{"_id":"@authpass.ai/mcp","_rev":"2-d53e586ec98632bcb8a75b554e5b86b3","name":"@authpass.ai/mcp","dist-tags":{"latest":"0.1.1"},"versions":{"0.1.0":{"name":"@authpass.ai/mcp","version":"0.1.0","keywords":["mcp","model-context-protocol","authpass","claude","claude-code","security","sast","code-review","findings","false-positive"],"author":{"name":"AuthPass"},"license":"MIT","_id":"@authpass.ai/mcp@0.1.0","maintainers":[{"name":"nicolette.authpass","email":"nicolette@authpass.ai"}],"homepage":"https://authpass.ai","bin":{"authpass-mcp":"dist/index.js"},"dist":{"shasum":"1d335c92927c78e66b2addd5044f056914d72402","tarball":"https://registry.npmjs.org/@authpass.ai/mcp/-/mcp-0.1.0.tgz","fileCount":12,"integrity":"sha512-VACvNdBcYW1f0kSTVDrA/5rDsS6mXRZ1gAm3Jppmk8Pds1vQzAsdWBQKS9mPETOax09d+qFRmjEi+H7gdSUX2Q==","signatures":[{"sig":"MEUCIBdd1l5+iRQJdULSAy/TFlLxSpxGON8CbQp6zcGV+rTqAiEA3T4mGlF2Rf75VqolnoQFlsJxNmH6UOGbaWg9aJY2Dzc=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":40376},"type":"module","engines":{"node":">=18"},"gitHead":"8859918c622ed2c27430431239e7bd1766b10afa","private":false,"scripts":{"dev":"tsc --watch","test":"npm run build && node test/smoke.mjs && node test/integration.mjs","build":"tsc","start":"node dist/index.js","prepublishOnly":"npm run build"},"_npmUser":{"name":"nicolette.authpass","email":"nicolette@authpass.ai"},"_npmVersion":"11.6.2","description":"Model Context Protocol server for AuthPass — query findings and submit false-positive feedback from Claude Code.","directories":{},"_nodeVersion":"25.2.1","dependencies":{"zod":"^3.25.76","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.7.0","@types/node":"^22.10.0"},"_npmOperationalInternal":{"tmp":"tmp/mcp_0.1.0_1782143224549_0.3542630087772616","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@authpass.ai/mcp","version":"0.1.1","description":"Model Context Protocol server for AuthPass — query findings and submit false-positive feedback from Claude Code.","keywords":["mcp","model-context-protocol","authpass","claude","claude-code","security","sast","code-review","findings","false-positive"],"homepage":"https://authpass.ai","author":{"name":"AuthPass"},"license":"MIT","private":false,"type":"module","bin":{"authpass-mcp":"dist/index.js"},"engines":{"node":">=18"},"scripts":{"build":"tsc","start":"node dist/index.js","dev":"tsc --watch","test":"npm run build && node test/smoke.mjs && node test/integration.mjs","prepublishOnly":"npm run build"},"dependencies":{"@modelcontextprotocol/sdk":"^1.29.0","zod":"^3.25.76"},"devDependencies":{"@types/node":"^22.10.0","typescript":"^5.7.0"},"gitHead":"014e28cf970e8056221123b1ebd815a824aa52b6","_id":"@authpass.ai/mcp@0.1.1","_nodeVersion":"25.2.1","_npmVersion":"11.6.2","dist":{"integrity":"sha512-mrno9m3ypIW9tI9zC8c7VjO0DiTHaaAY4v8V7wWiws7pkzasqkqtLIEVqG2N0pGF53WtFTAu0uR/XYVnu9s3kg==","shasum":"256dcc5ee8ca850a3eec97427547adb0bea3180e","tarball":"https://registry.npmjs.org/@authpass.ai/mcp/-/mcp-0.1.1.tgz","fileCount":12,"unpackedSize":41205,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQC8zGKEtnGBz2UN3rFZAQ/ZkMSbTSn8jEyjUNTcbdkKaQIhAOZ3GyPUoLusKeiVH09H31LWZiFkblPkVGcWVcVRK20J"}]},"_npmUser":{"name":"nicolette.authpass","email":"nicolette@authpass.ai"},"directories":{},"maintainers":[{"name":"nicolette.authpass","email":"nicolette@authpass.ai"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/mcp_0.1.1_1782146723604_0.9098161508943645"},"_hasShrinkwrap":false}},"time":{"created":"2026-06-22T15:47:04.426Z","modified":"2026-06-22T16:45:23.941Z","0.1.0":"2026-06-22T15:47:04.683Z","0.1.1":"2026-06-22T16:45:23.809Z"},"author":{"name":"AuthPass"},"license":"MIT","homepage":"https://authpass.ai","keywords":["mcp","model-context-protocol","authpass","claude","claude-code","security","sast","code-review","findings","false-positive"],"description":"Model Context Protocol server for AuthPass — query findings and submit false-positive feedback from Claude Code.","maintainers":[{"name":"nicolette.authpass","email":"nicolette@authpass.ai"}],"readme":"# @authpass.ai/mcp\n\nA [Model Context Protocol](https://modelcontextprotocol.io) server for\n[AuthPass](https://authpass.ai). It lets you query AuthPass findings and submit\nfalse-positive feedback **directly from Claude Code** — no dashboard\nround-trips:\n\n> *\"Hey Claude, review the AuthPass findings on this PR and dismiss the false\n> positives.\"*\n\nThe server is a thin wrapper over the AuthPass REST API. Every call is\nauthenticated with your Personal Access Token (PAT).\n\n## Tools\n\n| Tool | What it does | REST endpoint |\n|---|---|---|\n| `list_pr_findings(pr_url)` | Open findings for a pull request URL | `GET /api/v1/findings?pr_url=…` |\n| `list_open_findings(repo?, severity?)` | Open findings, optionally filtered by repo / severity | `GET /api/v1/findings?…` |\n| `submit_feedback(finding_id, verdict, reason_code, reason_detail?)` | Record a triage verdict (e.g. mark a false positive) | `POST /api/v1/findings/{id}/feedback` |\n| `get_repo_context(repo)` | The repo's `.authpass/context.yaml` (trust boundary, admin routes, compliance, dev-only paths) | `GET /api/v1/repositories/{repo}/context` |\n| `regenerate_context(repo)` | Manually trigger context regeneration — scores two candidate contexts against existing findings and opens a PR with the better one | `POST /api/v1/repositories/{repo}/context/regenerate` |\n\n**`verdict`** is one of `false_positive`, `wont_fix`, `confirmed`.\n\n**`reason_code`** is required and is one of:\n\n| code | meaning |\n|---|---|\n| `out_of_scope` | Code path doesn't run in prod (dev scripts, tests, examples) |\n| `compensating_control` | Mitigated upstream (backend ABAC, WAF, IdP, gateway) |\n| `authorized_pattern` | Intentional, permission-gated access (admin views, support tools) |\n| `compliance_required` | The \"violation\" is mandated by FERPA/HIPAA/SOC2/etc. |\n| `other` | Free-text only — use `reason_detail` to explain |\n\n## Setup\n\n### 1. Mint a Personal Access Token (PAT)\n\n1. Sign in to the AuthPass dashboard.\n2. Go to **Settings → API**.\n3. Click **Create API key**, give it a name (e.g. `claude-code-laptop`), and\n   create it.\n4. **Copy the token immediately** — it starts with `ap_live_` and is shown\n   **only once**. AuthPass stores only a hash; you cannot retrieve it later.\n   (Tokens default to a 90-day expiry and can be revoked anytime from the same\n   screen.)\n\n> Prefer the API? `POST /api/v1/api-keys` with your dashboard session returns\n> the token once in its response.\n\n### 2. Add the server to Claude Code\n\nAdd this to your Claude Code MCP config (`claude mcp add` or your\n`.mcp.json` / settings):\n\n```json\n{\n  \"mcpServers\": {\n    \"authpass\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@authpass.ai/mcp\"],\n      \"env\": {\n        \"AUTHPASS_API_KEY\": \"ap_live_...\",\n        \"AUTHPASS_API_URL\": \"https://api.authpass.ai\"\n      }\n    }\n  }\n}\n```\n\n| Env var | Required | Default | Notes |\n|---|---|---|---|\n| `AUTHPASS_API_KEY` | **yes** | — | Your `ap_live_…` PAT. The server exits with a clear message if it's missing. |\n| `AUTHPASS_API_URL` | no | `https://api.authpass.ai` | API base. You may include or omit the `/api/v1` suffix — both work. |\n\n> **`AUTHPASS_API_KEY` must live in the MCP server's `env` block (above), not in\n> a `.env` file.** Claude Code launches the MCP server as a subprocess and does\n> **not** load `.env` files, so a key sitting in `.env` is never seen and every\n> call fails with `Invalid API key.` Put it in the `env` block shown above, or\n> export it in the shell that launches Claude Code (`export AUTHPASS_API_KEY=ap_live_…`)\n> and reference it from the config — e.g. drop the `env` value and let the\n> inherited shell environment provide it.\n\n> **If the default URL doesn't reach your AuthPass instance, set\n> `AUTHPASS_API_URL` explicitly.** The default `https://api.authpass.ai` targets\n> the hosted AuthPass API. Self-hosted or differently-routed deployments should\n> point this at their own base (with or without the `/api/v1` suffix).\n\nRestart Claude Code (or reload MCP servers). You should see the `authpass`\ntools become available.\n\n### 3. Sample prompts\n\nOnce configured, try:\n\n1. **Triage a PR:**\n   > \"Use AuthPass to list the open findings on\n   > https://github.com/acme/web/pull/128, then explain which look like real\n   > issues versus false positives.\"\n\n2. **Dismiss false positives with rationale:**\n   > \"These AuthPass findings are all in `tests/` fixtures and never run in\n   > prod. Submit `false_positive` feedback for each with reason_code\n   > `out_of_scope`.\"\n\n3. **Review a repo's posture before triaging:**\n   > \"Show me the AuthPass context for `acme/web`, then list all open\n   > high-severity findings and flag any that contradict the repo's declared\n   > trust boundary.\"\n\n## Errors\n\nIf your PAT is invalid, expired, or revoked, tools return a clean error\nmessage telling you to mint a new key under **Settings → API** — never a stack\ntrace. Network failures (wrong `AUTHPASS_API_URL`, no connectivity) report the\nunreachable URL.\n\n## Development\n\n```bash\nnpm install\nnpm run build        # compile TypeScript → dist/\nnpm test             # build + smoke test + integration test (mock API)\n```\n\n- `src/index.ts` — entry point; sets up the MCP server over stdio.\n- `src/client.ts` — typed REST client wrapping the AuthPass API.\n- `src/tools.ts` — the four tool definitions and handlers.\n- `test/smoke.mjs` — drives the built server over stdio (initialize, tools/list, tools/call).\n- `test/integration.mjs` — runs every tool against a local mock API and asserts each hits the right endpoint.\n","readmeFilename":"README.md"}