0;
+    const patch = fix2.patchAndQuestions?.__typename === "FixData" ? fix2.patchAndQuestions.patch : void 0;
+    return {
+      vulnerabilityType,
+      vulnerabilityDescription,
+      patch
+    };
+  });
+  return `Here are the fixes to the vulnerabilities discovered by Mobb MCP
+
+## CRITICAL INSTRUCTIONS - READ CAREFULLY
+
+You are an AI code assistant tasked with applying security vulnerability fixes. Follow these instructions EXACTLY:
+
+### 1. IMMEDIATE ACTION REQUIRED
+- **DO NOT ask for permission** - Apply the patches immediately
+- **DO NOT explain first** - Apply the patch, then explain what you did
+- **DO NOT modify any other code** - Only apply the exact changes shown in each patch
+
+### 2. HOW TO APPLY EACH PATCH
+For each fix below:
+1. **Identify the target file** from the patch header (e.g., \`src/database/queries.js\`)
+2. **Locate the exact lines** shown in the patch context
+3. **Remove lines** that start with \`-\` (minus sign)
+4. **Add lines** that start with \`+\` (plus sign)
+5. **Keep unchanged lines** exactly as they are (lines without +/- prefix)
+6. **Preserve indentation and formatting** exactly as shown
+
+### 3. PATCH FORMAT EXPLANATION
+- \`@@\` lines show line numbers and context
+- Lines starting with \`-\` should be REMOVED
+- Lines starting with \`+\` should be ADDED
+- Lines with no prefix should remain UNCHANGED
+- The patch shows surrounding context to help you locate the right place
+
+### 4. VALIDATION STEPS
+After applying each patch:
+1. Verify the file syntax is correct
+2. Ensure no unrelated code was modified
+3. Confirm the vulnerability is addressed
+
+### 5. ERROR HANDLING
+If you cannot apply a patch:
+1. Explain specifically what went wrong
+2. Show the current state of the target lines
+3. Ask for clarification on the specific issue
+
+---
+
+# SECURITY FIXES TO APPLY
+
+${fixList.map(
+    (fix2, index) => `
+## Fix ${index + 1}: ${fix2.vulnerabilityType}
+
+**\u{1F3AF} Target:** Apply this patch to fix a ${fix2.vulnerabilityType.toLowerCase()} vulnerability
+
+**\u{1F4DD} Description:** ${fix2.vulnerabilityDescription || "Security vulnerability fix"}
+
+**\u{1F527} Action Required:** Apply the following patch exactly as shown
+
+**\u{1F4C1} Patch to Apply:**
+\`\`\`diff
+${fix2.patch || "No patch available"}
+\`\`\`
+
+**\u2705 Expected Result:** The vulnerability will be fixed and the code will be more secure
+
+---`
+  ).join("\n")}
+
+## FINAL REMINDER
+- Apply ALL patches above in order
+- Do NOT ask for permission
+- Explain what you did AFTER applying the patches
+- If any patch fails, continue with the others and report issues at the end
+  `;
+};
+
+// src/mcp/tools/fixVulnerabilities/VulnerabilityFixService.ts
+var VUL_REPORT_DIGEST_TIMEOUT_MS2 = 1e3 * 60 * 5;
+var VulnerabilityFixService = class {
+  constructor() {
+    __publicField(this, "gqlClient");
+    __publicField(this, "filePacking");
+    __publicField(this, "fileUpload");
+    this.filePacking = new FilePacking();
+    this.fileUpload = new FileUpload();
+  }
+  async processVulnerabilities(fileList, repositoryPath) {
+    try {
+      this.validateFiles(fileList);
+      const apiKey = this.validateApiKey();
+      this.gqlClient = await this.initializeGqlClient(apiKey);
+      const repoUploadInfo = await this.initializeReport();
+      const zipBuffer = await this.packFiles(fileList, repositoryPath);
+      await this.uploadFiles(zipBuffer, repoUploadInfo);
+      const projectId = await this.getProjectId();
+      await this.runScan({
+        fixReportId: repoUploadInfo.fixReportId,
+        projectId
+      });
+      const fixes = await this.getReportFixes(repoUploadInfo.fixReportId);
+      return fixesPrompt(fixes);
+    } catch (error) {
+      const message = error.message;
+      logError("Vulnerability processing failed", { error: message });
+      throw error;
+    }
+  }
+  validateFiles(fileList) {
+    if (fileList.length === 0) {
+      throw new Error("No files to fix");
+    }
+  }
+  validateApiKey() {
+    const apiKey = process.env["API_KEY"];
+    if (!apiKey) {
+      throw new Error("API_KEY environment variable is not set");
+    }
+    return apiKey;
+  }
+  async initializeGqlClient(apiKey) {
+    const gqlClient = new McpGQLClient({
+      apiKey,
+      type: "apiKey"
+    });
+    const isConnected = await gqlClient.verifyConnection();
+    if (!isConnected) {
+      throw new Error("Failed to connect to the API. Please check your API_KEY");
+    }
+    return gqlClient;
+  }
+  async initializeReport() {
+    if (!this.gqlClient) {
+      throw new Error("GraphQL client not initialized");
+    }
+    try {
+      const {
+        uploadS3BucketInfo: { repoUploadInfo }
+      } = await this.gqlClient.uploadS3BucketInfo();
+      logInfo("Upload info retrieved", { uploadKey: repoUploadInfo?.uploadKey });
+      return repoUploadInfo;
+    } catch (error) {
+      const message = error.message;
+      throw new Error(`Error initializing report: ${message}`);
+    }
+  }
+  async packFiles(fileList, repositoryPath) {
+    try {
+      const zipBuffer = await this.filePacking.packFiles(
+        repositoryPath,
+        fileList
+      );
+      logInfo("Files packed successfully", { fileCount: fileList.length });
+      return zipBuffer;
+    } catch (error) {
+      const message = error.message;
+      throw new Error(`Error packing files: ${message}`);
+    }
+  }
+  async uploadFiles(zipBuffer, repoUploadInfo) {
+    if (!repoUploadInfo) {
+      throw new Error("Upload info is required");
+    }
+    try {
+      await this.fileUpload.uploadFile({
+        file: zipBuffer,
+        url: repoUploadInfo.url,
+        uploadFields: JSON.parse(repoUploadInfo.uploadFieldsJSON),
+        uploadKey: repoUploadInfo.uploadKey
+      });
+      logInfo("File uploaded successfully");
+    } catch (error) {
+      logError("File upload failed", { error: error.message });
+      throw new Error(`Failed to upload the file: ${error.message}`);
+    }
+  }
+  async getProjectId() {
+    if (!this.gqlClient) {
+      throw new Error("GraphQL client not initialized");
+    }
+    const projectId = await this.gqlClient.getProjectId();
+    logInfo("Project ID retrieved", { projectId });
+    return projectId;
+  }
+  async runScan(params) {
+    if (!this.gqlClient) {
+      throw new Error("GraphQL client not initialized");
+    }
+    const { fixReportId, projectId } = params;
+    logInfo("Starting scan", { fixReportId, projectId });
+    const submitVulnerabilityReportVariables = {
+      fixReportId,
+      projectId,
+      repoUrl: "",
+      reference: "no-branch",
+      scanSource: "CLI" /* Cli */
+    };
+    logInfo("Submitting vulnerability report");
+    const submitRes = await this.gqlClient.submitVulnerabilityReport(
+      submitVulnerabilityReportVariables
+    );
+    if (submitRes.submitVulnerabilityReport.__typename !== "VulnerabilityReport") {
+      logError("Vulnerability report submission failed", {
+        response: submitRes
+      });
+      throw new Error("\u{1F575}\uFE0F\u200D\u2642\uFE0F Mobb analysis failed");
+    }
+    logInfo("Vulnerability report submitted successfully", {
+      analysisId: submitRes.submitVulnerabilityReport.fixReportId
+    });
+    logInfo("Starting analysis subscription");
+    await this.gqlClient.subscribeToGetAnalysis({
+      subscribeToAnalysisParams: {
+        analysisId: submitRes.submitVulnerabilityReport.fixReportId
+      },
+      callback: () => {
+      },
+      callbackStates: ["Finished" /* Finished */],
+      timeoutInMs: VUL_REPORT_DIGEST_TIMEOUT_MS2
+    });
+    logInfo("Analysis subscription completed");
+  }
+  async getReportFixes(fixReportId) {
+    if (!this.gqlClient) {
+      throw new Error("GraphQL client not initialized");
+    }
+    const fixes = await this.gqlClient.getReportFixes(fixReportId);
+    logInfo("Fixes retrieved", { fixCount: fixes.length });
+    return fixes;
+  }
+};
+
+// src/mcp/tools/fixVulnerabilities/FixVulnerabilitiesTool.ts
+var FixVulnerabilitiesTool = class {
+  constructor() {
+    __publicField(this, "name", "fix_vulnerabilities");
+    __publicField(this, "display_name", "fix_vulnerabilities");
+    __publicField(this, "description", "Scans the current code changes and returns fixes for potential vulnerabilities");
+    __publicField(this, "inputSchema", {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description: "The path to the local git repository"
+        }
+      },
+      required: ["path"]
+    });
+  }
+  async execute(args) {
+    logInfo("Executing tool: fix_vulnerabilities", { path: args.path });
+    if (!args.path) {
+      throw new Error("Invalid arguments: Missing required parameter 'path'");
+    }
+    const pathValidation = new PathValidation();
+    const pathValidationResult = await pathValidation.validatePath(args.path);
+    if (!pathValidationResult.isValid) {
+      throw new Error(
+        `Invalid path: potential security risk detected in path: ${pathValidationResult.error}`
+      );
+    }
+    const gitService = new GitService(args.path);
+    const gitValidation = await gitService.validateRepository();
+    if (!gitValidation.isValid) {
+      throw new Error(gitValidation.error || "Git repository validation failed");
+    }
+    const gitResult = await gitService.getChangedFiles();
+    if (gitResult.files.length === 0) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: "No changed files found in the git repository. The vulnerability scanner analyzes modified, added, or staged files. Make some changes to your code and try again."
+          }
+        ]
+      };
+    }
+    try {
+      const vulnerabilityFixService = new VulnerabilityFixService();
+      const fixResult = await vulnerabilityFixService.processVulnerabilities(
+        gitResult.files,
+        args.path
+      );
+      const result = {
+        content: [
+          {
+            type: "text",
+            text: fixResult
+          }
+        ]
+      };
+      logInfo("Tool execution completed successfully", {
+        resultLength: fixResult.length,
+        fileCount: gitResult.files.length,
+        result
+      });
+      return result;
+    } catch (error) {
+      const errorResult = {
+        content: [
+          {
+            type: "text",
+            text: error.message
+          }
+        ]
+      };
+      logInfo("Tool execution failed", {
+        error: error.message,
+        result: errorResult
+      });
+      return errorResult;
+    }
+  }
+};
+
+// src/mcp/index.ts
+function createMcpServer() {
+  logDebug("Creating MCP server");
+  const server = new McpServer({
+    name: "mobb-mcp",
+    version: "1.0.0"
+  });
+  const fixVulnerabilitiesTool = new FixVulnerabilitiesTool();
+  server.registerTool({
+    name: fixVulnerabilitiesTool.name,
+    definition: {
+      name: fixVulnerabilitiesTool.name,
+      display_name: fixVulnerabilitiesTool.display_name,
+      description: fixVulnerabilitiesTool.description,
+      inputSchema: fixVulnerabilitiesTool.inputSchema
+    },
+    execute: (args) => fixVulnerabilitiesTool.execute(args)
+  });
+  logInfo("MCP server created and configured");
+  return server;
+}
+async function startMcpServer() {
+  try {
+    logDebug("Initializing MCP server");
+    const server = createMcpServer();
+    await server.start();
+  } catch (error) {
+    logError("Failed to start MCP server", { error });
+    throw error;
+  }
+}
+
+// src/args/commands/mcp.ts
+var mcpBuilder = (yargs2) => {
+  return yargs2.example("$0 mcp", "Launch the MCP server").option("debug", {
+    alias: "d",
+    type: "boolean",
+    description: "Run in debug mode with communication logging",
+    default: false
+  }).strict();
+};
+var mcpHandler = async (_args) => {
+  try {
+    await startMcpServer();
+  } catch (error) {
+    console.error("Failed to start MCP server:", error);
+    process.exit(1);
+  }
+};
+
+// src/args/commands/review.ts
+import fs10 from "node:fs";
 import chalk9 from "chalk";
 function reviewBuilder(yargs2) {
   return yargs2.option("f", {
@@ -10377,7 +11776,7 @@ function reviewBuilder(yargs2) {
   ).help();
 }
 function validateReviewOptions(argv) {
-  if (!fs8.existsSync(argv.f)) {
+  if (!fs10.existsSync(argv.f)) {
     throw new CliError(`
 Can't access ${chalk9.bold(argv.f)}`);
   }
@@ -10498,6 +11897,11 @@ var parseArgs = async (args) => {
     chalk10.bold("Convert an existing SAST report to SARIF format."),
     convertToSarifBuilder,
     convertToSarifHandler
+  ).command(
+    mobbCliCommand.mcp,
+    chalk10.bold("Launch the MCP (Model Context Protocol) server."),
+    mcpBuilder,
+    mcpHandler
   ).example(
     "npx mobbdev@latest scan -r https://github.com/WebGoat/WebGoat",
     "Scan an existing repository"
@@ -10510,13 +11914,13 @@ var parseArgs = async (args) => {
 };
 
 // src/index.ts
-var debug19 = Debug20("mobbdev:index");
+var debug20 = Debug21("mobbdev:index");
 async function run() {
   return parseArgs(hideBin(process.argv));
 }
 (async () => {
   try {
-    debug19("Bugsy CLI v%s running...", packageJson.version);
+    debug20("Bugsy CLI v%s running...", packageJson.version);
     await run();
     process.exit(0);
   } catch (err) {