silicon-transfer-mcp-server 0.1.0

package/dist/tools/register.js

@@ -0,0 +1,172 @@
+import { z } from "zod";
+import { localSha256, judge } from "../services/proof.js";
+function ok(output) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
+        structuredContent: output,
+    };
+}
+function fail(err, hint) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const output = { error: msg, hint };
+    return {
+        content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
+        structuredContent: output,
+        isError: true,
+    };
+}
+const proofSchema = z
+    .enum(["hash", "size", "none"])
+    .default("hash")
+    .describe("Beweisstufe: hash = SHA-256-Rueckvergleich (Standard), size = nur Groesse, none = ohne Urteil");
+export function registerAll(server, cm) {
+    server.registerTool("silicon_connect", {
+        title: "Verbindung aufbauen",
+        description: "Verbindet zu einem FTP-, FTPS- oder SFTP-Server. SFTP unterstuetzt Passwort oder SSH-Key (privateKeyPath).",
+        inputSchema: {
+            protocol: z.enum(["ftp", "ftps", "sftp"]).describe("Uebertragungsprotokoll"),
+            host: z.string().describe("Hostname oder IP"),
+            port: z.number().int().optional().describe("Port (Standard: 21 fuer ftp/ftps, 22 fuer sftp)"),
+            username: z.string().describe("Benutzername"),
+            password: z.string().optional().describe("Passwort (bei SSH-Key optional)"),
+            privateKeyPath: z.string().optional().describe("Pfad zu einem privaten SSH-Key (nur sftp)"),
+            passphrase: z.string().optional().describe("Passphrase des SSH-Keys, falls verschluesselt"),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, async (a) => {
+        try {
+            await cm.connect(a);
+            return ok({ status: "verbunden", target: cm.target });
+        }
+        catch (e) {
+            return fail(e, "Host, Port, Zugangsdaten und Protokoll pruefen.");
+        }
+    });
+    server.registerTool("silicon_disconnect", {
+        title: "Verbindung trennen",
+        description: "Trennt die aktive Verbindung sauber.",
+        inputSchema: {},
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async () => {
+        const was = cm.target;
+        await cm.disconnect();
+        return ok({ status: "getrennt", war: was });
+    });
+    server.registerTool("silicon_status", {
+        title: "Verbindungsstatus",
+        description: "Zeigt, ob und wohin aktuell eine Verbindung besteht.",
+        inputSchema: {},
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async () => ok({ verbunden: cm.connected, target: cm.target }));
+    server.registerTool("silicon_list_dir", {
+        title: "Verzeichnis auflisten",
+        description: "Listet ein Remote-Verzeichnis mit Typ, Groesse und Aenderungsdatum.",
+        inputSchema: { path: z.string().describe("Remote-Pfad, z.B. /home/user/www") },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async ({ path }) => {
+        try {
+            const entries = await cm.list(path);
+            return ok({ path, count: entries.length, entries });
+        }
+        catch (e) {
+            return fail(e, "Pfad pruefen; fuehrender / noetig? Verbindung aktiv?");
+        }
+    });
+    server.registerTool("silicon_upload_file", {
+        title: "Datei hochladen (mit Beweis)",
+        description: "Laedt eine lokale Datei hoch und liefert das Transfer-Urteil mit: PROVEN nur, wenn der SHA-256 der Remote-Datei nach dem Upload dem lokalen entspricht.",
+        inputSchema: {
+            localPath: z.string().describe("Lokaler Quellpfad"),
+            remotePath: z.string().describe("Remote-Zielpfad inkl. Dateiname"),
+            proof: proofSchema,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async ({ localPath, remotePath, proof }) => {
+        try {
+            const t0 = Date.now();
+            const local = await localSha256(localPath);
+            await cm.upload(localPath, remotePath);
+            const remote = proof === "hash"
+                ? await cm.remoteSha256(remotePath)
+                : proof === "size"
+                    ? { sha256: undefined, bytes: await cm.remoteSize(remotePath) }
+                    : { sha256: undefined, bytes: undefined };
+            const urteil = judge(local, remote, proof);
+            return ok({ localPath, remotePath, duration_ms: Date.now() - t0, proof: urteil });
+        }
+        catch (e) {
+            return fail(e, "Lokalen Pfad, Remote-Rechte und Verbindung pruefen.");
+        }
+    });
+    server.registerTool("silicon_download_file", {
+        title: "Datei herunterladen (mit Beweis)",
+        description: "Laedt eine Remote-Datei herunter und liefert das Transfer-Urteil mit: PROVEN nur bei identischem SHA-256 zwischen Remote-Quelle und lokaler Kopie.",
+        inputSchema: {
+            remotePath: z.string().describe("Remote-Quellpfad"),
+            localPath: z.string().describe("Lokaler Zielpfad inkl. Dateiname"),
+            proof: proofSchema,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async ({ remotePath, localPath, proof }) => {
+        try {
+            const t0 = Date.now();
+            await cm.download(remotePath, localPath);
+            const local = await localSha256(localPath);
+            const remote = proof === "hash"
+                ? await cm.remoteSha256(remotePath)
+                : proof === "size"
+                    ? { sha256: undefined, bytes: await cm.remoteSize(remotePath) }
+                    : { sha256: undefined, bytes: undefined };
+            const urteil = judge(local, remote, proof);
+            return ok({ remotePath, localPath, duration_ms: Date.now() - t0, proof: urteil });
+        }
+        catch (e) {
+            return fail(e, "Remote-Pfad, lokale Schreibrechte und Verbindung pruefen.");
+        }
+    });
+    server.registerTool("silicon_delete_file", {
+        title: "Remote-Datei loeschen",
+        description: "Loescht eine Datei auf dem Server. Endgueltig - vorher mit silicon_list_dir pruefen.",
+        inputSchema: { remotePath: z.string().describe("Remote-Pfad der zu loeschenden Datei") },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    }, async ({ remotePath }) => {
+        try {
+            await cm.remove(remotePath);
+            return ok({ status: "geloescht", remotePath });
+        }
+        catch (e) {
+            return fail(e, "Existiert die Datei? Rechte vorhanden?");
+        }
+    });
+    server.registerTool("silicon_make_dir", {
+        title: "Remote-Verzeichnis anlegen",
+        description: "Legt ein Verzeichnis auf dem Server an (rekursiv moeglich).",
+        inputSchema: {
+            remotePath: z.string().describe("Anzulegender Remote-Pfad"),
+            recursive: z.boolean().default(true).describe("Elternverzeichnisse mit anlegen"),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async ({ remotePath, recursive }) => {
+        try {
+            await cm.mkdir(remotePath, recursive);
+            return ok({ status: "angelegt", remotePath });
+        }
+        catch (e) {
+            return fail(e, "Rechte pruefen; existiert der Pfad bereits?");
+        }
+    });
+    server.registerTool("silicon_file_info", {
+        title: "Datei-Steckbrief",
+        description: "Groesse und SHA-256 einer Remote-Datei - der Fingerabdruck ohne Download auf Platte.",
+        inputSchema: { remotePath: z.string().describe("Remote-Pfad der Datei") },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async ({ remotePath }) => {
+        try {
+            const r = await cm.remoteSha256(remotePath);
+            return ok({ remotePath, bytes: r.bytes, sha256: r.sha256 });
+        }
+        catch (e) {
+            return fail(e, "Existiert die Datei? Verbindung aktiv?");
+        }
+    });
+}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "silicon-transfer-mcp-server",
+  "version": "0.1.0",
+  "description": "FTP/SFTP/FTPS MCP server with built-in transfer proofs - every upload returns a checksum verdict. Built from scratch by Silicon Networks.",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "silicon-transfer-mcp-server": "dist/index.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "dev": "tsc --watch"
+  },
+  "author": "Silicon Networks (https://aegis888.com)",
+  "license": "MIT",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "ftp",
+    "sftp",
+    "ftps",
+    "file-transfer",
+    "checksum",
+    "deploy",
+    "claude"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "basic-ftp": "^5.0.5",
+    "ssh2-sftp-client": "^11.0.0",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/ssh2-sftp-client": "^9.0.4",
+    "typescript": "^5.6.0"
+  }
+}

package/src/index.ts

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+/**
+ * Silicon Transfer MCP Server
+ * FTP/SFTP/FTPS fuer Claude - mit eingebauten Transfer-Beweisen.
+ * Grundsatz: erst beweisen, dann behaupten. Jeder Upload liefert seinen Hash-Beweis mit.
+ *
+ * Built from scratch by Silicon Networks (aegis888.com), 2026.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { ConnectionManager } from "./services/connection.js";
+import { registerAll } from "./tools/register.js";
+import { registerDirTools } from "./tools/register-dir.js";
+
+const SERVER_NAME = "silicon-transfer-mcp-server";
+const SERVER_VERSION = "0.1.0";
+
+const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION });
+const connections = new ConnectionManager();
+
+server.registerTool(
+  "silicon_server_info",
+  {
+    title: "Server Info",
+    description: "Name, Version und Philosophie dieses MCP-Servers. Lebenszeichen-Check.",
+    inputSchema: {},
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  },
+  async () => {
+    const output = {
+      name: SERVER_NAME,
+      version: SERVER_VERSION,
+      philosophy: "erst beweisen, dann behaupten - every transfer returns its checksum proof",
+      protocols: ["ftp", "ftps", "sftp"],
+    };
+    return {
+      content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
+      structuredContent: output,
+    };
+  }
+);
+
+registerAll(server, connections);
+registerDirTools(server, connections);
+
+async function main(): Promise<void> {
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  console.error(`${SERVER_NAME} ${SERVER_VERSION} bereit (stdio)`);
+}
+
+main().catch((err) => {
+  console.error("Serverstart fehlgeschlagen:", err);
+  process.exit(1);
+});

package/src/services/connection.ts

@@ -0,0 +1,180 @@
+/**
+ * Verbindungs-Schicht: FTP / FTPS / SFTP hinter einer einheitlichen Fassade.
+ * Ein aktiver Kanal pro Server-Instanz - bewusst simpel, bewusst nachvollziehbar.
+ */
+import { Client as FtpClient } from "basic-ftp";
+import SftpClient from "ssh2-sftp-client";
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { Writable } from "node:stream";
+
+export type Protocol = "ftp" | "ftps" | "sftp";
+
+export interface ConnectOptions {
+  protocol: Protocol;
+  host: string;
+  port?: number;
+  username: string;
+  password?: string;
+  privateKeyPath?: string;
+  passphrase?: string;
+}
+
+export interface RemoteEntry {
+  name: string;
+  type: "file" | "dir" | "link";
+  size: number;
+  modifiedAt?: string;
+}
+
+export class ConnectionManager {
+  private ftp: FtpClient | null = null;
+  private sftp: SftpClient | null = null;
+  private opts: ConnectOptions | null = null;
+
+  get connected(): boolean {
+    return this.ftp !== null || this.sftp !== null;
+  }
+
+  get target(): string {
+    if (!this.opts) return "nicht verbunden";
+    const p = this.opts.port ?? (this.opts.protocol === "sftp" ? 22 : 21);
+    return `${this.opts.protocol}://${this.opts.username}@${this.opts.host}:${p}`;
+  }
+
+  async connect(o: ConnectOptions): Promise<void> {
+    await this.disconnect();
+    if (o.protocol === "sftp") {
+      const c = new SftpClient();
+      await c.connect({
+        host: o.host,
+        port: o.port ?? 22,
+        username: o.username,
+        password: o.password,
+        privateKey: o.privateKeyPath ? readFileSync(o.privateKeyPath) : undefined,
+        passphrase: o.passphrase,
+        readyTimeout: 30000,
+      });
+      this.sftp = c;
+    } else {
+      const c = new FtpClient();
+      await c.access({
+        host: o.host,
+        port: o.port ?? 21,
+        user: o.username,
+        password: o.password,
+        secure: o.protocol === "ftps",
+      });
+      this.ftp = c;
+    }
+    this.opts = o;
+  }
+
+  async disconnect(): Promise<void> {
+    if (this.ftp) { this.ftp.close(); this.ftp = null; }
+    if (this.sftp) { await this.sftp.end().catch(() => undefined); this.sftp = null; }
+    this.opts = null;
+  }
+
+  private ensure(): void {
+    if (!this.connected) {
+      throw new Error("Keine aktive Verbindung - zuerst silicon_connect aufrufen.");
+    }
+  }
+
+  async list(path: string): Promise<RemoteEntry[]> {
+    this.ensure();
+    if (this.sftp) {
+      const entries = await this.sftp.list(path);
+      return entries.map((e) => ({
+        name: e.name,
+        type: e.type === "d" ? "dir" : e.type === "l" ? "link" : "file",
+        size: e.size,
+        modifiedAt: new Date(e.modifyTime).toISOString(),
+      }));
+    }
+    const entries = await this.ftp!.list(path);
+    return entries.map((e) => ({
+      name: e.name,
+      type: e.isDirectory ? "dir" : e.isSymbolicLink ? "link" : "file",
+      size: e.size,
+      modifiedAt: e.modifiedAt ? e.modifiedAt.toISOString() : undefined,
+    }));
+  }
+
+  async upload(localPath: string, remotePath: string): Promise<void> {
+    this.ensure();
+    if (this.sftp) { await this.sftp.fastPut(localPath, remotePath); return; }
+    await this.ftp!.uploadFrom(localPath, remotePath);
+  }
+
+  async download(remotePath: string, localPath: string): Promise<void> {
+    this.ensure();
+    if (this.sftp) { await this.sftp.fastGet(remotePath, localPath); return; }
+    await this.ftp!.downloadTo(localPath, remotePath);
+  }
+
+  async remove(remotePath: string): Promise<void> {
+    this.ensure();
+    if (this.sftp) { await this.sftp.delete(remotePath); return; }
+    await this.ftp!.remove(remotePath);
+  }
+
+  async mkdir(remotePath: string, recursive: boolean): Promise<void> {
+    this.ensure();
+    if (this.sftp) { await this.sftp.mkdir(remotePath, recursive); return; }
+    await this.ftp!.ensureDir(remotePath);
+    await this.ftp!.cd("/");
+  }
+
+  async remoteSize(remotePath: string): Promise<number> {
+    this.ensure();
+    if (this.sftp) {
+      const s = await this.sftp.stat(remotePath);
+      return s.size;
+    }
+    return this.ftp!.size(remotePath);
+  }
+
+  /**
+   * Herzstueck der Beweis-DNA: liest die Remote-Datei als Strom zurueck
+   * und berechnet ihren SHA-256 - ohne sie auf Platte zu speichern.
+   */
+  async remoteSha256(remotePath: string): Promise<{ sha256: string; bytes: number }> {
+    this.ensure();
+    const hash = createHash("sha256");
+    let bytes = 0;
+    const sink = new Writable({
+      write(chunk: Buffer, _enc, cb) {
+        hash.update(chunk);
+        bytes += chunk.length;
+        cb();
+      },
+    });
+    if (this.sftp) {
+      await this.sftp.get(remotePath, sink);
+    } else {
+      await this.ftp!.downloadTo(sink, remotePath);
+    }
+    return { sha256: hash.digest("hex"), bytes };
+  }
+
+  async rename(fromPath: string, toPath: string): Promise<void> {
+    this.ensure();
+    if (this.sftp) { await this.sftp.rename(fromPath, toPath); return; }
+    await this.ftp!.rename(fromPath, toPath);
+  }
+
+  async uploadDir(localDir: string, remoteDir: string): Promise<void> {
+    this.ensure();
+    if (this.sftp) { await this.sftp.uploadDir(localDir, remoteDir); return; }
+    await this.ftp!.uploadFromDir(localDir, remoteDir);
+    await this.ftp!.cd("/");
+  }
+
+  async downloadDir(remoteDir: string, localDir: string): Promise<void> {
+    this.ensure();
+    if (this.sftp) { await this.sftp.downloadDir(remoteDir, localDir); return; }
+    await this.ftp!.downloadToDir(localDir, remoteDir);
+  }
+}

package/src/services/proof.ts

@@ -0,0 +1,64 @@
+/**
+ * Beweis-Maschine: erst beweisen, dann behaupten.
+ * Jeder Transfer bekommt sein Urteil - PROVEN nur bei identischem SHA-256.
+ */
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+
+export type ProofMode = "hash" | "size" | "none";
+export type Verdict = "PROVEN" | "SIZE_MATCH" | "UNVERIFIED" | "MISMATCH";
+
+export interface TransferProof {
+  verdict: Verdict;
+  detail: string;
+  local_sha256?: string;
+  remote_sha256?: string;
+  local_bytes?: number;
+  remote_bytes?: number;
+}
+
+export function localSha256(path: string): Promise<{ sha256: string; bytes: number }> {
+  return new Promise((resolve, reject) => {
+    const hash = createHash("sha256");
+    let bytes = 0;
+    const rs = createReadStream(path);
+    rs.on("data", (chunk) => {
+      hash.update(chunk);
+      bytes += chunk.length;
+    });
+    rs.on("end", () => resolve({ sha256: hash.digest("hex"), bytes }));
+    rs.on("error", reject);
+  });
+}
+
+export function judge(
+  local: { sha256?: string; bytes?: number },
+  remote: { sha256?: string; bytes?: number },
+  mode: ProofMode
+): TransferProof {
+  if (mode === "none") {
+    return { verdict: "UNVERIFIED", detail: "Beweis abgewaehlt (proof=none) - Transfer ohne Urteil." };
+  }
+  if (mode === "size") {
+    const ok = local.bytes !== undefined && local.bytes === remote.bytes;
+    return {
+      verdict: ok ? "SIZE_MATCH" : "MISMATCH",
+      detail: ok
+        ? `Groessen identisch (${local.bytes} Bytes) - schwacher Beweis, fuer harte Faelle proof=hash nutzen.`
+        : `Groessen weichen ab: lokal ${local.bytes} vs remote ${remote.bytes} Bytes.`,
+      local_bytes: local.bytes,
+      remote_bytes: remote.bytes,
+    };
+  }
+  const ok = !!local.sha256 && local.sha256 === remote.sha256;
+  return {
+    verdict: ok ? "PROVEN" : "MISMATCH",
+    detail: ok
+      ? "SHA-256 identisch - Transfer bewiesen."
+      : "SHA-256 weicht ab - Transfer NICHT vertrauen, erneut uebertragen.",
+    local_sha256: local.sha256,
+    remote_sha256: remote.sha256,
+    local_bytes: local.bytes,
+    remote_bytes: remote.bytes,
+  };
+}

package/src/tools/register-dir.ts

@@ -0,0 +1,173 @@
+/**
+ * Verzeichnis-Werkzeuge: rename, upload_dir, download_dir.
+ * Auch Verzeichnisse liefern Urteile - pro Datei, mit Mismatch-Liste.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+import { readdirSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+import { ConnectionManager } from "../services/connection.js";
+import { localSha256 } from "../services/proof.js";
+
+type ToolResult = {
+  content: Array<{ type: "text"; text: string }>;
+  structuredContent?: Record<string, unknown>;
+  isError?: boolean;
+};
+
+function ok(output: Record<string, unknown>): ToolResult {
+  return {
+    content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
+    structuredContent: output,
+  };
+}
+
+function fail(err: unknown, hint: string): ToolResult {
+  const msg = err instanceof Error ? err.message : String(err);
+  const output = { error: msg, hint };
+  return {
+    content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
+    structuredContent: output,
+    isError: true,
+  };
+}
+
+/** Alle Dateien unter dir, als relative Pfade mit / als Trenner. */
+function walkLocal(dir: string, base: string = dir): string[] {
+  const out: string[] = [];
+  for (const name of readdirSync(dir)) {
+    const full = join(dir, name);
+    if (statSync(full).isDirectory()) out.push(...walkLocal(full, base));
+    else out.push(relative(base, full).split("\\").join("/"));
+  }
+  return out;
+}
+
+export function registerDirTools(server: McpServer, cm: ConnectionManager): void {
+  server.registerTool(
+    "silicon_rename",
+    {
+      title: "Umbenennen / Verschieben",
+      description: "Benennt eine Remote-Datei oder ein Verzeichnis um bzw. verschiebt es.",
+      inputSchema: {
+        fromPath: z.string().describe("Aktueller Remote-Pfad"),
+        toPath: z.string().describe("Neuer Remote-Pfad"),
+      },
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    },
+    async ({ fromPath, toPath }) => {
+      try {
+        await cm.rename(fromPath, toPath);
+        return ok({ status: "umbenannt", fromPath, toPath });
+      } catch (e) {
+        return fail(e, "Quelle vorhanden? Ziel frei? Rechte pruefen.");
+      }
+    }
+  );
+
+  server.registerTool(
+    "silicon_upload_dir",
+    {
+      title: "Verzeichnis hochladen (mit Beweis-Wanderung)",
+      description:
+        "Laedt ein lokales Verzeichnis rekursiv hoch. Danach wird jede Datei einzeln verglichen: proof=hash prueft SHA-256 pro Datei (gruendlich, langsamer), proof=size vergleicht Groessen (schnell), none ueberspringt.",
+      inputSchema: {
+        localDir: z.string().describe("Lokales Quellverzeichnis"),
+        remoteDir: z.string().describe("Remote-Zielverzeichnis"),
+        proof: z.enum(["hash", "size", "none"]).default("size").describe("Beweisstufe pro Datei (Standard: size)"),
+      },
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    },
+    async ({ localDir, remoteDir, proof }) => {
+      try {
+        const t0 = Date.now();
+        const files = walkLocal(localDir);
+        await cm.uploadDir(localDir, remoteDir);
+        const mismatches: Array<Record<string, unknown>> = [];
+        let checked = 0;
+
+        if (proof !== "none") {
+          for (const rel of files) {
+            const lp = join(localDir, rel);
+            const rp = `${remoteDir.replace(/\/$/, "")}/${rel}`;
+            if (proof === "hash") {
+              const [l, r] = await Promise.all([localSha256(lp), cm.remoteSha256(rp)]);
+              checked++;
+              if (l.sha256 !== r.sha256) mismatches.push({ file: rel, local_sha256: l.sha256, remote_sha256: r.sha256 });
+            } else {
+              const lb = statSync(lp).size;
+              const rb = await cm.remoteSize(rp);
+              checked++;
+              if (lb !== rb) mismatches.push({ file: rel, local_bytes: lb, remote_bytes: rb });
+            }
+          }
+        }
+        const verdict =
+          proof === "none" ? "UNVERIFIED" : mismatches.length === 0 ? (proof === "hash" ? "PROVEN" : "SIZE_MATCH") : "MISMATCH";
+        return ok({
+          localDir,
+          remoteDir,
+          files_total: files.length,
+          files_checked: checked,
+          duration_ms: Date.now() - t0,
+          proof: { verdict, mismatches },
+        });
+      } catch (e) {
+        return fail(e, "Lokales Verzeichnis vorhanden? Remote-Rechte? Bei grossen Baeumen proof=size nutzen.");
+      }
+    }
+  );
+
+  server.registerTool(
+    "silicon_download_dir",
+    {
+      title: "Verzeichnis herunterladen (mit Beweis-Wanderung)",
+      description:
+        "Laedt ein Remote-Verzeichnis rekursiv herunter. Danach wird jede lokale Datei gegen die Remote-Quelle verglichen (hash/size/none, Standard size).",
+      inputSchema: {
+        remoteDir: z.string().describe("Remote-Quellverzeichnis"),
+        localDir: z.string().describe("Lokales Zielverzeichnis"),
+        proof: z.enum(["hash", "size", "none"]).default("size").describe("Beweisstufe pro Datei (Standard: size)"),
+      },
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    },
+
+    async ({ remoteDir, localDir, proof }) => {
+      try {
+        const t0 = Date.now();
+        await cm.downloadDir(remoteDir, localDir);
+        const files = walkLocal(localDir);
+        const mismatches: Array<Record<string, unknown>> = [];
+        let checked = 0;
+        if (proof !== "none") {
+          for (const rel of files) {
+            const lp = join(localDir, rel);
+            const rp = `${remoteDir.replace(/\/$/, "")}/${rel}`;
+            if (proof === "hash") {
+              const [l, r] = await Promise.all([localSha256(lp), cm.remoteSha256(rp)]);
+              checked++;
+              if (l.sha256 !== r.sha256) mismatches.push({ file: rel, local_sha256: l.sha256, remote_sha256: r.sha256 });
+            } else {
+              const lb = statSync(lp).size;
+              const rb = await cm.remoteSize(rp);
+              checked++;
+              if (lb !== rb) mismatches.push({ file: rel, local_bytes: lb, remote_bytes: rb });
+            }
+          }
+        }
+        const verdict =
+          proof === "none" ? "UNVERIFIED" : mismatches.length === 0 ? (proof === "hash" ? "PROVEN" : "SIZE_MATCH") : "MISMATCH";
+        return ok({
+          remoteDir,
+          localDir,
+          files_total: files.length,
+          files_checked: checked,
+          duration_ms: Date.now() - t0,
+          proof: { verdict, mismatches },
+        });
+      } catch (e) {
+        return fail(e, "Remote-Verzeichnis vorhanden? Lokale Schreibrechte? Bei grossen Baeumen proof=size nutzen.");
+      }
+    }
+  );
+}