Metadata-Version: 2.5
Name: depsentinel-guard
Version: 1.1.1
Summary: DepSentinel MCP Server (Thin Client) for AI Package Hallucination Guard — with real-time layer streaming
Project-URL: Homepage, https://depsentinel-platform.vercel.app
Author-email: DepSentinel Security <security@depsentinel.com>
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Requires-Python: >=3.9
Requires-Dist: httpx>=0.27
Requires-Dist: mcp[cli]>=1.0.0
Description-Content-Type: text/markdown

# 🛡️ DepSentinel MCP Server

[![PyPI](https://img.shields.io/pypi/v/depsentinel-guard.svg)](https://pypi.org/project/depsentinel-guard/)
[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](https://opensource.org/licenses/MIT)

**DepSentinel** is an AI Package Hallucination & Supply-Chain Attack Guard. This official [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server allows any AI IDE or coding assistant (Cursor, Claude Desktop, Antigravity, VS Code, Windsurf, etc.) to automatically verify npm packages across 7 security layers before installation.

---

## ⚡ How It Works

Before running `npm install`, your AI assistant automatically invokes `verify_packages` over MCP. The engine streams 7 independent analysis layers:

1. **🔍 Layer 0 · Registry Existence**: Instant check against live npm registry to catch hallucinated package names.
2. **🎯 Layer 1 · Semantic Intent Matching**: Cosine similarity matching between developer's stated goal and package capabilities.
3. **🔬 Layer 2 · Heuristics**: Typosquatting edit distance, download metrics, package age, and install-hook traps.
4. **🛡️ Layer 3 · Vulnerability Advisories**: Real-time OSV.dev and CVE tracking for unpatched vulnerabilities.
5. **📝 Layer 5 · Static Code Analysis**: Deep AST parsing of source files for command execution (`child_process`), network calls, and token access.
6. **🤖 Layer 6 · AI Deep Code Scan**: Autonomous LLM review of full package source code.
7. **💥 Layer 7 · Detonation Sandbox**: Full runtime sandbox execution with active syscall interception to prevent execution of backdoors.

---

## 🚀 Quick Setup

Get your API key at [DepSentinel Platform](https://depsentinel.neuraliftx.in).

### 1. Cursor IDE
Add to your **Cursor Settings > Features > MCP Servers** or in `.cursor/mcp.json`:

```json
{
  "mcpServers": {
    "depsentinel": {
      "command": "uvx",
      "args": ["depsentinel-guard"],
      "env": {
        "DEPSENTINEL_API_KEY": "ds_your_api_key_here",
        "DEPSENTINEL_API_URL": "https://depsentinel.neuraliftx.in"
      }
    }
  }
}
```

---

### 2. Claude Desktop
Add to your `claude_desktop_config.json`:
- **macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`
- **Windows**: `%APPDATA%\Claude\claude_desktop_config.json`

```json
{
  "mcpServers": {
    "depsentinel": {
      "command": "uvx",
      "args": ["depsentinel-guard"],
      "env": {
        "DEPSENTINEL_API_KEY": "ds_your_api_key_here",
        "DEPSENTINEL_API_URL": "https://depsentinel.neuraliftx.in"
      }
    }
  }
}
```

---

### 3. Antigravity IDE / Gemini
Add to `~/.gemini/antigravity-ide/mcp_config.json` or `~/.gemini/config/mcp_config.json`:

```json
{
  "mcpServers": {
    "DepSentinel": {
      "command": "uvx",
      "args": ["depsentinel-guard"],
      "env": {
        "DEPSENTINEL_API_KEY": "ds_your_api_key_here",
        "DEPSENTINEL_API_URL": "https://depsentinel.neuraliftx.in"
      }
    }
  }
}
```

---

### 4. Windsurf IDE
Add to `~/.codeium/windsurf/mcp_config.json`:

```json
{
  "mcpServers": {
    "depsentinel": {
      "command": "uvx",
      "args": ["depsentinel-guard"],
      "env": {
        "DEPSENTINEL_API_KEY": "ds_your_api_key_here",
        "DEPSENTINEL_API_URL": "https://depsentinel.neuraliftx.in"
      }
    }
  }
}
```

---

### 5. VS Code (Cline / Roo Code / Continue)
In your extension's MCP configuration settings:

```json
{
  "mcpServers": {
    "depsentinel": {
      "command": "uvx",
      "args": ["depsentinel-mcp"],
      "env": {
        "DEPSENTINEL_API_KEY": "ds_your_api_key_here",
        "DEPSENTINEL_API_URL": "https://depsentinel.neuraliftx.in"
      }
    }
  }
}
```

*(Note: If `uvx` is not installed on your system, install it via `pip install uv` or use `python -m depsentinel_mcp` after running `pip install depsentinel-mcp`).*

---

## 🛠️ MCP Tools Exposed

| Tool | Description |
| :--- | :--- |
| **`verify_packages(intent, packages)`** | Verifies one or more npm package names or local `.zip`/`.tgz` file paths against 7 security layers with live streaming. |
| **`quick_check(package_name)`** | Fast single-package existence and health check. |

---

## 📄 License
MIT License. Developed with ❤️ by the DepSentinel Security Team.
