nodebench-mcp 2.0.0 → 2.2.0

package/dist/tools/securityTools.js

@@ -0,0 +1,338 @@
+/**
+ * Security tools — dependency auditing and code security analysis.
+ *
+ * - scan_dependencies: Parse package manifests, detect known vulnerabilities and outdated packages
+ * - run_code_analysis: Static analysis on code/text for security patterns, secrets, quality issues
+ *
+ * Both tools work locally without API keys — pure regex/pattern-based detection.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as childProcess from "node:child_process";
+function parsePackageJson(content) {
+    try {
+        const pkg = JSON.parse(content);
+        const deps = [];
+        for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
+            deps.push({ name, version: String(version), type: "production" });
+        }
+        for (const [name, version] of Object.entries(pkg.devDependencies ?? {})) {
+            deps.push({ name, version: String(version), type: "dev" });
+        }
+        for (const [name, version] of Object.entries(pkg.optionalDependencies ?? {})) {
+            deps.push({ name, version: String(version), type: "optional" });
+        }
+        return deps;
+    }
+    catch {
+        return [];
+    }
+}
+function parseRequirementsTxt(content) {
+    return content
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line && !line.startsWith("#") && !line.startsWith("-"))
+        .map((line) => {
+        const match = line.match(/^([a-zA-Z0-9_-]+)\s*([><=!~]+\s*[\d.]+)?/);
+        if (!match)
+            return null;
+        return { name: match[1], version: match[2]?.trim() || "*", type: "production" };
+    })
+        .filter(Boolean);
+}
+function runNpmAudit(projectRoot) {
+    try {
+        const result = childProcess.execSync("npm audit --json 2>/dev/null", {
+            cwd: projectRoot,
+            timeout: 30000,
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const audit = JSON.parse(result);
+        const vulns = [];
+        if (audit.vulnerabilities) {
+            for (const [pkg, info] of Object.entries(audit.vulnerabilities)) {
+                vulns.push({
+                    package: pkg,
+                    severity: info.severity ?? "moderate",
+                    title: info.fixAvailable ? `Fix available: ${typeof info.fixAvailable === "object" ? info.fixAvailable.name : "update"}` : "Vulnerable",
+                    url: info.via?.[0]?.url,
+                });
+            }
+        }
+        return vulns;
+    }
+    catch (err) {
+        // npm audit returns exit code 1 when vulnerabilities found — still has valid JSON
+        try {
+            const output = err.stdout || err.output?.[1];
+            if (typeof output === "string" && output.includes('"vulnerabilities"')) {
+                const audit = JSON.parse(output);
+                const vulns = [];
+                for (const [pkg, info] of Object.entries(audit.vulnerabilities ?? {})) {
+                    vulns.push({
+                        package: pkg,
+                        severity: info.severity ?? "moderate",
+                        title: info.fixAvailable ? "Fix available" : "Vulnerable",
+                        url: info.via?.[0]?.url,
+                    });
+                }
+                return vulns;
+            }
+        }
+        catch { /* parsing failed */ }
+        return [];
+    }
+}
+// Secret patterns (HIGH severity)
+const SECRET_PATTERNS = [
+    { pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"][a-zA-Z0-9_\-]{20,}['"]/gi, desc: "Hardcoded API key", remediation: "Move to environment variable" },
+    { pattern: /(?:secret|token|password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi, desc: "Hardcoded secret/password", remediation: "Use a secrets manager or env var" },
+    { pattern: /(?:sk|pk)[-_](?:live|test|prod)[a-zA-Z0-9_\-]{20,}/g, desc: "Stripe-style API key", remediation: "Move to environment variable" },
+    { pattern: /ghp_[a-zA-Z0-9]{36}/g, desc: "GitHub personal access token", remediation: "Use GITHUB_TOKEN env var" },
+    { pattern: /(?:AKIA|ASIA)[A-Z0-9]{16}/g, desc: "AWS access key ID", remediation: "Use AWS credentials file or IAM roles" },
+    { pattern: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g, desc: "Private key in source", remediation: "Move to secure key store" },
+];
+// Homograph patterns (same as terminal-security-scanner)
+const CONFUSABLE_RANGES = [
+    { start: 0x0400, end: 0x04ff, script: "Cyrillic" },
+    { start: 0x0370, end: 0x03ff, script: "Greek" },
+    { start: 0xff00, end: 0xffef, script: "Fullwidth" },
+];
+const INVISIBLE_CHARS = [0x200b, 0x200c, 0x200d, 0x2060, 0xfeff];
+// ANSI injection patterns
+const ANSI_PATTERNS = [
+    { pattern: /\x1b\]52;[^\x07\x1b]*(?:\x07|\x1b\\)/g, severity: "HIGH", desc: "OSC 52 clipboard access" },
+    { pattern: /\x1b\](?:0|1|2);[^\x07\x1b]*(?:\x07|\x1b\\)/g, severity: "MEDIUM", desc: "OSC title spoofing" },
+    { pattern: /\x1bP[^\x1b]*\x1b\\/g, severity: "MEDIUM", desc: "DCS sequence" },
+    { pattern: /\\x1[bB]|\\033|\\e\[/g, severity: "LOW", desc: "Encoded ANSI escape" },
+];
+// URL patterns
+const URL_RISK_PATTERNS = [
+    { pattern: /data:\s*(?:text\/html|application\/javascript)[;,][^\s'")\]]+/gi, severity: "HIGH", desc: "Executable data: URL" },
+    { pattern: /javascript\s*:/gi, severity: "HIGH", desc: "javascript: URL scheme" },
+    { pattern: /https?:\/\/[^\s/]*xn--[^\s/]+/gi, severity: "MEDIUM", desc: "Punycode/IDN domain" },
+    { pattern: /https?:\/\/[^\s]*@[^\s]+/g, severity: "MEDIUM", desc: "URL with credential confusion (@)" },
+];
+// Quality patterns
+const QUALITY_PATTERNS = [
+    { pattern: /\bTODO\b/gi, severity: "LOW", desc: "TODO comment found" },
+    { pattern: /\bFIXME\b/gi, severity: "MEDIUM", desc: "FIXME comment found" },
+    { pattern: /\bHACK\b/gi, severity: "LOW", desc: "HACK comment found" },
+    { pattern: /\bconsole\.(log|warn|error|debug)\s*\(/g, severity: "LOW", desc: "Console statement (may be debug leftover)" },
+    { pattern: /debugger\s*;/g, severity: "MEDIUM", desc: "Debugger statement" },
+];
+function analyzeCode(content, checks) {
+    const findings = [];
+    const lines = content.split("\n");
+    const runPatterns = (patterns, check, defaultSeverity) => {
+        for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+            for (const p of patterns) {
+                const regex = new RegExp(p.pattern.source, p.pattern.flags);
+                let match;
+                while ((match = regex.exec(lines[lineIdx])) !== null) {
+                    findings.push({
+                        check,
+                        severity: p.severity ?? defaultSeverity,
+                        line: lineIdx + 1,
+                        column: match.index + 1,
+                        description: p.desc,
+                        remediation: p.remediation ?? `Review and address this ${check} finding`,
+                    });
+                }
+            }
+        }
+    };
+    if (checks.includes("secrets")) {
+        runPatterns(SECRET_PATTERNS, "secrets", "HIGH");
+    }
+    if (checks.includes("homograph")) {
+        for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+            for (let col = 0; col < lines[lineIdx].length; col++) {
+                const cp = lines[lineIdx].codePointAt(col);
+                if (cp === undefined)
+                    continue;
+                if (INVISIBLE_CHARS.includes(cp)) {
+                    findings.push({
+                        check: "homograph",
+                        severity: "HIGH",
+                        line: lineIdx + 1,
+                        column: col + 1,
+                        description: `Invisible Unicode character (U+${cp.toString(16).toUpperCase().padStart(4, "0")})`,
+                        remediation: "Remove invisible characters that could hide malicious content",
+                    });
+                }
+                else {
+                    for (const range of CONFUSABLE_RANGES) {
+                        if (cp >= range.start && cp <= range.end) {
+                            findings.push({
+                                check: "homograph",
+                                severity: "MEDIUM",
+                                line: lineIdx + 1,
+                                column: col + 1,
+                                description: `${range.script} character (U+${cp.toString(16).toUpperCase().padStart(4, "0")}) may mimic ASCII`,
+                                remediation: `Replace with ASCII equivalent`,
+                            });
+                            break;
+                        }
+                    }
+                }
+                if (cp > 0xffff)
+                    col++; // Skip surrogate pair
+            }
+        }
+    }
+    if (checks.includes("ansi")) {
+        runPatterns(ANSI_PATTERNS, "ansi", "MEDIUM");
+    }
+    if (checks.includes("urls")) {
+        runPatterns(URL_RISK_PATTERNS, "urls", "MEDIUM");
+    }
+    if (checks.includes("quality")) {
+        runPatterns(QUALITY_PATTERNS, "quality", "LOW");
+    }
+    return findings;
+}
+// ─── Tools ───────────────────────────────────────────────────────────────────
+export const securityTools = [
+    {
+        name: "scan_dependencies",
+        description: "Scan a project's dependency manifest for vulnerabilities and outdated packages. Auto-detects package.json, requirements.txt, Cargo.toml, and go.mod. Runs npm audit when available. Returns structured findings with severity and remediation guidance.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                projectRoot: { type: "string", description: "Project root directory (default: current working directory)" },
+                packageFile: { type: "string", description: "Specific package file path to scan (overrides auto-detection)" },
+            },
+        },
+        handler: async (args) => {
+            const root = args.projectRoot || process.cwd();
+            // Auto-detect or use specified package file
+            const manifests = [];
+            if (args.packageFile) {
+                const ext = path.extname(args.packageFile);
+                manifests.push({
+                    path: args.packageFile,
+                    type: ext === ".txt" ? "pip" : args.packageFile.includes("Cargo") ? "cargo" : "npm",
+                });
+            }
+            else {
+                const candidates = [
+                    { file: "package.json", type: "npm" },
+                    { file: "requirements.txt", type: "pip" },
+                    { file: "Cargo.toml", type: "cargo" },
+                    { file: "go.mod", type: "go" },
+                ];
+                for (const c of candidates) {
+                    const fullPath = path.join(root, c.file);
+                    try {
+                        if (fs.statSync(fullPath).isFile()) {
+                            manifests.push({ path: fullPath, type: c.type });
+                        }
+                    }
+                    catch { /* not found */ }
+                }
+            }
+            if (manifests.length === 0) {
+                return { error: true, message: "No package manifest found", scannedPaths: [root] };
+            }
+            const results = [];
+            for (const manifest of manifests) {
+                let content;
+                try {
+                    content = fs.readFileSync(manifest.path, "utf-8");
+                }
+                catch {
+                    continue;
+                }
+                let dependencies = [];
+                let vulnerabilities = [];
+                if (manifest.type === "npm") {
+                    dependencies = parsePackageJson(content);
+                    vulnerabilities = runNpmAudit(root);
+                }
+                else if (manifest.type === "pip") {
+                    dependencies = parseRequirementsTxt(content);
+                }
+                results.push({
+                    manifest: manifest.path,
+                    type: manifest.type,
+                    packages: dependencies.length,
+                    dependencies,
+                    vulnerabilities,
+                });
+            }
+            const totalPackages = results.reduce((s, r) => s + r.packages, 0);
+            const totalVulns = results.reduce((s, r) => s + r.vulnerabilities.length, 0);
+            const criticalVulns = results.flatMap((r) => r.vulnerabilities).filter((v) => v.severity === "critical").length;
+            const highVulns = results.flatMap((r) => r.vulnerabilities).filter((v) => v.severity === "high").length;
+            return {
+                projectRoot: root,
+                manifests: results.map((r) => r.manifest),
+                totalPackages,
+                totalVulnerabilities: totalVulns,
+                bySeverity: {
+                    critical: criticalVulns,
+                    high: highVulns,
+                    moderate: results.flatMap((r) => r.vulnerabilities).filter((v) => v.severity === "moderate").length,
+                    low: results.flatMap((r) => r.vulnerabilities).filter((v) => v.severity === "low").length,
+                },
+                vulnerabilities: results.flatMap((r) => r.vulnerabilities),
+                dependencies: results.flatMap((r) => r.dependencies),
+                summary: totalVulns === 0
+                    ? `Scanned ${totalPackages} packages across ${results.length} manifest(s). No known vulnerabilities detected.`
+                    : `Scanned ${totalPackages} packages. Found ${totalVulns} vulnerabilities (${criticalVulns} critical, ${highVulns} high). Run 'npm audit fix' to resolve.`,
+            };
+        },
+    },
+    {
+        name: "run_code_analysis",
+        description: "Static analysis on code or text content for security issues, secrets, homograph attacks, ANSI injections, suspicious URLs, and code quality. Returns structured findings with severity, line numbers, and remediation. Works on any text content — no file system access needed.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                content: { type: "string", description: "The code or text content to analyze" },
+                checks: {
+                    type: "array",
+                    items: { type: "string", enum: ["security", "secrets", "homograph", "ansi", "urls", "quality", "all"] },
+                    description: "Which checks to run (default: ['all'])",
+                },
+                filename: { type: "string", description: "Optional filename for context in findings" },
+            },
+            required: ["content"],
+        },
+        handler: async (args) => {
+            let checks = args.checks ?? ["all"];
+            // Expand "all" and "security"
+            if (checks.includes("all")) {
+                checks = ["secrets", "homograph", "ansi", "urls", "quality"];
+            }
+            else if (checks.includes("security")) {
+                checks = [...new Set([...checks.filter((c) => c !== "security"), "secrets", "homograph", "ansi", "urls"])];
+            }
+            const findings = analyzeCode(args.content, checks);
+            const fname = args.filename ?? "<input>";
+            // Add filename to findings
+            const withFile = findings.map((f) => ({ ...f, file: fname }));
+            const bySeverity = { HIGH: 0, MEDIUM: 0, LOW: 0, INFO: 0 };
+            for (const f of findings)
+                bySeverity[f.severity]++;
+            const byCheck = {};
+            for (const f of findings)
+                byCheck[f.check] = (byCheck[f.check] || 0) + 1;
+            return {
+                findings: withFile,
+                totalFindings: findings.length,
+                bySeverity,
+                byCheck,
+                checksRun: checks,
+                linesAnalyzed: args.content.split("\n").length,
+                summary: findings.length === 0
+                    ? `No issues found across ${checks.length} check categories.`
+                    : `Found ${findings.length} issues: ${bySeverity.HIGH} HIGH, ${bySeverity.MEDIUM} MEDIUM, ${bySeverity.LOW} LOW.`,
+            };
+        },
+    },
+];
+//# sourceMappingURL=securityTools.js.map

package/dist/tools/securityTools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityTools.js","sourceRoot":"","sources":["../../src/tools/securityTools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAC;AAkBnD,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,GAAqB,EAAE,CAAC;QAElC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO,OAAO;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACxE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC;IAC3F,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAqB,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,8BAA8B,EAAE;YACnE,GAAG,EAAE,WAAW;YAChB,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,KAAK,GAAwB,EAAE,CAAC;QAEtC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAoB,EAAE,CAAC;gBACnF,KAAK,CAAC,IAAI,CAAC;oBACT,OAAO,EAAE,GAAG;oBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,UAAU;oBACrC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,YAAY;oBACvI,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,kFAAkF;QAClF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAwB,EAAE,CAAC;gBACtC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAoB,EAAE,CAAC;oBACzF,KAAK,CAAC,IAAI,CAAC;wBACT,OAAO,EAAE,GAAG;wBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,UAAU;wBACrC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;wBACzD,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;qBACxB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAaD,kCAAkC;AAClC,MAAM,eAAe,GAAG;IACtB,EAAE,OAAO,EAAE,+DAA+D,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,8BAA8B,EAAE;IACpJ,EAAE,OAAO,EAAE,mEAAmE,EAAE,IAAI,EAAE,2BAA2B,EAAE,WAAW,EAAE,kCAAkC,EAAE;IACpK,EAAE,OAAO,EAAE,qDAAqD,EAAE,IAAI,EAAE,sBAAsB,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAC7I,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,8BAA8B,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAClH,EAAE,OAAO,EAAE,4BAA4B,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,uCAAuC,EAAE;IAC1H,EAAE,OAAO,EAAE,gDAAgD,EAAE,IAAI,EAAE,uBAAuB,EAAE,WAAW,EAAE,0BAA0B,EAAE;CACtI,CAAC;AAEF,yDAAyD;AACzD,MAAM,iBAAiB,GAA0D;IAC/E,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;IAClD,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAC/C,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE;CACpD,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAEjE,0BAA0B;AAC1B,MAAM,aAAa,GAAG;IACpB,EAAE,OAAO,EAAE,uCAAuC,EAAE,QAAQ,EAAE,MAAe,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAChH,EAAE,OAAO,EAAE,8CAA8C,EAAE,QAAQ,EAAE,QAAiB,EAAE,IAAI,EAAE,oBAAoB,EAAE;IACpH,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,QAAiB,EAAE,IAAI,EAAE,cAAc,EAAE;IACtF,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAc,EAAE,IAAI,EAAE,qBAAqB,EAAE;CAC5F,CAAC;AAEF,eAAe;AACf,MAAM,iBAAiB,GAAG;IACxB,EAAE,OAAO,EAAE,iEAAiE,EAAE,QAAQ,EAAE,MAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE;IACvI,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAe,EAAE,IAAI,EAAE,wBAAwB,EAAE;IAC1F,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,QAAiB,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACxG,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,QAAiB,EAAE,IAAI,EAAE,mCAAmC,EAAE;CACjH,CAAC;AAEF,mBAAmB;AACnB,MAAM,gBAAgB,GAAG;IACvB,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC/E,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAiB,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACpF,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC/E,EAAE,OAAO,EAAE,yCAAyC,EAAE,QAAQ,EAAE,KAAc,EAAE,IAAI,EAAE,2CAA2C,EAAE;IACnI,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAiB,EAAE,IAAI,EAAE,oBAAoB,EAAE;CACtF,CAAC;AAEF,SAAS,WAAW,CAAC,OAAe,EAAE,MAAgB;IACpD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,WAAW,GAAG,CAAC,QAA2F,EAAE,KAAa,EAAE,eAAwC,EAAE,EAAE;QAC3K,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC5D,IAAI,KAA6B,CAAC;gBAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACrD,QAAQ,CAAC,IAAI,CAAC;wBACZ,KAAK;wBACL,QAAQ,EAAG,CAAC,CAAC,QAAoC,IAAI,eAAe;wBACpE,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;wBACvB,WAAW,EAAE,CAAC,CAAC,IAAI;wBACnB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,2BAA2B,KAAK,UAAU;qBACzE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,WAAW,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;gBACrD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,EAAE,KAAK,SAAS;oBAAE,SAAS;gBAE/B,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;oBACjC,QAAQ,CAAC,IAAI,CAAC;wBACZ,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,MAAM,EAAE,GAAG,GAAG,CAAC;wBACf,WAAW,EAAE,kCAAkC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG;wBAChG,WAAW,EAAE,+DAA+D;qBAC7E,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;wBACtC,IAAI,EAAE,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;4BACzC,QAAQ,CAAC,IAAI,CAAC;gCACZ,KAAK,EAAE,WAAW;gCAClB,QAAQ,EAAE,QAAQ;gCAClB,IAAI,EAAE,OAAO,GAAG,CAAC;gCACjB,MAAM,EAAE,GAAG,GAAG,CAAC;gCACf,WAAW,EAAE,GAAG,KAAK,CAAC,MAAM,iBAAiB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB;gCAC9G,WAAW,EAAE,+BAA+B;6BAC7C,CAAC,CAAC;4BACH,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,IAAI,EAAE,GAAG,MAAM;oBAAE,GAAG,EAAE,CAAC,CAAC,sBAAsB;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,WAAW,CAAC,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,WAAW,CAAC,gBAAgB,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAc;IACtC;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,yPAAyP;QAC3P,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE;gBAC3G,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+DAA+D,EAAE;aAC9G;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAoD,EAAE,EAAE;YACtE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAE/C,4CAA4C;YAC5C,MAAM,SAAS,GAA0C,EAAE,CAAC;YAE5D,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC3C,SAAS,CAAC,IAAI,CAAC;oBACb,IAAI,EAAE,IAAI,CAAC,WAAW;oBACtB,IAAI,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;iBACpF,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG;oBACjB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE;oBACrC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE;oBACzC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE;oBACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;iBAC/B,CAAC;gBAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;oBACzC,IAAI,CAAC;wBACH,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;4BACnC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;wBACnD,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACrF,CAAC;YAED,MAAM,OAAO,GAMR,EAAE,CAAC;YAER,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBAED,IAAI,YAAY,GAAqB,EAAE,CAAC;gBACxC,IAAI,eAAe,GAAwB,EAAE,CAAC;gBAE9C,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBAC5B,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;oBACzC,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;qBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACnC,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC/C,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,QAAQ,EAAE,YAAY,CAAC,MAAM;oBAC7B,YAAY;oBACZ,eAAe;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC7E,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;YAChH,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;YAExG,OAAO;gBACL,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACzC,aAAa;gBACb,oBAAoB,EAAE,UAAU;gBAChC,UAAU,EAAE;oBACV,QAAQ,EAAE,aAAa;oBACvB,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;oBACnG,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;iBAC1F;gBACD,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC1D,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;gBACpD,OAAO,EAAE,UAAU,KAAK,CAAC;oBACvB,CAAC,CAAC,WAAW,aAAa,oBAAoB,OAAO,CAAC,MAAM,kDAAkD;oBAC9G,CAAC,CAAC,WAAW,aAAa,oBAAoB,UAAU,qBAAqB,aAAa,cAAc,SAAS,yCAAyC;aAC7J,CAAC;QACJ,CAAC;KACF;IAED;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,kRAAkR;QACpR,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE;gBAC/E,MAAM,EAAE;oBACN,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE;oBACvG,WAAW,EAAE,wCAAwC;iBACtD;gBACD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2CAA2C,EAAE;aACvF;YACD,QAAQ,EAAE,CAAC,SAAS,CAAC;SACtB;QACD,OAAO,EAAE,KAAK,EAAE,IAA+D,EAAE,EAAE;YACjF,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YAEpC,8BAA8B;YAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YAC/D,CAAC;iBAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7G,CAAC;YAED,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;YAEzC,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAE9D,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAEnD,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAEzE,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,aAAa,EAAE,QAAQ,CAAC,MAAM;gBAC9B,UAAU;gBACV,OAAO;gBACP,SAAS,EAAE,MAAM;gBACjB,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM;gBAC9C,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAC5B,CAAC,CAAC,0BAA0B,MAAM,CAAC,MAAM,oBAAoB;oBAC7D,CAAC,CAAC,SAAS,QAAQ,CAAC,MAAM,YAAY,UAAU,CAAC,IAAI,UAAU,UAAU,CAAC,MAAM,YAAY,UAAU,CAAC,GAAG,OAAO;aACpH,CAAC;QACJ,CAAC;KACF;CACF,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nodebench-mcp",
-  "version": "2.0.0",
-  "description": "Make AI agents catch the bugs they normally ship. Structured research, risk assessment, 3-layer testing, quality gates, and persistent knowledge that compounds across tasks. Benchmarked: 13 issues caught, 26 blind spots prevented, 0 shipped to production. 75 MCP tools including parallel agent coordination for Claude Code subagents.",
+  "version": "2.2.0",
+  "description": "Make AI agents catch the bugs they normally ship. 80 MCP tools: structured research, 3-layer testing, quality gates, persistent knowledge, LLM calling, and security analysis. v2.2: +5 'doer' tools — call_llm, extract_structured_data, diff_outputs, scan_dependencies, run_code_analysis. --preset lite (32), core (57), or full (80). Benchmarked: 13 issues caught, 26 blind spots prevented.",
   "type": "module",
   "bin": {
     "nodebench-mcp": "./dist/index.js"
@@ -45,7 +45,13 @@
     "github",
     "vision",
     "verification",
-    "sqlite"
+    "sqlite",
+    "quality-gates",
+    "parallel-agents",
+    "toolset-gating",
+    "eval",
+    "qa-automation",
+    "agentic"
   ],
   "repository": {
     "type": "git",