mcpgawk 0.1.44__tar.gz → 0.1.45__tar.gz

{mcpgawk-0.1.44 → mcpgawk-0.1.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpgawk
-Version: 0.1.44
+Version: 0.1.45
 Summary: One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine.
 Project-URL: Homepage, https://mcp.gawk.dev
 Project-URL: Documentation, https://mcp.gawk.dev
@@ -113,8 +113,8 @@ request, used or not.
 
 **CLI** (any terminal):
 ```bash
-pip install --upgrade mcpgawk        # or: uv tool install --force mcpgawk
-mcpgawk scan mcp.json
+uv tool install --force mcpgawk      # or: pipx install --force mcpgawk
+mcpgawk                              # finds every agent config on the machine itself
 ```
 
 **Editor** (VS Code / Cursor): install **mcpgawk** from the marketplace ([Open VSX](https://open-vsx.org/extension/gawk-dev/mcpgawk)). It scans your workspace `mcp.json` and shows cost + capability flags inline. The extension drives this engine as a subprocess — it is built and released separately, so its source is not in this repository.

{mcpgawk-0.1.44 → mcpgawk-0.1.45}/README.md

@@ -78,8 +78,8 @@ request, used or not.
 
 **CLI** (any terminal):
 ```bash
-pip install --upgrade mcpgawk        # or: uv tool install --force mcpgawk
-mcpgawk scan mcp.json
+uv tool install --force mcpgawk      # or: pipx install --force mcpgawk
+mcpgawk                              # finds every agent config on the machine itself
 ```
 
 **Editor** (VS Code / Cursor): install **mcpgawk** from the marketplace ([Open VSX](https://open-vsx.org/extension/gawk-dev/mcpgawk)). It scans your workspace `mcp.json` and shows cost + capability flags inline. The extension drives this engine as a subprocess — it is built and released separately, so its source is not in this repository.

{mcpgawk-0.1.44 → mcpgawk-0.1.45}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mcpgawk"
-version = "0.1.44"
+version = "0.1.45"
 description = "One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine."
 readme = "README.md"
 requires-python = ">=3.10"

{mcpgawk-0.1.44 → mcpgawk-0.1.45}/src/mcpgawk/cli.py

@@ -1095,8 +1095,15 @@ def _changes(args) -> int:
               f"snapshot did not record which kinds it enumerated (written by wrap before 0.1.41 "
               f"or a scan before 0.1.40), so prompts and resources were not compared there.")
     if not found:
-        which = history.display_name(store, keys[0]) if len(keys) == 1 else f"{len(keys)} servers"
         n = sum(snapshots.values())
+        if not keys or n == 0:
+            # A fresh install. "No change recorded for 0 servers (0 snapshots)" is true and reads
+            # as nonsense; say what is actually missing and the one command that starts it.
+            print("No history yet. Run `mcpgawk scan` — every scan records a snapshot, and this "
+                  "screen compares them. Changes appear once a server's tools move between two "
+                  "snapshots.")
+            return 0
+        which = history.display_name(store, keys[0]) if len(keys) == 1 else f"{len(keys)} servers"
         print(f"No change recorded for {which} since {label} ({n} snapshot{'s' if n != 1 else ''})."
               + footer)
         return 0
@@ -1273,9 +1280,10 @@ ACCOUNT_COMMANDS = {
 #: reply must confirm they are in the right place and name the ONE missing step — never read as
 #: "you typed something wrong".
 _ACCOUNT_NEEDS_PLATFORM = (
-    "mcpgawk {cmd}: the mcpgawk Platform isn't installed in this environment yet.\n"
-    "Your licence unlocks it, and your purchase email has the one-line install command.\n"
-    "Lost it? https://mcp.gawk.dev/activate.html — or reply to the receipt and we'll resend.\n"
+    "mcpgawk {cmd}: the paid engine is not in this environment yet.\n"
+    "Your licence key is the one thing that adds it: run `mcpgawk login <license-key>` and the\n"
+    "engine is fetched, checksum-verified and put beside the free scanner in one step.\n"
+    "Lost the key? https://mcp.gawk.dev/trial.html — or reply to the email that carried it.\n"
     "The free scanner (`mcpgawk scan`) keeps working either way."
 )
 
@@ -1289,6 +1297,18 @@ def _run_account_command(command: str, rest: list[str]) -> int:
     try:
         from gawk_platform.cli import run_account
     except ImportError:
+        if command == "login":
+            # ONE path [FOUNDER 2026-09-12]: `mcpgawk login KEY` on a free install fetches the
+            # paid engine itself (token-gated, checksum-verified, installed where this
+            # interpreter lives) and re-runs login from the binary that now has it. `-h` prints
+            # the same usage the paid `login` prints; no key at all falls through to the message
+            # below, which is also what every other account command gets.
+            from . import engine_fetch
+            if rest and rest[0] in ("-h", "--help"):
+                print(engine_fetch.USAGE)
+                return 0
+            if rest and not rest[0].startswith("-"):
+                return engine_fetch.login_with_fetch(rest[0])
         print(_ACCOUNT_NEEDS_PLATFORM.format(cmd=command), file=sys.stderr)
         return 3
     return run_account(command, rest)

mcpgawk-0.1.45/src/mcpgawk/engine_fetch.py

@@ -0,0 +1,152 @@
+"""`mcpgawk login KEY` on a free install: fetch the paid engine, verify it, install it HERE.
+
+[FOUNDER 2026-09-12] "There should not be free beta and paid path .. everything should be
+seamless." Every page told a paying customer to type `mcpgawk login KEY`; on the install they
+had, that exited 3 with "the Platform isn't installed" and pointed at an email. The email's
+one-liner did the real work. Now `login` is that work.
+
+The mechanism is the one that already exists and is already tested: one POST to the
+token-gated endpoint with the key in the body returns a short-lived signed URL, a filename and
+a sha256 (`site/api/license-status.js`, `docs/token-gated-install-plan-2026-08-22.md`). The
+paid engine never ships in the public wheel — this module only ever fetches it behind a key.
+
+THE ONE RULE FOR WHERE IT GOES: the wheel is installed where the running interpreter lives. A uv
+tool environment installs with uv, a pipx venv with pipx, anything else with this interpreter's
+own pip. `install.sh` chooses where the FREE package goes and keeps its fallback ladder for
+that; this module does not have a ladder, because a second definition of "where mcpgawk is"
+would drift from the first.
+
+The three seams (`_post`, `_get`, `_run`) are module attributes so the tests can drive the real
+entry point with the network and the installer captured. Free-engine code; syncs public.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+ENDPOINT = "https://mcp.gawk.dev/api/license-status"
+
+#: Exit codes follow cli.py's own vocabulary: 3 = cannot run (this key does not unlock the
+#: engine), 4 = INCOMPLETE (ran but could not finish; 1 means findings, this is neither) — NEVER 0.
+#: No failure path prints the word "installed": a customer skimming stderr must never read
+#: success into a refusal. The tests pin that as a substring rule over stdout AND stderr.
+EXIT_NOT_ELIGIBLE = 3
+EXIT_INCOMPLETE = 4
+
+
+def request_body(key: str) -> str:
+    """Exactly the fields `license-status.js` reads. Pinned as data by the tests."""
+    return json.dumps({"licenseKey": key, "want": "engine"})
+
+
+def _post(url: str, payload: dict) -> tuple[int, dict]:
+    req = urllib.request.Request(url, data=json.dumps(payload).encode(), method="POST",
+                                 headers={"Content-Type": "application/json",
+                                          "User-Agent": "mcpgawk-login"})
+    try:
+        with urllib.request.urlopen(req, timeout=20) as resp:      # noqa: S310 — https, fixed host
+            return resp.status, json.loads(resp.read().decode() or "{}")
+    except urllib.error.HTTPError as e:
+        try:
+            body = json.loads(e.read().decode() or "{}")
+        except Exception:  # noqa: BLE001 — a non-JSON error page is still an error
+            body = {}
+        return e.code, body
+
+
+def _get(url: str) -> bytes:
+    with urllib.request.urlopen(url, timeout=120) as resp:          # noqa: S310 — the signed URL
+        return resp.read()
+
+
+def _run(argv: list[str]) -> int:
+    return subprocess.run(argv, check=False).returncode
+
+
+def _download_dir() -> Path:
+    return Path(tempfile.mkdtemp(prefix="mcpgawk-engine-"))
+
+
+def install_argv(wheel: Path) -> list[str]:
+    """The ONE rule: install where this interpreter lives."""
+    prefix = Path(sys.prefix)
+    uv = shutil.which("uv")
+    if (prefix / "uv-receipt.toml").exists() and uv:
+        return [uv, "tool", "install", "--force", str(wheel)]
+    pipx = shutil.which("pipx")
+    if "pipx" in prefix.parts and pipx:
+        return [pipx, "install", "--force", str(wheel)]
+    return [sys.executable, "-m", "pip", "install", "--quiet", "--force-reinstall", str(wheel)]
+
+
+def _own_binary() -> str:
+    """The `mcpgawk` this process was launched as — the one the install just replaced."""
+    here = Path(sys.prefix) / ("Scripts" if os.name == "nt" else "bin") / "mcpgawk"
+    if here.exists():
+        return str(here)
+    return shutil.which("mcpgawk") or "mcpgawk"
+
+
+USAGE = (
+    "usage: mcpgawk login <license-key>\n\n"
+    "Your key is the only thing you add. With it, `login` fetches the paid engine (pre-built,\n"
+    "checksum-verified, gated on the key), installs it beside the free scanner, and saves the key\n"
+    "so the paid capabilities unlock. Lost the key? https://mcp.gawk.dev/trial.html or reply to\n"
+    "the email that carried it. The free scanner (`mcpgawk scan`) keeps working either way."
+)
+
+
+def login_with_fetch(key: str) -> int:
+    """Fetch → verify → install here → re-exec `mcpgawk login KEY` from the new binary."""
+    print("Fetching the paid engine with your key (pre-built, checksum-verified) …", flush=True)
+    status, body = _post(ENDPOINT, json.loads(request_body(key)))
+    if status == 403:
+        print("mcpgawk login: this key does not unlock the engine (it is not on a live trial or "
+              "licence). Request a trial at https://mcp.gawk.dev/trial.html, or check the key "
+              "you pasted.", file=sys.stderr)
+        return EXIT_NOT_ELIGIBLE
+    if status != 200 or not all(body.get(k) for k in ("url", "filename", "sha256")):
+        print(f"mcpgawk login: the engine download is not available right now (HTTP {status}). "
+              "Nothing changed on this machine. Try again in a minute.", file=sys.stderr)
+        return EXIT_INCOMPLETE
+
+    dest = _download_dir() / str(body["filename"]).split("/")[-1]
+    try:
+        data = _get(str(body["url"]))
+    except Exception as e:  # noqa: BLE001 — network; say so, never pretend
+        print(f"mcpgawk login: the download did not complete ({type(e).__name__}). Nothing changed "
+              "on this machine. Try again in a minute.", file=sys.stderr)
+        return EXIT_INCOMPLETE
+    got = hashlib.sha256(data).hexdigest()
+    if got != str(body["sha256"]).lower():
+        print("mcpgawk login: the downloaded engine's sha256 does not match what the server "
+              f"published (got {got[:16]}, want {str(body['sha256'])[:16]}). Refusing to install "
+              "it. Nothing changed on this machine. Re-run; if it happens again, mail "
+              "hello@nativerse-ventures.com with this line.", file=sys.stderr)
+        return EXIT_INCOMPLETE
+    dest.write_bytes(data)
+    print(f"  ✓ engine {body.get('version', '')} fetched and checksum-verified", flush=True)
+
+    argv = install_argv(dest)
+    print(f"  installing into {sys.prefix} …", flush=True)
+    rc = _run(argv)
+    try:
+        dest.unlink()
+    except OSError:
+        pass
+    if rc != 0:
+        print(f"mcpgawk login: the install command exited {rc}: {' '.join(argv[:-1])} <wheel>. "
+              "Nothing was activated.", file=sys.stderr)
+        return EXIT_INCOMPLETE
+    print("  ✓ paid engine installed", flush=True)
+    # 6 — the platform's own `login` saves the key; run it from the binary that now has it.
+    return _run([_own_binary(), "login", key])

{mcpgawk-0.1.44 → mcpgawk-0.1.45}/tests/test_changes_is_the_changelog_nobody_publishes.py

@@ -240,6 +240,17 @@ def test_no_server_means_every_server(store, capsys):
     assert rc == 0 and "srv" in out and "rotate_key" in out, out
 
 
+def test_a_fresh_install_says_what_is_missing_not_zero_of_zero(tmp_path, monkeypatch, capsys):
+    """Measured on the released 0.1.44: an empty store printed "No change recorded for 0 servers
+    since … (0 snapshots)". True, and nonsense to the person who just installed it. The first
+    thing a tester sees from this screen must name the one command that starts the history."""
+    monkeypatch.setenv(history.STORE_ENV, str(tmp_path / "history.json"))
+    rc, out = _run(capsys)
+    assert rc == 0
+    assert "No history yet" in out and "mcpgawk scan" in out, out
+    assert "0 servers" not in out and "0 snapshots" not in out, out
+
+
 def test_unknown_name_exits_2(store, capsys):
     rc, _ = _run(capsys, "nope")
     assert rc == 2

mcpgawk-0.1.45/tests/test_login_fetches_the_engine_itself.py

@@ -0,0 +1,204 @@
+"""`mcpgawk login KEY` on a FREE install fetches and installs the paid engine itself.
+
+[FOUNDER 2026-09-12] "There should not be free beta and paid path .. everything should be
+seamless." Before this, a paying customer who typed the command every page told them to type got
+exit 3 and "the Platform isn't installed in this environment yet" — the key alone did nothing,
+and the one-liner that did the work lived in an email. Now `login` IS the one-liner.
+
+THE NON-NEGOTIABLES, each pinned below and mutation-checked at build time:
+  1. The paid engine never ships in the public wheel (the existing artefact verifier owns this;
+     `login` only ever FETCHES it, behind a valid key, from the token-gated endpoint).
+  2. `login` never installs a wheel whose sha256 differs from the manifest's. A mismatch refuses,
+     deletes the download, exits non-zero and never says "installed".
+  3. 403 names the ONE missing step (the key is not eligible) and exits 3 — the documented
+     "cannot run". 503 says try again and exits 4 — "incomplete", never 0.
+  4. The key travels ONLY in the POST body. Never in a URL, never on a shell command line except
+     the one the customer typed themselves (the re-exec after install).
+  5. The wheel is installed WHERE THE RUNNING INTERPRETER LIVES — one rule, no fallback ladder.
+     `install.sh` chooses where the free package goes; `login` puts the paid engine in the same
+     place. Two install routes would be a second definition of "where mcpgawk is".
+  6. After a successful install `login` re-execs itself through the new binary, so the platform's
+     own `login` saves the key; the old process never imports the engine it just installed.
+
+Every test drives the real entry point, `cli.main(["login", KEY])`, with the network and the
+installer captured — no endpoint, no bucket, no real key.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+from mcpgawk import cli, engine_fetch
+
+KEY = "gawk-beta.test.not-a-real-key"
+WHEEL_BYTES = b"PK\x03\x04 not really a wheel, but bytes with a sha256"
+SHA = hashlib.sha256(WHEEL_BYTES).hexdigest()
+
+
+class Net:
+    """Captures what `login` asked the network for, and answers as the endpoint would."""
+
+    def __init__(self, status=200, body=None):
+        self.status, self.body = status, body
+        self.posts: list[tuple[str, dict]] = []
+        self.gets: list[str] = []
+
+    def post(self, url: str, payload: dict) -> tuple[int, dict]:
+        self.posts.append((url, payload))
+        if self.body is None:
+            return self.status, {"ok": True, "version": "9.9.9", "filename": "mcpgawk-9.9.9-py3-none-any.whl",
+                                 "sha256": SHA, "url": "https://bucket.example/signed/mcpgawk-9.9.9.whl?token=abc"}
+        return self.status, self.body
+
+    def get(self, url: str) -> bytes:
+        self.gets.append(url)
+        return WHEEL_BYTES
+
+
+@pytest.fixture
+def free_install(monkeypatch, tmp_path):
+    """A FREE install: gawk_platform is not importable, downloads land in tmp, the installer and
+    the re-exec are captured instead of run."""
+    monkeypatch.setitem(sys.modules, "gawk_platform", None)
+    monkeypatch.setitem(sys.modules, "gawk_platform.cli", None)
+    net = Net()
+    monkeypatch.setattr(engine_fetch, "_post", net.post)
+    monkeypatch.setattr(engine_fetch, "_get", net.get)
+    runs: list[list[str]] = []
+    installed: list[bytes] = []          # the wheel's bytes AS THE INSTALLER SAW THEM (it is deleted after)
+
+    def run(argv):
+        runs.append(list(argv))
+        if argv[-1].endswith(".whl"):
+            installed.append(Path(argv[-1]).read_bytes())
+        return 0
+
+    monkeypatch.setattr(engine_fetch, "_run", run)
+    monkeypatch.setattr(engine_fetch, "_download_dir", lambda: tmp_path)
+    net.installed = installed
+    return net, runs
+
+
+def test_login_on_a_free_install_fetches_verifies_installs_and_reexecs(free_install, capsys):
+    net, runs = free_install
+    rc = cli.main(["login", KEY])
+    out = capsys.readouterr().out
+    assert rc == 0, out
+    # 4 — the key is in the POST body and nowhere else
+    assert net.posts == [(engine_fetch.ENDPOINT, {"licenseKey": KEY, "want": "engine"})]
+    assert KEY not in net.posts[0][0] and all(KEY not in u for u in net.gets)
+    # the signed URL was fetched, the bytes verified, and the wheel installed then re-exec'd
+    assert net.gets == ["https://bucket.example/signed/mcpgawk-9.9.9.whl?token=abc"]
+    assert len(runs) == 2, runs
+    install, reexec = runs
+    assert install[-1].endswith("mcpgawk-9.9.9-py3-none-any.whl") and net.installed == [WHEEL_BYTES]
+    assert not Path(install[-1]).exists(), "the downloaded wheel was left on disk after install"
+    assert reexec[-2:] == ["login", KEY], reexec
+    assert "installed" in out.lower()
+
+
+def test_a_wheel_whose_sha256_does_not_match_is_refused_and_deleted(free_install, capsys):
+    net, runs = free_install
+    net.body = {"ok": True, "version": "9.9.9", "filename": "mcpgawk-9.9.9-py3-none-any.whl",
+                "sha256": "0" * 64, "url": "https://bucket.example/signed/x.whl"}
+    rc = cli.main(["login", KEY])
+    out = capsys.readouterr()
+    text = (out.out + out.err).lower()
+    assert rc == 4
+    assert runs == [], "an unverified wheel reached the installer"
+    assert "installed" not in text and "sha256" in text, text
+    assert not list(engine_fetch._download_dir().glob("*.whl")), "the bad download was left on disk"
+
+
+def test_a_key_that_is_not_eligible_names_the_one_missing_step_and_exits_3(free_install, capsys):
+    net, runs = free_install
+    net.status, net.body = 403, {"error": "not-eligible"}
+    rc = cli.main(["login", KEY])
+    out = capsys.readouterr()
+    text = (out.out + out.err).lower()
+    assert rc == 3 and runs == [] and net.gets == []
+    assert "trial" in text or "licence" in text, text
+    assert "installed" not in text
+
+
+def test_an_endpoint_outage_says_try_again_and_exits_4_never_0(free_install, capsys):
+    net, runs = free_install
+    net.status, net.body = 503, {"error": "try-again"}
+    rc = cli.main(["login", KEY])
+    out = capsys.readouterr()
+    text = (out.out + out.err).lower()
+    assert rc == 4 and runs == [] and net.gets == []
+    assert "try again" in text and "installed" not in text, text
+
+
+def test_a_download_that_fails_midway_says_so_and_exits_4(free_install, capsys):
+    net, runs = free_install
+
+    def broken(url):
+        raise OSError("connection reset")
+
+    net.get = broken
+    import mcpgawk.engine_fetch as ef
+    ef._get = broken
+    rc = cli.main(["login", KEY])
+    out = capsys.readouterr()
+    text = (out.out + out.err).lower()
+    assert rc == 4 and runs == []
+    assert "try again" in text and "installed" not in text, text
+
+
+def test_an_installer_that_exits_nonzero_never_reexecs_and_never_says_installed(free_install, monkeypatch, capsys):
+    net, runs = free_install
+    monkeypatch.setattr(engine_fetch, "_run", lambda argv: (runs.append(list(argv)), 1)[1])
+    rc = cli.main(["login", KEY])
+    out = capsys.readouterr()
+    text = (out.out + out.err).lower()
+    assert rc == 4 and len(runs) == 1, runs          # the installer ran once; NO re-exec
+    assert "installed" not in text and "exited 1" in text, text
+
+
+def test_the_wheel_is_installed_where_the_running_interpreter_lives(monkeypatch, tmp_path):
+    """One rule: a uv tool environment (uv-receipt.toml beside the prefix) installs with uv; a
+    pipx venv with pipx; anything else with THIS interpreter's pip. No ladder, no guessing."""
+    wheel = tmp_path / "w.whl"
+    wheel.write_bytes(b"x")
+    # uv tool env
+    prefix = tmp_path / "uv" / "tools" / "mcpgawk"
+    prefix.mkdir(parents=True)
+    (prefix / "uv-receipt.toml").write_text("[tool]\n")
+    monkeypatch.setattr(engine_fetch.sys, "prefix", str(prefix))
+    monkeypatch.setattr(engine_fetch.shutil, "which", lambda name: "/usr/local/bin/uv" if name == "uv" else None)
+    assert engine_fetch.install_argv(wheel)[:4] == ["/usr/local/bin/uv", "tool", "install", "--force"]
+    # pipx venv
+    monkeypatch.setattr(engine_fetch.sys, "prefix", str(tmp_path / "pipx" / "venvs" / "mcpgawk"))
+    monkeypatch.setattr(engine_fetch.shutil, "which", lambda name: "/usr/local/bin/pipx" if name == "pipx" else None)
+    assert engine_fetch.install_argv(wheel)[:3] == ["/usr/local/bin/pipx", "install", "--force"]
+    # plain venv / pip
+    monkeypatch.setattr(engine_fetch.sys, "prefix", str(tmp_path / "somewhere"))
+    argv = engine_fetch.install_argv(wheel)
+    assert argv[:4] == [sys.executable, "-m", "pip", "install"] and "--force-reinstall" in argv
+
+
+def test_login_without_a_key_on_a_free_install_names_the_key_as_the_one_missing_step(monkeypatch, capsys):
+    """The old message pointed at a purchase email and a one-liner that slice 1 deleted."""
+    monkeypatch.setitem(sys.modules, "gawk_platform", None)
+    monkeypatch.setitem(sys.modules, "gawk_platform.cli", None)
+    rc = cli.main(["login"])
+    err = capsys.readouterr().err
+    assert rc == 3 and "mcpgawk login <license-key>" in err, err
+    assert "email has the one-line" not in err and "installed" not in err.lower(), err
+    # -h on a free install prints usage and exits 0, exactly as the paid `login -h` does
+    rc = cli.main(["login", "--help"])
+    out = capsys.readouterr().out
+    assert rc == 0 and out.startswith("usage: mcpgawk login <license-key>"), out
+
+
+def test_the_request_body_is_exactly_what_the_endpoint_reads():
+    """`license-status.js` reads `licenseKey` and `want`. A renamed field would be a 400 in prod
+    and a green suite here — so the shape is pinned as data, not as a mock."""
+    assert json.loads(engine_fetch.request_body(KEY)) == {"licenseKey": KEY, "want": "engine"}