claude-mpm 5.4.41__py3-none-any.whl → 5.6.72__py3-none-any.whl

claude_mpm/init.py

@@ -147,9 +147,14 @@ class ProjectInitializer:
 
             # Print appropriate message to console for visibility during startup
             # BUT: Don't print to stdout when running MCP server (interferes with JSON-RPC)
+            # ALSO: Skip output for lightweight commands (oauth, version, help, doctor)
             is_mcp_mode = "mcp" in sys.argv and "start" in sys.argv
+            is_lightweight_command = any(
+                cmd in sys.argv
+                for cmd in ["oauth", "--version", "-v", "--help", "-h", "doctor"]
+            )
 
-            if not is_mcp_mode:
+            if not is_mcp_mode and not is_lightweight_command:
                 if directory_existed:
                     print(f"✓ Found existing .claude-mpm/ directory in {project_root}")
                 else:
@@ -164,7 +169,15 @@ class ProjectInitializer:
                     )
 
             # Verify and deploy PM skills (non-blocking)
-            self._verify_and_deploy_pm_skills(project_root, is_mcp_mode)
+            # Skip for lightweight commands that should run immediately
+            suppress_output = is_mcp_mode or is_lightweight_command
+            self._verify_and_deploy_pm_skills(project_root, suppress_output)
+
+            # Setup security hooks (auto-install pre-commit, detect-secrets)
+            self._setup_security_hooks(project_root, suppress_output)
+
+            # Perform security checks (non-blocking)
+            self._check_security_risks(project_root, suppress_output)
 
             return True
 
@@ -210,14 +223,16 @@ class ProjectInitializer:
                         if deploy_result.deployed:
                             print(
                                 f"✓ Deployed {len(deploy_result.deployed)} PM skill(s) "
-                                f"to .claude-mpm/skills/pm/"
+                                f"to .claude/skills/"
                             )
                 else:
                     self.logger.warning(
                         f"PM skills deployment had errors: {len(deploy_result.errors)}"
                     )
                     if not is_mcp_mode and deploy_result.errors:
-                        print(f"⚠ PM skills deployment had {len(deploy_result.errors)} error(s)")
+                        print(
+                            f"⚠ PM skills deployment had {len(deploy_result.errors)} error(s)"
+                        )
             else:
                 # Skills verified successfully
                 registry = deployer._load_registry(project_root)
@@ -382,6 +397,211 @@ class ProjectInitializer:
                 if not dst_file.exists():
                     shutil.copy2(template_file, dst_file)
 
+    def _setup_security_hooks(
+        self, project_root: Path, is_mcp_mode: bool = False
+    ) -> None:
+        """Automatically install pre-commit hooks for secret scanning.
+
+        This method:
+        1. Installs pre-commit and detect-secrets if missing
+        2. Copies .pre-commit-config.yaml to project root
+        3. Runs pre-commit install to set up git hooks
+        4. Creates .secrets.baseline for detect-secrets
+
+        Args:
+            project_root: Project root directory
+            is_mcp_mode: Whether running in MCP mode (suppress console output)
+        """
+        try:
+            import subprocess  # nosec B404 - required for git/pre-commit operations
+
+            # Only set up hooks if this is a git repository
+            if not (project_root / ".git").exists():
+                self.logger.debug("Not a git repository, skipping security hooks setup")
+                return
+
+            # Check/install pre-commit
+            try:
+                subprocess.run(  # nosec B603 B607 - trusted pre-commit command
+                    ["pre-commit", "--version"],
+                    capture_output=True,
+                    text=True,
+                    timeout=2,
+                    check=True,
+                )
+            except (
+                subprocess.CalledProcessError,
+                subprocess.TimeoutExpired,
+                FileNotFoundError,
+            ):
+                self.logger.info("Installing pre-commit...")
+                try:
+                    subprocess.run(  # nosec B603 B607 - trusted pip install command
+                        [sys.executable, "-m", "pip", "install", "pre-commit"],
+                        capture_output=True,
+                        text=True,
+                        timeout=60,
+                        check=True,
+                    )
+                    self.logger.info("pre-commit installed successfully")
+                except subprocess.CalledProcessError as e:
+                    self.logger.warning(f"Failed to install pre-commit: {e}")
+                    return
+
+            # Check/install detect-secrets
+            try:
+                subprocess.run(  # nosec B603 B607 - trusted detect-secrets command
+                    ["detect-secrets", "--version"],
+                    capture_output=True,
+                    text=True,
+                    timeout=2,
+                    check=True,
+                )
+            except (
+                subprocess.CalledProcessError,
+                subprocess.TimeoutExpired,
+                FileNotFoundError,
+            ):
+                self.logger.info("Installing detect-secrets...")
+                try:
+                    subprocess.run(  # nosec B603 B607 - trusted pip install command
+                        [sys.executable, "-m", "pip", "install", "detect-secrets"],
+                        capture_output=True,
+                        text=True,
+                        timeout=60,
+                        check=True,
+                    )
+                    self.logger.info("detect-secrets installed successfully")
+                except subprocess.CalledProcessError as e:
+                    self.logger.warning(f"Failed to install detect-secrets: {e}")
+                    return
+
+            # Copy .pre-commit-config.yaml to project root if it doesn't exist
+            precommit_config = project_root / ".pre-commit-config.yaml"
+            if not precommit_config.exists():
+                template_dir = Path(__file__).parent / "templates"
+                template_config = template_dir / ".pre-commit-config.yaml"
+
+                if template_config.exists():
+                    shutil.copy2(template_config, precommit_config)
+                    self.logger.info("Copied .pre-commit-config.yaml to project root")
+                else:
+                    self.logger.warning("Template .pre-commit-config.yaml not found")
+                    return
+
+            # Create .secrets.baseline if it doesn't exist
+            secrets_baseline = project_root / ".secrets.baseline"
+            if not secrets_baseline.exists():
+                try:
+                    subprocess.run(  # nosec B603 B607 - trusted detect-secrets command
+                        ["detect-secrets", "scan", "--baseline", ".secrets.baseline"],
+                        cwd=str(project_root),
+                        capture_output=True,
+                        text=True,
+                        timeout=30,
+                        check=True,
+                    )
+                    self.logger.info("Created .secrets.baseline")
+                except subprocess.CalledProcessError as e:
+                    self.logger.warning(f"Failed to create .secrets.baseline: {e}")
+
+            # Install git hooks
+            try:
+                subprocess.run(  # nosec B603 B607 - trusted pre-commit command
+                    ["pre-commit", "install"],
+                    cwd=str(project_root),
+                    capture_output=True,
+                    text=True,
+                    timeout=30,
+                    check=True,
+                )
+                self.logger.info("Pre-commit hooks installed in git repository")
+
+                if not is_mcp_mode:
+                    print("✓ Security hooks installed (pre-commit + detect-secrets)")
+
+            except subprocess.CalledProcessError as e:
+                self.logger.warning(f"Failed to install pre-commit hooks: {e}")
+
+        except Exception as e:
+            self.logger.debug(f"Security hooks setup failed: {e}")
+            # Don't print to console - this is a non-critical failure
+
+    def _check_security_risks(
+        self, project_root: Path, is_mcp_mode: bool = False
+    ) -> None:
+        """Check for potential security risks like exposed config files.
+
+        Non-blocking operation that warns about security issues.
+
+        Args:
+            project_root: Project root directory
+            is_mcp_mode: Whether running in MCP mode (suppress console output)
+        """
+        try:
+            import subprocess  # nosec B404 - required for git operations
+
+            security_issues = []
+
+            # Common secret file patterns to check
+            secret_patterns = [
+                ".mcp-vector-search/config.json",
+                ".mcp/config.json",
+                "openrouter.json",
+                "anthropic-config.json",
+                "credentials.json",
+                "secrets.json",
+                "api-keys.json",
+            ]
+
+            for pattern in secret_patterns:
+                file_path = project_root / pattern
+                if file_path.exists():
+                    # Check if file is tracked by git
+                    try:
+                        result = subprocess.run(  # nosec B603 B607 - trusted git command
+                            ["git", "ls-files", str(file_path)],
+                            check=False,
+                            cwd=str(project_root),
+                            capture_output=True,
+                            text=True,
+                            timeout=2,
+                        )
+                        if result.stdout.strip():
+                            security_issues.append(
+                                f"⚠️  SECURITY: {pattern} is tracked by git (may contain secrets)"
+                            )
+                    except (subprocess.TimeoutExpired, FileNotFoundError):
+                        pass
+
+                    # Check if file is ignored by .gitignore
+                    try:
+                        result = subprocess.run(  # nosec B603 B607 - trusted git command
+                            ["git", "check-ignore", str(file_path)],
+                            check=False,
+                            cwd=str(project_root),
+                            capture_output=True,
+                            text=True,
+                            timeout=2,
+                        )
+                        if result.returncode != 0:  # File NOT ignored
+                            security_issues.append(
+                                f"⚠️  WARNING: {pattern} exists but not in .gitignore"
+                            )
+                    except (subprocess.TimeoutExpired, FileNotFoundError):
+                        pass
+
+            # Print security warnings if not in MCP mode
+            if security_issues and not is_mcp_mode:
+                print("\n🔒 Security Check:")
+                for issue in security_issues:
+                    print(f"   {issue}")
+                print()
+
+        except Exception as e:
+            self.logger.debug(f"Security check failed: {e}")
+            # Don't print to console - this is a non-critical failure
+
     def validate_dependencies(self) -> Dict[str, bool]:
         """Validate that all required dependencies are available."""
         dependencies = {}

claude_mpm/mcp/__init__.py

@@ -0,0 +1,9 @@
+"""MCP servers for claude-mpm integration.
+
+This module provides MCP (Model Context Protocol) servers that integrate
+with claude-mpm's authentication and token management system.
+"""
+
+from claude_mpm.mcp.google_workspace_server import main
+
+__all__ = ["main"]