silicon-transfer-mcp-server 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Silicon Networks
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,87 @@
+# Silicon Transfer MCP Server
+
+**FTP / FTPS / SFTP for Claude and other MCP clients - with built-in transfer proofs.**
+
+Every upload and download returns a verdict: `PROVEN` only when the SHA-256 of the
+remote file matches your local file. No more "transfer complete" on blind trust.
+
+> Philosophy: *prove it, then claim it.* Built from scratch by
+> [Silicon Networks](https://aegis888.com) - the makers of AEGIS Shield.
+
+## Why this one?
+
+| | Typical FTP tools | Silicon Transfer |
+|---|---|---|
+| Upload result | "done" | verdict + SHA-256 of both sides |
+| Directory sync check | manual | per-file proof walk with mismatch list |
+| Remote file fingerprint | download first | streamed SHA-256, no disk contact |
+| Protocols | often FTP only | FTP, FTPS, SFTP (password or SSH key) |
+
+## Tools (12)
+
+**Connection:** `silicon_connect`, `silicon_disconnect`, `silicon_status`, `silicon_server_info`
+**Files:** `silicon_upload_file`, `silicon_download_file`, `silicon_delete_file`, `silicon_file_info`
+**Directories:** `silicon_list_dir`, `silicon_make_dir`, `silicon_upload_dir`, `silicon_download_dir`, `silicon_rename`
+
+Transfers accept `proof: "hash" | "size" | "none"` - hash is the default for single
+files, size for directory trees (switch to hash when it matters).
+
+## Install
+
+```bash
+git clone https://github.com/SiliconAINetworks/silicon-transfer-mcp-server.git
+cd silicon-transfer-mcp-server
+npm install
+npm run build
+```
+
+## Claude Desktop configuration
+
+Add to your `claude_desktop_config.json` (no credentials in the config - you pass
+them at runtime through `silicon_connect`, for **your own server**):
+
+```json
+{
+  "mcpServers": {
+    "silicon-transfer": {
+      "command": "node",
+      "args": ["C:/path/to/silicon-transfer-mcp-server/dist/index.js"]
+    }
+  }
+}
+```
+
+## Usage example
+
+Ask your AI assistant:
+
+> "Connect to my server via SFTP (host example.com, user deploy, key at ~/.ssh/id_ed25519)
+> and upload dist/app.js to /var/www/app.js - with hash proof."
+
+The assistant calls `silicon_connect`, then `silicon_upload_file` and answers with the
+verdict:
+
+```json
+{
+  "proof": {
+    "verdict": "PROVEN",
+    "detail": "SHA-256 identisch - Transfer bewiesen.",
+    "local_sha256": "9f2a...",
+    "remote_sha256": "9f2a..."
+  }
+}
+```
+
+If the hashes ever differ you get `MISMATCH` with both fingerprints - retry instead
+of trusting a broken deploy.
+
+## Security notes
+
+- Credentials are **runtime-only tool parameters** for your own server. This project
+  ships no server addresses, no defaults, no config files with secrets.
+- SFTP supports password or private key (`privateKeyPath`).
+- `silicon_delete_file` is destructive - list first, delete second.
+
+## License
+
+MIT (c) 2026 Silicon Networks. Built from scratch - single-author codebase.

package/dist/index.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+/**
+ * Silicon Transfer MCP Server
+ * FTP/SFTP/FTPS fuer Claude - mit eingebauten Transfer-Beweisen.
+ * Grundsatz: erst beweisen, dann behaupten. Jeder Upload liefert seinen Hash-Beweis mit.
+ *
+ * Built from scratch by Silicon Networks (aegis888.com), 2026.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { ConnectionManager } from "./services/connection.js";
+import { registerAll } from "./tools/register.js";
+import { registerDirTools } from "./tools/register-dir.js";
+const SERVER_NAME = "silicon-transfer-mcp-server";
+const SERVER_VERSION = "0.1.0";
+const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION });
+const connections = new ConnectionManager();
+server.registerTool("silicon_server_info", {
+    title: "Server Info",
+    description: "Name, Version und Philosophie dieses MCP-Servers. Lebenszeichen-Check.",
+    inputSchema: {},
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+}, async () => {
+    const output = {
+        name: SERVER_NAME,
+        version: SERVER_VERSION,
+        philosophy: "erst beweisen, dann behaupten - every transfer returns its checksum proof",
+        protocols: ["ftp", "ftps", "sftp"],
+    };
+    return {
+        content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
+        structuredContent: output,
+    };
+});
+registerAll(server, connections);
+registerDirTools(server, connections);
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error(`${SERVER_NAME} ${SERVER_VERSION} bereit (stdio)`);
+}
+main().catch((err) => {
+    console.error("Serverstart fehlgeschlagen:", err);
+    process.exit(1);
+});

package/dist/services/connection.js

@@ -0,0 +1,175 @@
+/**
+ * Verbindungs-Schicht: FTP / FTPS / SFTP hinter einer einheitlichen Fassade.
+ * Ein aktiver Kanal pro Server-Instanz - bewusst simpel, bewusst nachvollziehbar.
+ */
+import { Client as FtpClient } from "basic-ftp";
+import SftpClient from "ssh2-sftp-client";
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { Writable } from "node:stream";
+export class ConnectionManager {
+    ftp = null;
+    sftp = null;
+    opts = null;
+    get connected() {
+        return this.ftp !== null || this.sftp !== null;
+    }
+    get target() {
+        if (!this.opts)
+            return "nicht verbunden";
+        const p = this.opts.port ?? (this.opts.protocol === "sftp" ? 22 : 21);
+        return `${this.opts.protocol}://${this.opts.username}@${this.opts.host}:${p}`;
+    }
+    async connect(o) {
+        await this.disconnect();
+        if (o.protocol === "sftp") {
+            const c = new SftpClient();
+            await c.connect({
+                host: o.host,
+                port: o.port ?? 22,
+                username: o.username,
+                password: o.password,
+                privateKey: o.privateKeyPath ? readFileSync(o.privateKeyPath) : undefined,
+                passphrase: o.passphrase,
+                readyTimeout: 30000,
+            });
+            this.sftp = c;
+        }
+        else {
+            const c = new FtpClient();
+            await c.access({
+                host: o.host,
+                port: o.port ?? 21,
+                user: o.username,
+                password: o.password,
+                secure: o.protocol === "ftps",
+            });
+            this.ftp = c;
+        }
+        this.opts = o;
+    }
+    async disconnect() {
+        if (this.ftp) {
+            this.ftp.close();
+            this.ftp = null;
+        }
+        if (this.sftp) {
+            await this.sftp.end().catch(() => undefined);
+            this.sftp = null;
+        }
+        this.opts = null;
+    }
+    ensure() {
+        if (!this.connected) {
+            throw new Error("Keine aktive Verbindung - zuerst silicon_connect aufrufen.");
+        }
+    }
+    async list(path) {
+        this.ensure();
+        if (this.sftp) {
+            const entries = await this.sftp.list(path);
+            return entries.map((e) => ({
+                name: e.name,
+                type: e.type === "d" ? "dir" : e.type === "l" ? "link" : "file",
+                size: e.size,
+                modifiedAt: new Date(e.modifyTime).toISOString(),
+            }));
+        }
+        const entries = await this.ftp.list(path);
+        return entries.map((e) => ({
+            name: e.name,
+            type: e.isDirectory ? "dir" : e.isSymbolicLink ? "link" : "file",
+            size: e.size,
+            modifiedAt: e.modifiedAt ? e.modifiedAt.toISOString() : undefined,
+        }));
+    }
+    async upload(localPath, remotePath) {
+        this.ensure();
+        if (this.sftp) {
+            await this.sftp.fastPut(localPath, remotePath);
+            return;
+        }
+        await this.ftp.uploadFrom(localPath, remotePath);
+    }
+    async download(remotePath, localPath) {
+        this.ensure();
+        if (this.sftp) {
+            await this.sftp.fastGet(remotePath, localPath);
+            return;
+        }
+        await this.ftp.downloadTo(localPath, remotePath);
+    }
+    async remove(remotePath) {
+        this.ensure();
+        if (this.sftp) {
+            await this.sftp.delete(remotePath);
+            return;
+        }
+        await this.ftp.remove(remotePath);
+    }
+    async mkdir(remotePath, recursive) {
+        this.ensure();
+        if (this.sftp) {
+            await this.sftp.mkdir(remotePath, recursive);
+            return;
+        }
+        await this.ftp.ensureDir(remotePath);
+        await this.ftp.cd("/");
+    }
+    async remoteSize(remotePath) {
+        this.ensure();
+        if (this.sftp) {
+            const s = await this.sftp.stat(remotePath);
+            return s.size;
+        }
+        return this.ftp.size(remotePath);
+    }
+    /**
+     * Herzstueck der Beweis-DNA: liest die Remote-Datei als Strom zurueck
+     * und berechnet ihren SHA-256 - ohne sie auf Platte zu speichern.
+     */
+    async remoteSha256(remotePath) {
+        this.ensure();
+        const hash = createHash("sha256");
+        let bytes = 0;
+        const sink = new Writable({
+            write(chunk, _enc, cb) {
+                hash.update(chunk);
+                bytes += chunk.length;
+                cb();
+            },
+        });
+        if (this.sftp) {
+            await this.sftp.get(remotePath, sink);
+        }
+        else {
+            await this.ftp.downloadTo(sink, remotePath);
+        }
+        return { sha256: hash.digest("hex"), bytes };
+    }
+    async rename(fromPath, toPath) {
+        this.ensure();
+        if (this.sftp) {
+            await this.sftp.rename(fromPath, toPath);
+            return;
+        }
+        await this.ftp.rename(fromPath, toPath);
+    }
+    async uploadDir(localDir, remoteDir) {
+        this.ensure();
+        if (this.sftp) {
+            await this.sftp.uploadDir(localDir, remoteDir);
+            return;
+        }
+        await this.ftp.uploadFromDir(localDir, remoteDir);
+        await this.ftp.cd("/");
+    }
+    async downloadDir(remoteDir, localDir) {
+        this.ensure();
+        if (this.sftp) {
+            await this.sftp.downloadDir(remoteDir, localDir);
+            return;
+        }
+        await this.ftp.downloadToDir(localDir, remoteDir);
+    }
+}

package/dist/services/proof.js

@@ -0,0 +1,46 @@
+/**
+ * Beweis-Maschine: erst beweisen, dann behaupten.
+ * Jeder Transfer bekommt sein Urteil - PROVEN nur bei identischem SHA-256.
+ */
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+export function localSha256(path) {
+    return new Promise((resolve, reject) => {
+        const hash = createHash("sha256");
+        let bytes = 0;
+        const rs = createReadStream(path);
+        rs.on("data", (chunk) => {
+            hash.update(chunk);
+            bytes += chunk.length;
+        });
+        rs.on("end", () => resolve({ sha256: hash.digest("hex"), bytes }));
+        rs.on("error", reject);
+    });
+}
+export function judge(local, remote, mode) {
+    if (mode === "none") {
+        return { verdict: "UNVERIFIED", detail: "Beweis abgewaehlt (proof=none) - Transfer ohne Urteil." };
+    }
+    if (mode === "size") {
+        const ok = local.bytes !== undefined && local.bytes === remote.bytes;
+        return {
+            verdict: ok ? "SIZE_MATCH" : "MISMATCH",
+            detail: ok
+                ? `Groessen identisch (${local.bytes} Bytes) - schwacher Beweis, fuer harte Faelle proof=hash nutzen.`
+                : `Groessen weichen ab: lokal ${local.bytes} vs remote ${remote.bytes} Bytes.`,
+            local_bytes: local.bytes,
+            remote_bytes: remote.bytes,
+        };
+    }
+    const ok = !!local.sha256 && local.sha256 === remote.sha256;
+    return {
+        verdict: ok ? "PROVEN" : "MISMATCH",
+        detail: ok
+            ? "SHA-256 identisch - Transfer bewiesen."
+            : "SHA-256 weicht ab - Transfer NICHT vertrauen, erneut uebertragen.",
+        local_sha256: local.sha256,
+        remote_sha256: remote.sha256,
+        local_bytes: local.bytes,
+        remote_bytes: remote.bytes,
+    };
+}

package/dist/tools/register-dir.js

@@ -0,0 +1,148 @@
+import { z } from "zod";
+import { readdirSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+import { localSha256 } from "../services/proof.js";
+function ok(output) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
+        structuredContent: output,
+    };
+}
+function fail(err, hint) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const output = { error: msg, hint };
+    return {
+        content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
+        structuredContent: output,
+        isError: true,
+    };
+}
+/** Alle Dateien unter dir, als relative Pfade mit / als Trenner. */
+function walkLocal(dir, base = dir) {
+    const out = [];
+    for (const name of readdirSync(dir)) {
+        const full = join(dir, name);
+        if (statSync(full).isDirectory())
+            out.push(...walkLocal(full, base));
+        else
+            out.push(relative(base, full).split("\\").join("/"));
+    }
+    return out;
+}
+export function registerDirTools(server, cm) {
+    server.registerTool("silicon_rename", {
+        title: "Umbenennen / Verschieben",
+        description: "Benennt eine Remote-Datei oder ein Verzeichnis um bzw. verschiebt es.",
+        inputSchema: {
+            fromPath: z.string().describe("Aktueller Remote-Pfad"),
+            toPath: z.string().describe("Neuer Remote-Pfad"),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    }, async ({ fromPath, toPath }) => {
+        try {
+            await cm.rename(fromPath, toPath);
+            return ok({ status: "umbenannt", fromPath, toPath });
+        }
+        catch (e) {
+            return fail(e, "Quelle vorhanden? Ziel frei? Rechte pruefen.");
+        }
+    });
+    server.registerTool("silicon_upload_dir", {
+        title: "Verzeichnis hochladen (mit Beweis-Wanderung)",
+        description: "Laedt ein lokales Verzeichnis rekursiv hoch. Danach wird jede Datei einzeln verglichen: proof=hash prueft SHA-256 pro Datei (gruendlich, langsamer), proof=size vergleicht Groessen (schnell), none ueberspringt.",
+        inputSchema: {
+            localDir: z.string().describe("Lokales Quellverzeichnis"),
+            remoteDir: z.string().describe("Remote-Zielverzeichnis"),
+            proof: z.enum(["hash", "size", "none"]).default("size").describe("Beweisstufe pro Datei (Standard: size)"),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async ({ localDir, remoteDir, proof }) => {
+        try {
+            const t0 = Date.now();
+            const files = walkLocal(localDir);
+            await cm.uploadDir(localDir, remoteDir);
+            const mismatches = [];
+            let checked = 0;
+            if (proof !== "none") {
+                for (const rel of files) {
+                    const lp = join(localDir, rel);
+                    const rp = `${remoteDir.replace(/\/$/, "")}/${rel}`;
+                    if (proof === "hash") {
+                        const [l, r] = await Promise.all([localSha256(lp), cm.remoteSha256(rp)]);
+                        checked++;
+                        if (l.sha256 !== r.sha256)
+                            mismatches.push({ file: rel, local_sha256: l.sha256, remote_sha256: r.sha256 });
+                    }
+                    else {
+                        const lb = statSync(lp).size;
+                        const rb = await cm.remoteSize(rp);
+                        checked++;
+                        if (lb !== rb)
+                            mismatches.push({ file: rel, local_bytes: lb, remote_bytes: rb });
+                    }
+                }
+            }
+            const verdict = proof === "none" ? "UNVERIFIED" : mismatches.length === 0 ? (proof === "hash" ? "PROVEN" : "SIZE_MATCH") : "MISMATCH";
+            return ok({
+                localDir,
+                remoteDir,
+                files_total: files.length,
+                files_checked: checked,
+                duration_ms: Date.now() - t0,
+                proof: { verdict, mismatches },
+            });
+        }
+        catch (e) {
+            return fail(e, "Lokales Verzeichnis vorhanden? Remote-Rechte? Bei grossen Baeumen proof=size nutzen.");
+        }
+    });
+    server.registerTool("silicon_download_dir", {
+        title: "Verzeichnis herunterladen (mit Beweis-Wanderung)",
+        description: "Laedt ein Remote-Verzeichnis rekursiv herunter. Danach wird jede lokale Datei gegen die Remote-Quelle verglichen (hash/size/none, Standard size).",
+        inputSchema: {
+            remoteDir: z.string().describe("Remote-Quellverzeichnis"),
+            localDir: z.string().describe("Lokales Zielverzeichnis"),
+            proof: z.enum(["hash", "size", "none"]).default("size").describe("Beweisstufe pro Datei (Standard: size)"),
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async ({ remoteDir, localDir, proof }) => {
+        try {
+            const t0 = Date.now();
+            await cm.downloadDir(remoteDir, localDir);
+            const files = walkLocal(localDir);
+            const mismatches = [];
+            let checked = 0;
+            if (proof !== "none") {
+                for (const rel of files) {
+                    const lp = join(localDir, rel);
+                    const rp = `${remoteDir.replace(/\/$/, "")}/${rel}`;
+                    if (proof === "hash") {
+                        const [l, r] = await Promise.all([localSha256(lp), cm.remoteSha256(rp)]);
+                        checked++;
+                        if (l.sha256 !== r.sha256)
+                            mismatches.push({ file: rel, local_sha256: l.sha256, remote_sha256: r.sha256 });
+                    }
+                    else {
+                        const lb = statSync(lp).size;
+                        const rb = await cm.remoteSize(rp);
+                        checked++;
+                        if (lb !== rb)
+                            mismatches.push({ file: rel, local_bytes: lb, remote_bytes: rb });
+                    }
+                }
+            }
+            const verdict = proof === "none" ? "UNVERIFIED" : mismatches.length === 0 ? (proof === "hash" ? "PROVEN" : "SIZE_MATCH") : "MISMATCH";
+            return ok({
+                remoteDir,
+                localDir,
+                files_total: files.length,
+                files_checked: checked,
+                duration_ms: Date.now() - t0,
+                proof: { verdict, mismatches },
+            });
+        }
+        catch (e) {
+            return fail(e, "Remote-Verzeichnis vorhanden? Lokale Schreibrechte? Bei grossen Baeumen proof=size nutzen.");
+        }
+    });
+}