toolstile 0.4.2 → 0.5.1

package/README.md

@@ -7,7 +7,7 @@ npx toolstile audit
 ```
 
 It reads the configs of Claude Code, Claude Desktop, Cursor, Codex, VS Code,
-Windsurf, Gemini CLI and Cline and grades them for:
+Windsurf, Devin Desktop, Gemini CLI and Cline and grades them for:
 
 | Check | Severity |
 | --- | --- |
@@ -73,7 +73,7 @@ you pick which to apply (space toggles, enter applies):
 | Rule that approves a whole server, or `enableAllProjectMcpServers` | Removes it. These start unselected, since the agent then asks before each tool. |
 
 Everything else (secrets in arguments or URLs, Claude Desktop and Cline, which
-cannot read variables, Windows, `http://` servers, Docker images, broad
+cannot read variables, Devin Desktop, Windows, `http://` servers, Docker images, broad
 filesystem roots and auto-approve lists) is listed with what to change by hand.
 
 Each edited file is checked before it is written: it must parse to exactly the
@@ -160,6 +160,7 @@ values) and prints a ready-to-post link. To post the text report instead, add
 | Codex | `$CODEX_HOME/config.toml` (default `~/.codex`) | `.codex/config.toml` |
 | VS Code | user `settings.json` and `mcp.json` | `.vscode/mcp.json` |
 | Windsurf | `~/.codeium/windsurf/mcp_config.json` | |
+| Devin Desktop | `~/.config/devin/mcp_config.json` (`%APPDATA%\devin` on Windows) | `.devin/mcp_config.json`, `.devin/mcp_config.local.json` |
 | Gemini CLI | `~/.gemini/settings.json` | `.gemini/settings.json` |
 | Cline | `cline_mcp_settings.json` in VS Code or Cursor storage | |
 
@@ -182,7 +183,7 @@ reach the machine you are signing in, so it works over SSH, in containers and on
 servers without a browser.
 
 `mcp setup` lists the agents it finds (Claude Code, Claude Desktop, Cursor,
-Codex, VS Code, Windsurf, Gemini CLI, Cline) and lets you turn each one on or
+Codex, VS Code, Windsurf, Devin Desktop, Gemini CLI, Cline) and lets you turn each one on or
 off. Run it again any time to change the selection. Each enabled agent appears
 under this machine in the Toolstile dashboard with its own access, so you can
 grant, limit or revoke it there; then choose which MCP servers it can use.
@@ -243,6 +244,21 @@ works on its own and does not require a Toolstile account.
 
 Questions and reports: support@toolstile.com.
 
+## Development
+
+Development uses [Vite+](https://viteplus.dev). Its `vp env` shims pick Node.js
+from `.node-version` and pnpm from `packageManager`, so install Vite+, then run:
+
+```sh
+pnpm install
+pnpm typecheck
+pnpm test    # builds dist, then runs the tests with vp test
+pnpm build
+```
+
+Development needs Node.js 22.18+, 24.11+ or 26+. The published CLI still runs on
+Node.js 18 and later.
+
 ## Releases
 
 The npm package is published by [GitHub Actions](.github/workflows/publish.yml)

package/dist/agents.js

@@ -4,7 +4,7 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSyn
 import { dirname, join } from "node:path";
 import { parse as parseToml } from "smol-toml";
 import { parseJsonc } from "./parse.js";
-import { appData, CLIENT_NAMES } from "./sources.js";
+import { appData, CLIENT_NAMES, devinDir } from "./sources.js";
 /** The server name `toolstile mcp setup` adds to each agent's config. */
 export const ENTRY = "toolstile";
 export function targets(opts) {
@@ -21,6 +21,8 @@ export function targets(opts) {
         ["codex", join(codexHome, "config.toml"), "codex", codexHome],
         ["vscode", join(code, "mcp.json"), "vscode", code],
         ["windsurf", join(home, ".codeium", "windsurf", "mcp_config.json"), "mcpServers", join(home, ".codeium", "windsurf")],
+        // Devin Desktop, which replaced the Windsurf editor, reads its own user config.
+        ["devin", join(devinDir(opts), "mcp_config.json"), "mcpServers", devinDir(opts)],
         ["gemini", join(home, ".gemini", "settings.json"), "mcpServers", join(home, ".gemini")],
         ["cline", join(cline, "settings", "cline_mcp_settings.json"), "mcpServers", cline],
     ];

package/dist/cli.js

@@ -27,7 +27,7 @@ Usage
   npx toolstile audit [options]
 
 Checks Claude Code, Claude Desktop, Cursor, Codex, VS Code, Windsurf,
-Gemini CLI and Cline configs for plaintext secrets, credentials copied
+Devin Desktop, Gemini CLI and Cline configs for plaintext secrets, credentials copied
 between clients, unpinned packages, auto-approved tools, broad
 filesystem access and unencrypted remote servers.
 
@@ -89,7 +89,7 @@ Options for setup
   --workspace <slug>    Workspace the agents use (default: the last one, or personal)
   --device-name <name>  Name for this machine (default: its hostname)
 
-Agents: claude-code, claude-desktop, cursor, codex, vscode, windsurf, gemini, cline
+Agents: claude-code, claude-desktop, cursor, codex, vscode, windsurf, devin, gemini, cline
 `;
 function version() {
     const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));

package/dist/fix.js

@@ -156,7 +156,9 @@ function moveSecret(sec, names) {
     }
     const ref = REFERENCE[s.client];
     if (!ref)
-        return `${CLIENT_NAMES[s.client]} does not read environment variables in its config`;
+        return s.client === "devin"
+            ? "--fix does not move Devin Desktop secrets yet; replace the value with an ${env:NAME} reference by hand"
+            : `${CLIENT_NAMES[s.client]} does not read environment variables in its config`;
     if (where === "env" && key) {
         const name = names.pick([key, `${server}_${key}`], sec.value);
         if (!name)

package/dist/report.js

@@ -120,7 +120,7 @@ export function renderReport(r, home, s, redacted = false, columns = 80) {
     const lines = [];
     lines.push("", `${s.bold("toolstile audit")} ${s.dim("· local MCP config check · nothing leaves this machine")}`, "");
     if (r.files.length === 0 && r.unreadable.length === 0) {
-        lines.push("No MCP client configs found.", s.dim("Looked for Claude Code, Claude Desktop, Cursor, Codex, VS Code, Windsurf, Gemini CLI and Cline."), "");
+        lines.push("No MCP client configs found.", s.dim("Looked for Claude Code, Claude Desktop, Cursor, Codex, VS Code, Windsurf, Devin Desktop, Gemini CLI and Cline."), "");
         return lines.join("\n");
     }
     if (r.grade !== null) {

package/dist/sources.d.ts

@@ -7,6 +7,8 @@ export interface ScanOptions {
     env: Record<string, string | undefined>;
 }
 export declare const CLIENT_NAMES: Record<ClientId, string>;
+/** Devin Desktop's user config folder: `%APPDATA%\\devin` on Windows, `~/.config/devin` elsewhere. */
+export declare function devinDir({ home, platform, env }: Omit<ScanOptions, "cwd">): string;
 export declare function appData({ home, platform, env }: Omit<ScanOptions, "cwd">): string;
 /** Appends a key to a pointer, quoting keys that are not plain identifiers. */
 export declare function pointerJoin(base: string, key: string): string;

package/dist/sources.js

@@ -8,9 +8,16 @@ export const CLIENT_NAMES = {
     codex: "Codex",
     vscode: "VS Code",
     windsurf: "Windsurf",
+    devin: "Devin Desktop",
     gemini: "Gemini CLI",
     cline: "Cline",
 };
+/** Devin Desktop's user config folder: `%APPDATA%\\devin` on Windows, `~/.config/devin` elsewhere. */
+export function devinDir({ home, platform, env }) {
+    if (platform === "win32")
+        return join(env.APPDATA ?? join(home, "AppData", "Roaming"), "devin");
+    return join(home, ".config", "devin");
+}
 export function appData({ home, platform, env }) {
     if (platform === "darwin")
         return join(home, "Library", "Application Support");
@@ -30,6 +37,7 @@ function candidates(opts) {
         { client: "cursor", path: join(home, ".cursor", "mcp.json"), kind: "mcp" },
         { client: "codex", path: join(codexHome, "config.toml"), kind: "codex" },
         { client: "windsurf", path: join(home, ".codeium", "windsurf", "mcp_config.json"), kind: "mcp" },
+        { client: "devin", path: join(devinDir(opts), "mcp_config.json"), kind: "mcp" },
         { client: "gemini", path: join(home, ".gemini", "settings.json"), kind: "mcp" },
     ];
     for (const edition of ["Code", "Code - Insiders"]) {
@@ -38,7 +46,7 @@ function candidates(opts) {
     list.push({ client: "cline", path: join(data, "Cursor", "User", ...clineSettings), kind: "mcp" });
     if (cwd) {
         const dir = resolve(cwd);
-        list.push({ client: "claude-code", path: join(dir, ".mcp.json"), kind: "mcp" }, { client: "claude-code", path: join(dir, ".claude", "settings.json"), kind: "claude-settings" }, { client: "claude-code", path: join(dir, ".claude", "settings.local.json"), kind: "claude-settings" }, { client: "cursor", path: join(dir, ".cursor", "mcp.json"), kind: "mcp" }, { client: "vscode", path: join(dir, ".vscode", "mcp.json"), kind: "vscode-mcp" }, { client: "gemini", path: join(dir, ".gemini", "settings.json"), kind: "mcp" }, { client: "codex", path: join(dir, ".codex", "config.toml"), kind: "codex" });
+        list.push({ client: "claude-code", path: join(dir, ".mcp.json"), kind: "mcp" }, { client: "claude-code", path: join(dir, ".claude", "settings.json"), kind: "claude-settings" }, { client: "claude-code", path: join(dir, ".claude", "settings.local.json"), kind: "claude-settings" }, { client: "cursor", path: join(dir, ".cursor", "mcp.json"), kind: "mcp" }, { client: "vscode", path: join(dir, ".vscode", "mcp.json"), kind: "vscode-mcp" }, { client: "gemini", path: join(dir, ".gemini", "settings.json"), kind: "mcp" }, { client: "codex", path: join(dir, ".codex", "config.toml"), kind: "codex" }, { client: "devin", path: join(dir, ".devin", "mcp_config.json"), kind: "mcp" }, { client: "devin", path: join(dir, ".devin", "mcp_config.local.json"), kind: "mcp" });
     }
     const seen = new Set();
     return list.filter((c) => (seen.has(c.path) ? false : (seen.add(c.path), true)));

package/dist/types.d.ts

@@ -1,6 +1,6 @@
 /** `info` findings are context only and do not affect the score. */
 export type Severity = "high" | "medium" | "low" | "info";
-export type ClientId = "claude-code" | "claude-desktop" | "cursor" | "codex" | "vscode" | "windsurf" | "gemini" | "cline";
+export type ClientId = "claude-code" | "claude-desktop" | "cursor" | "codex" | "vscode" | "windsurf" | "devin" | "gemini" | "cline";
 export interface Location {
     /** Absolute path of the config file. */
     file: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolstile",
-  "version": "0.4.2",
+  "version": "0.5.1",
   "description": "Audit the MCP server configs your AI agents use for plaintext secrets, unpinned packages, auto-approved tools and duplicated setups, and connect those agents to Toolstile without putting tokens in their configs.",
   "keywords": [
     "mcp",
@@ -39,7 +39,7 @@
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json && chmod +x dist/cli.js",
     "typecheck": "tsc --noEmit",
-    "test": "pnpm build && vitest run",
+    "test": "pnpm build && vp test run",
     "prepublishOnly": "pnpm typecheck && pnpm test"
   },
   "dependencies": {
@@ -49,7 +49,7 @@
   "devDependencies": {
     "@types/node": "^22.19.0",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.0"
+    "vite-plus": "1.5.1"
   },
   "packageManager": "pnpm@11.20.0",
   "optionalDependencies": {