policylayer 0.1.4 → 0.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +89 -0
- package/package.json +3 -2
package/README.md
ADDED
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
# policylayer
|
|
2
|
+
|
|
3
|
+
Scan your MCP config. See what your AI agent can do. Get a shareable report.
|
|
4
|
+
|
|
5
|
+
## Quick start
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
npx -y policylayer
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
That's it. The CLI finds your MCP config, live-scans each server, classifies every tool, and prints a report URL.
|
|
12
|
+
|
|
13
|
+
## What it does
|
|
14
|
+
|
|
15
|
+
1. **Finds your config** -- checks `.mcp.json`, `~/.claude.json`, Claude Desktop, Cursor, VS Code, Windsurf, and Codex configs automatically
|
|
16
|
+
2. **Live-scans servers** -- spawns each MCP server, performs the JSON-RPC handshake, and discovers every tool with its full schema
|
|
17
|
+
3. **Classifies tools** -- checks against the PolicyLayer database of 2,500+ classified tools. Unknown tools are classified locally using schema analysis, blast radius detection, and verb matching
|
|
18
|
+
4. **Generates a policy YAML** -- suggested default rules for every tool, ready to use with [Intercept](https://github.com/policylayer/intercept)
|
|
19
|
+
5. **Prints a report URL** -- permanent, shareable, no login required
|
|
20
|
+
6. **Contributes back** -- live-scanned tool data is contributed to the database so future scans are faster for everyone
|
|
21
|
+
|
|
22
|
+
## Commands
|
|
23
|
+
|
|
24
|
+
```bash
|
|
25
|
+
npx -y policylayer
|
|
26
|
+
```
|
|
27
|
+
|
|
28
|
+
**Options:**
|
|
29
|
+
|
|
30
|
+
| Flag | Description |
|
|
31
|
+
|------|-------------|
|
|
32
|
+
| `-d, --dir <path>` | Directory to scan for config files (default: cwd) |
|
|
33
|
+
| `-o, --output <path>` | Output path for policy YAML (default: `policylayer.yaml`) |
|
|
34
|
+
| `--no-live` | Skip live scanning, classify from config only |
|
|
35
|
+
| `--no-report` | Skip submitting report to PolicyLayer |
|
|
36
|
+
| `--timeout <ms>` | Timeout per server in milliseconds (default: 30000) |
|
|
37
|
+
| `--json` | Output results as JSON |
|
|
38
|
+
|
|
39
|
+
### Examples
|
|
40
|
+
|
|
41
|
+
```bash
|
|
42
|
+
# Auto-detect config and scan
|
|
43
|
+
npx -y policylayer
|
|
44
|
+
|
|
45
|
+
# Scan a specific directory
|
|
46
|
+
npx -y policylayer -d ~/projects/my-app
|
|
47
|
+
|
|
48
|
+
# Skip live scanning (faster, less detailed)
|
|
49
|
+
npx -y policylayer --no-live
|
|
50
|
+
|
|
51
|
+
# Output as JSON for piping
|
|
52
|
+
npx -y policylayer --json
|
|
53
|
+
|
|
54
|
+
# Custom policy output path
|
|
55
|
+
npx -y policylayer -o my-policy.yaml
|
|
56
|
+
```
|
|
57
|
+
|
|
58
|
+
## Config detection
|
|
59
|
+
|
|
60
|
+
The CLI searches these paths and uses all configs found:
|
|
61
|
+
|
|
62
|
+
| Client | Path |
|
|
63
|
+
|--------|------|
|
|
64
|
+
| Claude Code (project) | `.mcp.json` |
|
|
65
|
+
| Claude Code (user) | `~/.claude.json` |
|
|
66
|
+
| Claude Desktop | `~/Library/Application Support/Claude/claude_desktop_config.json` |
|
|
67
|
+
| Cursor | `.cursor/mcp.json` |
|
|
68
|
+
| VS Code | `.vscode/settings.json` |
|
|
69
|
+
| Windsurf | `~/.codeium/windsurf/mcp_config.json` |
|
|
70
|
+
| Codex (project) | `.codex/config.toml` |
|
|
71
|
+
| Codex (user) | `~/.codex/config.toml` |
|
|
72
|
+
|
|
73
|
+
## Privacy
|
|
74
|
+
|
|
75
|
+
The CLI **never sends** your raw config. Before anything leaves your machine:
|
|
76
|
+
|
|
77
|
+
- Environment variables are stripped
|
|
78
|
+
- Auth tokens are removed
|
|
79
|
+
- Only server names, package identifiers, and tool schemas are sent
|
|
80
|
+
- Live-scanned tool data (names, descriptions, schemas) is contributed to improve the database
|
|
81
|
+
|
|
82
|
+
Use `--no-report` to skip sending anything.
|
|
83
|
+
|
|
84
|
+
## Links
|
|
85
|
+
|
|
86
|
+
- [Example report](https://policylayer.com/scan/report/65545482-5d1d-472f-9fca-472ff1181d0d)
|
|
87
|
+
- [Scan your config online](https://policylayer.com/scan)
|
|
88
|
+
- [Policy library](https://policylayer.com/policies)
|
|
89
|
+
- [Intercept](https://github.com/policylayer/intercept) -- enforce limits on every MCP tool call
|
package/package.json
CHANGED
|
@@ -1,13 +1,14 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "policylayer",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.5",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "Scan your MCP servers for security risks — live tool discovery + classification + shareable report",
|
|
6
6
|
"bin": {
|
|
7
7
|
"policylayer": "./dist/index.js"
|
|
8
8
|
},
|
|
9
9
|
"files": [
|
|
10
|
-
"dist"
|
|
10
|
+
"dist",
|
|
11
|
+
"README.md"
|
|
11
12
|
],
|
|
12
13
|
"engines": {
|
|
13
14
|
"node": ">=20"
|