{"_id":"@aigently/mcp-server","name":"@aigently/mcp-server","dist-tags":{"latest":"0.2.4"},"versions":{"0.2.4":{"name":"@aigently/mcp-server","version":"0.2.4","description":"MCP server for aigently security guardrails — reads static catalog-data JSON, zero API dependency","keywords":["mcp","security","cve","cursor","claude","windsurf","guardrails","vibe-coding"],"license":"Apache-2.0","repository":{"type":"git","url":"git+https://github.com/aelbuni/aigently-catalog.git","directory":"packages/mcp-server"},"homepage":"https://github.com/aelbuni/aigently-catalog/tree/main/packages/mcp-server#readme","publishConfig":{"access":"public"},"bin":{"aigently-mcp":"dist/index.js"},"main":"./dist/index.js","type":"module","scripts":{"prebuild":"mkdir -p dist/catalog-data","build":"tsc && cp ../catalog-data/threats.json ../catalog-data/rules.json ../catalog-data/stacks.json ../catalog-data/guardrails.json ../catalog-data/manifest.json dist/catalog-data/","dev":"tsc --watch","start":"node dist/index.js","test":"node scripts/test-tools.mjs","prepublishOnly":"npm run build"},"dependencies":{"@modelcontextprotocol/sdk":"^1.29.0"},"devDependencies":{"typescript":"^5"},"engines":{"node":">=18"},"_id":"@aigently/mcp-server@0.2.4","gitHead":"034bebfc6e99c3d96bcb25ef2698cd9d5b0f1f45","types":"./dist/index.d.ts","bugs":{"url":"https://github.com/aelbuni/aigently-catalog/issues"},"_nodeVersion":"22.22.3","_npmVersion":"10.9.8","dist":{"integrity":"sha512-yQgx7JTTtTsxfuyXoWO9mK7id3ryQ8CepsVcuzTvA32y4Ge6fBvEsV462SJlkyoe17nCgK9ja5FfgZJYzIQeTg==","shasum":"2fcca94f7276590de597474dfafd43ff413ad8e0","tarball":"https://registry.npmjs.org/@aigently/mcp-server/-/mcp-server-0.2.4.tgz","fileCount":22,"unpackedSize":1277044,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@aigently%2fmcp-server@0.2.4","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQCtJRGpI1i+DrNZ0swYSN1Gsn0PpPTYT2A6zyBoNmKDHwIhAO4Syp4hmmfT2vt6N4/4zyUwTJ4LbqFv9DPAFY5XLNOp"}]},"_npmUser":{"name":"aigent.ly","email":"admin@aigent.ly"},"directories":{},"maintainers":[{"name":"aigent.ly","email":"admin@aigent.ly"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/mcp-server_0.2.4_1779765134808_0.56155513281455"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-26T03:12:14.624Z","0.2.4":"2026-05-26T03:12:14.962Z","modified":"2026-05-26T03:12:15.319Z"},"maintainers":[{"name":"aigent.ly","email":"admin@aigent.ly"}],"description":"MCP server for aigently security guardrails — reads static catalog-data JSON, zero API dependency","homepage":"https://github.com/aelbuni/aigently-catalog/tree/main/packages/mcp-server#readme","keywords":["mcp","security","cve","cursor","claude","windsurf","guardrails","vibe-coding"],"repository":{"type":"git","url":"git+https://github.com/aelbuni/aigently-catalog.git","directory":"packages/mcp-server"},"bugs":{"url":"https://github.com/aelbuni/aigently-catalog/issues"},"license":"Apache-2.0","readme":"# @aigently/mcp-server\n\n> Inject real CVE threat data and security guardrails into any AI coding assistant.\n\nConnects Cursor, Claude Code, Windsurf, GitHub Copilot, and Cline to the\n[Aigent.ly](https://aigent.ly) security catalog — 500+ CVEs with AI-generated\nguardrail patterns, organized by tech stack and protection layer.\n\n**Zero configuration. No API key. No database. No network calls at runtime.**\nThe server reads static JSON files committed to this repo and updated daily.\n\n---\n\n## Install\n\n### Option A — npx (no clone needed, always latest)\n\nUse this directly in your IDE config — no installation step required:\n\n```json\n{\n  \"mcpServers\": {\n    \"aigently\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@aigently/mcp-server\"],\n      \"env\": { \"AIGENTLY_TARGET_IDE\": \"cursor\" }\n    }\n  }\n}\n```\n\nChange `AIGENTLY_TARGET_IDE` to `cursor`, `claude-code`, `windsurf`, `copilot`, or `cline`.\n\n### Option B — Clone (for local development or offline use)\n\n#### Step 1 — Get the server path\n\n```bash\ngit clone https://github.com/aelbuni/aigently-catalog.git\ncd aigently-catalog\nnpm install\nnpm run build -w @aigently/mcp-server\necho \"$(pwd)/packages/mcp-server/dist/index.js\"\n```\n\nCopy the path printed by that last command. You will paste it in the next step.\n\n#### Step 2 — Add to your IDE\n\nPick your IDE below. Replace `/PASTE/PATH/HERE` with the path you copied.\n\n---\n\n#### Cursor\n\nCreate or edit `.cursor/mcp.json` in your project root (or `~/.cursor/mcp.json` for all projects):\n\n```json\n{\n  \"mcpServers\": {\n    \"aigently\": {\n      \"command\": \"node\",\n      \"args\": [\"/PASTE/PATH/HERE\"],\n      \"env\": { \"AIGENTLY_TARGET_IDE\": \"cursor\" }\n    }\n  }\n}\n```\n\nRestart Cursor. The server starts automatically.\n\n---\n\n#### Claude Code\n\nAdd to `~/.claude/settings.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"aigently\": {\n      \"command\": \"node\",\n      \"args\": [\"/PASTE/PATH/HERE\"],\n      \"env\": { \"AIGENTLY_TARGET_IDE\": \"claude-code\" }\n    }\n  }\n}\n```\n\n---\n\n#### Windsurf\n\nCreate or edit `~/.codeium/windsurf/mcp_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"aigently\": {\n      \"command\": \"node\",\n      \"args\": [\"/PASTE/PATH/HERE\"],\n      \"env\": { \"AIGENTLY_TARGET_IDE\": \"windsurf\" }\n    }\n  }\n}\n```\n\n---\n\n#### GitHub Copilot (VS Code)\n\nOpen VS Code settings (`Cmd+Shift+P → \"Open User Settings JSON\"`):\n\n```json\n{\n  \"github.copilot.chat.mcpServers\": {\n    \"aigently\": {\n      \"command\": \"node\",\n      \"args\": [\"/PASTE/PATH/HERE\"],\n      \"env\": { \"AIGENTLY_TARGET_IDE\": \"copilot\" }\n    }\n  }\n}\n```\n\n---\n\n#### Cline (VS Code extension)\n\n```json\n{\n  \"cline.mcpServers\": {\n    \"aigently\": {\n      \"command\": \"node\",\n      \"args\": [\"/PASTE/PATH/HERE\"],\n      \"env\": { \"AIGENTLY_TARGET_IDE\": \"cline\" }\n    }\n  }\n}\n```\n\n---\n\n## How it works\n\nWhen you ask your AI assistant to write security-sensitive code, it calls\n`get_security_context` with your intent and the current file path. The server\ndetects your tech stack from the file path automatically — no configuration\nneeded — then returns the relevant security rules and top CVEs to enforce.\n\nWhen you want to set up guardrails for a project from scratch, it calls\n`detect_project_stack` with your project's root files, gets back the detected\nstack, and calls `compose_guardrail` to generate a complete guardrail file in\nthe right format for your IDE.\n\n```\nDeveloper asks: \"Add a login endpoint with JWT\"\n  ↓\nIDE calls: get_security_context(\"Add a login endpoint with JWT\", \"app/api/auth/route.ts\")\n  ↓\nServer detects: stack=nextjs (from file path), intent=auth (from text)\n  ↓\nServer returns: matching security rules + top 5 CVEs (e.g. CVE-2025-29927 auth bypass)\n  ↓\nIDE injects everything into the prompt before generating code\n  ↓\nResult: code that doesn't have auth bypass vulnerabilities\n```\n\nThe `AIGENTLY_TARGET_IDE` env var tells the server which IDE is calling so it can\nreturn IDE-specific rule content and format output files correctly. Set it once\nin `mcp.json` and forget about it.\n\n---\n\n## Tools\n\n| Tool | What it does |\n|------|-------------|\n| `detect_project_stack` | Detect tech stack from root file list — call this first when setting up a new project |\n| `get_security_context` | Get security rules + CVEs for a coding task (auto-detects stack from file path) |\n| `compose_guardrail` | Generate a complete IDE-ready guardrail file for a stack and protection layers |\n| `list_stacks` | List all 11 supported stacks with slugs |\n| `list_layers` | List all 15 protection layer categories |\n| `search_threats` | Search the CVE catalog by keyword, severity, OWASP category, or layer |\n| `get_threat` | Full CVE details + AI-generated guardrail patterns |\n| `get_rule` | Full security rule body + AI summary |\n| `get_manifest` | Catalog version, last updated, and counts |\n\n### Generated file locations by IDE\n\n| `AIGENTLY_TARGET_IDE` | Output file |\n|-----------------------|-------------|\n| `cursor` | `.cursor/rules/aigently-{stack}-security.mdc` |\n| `claude-code` | `CLAUDE.md` |\n| `windsurf` | `.windsurfrules` |\n| `copilot` | `.github/copilot-instructions.md` |\n| `cline` | `.clinerules` |\n\n---\n\n## Catalog contents\n\nThe JSON files in `packages/catalog-data/` are generated by the Aigently pipeline\nand committed here. Updated daily.\n\n| File | Contents |\n|------|---------|\n| `threats.json` | 500+ CVEs with severity, OWASP refs, affected stacks, AI guardrail patterns |\n| `rules.json` | Security rules with full `bodyMdx`, layer and IDE assignments |\n| `guardrails.json` | Pre-synthesized guardrail blocks per (stack × layer) |\n| `stacks.json` | 11 supported tech stacks |\n| `manifest.json` | Generation timestamp and counts |\n\n**Supported stacks:** Next.js, Express, FastAPI, NestJS, Nuxt, React SPA, Django, Rails, Go, iOS, Android\n\n**Protection layers:** auth_session, authz_access, input_validation, secrets_credentials,\ndependency_supply, data_privacy, api_security, database, infrastructure, caching_cdn,\nfrontend_network, observability, resilience, ai_safety, code_quality\n\n---\n\n## Keeping the catalog fresh\n\nThe catalog updates automatically via the daily Aigently pipeline. To update manually:\n\n```bash\ncd aigently-catalog\ngit pull\n```\n\nNo rebuild needed — the server reads the JSON files at runtime.\n\n---\n\n## Verify it works\n\n```bash\n# List all tools\necho '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\"}' \\\n  | node packages/mcp-server/dist/index.js | python3 -m json.tool\n\n# Test stack detection\necho '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\n  \"name\": \"detect_project_stack\",\n  \"arguments\": {\"file_paths\": [\"package.json\",\"next.config.ts\",\"app/\",\"tsconfig.json\"]}\n}}' | node packages/mcp-server/dist/index.js | python3 -m json.tool\n\n# Run the full smoke test suite\nnode packages/mcp-server/scripts/test-tools.mjs\n```\n\n---\n\n## Contributing\n\nThe catalog data comes from the [Aigent.ly](https://aigent.ly) pipeline. To\ncontribute new stacks or protection rules, open an issue or PR in this repo.\n\nTo contribute to the MCP server code, see [DEVELOPMENT.md](../../DEVELOPMENT.md).\n\n---\n\n## License\n\nApache 2.0 — see [LICENSE](../../LICENSE).\n","readmeFilename":"README.md","_rev":"1-dd3900697cac8f4d9b13dff684ff6f68"}