sphior-code-mcp 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SPHIOR Security
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,140 @@
+# sphior-code-mcp
+
+Official **Model Context Protocol (MCP)** server for **SPHIOR CODE** — surface security findings from your GitHub repositories directly inside any MCP-compatible AI coding assistant.
+
+[![npm version](https://img.shields.io/npm/v/sphior-code-mcp.svg)](https://www.npmjs.com/package/sphior-code-mcp)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+## What this gives you
+
+Your AI assistant can now answer questions like:
+
+- *"What are the highest-severity vulnerabilities in my code right now?"*
+- *"Show me the fix for finding `abc-123`."*
+- *"Mark this SQL injection alert as resolved — I just fixed it."*
+- *"What's our overall security posture this month?"*
+
+…using **live data from SPHIOR CODE's scanning engine** (AI SAST + SCA powered by OSV.dev).
+
+## Supported clients
+
+This is a standard MCP stdio server, so it works with **any MCP-compatible client**:
+
+| Client | Config location | Setup |
+|---|---|---|
+| **Cursor** | `~/.cursor/mcp.json` | [Add MCP](https://cursor.sh/) |
+| **Claude Code** | `~/.claude.json` | `claude mcp add sphior-code -- npx sphior-code-mcp` |
+| **VS Code** | `~/.config/Code/User/settings.json` (`mcp.servers`) | Built-in MCP |
+| **GitHub Copilot (VS Code)** | `.vscode/mcp.json` | Native MCP |
+| **Cline** (VS Code extension) | `~/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json` | Settings UI |
+| **Continue** (VS Code extension) | `~/.continue/config.yaml` | `mcpServers:` section |
+| **Windsurf** | `~/.codeium/windsurf/mcp_config.json` | Settings UI |
+| **Zed** | `~/.config/zed/settings.json` (`context_servers`) | Native MCP |
+| **JetBrains AI Assistant** (2024.3+) | Settings → Tools → AI Assistant → MCP | Built-in |
+
+## Installation
+
+```bash
+# No install needed — use npx
+npx -y sphior-code-mcp
+
+# Or install globally
+npm install -g sphior-code-mcp
+sphior-code-mcp
+```
+
+## Configuration
+
+Set your API key from [sphior.com/account/code/api-keys](https://sphior.com/account/code/api-keys):
+
+```bash
+export SPHIOR_API_KEY=sk_live_xxxxxxxxxxxx
+```
+
+### Environment variables
+
+| Variable | Required | Default | Description |
+|---|---|---|---|
+| `SPHIOR_API_KEY`  | ✅ Yes | — | Bearer token from your SPHIOR Code account |
+| `SPHIOR_API_BASE` | No | `https://sphior.com/api/v1` | Override for self-hosted / regional deployments |
+| `SPHIOR_TIMEOUT`  | No | `30000` | Request timeout in ms (1000–300000) |
+| `SPHIOR_DEBUG`    | No | `false` | Enable verbose logging to stderr |
+
+## Example config (Cursor / Claude Code / VS Code style)
+
+```json
+{
+  "mcpServers": {
+    "sphior-code": {
+      "command": "npx",
+      "args": ["-y", "sphior-code-mcp"],
+      "env": {
+        "SPHIOR_API_KEY": "sk_live_xxxxxxxxxxxx"
+      }
+    }
+  }
+}
+```
+
+For **GitHub Copilot in VS Code**, use `"servers"` instead of `"mcpServers"`:
+
+```json
+{
+  "servers": {
+    "sphior-code": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "sphior-code-mcp"],
+      "env": {
+        "SPHIOR_API_KEY": "sk_live_xxxxxxxxxxxx"
+      }
+    }
+  }
+}
+```
+
+## Tools exposed
+
+| Tool | Purpose |
+|---|---|
+| `list_findings` | List vulnerabilities (filter by severity / status / limit) |
+| `get_finding` | Full details for one finding (CVSS, CWE, file path, fix hint) |
+| `get_security_summary` | Posture overview (counts by severity, last scan, repos monitored) |
+| `get_fix_proposal` | AI-generated patch (code + explanation + post-fix CVSS) |
+| `resolve_finding` | Mark as fixed |
+| `mark_false_positive` | Mark as not exploitable |
+| `health_check` | Verify connection + auth |
+
+## Resources exposed
+
+- `sphior-code://summary` — JSON snapshot of current posture
+- `sphior-code://findings/{id}` — full detail per finding (auto-listed for open findings)
+
+## Reliability
+
+- **Exponential backoff retry** on 5xx / network errors (3 attempts)
+- **30-second request timeout** (configurable)
+- **Graceful degradation** — auth errors fail fast, server errors retry
+- **Structured errors** with actionable hints
+- **stderr-only logging** (stdout is reserved for MCP protocol)
+
+## Development
+
+```bash
+# In this directory
+npm install
+npm run build
+SPHIOR_API_KEY=sk_test_xxx node bin/sphior-code-mcp.js
+# Type a JSON-RPC request to test
+```
+
+## License
+
+MIT © SPHIOR Security
+
+## Links
+
+- 🌐 [SPHIOR Code](https://sphior.com/code)
+- 📖 [API Reference](https://sphior.com/docs/api)
+- 🐛 [Report issues](https://github.com/sphior/code-mcp/issues)
+- 🔑 [Get an API key](https://sphior.com/account/code/api-keys)

package/bin/sphior-code-mcp.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+/**
+ * sphior-code-mcp — Stdio entrypoint for MCP clients.
+ *
+ * 起動方法:
+ *   SPHIOR_API_KEY=sk_live_xxx npx -y @sphior/code-mcp
+ *
+ * 環境変数:
+ *   SPHIOR_API_KEY  (required)  Bearer API key from sphior.com/account/code/api-keys
+ *   SPHIOR_API_BASE (optional)  Override base URL. Default: https://sphior.com/api/v1
+ *   SPHIOR_TIMEOUT  (optional)  Request timeout in ms. Default: 30000
+ *   SPHIOR_DEBUG    (optional)  Enable debug logging to stderr. Default: false
+ */
+
+import { startServer } from "../dist/index.js";
+
+startServer().catch((err) => {
+  // stderr only — stdout is reserved for the MCP protocol
+  process.stderr.write(`[sphior-code-mcp] Fatal: ${err?.message ?? String(err)}\n`);
+  process.exit(1);
+});

package/dist/api-client.d.ts

@@ -0,0 +1,95 @@
+/**
+ * api-client.ts — SPHIOR CODE REST API クライアント
+ *
+ * 機能:
+ *   - Bearer 認証
+ *   - Exponential backoff retry (5xx, network, timeout)
+ *   - 構造化エラー (status code + hint message)
+ *   - タイムアウト保護 (AbortSignal)
+ *   - User-Agent でバージョン送信
+ */
+export interface Finding {
+    id: string;
+    severity: "critical" | "high" | "medium" | "low";
+    rule_type: string;
+    title: string;
+    message: string;
+    file_path: string;
+    line_start: number;
+    language: string | null;
+    cwe: string | null;
+    cvss_base: number | null;
+    fix_hint: string | null;
+    fix_available: boolean;
+    resolved_at: string | null;
+    false_positive_marked: boolean;
+    risk_accepted: boolean;
+    repo_full_name: string | null;
+    created_at: string;
+}
+export interface FindingDetail extends Finding {
+    instance_key: string;
+    finding_key: string;
+    pr_number: number | null;
+    commit_sha: string | null;
+    owasp: string | null;
+    column_start: number | null;
+    last_seen: string;
+}
+export interface SecuritySummary {
+    total_open: number;
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    last_scan_at: string | null;
+    repos_monitored: number;
+}
+export interface FixProposal {
+    explanation: string;
+    patched_code: string;
+    test_suggestion: string | null;
+    cvss_after_fix: number | null;
+}
+export declare class SphiorApiError extends Error {
+    readonly status: number;
+    readonly endpoint: string;
+    readonly hint?: string | undefined;
+    constructor(status: number, endpoint: string, message: string, hint?: string | undefined);
+    /** MCP クライアント向けの人間可読フォーマット */
+    toUserMessage(): string;
+}
+export declare const api: {
+    listFindings(opts?: {
+        severity?: string;
+        status?: string;
+        limit?: number;
+    }): Promise<{
+        findings: Finding[];
+    }>;
+    getFinding(findingId: string): Promise<{
+        finding: FindingDetail;
+    }>;
+    getSummary(): Promise<{
+        summary: SecuritySummary;
+    }>;
+    getFixProposal(findingId: string): Promise<{
+        fix: FixProposal | null;
+    }>;
+    resolveFinding(findingId: string, reason?: string): Promise<{
+        message: string;
+    }>;
+    markFalsePositive(findingId: string, reason?: string): Promise<{
+        message: string;
+    }>;
+    verifyEvidence(opts?: {
+        repo?: string;
+        includePack?: boolean;
+    }): Promise<unknown>;
+    getFixContext(opts?: {
+        repo?: string;
+        findingId?: string;
+        severity?: string;
+    }): Promise<unknown>;
+};
+//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAsB,MAAM,CAAC;IAC/B,QAAQ,EAAgB,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC/D,SAAS,EAAe,MAAM,CAAC;IAC/B,KAAK,EAAmB,MAAM,CAAC;IAC/B,OAAO,EAAiB,MAAM,CAAC;IAC/B,SAAS,EAAe,MAAM,CAAC;IAC/B,UAAU,EAAc,MAAM,CAAC;IAC/B,QAAQ,EAAgB,MAAM,GAAG,IAAI,CAAC;IACtC,GAAG,EAAqB,MAAM,GAAG,IAAI,CAAC;IACtC,SAAS,EAAe,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,EAAgB,MAAM,GAAG,IAAI,CAAC;IACtC,aAAa,EAAW,OAAO,CAAC;IAChC,WAAW,EAAa,MAAM,GAAG,IAAI,CAAC;IACtC,qBAAqB,EAAG,OAAO,CAAC;IAChC,aAAa,EAAW,OAAO,CAAC;IAChC,cAAc,EAAU,MAAM,GAAG,IAAI,CAAC;IACtC,UAAU,EAAc,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,aAAc,SAAQ,OAAO;IAC5C,YAAY,EAAG,MAAM,CAAC;IACtB,WAAW,EAAI,MAAM,CAAC;IACtB,SAAS,EAAM,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAK,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAU,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAG,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAM,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAQ,MAAM,CAAC;IACzB,QAAQ,EAAU,MAAM,CAAC;IACzB,IAAI,EAAc,MAAM,CAAC;IACzB,MAAM,EAAY,MAAM,CAAC;IACzB,GAAG,EAAe,MAAM,CAAC;IACzB,YAAY,EAAM,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,EAAG,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAK,MAAM,CAAC;IACvB,YAAY,EAAI,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAID,qBAAa,cAAe,SAAQ,KAAK;aAErB,MAAM,EAAI,MAAM;aAChB,QAAQ,EAAE,MAAM;aAEhB,IAAI,CAAC,EAAK,MAAM;gBAHhB,MAAM,EAAI,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChC,OAAO,EAAE,MAAM,EACC,IAAI,CAAC,EAAK,MAAM,YAAA;IAMlC,8BAA8B;IAC9B,aAAa,IAAI,MAAM;CAKxB;AAkGD,eAAO,MAAM,GAAG;wBACK;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;0BAI3F,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,aAAa,CAAA;KAAE,CAAC;kBAIpD,OAAO,CAAC;QAAE,OAAO,EAAE,eAAe,CAAA;KAAE,CAAC;8BAIzB,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,CAAC;8BAI7C,MAAM,WAAW,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;iCAOnD,MAAM,WAAW,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;0BAQ9D;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAQ,OAAO,CAAC,OAAO,CAAC;yBAKjE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,OAAO,CAAC,OAAO,CAAC;CAKrG,CAAC"}

package/dist/api-client.js

@@ -0,0 +1,153 @@
+/**
+ * api-client.ts — SPHIOR CODE REST API クライアント
+ *
+ * 機能:
+ *   - Bearer 認証
+ *   - Exponential backoff retry (5xx, network, timeout)
+ *   - 構造化エラー (status code + hint message)
+ *   - タイムアウト保護 (AbortSignal)
+ *   - User-Agent でバージョン送信
+ */
+import { CONFIG } from "./config.js";
+import { log } from "./logger.js";
+// ── Error ─────────────────────────────────────────────────────────────────────
+export class SphiorApiError extends Error {
+    status;
+    endpoint;
+    hint;
+    constructor(status, endpoint, message, hint) {
+        super(message);
+        this.status = status;
+        this.endpoint = endpoint;
+        this.hint = hint;
+        this.name = "SphiorApiError";
+    }
+    /** MCP クライアント向けの人間可読フォーマット */
+    toUserMessage() {
+        const lines = [`${this.message} (status ${this.status} on ${this.endpoint})`];
+        if (this.hint)
+            lines.push(`Hint: ${this.hint}`);
+        return lines.join("\n");
+    }
+}
+// ── Retry helper ──────────────────────────────────────────────────────────────
+const MAX_RETRIES = 3;
+const BACKOFF_BASE = 500; // ms
+async function withRetry(label, fn) {
+    let lastErr;
+    for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastErr = err;
+            // 4xx は retry しない
+            if (err instanceof SphiorApiError && err.status < 500 && err.status !== 0) {
+                throw err;
+            }
+            if (attempt === MAX_RETRIES - 1)
+                break;
+            const delay = BACKOFF_BASE * Math.pow(2, attempt); // 500ms → 1s → 2s
+            log.warn(`${label} failed (attempt ${attempt + 1}/${MAX_RETRIES}), retrying in ${delay}ms`, {
+                error: err instanceof Error ? err.message : String(err),
+            });
+            await new Promise((r) => setTimeout(r, delay));
+        }
+    }
+    throw lastErr;
+}
+async function request(path, opts = {}) {
+    const method = opts.method ?? "GET";
+    // query string 構築 (undefined はスキップ)
+    let url = `${CONFIG.baseUrl}${path}`;
+    if (opts.query) {
+        const qs = new URLSearchParams();
+        for (const [k, v] of Object.entries(opts.query)) {
+            if (v !== undefined && v !== null)
+                qs.set(k, String(v));
+        }
+        const q = qs.toString();
+        if (q)
+            url += `?${q}`;
+    }
+    const endpoint = `${method} ${path}`;
+    return withRetry(endpoint, async () => {
+        log.debug(`→ ${endpoint}`);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), CONFIG.timeoutMs);
+        let res;
+        try {
+            res = await fetch(url, {
+                method,
+                headers: {
+                    "Authorization": `Bearer ${CONFIG.apiKey}`,
+                    "Content-Type": "application/json",
+                    "User-Agent": `sphior-code-mcp/${CONFIG.version} node/${process.versions.node}`,
+                },
+                body: opts.body ? JSON.stringify(opts.body) : undefined,
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            clearTimeout(timer);
+            // ネットワーク / abort
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new SphiorApiError(0, endpoint, `Network error: ${msg}`, "Check your internet connection and SPHIOR_API_BASE setting.");
+        }
+        clearTimeout(timer);
+        if (!res.ok) {
+            let errBody = {};
+            try {
+                errBody = (await res.json());
+            }
+            catch { /* non-JSON error body */ }
+            const message = errBody.error ?? `HTTP ${res.status} ${res.statusText}`;
+            const hint = errBody.hint ?? (res.status === 401
+                ? "Verify SPHIOR_API_KEY is valid and not revoked."
+                : res.status === 429
+                    ? "Rate limit exceeded. Retry after a few seconds."
+                    : undefined);
+            throw new SphiorApiError(res.status, endpoint, message, hint);
+        }
+        log.debug(`← ${endpoint} 200`);
+        return (await res.json());
+    });
+}
+// ── Public API methods ────────────────────────────────────────────────────────
+export const api = {
+    listFindings(opts = {}) {
+        return request("/code/findings", { query: { severity: opts.severity, status: opts.status, limit: opts.limit } });
+    },
+    getFinding(findingId) {
+        return request(`/code/findings/${encodeURIComponent(findingId)}`);
+    },
+    getSummary() {
+        return request("/code/summary");
+    },
+    getFixProposal(findingId) {
+        return request(`/code/findings/${encodeURIComponent(findingId)}/fix`);
+    },
+    resolveFinding(findingId, reason) {
+        return request(`/code/findings/${encodeURIComponent(findingId)}/resolve`, {
+            method: "POST",
+            body: { reason },
+        });
+    },
+    markFalsePositive(findingId, reason) {
+        return request(`/code/findings/${encodeURIComponent(findingId)}/false-positive`, {
+            method: "POST",
+            body: { reason },
+        });
+    },
+    // 改ざん不可の監査証跡（決定論エンジン）の独立検証。監査人向け。
+    verifyEvidence(opts = {}) {
+        return request("/code/evidence", { query: { repo: opts.repo, pack: opts.includePack ? "1" : undefined } });
+    },
+    // 決定論 finding の修正コンテキスト（顧客 AI が直すための payload・コード非送信）。
+    getFixContext(opts = {}) {
+        return request("/code/evidence/fix-context", {
+            query: { repo: opts.repo, finding_id: opts.findingId, severity: opts.severity },
+        });
+    },
+};
+//# sourceMappingURL=api-client.js.map

package/dist/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAmDlC,iFAAiF;AAEjF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAErB;IACA;IAEA;IAJlB,YACkB,MAAgB,EAChB,QAAgB,EAChC,OAAe,EACC,IAAgB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAU;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,SAAI,GAAJ,IAAI,CAAY;QAGhC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;IAED,8BAA8B;IAC9B,aAAa;QACX,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,YAAY,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC9E,IAAI,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,iFAAiF;AAEjF,MAAM,WAAW,GAAK,CAAC,CAAC;AACxB,MAAM,YAAY,GAAI,GAAG,CAAC,CAAC,KAAK;AAEhC,KAAK,UAAU,SAAS,CAAI,KAAa,EAAE,EAAoB;IAC7D,IAAI,OAAgB,CAAC;IACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;YACd,kBAAkB;YAClB,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,OAAO,KAAK,WAAW,GAAG,CAAC;gBAAE,MAAM;YACvC,MAAM,KAAK,GAAG,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB;YACrE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,OAAO,GAAG,CAAC,IAAI,WAAW,kBAAkB,KAAK,IAAI,EAAE;gBAC1F,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC;AAChB,CAAC;AAUD,KAAK,UAAU,OAAO,CAAI,IAAY,EAAE,OAAuB,EAAE;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;IAEpC,oCAAoC;IACpC,IAAI,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;IACrC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;gBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC;YAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAErC,OAAO,SAAS,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACpC,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;QAE3B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAErE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACrB,MAAM;gBACN,OAAO,EAAE;oBACP,eAAe,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE;oBAC1C,cAAc,EAAG,kBAAkB;oBACnC,YAAY,EAAK,mBAAmB,MAAM,CAAC,OAAO,SAAS,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE;iBACnF;gBACD,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,iBAAiB;YACjB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,EAAE,EAAE,6DAA6D,CAAC,CAAC;QAChI,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,OAAO,GAAsC,EAAE,CAAC;YACpD,IAAI,CAAC;gBAAC,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;YAC9G,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACxE,MAAM,IAAI,GAAM,OAAO,CAAC,IAAI,IAAK,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClD,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;oBACpB,CAAC,CAAC,iDAAiD;oBACnD,CAAC,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAChE,CAAC;QAED,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,YAAY,CAAC,OAA+D,EAAE;QAC5E,OAAO,OAAO,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,UAAU;QACR,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IAED,cAAc,CAAC,SAAiB;QAC9B,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,MAAe;QAC/C,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,CAAC,SAAS,CAAC,UAAU,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,IAAI,EAAI,EAAE,MAAM,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB,CAAC,SAAiB,EAAE,MAAe;QAClD,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,CAAC,SAAS,CAAC,iBAAiB,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,IAAI,EAAI,EAAE,MAAM,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,cAAc,CAAC,OAAiD,EAAE;QAChE,OAAO,OAAO,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,sDAAsD;IACtD,aAAa,CAAC,OAAiE,EAAE;QAC/E,OAAO,OAAO,CAAC,4BAA4B,EAAE;YAC3C,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,15 @@
+/**
+ * config.ts — Environment-driven configuration with defaults.
+ *
+ * 環境変数から設定を読み、不正値・必須値欠落を起動時にチェックする。
+ */
+export interface Config {
+    apiKey: string;
+    baseUrl: string;
+    timeoutMs: number;
+    debug: boolean;
+    /** Package version (populated by build) */
+    version: string;
+}
+export declare const CONFIG: Config;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,MAAM;IACrB,MAAM,EAAG,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;CACjB;AAqCD,eAAO,MAAM,MAAM,EAAE,MAAiC,CAAC"}

package/dist/config.js

@@ -0,0 +1,33 @@
+/**
+ * config.ts — Environment-driven configuration with defaults.
+ *
+ * 環境変数から設定を読み、不正値・必須値欠落を起動時にチェックする。
+ */
+const PACKAGE_VERSION = "1.0.0";
+function readEnv() {
+    const apiKey = process.env.SPHIOR_API_KEY?.trim();
+    if (!apiKey) {
+        throw new Error("SPHIOR_API_KEY environment variable is required.\n" +
+            "Get your API key at: https://sphior.com/account/code/api-keys");
+    }
+    if (!apiKey.startsWith("sk_")) {
+        throw new Error(`Invalid SPHIOR_API_KEY format (expected sk_live_... or sk_test_...).\n` +
+            `Get your API key at: https://sphior.com/account/code/api-keys`);
+    }
+    const baseUrl = (process.env.SPHIOR_API_BASE?.trim() || "https://sphior.com/api/v1").replace(/\/+$/, "");
+    const timeoutMs = Number(process.env.SPHIOR_TIMEOUT ?? "30000");
+    const debug = ["1", "true", "yes", "on"].includes((process.env.SPHIOR_DEBUG ?? "").toLowerCase());
+    if (!Number.isFinite(timeoutMs) || timeoutMs < 1000 || timeoutMs > 300_000) {
+        throw new Error(`SPHIOR_TIMEOUT must be between 1000 and 300000 ms (got: ${timeoutMs}).`);
+    }
+    return {
+        apiKey,
+        baseUrl,
+        timeoutMs,
+        debug,
+        version: PACKAGE_VERSION,
+    };
+}
+// 起動時に 1 度だけ読み込んで凍結
+export const CONFIG = Object.freeze(readEnv());
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC,SAAS,OAAO;IACd,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,oDAAoD;YACpD,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,wEAAwE;YACxE,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,2BAA2B,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAElG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,IAAI,SAAS,GAAG,OAAO,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,2DAA2D,SAAS,IAAI,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,SAAS;QACT,KAAK;QACL,OAAO,EAAE,eAAe;KACzB,CAAC;AACJ,CAAC;AAED,oBAAoB;AACpB,MAAM,CAAC,MAAM,MAAM,GAAW,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * SPHIOR Code MCP — Public entrypoint.
+ *
+ * Exports:
+ *   - startServer(): Promise<void>  — start the stdio MCP server
+ *   - Types from api-client for programmatic use
+ */
+export { startServer } from "./server.js";
+export type { Finding, FindingDetail, SecuritySummary, FixProposal, } from "./api-client.js";
+export { SphiorApiError } from "./api-client.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,YAAY,EACV,OAAO,EACP,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+/**
+ * SPHIOR Code MCP — Public entrypoint.
+ *
+ * Exports:
+ *   - startServer(): Promise<void>  — start the stdio MCP server
+ *   - Types from api-client for programmatic use
+ */
+export { startServer } from "./server.js";
+export { SphiorApiError } from "./api-client.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/logger.d.ts

@@ -0,0 +1,13 @@
+/**
+ * logger.ts — stderr-only logger (MCP の stdout を汚さない)
+ *
+ * MCP プロトコルは stdout 上で JSON-RPC メッセージを交換するため、
+ * console.log() は使用厳禁。すべてのログは stderr に出力する。
+ */
+export declare const log: {
+    error: (msg: string, meta?: Record<string, unknown>) => void;
+    warn: (msg: string, meta?: Record<string, unknown>) => void;
+    info: (msg: string, meta?: Record<string, unknown>) => void;
+    debug: (msg: string, meta?: Record<string, unknown>) => void;
+};
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoBH,eAAO,MAAM,GAAG;iBACD,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAAI;gBAC7C,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAAI;gBAC7C,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAAI;iBAC7C,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAAI;CAC3D,CAAC"}

package/dist/logger.js

@@ -0,0 +1,27 @@
+/**
+ * logger.ts — stderr-only logger (MCP の stdout を汚さない)
+ *
+ * MCP プロトコルは stdout 上で JSON-RPC メッセージを交換するため、
+ * console.log() は使用厳禁。すべてのログは stderr に出力する。
+ */
+import { CONFIG } from "./config.js";
+const LEVELS = { error: 0, warn: 1, info: 2, debug: 3 };
+function shouldLog(level) {
+    const threshold = CONFIG.debug ? LEVELS.debug : LEVELS.info;
+    return LEVELS[level] <= threshold;
+}
+function write(level, message, meta) {
+    if (!shouldLog(level))
+        return;
+    const ts = new Date().toISOString();
+    const tag = `[sphior-code-mcp]`;
+    const extra = meta ? ` ${JSON.stringify(meta)}` : "";
+    process.stderr.write(`${ts} ${tag} ${level.toUpperCase()} ${message}${extra}\n`);
+}
+export const log = {
+    error: (msg, meta) => write("error", msg, meta),
+    warn: (msg, meta) => write("warn", msg, meta),
+    info: (msg, meta) => write("info", msg, meta),
+    debug: (msg, meta) => write("debug", msg, meta),
+};
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAW,CAAC;AAGjE,SAAS,SAAS,CAAC,KAAY;IAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;AACpC,CAAC;AAED,SAAS,KAAK,CAAC,KAAY,EAAE,OAAe,EAAE,IAA8B;IAC1E,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,mBAAmB,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,KAAK,EAAE,CAAC,GAAW,EAAE,IAA8B,EAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;IACvF,IAAI,EAAG,CAAC,GAAW,EAAE,IAA8B,EAAQ,EAAE,CAAC,KAAK,CAAC,MAAM,EAAG,GAAG,EAAE,IAAI,CAAC;IACvF,IAAI,EAAG,CAAC,GAAW,EAAE,IAA8B,EAAQ,EAAE,CAAC,KAAK,CAAC,MAAM,EAAG,GAAG,EAAE,IAAI,CAAC;IACvF,KAAK,EAAE,CAAC,GAAW,EAAE,IAA8B,EAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;CACxF,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,7 @@
+/**
+ * server.ts — MCP Server セットアップ (stdio transport)
+ *
+ * tools/resources を登録し、JSON-RPC リクエストを処理する。
+ */
+export declare function startServer(): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAoHjD"}

package/dist/server.js

@@ -0,0 +1,118 @@
+/**
+ * server.ts — MCP Server セットアップ (stdio transport)
+ *
+ * tools/resources を登録し、JSON-RPC リクエストを処理する。
+ */
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { z } from "zod";
+import { CONFIG } from "./config.js";
+import { log } from "./logger.js";
+import { TOOLS, HANDLERS } from "./tools/index.js";
+import { api } from "./api-client.js";
+export async function startServer() {
+    log.info(`SPHIOR Code MCP server starting`, { version: CONFIG.version, baseUrl: CONFIG.baseUrl });
+    const server = new Server({
+        name: "sphior-code",
+        version: CONFIG.version,
+    }, {
+        capabilities: {
+            tools: {},
+            resources: {},
+        },
+    });
+    // ── tools/list ──────────────────────────────────────────────────────────
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: TOOLS,
+    }));
+    // ── tools/call ──────────────────────────────────────────────────────────
+    // SDK 1.29+ では handler 戻り値の型が ServerResult union に拡張されているため
+    // ローカル ToolResult 形式 ({content, isError}) を CallToolResult として返す。
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const { name, arguments: args } = request.params;
+        log.debug(`tools/call ${name}`, { args });
+        const handler = HANDLERS[name];
+        if (!handler) {
+            return {
+                content: [{ type: "text", text: `Unknown tool: ${name}` }],
+                isError: true,
+            };
+        }
+        try {
+            const result = await handler(args);
+            return result;
+        }
+        catch (e) {
+            // Zod 検証エラーなど handler 内で投げられた未捕捉例外
+            if (e instanceof z.ZodError) {
+                const msg = `Invalid arguments for ${name}: ${e.issues.map((i) => `${i.path.join(".")} - ${i.message}`).join("; ")}`;
+                return { content: [{ type: "text", text: msg }], isError: true };
+            }
+            const msg = e instanceof Error ? e.message : String(e);
+            log.error("Unhandled tool error", { tool: name, error: msg });
+            return { content: [{ type: "text", text: `Internal error: ${msg}` }], isError: true };
+        }
+    });
+    // ── resources/list — 動的 URI で findings を露出 ─────────────────────────
+    server.setRequestHandler(ListResourcesRequestSchema, async () => {
+        try {
+            const { findings } = await api.listFindings({ status: "open", limit: 50 });
+            return {
+                resources: [
+                    {
+                        uri: "sphior-code://summary",
+                        name: "Security Summary",
+                        description: "Aggregate security posture (counts by severity, last scan time)",
+                        mimeType: "application/json",
+                    },
+                    ...findings.map((f) => ({
+                        uri: `sphior-code://findings/${f.id}`,
+                        name: `${f.severity.toUpperCase()} — ${f.title}`,
+                        description: `${f.file_path}:${f.line_start} · ${f.repo_full_name ?? "unknown repo"}`,
+                        mimeType: "application/json",
+                    })),
+                ],
+            };
+        }
+        catch (e) {
+            log.warn("resources/list failed", { error: e instanceof Error ? e.message : String(e) });
+            return { resources: [] };
+        }
+    });
+    // ── resources/read ──────────────────────────────────────────────────────
+    server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+        const uri = request.params.uri;
+        if (uri === "sphior-code://summary") {
+            const { summary } = await api.getSummary();
+            return {
+                contents: [
+                    { uri, mimeType: "application/json", text: JSON.stringify(summary, null, 2) },
+                ],
+            };
+        }
+        const match = uri.match(/^sphior-code:\/\/findings\/(.+)$/);
+        if (match) {
+            const findingId = match[1];
+            const { finding } = await api.getFinding(findingId);
+            return {
+                contents: [
+                    { uri, mimeType: "application/json", text: JSON.stringify(finding, null, 2) },
+                ],
+            };
+        }
+        throw new Error(`Unsupported resource URI: ${uri}`);
+    });
+    // ── Transport 接続 ──────────────────────────────────────────────────────
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    log.info(`Ready to receive MCP requests on stdio`);
+    // SIGTERM / SIGINT で graceful shutdown
+    const shutdown = (signal) => {
+        log.info(`Shutting down on ${signal}`);
+        process.exit(0);
+    };
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    process.on("SIGINT", () => shutdown("SIGINT"));
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAElG,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;QACE,IAAI,EAAK,aAAa;QACtB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,EACD;QACE,YAAY,EAAE;YACZ,KAAK,EAAM,EAAE;YACb,SAAS,EAAE,EAAE;SACd;KACF,CACF,CAAC;IAEF,2EAA2E;IAC3E,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK;KACb,CAAC,CAAC,CAAC;IAEJ,2EAA2E;IAC3E,4DAA4D;IAC5D,kEAAkE;IAClE,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;gBAC1D,OAAO,EAAE,IAAI;aACL,CAAC;QACb,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,MAAe,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,mCAAmC;YACnC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,yBAAyB,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAW,CAAC;YAC5E,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAW,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,OAAO;gBACL,SAAS,EAAE;oBACT;wBACE,GAAG,EAAU,uBAAuB;wBACpC,IAAI,EAAS,kBAAkB;wBAC/B,WAAW,EAAE,iEAAiE;wBAC9E,QAAQ,EAAK,kBAAkB;qBAChC;oBACD,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACtB,GAAG,EAAU,0BAA0B,CAAC,CAAC,EAAE,EAAE;wBAC7C,IAAI,EAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE;wBACvD,WAAW,EAAE,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,cAAc,IAAI,cAAc,EAAE;wBACrF,QAAQ,EAAK,kBAAkB;qBAChC,CAAC,CAAC;iBACJ;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzF,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QAE/B,IAAI,GAAG,KAAK,uBAAuB,EAAE,CAAC;YACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO;gBACL,QAAQ,EAAE;oBACR,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;iBAC9E;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC5D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpD,OAAO;gBACL,QAAQ,EAAE;oBACR,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;iBAC9E;aACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,GAAG,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAEnD,uCAAuC;IACvC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,GAAG,CAAC,IAAI,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/tools/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * tools/index.ts — MCP tool 定義一覧
+ *
+ * 各 tool は:
+ *   - definition: MCP プロトコル仕様で公開するメタ情報
+ *   - handler:    実際の処理 (api クライアントを呼び出して structured 結果を返す)
+ *
+ * Zod schema で実行時バリデーションし、不正パラメータは早期エラー化する。
+ */
+import type { Tool } from "@modelcontextprotocol/sdk/types.js";
+interface ToolResult {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}
+export declare const TOOLS: Tool[];
+type Handler = (args: unknown) => Promise<ToolResult>;
+export declare const HANDLERS: Record<string, Handler>;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAM/D,UAAU,UAAU;IAClB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAiED,eAAO,MAAM,KAAK,EAAE,IAAI,EAwIvB,CAAC;AAIF,KAAK,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtD,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAoD5C,CAAC"}

package/dist/tools/index.js

@@ -0,0 +1,238 @@
+/**
+ * tools/index.ts — MCP tool 定義一覧
+ *
+ * 各 tool は:
+ *   - definition: MCP プロトコル仕様で公開するメタ情報
+ *   - handler:    実際の処理 (api クライアントを呼び出して structured 結果を返す)
+ *
+ * Zod schema で実行時バリデーションし、不正パラメータは早期エラー化する。
+ */
+import { z } from "zod";
+import { api, SphiorApiError } from "../api-client.js";
+import { log } from "../logger.js";
+function ok(payload) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
+    };
+}
+function err(message) {
+    return {
+        content: [{ type: "text", text: message }],
+        isError: true,
+    };
+}
+async function safe(fn) {
+    try {
+        const result = await fn();
+        return ok(result);
+    }
+    catch (e) {
+        if (e instanceof SphiorApiError) {
+            return err(e.toUserMessage());
+        }
+        const msg = e instanceof Error ? e.message : String(e);
+        log.error("Unexpected tool error", { error: msg });
+        return err(`Internal error: ${msg}`);
+    }
+}
+// ── Schemas ───────────────────────────────────────────────────────────────────
+const SeverityEnum = z.enum(["critical", "high", "medium", "low"]);
+const StatusEnum = z.enum(["open", "resolved", "all"]);
+const ListFindingsArgs = z.object({
+    severity: SeverityEnum.optional().describe("Filter by severity"),
+    status: StatusEnum.optional().describe("Filter by triage status. Default: open"),
+    limit: z.number().int().min(1).max(100).optional().describe("Max number of results (1-100). Default: 20"),
+});
+const FindingIdArgs = z.object({
+    findingId: z.string().min(1).describe("Finding UUID — obtain via list_findings"),
+});
+const ResolveArgs = FindingIdArgs.extend({
+    reason: z.string().max(500).optional().describe("Optional human-readable reason for closing"),
+});
+const FpArgs = FindingIdArgs.extend({
+    reason: z.string().max(500).optional().describe("Optional reason why this is a false positive"),
+});
+const VerifyEvidenceArgs = z.object({
+    repo: z.string().optional().describe("Repository full_name (owner/repo). Omit for all."),
+    includePack: z.boolean().optional().describe("Include the independently-verifiable evidence pack (records + SHA-256 manifest)."),
+});
+const FixContextArgs = z.object({
+    repo: z.string().optional().describe("Repository full_name (owner/repo). Omit for the latest scanned repo."),
+    findingId: z.string().optional().describe("A specific finding fingerprint to fix. Omit for all findings."),
+    severity: SeverityEnum.optional().describe("Filter to one severity."),
+});
+// ── Tool definitions (MCP 仕様) ───────────────────────────────────────────────
+export const TOOLS = [
+    {
+        name: "list_findings",
+        description: "List security vulnerabilities (SAST + SCA) detected by SPHIOR CODE across the user's GitHub repositories. " +
+            "Use this when the user asks about security issues, vulnerabilities, or CVEs in their code. " +
+            "Returns up to 100 findings ordered by detection date (newest first).",
+        inputSchema: {
+            type: "object",
+            properties: {
+                severity: {
+                    type: "string",
+                    enum: ["critical", "high", "medium", "low"],
+                    description: "Filter by severity level",
+                },
+                status: {
+                    type: "string",
+                    enum: ["open", "resolved", "all"],
+                    description: "Filter by triage status. Default: open",
+                },
+                limit: {
+                    type: "number",
+                    minimum: 1,
+                    maximum: 100,
+                    description: "Max number of results (1-100). Default: 20",
+                },
+            },
+        },
+    },
+    {
+        name: "get_finding",
+        description: "Fetch full details of a single security finding by ID — includes CVSS score, CWE classification, " +
+            "exact file path and line number, vulnerability message, and fix hint. " +
+            "Use when the user wants to investigate a specific issue from list_findings.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                findingId: { type: "string", description: "Finding UUID — obtain via list_findings" },
+            },
+            required: ["findingId"],
+        },
+    },
+    {
+        name: "get_security_summary",
+        description: "Get the user's overall security posture: counts by severity, last scan time, and number of monitored repos. " +
+            "Use this when the user wants a high-level overview of their security health.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+        },
+    },
+    {
+        name: "get_fix_proposal",
+        description: "Fetch the AI-generated fix proposal for a specific finding — includes patched code, " +
+            "explanation of the change, and CVSS score after applying the fix. " +
+            "Use when the user wants to see how to fix a vulnerability.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                findingId: { type: "string", description: "Finding UUID — obtain via list_findings" },
+            },
+            required: ["findingId"],
+        },
+    },
+    {
+        name: "resolve_finding",
+        description: "Mark a finding as resolved (e.g., after applying a fix). " +
+            "Use only when the vulnerability has actually been remediated. " +
+            "For false positives, use mark_false_positive instead.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                findingId: { type: "string", description: "Finding UUID" },
+                reason: { type: "string", maxLength: 500, description: "Optional reason for closing" },
+            },
+            required: ["findingId"],
+        },
+    },
+    {
+        name: "mark_false_positive",
+        description: "Mark a finding as a false positive (the reported vulnerability is not actually exploitable). " +
+            "Use this when the AI's detection is incorrect for a specific code context.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                findingId: { type: "string", description: "Finding UUID" },
+                reason: { type: "string", maxLength: 500, description: "Optional reason why this is a false positive" },
+            },
+            required: ["findingId"],
+        },
+    },
+    {
+        name: "health_check",
+        description: "Verify connectivity and authentication with the SPHIOR CODE API. " +
+            "Returns service version and current security summary. " +
+            "Use this to debug connection issues.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+        },
+    },
+    {
+        name: "get_fix_context",
+        description: "Get deterministic remediation guidance for SPHIOR's code findings so YOU (the AI agent) can fix them. " +
+            "SPHIOR does not generate code or transmit source — open the referenced file in your workspace, read the " +
+            "code yourself, and apply the fix. Returns why-it-matters, remediation steps, exact location, and references. " +
+            "A human must review before merge.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                repo: { type: "string", description: "Repository full_name (owner/repo). Omit for the latest scanned repo." },
+                findingId: { type: "string", description: "A specific finding fingerprint to fix. Omit for all findings." },
+                severity: { type: "string", enum: ["critical", "high", "medium", "low"], description: "Filter to one severity." },
+            },
+        },
+    },
+    {
+        name: "verify_evidence",
+        description: "Independently verify SPHIOR's tamper-evident code evidence chain (Merkle root + hash-chain + commit anchor). " +
+            "Confirms the deterministic scan records were not altered — for auditors. No source code is returned.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                repo: { type: "string", description: "Filter to one repository (full_name). Omit for all." },
+                includePack: { type: "boolean", description: "Include the independently-verifiable evidence pack (records + SHA-256 manifest)." },
+            },
+        },
+    },
+];
+export const HANDLERS = {
+    list_findings: async (args) => {
+        const a = ListFindingsArgs.parse(args ?? {});
+        return safe(() => api.listFindings(a));
+    },
+    get_finding: async (args) => {
+        const a = FindingIdArgs.parse(args);
+        return safe(() => api.getFinding(a.findingId));
+    },
+    get_security_summary: async () => {
+        return safe(() => api.getSummary());
+    },
+    get_fix_proposal: async (args) => {
+        const a = FindingIdArgs.parse(args);
+        return safe(() => api.getFixProposal(a.findingId));
+    },
+    resolve_finding: async (args) => {
+        const a = ResolveArgs.parse(args);
+        return safe(() => api.resolveFinding(a.findingId, a.reason));
+    },
+    mark_false_positive: async (args) => {
+        const a = FpArgs.parse(args);
+        return safe(() => api.markFalsePositive(a.findingId, a.reason));
+    },
+    health_check: async () => {
+        return safe(async () => {
+            const { summary } = await api.getSummary();
+            return {
+                status: "ok",
+                api_reachable: true,
+                repos_monitored: summary.repos_monitored,
+                open_findings: summary.total_open,
+                version: "1.0.0",
+            };
+        });
+    },
+    get_fix_context: async (args) => {
+        const a = FixContextArgs.parse(args ?? {});
+        return safe(() => api.getFixContext({ repo: a.repo, findingId: a.findingId, severity: a.severity }));
+    },
+    verify_evidence: async (args) => {
+        const a = VerifyEvidenceArgs.parse(args ?? {});
+        return safe(() => api.verifyEvidence({ repo: a.repo, includePack: a.includePack }));
+    },
+};
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AASnC,SAAS,EAAE,CAAC,OAAgB;IAC1B,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,OAAe;IAC1B,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI,CAAI,EAAoB;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,cAAc,EAAE,CAAC;YAChC,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,GAAG,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AACnE,MAAM,UAAU,GAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAEzD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAChE,MAAM,EAAI,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IAClF,KAAK,EAAK,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;CAC7G,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yCAAyC,CAAC;CACjF,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;CAC9F,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAChG,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAS,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;IAC/F,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;CACjI,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAO,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;IACjH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;IAC1G,QAAQ,EAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;CACvE,CAAC,CAAC;AAEH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,KAAK,GAAW;IAC3B;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,4GAA4G;YAC5G,6FAA6F;YAC7F,sEAAsE;QACxE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;oBAC3C,WAAW,EAAE,0BAA0B;iBACxC;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;oBACjC,WAAW,EAAE,wCAAwC;iBACtD;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,GAAG;oBACZ,WAAW,EAAE,4CAA4C;iBAC1D;aACF;SACF;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,mGAAmG;YACnG,wEAAwE;YACxE,6EAA6E;QAC/E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE;aACtF;YACD,QAAQ,EAAE,CAAC,WAAW,CAAC;SACxB;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,8GAA8G;YAC9G,8EAA8E;QAChF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE;SACf;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,sFAAsF;YACtF,oEAAoE;YACpE,4DAA4D;QAC9D,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE;aACtF;YACD,QAAQ,EAAE,CAAC,WAAW,CAAC;SACxB;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,2DAA2D;YAC3D,gEAAgE;YAChE,uDAAuD;QACzD,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;gBAC1D,MAAM,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,6BAA6B,EAAE;aAC1F;YACD,QAAQ,EAAE,CAAC,WAAW,CAAC;SACxB;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,+FAA+F;YAC/F,4EAA4E;QAC9E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;gBAC1D,MAAM,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,8CAA8C,EAAE;aAC3G;YACD,QAAQ,EAAE,CAAC,WAAW,CAAC;SACxB;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,mEAAmE;YACnE,wDAAwD;YACxD,sCAAsC;QACxC,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE;SACf;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wGAAwG;YACxG,0GAA0G;YAC1G,+GAA+G;YAC/G,mCAAmC;QACrC,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sEAAsE,EAAE;gBACnH,SAAS,EAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+DAA+D,EAAE;gBAC5G,QAAQ,EAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE;aACpH;SACF;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,+GAA+G;YAC/G,sGAAsG;QACxG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qDAAqD,EAAE;gBACnG,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,kFAAkF,EAAE;aAClI;SACF;KACF;CACF,CAAC;AAMF,MAAM,CAAC,MAAM,QAAQ,GAA4B;IAC/C,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC1B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,YAAY,EAAE,KAAK,IAAI,EAAE;QACvB,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,aAAa,EAAE,IAAI;gBACnB,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,aAAa,EAAI,OAAO,CAAC,UAAU;gBACnC,OAAO,EAAU,OAAO;aACzB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACvG,CAAC;IAED,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;CACF,CAAC"}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "sphior-code-mcp",
+  "version": "1.0.0",
+  "description": "Official Model Context Protocol (MCP) server for SPHIOR CODE — surface security findings from your GitHub repos directly into Cursor, Claude Code, VS Code, Cline, Continue, Windsurf, Zed and any MCP-compatible AI coding assistant.",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "sphior",
+    "sphior-code",
+    "security",
+    "sast",
+    "sca",
+    "vulnerability",
+    "cursor",
+    "claude-code",
+    "vscode",
+    "cline",
+    "continue",
+    "windsurf",
+    "zed",
+    "github"
+  ],
+  "homepage": "https://sphior.com/code",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/sphior/code-mcp.git"
+  },
+  "bugs": {
+    "url": "https://github.com/sphior/code-mcp/issues"
+  },
+  "license": "MIT",
+  "author": "SPHIOR Security",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "sphior-code-mcp": "bin/sphior-code-mcp.js"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch",
+    "start": "node bin/sphior-code-mcp.js",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.4",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.1",
+    "typescript": "^5.7.2"
+  }
+}