@master4n/master-cli - npm Package Compare versions

Comparing version 3.0.3 to 3.0.4

bin/commands/mcp.d.ts

+declare const mcp: {
+    command: string;
+    describe: string;
+    builder: (yargs: any) => any;
+    handler: (argv: any) => Promise<void>;
+};
+export default mcp;

bin/utility/mcp-server.d.ts

+export declare const PROTOCOL_VERSION = "2025-06-18";
+/** Serve until stdin closes (client disconnect). Never returns. */
+export declare function serveMcp(): Promise<never>;

bin/utility/mcp-tools.d.ts

+/** Commands an MCP client may not invoke. */
+export declare const DENYLIST: Record<string, string>;
+export declare const RUNNABLE: string[];
+export declare const TOOLS: ({
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            command?: undefined;
+            args?: undefined;
+        };
+        additionalProperties: boolean;
+        required?: undefined;
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            command: {
+                type: string;
+                description: string;
+                enum: string[];
+            };
+            args: {
+                type: string;
+                items: {
+                    type: string;
+                };
+                description: string;
+            };
+        };
+        required: string[];
+        additionalProperties: boolean;
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            command: {
+                type: string;
+                description: string;
+                enum?: undefined;
+            };
+            args?: undefined;
+        };
+        required: string[];
+        additionalProperties: boolean;
+    };
+})[];
+export declare function callTool(name: string, input: any): Promise<Record<string, unknown>>;

bin/commands/index.d.ts

@@ -51,2 +51,3 @@ import cts from './cts';
 import dns from './dns';
-export { cts, sc, deco, date, epoch, killProcess, update, capabilities, id, hash, encode, random, port, jsonCmd, count, lines, have, sys, repo, calc, semver, caseCmd, cron, diff, env, size, ext, freq, regex, url, ip, escapeCmd, schema, outlineCmd, imports, replace, recent, pkgCmd, dotenv, wait, ports, http, base, clip, notify, openCmd, procs, disk, trash, dns, };
+import mcp from './mcp';
+export { cts, sc, deco, date, epoch, killProcess, update, capabilities, mcp, id, hash, encode, random, port, jsonCmd, count, lines, have, sys, repo, calc, semver, caseCmd, cron, diff, env, size, ext, freq, regex, url, ip, escapeCmd, schema, outlineCmd, imports, replace, recent, pkgCmd, dotenv, wait, ports, http, base, clip, notify, openCmd, procs, disk, trash, dns, };

llms.txt

 # @master4n/master-cli (`mfn`)
 
-> 50 headless, JSON-first commands for AI agents and developers: extract instead
+> 51 headless, JSON-first commands for AI agents and developers: extract instead
 > of dump (token savers), compute instead of guess (hallucination killers),
@@ -15,2 +15,7 @@ > one-call system/code/network facts, and cross-platform OS actions (clipboard,
   (`{ name, version, bin, conventions, docs, categories, commands:[{name,category,summary,examples}] }`).
+- **MCP server built in:** `mfn mcp` serves every command over the Model Context
+  Protocol (stdio) for MCP-only clients — tools `mfn_capabilities`, `mfn_run`
+  `{command, args[]}`, `mfn_help`; `update` is deny-listed. Client config:
+  `{ "command": "npx", "args": ["-y", "@master4n/master-cli", "mcp"] }`.
+  `mfn mcp --json` describes the server without starting it.
 - **Machine output:** pass `--json`, OR just pipe the command (when stdout is not
@@ -113,4 +118,5 @@ a TTY the CLI auto-emits JSON). Output is exactly one object on stdout:
 
-- File-content commands (`lines` `json` `schema` `diff` `freq` `regex -f`) refuse
-  credential/secret paths (`~/.ssh`, `.env*`, `*.pem`, `.npmrc`, …) → `SensitivePath`, exit 2.
+- File-content commands (`lines` `json` `schema` `diff` `freq` `regex -f`) and
+  `hash -f` refuse credential/secret paths (`~/.ssh`, `.env*`, `*.pem`, `.npmrc`, …)
+  → `SensitivePath`, exit 2 (a digest of a secrets file is offline-brute-forceable).
 - `clip` read redacts secret-shaped content (keys/JWTs/tokens) → `redacted:true`.
@@ -117,0 +123,0 @@ - `env` redacts by name AND value shape; `dotenv` never reads values at all.

package.json

 {
   "name": "@master4n/master-cli",
-  "version": "3.0.3",
-  "description": "AI-agent-friendly command-line toolkit: timestamp/date conversion, JWT decoding, port killing, file finding, and directory trees — headless, --json, with a self-describing manifest.",
+  "version": "3.0.4",
+  "description": "AI-agent-friendly command-line toolkit: timestamp/date conversion, JWT decoding, port killing, file finding, and directory trees — headless, --json, with a self-describing manifest and a built-in MCP server (mfn mcp).",
   "type": "module",
@@ -49,3 +49,6 @@ "repository": {
     "mfn",
-    "master-cli"
+    "master-cli",
+    "mcp",
+    "mcp-server",
+    "model-context-protocol"
   ],
@@ -52,0 +55,0 @@ "author": "dwivna",

README.md

@@ -12,3 +12,3 @@ # @master4n/master-cli (`mfn`)
 
-**Master CLI for developers and AI agents.** 43 headless, JSON-first commands in
+**Master CLI for developers and AI agents.** 51 headless, JSON-first commands in
 three families: **token savers** (extract exactly what you need — one JSON field,
@@ -58,2 +58,23 @@ a line range, a file outline — instead of dumping whole files into context),
 
+## MCP server (built in)
+
+For agent clients that can't run shell commands, `mfn mcp` serves the whole
+toolkit over the [Model Context Protocol](https://modelcontextprotocol.io)
+(stdio transport, zero extra dependencies):
+
+```jsonc
+// e.g. .mcp.json / claude_desktop_config.json / any MCP client
+{
+  "mcpServers": {
+    "mfn": { "command": "npx", "args": ["-y", "@master4n/master-cli", "mcp"] }
+  }
+}
+```
+
+Three tools: `mfn_capabilities` (the manifest), `mfn_run` (`{command, args[]}` —
+runs any catalogued command and returns its single JSON object, guardrails
+included), and `mfn_help` (per-command flags). `update` is deny-listed so an
+MCP-only client can never install packages. `mfn mcp --json` describes the
+server without starting it.
+
 ## Quick start
@@ -68,3 +89,3 @@
 
-## Commands (50)
+## Commands (51)
 
@@ -131,2 +152,3 @@ Run `mfn capabilities` for the grouped list, `mfn <command> --help` for flags.
 | `capabilities` / `update` | Machine-readable manifest · self-update | `mfn capabilities --json` |
+| `mcp` | Serve every command over the Model Context Protocol (stdio) | `mfn mcp` |
 
@@ -133,0 +155,0 @@ ### Examples

SECURITY.md

@@ -41,3 +41,3 @@ # Security Policy
 | --------- | -------- | ---------------- |
-| **Sensitive-path refusal** (`SensitivePath`, exit 2) | `lines` `json` `schema` `diff` `freq` `regex -f` | Returning the CONTENT of credential stores: `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.kube`, `.env*`, `*.pem`, `*.key`, `id_rsa*`, `.npmrc`, `.netrc`, `shadow`, … An agent's context window is a log that never rotates. |
+| **Sensitive-path refusal** (`SensitivePath`, exit 2) | `lines` `json` `schema` `diff` `freq` `regex -f` `hash -f` | Returning the CONTENT of credential stores: `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.kube`, `.env*`, `*.pem`, `*.key`, `id_rsa*`, `.npmrc`, `.netrc`, `shadow`, … An agent's context window is a log that never rotates. `hash -f` is included because a digest of a low-entropy secrets file can be brute-forced offline. |
 | **Clipboard secret redaction** | `clip` (read) | Passwords/tokens pasted through the clipboard (password managers). Secret-shaped content (private-key blocks, JWTs, AWS/GitHub/Slack/Google/npm/`sk-` tokens) is withheld with `redacted:true`. |
@@ -44,0 +44,0 @@ | **Env value scanning** | `env` | Redacts by NAME pattern (key/token/secret/…) **and** by VALUE shape — an innocently named variable holding a JWT is still redacted. `mfn env` with no names lists names only. |

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

396057

3.52%

Number of package files

80

3.9%

Lines of code

1239

7.37%

Number of lines in readme file

187

13.33%

No dependency changes