# traplens

traplens gives a coding agent a memory for other
people's API breakages. Before writing code against a
third-party service, look up that provider and get back
up to ten verified, dated failure modes, each with its
symptoms, its cause, a fix, a code example, and the date
it was last checked. When a call fails instead, paste
the error text and search for traps whose symptoms match
it. After a failure has been fixed, file a new trap so
the next agent does not lose the same hours, and after
hitting or avoiding a known trap, confirm whether it is
still true.

The bridge keeps no trap data of its own. It serves the
upstream Footgun server's tool list locally, exactly as
captured from the live endpoint, and forwards each tool
call upstream, returning the result untouched.

## Tools

- `lookup_traps` — traps for a provider. Required:
  `provider` (slug or common name, e.g. `"stripe"`).
  Optional: `surface` (part of the service, ranks
  matches first only), `context` (one-line task
  description), and `include_stale`.
- `search_traps` — traps matching error text. Required:
  `error_text` (4 to 4000 characters; known key and
  secret formats are redacted before matching).
  Optional: `provider` and `include_stale`.
- `file_trap` — draft a trap after a failure was fixed.
  Required: `provider`, `surface_type` (one of `api`,
  `sdk`, `ui`, `billing`, `infra`, `tool`),
  `surface_name`, `title`, `symptoms`, `cause`, `fix`,
  `apply`, and `affected`. Optional: `sources`, `tags`,
  and `visibility` (`private` by default, `public` to
  submit to the shared registry).
- `confirm_trap` — record whether a trap is still true.
  Required: `trap_id` and `still_true`. Optional:
  `hours_lost` and `version_seen`.

## Configuration

- `FOOTGUN_MCP_URL` (optional) — override the upstream
  endpoint. Defaults to `https://getfootgun.com/api/mcp`.
  (The override hook is this rebuild's own labelled
  reconstruction.)
- `FOOTGUN_API_KEY` (optional) — when set, every upstream
  request carries an `Authorization: Bearer <key>`
  header. When it is not set, no key header is sent.
  (The header name is pinned by the registry record; the
  Bearer scheme and this forwarding are labelled
  reconstructions — the original surface was captured
  keyless.)

### Forwarding mechanics

On the first tool call the client opens a streamable
HTTP session with the upstream: a JSON-RPC `initialize`
request (protocolVersion `2025-03-26`, clientInfo name
`traplens`), then a `notifications/initialized`
notification, then the `tools/call` request carrying
the caller's arguments unchanged. When the upstream
answers `initialize` with an `Mcp-Session-Id` header,
that value rides on every later request of the session,
which is reused for the life of the process. Replies
may arrive as plain JSON or as server-sent events;
both are read.

Successful upstream results pass through verbatim,
including any `isError` flag the upstream sets.
Failures — a JSON-RPC error, a non-2xx status, an
unreadable response, or a request that cannot be
completed — come back as an `isError` result whose
text starts with `traplens error:` (this rendering is
this rebuild's own labelled reconstruction).

## CLI

Each tool is also a subcommand taking one JSON argument
string:

```bash
npx @reneturcios/traplens lookup_traps '{"provider":"stripe"}'
npx @reneturcios/traplens search_traps '{"error_text":"No such payment_method"}'
npx @reneturcios/traplens confirm_trap '{"trap_id":"fg-0158","still_true":true}'
npx @reneturcios/traplens --version
```

Exit codes: `0` on success, `1` on an `isError`
result, `2` on a usage error.

## MCP server

```bash
npx -y @reneturcios/traplens mcp
```

MCP client config:

```json
{
  "mcpServers": {
    "traplens": {
      "command": "npx",
      "args": ["-y", "@reneturcios/traplens", "mcp"]
    }
  }
}
```

## Docker

```bash
docker run -i ghcr.io/cloudcorprecords/traplens
docker run --rm ghcr.io/cloudcorprecords/traplens --version
```

The container's default command is `mcp`, so the first
form is a stdio MCP server; any other arguments reach
the CLI normally.

## Development

```bash
npm install
npm run build
npm test
npm run dev
```

The test suite runs entirely against a stubbed
JSON-RPC upstream — no live network calls.

## License

MIT — see `LICENSE`.