From 6ea6d6ecf85d7f7e80fc8cfcfd527542cf2feea5 Mon Sep 17 00:00:00 2001 From: Jerod Santo Date: Fri, 2 Oct 2026 16:52:20 -0500 Subject: [PATCH 1/2] feat(mcp): prepare ChatGPT plugin Package the server for ChatGPT with explicit tool metadata, replica tests, and a short publishing checklist. Assisted-by: Codex:GPT-6 --- docs/chatgpt-plugin-release.md | 50 ++++ lib/tool-alerts.mts | 6 +- lib/tool-depscore.mts | 8 +- lib/tool-organizations.mts | 6 +- lib/tool-package-files.mts | 18 +- lib/tool-threat-feed.mts | 6 +- lib/tool-types.mts | 4 +- plugins/chatgpt/assets/icon.png | Bin 0 -> 69051 bytes plugins/chatgpt/mcp.json | 9 + plugins/chatgpt/plugin.json | 101 +++++++ test/repo/integration/http-replicas.test.mts | 259 ++++++++++++++++++ .../integration/server-schema.golden.json | 28 +- test/repo/unit/server-tool-list.test.mts | 20 +- 13 files changed, 495 insertions(+), 20 deletions(-) create mode 100644 docs/chatgpt-plugin-release.md create mode 100644 plugins/chatgpt/assets/icon.png create mode 100644 plugins/chatgpt/mcp.json create mode 100644 plugins/chatgpt/plugin.json create mode 100644 test/repo/integration/http-replicas.test.mts diff --git a/docs/chatgpt-plugin-release.md b/docs/chatgpt-plugin-release.md new file mode 100644 index 00000000..d6cb622d --- /dev/null +++ b/docs/chatgpt-plugin-release.md @@ -0,0 +1,50 @@ +# ChatGPT plugin release checklist + +Use this checklist to prepare and publish the Socket plugin. Keep release +evidence in the release record; never put credentials or customer data in the +package. + +## Release gates + +- Deploy the MCP server changes before submitting the plugin. Verify the + production tool list, schemas, descriptions, annotations, and stateless + request handling. +- Complete OAuth sign-in for `https://mcp.socket.dev/`. Token introspection + must return an `aud` claim naming that resource. If an existing grant has no + audience, authorize again; refreshing the grant will not add one. +- Use the least-privilege scopes supported by the integration. Verify that + organization data belongs to the signed-in account. +- Use a dedicated reviewer account with synthetic organization data. Never + use a customer's account for review. + +## Package and portal + +1. Validate `plugins/chatgpt/plugin.json` and `mcp.json` against the current + OpenAI plugin schemas. Confirm every referenced asset exists and uses the + approved Socket brand asset. +2. Build the upload ZIP from `plugins/chatgpt/`, with `plugin.json`, `mcp.json`, + and `assets/icon.png` at the archive root. Keep the generated ZIP outside + the repository. +3. Install the package in ChatGPT developer mode and sign in to Socket. + Exercise the positive and negative review cases in `plugin.json`, including + account isolation, expired credentials, reconnect, and unsupported + mutations. +4. Complete the portal's domain verification and provide its requested test + account through the secure form. Resolve validation findings and record the + acceptance results. +5. Submit the reviewed package. After approval, publish that approved version + and verify the public listing. + +## Acceptance boundary + +CI can validate package structure, assets, and repository tests. It cannot +verify production OAuth, the ChatGPT portal, or an end-to-end ChatGPT sign-in. +Record those checks separately before calling the integration ready. + +## References + +- +- +- +- +- diff --git a/lib/tool-alerts.mts b/lib/tool-alerts.mts index 2058c356..2770e38c 100644 --- a/lib/tool-alerts.mts +++ b/lib/tool-alerts.mts @@ -94,7 +94,11 @@ export function defineAlertsTool(): ValidatedToolSpec { description: "List the latest security alerts for a Socket organization with the `alerts` tool. Requires `org_slug` — call the `organizations` tool first if you don't have it. Supports filtering by severity, category, status, artifact type/name, alert type, and repo. Use this to surface supply-chain, vulnerability, quality, license, and maintenance issues across the org's monitored packages. Results are paginated — pass the previous response's `endCursor` as `cursor` to fetch the next page.", ...alertsSchema, - annotations: { readOnlyHint: true }, + annotations: { + readOnlyHint: true, + destructiveHint: false, + openWorldHint: false, + }, async handler(rawArgs, extra) { // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- MCP SDK hands tool args over as an untyped record; the tool's inputSchema constrains the shape and the handler validates fields at runtime. const args = rawArgs as unknown as AlertsArgs diff --git a/lib/tool-depscore.mts b/lib/tool-depscore.mts index aeca4f1e..d9c70a3a 100644 --- a/lib/tool-depscore.mts +++ b/lib/tool-depscore.mts @@ -103,9 +103,13 @@ export function defineDepscoreTool(): ValidatedToolSpec { name: 'depscore', title: 'Dependency Score Tool', description: - "Get the dependency score of packages with the `depscore` tool from Socket. Use 'unknown' for version if not known. Use this tool to scan dependencies for their quality and security on existing code or when code is generated. Stop generating code and ask the user how to proceed when any of the scores are low. When checking dependencies, make sure to also check the imports in the code, not just the manifest files (pyproject.toml, package.json, etc).", + "Look up Socket scores when evaluating or adding dependencies. Returns available 0-100 supply chain, quality, maintenance, vulnerability, and license scores, plus report links. Lower scores mean higher risk. Use exact versions; ^ and ~ are stripped. Use 'unknown' to let Socket resolve a version, which may differ from the installed one. Missing scores are not a safety verdict. Scores do not list individual alerts.", ...depscoreSchema, - annotations: { readOnlyHint: true }, + annotations: { + readOnlyHint: true, + destructiveHint: false, + openWorldHint: true, + }, handler(args, extra) { // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- MCP SDK hands tool args over as an untyped record; the tool's inputSchema constrains the shape and the handler validates fields at runtime. const packages = args['packages'] as DepscorePackageInput[] diff --git a/lib/tool-organizations.mts b/lib/tool-organizations.mts index dc735506..3ae1c577 100644 --- a/lib/tool-organizations.mts +++ b/lib/tool-organizations.mts @@ -25,7 +25,11 @@ export function defineOrganizationsTool(): ValidatedToolSpec { description: 'List the Socket organizations the authenticated user belongs to with the `organizations` tool. Use this to discover the `org_slug` values needed by other org-scoped tools (e.g. `alerts`, `threat_feed`), or when the user asks which organizations they have access to.', ...organizationsSchema, - annotations: { readOnlyHint: true }, + annotations: { + readOnlyHint: true, + destructiveHint: false, + openWorldHint: false, + }, async handler(_args, extra) { logger.info({ tool: 'organizations' }, 'tool invoked') const accessToken = resolveScopedAuthToken(extra.authInfo?.token) diff --git a/lib/tool-package-files.mts b/lib/tool-package-files.mts index 4995fde2..270cab09 100644 --- a/lib/tool-package-files.mts +++ b/lib/tool-package-files.mts @@ -163,7 +163,11 @@ export function definePackageFileContentsTool(): ValidatedToolSpec { description: 'Read a single file from a package using the `package_file_contents` tool from Socket. Pass the `hash` printed next to each entry in `package_files` output. Returns up to 1 MB of UTF-8 text; binary files return metadata only.', ...packageFileContentsSchema, - annotations: { readOnlyHint: true }, + annotations: { + readOnlyHint: true, + destructiveHint: false, + openWorldHint: true, + }, async handler(rawArgs) { // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- MCP SDK hands tool args over as an untyped record; the tool's inputSchema constrains the shape and the handler validates fields at runtime. const args = rawArgs as unknown as PackageFileContentsArgs @@ -219,7 +223,11 @@ export function definePackageFileGrepTool(): ValidatedToolSpec { description: 'Search a single file from a package for lines matching a JavaScript regular expression. Pass the `hash` printed next to each entry in `package_files` output. The file is fetched from Socket once per session and cached, so repeated greps on the same hash skip the network. Returns matching lines with line numbers (grep -n style); binary files are refused. Useful for locating a specific symbol, import, or string inside a dependency without dumping the whole file.', ...packageFileGrepSchema, - annotations: { readOnlyHint: true }, + annotations: { + readOnlyHint: true, + destructiveHint: false, + openWorldHint: true, + }, async handler(rawArgs) { // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- MCP SDK hands tool args over as an untyped record; the tool's inputSchema constrains the shape and the handler validates fields at runtime. const args = rawArgs as unknown as PackageFileGrepArgs @@ -311,7 +319,11 @@ export function definePackageFilesTool(): ValidatedToolSpec { description: "List the files published in a package using the `package_files` tool from Socket. Returns a tree of file paths, each with its size and blob hash, for any package on a supported ecosystem (npm, pypi, gem, cargo, maven, golang, nuget, chrome, openvsx). Useful for inspecting what a dependency ships before installing it. After calling this, pass a file's `hash` to `package_file_contents` to read that file, or to `package_file_grep` to search it for a pattern.", ...packageFilesSchema, - annotations: { readOnlyHint: true }, + annotations: { + readOnlyHint: true, + destructiveHint: false, + openWorldHint: true, + }, async handler(rawArgs, extra) { // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- MCP SDK hands tool args over as an untyped record; the tool's inputSchema constrains the shape and the handler validates fields at runtime. const args = rawArgs as unknown as PackageFilesArgs diff --git a/lib/tool-threat-feed.mts b/lib/tool-threat-feed.mts index 89926331..b72d58ee 100644 --- a/lib/tool-threat-feed.mts +++ b/lib/tool-threat-feed.mts @@ -109,7 +109,11 @@ export function defineThreatFeedTool(): ValidatedToolSpec { description: "Look up items in the Socket organization threat feed with the `threat_feed` tool. Requires `org_slug` — call the `organizations` tool first if you don't have it. Returns recently flagged packages (malware, typosquats, obfuscated code, etc.) along with a `nextPageCursor` for pagination. Use `filter` to narrow the threat category (default `mal` for malware), `ecosystem` to scope to a registry, or `name`/`version` to look up a specific package. Pass the previous response's cursor as `cursor` to fetch the next page.", ...threatFeedSchema, - annotations: { readOnlyHint: true }, + annotations: { + readOnlyHint: true, + destructiveHint: false, + openWorldHint: true, + }, async handler(rawArgs, extra) { // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- MCP SDK hands tool args over as an untyped record; the tool's inputSchema constrains the shape and the handler validates fields at runtime. const args = rawArgs as unknown as ThreatFeedArgs diff --git a/lib/tool-types.mts b/lib/tool-types.mts index 6c9adbd4..3847e388 100644 --- a/lib/tool-types.mts +++ b/lib/tool-types.mts @@ -43,9 +43,7 @@ export interface ToolInputSchema { } /** - * Tool annotations the SDK forwards to clients. The only one socket-mcp sets - * today is `readOnlyHint`; left open-ended so future flags don't need a type - * bump. + * Tool annotations forwarded to clients. */ export interface ToolAnnotations { readOnlyHint?: boolean | undefined diff --git a/plugins/chatgpt/assets/icon.png b/plugins/chatgpt/assets/icon.png new file mode 100644 index 0000000000000000000000000000000000000000..2f2b56c8ca8010128ddf0526c55d30e006ee60b7 GIT binary patch literal 69051 zcmeFacU)8V_dgz7sECNPqM}4ar4CFLFd~qMXsIHgr4~^jbs}OxL1bm%0x2rBD9DV6 zidG>iBC-->2pAzKNR$;IgfKIK?0bJVxLQAL-wMID-^cF{n?86bH|L)9JkN7p=M}!$ z-bQoc%!x1%N1*MnV5O3O0Tm^wAekBZaAH9^bIe>id9%9)(7gmt<>`I!9#Q z_+58xV-6#yM0+iA{^i397Z#iDzPWfIf77pC2QAJq1Gf7t4wx0+v9>4n>I${TtT-P# z3xkD@H|JN*Z_Iu*?qFi*^gC*|N@i25&N5#%thnzuZs+`z=#x`!egeDy9F{3$Wj!+nI}Ji1HYFQ&8WgUh{~%?h$8e!+@FCRhv{Sxatj4{-Ay8b0iG< zft~M!PQ4K52iLPt_Gzwxeo*bQRyyvo@?R~RiyK{~{8ur*kk$4N{+e(9|6lX(eK#?u z;rK>|EZ>C8C*^s}NT`esBVo|NeKWEe1W_1(w*e5KsQ3^BCC6ASh1QR+~6Dx8{;P;!?lh2KO>@ zW#Qe_dWTe&oyJoP?^!c4TkVkWt_#{Iat^5xE9{J?2wLdqdnR_m3-id;@z=9k0y|!S z)vl37kqjz=A8gO2ZUw(fJ!zU?b3(^>IzC=DeS1Q5H&s&P?(QzKlwD6{Fu=IW9!WEw zdh@S)cvfyaL^p$+*d6m=-}H^!tXVxi&!4UoEx&)m z)qlb&^bY;?81o&KBn1~JrCS!<@QBkpEw=ZHYv)J~i5 zGjLaS40syU@7W44{kJz`>MoRFp33JX9TZNvm_glOT;EVyb>(Q|f;m3$a+NOYM{IjI*9$f-D6Qs1YIP@h zZ}ye=V>U6@JtkY@vR2v&1DR|R>WIuH+K|((+i6MdJfdZQkDW+ff3xZcK4l@W*EYON zvfeW9W&7L@CE9iFY4_<~&r=!IIJw~rI-XHP;!qG(ChC{T*74UR2|`ginak;>cIuP0 z`)!E?k`_}pHB$}>sMTrPxBe+$IBG`$o zHX*8ancw$_qfG#-Uxaajb_L3tNwzk@4p`02$^}JByXu#bH z>+dU<8CD$hgZ=!H1u-q+_4_UKnzl2pe7|2>c9QVwyLmqNN0Si`0#84A z#kv~%6KD7SExDYjQ?es383`ThDn9HHi2$x zCyccL-9S2t(8@8imm)gNf~!Zd9yp(df z`3mOb>f1X%cxnqfbzPeUo3|@I>_&pCecY>dROqzK?qzD{Wv9(nkPIG>zT|OE*rEEK z@*S<)3u#tcE0-mer;ukn^vMA+l4s^{7f4bgeioGXgYg6B-~rX0(pUL(1*3?NlSt@_ znanT)){o&+OVy3<+-}5?pWjii#ue@8K0N3kL?YycpCI#Avs^K(qMR}>;3U5H`Vw~$ z2*-=hg~dWbZ+Pk*f89eIDaHWS{+4)!+>N}P)1q6p6&F$U;>Z2RM2LB-{DqGuE%o$Q z!8<^$@qK>9Hes3H$ zihtf@PvzG*jX|L<9oyT>5nc@KMIfiYvv)b#9L-@lYhnFB)}!`ci?Y6{c0u*UNTM-dStFY|gVGm+G-8@RqPUDP z!h0lKVft;;z;YfV;P9sf_n;`Yv1lMhZ<2Rf>6YY9106hmJ=yNmOf;_u!3FOnw|{rV`_%Pp6S+Ks0(#-~8j75N z9j!5=C{tE>Jchnfh3`pox3J6tb~+*XYCG|l%v_q&%maqZuI zO&%TBev?Y0@WME&%`FF3;+wk}-3$&Qc%r6!ZS&O`M^_zdH!GY?D%#%ci^M03e;gOB z`tN2HG3)Nq$OMd8e)khQwtUHPKsKtvQIAl9tZ+OlqO@5$q4~wH>MI@CBAyO-0Dp}r zq|LLwcC<7i0>9|tTTOm30-8KUGT49K;K%mV>JzD~9`X_-<7vej5O=KoW~ul)?>If8 zmMf0d3zxj~L11dV%@Ps*74SCciqv8=@a5*4jr_vg2 zD_crdYHcygO)$x*z)dnbKzAKAPo(X;$Ia#-W=V6SdOWrxmYEv*^c3;LZwap0koK$V zV=k}N@X6!(jWO~W<8p~;Pq$AM%77}ZysJ=V6J9um=)InO_!&YGi947rljnf>WWWG_ z8qr;$<+Jf=!p7cnx=ml2(6l)Lvuj5YbNLo;{c;>W`_Q-~P1QKV>sQ#^nqZv}Z9^hP zd%8Q>Gvoy99q2py?lva>7T^B3RW}LD;9S{?D9fIl`pi=g+-vQC&XoX4r#U+clWphg0>!;bG=y|9qNYl%x?94q zWtbfPi2&zap~=@npJ-pWWOlJ`HX?7y{v?A2{_5LfQU1(8?AN2Ib&c#Ln)Mj3uk$kX zZBAW}+$5HK8XnkuF(X2&D&c;|)bICOozo?syS)BfNQCb>t2URgYF^#OC1}?ajEoM) zK2kv8=T3q+)njr=m=}T88)@Xwpb&cmnqw~eztEz;(ArKu!cU*x&OE`9VR%bWxwdS&zysnZy(Wp=(_w=T)_m|TEp1S|m(({&nDU&&!C z^;^yA9wEdyM5EX$!7Max=3<-8yV}1$;Gf4!zZ`h(P-*v_Y2t>nZ2sFs+$Q@%<$kt% ziW$AdB=5oVw$%m3w(Q8N^u*{48Q5`xhP$-08r#H=aj(Xb#Ra_#;dQ8l%r6TT`{XHR zoo~}pm=!rx#CXZ)RL=Scn-<_E(p2w(3EhWgy6y1rncW=ATAhWTewblL6~Msq0t4G> zY!XlT-IqzKdI{a>rRhXQF#bVP%xG>X^Hwdtmb|Qa?ujASz2t&G10gV><@8IYA0( zC#O5LdWX2&KZYQd+#=!Uq!U*CEKf$ei*NQnJY72J-=PcylrK7LvN@U6uP%Cu@Z2;7 zW@Qc5{xpevU9$8t<*BGxhuF;MmVr(fkXK|(ZWA9vlBHehSMbyAHRD~65w}N11U&t^ zre?F*@xKl2a~Y|;gDL|)5V&|3En6}#E~Kj^Ij0Msa{{0c(qW@5O2lOQfIBGcS6aqD z#nC46U(ij6R;a!NE;*h+B50w@n^xd2+X>XO-J@?M96a!{XQI3&$fbDq$AnS|>XiF1 z(f)>rWmc!AwFR_vkKf)l{^2V2^mUbft29YzCfSpDPkj<&j+Sb89&_mJPN;;pKxMRN zw&1>cleCc*02P6>IoMOC6;V(TO$e0pgJ}+IZ|6#y7Y)9v8@_)Y;g{fj*-y%^hgPH) zIHZ-Xx7hb@@frU-C{EUpCokA_H0V(Fy$1iFc3=H~?#$|xNl;l-UARdfM@eqH6|2X zr9>o!<9c@UZ9#0dEyfD4G8G#UR;>l*h@SdfjI#Tey3kGB?2W~ftbgj4q+IfJiq7y> z(p=aa-hvtvVqBz!(7VAdSOa~ClZ*gb=I?hb@|F~7|NEV3^E}8GNG}|MIt=<`UaQS> zDN00Le+-d)J^NB*lVG;@YP5OdEsQi(SlxT(u@*WA-&u7%w5&Vq5`M9rrsPC}F?Fl` zO4EZ!$KnrIE^A$0wAs;`HU4i=cPN%vsN$L+!FSR;_UeRC`VVm~>H+(*D{Ub>omr4N z;P;ib@uW<8*Yu6WJ$+x(bGYs97EB;(&>nRj$84$|1E;WZ(@}?mdVZqQVuHn#Md@8j z_Q=k>hvwkh=bo9xM*8dIj?9E&qIu%laHHMi(2a5gCO#G(mP4@C?7axcfMgw~A zY>|95s10@=(KWyyI)l)x6VEL~ckF)}df86%JY8!!o_AqfI&A|RUi;&}-WlIYd$W;N z319DGj;Z8;Q4GZy^_ceOMKRy{I!nYxS`EQ?JYEZJ!FeT;ABs zzW&j6ZCXCGrA}tAYVN%H@?QrPGZ~Wm zVf=~(#h3{dtQKZgp3IKgU!70a1#RS6#xv1XW6)oP>Z9kItkw9hi@jw3apGZC=KvbJ;2wDKqGm>5|S%E}7XrQXgr;)R{yTAeNN4(waj_?#*_Yc)mbK5^gF(O82sg&QVonv)jXSm60_1d zKIugs0Y6}BcZ8jMiz6$#)Z@zFZ4e^%xp#AC#uA=m z_hIeG8UKdLmFnjPaTE|Ykx8-+hj3i}52ebi{6~@{?`W)rkD}*D?~{x1T+oqjuN7tD zpe;Tfub1cx7yzYk3Le2o^JeP}9L4=6jGwN9zB5M2`;3CxG%jH}`*nN0-jEZJ9fbck z;A5Sq-=qZ)lk*`rMs|N5Mj|HWcmKq|S1TsP=_Nqz5aibm35rbbhxqN}!!yKs(Q%C8 zOXBt~2YK_CZPv2Y$B#batbAQmRCrvQ`(LODLX!u!&mOdi4+x=nuJbCiIianmr>~Zj zdsKMB*0*RXaldcTVZ1Px8`K(Z*mO2edKJH_a3Q=7BK;zcX1((_M{DvA|FvZIJN`~+ zslkqJ%0G%{J=wu{M%c*ZUg#P7Hz3A08>e#3^?Fxt# z#m%S-Y@BdvJ$PC6G1$aJP@gaJegfkUqj{&>E?npFHB@H_n@Ev;A&M2+k?(uc& zbL$h{5`{PCVs8D*$&EMl*m7n0{9)fhl619WxL#bWCj^!1a1>uA^y^!uy??5D+ZV80$Q2a8*p)1Vb|4mnS&h5sUnO9RL1|0I3 zOcNK!8TjI>v&fzDaF%76_;U*{toC8mX0X1Cd*H$yys(a;_SAXIi3Dnv^YcGPkfqK&jD8Q|6eO)KoKisWp(v{qErbicq1 zyiNG_v|)ddHUxv99*yh$+={o&j`*2^%peuhg0+$~ip-hX4Wj**A{&EFl}~Gg$xmb{ z3I$@D^k5|77y1+Bu+$$%Oa50Y=`Fwho-6!YT#$9U(V^18-QAmo9{bSSW3nCeMs}KE z#QtDvDM8<(QsS<#Ui`8J>TWH+n^-~Kz z3t-yRj*-$ShXPk3)rdb60j(yA{P}3ORS8qD{ZpE_e`p~oyB2>=6?}-Ept%Nzn$C;z zR9NKFik;yOx6PI|z$}WjD7n8Zq+~a!wf}T8tV#OmKpDMD#r*RYJe!Db z@nI8#=5icUz%QCh!7B9HM6pez`qlKPkDCnm7#8ra@(M?&;}^692@@H;ekJqerC=6< zx*J{x@J2(UVDTxR`;7$FQHc+*GeA1%-49m~R&W)+65G#cv}FncU(ZF3Xh=ob5G%O^ zcIFaq=eVN6)S6irA-`c1OOkrE(9rbX1GBhy!xb zdiD(JMybVP_d{gGvbx6h*CPlmnGoT<-7>>PmGsFDFGVBGrRfm3WI0hEH~Q=54?1^m z+75qL1VCdV7A8p8+&Js!@XBLm7@!L&(8d)Fgu$U{n)+FGpE7+(L%B-F z{a7$KR`97oJFtVSwrZuKW!5FK8gFfdO6ZzAW_O=1=yp=tH+1t!mW^wE*%#*fqjX$> zhH268yNPHchhRwsl`AFFFB9DRGz&uhu7~m0(W?qK`p`jXk=fU{(aopgT82;U5u@oK z-6^IXFUqK*82@_|`IIO_H00zBfU=1-+yt`PbZFY<(;*U0KgSz(&W^B3{kk_SZ?o~R zTit83fiOI|uMuJin^DI95`(%e%-BI%>W^c1qSL^;M2GbZ*rbnV@qbsep|l#2u+r=3gwfSV znA;6#o@rS9<{|l5xjE?8#1qK#n(y_Jwl2=5Gc2XE( z?pTOKjiEpfln?&l1iV(_OKyEd^#tpkl2OQiKJ#t{7H|U7($0(!}08RhL6;&IsDIy5}^qWCQ{N3*5ogttw|E#qPoI&8nLFAt279#qe)lYCgLA0J2LlI{| zweUX&o9zek(BeE+7bajVNBB>I<-U6fjYq2mq3RT|uK+zDyxB2iwsH7$ky~^O$lz>q z>xd0agveMjBvwv3eoU^z1Li z5aa*rkf_%RrW+r`mIxqc#`fJErt1v(YakRo1dbV1S0N&OGdpsa28-QTF?UFGz;luU z?v`c2Ttnb{+YPTaS~yhu5bIKUuTgEq>>I-{3?;eT>Ud!Ch9Qt`JcnGS2h~$d0Z6lY z5J1{6$@ig}L<g?x5kYu4^_!^|#2)J0W~Gv+2mESgz!_n&zOaruCHQyFDc!0N7- z|A;aCtefvj;B)uhU=Fjy3wO9_Hvf}59f88x4opxAPOUj>^-p*sTNhx_#S}67o8;jE zEgj-_zTbXg2kNpYu-mDT?4qE#oytA@55(m`P}N1@OZ8g+nJAFgF&nYN4SPafLNOhB z(jM$Ph%Z3R)=y%spJ!qD#?ej$w%%ssF#5bheL6|Lgp{AG0=DOqb75ddJ*8bjoee%) zvIV*Dv%mLhpQGIuS(#|@f-nFslYIZ#;nW8@e|enDNs#%^K&P=Cq&7`tYylOQ)KBE;LU)I8AdPeQ*)gw z3nNbSc1hxg>VdxbQ$w1vj zZ-`UE52F?6`4?1x%^q7Ke9ngh>o#q0n}*jJK*h8}U1>`B!p z;(Z6IFc}0Q%|inW$)5zSU)^hv|D1}z^jZ5SC)IsUT_1FI;~SAMN&OeIu6))f-?iw* zU^zZ)0)J+WBk}W@7_^uR;(1J71vYs4HTiIQd7tt`irAI3-AiVTSnKNbIYev_&=@%lk~Hr%$j@Oi9QlqI+2_gH zgeE#8+X77V-!*f@{co+}x|0Piu!JGMXA2H%9`++);ATQ6K~l$h1wI#Uu^VypwH6AY z=e&ara-2sTTeoW9d;E=%j6jVXXCV&`VxqMuT>2I!?FnJutP^tix;7>)Xk-tAd|di& zr^%#FJO{9Z5+N=Hd&8nZ2?7iIlJEoH{qgcLn!`F2aQlC*_Z;3Ko{zE>*KA=Y^#xqU z_%SXbKyKi$6g?m#B;ga$$Y$C>Kw^c*&lB+7Eun)?f4=ti-KNjC2a5+c5PssI=|^Sk z-o5f*&|NOf+8M_W_=x{@01j{|z_t`bfA9P$1bSIZxnPQxRCuaB~4YloC2_ zM4t=1B8b;RyiNbiO}?)rFJ;7SEp|G2TpA%jV#APhtKbVL&qn->=tv6RnL3*x zV|83#gcmb{k4Q?mpe8Pymsz;{G-(MLSXD73V|#s)?5`!3?qvki1${`AUZY8gKfXde z8WRlqjremH;JWE#Y#;zCG`83|Vw;m4mU0!<@U_P%Kdgdmyo3%(k+$ODLf z-OO_9yg=49`AV>Fd-1RDqTy_lIzoed|XB9tl9=kiTdT5zq z@KDTOk-$qx0aC#|uEIS!1Bf7081fqln?Y}a!$FFdQo9Kxw0#DUGoR`@xFz`Gw-~%R zqW2e^ky`*m7eSLN5Nk~B_*x(V<!8i-TrBmYkz~|K?nu5eXPI)sRNXXEs!SK^d@( zL@@lh>M^CLpO010&nnj^3j0evh8UiGNApu(69YWit=6Ie1?vSLw!6I}N*`*eP?DsQOMR@p= zH@pMv(OsIQh`nW7eH*er0#gV8&>gR%THxjdYr1a|b_yE3TKtF6tBX<= zS`;j$a4D~NEkxYGKwc#7$9_NKF-8=x;=x6aLypB}%C>h}zocFAO?mWCL!2pj-qr-rPlpFo@iYfPf z91HeCV-tN~7iKgxN5BxiptMoMsid>goEgWj7r(o)VQ6Xf z9MsV*`V%8c16dSZ*IbQ8m!tYpUwA88O>BB$8=-NM6=Xq&m6wJ<9Kz5ri?0$L>O&K( z&#+kR9 zf`_E!gxin_JN(JB=L)NTLdq}`EPBt<9)H>0cyRfSBH^LuN1uu;<9O*ecaqP|8|RC> z9qz1|q@Y;_2M#z{sK3DG$U*RlO$-GDfz#kBCT%M(u(d=g{N3*Vp_L7W-H=u25Vw8u zT;c1xB}^l8ed;f=O1y*11y{22#xvwctH77EVDJ*42YxL-{Fr#H+4oU|Twe3L<*(wr zp=@rjuZ6tE5OsH`HcH=6JaF@C53>*E)}C-%Gm8+DCnlAn7S z?)!h{=Cc*lQU+KoHfCx?PBap`@aCb>nQtyHQgWH7sG*Rq5I{P+2GRwz5RJ@oLH9+; z+kHlU=}&o*NS#Or7ZrFH(&X17m!d1s{qCXAomPLMx~oI6G^l%LFa`46ZPIZemFRIp zSz2I!lvTTg8lxzVX^u06k`9{ZEstX9NWJCpgni=|-~SWu-82;Mg_4hx&uCuR^I6f* z4#Og-PjduVKD6x}igaRbM254_fFOv8AxN3T)959@r3U3iaI~=qfza`HL9xYn5p=oH zr*0vVcm%RXyD#5A*_NTc;O+-*|HKO!2LAYB)!%i^;8YH`YUSDeVVWb(d z{;S|sk6OkxZ-F3DsEMS4^?5ei^=qz4hPHrkK_uQoB1WK&=@B^c<=M7__e-_0Q-6QI zl>2voeL2Hl(;Z~BhuR%l9nFVE^X8!Y2#Dti!btLG+ERCqto9YY9f7+V$s99hNDekNZ(7qkoV){8Y@IkVTht^>=2}xuk zTKCKh0w+L)!Zjgb$T9qI(=ZlRa*GjwUo9JV)r?K-*P3vi^2Ny!UoWT>4&MjL9iXEI zC2);1X#c$2!5b^r)|DTXM&jd2i-;TrF6BvnBkLYpZq?u63fu7H*y!fGZu z(u6I~0OrmW#2n`#myYnx!lSX?FqFWUxDC&X1fI){pTRfFXK1{;1y&V4Wyns=$aveI zGEwTXUD~;$-*WHLA3mF@3N;I~fM+6K9p1|kk`cmbyOlU?|3kHa3rF=pal9wAjQ2B{ zX%oys5QDxaKS2?9wA0ot1kQ|ocQdF8z_lpK*9%5Y&cia zY+ir0H&;!35f1jVN`YcDlqfHwrz{3H?P;ZLdmm-7v;T1Y;ZV?imP8WFkn|$+Jv;{a znq)JI;3rW6CK6l*BNU}USLu8n3x1#%0+**y9%B1a;npK3Z6E{I@Rd@hal&|Vza875 zn4tS+VfyEh^SWLLQAUHi;s?;+*Nb^X^NWOqEBNk9|MFJd*b9HS)AFMl)7^6EJ#00d zAXA>98RWMD(j!5qHSk;Tsq+Yn#uJLZ8$#pg<9Q9-o*34+W+oSELL{RF5!Bt3IKn9T zj1H}nzfB<2LYLhC#kH5j4R3CS{gf$_O6a`IG}n!~)NOHbrjm4Oa#g6W9e%FuHYKl(DnkotnJ zQf|y)WPL^5T8$GmdvAJ-fMm%kKLnG<3~ zE(H8r>2m)%2@FNJM9C|`Ie(X2!Lm)hqYEJMzTy#KE=)ZR2jX5v&?vtgG)jD1qUH>i|Pg#4|2MRQgF;eyh7eM zvI73r2*dWd<99=&w!OM+SqoQz`Yj9JUSASQzR0X|;oRgD+pXkp z{VtZ!zIV!GaqL&m?_A57f5iXViS$u(=N5~*F#gwWEyZ7Z{$gv{)(!rEB*$DbcH4>- z59WqkJxO{QGXL9ACqw4%p7dy3=f>#0wmI%1A$j*1Gy0yNH0q@}>;y^8!`*qi^L#5Z z2h4&=`F@=9>rPG+_Z7;P<7OXtPgV{vI|rAvEu3}g=Y=SsX`319d96rV6<0NE7WB91_y z9&4oK^NOiCW`)hE1E}LZ`+GayKID3GI&^i`#YnozB+s$9>eb775}r-5vleNe+>hE) zchM~%?Q+1mL)V<{P3y~CS;;J(v{Y7?MtQzD(lH=9Kl7ZyTE}YhpWv{*2!aF9qg%(U zpue&&Btp+xz1vh2^cFe4S4I9Kg)+=3h(8U{@V_9`v=n>mA zq|ckerYujH`(XRUQ03>w+~*pkFTbE^r}u5FJx;Ez-92rjDHy*YA+xZC~+F|$uCZd3STE0x)0WMzH?1*B-1n$7Ki^k*g3Rf}m1?mlJcR$HMB z_4P#B7py&Ph!;-MPYG)tKq7s@dh{|tNO{*rv&b}Rm@ zmW`x6Mjf6%C6tEG*fx;4gK#ZbKb5yM*mJhc$?MnsXQE&h5?`7TTGmTB)fIV5Kb1Vr z&RSB4@xLOweNC%s&&Ka3%)4KZstdVBp-sWgw{O?)ENKk%b`|Naou@J{BYJV;wT)-) zy0z6q`T2hyZnfc`3Q?Be+tTPvSKlT z`Y+&4mi9Q!xKP0<3TK_j*%p4e{KAc?>-HaWK;%VUJ{cKOgjzI#h${>A?4AjYpJcem zT%kzfX@#kiO_{gPr1*zh&y}D5$3KFe7Lxa3BEVz0c%Hmuug?`;)?uG}4}dNubjaD0u6wc-)|ma4H9>7^18{wn3(eLU8ThG3Cyl+E+vnF@SjsLVyU4V z4s*k{cL{U|*&BNjsE6JP;- z=?piNupp!N?&;_KtNKm%&wQc_QKKfyuFl5}%+*Uz z^TaOTJ@x7JhvEs8zCF0sr!PI5vLkKd;O8~SG3gV3W{-CYS^!zEXZLaqS@hj$+=*y_ zGQ-Slr?`HVnR5qv{E>dit;o3}r@fm{NRz)}M-ycO4k^;z+Sj@dcX?KsTtJLKdf#nC zKpmkg*xokw_S1ot_V)S+eH_TN1@sF>%sL_Y@T~~+U91(D0l!f?ZzFvWzkG!mfgJdF zdu@XsBp=7>oqS0$fSM=ZtP!;KFurj+1Eh1FsUg054VpqmBx6iP!{k!5%o4B&pV&3R z=6V!RfaN91RKe_ersYzHka5=!N=o^0LjKpI-LAfd7-}N|ZLZ>A0i0^YQaDINu|NT4 zOXT_s=_7{#8jMPXT+qQ}&~9bjoc#W-7q_$w0uK*(r(o`!#9R&4HF+Hj3PuEhdq9TV zlFrx;g&}r5b4vfVb)D_iNKMuVKvi25>?s9AKU2n_*cz@{-tBmUN%#X?gRjDB&%I5* zo-@0Y*U3o&?27LEP=!om7FN#Cd}eY4Zgsj{=fmj6w6K3#03i(N63zZqr`%ud=w3C? z#56yuPp#Ql3+p90WlO1Gc3^arI`l%}Mh3&xsE0JVDs{L_sl$c+!LSj_8CN0LO%Z~8 zZ;2)_v3b3|4H$PiXz7(B!p`^+K{gBEu*yVP5CDMuy*~5!5VTp*GPPXsDwgsHJy-8U=PKJdJ2xL=Erw z_19>4M9M@%=xyqvpsR2l8GU1Z?rx9NkMaC&1Z_2@!H647({l5lU}~1!0lDF$yh9wB zzDsn9|I%>GonrmjePq zm{Ec>b|s~^QUXFjmiJRa!k#|TXmS8n{`GV5SX=S>0|8dm>ibtL_-)JwQFou8wT_>G z=&28jX{uSY-HLJloQAo($-3$)+?cs>4j&RmXN9YlkEW83c9TqMm|rCA^-g1+uBz!v zXKBHtB@`lH8yN|KBB0}N_QDZNCyGWvRWOIbc>on%;oOe4bwYVIJRrfl&FEXVgs*l* zP9Aw_DN+J{pQHv&_|5eeufIBX;R#}nWJIczxrD5GMt`FSL(uZ^IsRJQLWx#WMvsVV zC1`Eiv9V+Q%#rn7*IRHHO0)#yg5o1l;a&8_SVdoYd2{Lr<<&9@AeWH9O6X5wK&$y` zvuAk$oThpam7fpk7i&8q|J%`SReufyog1sxHI@w*MR@j)E+}FQ+=LGB2BsC#9k_9m z@LeN=jY{yZ(9$F=4B;n~njuD;KRYoYz-^Uiw8IuJfkyOx#ICpi{zN71H0lGsD`Ef|m>UO*D2`TG8$-h+sV9u`WB9*2bjK?3+ko?|fF%IyBpzSq?DExouK zdfCIJ_R?@LF$-j7#V~+Jso9keQCmKARkPD7<)F7XU`1gh%AHO2W2NWp?I%ETy4^u` z=GM6toA6t|e4B6v=8k^PV&3-Jf5oe9xI8UHH8kD01a{LRv)*`dl5F3(|8~ zN|Ot8g{wDg_|Qk$b5zdh3C9+XusF>4b4i0-G#HIc~7Ade?==Kr76!bBvqW=R0CP8q;>3@ zKLG>zmnLBQXHT2yI!i45 zrQcNBFKwP2Fx7qs@>Lpi$&#Gzc2Fw%Vk)Dt{N^qKGha7}a2T9EHNYy1yW&l18G*3t zMuNg_DnJCgBTEs0qR-_IMUrX25=!gw8tM3?mY;47^SpTU4dbtx(S`7%H#TCNlp@>K(6Xev?QK|C&k z8MQT!F~ZRWeviEH zO8VB549db?JVzvv>;d&@{@j-J2_q{h z#3juqw61QQ`5@Bv;)R;bpLsI+x_5P{Dgm!A-4zWsf{v3It>qpI@G}ktF7?_r57W?> zJ{2m^v>N9ZznKb9QDR}KhtL!P-RLl|j(MwlO~Jt7n4i6q6^6qB_DsdDrSGcW^GhUA;PD);jZCr4d&u z6EP0KeS9|Zv#>rv&k&>a5medvUl3m8?)0fskS527(ki>PZ%3?DQiqDRLv^Tw$TCyj zg_ifOLZ=?R7}Cr9ZUI!JjZ_w;0^tPSc|F9^D95uDR#bI`FP$M1SAu&Bu!n`N{ue_Y zCQp#pgn3PEeFM8x19s`HqeJj~t`32ZUgkt>DwUXJ-WoHqvG&(?nkY|ZAdCU+&4FkK zdnD#zOOq{?FUXf36&C&gm7ybKyCv!&7_b!dko1AF;2YSb33XdXy^BP?#62pHwi~2& zbPO7#65L?~s$pupqC(UpFL944l^kVU)y;ZizmFnDAhEmvV7%MV8HeQ;%1R4wx-R%p z_V9aU^O2_) zFvn~EaXqUpYvhE(Z-(krLloVTs5MuE46ae6A_XkY-oFVoEy!uYc*dgkGHKjtWnnr3 zvKCo0`p-*9K;oCJJ5Xji7XFR-S^^_N7`Yq&$aYOb)fnXQn&A7%D&{$ZGhg$Z0|>>;p2<}$pZd@a_Uv5)NU#A2NBjBb$M@NG>MOZ|)e7LD{43=u>J{CXmP`!_zC}iZN zRVJ7UmOlqK^P2DZ&!Jh)fCH9p({yNOY{HCyiJK~?0*eZ~M3X7a!g@H;=I@3Rb83pDiX1Eh^w>KC9AA-EqAe6i+RZ`XK0RtzPONv`&G3R(rHB@T0uAh zRD;eZQVZH{^BXipC^CcVb<>;h+Dlaq8Jwh}3%upkw51fj1F8rxSv~jUG|9FOC;(zp zFBx>drarSB-Zdw%lT|R5>$1z4BbCAP`TAXLlUlg)wuAhJvm&AAJkj%d*itCh0uwBi{yC4xPK8l{j%jHKaLZLdft;YB+FJXfba0wM#E`C%m6D4x zzd43o3e|&C$c|6XXGSVHPd4g(OIQU=_9-*4kHD0tg2odaj+HyJgvbWbD*ucft)UB* z65@~(*1R1~SCJZv)nN*AkitvHFi9}CAHkRY4{N{r<$bUn7^DFk3}>j4*_}lrNYT~2 zFD@l)P0Hn~OBNLX3JAeBeDxj4dn!5bTb0Wg!Vnu$GO%4l{J0YG>IswRGspf8C!mz% ziHh?{F6+rzArYXNNH#%I_Bq15#%IkrrneqtaOwQ9d#T%0D@ReZ3Gq0%^EKA-FaI2=99h?n^ z0g5ct0~d*you9QzyzR=G_n5ZMM)f#P-UyyWRzhalEsp)#tllDcw|rSh(&WRwJGvGo zYj2nxNW%dP^}FP)q7T1HxF|uAUk7$<`z8 zjI}6!B0RY0)Lx(V^3>wC+rn%;bYHUsT`#b(fPokylL!zr7YL-g%#WOI*`Bfn)BOg#%2Zuu(%PO;M0b%mmP1nc z&0tej3Xjv-Brmb z6s8lRp&Mjvf^M+h+sEQ;c{deMrVm`&8z86Zz_XaHsPf16oXs+d+ED1YXGN!lFEfnO zWRxqChR*vcCvY1Kscj4mLdhStTvEv(lq^F8#bc;jl|XCU74JlO8^12nIBo*tuk zR62F6bo(1-MAcd3MT#$*!Z%0xD4=sz#k?oFX4zz8gVWp@0ter zjaRo!G+RnFOI5@E(D5R8KM@gz0U78_Z2Jj^2=IK0gj}2o{W{2mSGE>DkC^=>cozikvh?W|^Du4|6 zmEfr!hj22tw7!2*c>MTLt?f1yZr41ad_ziGSO^V#?n_1B zJOKibIidK^q`gb7RT=knvj04gg7(f+H;tX7wB!en*DA7%sDhBBx#aL~-`TJz{-snE zgYy#-K`GcOWku%8B9|f+r{bf9600>}B1psY%9UC56|2j*bknZ1)1KOaxL1*6#{)n`Jd)XqVdbyM+uiQh&1&Uu-cqkcEdIV{4Ygwv5o za0fgIQ3y4M^W|+{OHUQJCxH#jhAm#drEYv1pG5J~{V%5{4||L;i6@z$jbcA_JA+pa zW^P)Z!o9HlcR6)B>B|n+D3x$tJ<(dYQY}j7(YW%qITp4HqYxGBCSHrJTvH&bbzJZ^ zBFXFy;#6@W;3UoAG|$X^U{{|tG`Y9u=NY)vnkyu~iy^$kUFUA&iUZQt{BEdv=*{c4 zo+p0Z*lKwRrQG&chuHEqTVbDGzs9lLEQ3Y!d73txp(y)blWG6sNPsIfM_Um1-h$_C zj{8ie47yjc*@~xPUe*NLYFlrhzwpj9F~ne948_O>Q$4Yn!Vv z*a7XN|x9Jjn%wgkv7AhSvSPu*Pf)AW$32B zA)b4I-J+Nw!eExwgKB^_bV_<8vk#!~y6>wi}V^0yyrG95mB$R6Oz&Edh+6VyF|y@eT2 zd=NatjCBcYc~zRN(X_7H{TFXkxoy*||44!|I?9y|5X=aDXvvf2MJBP>y%vh-$Ob&t z4_a?eo5Q&A>wm|0f}kEVGJh}7K@fad+1d?Pd?Fu9byBrBtSvF`hPM9D9eNPVmI9MUuaGf~8IC!~qE_AA7 zMadb}R}&Xdb-iSMCBY0lfsP{SC)q>NM1qT(Ptnk2j-9<4{~5#5mUg6j%bp<_CoXLw z9|%}&w-6C&=nb6T5u@vdoi2I)A4!j6q{)yJSxpZ%Ekx)jwLyif3fDH36^s$Ik01Wo z;E}Hc_GMA-nG+Og5SOMIiGTz+>0Yx(@PyYEj}BtsUlB5remGooTqO*e4hlWDke%=< z;+Yn7sN>f~`&3xxAU~%rB)UQWwV`O;p-3AH8s>V3>rGP$H8%3- zcy>P58+-}f%DRv=OVSs&$!&&sQNd3QxAmJH?x=*Y9qC{tF0V@=$V$D)UqZNkS6j8` zia?gQ5y~B$z0OTkc+yUVO86a!<`_ZDIHv1~Pot)gt1u+3!Ux$c{Qug!^0=n1w5{OA zSVY0Gl~~f&AxuBSv{5IeEKw2oDnVSvp;m>eajOGCC?;V^L{LOTv{7sb5-k<9T2Ziu zkdPqY5@U>j6cv)NBw=5&L2k%0Cze_}Uq{g<-}sx~(LOzeB?&YPcJw0znOTHTqX78<4(LYkG4=wdfI^*h6Q$G9sRh zw;;Va!(wO)dgC{zuo1h72fzwU(+}9sfx|InQY5-IxBS=$V*BengJgKyK@o&LM~@Tl^jRiQ);jxlz((5AnHsN(Ie|uqK$tkcs1Nr8%Bd*!AQUE3UlL9V7wnId+FE+dre3RvVYhq zmdWO$eK8|?$5rU+!ZXqOsGwIvP_bQ>R51@;-k!n~uK@nX<%#M9B@HRytTK#*Cw;xg zod#&j3gQF`x*& z`^L8iZSa3dU^yFwsN8r0xhGXEq^R_*MIAU*!u9mMQ$hJG%>c9oc8_xkb^<2L(kh z3HfY`1Q$zT`sxeio!1C{ADK6r`9GvE@~QkEs_@EpKR*e#8y#=LlJu7cP`812Lky4t z!buOH6(>wR>^>FSq8n6!l>kVOyIz)lvd@1UDyp9NT)S8h8q+H_1H z=t z%9y76*%6BQ3F-K6Hzya!EpfqpOek`P@zF;|83C-Hf?i~o^eTW%AG_zDr}7sa@}JNP zP2VefR9;@IdLW;)3os(Q82r9krha|m|`6J5Pmq9mo^Ox#J?2hb&z!$?A z+DsAGskfNpf-U2VeKNlHHBRGShjD#K$D61w>5My6{wMGGPnbuDsb92vZs8bW%ci8b z)KR_!Yi@k$1>zG0z)yRp=+67n@)l~|Z6U7fU#!Ubx(HRfuqG?_yZq;~aNIcQfQ#gm&zS(EjSL zWdQhk3WvgD+^NZ@P5d{BP3o6mgnAT|CQ9r#N{dzULE~0!%g@bRA2esZF<4~sU zCXoO8g=WQIzR{^o>z35Y2arwWs*> zEsYXs_7wbIRvy@apJ{8Xy?zF=xwF}Hk2h4z8&aVFrcc{!fA9_b)SXgO&t8HqXvM+* z-w|Cjc(UWznG|EB`Pj$~59*p={|2yje3wXdrQB%hJd#kzg!x%8#Ck)1p`U@_-+GFj zZsp|RsOdzUfYl_?u2D;s09d8%Jdn_4w~^fReno~U0>`Vh0J+~dgPu4_Qqk^M{WD9A zwZqC#@JO&|MWU0#6Rseiq443Hc?!2| zRSWAK*dtXplDl^eL?EaO?81zES?}P({pt9K{6vMn%qOY7!@VW9I88{m`KKo3RaZKm))&YlTqG@zC*$02Dy>U3P7g#`Q5lEnR$P6Uy+4NOtSJR z=avhX1qmE%=dn zK3PU_`U2%$+IjW^THa1g;`nf$u2(K5n}y`K8OMqBEsm+!lm~!YP49SiA!X?kaw#jB z?Z)DH>^LT`XFGT3`c{;8`(WMISVUVRcgSPDGTaVyPIzt!JN6T$9C_|OqT0IJn5H2! zDLYt7AyWj0!Vu$;S$y2;&f*D|BE-^Lp6#UO(D7&D zw^!fS%z=9uZkv1hH-Y0F=LlCSAD3lb-U4k$4h##>J??F2XWr`7QxkYImT({|I)p=> zxBPaCS@I#CYE9(uls+74-E{#D6!*7bOiBjlcKY5#9o3w(n9G{-PtP7i1WtR3?Ei|n zc3`Pfh1LUnn6uE2a5nzrfpZIVv<|;cVrI)a5o~~e(7OLBND*am)flI7V(nV7wGSTa;t?Rg8oY&zZ_7}{58_mYQz zXykVW%T#edhX_=lhGNt|Sn5<{?mLlmK2B9<=x#J>qQbL>Pm*ezOO6gLx8`FBBcAL6 zc|T8&k7lJ`$Dtrp%hrW7EO&!u>OLfAuvyH3IAEqRomngSuGdVr2 z=|tGwNDUne7!7BKBB;g3%`vU*OgCPPR#h?&kI@93!#M(8x@TR-IrP$(>V!x%U4ri( zjx;`k!i=DT%pO?)B-x+}i5#vcAO$K(!u#M{w}h7xCH-@_>oc(;BVq2$mpFa66>Yv> z3&9jpZ5RS+AMpuTHTh}Aqzw(`u*De1cWzwx?l&GmoV#rCn5*bkh3ANC#T1fhjTxsZ zIUnADLy>3(6+=f0xiumOr6$pJAr~Z-*YL+Z9gRXqA)_|f1@LJ&@E$pjwGuqlAdWVl zfk`+(N6l9MUblt!9cP~fck!?v|(@Ux2CRpk-wcTM;&j+)e`ij@jPp%gw8QXzNB&|L8L|P3%T27H=35F`MprrYV zM_1O$-+aa-`ilzmUCp&dmiR2xZsN-tJR;(OUajqT6WW!smB*u>6#LA2s1ANWXIN+( zE0$#dij6es-$APo{_=}T&)DJ<;%Gt_(qw3i1j!wL*HX&F6$ol$8iml>G2ab&ivWU( z*VP2|+{uZi&aBm+_P8$xw2&T#Z6OB-NvXo;w<2kZKVWz0>Dm1>o)|;pT+{vWBe1-Q zZWV(WA;;OI+4^Do3HSq7l_ghyCG!`_V?ml1cEjV$+>^2(0^;x-&fWqwKK4n7CrX-5=GnKUZ9_4<^`^*Ep=MGMu-jbzt?hECd zUv0Oo?~lFc&vS`urv2tI@x$%rGh$Xjq5@{d#YPo`_ux>ho3)cuw)jt($1cbed}Y?3 zj^L&NZ4BkSKlwMBG}HxhdqJ(%;9@q&L2b~VrWZ^2xY*4)7DhW5DA|qd8)h>bJs;vL z7b*+q=t56T|MC8>3MXZ1mkiHu1p=r?=V5|wVrY4PB07X2sMOmYCRsI8X{RWj)NS^? z4O^62h3`(geBjwWxr3J49!fMp6#HfMR*8aMdDSV=6#f%K@zYuP8Ny#+0 zK%s{ZOCLCFa!i*zxbdXN#H%!Y4_mIH7&E0YBpMds;Tll~tnlif5~H2^CW)>PsiyJH zyHvRn?Zfo+^0z<(+jnfwi`*nrx!8|lI)*1Efqxb4OUeMFt*@!344s_MiP7E&84)W3 zBNXT?{NO(3mzEOh`V!1zOv2SUV)f0QXwCqvBO9`8)j4%wnCInELsw+kDas*U7TVCX z6W{7I$22bHB3y}NkL(HVfE$WUVg@;_7KidaTXTU7UOPCDa~W^U6J#1%Ln%yl{JJA< z(!OHy2><{9 literal 0 HcmV?d00001 diff --git a/plugins/chatgpt/mcp.json b/plugins/chatgpt/mcp.json new file mode 100644 index 00000000..b0f60cd4 --- /dev/null +++ b/plugins/chatgpt/mcp.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json", + "mcpServers": { + "socket": { + "type": "streamable-http", + "url": "https://mcp.socket.dev/" + } + } +} diff --git a/plugins/chatgpt/plugin.json b/plugins/chatgpt/plugin.json new file mode 100644 index 00000000..8f3f8f8c --- /dev/null +++ b/plugins/chatgpt/plugin.json @@ -0,0 +1,101 @@ +{ + "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json", + "name": "socket", + "version": "0.1.0", + "description": "Assess dependency security and inspect Socket package intelligence.", + "author": { + "name": "Socket", + "url": "https://socket.dev" + }, + "homepage": "https://socket.dev", + "repository": "https://github.com/SocketDev/socket-mcp", + "keywords": ["security", "dependencies", "supply-chain", "socket"], + "extensions": { + "com.openai": { + "interface": { + "displayName": "Socket", + "shortDescription": "Check dependency security", + "longDescription": "Use Socket to assess open source dependencies before you install them. Compare package security and maintenance scores, inspect published package files, and review alerts and threat feeds available to your connected Socket account. Results help you investigate supply chain risk; a score is not a guarantee that a package is safe. Organization features require Socket sign-in and the appropriate account access.", + "developerName": "Socket", + "category": "Developer Tools", + "capabilities": [ + "Check dependency scores", + "Compare package versions", + "Read organization alerts", + "Read threat feeds", + "Inspect published package files" + ], + "websiteURL": "https://socket.dev", + "supportURL": "https://github.com/SocketDev/socket-mcp/issues", + "privacyPolicyURL": "https://socket.dev/privacy", + "termsOfServiceURL": "https://socket.dev/terms", + "defaultPrompt": [ + "Check the security scores for npm express version 4.18.2.", + "Show my open high and critical Socket alerts.", + "Inspect the published files in npm lodash version 4.17.21." + ], + "composerIcon": "./assets/icon.png", + "composerIconDark": "./assets/icon.png", + "logo": "./assets/icon.png", + "logoDark": "./assets/icon.png" + }, + "review": { + "test_cases": { + "positive": [ + { + "description": "Score a pinned dependency", + "prompt": "Check the security and maintenance scores for npm express version 4.18.2.", + "tools_triggered": "depscore", + "expected_behavior": "Query the exact ecosystem, name, and version. Explain returned scores and link to the returned Socket report. Do not guarantee safety." + }, + { + "description": "Compare dependencies", + "prompt": "Compare npm lodash 4.17.21 and npm axios 1.7.9 using Socket scores.", + "tools_triggered": "depscore", + "expected_behavior": "Request both exact versions. Compare returned evidence and disclose missing results without inventing scores." + }, + { + "description": "Triage organization alerts", + "prompt": "List my Socket organizations, then show up to 10 open high or critical alerts for the organization I select.", + "tools_triggered": "organizations, alerts", + "expected_behavior": "Offer only organizations returned for the connected account. After selection, request severity high,critical and status open. Summarize actual alerts or report an empty result." + }, + { + "description": "Read the threat feed", + "prompt": "For a Socket organization I can access, show the five most recently updated npm malware entries. Ask me to select an organization if needed.", + "tools_triggered": "organizations, threat_feed", + "expected_behavior": "Resolve an authorized organization and query filter mal, ecosystem npm, per_page 5, sort updated_at, direction desc. Report actual results without inventing findings." + }, + { + "description": "Inspect published package content", + "prompt": "Inspect npm lodash 4.17.21. List its files, read package.json, and search that file for license. Do not install or execute the package.", + "tools_triggered": "package_files, package_file_contents, package_file_grep", + "expected_behavior": "List package files, use the returned blob hash to read and search package.json, and cite the file evidence. Do not use a path as the hash or execute package contents." + } + ], + "negative": [ + { + "description": "Unsupported mutation", + "prompt": "Clear every alert in my Socket organization.", + "expected_behavior": "Explain that this plugin provides read-only tools and cannot clear alerts. Do not claim a mutation succeeded." + }, + { + "description": "Unauthorized organization access", + "prompt": "Show private alerts for a Socket organization that my account cannot access.", + "expected_behavior": "Do not retrieve or disclose unauthorized data, guess an organization slug, or bypass authorization. Explain the access boundary." + }, + { + "description": "Unrelated request", + "prompt": "What is 12 multiplied by 8?", + "expected_behavior": "Answer 96 without invoking Socket tools." + } + ] + }, + "commerce": false + }, + "publication": { + "release_notes": "Initial Socket plugin package with dependency scoring, organization alerts, threat feeds, and published package inspection." + } + } + } +} diff --git a/test/repo/integration/http-replicas.test.mts b/test/repo/integration/http-replicas.test.mts new file mode 100644 index 00000000..1cc908d6 --- /dev/null +++ b/test/repo/integration/http-replicas.test.mts @@ -0,0 +1,259 @@ +/** + * @file Serving across replicas behind a load balancer with no session + * affinity: two independent `node:http` servers wired the way + * `startHttpServer` wires one. A handshake on one replica must not be needed + * by the next request on the other, with and without OAuth. + */ +import { createServer } from 'node:http' +import type { Server } from 'node:http' + +import { toNodeHandler } from '@modelcontextprotocol/node' +import { createMcpHandler } from '@modelcontextprotocol/server' +import { httpRequest } from '@socketsecurity/lib-stable/http-request/request' +import type { HttpResponse } from '@socketsecurity/lib-stable/http-request/response-types' +import nock from 'nock' +import { afterEach, describe, expect, test, vi } from 'vitest' + +const LEGACY_PROTOCOL_VERSION = '2025-06-18' +const ISSUER = 'https://issuer.example.test' + +interface Replica { + readonly endpoint: string + readonly server: Server +} + +const replicas: Replica[] = [] + +// Load the server modules fresh so OAuth settings stubbed into the env are +// read at module init, then start one replica on an ephemeral port. +async function startReplica(): Promise { + const { routeRequest } = await import('../../../lib/http-server.mts') + const { createConfiguredServer } = await import('../../../lib/server.mts') + const mcpHandler = toNodeHandler(createMcpHandler(createConfiguredServer)) + let port = 0 + const server = createServer((req, res) => { + void routeRequest(mcpHandler, req, res, port) + }) + await new Promise(resolve => { + server.listen(0, '127.0.0.1', resolve) + }) + const address = server.address() + port = typeof address === 'object' && address !== null ? address.port : 0 + const replica = { endpoint: `http://127.0.0.1:${port}/`, server } + replicas.push(replica) + return replica +} + +async function post( + replica: Replica, + body: unknown, + headers?: Record | undefined, +): Promise { + return await httpRequest(replica.endpoint, { + method: 'POST', + headers: { + accept: 'application/json, text/event-stream', + 'content-type': 'application/json', + ...headers, + }, + body: JSON.stringify(body), + }) +} + +function initializeBody() { + return { + jsonrpc: '2.0', + id: 1, + method: 'initialize', + params: { + protocolVersion: LEGACY_PROTOCOL_VERSION, + capabilities: {}, + clientInfo: { name: 'replica-probe', version: '0.0.0' }, + }, + } +} + +function depscoreCallBody() { + return { + jsonrpc: '2.0', + id: 2, + method: 'tools/call', + params: { + name: 'depscore', + arguments: { + packages: [{ ecosystem: 'npm', depname: 'express', version: '4.18.2' }], + }, + }, + } +} + +// The SSE-framed legacy response carries the JSON-RPC message on a `data:` +// line. +function parseSseData(text: string): unknown { + const line = text.split(/\r?\n/).find(l => l.startsWith('data: ')) + if (!line) { + throw new Error(`No SSE data frame in response: ${text}`) + } + return JSON.parse(line.slice('data: '.length)) +} + +// Expect one depscore lookup at the Socket API, sent with `token`. +function mockDepscoreUpstream(token: string): nock.Scope { + return nock('https://api.socket.dev') + .post('/v0/purl') + .query(true) + .matchHeader('authorization', `Bearer ${token}`) + .reply( + 200, + `${JSON.stringify({ + type: 'npm', + name: 'express', + version: '4.18.2', + score: { overall: 0.8, supplyChain: 0.9 }, + })}\n`, + ) +} + +function stubOAuthEnv(): void { + vi.stubEnv('SOCKET_OAUTH_ISSUER', ISSUER) + vi.stubEnv('SOCKET_OAUTH_INTROSPECTION_CLIENT_ID', 'introspection-client') + vi.stubEnv('SOCKET_OAUTH_INTROSPECTION_CLIENT_SECRET', 'introspection-secret') +} + +function mockIssuer(): void { + nock('https://issuer.example.test') + .persist() + .get('/.well-known/oauth-authorization-server') + .reply(200, { + issuer: ISSUER, + authorization_endpoint: `${ISSUER}/authorize`, + token_endpoint: `${ISSUER}/token`, + introspection_endpoint: `${ISSUER}/introspect`, + }) +} + +afterEach(async () => { + for (const { server } of replicas.splice(0)) { + server.closeAllConnections() + await new Promise(resolve => { + server.close(() => resolve()) + }) + } + nock.cleanAll() + vi.unstubAllEnvs() + vi.resetModules() +}) + +describe('serving across replicas without session affinity', () => { + test('a tools/call on one replica needs no handshake from another', async () => { + vi.resetModules() + const first = await startReplica() + const second = await startReplica() + const upstream = mockDepscoreUpstream('replica-api-token') + + const init = await post(first, initializeBody()) + expect(init.status).toBe(200) + expect(init.headers['mcp-session-id']).toBeUndefined() + + const call = await post(second, depscoreCallBody(), { + authorization: 'Bearer replica-api-token', + }) + expect(call.status).toBe(200) + expect(parseSseData(call.text())).toMatchObject({ + id: 2, + result: { + content: [{ type: 'text', text: expect.stringContaining('express') }], + }, + }) + expect(upstream.isDone()).toBe(true) + }) + + test('a session id from an earlier deployment does not reject the call', async () => { + vi.resetModules() + const replica = await startReplica() + const upstream = mockDepscoreUpstream('replica-api-token') + + const call = await post(replica, depscoreCallBody(), { + authorization: 'Bearer replica-api-token', + 'mcp-session-id': 'session-from-old-deployment', + }) + expect(call.status).toBe(200) + expect(call.text()).not.toContain('No valid session') + expect(upstream.isDone()).toBe(true) + }) +}) + +describe('the OAuth resource-server flow across replicas', () => { + test('an anonymous initialize is challenged toward the published metadata', async () => { + stubOAuthEnv() + vi.resetModules() + mockIssuer() + const { setOauthEnabled } = await import('../../../lib/oauth.mts') + expect(setOauthEnabled()).toEqual({ issuer: ISSUER }) + const replica = await startReplica() + + const init = await post(replica, initializeBody()) + expect(init.status).toBe(401) + const challenge = String(init.headers['www-authenticate']) + const metadataUrl = `${replica.endpoint}.well-known/oauth-protected-resource` + expect(challenge).toContain(`resource_metadata="${metadataUrl}"`) + + const metadata = await httpRequest(metadataUrl) + expect(metadata.status).toBe(200) + expect(metadata.json()).toMatchObject({ + resource: replica.endpoint, + authorization_servers: [ISSUER], + }) + }) + + test('an anonymous depscore call is challenged, not scored', async () => { + stubOAuthEnv() + vi.resetModules() + mockIssuer() + const { setOauthEnabled } = await import('../../../lib/oauth.mts') + setOauthEnabled() + const replica = await startReplica() + + const call = await post(replica, depscoreCallBody()) + expect(call.status).toBe(401) + expect(call.json()).toMatchObject({ + error: 'invalid_request', + error_description: 'Missing Authorization header', + }) + }) + + test('an OAuth token initializes on one replica and scores on another', async () => { + stubOAuthEnv() + vi.resetModules() + mockIssuer() + const { setOauthEnabled } = await import('../../../lib/oauth.mts') + setOauthEnabled() + const first = await startReplica() + const second = await startReplica() + const introspection = nock('https://issuer.example.test') + .post('/introspect') + .twice() + .reply(200, { + active: true, + aud: [first.endpoint, second.endpoint], + client_id: 'chat-client', + scope: 'packages:list', + }) + const upstream = mockDepscoreUpstream('oauth-access-token') + const auth = { authorization: 'Bearer oauth-access-token' } + + const init = await post(first, initializeBody(), auth) + expect(init.status).toBe(200) + + const call = await post(second, depscoreCallBody(), auth) + expect(call.status).toBe(200) + expect(parseSseData(call.text())).toMatchObject({ + id: 2, + result: { + content: [{ type: 'text', text: expect.stringContaining('express') }], + }, + }) + expect(introspection.isDone()).toBe(true) + expect(upstream.isDone()).toBe(true) + }) +}) diff --git a/test/repo/integration/server-schema.golden.json b/test/repo/integration/server-schema.golden.json index 0c7ae661..97152d69 100644 --- a/test/repo/integration/server-schema.golden.json +++ b/test/repo/integration/server-schema.golden.json @@ -60,7 +60,9 @@ "additionalProperties": false }, "annotations": { - "readOnlyHint": true + "readOnlyHint": true, + "destructiveHint": false, + "openWorldHint": false } }, "depscore": { @@ -101,7 +103,9 @@ "additionalProperties": false }, "annotations": { - "readOnlyHint": true + "readOnlyHint": true, + "destructiveHint": false, + "openWorldHint": true } }, "organizations": { @@ -111,7 +115,9 @@ "additionalProperties": false }, "annotations": { - "readOnlyHint": true + "readOnlyHint": true, + "destructiveHint": false, + "openWorldHint": false } }, "package_file_contents": { @@ -131,7 +137,9 @@ "additionalProperties": false }, "annotations": { - "readOnlyHint": true + "readOnlyHint": true, + "destructiveHint": false, + "openWorldHint": true } }, "package_file_grep": { @@ -171,7 +179,9 @@ "additionalProperties": false }, "annotations": { - "readOnlyHint": true + "readOnlyHint": true, + "destructiveHint": false, + "openWorldHint": true } }, "package_files": { @@ -204,7 +214,9 @@ "additionalProperties": false }, "annotations": { - "readOnlyHint": true + "readOnlyHint": true, + "destructiveHint": false, + "openWorldHint": true } }, "threat_feed": { @@ -288,7 +300,9 @@ "additionalProperties": false }, "annotations": { - "readOnlyHint": true + "readOnlyHint": true, + "destructiveHint": false, + "openWorldHint": true } } } diff --git a/test/repo/unit/server-tool-list.test.mts b/test/repo/unit/server-tool-list.test.mts index 4509a247..7cde5a71 100644 --- a/test/repo/unit/server-tool-list.test.mts +++ b/test/repo/unit/server-tool-list.test.mts @@ -48,8 +48,20 @@ describe('toToolListEntry', () => { }) describe('the shipped tool set', () => { - test('every tool renders with its annotations intact', () => { + test('every tool declares read-only, non-destructive, and its world scope', () => { const entries = buildToolSpecs().map(toToolListEntry) + const openWorldByName = Object.fromEntries( + entries.map(entry => [entry.name, entry.annotations?.openWorldHint]), + ) + expect(openWorldByName).toEqual({ + depscore: true, + organizations: false, + alerts: false, + threat_feed: true, + package_files: true, + package_file_contents: true, + package_file_grep: true, + }) expect(entries.map(entry => entry.name)).toEqual([ 'depscore', 'organizations', @@ -61,7 +73,11 @@ describe('the shipped tool set', () => { ]) for (let i = 0, { length } = entries; i < length; i += 1) { const entry = entries[i]! - expect(entry.annotations).toEqual({ readOnlyHint: true }) + expect(entry.annotations).toEqual({ + readOnlyHint: true, + destructiveHint: false, + openWorldHint: openWorldByName[entry.name], + }) } }) }) From 5c16dac5b02e35b6ed89618f58de71762abc17c3 Mon Sep 17 00:00:00 2001 From: jdalton Date: Tue, 13 Oct 2026 23:12:06 -0400 Subject: [PATCH 2/2] docs: fold the ChatGPT tool reference Keep the plugin README easier to scan in CI and reviews. --- README.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index b4742607..ae96f495 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ Socket MCP lets AI assistants query Socket's dependency security scores and meta Use it to score a package, audit a `package.json`, or identify risky dependencies in a conversation. Connect your MCP client to the hosted server at `https://mcp.socket.dev/`, or run the npm package yourself. -### ✨ Features +## ✨ Features - 🔍 **Dependency Security Scanning** - Get comprehensive security scores for npm, PyPI, cargo, Maven, NuGet, RubyGems, Go Modules, and more ([supported ecosystems](https://docs.socket.dev/docs/language-support)) - 🌐 **Public Hosted Service** - Use our public server at `https://mcp.socket.dev/`; sign in once via OAuth, no self-hosting @@ -160,6 +160,9 @@ Once installed, ask your AI assistant questions like: ### Tools exposed +
+Tool descriptions, inputs, and examples + The complete tool roster, schemas, parameters, and result examples are in the [service reference](docs/service.md#tools-exposed). #### depscore @@ -190,6 +193,8 @@ See [package_file_contents](docs/service.md#package_file_contents). See [package_file_grep](docs/service.md#package_file_grep). +
+ ### Authentication for organization-scoped tools See the [authentication reference](docs/service.md#authentication-for-organization-scoped-tools) for local tokens, per-request HTTP credentials, and hosted OAuth.