feat(cli): expose application commands over MCP

[kmbroai]

Summary

MCP clients can currently run scans but must switch to the CLI for the rest of the security workflow. This adds the remaining application commands to the same MCP server, so agents can inspect saved scans, import and triage findings, validate or patch them, export results, and publish findings.

Stacked on #682. This PR targets dev/kyleb/mcp-scans and leaves #682 unchanged.

Changes

• Expose 20 additional tools, for 22 total: component and bulk scans; scan history, rerun, matching and comparison; finding history and triage; GitHub import; export; validation; fix verification; patching; publication checks and publication; hook installation; login status and logout.
• Derive typed inputs from the public CLI manifest. New tools accept args, options, and optional workingDirectory; command group names use underscores. Existing scan and info inputs stay unchanged. No CLI commands, flags, environment variables, or defaults change.
• Run each new tool through the existing CLI in a separate process, retaining its environment, credentials, exit status, structured results or raw output, and stderr diagnostics. Cancellation and disconnects wait for CLI subprocess cleanup; artifacts are retained.
• Keep browser/device sign-in, credential entry, shell completions, and MCP/skills installation helpers as local CLI actions. Expose only documented publication destinations.
• Document tool names, examples, side effects, noninteractive inputs, and CLI positional argument limitations. Extend installed-package smoke coverage and package contents validation, with the hook fixture isolated from global Git hooks configuration.
• Install Git and Python in the Docker package-validation stage so its new MCP smoke tests run in the minimal build image. Runtime requirements are unchanged.

Testing

• 52 focused MCP tests passed, including per-request cancellation, subprocess cleanup, inherited runtime paths, and diagnostic failures after shutdown.
• Both full regression suites passed: 1,970 passed, 29 platform skips, zero failures, and 23,980 assertions across 100 files per run (seeds 12345 and 3403824858).
• Three fresh native reviews of the final commit and independent verification completed with no actionable findings.
• Type/model-generation checks, full package formatting, build, and diff whitespace checks passed.
• Packed and installed the final npm tarball. Complete package validation passed with 286 entries, including real MCP initialization/tool listing, scan preflight, history, CSV export parity with the CLI, publication dry-run, and hook installation.
• A separate Node 22 protocol check closed stderr while leaving MCP connected, verified the command error response and a subsequent successful info call, and confirmed clean shutdown. The temporary-directory test also passed with a symlinked TMPDIR.
• All 12 container entrypoint and release-contract tests passed after adding the package-stage dependencies. A real local docker build --target package passed, including the complete installed-package and MCP smoke checks in the minimal build image.
• The complete installed-package check also passed with a synthetic global core.hooksPath; its existing shared hook remained untouched.

Tests use isolated synthetic fixtures; no billable scans, changes to existing credentials, or external issue publication were performed.

Risk and rollout

#682 must merge first; this PR can then be retargeted to main and rebased as needed. Neither PR is merged by this change.

The new tools have the same local filesystem and credential access as the CLI. Some commands can make billable model calls, modify files or stored findings, remove stored sign-in, or publish external issues and pull requests; tool annotations and server instructions describe those effects. Cancellation stops work but does not roll back completed side effects. Authentication setup remains outside MCP, and commands that normally offer terminal pickers need explicit inputs.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-27T22:36:22.609564Z	a073453	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.