
Company News
AWS Security Hub Adds Socket for Supply Chain Security
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.
compare-cli-mcp
Advanced tools
MCP (Model Context Protocol) server wrapping compare-cli for agent pipelines. Three tools: compare_files, compare_with_negotiation, compare_demo. Stdio transport. Part of the contract-ops CLI suite.
MCP (Model Context Protocol) server wrapping compare-cli for agent pipelines. Three tools, stdio transport, JSON-first responses with optional human report.
Design contract:
../docs/mcp.md. This package ships the implementation; behavior and schemas track the design version.
Part of the contract-ops suite.
compare-cli-mcp has compare-cli as a peer dependency, so install both:
npm install -g compare-cli@^0.3.0 compare-cli-mcp@^0.1.1
Then run:
compare-mcp # spawns the MCP server on stdio
Add to your MCP-client config (e.g. ~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"compare-cli": {
"command": "compare-mcp"
}
}
}
{
"mcpServers": {
"compare-cli": {
"command": "compare-mcp",
"env": {
"COMPARE_MCP_BASE_DIR": "/path/to/contract/documents"
}
}
}
}
Every path argument the agent supplies is then resolved against COMPARE_MCP_BASE_DIR and rejected if it escapes the directory (symlinks collapsed). Without the env var the server reads any file the process can read — see the security note in ../docs/mcp.md §3.2.
| Tool | Purpose |
|---|---|
compare_files | Two-document comparison. Each side accepts path, content_base64, or content_text. |
compare_with_negotiation | Base is read from nda-review-cli's negotiation.json. Returns base.negotiation_resolution so the agent can audit which signal produced the agreed text. |
compare_demo | Zero-arg synthetic comparison against bundled fixtures. Deterministically returns exit_class: "substantive". Use to confirm the server is wired up. |
Tool descriptions, input schemas, and output schemas are advertised on tools/list. The schemas are stable across v1.x of this package; any change is fenced by the snapshot golden in tests/fixtures/tools-list.json.
Every successful tool call returns:
structuredContent — the exact compare --json shape (top-level ok, exit_class, exit_code, base, candidate, summary, differences, warnings). Stable across compare-cli v1.x per its AGENTS.md. This is the contract the agent reads.content[0] — the same JSON serialized as a text block, for MCP clients that don't yet read structuredContent.content[1] (optional, when caller passes include_human_report: true) — the human-readable report.compare_with_negotiation adds structuredContent.base.negotiation_resolution ∈ {"status", "per_round_agreed", "clause_status"} indicating which of the three resolution tiers produced the agreed base text.
Substantive drift is a successful tool call. The agent asked what's different and the server answered. Routing on exit_class is the contract — error envelopes (isError: true) are reserved for I/O / argument failures plus one explicit precondition exception:
| Code | Trigger |
|---|---|
INPUT_NOT_FOUND | Path not found / unreadable. |
INPUT_MALFORMED | Malformed .docx / .pdf. |
PDF_NO_TEXT_LAYER | Scanned PDF; pdfjs extracted zero characters. |
INVALID_ARGS | Schema-validation failure (missing args, oneOf violation, etc.). |
PATH_OUTSIDE_BASE_DIR | COMPARE_MCP_BASE_DIR is set and the path escapes it. |
NO_AGREED_ROUND | compare_with_negotiation precondition: no agreed round found. The CLI returns exit 2 here; the MCP server promotes it to an error because no comparison ran. |
NOT_SIGNED_OFF | require_signoffs: true and signoffs.a / signoffs.b is missing. |
INTERNAL_ERROR | Unexpected; surfaces underlying message so the agent isn't blind. |
Codes are stable across v1.x of this package.
# From the repo root:
npm install # workspaces resolve compare-cli + compare-cli-mcp
cd mcp && npm test # 22 tests, ~100 ms
The conformance + snapshot suite is in tests/test_protocol.mjs. The tools/list golden lives at tests/fixtures/tools-list.json. To regenerate the golden after an intentional schema change (also bump the minor version):
node -e 'import("./compare-cli-mcp.mjs").then(m => process.stdout.write(JSON.stringify(JSON.parse(JSON.stringify(m.TOOLS)), null, 2)))' > tests/fixtures/tools-list.json
MIT. See ../LICENSE.
FAQs
MCP (Model Context Protocol) server wrapping compare-cli for agent pipelines. Three tools: compare_files, compare_with_negotiation, compare_demo. Stdio transport. Part of the contract-ops CLI suite.
We found that compare-cli-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.