toolstile 0.4.1 → 0.5.0

package/README.md

@@ -7,13 +7,13 @@ npx toolstile audit
 ```
 
 It reads the configs of Claude Code, Claude Desktop, Cursor, Codex, VS Code,
-Windsurf, Gemini CLI and Cline and grades them for:
+Windsurf, Devin Desktop, Gemini CLI and Cline and grades them for:
 
 | Check | Severity |
 | --- | --- |
 | API keys, tokens and passwords written into config files, URLs or arguments | high |
 | Remote servers reached over plain `http://` | high |
-| Containers run with `--privileged` or the Docker socket | high |
+| Containers run with `--privileged`, the Docker socket or host networking (`--net=host`) | high |
 | The same credential pasted into several clients' configs | medium |
 | Config files holding secrets that other accounts can reach (file and folder permissions) | medium |
 | `npx`, `uvx` and `docker` servers that run whatever version is newest | medium |
@@ -73,7 +73,7 @@ you pick which to apply (space toggles, enter applies):
 | Rule that approves a whole server, or `enableAllProjectMcpServers` | Removes it. These start unselected, since the agent then asks before each tool. |
 
 Everything else (secrets in arguments or URLs, Claude Desktop and Cline, which
-cannot read variables, Windows, `http://` servers, Docker images, broad
+cannot read variables, Devin Desktop, Windows, `http://` servers, Docker images, broad
 filesystem roots and auto-approve lists) is listed with what to change by hand.
 
 Each edited file is checked before it is written: it must parse to exactly the
@@ -84,8 +84,8 @@ them once your agents work. After moving secrets, open a new terminal and restar
 your agents so they start with the variables, and rotate any secret that sat in a
 shared or synced file.
 
-`--dry-run` only shows the changes; `--yes` applies the ones that start selected
-without asking.
+`--dry-run` only shows the changes; `--yes` (or `-y`) applies the ones that start
+selected without asking.
 
 ## The audit only reads
 
@@ -99,7 +99,7 @@ without asking.
   for example `mcpServers.github.env.GITHUB_TOKEN`, and the kind of secret.
 - Never quotes a config file: one that cannot be read or parsed is listed with a
   reason and position only, for example `invalid TOML at line 3, column 12`.
-- About 3,500 lines of TypeScript with two runtime dependencies
+- Plain TypeScript with two runtime dependencies
   ([smol-toml](https://github.com/squirrelchat/smol-toml), for Codex's TOML
   config, and [jsonc-parser](https://github.com/microsoft/node-jsonc-parser), so
   `--fix` keeps comments and layout in JSON files) and an optional one ([resvg-js](https://github.com/thx/resvg-js), only
@@ -109,7 +109,7 @@ without asking.
 
 ```text
 --fix               Suggest fixes and apply the ones you select
---yes               With --fix: apply the fixes that start selected, without asking
+-y, --yes           With --fix: apply the fixes that start selected, without asking
 --dry-run           With --fix: only show the changes
 --json              Print results as JSON
 --card [file]       Write a shareable grade card (default toolstile-audit.png;
@@ -160,13 +160,15 @@ values) and prints a ready-to-post link. To post the text report instead, add
 | Codex | `$CODEX_HOME/config.toml` (default `~/.codex`) | `.codex/config.toml` |
 | VS Code | user `settings.json` and `mcp.json` | `.vscode/mcp.json` |
 | Windsurf | `~/.codeium/windsurf/mcp_config.json` | |
+| Devin Desktop | `~/.config/devin/mcp_config.json` (`%APPDATA%\devin` on Windows) | `.devin/mcp_config.json`, `.devin/mcp_config.local.json` |
 | Gemini CLI | `~/.gemini/settings.json` | `.gemini/settings.json` |
 | Cline | `cline_mcp_settings.json` in VS Code or Cursor storage | |
 
 ## Connect your agents to Toolstile
 
-If you use [Toolstile](https://www.toolstile.com), the CLI can also sign in and set
-up the agents on a machine for you:
+If you use the managed [Toolstile](https://www.toolstile.com) service, the CLI can
+also sign in and set up the agents on a machine for you (self-hosted instances
+use each agent app's own sign-in instead):
 
 ```sh
 npx toolstile auth login
@@ -181,7 +183,7 @@ reach the machine you are signing in, so it works over SSH, in containers and on
 servers without a browser.
 
 `mcp setup` lists the agents it finds (Claude Code, Claude Desktop, Cursor,
-Codex, VS Code, Windsurf, Gemini CLI, Cline) and lets you turn each one on or
+Codex, VS Code, Windsurf, Devin Desktop, Gemini CLI, Cline) and lets you turn each one on or
 off. Run it again any time to change the selection. Each enabled agent appears
 under this machine in the Toolstile dashboard with its own access, so you can
 grant, limit or revoke it there; then choose which MCP servers it can use.
@@ -205,6 +207,11 @@ readable by you alone; `%APPDATA%\toolstile` on Windows). No token is written
 into the agent's config, so `toolstile audit` has nothing to flag. JSON configs
 with comments are not rewritten; setup prints the entry to add yourself.
 
+The CLI keeps the credentials file, `--fix`'s `secrets.env` and its backups in one
+folder: `$TOOLSTILE_CONFIG_DIR` when set, otherwise `%APPDATA%\toolstile` on
+Windows and `$XDG_CONFIG_HOME/toolstile` (default `~/.config/toolstile`)
+elsewhere.
+
 `npx toolstile auth logout` ends the CLI's sign-in. Agents you enabled keep
 working until you turn them off with `mcp setup` or delete the device in the
 dashboard.
@@ -231,7 +238,9 @@ const { grade, findings } = audit();
 Built by [Akshit Kr Nagpal](https://akshit.io) as part of
 [Toolstile](https://www.toolstile.com), an MCP gateway that keeps upstream
 credentials off your machines and lets you choose which tools each agent can use.
-The audit works on its own and does not require a Toolstile account.
+Toolstile is available as a managed service and as an open-source self-hosted
+edition at [toolstile/toolstile](https://github.com/toolstile/toolstile). The audit
+works on its own and does not require a Toolstile account.
 
 Questions and reports: support@toolstile.com.
 

package/dist/agents.js

@@ -4,7 +4,7 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSyn
 import { dirname, join } from "node:path";
 import { parse as parseToml } from "smol-toml";
 import { parseJsonc } from "./parse.js";
-import { appData, CLIENT_NAMES } from "./sources.js";
+import { appData, CLIENT_NAMES, devinDir } from "./sources.js";
 /** The server name `toolstile mcp setup` adds to each agent's config. */
 export const ENTRY = "toolstile";
 export function targets(opts) {
@@ -21,6 +21,8 @@ export function targets(opts) {
         ["codex", join(codexHome, "config.toml"), "codex", codexHome],
         ["vscode", join(code, "mcp.json"), "vscode", code],
         ["windsurf", join(home, ".codeium", "windsurf", "mcp_config.json"), "mcpServers", join(home, ".codeium", "windsurf")],
+        // Devin Desktop, which replaced the Windsurf editor, reads its own user config.
+        ["devin", join(devinDir(opts), "mcp_config.json"), "mcpServers", devinDir(opts)],
         ["gemini", join(home, ".gemini", "settings.json"), "mcpServers", join(home, ".gemini")],
         ["cline", join(cline, "settings", "cline_mcp_settings.json"), "mcpServers", cline],
     ];

package/dist/cli.js

@@ -27,7 +27,7 @@ Usage
   npx toolstile audit [options]
 
 Checks Claude Code, Claude Desktop, Cursor, Codex, VS Code, Windsurf,
-Gemini CLI and Cline configs for plaintext secrets, credentials copied
+Devin Desktop, Gemini CLI and Cline configs for plaintext secrets, credentials copied
 between clients, unpinned packages, auto-approved tools, broad
 filesystem access and unencrypted remote servers.
 
@@ -47,7 +47,7 @@ safely are listed with what to do by hand.
 
 Options
   --fix               Suggest fixes and apply the ones you select
-  --yes               With --fix: apply the fixes that start selected, without asking
+  -y, --yes           With --fix: apply the fixes that start selected, without asking
   --dry-run           With --fix: only show the changes
   --json              Print results as JSON
   --card [file]       Write a shareable grade card (default toolstile-audit.png;
@@ -89,7 +89,7 @@ Options for setup
   --workspace <slug>    Workspace the agents use (default: the last one, or personal)
   --device-name <name>  Name for this machine (default: its hostname)
 
-Agents: claude-code, claude-desktop, cursor, codex, vscode, windsurf, gemini, cline
+Agents: claude-code, claude-desktop, cursor, codex, vscode, windsurf, devin, gemini, cline
 `;
 function version() {
     const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));

package/dist/commands.d.ts

@@ -25,6 +25,16 @@ export declare class UserError extends Error {
 export declare function normalizeServer(value: string): string;
 /** A gateway URL the server reported: HTTPS (or loopback HTTP) with no credentials, else undefined. */
 export declare function gatewayUrl(value: unknown): string | undefined;
+/**
+ * A sign-in page link the server sent, if it is safe to show and open: a URL on the server's
+ * own origin (so HTTPS, or HTTP for a loopback server) with no credentials, else undefined.
+ */
+export declare function signInUrl(value: unknown, server: string): URL | undefined;
+/**
+ * The program and arguments that open `url` in the default browser. Never a shell string:
+ * Windows uses rundll32 rather than `cmd /c start`, where `&` in a URL would end the command.
+ */
+export declare function browserCommand(platform: NodeJS.Platform, url: string): [string, string[]];
 export declare function login(ctx: Context, options: {
     server?: string;
     browser: boolean;

package/dist/commands.js

@@ -24,6 +24,9 @@ async function compensate(error, cleanup, remedy) {
     }
     throw error;
 }
+const LOOPBACK = /^(localhost|127\.\d+\.\d+\.\d+|\[::1\])$/;
+/** HTTPS, or HTTP to a loopback host for local development. */
+const secureScheme = (url) => url.protocol === "https:" || (url.protocol === "http:" && LOOPBACK.test(url.hostname));
 /** HTTPS, except a loopback server for local development. */
 export function normalizeServer(value) {
     let url;
@@ -33,8 +36,7 @@ export function normalizeServer(value) {
     catch {
         throw new UserError(`--server must be a URL, for example https://app.toolstile.com`);
     }
-    const loopback = /^(localhost|127\.\d+\.\d+\.\d+|\[::1\])$/.test(url.hostname);
-    if (url.protocol !== "https:" && !(loopback && url.protocol === "http:"))
+    if (!secureScheme(url))
         throw new UserError("--server must use https://");
     return url.origin;
 }
@@ -49,13 +51,41 @@ export function gatewayUrl(value) {
     catch {
         return undefined;
     }
-    const loopback = /^(localhost|127\.\d+\.\d+\.\d+|\[::1\])$/.test(url.hostname);
     if (url.username || url.password || url.search || url.hash)
         return undefined;
-    if (url.protocol !== "https:" && !(loopback && url.protocol === "http:"))
+    if (!secureScheme(url))
         return undefined;
     return url.href;
 }
+/**
+ * A sign-in page link the server sent, if it is safe to show and open: a URL on the server's
+ * own origin (so HTTPS, or HTTP for a loopback server) with no credentials, else undefined.
+ */
+export function signInUrl(value, server) {
+    if (typeof value !== "string")
+        return undefined;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return undefined;
+    }
+    if (!secureScheme(url) || url.username || url.password || url.origin !== server)
+        return undefined;
+    return url;
+}
+/**
+ * The program and arguments that open `url` in the default browser. Never a shell string:
+ * Windows uses rundll32 rather than `cmd /c start`, where `&` in a URL would end the command.
+ */
+export function browserCommand(platform, url) {
+    if (platform === "darwin")
+        return ["open", [url]];
+    if (platform === "win32")
+        return ["rundll32", ["url.dll,FileProtocolHandler", url]];
+    return ["xdg-open", [url]];
+}
 function defaultOpenBrowser(ctx) {
     return (url) => {
         // Over SSH or without a display the URL and code are enough; nothing to open.
@@ -63,9 +93,9 @@ function defaultOpenBrowser(ctx) {
             return;
         if (ctx.platform === "linux" && !ctx.env.DISPLAY && !ctx.env.WAYLAND_DISPLAY)
             return;
-        const [command, args] = ctx.platform === "darwin" ? ["open", [url]] : ctx.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+        const [command, args] = browserCommand(ctx.platform, url);
         try {
-            spawn(command, args, { stdio: "ignore", detached: true }).on("error", () => { }).unref();
+            spawn(command, args, { stdio: "ignore", detached: true, shell: false }).on("error", () => { }).unref();
         }
         catch { }
     };
@@ -81,15 +111,29 @@ export async function login(ctx, options) {
     const code = await api.deviceCode();
     // The page fills in the code and this machine's name; the name can be edited there and
     // becomes the device this machine's agents are listed under.
-    const link = new URL(code.verification_uri_complete);
-    link.searchParams.set("device_name", machineName(ctx));
-    print(ctx, `Open this link on any device with a browser and approve the sign-in:`);
-    print(ctx);
-    print(ctx, `  ${s.bold(link.href)}`);
-    print(ctx);
-    print(ctx, `Check that the page shows this code: ${s.bold(formatCode(code.user_code))}`);
+    const link = signInUrl(code.verification_uri_complete, server);
+    if (link) {
+        link.searchParams.set("device_name", machineName(ctx));
+        print(ctx, `Open this link on any device with a browser and approve the sign-in:`);
+        print(ctx);
+        print(ctx, `  ${s.bold(link.href)}`);
+        print(ctx);
+        print(ctx, `Check that the page shows this code: ${s.bold(formatCode(code.user_code))}`);
+    }
+    else {
+        // Never show or open a link that points anywhere but the server being signed in to.
+        const page = signInUrl(code.verification_uri, server);
+        if (!page)
+            throw new UserError(`${server} sent a sign-in link for a different address. Check --server and TOOLSTILE_URL.`);
+        ctx.stderr.write(`The sign-in link from ${server} was not valid, so no browser was opened.\n`);
+        print(ctx, `Open this page on any device with a browser, enter the code and approve the sign-in:`);
+        print(ctx);
+        print(ctx, `  ${s.bold(page.href)}`);
+        print(ctx);
+        print(ctx, `Code: ${s.bold(formatCode(code.user_code))}`);
+    }
     print(ctx, s.dim(`Waiting for approval. The code expires in ${Math.round(code.expires_in / 60)} minutes.`));
-    if (options.browser)
+    if (link && options.browser)
         (ctx.openBrowser ?? defaultOpenBrowser(ctx))(link.href);
     const sleep = ctx.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     let interval = Math.max(code.interval, 1) * 1000;

package/dist/fix.js

@@ -156,7 +156,9 @@ function moveSecret(sec, names) {
     }
     const ref = REFERENCE[s.client];
     if (!ref)
-        return `${CLIENT_NAMES[s.client]} does not read environment variables in its config`;
+        return s.client === "devin"
+            ? "--fix does not move Devin Desktop secrets yet; replace the value with an ${env:NAME} reference by hand"
+            : `${CLIENT_NAMES[s.client]} does not read environment variables in its config`;
     if (where === "env" && key) {
         const name = names.pick([key, `${server}_${key}`], sec.value);
         if (!name)

package/dist/report.js

@@ -120,7 +120,7 @@ export function renderReport(r, home, s, redacted = false, columns = 80) {
     const lines = [];
     lines.push("", `${s.bold("toolstile audit")} ${s.dim("· local MCP config check · nothing leaves this machine")}`, "");
     if (r.files.length === 0 && r.unreadable.length === 0) {
-        lines.push("No MCP client configs found.", s.dim("Looked for Claude Code, Claude Desktop, Cursor, Codex, VS Code, Windsurf, Gemini CLI and Cline."), "");
+        lines.push("No MCP client configs found.", s.dim("Looked for Claude Code, Claude Desktop, Cursor, Codex, VS Code, Windsurf, Devin Desktop, Gemini CLI and Cline."), "");
         return lines.join("\n");
     }
     if (r.grade !== null) {

package/dist/sources.d.ts

@@ -7,6 +7,8 @@ export interface ScanOptions {
     env: Record<string, string | undefined>;
 }
 export declare const CLIENT_NAMES: Record<ClientId, string>;
+/** Devin Desktop's user config folder: `%APPDATA%\\devin` on Windows, `~/.config/devin` elsewhere. */
+export declare function devinDir({ home, platform, env }: Omit<ScanOptions, "cwd">): string;
 export declare function appData({ home, platform, env }: Omit<ScanOptions, "cwd">): string;
 /** Appends a key to a pointer, quoting keys that are not plain identifiers. */
 export declare function pointerJoin(base: string, key: string): string;

package/dist/sources.js

@@ -8,9 +8,16 @@ export const CLIENT_NAMES = {
     codex: "Codex",
     vscode: "VS Code",
     windsurf: "Windsurf",
+    devin: "Devin Desktop",
     gemini: "Gemini CLI",
     cline: "Cline",
 };
+/** Devin Desktop's user config folder: `%APPDATA%\\devin` on Windows, `~/.config/devin` elsewhere. */
+export function devinDir({ home, platform, env }) {
+    if (platform === "win32")
+        return join(env.APPDATA ?? join(home, "AppData", "Roaming"), "devin");
+    return join(home, ".config", "devin");
+}
 export function appData({ home, platform, env }) {
     if (platform === "darwin")
         return join(home, "Library", "Application Support");
@@ -30,6 +37,7 @@ function candidates(opts) {
         { client: "cursor", path: join(home, ".cursor", "mcp.json"), kind: "mcp" },
         { client: "codex", path: join(codexHome, "config.toml"), kind: "codex" },
         { client: "windsurf", path: join(home, ".codeium", "windsurf", "mcp_config.json"), kind: "mcp" },
+        { client: "devin", path: join(devinDir(opts), "mcp_config.json"), kind: "mcp" },
         { client: "gemini", path: join(home, ".gemini", "settings.json"), kind: "mcp" },
     ];
     for (const edition of ["Code", "Code - Insiders"]) {
@@ -38,7 +46,7 @@ function candidates(opts) {
     list.push({ client: "cline", path: join(data, "Cursor", "User", ...clineSettings), kind: "mcp" });
     if (cwd) {
         const dir = resolve(cwd);
-        list.push({ client: "claude-code", path: join(dir, ".mcp.json"), kind: "mcp" }, { client: "claude-code", path: join(dir, ".claude", "settings.json"), kind: "claude-settings" }, { client: "claude-code", path: join(dir, ".claude", "settings.local.json"), kind: "claude-settings" }, { client: "cursor", path: join(dir, ".cursor", "mcp.json"), kind: "mcp" }, { client: "vscode", path: join(dir, ".vscode", "mcp.json"), kind: "vscode-mcp" }, { client: "gemini", path: join(dir, ".gemini", "settings.json"), kind: "mcp" }, { client: "codex", path: join(dir, ".codex", "config.toml"), kind: "codex" });
+        list.push({ client: "claude-code", path: join(dir, ".mcp.json"), kind: "mcp" }, { client: "claude-code", path: join(dir, ".claude", "settings.json"), kind: "claude-settings" }, { client: "claude-code", path: join(dir, ".claude", "settings.local.json"), kind: "claude-settings" }, { client: "cursor", path: join(dir, ".cursor", "mcp.json"), kind: "mcp" }, { client: "vscode", path: join(dir, ".vscode", "mcp.json"), kind: "vscode-mcp" }, { client: "gemini", path: join(dir, ".gemini", "settings.json"), kind: "mcp" }, { client: "codex", path: join(dir, ".codex", "config.toml"), kind: "codex" }, { client: "devin", path: join(dir, ".devin", "mcp_config.json"), kind: "mcp" }, { client: "devin", path: join(dir, ".devin", "mcp_config.local.json"), kind: "mcp" });
     }
     const seen = new Set();
     return list.filter((c) => (seen.has(c.path) ? false : (seen.add(c.path), true)));

package/dist/state.d.ts

@@ -43,6 +43,10 @@ export interface StateEnv {
 /** `TOOLSTILE_CONFIG_DIR`, else the platform's per-user config folder. */
 export declare function stateDir({ home, env, platform }?: StateEnv): string;
 export declare const statePath: (opts?: StateEnv) => string;
+/**
+ * The saved server always wins over `TOOLSTILE_URL`, which only picks the server for a new
+ * `auth login`: an environment variable set by a project must not redirect saved tokens.
+ */
 export declare function loadState(opts?: StateEnv): State;
 /** Hold the credential revision stable during a synchronous config mutation. */
 export declare function withCurrentState<T>(state: State, opts: StateEnv | undefined, run: () => T): T;

package/dist/state.js

@@ -17,11 +17,11 @@ export function stateDir({ home = homedir(), env = process.env, platform = proce
     return join(env.XDG_CONFIG_HOME ?? join(home, ".config"), "toolstile");
 }
 export const statePath = (opts) => join(stateDir(opts), "credentials.json");
+const revisions = new WeakMap();
 /**
  * The saved server always wins over `TOOLSTILE_URL`, which only picks the server for a new
  * `auth login`: an environment variable set by a project must not redirect saved tokens.
  */
-const revisions = new WeakMap();
 export function loadState(opts) {
     const fallback = { server: DEFAULT_SERVER, agents: {} };
     let text;

package/dist/types.d.ts

@@ -1,6 +1,6 @@
 /** `info` findings are context only and do not affect the score. */
 export type Severity = "high" | "medium" | "low" | "info";
-export type ClientId = "claude-code" | "claude-desktop" | "cursor" | "codex" | "vscode" | "windsurf" | "gemini" | "cline";
+export type ClientId = "claude-code" | "claude-desktop" | "cursor" | "codex" | "vscode" | "windsurf" | "devin" | "gemini" | "cline";
 export interface Location {
     /** Absolute path of the config file. */
     file: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolstile",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Audit the MCP server configs your AI agents use for plaintext secrets, unpinned packages, auto-approved tools and duplicated setups, and connect those agents to Toolstile without putting tokens in their configs.",
   "keywords": [
     "mcp",