@autokap/core

Shared core library consumed by the bundled autokap CLI binary and the @autokap/mcp server. You probably do not need to install this package directly — install @autokap/mcp (for IDE agents) or autokap (for CI / Cloud Run) and let them pull @autokap/core in transitively.

The package exists to keep request shaping, schema validation, secret redaction, and the SSRF-aware config layer in a single source of truth across the two consumers.

Entry points

import { /* ... */ } from "@autokap/core";              // re-exports everything below
import { /* ... */ } from "@autokap/core/config";       // ~/.autokap/config.json, SSRF guards
import { /* ... */ } from "@autokap/core/api-client";   // apiCall(), validateApiKey(), ApiClientError
import { /* ... */ } from "@autokap/core/endpoint-helpers"; // buildEndpointAssetUrl, toCsv
import { /* ... */ } from "@autokap/core/types";        // ValidateResponse, AutokapConfig, CheckResult
import { /* ... */ } from "@autokap/core/logger";       // createStderrLogger, redactString, redactValue

What's in here

• Config — atomic-write ~/.autokap/config.json with chmod 0600 on POSIX. The same file is read by the CLI and the MCP server so users authenticate once.
• SSRF / origin guard (validatePublicHttpUrl) — rejects non-http(s), loopback, private IPv4 (including obfuscated forms — 0177.0.0.1, 2130706433, hex), .local / .internal, IPv6 ULA / link-local / IPv4-mapped / 6to4 / NAT64.
• API client — typed apiCall<T>() wrapping fetch with bearer auth, retry on 429 / 5xx (idempotent methods only), Retry-After honoring, error envelope unpacking, and uniform secret redaction in error bodies.
• Logger — stderr-only logger (stdout is reserved for the MCP transport) plus redactString / redactValue helpers that scrub obvious tokens (ak_cli_…, ak_run_…, bearer headers) from any string before it lands in an error message or log line.

Versioning

@autokap/core is pinned exactly by @autokap/mcp and autokap. When you bump it, bump the consumers' manifests in the same commit so the dependency graph stays internally consistent. See the release sequence in the root CHANGELOG.md.