Metadata-Version: 2.4
Name: mantivor
Version: 0.1.2
Summary: Mantivor — MCP security scanning for your hosted organisation
Project-URL: Homepage, https://mantivor.io
Project-URL: Documentation, https://mantivor.io/docs
Project-URL: Issues, https://mantivor.io/support
License: Mantivor CLI — Proprietary Licence
        
        Copyright (c) 2026 Fahad Ali, trading as Mantivor. All rights reserved.
        
        
        THIS IS A WORKING DRAFT, NOT LEGAL ADVICE.
        
        It is pending review by a qualified solicitor and may change. It states the
        licensor's current intent in good faith. If anything here conflicts with a
        signed agreement you have with the licensor, that agreement governs.
        
        
        1. DEFINITIONS
        
           "Licensor" means Fahad Ali, an individual trading as Mantivor. No company is
           registered at the date of this licence. Where this licence is later assigned
           to a company formed by the Licensor, that company becomes the Licensor and
           this licence continues unchanged in all other respects.
        
           "Software" means the Mantivor CLI distributed under the package name
           `mantivor`, including its source code, object code and accompanying files.
        
           "Mantivor Service" means the hosted Mantivor service operated by the Licensor.
        
           "Your Organisation" means an organisation account on the Mantivor Service that
           you own, or are authorised by its owner to act for.
        
           "You" means the individual or entity exercising the permission granted in
           section 2.
        
        
        2. GRANT OF PERMISSION
        
           The Licensor grants you a personal, non-exclusive, non-transferable,
           revocable permission to install and run the Software for the sole purpose of
           interacting with Your Organisation on the Mantivor Service.
        
           That is the entire grant. Installing the Software on machines you control —
           including build agents and continuous-integration runners — and running it
           against Your Organisation is permitted. Any other use is not.
        
        
        3. RESTRICTIONS
        
           Except to the extent that applicable law expressly overrides a restriction
           below, and only to that extent, you may not:
        
           (a) redistribute, publish, sell, rent, lease, sublicense, or otherwise make
               the Software available to any third party;
        
           (b) modify, adapt, translate, or create derivative works of the Software;
        
           (c) reverse engineer, decompile, or disassemble the Software, or otherwise
               attempt to derive its source code, algorithms, or underlying ideas;
        
           (d) remove, obscure, or alter any copyright, trademark, or other proprietary
               notice in or on the Software;
        
           (e) use the Software to interact with any Mantivor organisation that is not
               Your Organisation;
        
           (f) use the Software to build, train, or improve a competing product or
               service.
        
        
        4. RESERVATION OF RIGHTS
        
           The Software is licensed, not sold. The Licensor retains all right, title and
           interest in and to the Software, including all intellectual property rights.
           No rights are granted except those expressly stated in section 2. No right is
           granted by implication, estoppel, or otherwise.
        
        
        5. THIRD-PARTY COMPONENTS
        
           The Software depends on separately licensed open-source components, which
           remain governed by their own licences. Nothing in this licence limits your
           rights under those licences with respect to those components.
        
        
        6. TERMINATION
        
           This permission terminates automatically if you breach any term of this
           licence, and may be revoked by the Licensor at any time. On termination you
           must stop using the Software and remove all copies in your possession or
           control. Sections 3, 4, 7 and 8 survive termination.
        
        
        7. NO WARRANTY
        
           THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
           IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
           FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
        
           The Software reports the results of automated security analysis. It does not
           guarantee that any system is secure, and its output is not a substitute for
           your own security judgement.
        
        
        8. LIMITATION OF LIABILITY
        
           TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE
           LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN
           ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN
           CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
        
           Nothing in this licence excludes or limits liability for death or personal
           injury caused by negligence, for fraud or fraudulent misrepresentation, or
           for any other liability that cannot lawfully be excluded or limited.
        
        
        9. GOVERNING LAW
        
           This licence is governed by the laws of England and Wales, and the courts of
           England and Wales have exclusive jurisdiction over any dispute arising from
           it.
        
        
        Questions about this licence: contact@mantivor.io
License-File: LICENSE
Keywords: ci,mcp,model-context-protocol,scanner,security
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: Other/Proprietary License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Typing :: Typed
Requires-Python: >=3.12
Requires-Dist: httpx>=0.27.0
Requires-Dist: typer-slim<0.22,>=0.12.0
Description-Content-Type: text/markdown

# Mantivor CLI

Scan the MCP servers in your [Mantivor](https://mantivor.io) organisation from a
terminal or a CI pipeline, and fail the build when a scan finds something.

Mantivor is a hosted security scanner for Model Context Protocol servers. This
package is its command-line client: it talks to the hosted API over HTTPS and
does nothing else, which is why it installs in about 2.7 MB from two direct
dependencies (`httpx` and `typer-slim`). The scanning happens on our side, not
on your runner.

**You need a Mantivor organisation to use this.** Sign up free at
[mantivor.io](https://mantivor.io) — the free tier covers one server.

```bash
uv tool install mantivor     # or: pipx install mantivor
mantivor login
mantivor scan --hosted <server-id>
```

## Commands

| Command | What it does |
| --- | --- |
| `mantivor login` | Store an API key (prompted, never echoed, never an argv flag) |
| `mantivor logout` | Remove the stored key |
| `mantivor auth status` | Show which credential is active, without printing it |
| `mantivor scan --hosted <id>` | Scan a server in your organisation |
| `mantivor findings` | List findings, newest first |

`mantivor --help` lists every flag.

## CI

Set `VORLOX_API_KEY` instead of running `mantivor login` — a pipeline has no
terminal to prompt at, and a key passed as a command-line flag lands in the
build log. The variable takes precedence over a stored credential, so a job is
never affected by whoever last logged in on the runner.

```bash
export VORLOX_API_KEY=vlx_live_...
mantivor scan --hosted <server-id> --fail-on high
```

`--fail-on` takes `info`, `low`, `medium`, `high` or `critical`, and is unset by
default.

Exit codes: `0` scan completed and the gate passed, `1` scan completed and a
finding met or exceeded `--fail-on`, `2` the scan could not run at all (no
credential, refused, unreachable). `1` and `2` are kept distinct so a pipeline
can tell "we found something" from "we never looked".

> The environment variables are spelled `VORLOX_*` — `VORLOX_API_KEY` and
> `VORLOX_API_URL`. That is not a typo and not stale documentation: Vorlox was
> this product's former name, and the variables keep the old spelling so
> existing pipelines do not break. They are the correct, current names.

## Before the CLI can scan a server

A **person** must add the server in the Mantivor dashboard and confirm they are
authorised to scan it. An API key cannot do this for itself — a pipeline must
not be able to manufacture the authorisation for the target it then scans. The
server's page shows its ID once it is confirmed.

Your key needs the `scans:write` scope to scan, and `findings:read` to read
findings. Scopes are fixed when a key is created; to change them, mint a new
key. Create keys at **Settings → API keys** in the dashboard.

## Scope of this package

Hosted commands only. Scanning a local MCP server from your own machine
(`--name` / `--endpoint` / `--transport`) is not part of this package — the
detectors are not shipped here. Passing those flags prints an explanation rather
than an unknown-option error.

## Licence

Proprietary. Installing and running it against your own Mantivor organisation is
permitted; redistribution and modification are not. The full terms ship in the
package as `LICENSE`.

Support: [mantivor.io/support](https://mantivor.io/support) ·
Questions about the licence: contact@mantivor.io
