shieldapi-mcp 1.0.1 → 1.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/index.js +44 -8
  2. package/package.json +2 -2
  3. package/src/index.ts +61 -46
package/dist/index.js CHANGED
@@ -10,6 +10,44 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
10
10
  import { z } from 'zod';
11
11
  const { SHIELDAPI_URL = 'https://shield.vainplex.dev', SHIELDAPI_WALLET_PRIVATE_KEY, } = process.env;
12
12
  const demoMode = !SHIELDAPI_WALLET_PRIVATE_KEY;
13
+ const TOOLS = {
14
+ check_url: {
15
+ description: 'Check a URL for malware, phishing, and other threats. Uses URLhaus + heuristic analysis.',
16
+ param: 'url',
17
+ paramDesc: 'The URL to check (e.g. https://example.com)',
18
+ endpoint: 'check-url',
19
+ },
20
+ check_password: {
21
+ description: 'Check if a password hash (SHA-1) has been exposed in known data breaches via HIBP.',
22
+ param: 'hash',
23
+ paramDesc: 'SHA-1 hash of the password (40 hex chars)',
24
+ endpoint: 'check-password',
25
+ },
26
+ check_password_range: {
27
+ description: 'Look up a SHA-1 hash prefix in the HIBP k-Anonymity database.',
28
+ param: 'prefix',
29
+ paramDesc: 'First 5 characters of the SHA-1 password hash',
30
+ endpoint: 'check-password-range',
31
+ },
32
+ check_domain: {
33
+ description: 'Check domain reputation: DNS records, blacklists (Spamhaus, SpamCop, SORBS), SPF/DMARC, SSL.',
34
+ param: 'domain',
35
+ paramDesc: 'Domain name to check (e.g. example.com)',
36
+ endpoint: 'check-domain',
37
+ },
38
+ check_ip: {
39
+ description: 'Check IP reputation: blacklists, Tor exit node detection, reverse DNS.',
40
+ param: 'ip',
41
+ paramDesc: 'IPv4 address to check (e.g. 8.8.8.8)',
42
+ endpoint: 'check-ip',
43
+ },
44
+ check_email: {
45
+ description: 'Check if an email address has been exposed in known data breaches via HIBP.',
46
+ param: 'email',
47
+ paramDesc: 'Email address to check',
48
+ endpoint: 'check-email',
49
+ },
50
+ };
13
51
  // --- x402 payment setup (lazy, only if wallet configured) ---
14
52
  let paymentFetch = fetch;
15
53
  async function initPaymentFetch() {
@@ -65,15 +103,13 @@ function formatResult(data) {
65
103
  // --- MCP Server ---
66
104
  const server = new McpServer({
67
105
  name: 'ShieldAPI',
68
- version: '1.0.0',
106
+ version: '1.0.2',
69
107
  });
70
- // Tools
71
- server.tool('check_url', 'Check a URL for malware, phishing, and other threats. Uses URLhaus + heuristic analysis.', { url: z.string().describe('The URL to check (e.g. https://example.com)') }, async ({ url }) => formatResult(await callShieldApi('check-url', { url })));
72
- server.tool('check_password', 'Check if a password hash (SHA-1) has been exposed in known data breaches via HIBP.', { hash: z.string().describe('SHA-1 hash of the password (40 hex chars)') }, async ({ hash }) => formatResult(await callShieldApi('check-password', { hash })));
73
- server.tool('check_password_range', 'Look up a SHA-1 hash prefix in the HIBP k-Anonymity database.', { prefix: z.string().describe('First 5 characters of the SHA-1 password hash') }, async ({ prefix }) => formatResult(await callShieldApi('check-password-range', { prefix })));
74
- server.tool('check_domain', 'Check domain reputation: DNS records, blacklists (Spamhaus, SpamCop, SORBS), SPF/DMARC, SSL.', { domain: z.string().describe('Domain name to check (e.g. example.com)') }, async ({ domain }) => formatResult(await callShieldApi('check-domain', { domain })));
75
- server.tool('check_ip', 'Check IP reputation: blacklists, Tor exit node detection, reverse DNS.', { ip: z.string().describe('IPv4 address to check (e.g. 8.8.8.8)') }, async ({ ip }) => formatResult(await callShieldApi('check-ip', { ip })));
76
- server.tool('check_email', 'Check if an email address has been exposed in known data breaches via HIBP.', { email: z.string().describe('Email address to check') }, async ({ email }) => formatResult(await callShieldApi('check-email', { email })));
108
+ // Register standard tools from config
109
+ for (const [name, def] of Object.entries(TOOLS)) {
110
+ server.tool(name, def.description, { [def.param]: z.string().describe(def.paramDesc) }, async (params) => formatResult(await callShieldApi(def.endpoint, params)));
111
+ }
112
+ // full_scan is special — single 'target' param mapped to the correct server param
77
113
  server.tool('full_scan', 'Run all security checks on a target (URL, domain, IP, or email). Most comprehensive scan.', { target: z.string().describe('Target to scan — URL, domain, IP address, or email') }, async ({ target }) => formatResult(await callShieldApi('full-scan', detectTargetType(target))));
78
114
  // --- Start ---
79
115
  async function main() {
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "shieldapi-mcp",
3
- "version": "1.0.1",
4
- "description": "MCP server for ShieldAPI",
3
+ "version": "1.0.3",
4
+ "description": "MCP server for ShieldAPI — URL scanning, breach detection, domain/IP reputation as AI agent tools. Pay-per-request with USDC micropayments via x402.",
5
5
  "main": "dist/index.js",
6
6
  "bin": {
7
7
  "shieldapi-mcp": "dist/index.js"
package/src/index.ts CHANGED
@@ -1,7 +1,7 @@
1
1
  #!/usr/bin/env node
2
2
  /**
3
3
  * ShieldAPI MCP Server
4
- *
4
+ *
5
5
  * Exposes ShieldAPI security intelligence as native MCP tools.
6
6
  * Handles x402 USDC micropayments automatically, with demo fallback.
7
7
  */
@@ -17,13 +17,61 @@ const {
17
17
 
18
18
  const demoMode = !SHIELDAPI_WALLET_PRIVATE_KEY;
19
19
 
20
+ // --- Tool definitions (single source of truth) ---
21
+
22
+ interface ToolDef {
23
+ description: string;
24
+ param: string;
25
+ paramDesc: string;
26
+ endpoint: string;
27
+ }
28
+
29
+ const TOOLS: Record<string, ToolDef> = {
30
+ check_url: {
31
+ description: 'Check a URL for malware, phishing, and other threats. Uses URLhaus + heuristic analysis.',
32
+ param: 'url',
33
+ paramDesc: 'The URL to check (e.g. https://example.com)',
34
+ endpoint: 'check-url',
35
+ },
36
+ check_password: {
37
+ description: 'Check if a password hash (SHA-1) has been exposed in known data breaches via HIBP.',
38
+ param: 'hash',
39
+ paramDesc: 'SHA-1 hash of the password (40 hex chars)',
40
+ endpoint: 'check-password',
41
+ },
42
+ check_password_range: {
43
+ description: 'Look up a SHA-1 hash prefix in the HIBP k-Anonymity database.',
44
+ param: 'prefix',
45
+ paramDesc: 'First 5 characters of the SHA-1 password hash',
46
+ endpoint: 'check-password-range',
47
+ },
48
+ check_domain: {
49
+ description: 'Check domain reputation: DNS records, blacklists (Spamhaus, SpamCop, SORBS), SPF/DMARC, SSL.',
50
+ param: 'domain',
51
+ paramDesc: 'Domain name to check (e.g. example.com)',
52
+ endpoint: 'check-domain',
53
+ },
54
+ check_ip: {
55
+ description: 'Check IP reputation: blacklists, Tor exit node detection, reverse DNS.',
56
+ param: 'ip',
57
+ paramDesc: 'IPv4 address to check (e.g. 8.8.8.8)',
58
+ endpoint: 'check-ip',
59
+ },
60
+ check_email: {
61
+ description: 'Check if an email address has been exposed in known data breaches via HIBP.',
62
+ param: 'email',
63
+ paramDesc: 'Email address to check',
64
+ endpoint: 'check-email',
65
+ },
66
+ };
67
+
20
68
  // --- x402 payment setup (lazy, only if wallet configured) ---
21
69
 
22
70
  let paymentFetch: typeof fetch = fetch;
23
71
 
24
72
  async function initPaymentFetch(): Promise<void> {
25
73
  if (demoMode) return;
26
-
74
+
27
75
  const { wrapFetchWithPayment, x402Client } = await import('@x402/fetch');
28
76
  const { ExactEvmScheme, toClientEvmSigner } = await import('@x402/evm');
29
77
  const { createWalletClient, http, publicActions } = await import('viem');
@@ -84,53 +132,20 @@ function formatResult(data: unknown): { content: Array<{ type: 'text'; text: str
84
132
 
85
133
  const server = new McpServer({
86
134
  name: 'ShieldAPI',
87
- version: '1.0.0',
135
+ version: '1.0.2',
88
136
  });
89
137
 
90
- // Tools
91
-
92
- server.tool(
93
- 'check_url',
94
- 'Check a URL for malware, phishing, and other threats. Uses URLhaus + heuristic analysis.',
95
- { url: z.string().describe('The URL to check (e.g. https://example.com)') },
96
- async ({ url }) => formatResult(await callShieldApi('check-url', { url }))
97
- );
98
-
99
- server.tool(
100
- 'check_password',
101
- 'Check if a password hash (SHA-1) has been exposed in known data breaches via HIBP.',
102
- { hash: z.string().describe('SHA-1 hash of the password (40 hex chars)') },
103
- async ({ hash }) => formatResult(await callShieldApi('check-password', { hash }))
104
- );
105
-
106
- server.tool(
107
- 'check_password_range',
108
- 'Look up a SHA-1 hash prefix in the HIBP k-Anonymity database.',
109
- { prefix: z.string().describe('First 5 characters of the SHA-1 password hash') },
110
- async ({ prefix }) => formatResult(await callShieldApi('check-password-range', { prefix }))
111
- );
112
-
113
- server.tool(
114
- 'check_domain',
115
- 'Check domain reputation: DNS records, blacklists (Spamhaus, SpamCop, SORBS), SPF/DMARC, SSL.',
116
- { domain: z.string().describe('Domain name to check (e.g. example.com)') },
117
- async ({ domain }) => formatResult(await callShieldApi('check-domain', { domain }))
118
- );
119
-
120
- server.tool(
121
- 'check_ip',
122
- 'Check IP reputation: blacklists, Tor exit node detection, reverse DNS.',
123
- { ip: z.string().describe('IPv4 address to check (e.g. 8.8.8.8)') },
124
- async ({ ip }) => formatResult(await callShieldApi('check-ip', { ip }))
125
- );
126
-
127
- server.tool(
128
- 'check_email',
129
- 'Check if an email address has been exposed in known data breaches via HIBP.',
130
- { email: z.string().describe('Email address to check') },
131
- async ({ email }) => formatResult(await callShieldApi('check-email', { email }))
132
- );
138
+ // Register standard tools from config
139
+ for (const [name, def] of Object.entries(TOOLS)) {
140
+ server.tool(
141
+ name,
142
+ def.description,
143
+ { [def.param]: z.string().describe(def.paramDesc) },
144
+ async (params) => formatResult(await callShieldApi(def.endpoint, params as Record<string, string>))
145
+ );
146
+ }
133
147
 
148
+ // full_scan is special — single 'target' param mapped to the correct server param
134
149
  server.tool(
135
150
  'full_scan',
136
151
  'Run all security checks on a target (URL, domain, IP, or email). Most comprehensive scan.',