runlayer 0.22.0__tar.gz → 0.22.2__tar.gz

{runlayer-0.22.0 → runlayer-0.22.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: runlayer
-Version: 0.22.0
+Version: 0.22.2
 Summary: A command-line interface for running MCP servers via HTTP transport
 Project-URL: Homepage, https://runlayer.com
 Project-URL: Documentation, https://docs.runlayer.com/
@@ -229,6 +229,7 @@ Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: questionary>=2.0.0
 Requires-Dist: rich>=13.0.0
 Requires-Dist: structlog>=25.4.0
+Requires-Dist: tomli>=2.0.0; python_version < '3.11'
 Requires-Dist: typer>=0.17.4
 Description-Content-Type: text/markdown
 
@@ -531,7 +532,7 @@ The `--secret` flag still accepts any raw API key (user or org) directly and tak
 
 ### `scan` - Scan MCP Client Configurations
 
-Scan for MCP server configurations across supported clients (Cursor, Claude Desktop, Claude Code, VS Code, Windsurf) and submit results to Runlayer for classification.
+Scan for MCP server configurations, skills, and plugins across supported clients (Cursor, Claude Desktop, Claude Code, VS Code, Windsurf, Goose, Zed, OpenCode, Codex) and submit results to Runlayer for classification.
 
 #### Command Options
 
@@ -732,12 +733,12 @@ uvx runlayer skills push [PATH] --namespace <namespace> [OPTIONS]
 uvx runlayer skills scan <PATH> [OPTIONS]
 ```
 
-- `PATH`: Skill dir or `SKILL.md` path. Must resolve to exactly one skill
-- `--name`: Override skill name sent to the security scan API
+- `PATH`: Skill dir, `SKILL.md` path, or a root containing many skills
+- `--name`: Override skill name sent to the security scan API for single-skill scans only
 - `--fail-on`: Exit non-zero on `warn` or `block`
-- Output is always JSON
+- Output is always JSON. Single-skill scans return one scan object; multi-skill scans return `{ "skills": [...] }`
 
-This calls the security scan API to score one local skill without pushing it to the
+This calls the security scan API to score one or many local skills without pushing them to the
 Runlayer skills catalog or AI Watch shadow-skill discovery flow.
 
 #### `skills add`

{runlayer-0.22.0 → runlayer-0.22.2}/README.md

@@ -297,7 +297,7 @@ The `--secret` flag still accepts any raw API key (user or org) directly and tak
 
 ### `scan` - Scan MCP Client Configurations
 
-Scan for MCP server configurations across supported clients (Cursor, Claude Desktop, Claude Code, VS Code, Windsurf) and submit results to Runlayer for classification.
+Scan for MCP server configurations, skills, and plugins across supported clients (Cursor, Claude Desktop, Claude Code, VS Code, Windsurf, Goose, Zed, OpenCode, Codex) and submit results to Runlayer for classification.
 
 #### Command Options
 
@@ -498,12 +498,12 @@ uvx runlayer skills push [PATH] --namespace <namespace> [OPTIONS]
 uvx runlayer skills scan <PATH> [OPTIONS]
 ```
 
-- `PATH`: Skill dir or `SKILL.md` path. Must resolve to exactly one skill
-- `--name`: Override skill name sent to the security scan API
+- `PATH`: Skill dir, `SKILL.md` path, or a root containing many skills
+- `--name`: Override skill name sent to the security scan API for single-skill scans only
 - `--fail-on`: Exit non-zero on `warn` or `block`
-- Output is always JSON
+- Output is always JSON. Single-skill scans return one scan object; multi-skill scans return `{ "skills": [...] }`
 
-This calls the security scan API to score one local skill without pushing it to the
+This calls the security scan API to score one or many local skills without pushing them to the
 Runlayer skills catalog or AI Watch shadow-skill discovery flow.
 
 #### `skills add`

{runlayer-0.22.0 → runlayer-0.22.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "runlayer"
-version = "0.22.0"
+version = "0.22.2"
 description = "A command-line interface for running MCP servers via HTTP transport"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -29,6 +29,7 @@ dependencies = [
   "rich>=13.0.0",
   "python-dotenv>=1.0.0",
   "json5>=0.12.1",
+  "tomli>=2.0.0; python_version < '3.11'",
   "questionary>=2.0.0",
   "keyring>=25.0.0,<26",
 ]

{runlayer-0.22.0 → runlayer-0.22.2}/runlayer_cli/commands/setup.py

@@ -1175,7 +1175,7 @@ def _build_opencode_server_entry(spec: InstallServerSpec) -> dict[str, Any]:
         }
         return entry
 
-    entry = {"enabled": True, "type": "remote", "url": spec.proxy_url}
+    entry: dict[str, Any] = {"enabled": True, "type": "remote", "url": spec.proxy_url}
     if spec.headers:
         entry["headers"] = spec.headers
     return entry

{runlayer-0.22.0 → runlayer-0.22.2}/runlayer_cli/commands/skills.py

@@ -1,3 +1,4 @@
+import json
 from enum import Enum
 from pathlib import Path
 
@@ -5,7 +6,7 @@ import anyio
 import structlog
 import typer
 
-from runlayer_cli.api import RunlayerClient
+from runlayer_cli.api import RunlayerClient, SkillScanResponse
 from runlayer_cli.console import print_error
 from runlayer_cli.config import resolve_credentials, set_credentials_in_context
 from runlayer_cli.logging import setup_logging
@@ -61,7 +62,7 @@ def _resolve_client(client_name: str | None) -> str:
     return "claude_code"
 
 
-def _load_single_skill(path: str) -> DiscoveredSkill:
+def _load_skills(path: str) -> list[DiscoveredSkill]:
     target = Path(path).resolve()
     if not target.exists():
         raise ValueError(f"Path does not exist: {target}")
@@ -73,14 +74,51 @@ def _load_single_skill(path: str) -> DiscoveredSkill:
     else:
         root = target
 
-    discovered = discover_skills(root)
-    if not discovered:
+    skills = discover_skills(root)
+    if not skills:
         raise ValueError(f"No skill found under {root}")
-    if len(discovered) > 1:
-        raise ValueError(
-            f"Found {len(discovered)} skills under {root}. Pass a single skill dir."
-        )
-    return discovered[0]
+    return skills
+
+
+def _scan_skill(client: RunlayerClient, skill: DiscoveredSkill) -> SkillScanResponse:
+    return client.score_skill(
+        skill_name=skill.name,
+        files=[
+            {
+                "name": file.title,
+                "content": file.content,
+            }
+            for file in skill.files
+        ],
+    )
+
+
+def _override_skill_name(skill: DiscoveredSkill, name: str) -> DiscoveredSkill:
+    return DiscoveredSkill(
+        path=skill.path,
+        name=name,
+        description=skill.description,
+        files=skill.files,
+    )
+
+
+def _render_scan_results(
+    scanned_skills: list[tuple[DiscoveredSkill, SkillScanResponse]],
+) -> str:
+    if len(scanned_skills) == 1:
+        return scanned_skills[0][1].model_dump_json(indent=2)
+
+    payload = {
+        "skills": [
+            {
+                "path": skill.path,
+                "name": skill.name,
+                **result.model_dump(mode="json"),
+            }
+            for skill, result in scanned_skills
+        ]
+    }
+    return json.dumps(payload, indent=2)
 
 
 def _should_fail(risk_level: str, fail_on: FailOn | None) -> bool:
@@ -184,23 +222,20 @@ def scan(
     credentials = resolve_credentials(ctx, require_auth=True, allow_org_key=True)
 
     try:
-        skill = _load_single_skill(path)
-        skill_name = name or skill.name
+        skills = _load_skills(path)
+        if name is not None and len(skills) != 1:
+            raise ValueError("--name requires a single skill path")
+        if name is not None:
+            skills[0] = _override_skill_name(skills[0], name)
         client = RunlayerClient(
             hostname=credentials["host"], secret=credentials["secret"]
         )
-        result = client.score_skill(
-            skill_name=skill_name,
-            files=[
-                {
-                    "name": file.title,
-                    "content": file.content,
-                }
-                for file in skill.files
-            ],
-        )
-        typer.echo(result.model_dump_json(indent=2))
-        if _should_fail(result.skill_risk_level, fail_on):
+        scanned_skills = [(skill, _scan_skill(client, skill)) for skill in skills]
+        typer.echo(_render_scan_results(scanned_skills))
+        if any(
+            _should_fail(result.skill_risk_level, fail_on)
+            for _, result in scanned_skills
+        ):
             raise typer.Exit(2 if fail_on == FailOn.WARN else 3)
     except typer.Exit:
         raise

{runlayer-0.22.0 → runlayer-0.22.2}/runlayer_cli/plugins/installer.py

@@ -380,14 +380,10 @@ def _build_plugin_mcp_config(
     host: str,
     client_name: str,
 ) -> dict[str, dict[str, dict[str, str]]]:
-    # VS Code plugin `.mcp.json` uses "mcpServers" (plugin schema),
-    # while VS Code client config uses "servers".
-    if client_name == "vscode":
-        servers_key = "mcpServers"
-    else:
-        client_def = get_client_by_name(client_name)
-        servers_key = client_def.servers_key if client_def else "mcpServers"
-    return {servers_key: _build_plugin_proxy_servers(plugin, host)}
+    # Plugin `.mcp.json` always uses the standard "mcpServers" key regardless
+    # of what key the client's own config format uses (e.g. VS Code uses
+    # "servers", Codex uses "mcp_servers" in TOML).
+    return {"mcpServers": _build_plugin_proxy_servers(plugin, host)}
 
 
 def _write_plugin_mcp_json(

{runlayer-0.22.0 → runlayer-0.22.2}/runlayer_cli/scan/clients.py

@@ -404,6 +404,40 @@ MCP_CLIENTS: list[MCPClientDefinition] = [
         ),
         notes="Servers live under top-level 'mcp' and use OpenCode format (type=local|remote, command[]=..., environment={...}).",
     ),
+    MCPClientDefinition(
+        name="codex",
+        display_name="Codex",
+        paths=[
+            ConfigPath("~/.codex/config.toml", platform="macos"),
+            ConfigPath("~/.codex/config.toml", platform="linux"),
+            ConfigPath("%USERPROFILE%/.codex/config.toml", platform="windows"),
+        ],
+        servers_key="mcp_servers",
+        config_format="toml",
+        project_config=ProjectConfigPattern(
+            relative_path=".codex/config.toml",
+            servers_key="mcp_servers",
+        ),
+        plugin_paths=[
+            PluginPath(
+                "~/.codex/plugins/cache",
+                platform="macos",
+                mcp_filenames=("mcp.json", ".mcp.json"),
+            ),
+            PluginPath(
+                "%USERPROFILE%/.codex/plugins/cache",
+                platform="windows",
+                mcp_filenames=("mcp.json", ".mcp.json"),
+            ),
+            PluginPath(
+                "~/.codex/plugins/cache",
+                platform="linux",
+                mcp_filenames=("mcp.json", ".mcp.json"),
+            ),
+        ],
+        notes="TOML format. MCP servers under [mcp_servers.<name>] tables. "
+        "Plugins in ~/.codex/plugins/cache/<marketplace>/<plugin>/<version>/.",
+    ),
     # ==========================================================================
     # DESCOPED FROM v0 - Add these in a future release
     # ==========================================================================

runlayer-0.22.2/runlayer_cli/scan/codex_plugins.py

@@ -0,0 +1,168 @@
+"""Discover MCP servers bundled inside installed Codex plugins.
+
+Plugins are cached at ~/.codex/plugins/cache/<marketplace>/<plugin>/<version>/.
+Each plugin may contain mcp.json or .mcp.json with server definitions either
+under the "mcpServers" key or at root level.
+"""
+
+from __future__ import annotations
+
+import os
+import platform
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+
+import structlog
+
+from runlayer_cli.scan.config_parser import (
+    MCPClientConfig,
+    MCPServerConfig,
+    parse_plugin_mcp_file,
+)
+from runlayer_cli.scan.plugin_scanner import (
+    _version_sort_key,
+    compute_plugin_identifier,
+)
+
+logger = structlog.get_logger(__name__)
+
+
+@dataclass
+class DiscoveredCodexPlugin:
+    """A Codex plugin found in the cache with MCP server definitions."""
+
+    name: str
+    config_path: Path
+    config_modified_at: str | None
+    servers: list[MCPServerConfig]
+    plugin_identifier: str | None = None
+
+
+def _discover_codex_plugins(
+    plugin_cache_base: Path,
+    mcp_filenames: tuple[str, ...] = ("mcp.json", ".mcp.json"),
+) -> list[DiscoveredCodexPlugin]:
+    """Scan Codex plugin cache for plugins containing MCP configs.
+
+    Traverses <base>/<marketplace>/<plugin>/<version>/ looking for MCP files.
+    """
+    if not plugin_cache_base.is_dir():
+        return []
+
+    discovered: list[DiscoveredCodexPlugin] = []
+    seen: set[str] = set()
+
+    try:
+        for marketplace_dir in sorted(plugin_cache_base.iterdir()):
+            if not marketplace_dir.is_dir():
+                continue
+
+            for plugin_dir in sorted(marketplace_dir.iterdir()):
+                if not plugin_dir.is_dir():
+                    continue
+                plugin_name = plugin_dir.name
+                seen_key = f"{marketplace_dir.name}/{plugin_name}"
+                if seen_key in seen:
+                    continue
+
+                for version_dir in sorted(
+                    plugin_dir.iterdir(), key=_version_sort_key, reverse=True
+                ):
+                    if not version_dir.is_dir():
+                        continue
+
+                    for mcp_filename in mcp_filenames:
+                        mcp_path = version_dir / mcp_filename
+                        if not mcp_path.exists():
+                            continue
+
+                        servers = parse_plugin_mcp_file(mcp_path, plugin_name)
+                        if not servers:
+                            continue
+
+                        try:
+                            mtime = mcp_path.stat().st_mtime
+                            modified_at = datetime.fromtimestamp(
+                                mtime, tz=timezone.utc
+                            ).isoformat()
+                        except OSError:
+                            modified_at = None
+
+                        plugin_id = compute_plugin_identifier(version_dir)
+                        discovered.append(
+                            DiscoveredCodexPlugin(
+                                name=plugin_name,
+                                config_path=mcp_path,
+                                config_modified_at=modified_at,
+                                servers=servers,
+                                plugin_identifier=plugin_id,
+                            )
+                        )
+                        seen.add(seen_key)
+                        logger.debug(
+                            "Found Codex plugin MCP config",
+                            plugin=plugin_name,
+                            server_count=len(servers),
+                        )
+                        break  # found mcp config in this version dir
+                    else:
+                        continue
+                    break  # use first version dir with an mcp config
+
+    except OSError as e:
+        logger.warning(
+            "Failed to scan Codex plugin cache",
+            path=str(plugin_cache_base),
+            error=str(e),
+        )
+
+    return discovered
+
+
+def scan_codex_plugins(
+    plugin_cache_base: Path | None = None,
+) -> list[MCPClientConfig]:
+    """Scan Codex plugin cache for bundled MCP servers.
+
+    Args:
+        plugin_cache_base: Override path for testing (uses default if None)
+
+    Returns:
+        List of MCPClientConfig entries for plugins with MCP servers.
+    """
+    if plugin_cache_base is None:
+        if platform.system() == "Windows":
+            profile = os.environ.get("USERPROFILE")
+            if not profile:
+                return []
+            plugin_cache_base = Path(profile) / ".codex" / "plugins" / "cache"
+        else:
+            try:
+                plugin_cache_base = Path.home() / ".codex" / "plugins" / "cache"
+            except RuntimeError:
+                return []
+
+    plugins = _discover_codex_plugins(plugin_cache_base)
+    if not plugins:
+        return []
+
+    configurations: list[MCPClientConfig] = []
+    for plugin in plugins:
+        configurations.append(
+            MCPClientConfig(
+                client="codex",
+                config_path=str(plugin.config_path),
+                config_modified_at=plugin.config_modified_at,
+                servers=plugin.servers,
+                config_scope="plugin",
+                plugin_identifier=plugin.plugin_identifier,
+            )
+        )
+        logger.info(
+            "Found MCP servers in Codex plugin",
+            plugin=plugin.name,
+            server_count=len(plugin.servers),
+        )
+
+    return configurations

{runlayer-0.22.0 → runlayer-0.22.2}/runlayer_cli/scan/config_parser.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import sys
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path
@@ -13,6 +14,11 @@ import json5
 import structlog
 import yaml
 
+if sys.version_info >= (3, 11):
+    import tomllib
+else:
+    import tomli as tomllib
+
 if TYPE_CHECKING:
     from runlayer_cli.scan.clients import MCPClientDefinition
 
@@ -120,6 +126,25 @@ def parse_plugin_mcp_entries(
     return servers
 
 
+def parse_plugin_mcp_file(mcp_path: Path, plugin_name: str) -> list[MCPServerConfig]:
+    """Read and parse an mcp.json / .mcp.json from a plugin directory."""
+    try:
+        raw = json5.loads(mcp_path.read_text(encoding="utf-8"))
+    except (ValueError, OSError) as e:
+        logger.warning(
+            "Failed to parse plugin MCP config",
+            plugin=plugin_name,
+            path=str(mcp_path),
+            error=str(e),
+        )
+        return []
+
+    if not isinstance(raw, dict):
+        return []
+
+    return parse_plugin_mcp_entries(raw, plugin_name)
+
+
 def _parse_goose_extension(name: str, config: dict[str, Any]) -> MCPServerConfig | None:
     """Parse a Goose extension entry from config file.
 
@@ -266,7 +291,8 @@ def _parse_opencode_mcp_server(
         cmd = command_list[0] if isinstance(command_list[0], str) else None
         if not cmd:
             return None
-        args = [a for a in command_list[1:] if isinstance(a, str)] or None
+        filtered_args: list[str] = [a for a in command_list[1:] if isinstance(a, str)]
+        args: list[str] | None = filtered_args if filtered_args else None
         environment = config.get("environment")
         env = environment if isinstance(environment, dict) else None
         server = MCPServerConfig(
@@ -303,6 +329,69 @@ def _parse_opencode_mcp_server(
     return None
 
 
+def _parse_codex_mcp_server(
+    name: str, config: dict[str, Any]
+) -> MCPServerConfig | None:
+    """Parse a Codex MCP server entry from config.toml.
+
+    Codex TOML format (docs: developers.openai.com/codex/mcp):
+    - enabled: bool (defaults to true)
+    - command + args + env for stdio
+    - url + http_headers / env_http_headers / bearer_token_env_var for streamable-http
+    """
+    if config.get("enabled") is False:
+        return None
+
+    if "url" in config:
+        url = config["url"]
+        if not isinstance(url, str) or not url:
+            return None
+        headers: dict[str, str] = {}
+        if isinstance(config.get("http_headers"), dict):
+            headers.update(config["http_headers"])
+        if isinstance(config.get("env_http_headers"), dict):
+            for header_name, env_var in config["env_http_headers"].items():
+                if isinstance(env_var, str):
+                    headers[header_name] = f"${{{env_var}}}"
+        bearer_env = config.get("bearer_token_env_var")
+        if isinstance(bearer_env, str) and bearer_env:
+            headers["Authorization"] = f"Bearer ${{{bearer_env}}}"
+        server = MCPServerConfig(
+            name=name,
+            type="streamable-http",
+            command=None,
+            args=None,
+            url=url,
+            env=None,
+            headers=headers or None,
+            project_name=config.get("project_name"),
+        )
+        server.config_hash = compute_config_hash(server)
+        return server
+
+    command = config.get("command")
+    if not isinstance(command, str) or not command:
+        return None
+    args = config.get("args")
+    if args is not None and not isinstance(args, list):
+        args = None
+    env = config.get("env")
+    if env is not None and not isinstance(env, dict):
+        env = None
+    server = MCPServerConfig(
+        name=name,
+        type="stdio",
+        command=command,
+        args=args,
+        url=None,
+        env=env,
+        headers=None,
+        project_name=config.get("project_name"),
+    )
+    server.config_hash = compute_config_hash(server)
+    return server
+
+
 def _parse_server_entry(name: str, config: dict[str, Any]) -> MCPServerConfig:
     """Parse a single server entry from config file.
 
@@ -413,14 +502,24 @@ def parse_config_file(
     config_format = getattr(client_def, "config_format", "json")
 
     try:
-        with open(config_path, encoding="utf-8") as f:
-            if config_format == "yaml":
+        if config_format == "toml":
+            with open(config_path, "rb") as fb:
+                raw_config = tomllib.load(fb)
+        elif config_format == "yaml":
+            with open(config_path, encoding="utf-8") as f:
                 raw_config = yaml.safe_load(f)
-            else:
-                # Use json5 for JSONC support (handles comments, trailing commas, etc.)
-                # Many editors (VS Code, Zed, Cursor) use JSONC for config files
+        else:
+            with open(config_path, encoding="utf-8") as f:
                 content = f.read()
-                raw_config = json5.loads(content)
+            raw_config = json5.loads(content)
+    except tomllib.TOMLDecodeError as e:
+        logger.warning(
+            "Failed to parse config file - invalid TOML",
+            client=client_def.name,
+            path=str(config_path),
+            error=str(e),
+        )
+        return None
     except yaml.YAMLError as e:
         logger.warning(
             "Failed to parse config file - invalid YAML",
@@ -430,7 +529,6 @@ def parse_config_file(
         )
         return None
     except ValueError as e:
-        # json5 raises ValueError for parse errors
         logger.warning(
             "Failed to parse config file - invalid JSON/JSONC",
             client=client_def.name,
@@ -484,6 +582,10 @@ def parse_config_file(
                     server = _parse_opencode_mcp_server(name, server_config)
                     if server is not None:
                         servers.append(server)
+                elif client_def.name == "codex":
+                    server = _parse_codex_mcp_server(name, server_config)
+                    if server is not None:
+                        servers.append(server)
                 else:
                     server = _parse_server_entry(name, server_config)
                     servers.append(server)

{runlayer-0.22.0 → runlayer-0.22.2}/runlayer_cli/scan/cursor_plugins.py

@@ -20,7 +20,7 @@ from runlayer_cli.scan.clients import MCPClientDefinition
 from runlayer_cli.scan.config_parser import (
     MCPClientConfig,
     MCPServerConfig,
-    parse_plugin_mcp_entries,
+    parse_plugin_mcp_file,
 )
 from runlayer_cli.scan.plugin_scanner import compute_plugin_identifier
 
@@ -38,25 +38,6 @@ class DiscoveredPlugin:
     plugin_identifier: str | None = None
 
 
-def _parse_plugin_mcp_file(mcp_path: Path, plugin_name: str) -> list[MCPServerConfig]:
-    """Parse an mcp.json or .mcp.json from a plugin directory."""
-    try:
-        raw = json5.loads(mcp_path.read_text(encoding="utf-8"))
-    except (ValueError, OSError) as e:
-        logger.warning(
-            "Failed to parse plugin MCP config",
-            plugin=plugin_name,
-            path=str(mcp_path),
-            error=str(e),
-        )
-        return []
-
-    if not isinstance(raw, dict):
-        return []
-
-    return parse_plugin_mcp_entries(raw, plugin_name)
-
-
 def discover_plugins(client_def: MCPClientDefinition) -> list[DiscoveredPlugin]:
     """Scan plugin cache directories for plugins containing MCP configs.
 
@@ -91,7 +72,7 @@ def discover_plugins(client_def: MCPClientDefinition) -> list[DiscoveredPlugin]:
                         if not mcp_path.exists():
                             continue
 
-                        servers = _parse_plugin_mcp_file(mcp_path, plugin_name)
+                        servers = parse_plugin_mcp_file(mcp_path, plugin_name)
                         if not servers:
                             continue