port-scanner-mcp 1.0.0 → 1.0.1

package/README.md

@@ -19,3 +19,21 @@ node dist/index.js
 ```
 
 Scans are bounded to 50 ports per call and 2 seconds per port. Scanning systems you do not own may be illegal where you live.
+
+<!-- paywall -->
+## Premium tools
+
+These tools need a license key:
+
+* `summarize_scan_results`
+
+Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-port-scanner-mcp and set it in your MCP client config:
+
+```json
+"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
+```
+
+The key is checked against MCP Marketplace, cached for 24 hours, and keeps
+working offline once one check has succeeded. Every other tool on this server
+stays free.
+<!-- /paywall -->

package/dist/api.js

@@ -50,3 +50,148 @@ export async function scanCommon(args) {
         ? `Open ports on ${host}:\n${results.join("\n")}`
         : `No common ports open on ${host}`;
 }
+// ---- muxB tools:
+const MAX_PORTS = 4096;
+const MAX_SPEC = 20000;
+const MAX_REPORT = 200000;
+const STATES = ["open", "closed", "filtered", "timeout", "refused", "unreachable"];
+function pad(label, width = 20) {
+    return label.length >= width ? label : label + " ".repeat(width - label.length);
+}
+function runsOf(sorted) {
+    const runs = [];
+    for (const port of sorted) {
+        const last = runs[runs.length - 1];
+        if (last && port === last[1] + 1)
+            last[1] = port;
+        else
+            runs.push([port, port]);
+    }
+    return runs;
+}
+function formatRuns(runs, limit = 12) {
+    if (!runs.length)
+        return "none";
+    const shown = runs.slice(0, limit).map(([from, to]) => (from === to ? String(from) : `${from}-${to}`));
+    return shown.join(", ") + (runs.length > limit ? `, +${runs.length - limit} more` : "");
+}
+export async function parsePortSpec(args) {
+    const spec = (args.spec ?? "").trim();
+    if (!spec)
+        throw new Error("Provide a port specification in spec, for example 22,80,8000-8010");
+    if (spec.length > MAX_SPEC)
+        throw new Error(`Keep spec under ${MAX_SPEC} characters`);
+    const cap = Math.min(MAX_PORTS, Math.max(1, Math.trunc(Number(args.max_ports ?? MAX_PORTS) || MAX_PORTS)));
+    const accepted = [];
+    const rejected = [];
+    let duplicates = 0;
+    const seen = new Set();
+    for (const chunk of spec.split(/[\s,;]+/).filter(Boolean)) {
+        const range = /^(\d{1,5})\s*[-:.]{1,2}\s*(\d{1,5})$/.exec(chunk);
+        const single = /^(\d{1,5})$/.exec(chunk);
+        let from;
+        let to;
+        if (range) {
+            from = Number(range[1]);
+            to = Number(range[2]);
+            if (from > to) {
+                rejected.push(`${chunk} (range runs backwards)`);
+                continue;
+            }
+            if (to - from + 1 > cap) {
+                rejected.push(`${chunk} (expands to more than ${cap} ports)`);
+                continue;
+            }
+        }
+        else if (single) {
+            from = Number(single[1]);
+            to = from;
+        }
+        else {
+            rejected.push(`${chunk} (not a port or a range)`);
+            continue;
+        }
+        if (from < 1 || to > 65535) {
+            rejected.push(`${chunk} (outside 1-65535)`);
+            continue;
+        }
+        for (let port = from; port <= to; port += 1) {
+            if (seen.has(port)) {
+                duplicates += 1;
+                continue;
+            }
+            seen.add(port);
+            accepted.push(port);
+        }
+    }
+    accepted.sort((a, b) => a - b);
+    const acceptedRuns = runsOf(accepted);
+    const out = [];
+    out.push(`Port specification expansion (${spec.length} characters of input)`);
+    out.push(`${pad("Accepted")}${accepted.length} distinct ports, lowest ${accepted[0] ?? "none"}, highest ${accepted[accepted.length - 1] ?? "none"}`);
+    out.push(`${pad("Ranges found")}${acceptedRuns.length} contiguous run${acceptedRuns.length === 1 ? "" : "s"}: ${formatRuns(acceptedRuns, 20)}`);
+    out.push(`${pad("Duplicates")}${duplicates} repeated port${duplicates === 1 ? "" : "s"} collapsed away`);
+    out.push(`${pad("Rejected")}${rejected.length} entr${rejected.length === 1 ? "y" : "ies"}`);
+    for (const item of rejected.slice(0, 12))
+        out.push(`  - ${item}`);
+    if (rejected.length > 12)
+        out.push(`  +${rejected.length - 12} more rejected entries not listed`);
+    out.push(`${pad("To scan")}${accepted.length ? `spec = "${accepted.slice(0, 40).join(",")}${accepted.length > 40 ? ",..." : ""}"` : "nothing valid to scan, fix the specification first"}`);
+    if (accepted.length > 40)
+        out.push(`  the scan_host ports field holds the full list; ${accepted.length} ports is ${Math.ceil(accepted.length / 10)} times the 50 port cap in one call`);
+    return out.join("\n");
+}
+export async function summarizeScanResults(args) {
+    const report = args.report ?? "";
+    if (!report.trim())
+        throw new Error("Paste a scan report into report to summarise");
+    if (report.length > MAX_REPORT)
+        throw new Error(`Keep report under ${MAX_REPORT} characters`);
+    const counts = Object.fromEntries(STATES.map((state) => [state, 0]));
+    const open = [];
+    const all = [];
+    let parsed = 0;
+    let ignored = 0;
+    for (const line of report.split(/\r?\n/)) {
+        const match = /(?:^|\s)(\d{1,5})\s*[:=\-]?\s*(open|closed|filtered|timeout|refused|unreachable)\b/i.exec(line);
+        if (!match) {
+            if (line.trim())
+                ignored += 1;
+            continue;
+        }
+        const port = Number(match[1]);
+        if (port < 1 || port > 65535) {
+            ignored += 1;
+            continue;
+        }
+        const state = match[2].toLowerCase();
+        counts[state] += 1;
+        parsed += 1;
+        all.push(port);
+        if (state === "open")
+            open.push(port);
+    }
+    const out = [];
+    out.push(`Scan report summary (${report.length} characters pasted)`);
+    if (!parsed) {
+        out.push(`${pad("Result")}no "port: state" line was recognised, ${ignored} line${ignored === 1 ? "" : "s"} ignored`);
+        out.push("Expected lines look like \"8080: OPEN\" or \"443 closed\".");
+        return out.join("\n");
+    }
+    const total = parsed;
+    const openSorted = [...open].sort((a, b) => a - b);
+    out.push(`${pad("Parsed")}${parsed} port lines, ${ignored} line${ignored === 1 ? "" : "s"} ignored`);
+    out.push(`${pad("States")}${STATES.filter((state) => counts[state] > 0).map((state) => `${state} ${counts[state]}`).join("  ")}`);
+    out.push(`${pad("Open ratio")}${((counts.open / total) * 100).toFixed(1)}% of ${total} probed ports answered`);
+    const runs = runsOf(openSorted);
+    out.push(`${pad("Open ports")}${openSorted.length ? formatRuns(runs, 30) : "none"}`);
+    out.push(`${pad("Highest open")}${openSorted.length ? openSorted[openSorted.length - 1] : "not reported - no port answered"}`);
+    out.push(`${pad("Contiguous runs")}${runs.length} run${runs.length === 1 ? "" : "s"}: ${formatRuns(runs, 12)}`);
+    const longest = runs.reduce((max, run) => Math.max(max, run[1] - run[0] + 1), 0);
+    const isolated = runs.filter(([from, to]) => from === to).length;
+    out.push(`${pad("Pattern")}longest contiguous open run ${longest} port${longest === 1 ? "" : "s"}, ${isolated} isolated open port${isolated === 1 ? "" : "s"}`);
+    const sorted = [...new Set(all)].sort((a, b) => a - b);
+    out.push(`${pad("Coverage")}${new Set(all).size} distinct ports probed, spanning ${sorted.length ? `${sorted[0]} to ${sorted[sorted.length - 1]}` : "not reported"}`);
+    out.push(`${pad("Reading")}${counts.open === 0 ? "nothing answered, so either the host is down or every probed port is filtered" : longest >= 3 ? "a contiguous block answered, which usually means one service listening on a range" : counts.open <= 2 ? "only one or two ports answered, which is a small attack surface" : "several scattered ports answered, worth reviewing individually"}`);
+    return out.join("\n");
+}

package/dist/license.js

@@ -0,0 +1,78 @@
+// Premium tools on this server need a license key bought from MCP Marketplace.
+// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
+// that is not listed in PREMIUM keeps working without a key.
+const SLUG = "port-scanner-mcp";
+// Tools that need a key. Everything else is free.
+const PREMIUM = new Set([
+    "summarize_scan_results",
+]);
+const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`;
+// The license check calls the marketplace's verify endpoint directly instead of
+// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
+// check it makes is rejected by Supabase before it reaches the function. The
+// publishable key below is public by design - it ships in mcp-marketplace.io's
+// own JavaScript and only ever reaches their licence check.
+const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key";
+const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h";
+const OK_CACHE_MS = 60 * 60 * 1000;
+const BAD_CACHE_MS = 60 * 1000;
+const seen = new Map();
+const REASONS = {
+    missing_key: "no key is set",
+    invalid_format: "that key is not a valid MCP Marketplace key",
+    not_found: "that key was not found",
+    revoked: "that key has been revoked",
+    rotated: "that key was rotated, use your new one",
+    expired: "that key has expired, renew it",
+    rate_limited: "there were too many checks just now, try again shortly",
+    network_error: "the license server could not be reached",
+};
+function blocked(tool, reason) {
+    const why = REASONS[reason] ?? `the license server answered "${reason}"`;
+    return `"${tool}" needs a license key, but ${why}. ` +
+        `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`;
+}
+async function verify(key) {
+    const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
+        method: "POST",
+        headers: {
+            apikey: PUBLISHABLE_KEY,
+            Authorization: `Bearer ${PUBLISHABLE_KEY}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ key, slug: SLUG }),
+        // an unusable key answers 400 with a JSON body, so read the body either way
+        signal: AbortSignal.timeout(15000),
+    });
+    const data = (await res.json());
+    if (typeof data?.valid !== "boolean")
+        return { valid: false, reason: "unexpected_response" };
+    return data;
+}
+/**
+ * Returns null when the caller may run the tool, or a short message telling
+ * them how to get a key.
+ *
+ * A good key is remembered for an hour, so a busy session does not hit the
+ * license server on every call and keeps working through a brief outage.
+ */
+export async function premiumRequired(tool) {
+    if (!PREMIUM.has(tool))
+        return null;
+    const key = process.env.MCP_LICENSE_KEY;
+    if (!key)
+        return blocked(tool, "missing_key");
+    const hit = seen.get(key);
+    if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
+        return hit.valid ? null : blocked(tool, hit.reason ?? "invalid");
+    }
+    let result;
+    try {
+        result = await verify(key);
+    }
+    catch {
+        result = { valid: false, reason: "network_error" };
+    }
+    seen.set(key, { ...result, at: Date.now() });
+    return result.valid ? null : blocked(tool, result.reason ?? "invalid");
+}

package/dist/server.js

@@ -1,7 +1,8 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { scanCommon } from "./api.js";
-import { scanHost } from "./api.js";
+import { scanHost, summarizeScanResults, parsePortSpec } from "./api.js";
+import { premiumRequired } from "./license.js";
 const text = (value) => ({ content: [{ type: "text", text: value }] });
 const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
@@ -34,5 +35,36 @@ export function createServer() {
             return textError(error(e));
         }
     });
+    server.registerTool("summarize_scan_results", {
+        title: "Summarize scan results",
+        description: "Summarise a scan report you paste back in: state counts, open ratio, open ports as contiguous runs, highest open port, longest run, isolated opens and probed coverage. Computed locally from the text you supply; no connection is attempted.",
+        inputSchema: z.object({ report: z.string().min(1).max(200000).describe("Scan output to summarise, for example \"80: OPEN\" lines, up to 200,000 characters.") }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: summarize_scan_results ----
+        const paywallMessage = await premiumRequired("summarize_scan_results");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await summarizeScanResults(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("parse_port_spec", {
+        title: "Parse port spec",
+        description: "Expand a port specification you supply into a deduplicated sorted list: contiguous runs, duplicates collapsed, backwards and out-of-range entries rejected with a reason, and the port count the specification implies. No connection is attempted.",
+        inputSchema: z.object({ spec: z.string().min(1).max(20000).describe("Port specification such as 22,80,8000-8010, up to 20,000 characters."), max_ports: z.number().int().min(1).max(4096).optional().describe("Reject any single range wider than this many ports, 1-4096.") }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        try {
+            return text(await parsePortSpec(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
     return server;
 }

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0",
+  "version": "1.0.1",
   "type": "module",
   "repository": {
     "type": "git",