toolip 1.0.7 → 2.0.0

package/dist/src/mcp/server.js

@@ -0,0 +1,64 @@
+import { TOOLIP_VERSION } from '../config/version.js';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { z } from 'zod';
+import { runSecurityDoctor } from '../core/security-doctor.js';
+import { generateSbom } from '../core/sbom/generate.js';
+import { securityDiff } from '../core/diff/security-diff.js';
+export async function startMcpServer() {
+    const server = new McpServer({
+        name: 'toolip',
+        version: TOOLIP_VERSION
+    });
+    server.registerTool('toolip_doctor', {
+        title: 'Toolip Security Doctor',
+        description: 'Run local Toolip security checks inside the approved workspace.',
+        inputSchema: {
+            root: z.string().default(process.cwd())
+        }
+    }, async ({ root }) => {
+        const report = await runSecurityDoctor(root);
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify(report, null, 2)
+                }]
+        };
+    });
+    server.registerTool('toolip_sbom', {
+        title: 'Generate SBOM',
+        description: 'Generate a local CycloneDX or SPDX SBOM.',
+        inputSchema: {
+            root: z.string().default(process.cwd()),
+            format: z.enum(['cyclonedx', 'spdx']).default('cyclonedx')
+        }
+    }, async ({ root, format }) => {
+        const report = await generateSbom(root, format);
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify(report, null, 2)
+                }]
+        };
+    });
+    server.registerTool('toolip_diff', {
+        title: 'Security Diff',
+        description: 'Summarize security-relevant Git changes.',
+        inputSchema: {
+            root: z.string().default(process.cwd()),
+            base: z.string(),
+            head: z.string().default('HEAD')
+        }
+    }, async ({ root, base, head }) => {
+        const result = await securityDiff(root, base, head);
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify(result, null, 2)
+                }]
+        };
+    });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+//# sourceMappingURL=server.js.map

package/dist/src/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,iEAAiE;QAC9E,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;SACxC;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,0CAA0C;QACvD,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;SAC3D;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,0CAA0C;QACvD,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACjC;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/src/providers/depsdev/client.d.ts

@@ -0,0 +1,71 @@
+export type DepsDevVersionResponse = {
+    versionKey?: {
+        system?: string;
+        name?: string;
+        version?: string;
+    };
+    publishedAt?: string;
+    isDefault?: boolean;
+    isDeprecated?: boolean;
+    deprecatedReason?: string;
+    licenses?: string[];
+    advisoryKeys?: Array<{
+        id?: string;
+    }>;
+    links?: Array<{
+        label?: string;
+        url?: string;
+    }>;
+    slsaProvenances?: Array<{
+        sourceRepository?: string;
+        commit?: string;
+        url?: string;
+        verified?: boolean;
+    }>;
+    attestations?: Array<{
+        type?: string;
+        url?: string;
+        verified?: boolean;
+        sourceRepository?: string;
+        commit?: string;
+    }>;
+    registries?: string[];
+    relatedProjects?: Array<{
+        projectKey?: {
+            id?: string;
+        };
+        relationType?: string;
+        relationProvenance?: string;
+    }>;
+};
+export type DepsDevDependenciesResponse = {
+    nodes?: Array<{
+        versionKey?: {
+            system?: string;
+            name?: string;
+            version?: string;
+        };
+        relation?: string;
+        errors?: string[];
+    }>;
+    edges?: Array<{
+        fromNode?: number;
+        toNode?: number;
+        requirement?: string;
+    }>;
+    error?: string;
+};
+export type DepsDevClientOptions = {
+    endpoint?: string;
+    timeoutMs?: number;
+    fetchImplementation?: typeof fetch;
+};
+export declare class DepsDevClient {
+    private readonly endpoint;
+    private readonly timeoutMs;
+    private readonly fetchImplementation;
+    constructor(options?: DepsDevClientOptions);
+    getVersion(packageName: string, version: string, signal?: AbortSignal): Promise<DepsDevVersionResponse>;
+    getDependencies(packageName: string, version: string, signal?: AbortSignal): Promise<DepsDevDependenciesResponse>;
+    private getJson;
+}

package/dist/src/providers/depsdev/client.js

@@ -0,0 +1,44 @@
+export class DepsDevClient {
+    endpoint;
+    timeoutMs;
+    fetchImplementation;
+    constructor(options = {}) {
+        this.endpoint =
+            options.endpoint ?? 'https://api.deps.dev/v3';
+        this.timeoutMs = options.timeoutMs ?? 20_000;
+        this.fetchImplementation =
+            options.fetchImplementation ?? globalThis.fetch;
+    }
+    async getVersion(packageName, version, signal) {
+        return this.getJson(`/systems/npm/packages/${encodeURIComponent(packageName)}/versions/${encodeURIComponent(version)}`, signal);
+    }
+    async getDependencies(packageName, version, signal) {
+        return this.getJson(`/systems/npm/packages/${encodeURIComponent(packageName)}/versions/${encodeURIComponent(version)}:dependencies`, signal);
+    }
+    async getJson(pathname, outerSignal) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        const abort = () => controller.abort();
+        outerSignal?.addEventListener('abort', abort, {
+            once: true
+        });
+        try {
+            const response = await this.fetchImplementation(`${this.endpoint}${pathname}`, {
+                headers: {
+                    accept: 'application/json',
+                    'user-agent': 'toolip'
+                },
+                signal: controller.signal
+            });
+            if (!response.ok) {
+                throw new Error(`deps.dev request failed with HTTP ${response.status}.`);
+            }
+            return (await response.json());
+        }
+        finally {
+            clearTimeout(timeout);
+            outerSignal?.removeEventListener('abort', abort);
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/src/providers/depsdev/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../../src/providers/depsdev/client.ts"],"names":[],"mappings":"AAiEA,MAAM,OAAO,aAAa;IACP,QAAQ,CAAS;IACjB,SAAS,CAAS;IAClB,mBAAmB,CAAe;IAEnD,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,QAAQ;YACX,OAAO,CAAC,QAAQ,IAAI,yBAAyB,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,mBAAmB;YACtB,OAAO,CAAC,mBAAmB,IAAI,UAAU,CAAC,KAAK,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CACd,WAAmB,EACnB,OAAe,EACf,MAAoB;QAEpB,OAAO,IAAI,CAAC,OAAO,CACjB,yBAAyB,kBAAkB,CACzC,WAAW,CACZ,aAAa,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAC3C,MAAM,CACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,WAAmB,EACnB,OAAe,EACf,MAAoB;QAEpB,OAAO,IAAI,CAAC,OAAO,CACjB,yBAAyB,kBAAkB,CACzC,WAAW,CACZ,aAAa,kBAAkB,CAC9B,OAAO,CACR,eAAe,EAChB,MAAM,CACP,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,QAAgB,EAChB,WAAyB;QAEzB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,SAAS,CACf,CAAC;QAEF,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7C,WAAW,EAAE,gBAAgB,CAC3B,OAAO,EACP,KAAK,EACL;YACE,IAAI,EAAE,IAAI;SACX,CACF,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GACZ,MAAM,IAAI,CAAC,mBAAmB,CAC5B,GAAG,IAAI,CAAC,QAAQ,GAAG,QAAQ,EAAE,EAC7B;gBACE,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,YAAY,EAAE,QAAQ;iBACvB;gBACD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CACF,CAAC;YAEJ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,CAAC,MAAM,GAAG,CACxD,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,WAAW,EAAE,mBAAmB,CAC9B,OAAO,EACP,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/src/providers/osv/client.d.ts

@@ -0,0 +1,15 @@
+import type { OsvBatchResponse, OsvQuery } from './types.js';
+export type OsvQueryResult = {
+    query: OsvQuery;
+    vulnerabilities: NonNullable<OsvBatchResponse['results'][number]['vulns']>;
+};
+export declare class OsvClient {
+    private readonly options;
+    constructor(options?: {
+        endpoint?: string;
+        timeoutMs?: number;
+        fetchImplementation?: typeof fetch;
+        batchSize?: number;
+    });
+    queryBatch(queries: OsvQuery[], signal?: AbortSignal): Promise<OsvQueryResult[]>;
+}

package/dist/src/providers/osv/client.js

@@ -0,0 +1,51 @@
+export class OsvClient {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    async queryBatch(queries, signal) {
+        const endpoint = this.options.endpoint ?? 'https://api.osv.dev/v1/querybatch';
+        const timeoutMs = this.options.timeoutMs ?? 20000;
+        const fetchImplementation = this.options.fetchImplementation ?? globalThis.fetch;
+        const batchSize = Math.max(1, this.options.batchSize ?? 500);
+        const results = [];
+        for (let start = 0; start < queries.length; start += batchSize) {
+            const batch = queries.slice(start, start + batchSize);
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), timeoutMs);
+            const abortFromOuter = () => controller.abort();
+            signal?.addEventListener('abort', abortFromOuter, { once: true });
+            try {
+                const response = await fetchImplementation(endpoint, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json', 'user-agent': 'toolip' },
+                    body: JSON.stringify({ queries: batch }),
+                    signal: controller.signal
+                });
+                if (!response.ok)
+                    throw new Error(`OSV request failed with HTTP ${response.status}.`);
+                const payload = (await response.json());
+                if (!Array.isArray(payload.results))
+                    throw new Error('OSV returned a malformed response.');
+                if (payload.results.length !== batch.length) {
+                    throw new Error(`OSV returned ${payload.results.length} results for ${batch.length} queries.`);
+                }
+                batch.forEach((query, index) => {
+                    results.push({ query, vulnerabilities: payload.results[index]?.vulns ?? [] });
+                });
+            }
+            catch (error) {
+                if (error instanceof Error && error.name === 'AbortError') {
+                    throw new Error('OSV vulnerability lookup timed out or was cancelled.');
+                }
+                throw error;
+            }
+            finally {
+                clearTimeout(timeout);
+                signal?.removeEventListener('abort', abortFromOuter);
+            }
+        }
+        return results;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/src/providers/osv/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../../src/providers/osv/client.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,SAAS;IAED;IADnB,YACmB,UAKb,EAAE;QALW,YAAO,GAAP,OAAO,CAKlB;IACL,CAAC;IAEJ,KAAK,CAAC,UAAU,CAAC,OAAmB,EAAE,MAAoB;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,mCAAmC,CAAC;QAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAClD,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,UAAU,CAAC,KAAK,CAAC;QACjF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAqB,EAAE,CAAC;QAErC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YAChE,MAAM,cAAc,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAElE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE;oBACnD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,QAAQ,EAAE;oBACvE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;oBACxC,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;gBACtF,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;gBAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBAC3F,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,CAAC,OAAO,CAAC,MAAM,gBAAgB,KAAK,CAAC,MAAM,WAAW,CAAC,CAAC;gBACjG,CAAC;gBAED,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;oBAC7B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChF,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/src/providers/osv/types.d.ts

@@ -0,0 +1,38 @@
+export type OsvQuery = {
+    package: {
+        ecosystem: 'npm';
+        name: string;
+    };
+    version: string;
+};
+export type OsvVulnerability = {
+    id: string;
+    aliases?: string[];
+    summary?: string;
+    published?: string;
+    modified?: string;
+    severity?: Array<{
+        type?: string;
+        score?: string;
+    }>;
+    references?: Array<{
+        type?: string;
+        url?: string;
+    }>;
+    affected?: Array<{
+        ranges?: Array<{
+            type?: string;
+            events?: Array<{
+                introduced?: string;
+                fixed?: string;
+                last_affected?: string;
+            }>;
+        }>;
+    }>;
+    database_specific?: Record<string, unknown>;
+};
+export type OsvBatchResponse = {
+    results: Array<{
+        vulns?: OsvVulnerability[];
+    }>;
+};

package/dist/src/providers/osv/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/providers/osv/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/providers/osv/types.ts"],"names":[],"mappings":""}

package/dist/src/storage/memory-cache.d.ts

@@ -0,0 +1,7 @@
+import type { AnalyzerCache } from '../contracts/analyzer.js';
+export declare class MemoryCache implements AnalyzerCache {
+    private readonly entries;
+    get<T>(key: string): Promise<T | undefined>;
+    set<T>(key: string, value: T, ttlMs?: number): Promise<void>;
+    clear(): void;
+}

package/dist/src/storage/memory-cache.js

@@ -0,0 +1,25 @@
+export class MemoryCache {
+    entries = new Map();
+    async get(key) {
+        const entry = this.entries.get(key);
+        if (!entry) {
+            return undefined;
+        }
+        if (entry.expiresAt !== undefined &&
+            entry.expiresAt <= Date.now()) {
+            this.entries.delete(key);
+            return undefined;
+        }
+        return entry.value;
+    }
+    async set(key, value, ttlMs) {
+        this.entries.set(key, {
+            value,
+            expiresAt: ttlMs === undefined ? undefined : Date.now() + ttlMs
+        });
+    }
+    clear() {
+        this.entries.clear();
+    }
+}
+//# sourceMappingURL=memory-cache.js.map

package/dist/src/storage/memory-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-cache.js","sourceRoot":"","sources":["../../../src/storage/memory-cache.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,WAAW;IACL,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEzD,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;YAC7B,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAC7B,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,CAAC,KAAU,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,GAAG,CACP,GAAW,EACX,KAAQ,EACR,KAAc;QAEd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;YACpB,KAAK;YACL,SAAS,EACP,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SACvD,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolip",
-  "version": "1.0.7",
+  "version": "2.0.0",
   "description": "A TypeScript-powered developer security companion CLI for supply chain security, dependency intelligence, secret detection, security auditing, encrypted local secrets management, Git security checks, and secure development education.",
   "type": "module",
   "bin": {
@@ -23,7 +23,8 @@
     "verify:package": "node scripts/verify-package.mjs",
     "verify": "npm run typecheck && npm test && npm run clean && npm run build && npm run verify:package",
     "prepack": "npm run verify",
-    "pack:check": "npm pack --dry-run"
+    "pack:check": "npm pack --dry-run",
+    "release:check": "bash scripts/release-check.sh"
   },
   "keywords": [
     "typescript",
@@ -56,6 +57,7 @@
   },
   "homepage": "https://github.com/wbizmo/toolip#readme",
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^5.4.1",
     "commander": "^13.1.0",
     "fast-glob": "^3.3.3",
@@ -63,13 +65,13 @@
     "ora": "^8.2.0",
     "pacote": "^21.0.4",
     "semver": "^7.7.3",
+    "typescript": "^5.8.2",
     "zod": "^3.24.2"
   },
   "devDependencies": {
     "@types/node": "^22.13.10",
     "@types/semver": "^7.7.1",
     "tsx": "^4.19.3",
-    "typescript": "^5.8.2",
     "vitest": "^3.2.6"
   }
 }