@getcordon/cli - npm Package Compare versions

Comparing version 0.2.0 to 0.2.1

package.json

 {
   "name": "@getcordon/cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "mcpName": "io.github.marras0914/cordon",
@@ -5,0 +5,0 @@ "description": "Cordon for MCP — security gateway for MCP tool calls. Firewall, auditor, and human-in-the-loop approvals over any stdio MCP server.",

README.md

@@ -1,1 +0,64 @@
-cli stub
+# @getcordon/cli
+
+The command-line interface for [Cordon for MCP](https://github.com/marras0914/cordon), the security gateway for MCP tool calls.
+
+## Install
+
+```bash
+npm install -g @getcordon/cli
+```
+
+## Quickstart
+
+```bash
+cordon init      # reads your Claude Desktop config, generates cordon.config.ts,
+                 # patches Claude Desktop to route tool calls through Cordon
+cordon start     # launches the gateway
+```
+
+Restart Claude Desktop after `cordon init`. Every MCP tool call now flows through Cordon.
+
+## What it does
+
+- Scans `claude_desktop_config.json` and generates a starter `cordon.config.ts`
+- Patches your MCP client config to route through Cordon (opt-in, backed up)
+- Runs the gateway as an MCP server that aggregates your existing upstream servers
+- Enforces per-tool policies (allow, block, approve, read-only, log-only, hidden, sql-read-only, sql-approve-writes)
+- Supports closed-world tool catalogs via `knownTools` so new upstream tools don't silently become callable
+- SQL-aware policies parse the statement in tool-call args and decide based on type (SELECT vs DML vs DDL)
+- Surfaces approval prompts in the terminal, or Slack via the hosted dashboard
+
+## Config example
+
+```typescript
+import { defineConfig } from '@getcordon/policy';
+
+export default defineConfig({
+  servers: [
+    {
+      name: 'database',
+      transport: 'stdio',
+      command: 'npx',
+      args: ['-y', '@modelcontextprotocol/server-postgres', process.env.POSTGRES_URL!],
+      policy: 'read-only',
+      // Optional: declare the exact tool surface you expect. New tools in
+      // future upstream releases get blocked until you add them here.
+      knownTools: ['query', 'list_tables', 'describe_table'],
+    },
+  ],
+  audit: { enabled: true, output: 'file' },
+  approvals: { channel: 'terminal', timeoutMs: 60_000 },
+});
+```
+
+## Full documentation
+
+Complete policy reference, approval channels, audit outputs, and architecture overview:
+**https://github.com/marras0914/cordon**
+
+Writeup with real-world examples:
+**https://dev.to/marras0914/mcp-has-no-security-model-heres-how-to-fix-it-in-2-minutes-5f7o**
+
+## License
+
+MIT

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

87105

2.5%

Number of lines in readme file

65

3150%

No dependency changes