legion-mcp 0.1.0

data/lib/legion/mcp/tier_router.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require 'digest'
+require_relative 'pattern_store'
+require_relative 'context_guard'
+
+module Legion
+  module MCP
+    module TierRouter
+      CONFIDENCE_TIER0 = 0.8
+      CONFIDENCE_TIER1 = 0.6
+
+      module_function
+
+      def route(intent:, params: {}, context: {})
+        start_time = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+        normalized = normalize_intent(intent)
+        intent_hash = Digest::SHA256.hexdigest(normalized)
+
+        ContextGuard.record_request(intent_hash)
+
+        pattern = PatternStore.lookup(intent_hash)
+        pattern ||= try_semantic_lookup(normalized)
+
+        return tier2_response('no matching pattern') unless pattern
+
+        confidence = pattern[:confidence] || 0.0
+
+        return tier2_response('low confidence') if confidence < CONFIDENCE_TIER1
+
+        return tier1_response(pattern, 'confidence below tier 0 threshold') if confidence < CONFIDENCE_TIER0
+
+        guard_result = ContextGuard.check(pattern, params, context)
+        return tier1_response(pattern, guard_result[:reason]) unless guard_result[:passed]
+
+        begin
+          results = execute_tool_chain(pattern[:tool_chain], params)
+          response = generate_response(results, pattern)
+          PatternStore.record_hit(intent_hash)
+
+          elapsed_ms = ((::Process.clock_gettime(::Process::CLOCK_MONOTONIC) - start_time) * 1000).round(2)
+          {
+            tier:               0,
+            response:           response,
+            latency_ms:         elapsed_ms,
+            pattern_confidence: pattern[:confidence]
+          }
+        rescue StandardError => e
+          PatternStore.record_miss(intent_hash)
+          tier1_response(pattern, "tool chain failed: #{e.message}")
+        end
+      end
+
+      def normalize_intent(intent)
+        intent.to_s.strip.downcase.gsub(/\s+/, ' ')
+      end
+
+      def execute_tool_chain(tool_chain, params)
+        tool_chain.map do |tool_name|
+          tool_class = find_tool_class(tool_name)
+          raise ArgumentError, "unknown tool: #{tool_name}" unless tool_class
+
+          if params.empty?
+            tool_class.call
+          else
+            tool_class.call(**params.transform_keys(&:to_sym))
+          end
+        end
+      end
+
+      def generate_response(results, pattern)
+        template = pattern[:response_template]
+
+        if template && transformer_available?
+          begin
+            client = Legion::Extensions::Transformer::Client.new
+            rendered = client.transform(transformation: template, payload: { results: results })
+            return rendered[:result] if rendered[:success]
+          rescue StandardError
+            # Fall through to raw results
+          end
+        end
+
+        results.size == 1 ? results.first : results
+      end
+
+      def try_semantic_lookup(normalized_intent)
+        return nil unless defined?(Legion::MCP::EmbeddingIndex) && Legion::MCP::EmbeddingIndex.populated?
+
+        embedder = Legion::MCP::EmbeddingIndex.instance_variable_get(:@embedder)
+        return nil unless embedder
+
+        intent_vector = embedder.call(normalized_intent)
+        return nil unless intent_vector
+
+        PatternStore.lookup_semantic(intent_vector)
+      rescue StandardError
+        nil
+      end
+
+      def find_tool_class(tool_name)
+        return nil unless defined?(Legion::MCP::Server::TOOL_CLASSES)
+
+        Legion::MCP::Server::TOOL_CLASSES.find do |klass|
+          klass.respond_to?(:tool_name) && klass.tool_name == tool_name
+        end
+      end
+
+      def transformer_available?
+        defined?(Legion::Extensions::Transformer::Client)
+      end
+
+      def tier1_response(pattern, reason)
+        { tier: 1, response: nil, pattern: pattern, reason: reason }
+      end
+
+      def tier2_response(reason)
+        { tier: 2, response: nil, reason: reason }
+      end
+    end
+  end
+end

data/lib/legion/mcp/tool_governance.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Legion
+  module MCP
+    module ToolGovernance
+      RISK_TIER_ORDER = { low: 0, medium: 1, high: 2, critical: 3 }.freeze
+
+      DEFAULT_TOOL_TIERS = {
+        'legion.list_workers'      => :low,
+        'legion.show_worker'       => :low,
+        'legion.list_tasks'        => :low,
+        'legion.get_task'          => :low,
+        'legion.get_status'        => :low,
+        'legion.get_config'        => :low,
+        'legion.describe_runner'   => :low,
+        'legion.list_extensions'   => :low,
+        'legion.run_task'          => :medium,
+        'legion.create_schedule'   => :medium,
+        'legion.worker_lifecycle'  => :high,
+        'legion.enable_extension'  => :high,
+        'legion.disable_extension' => :high,
+        'legion.delete_task'       => :high,
+        'legion.rbac_assignments'  => :high,
+        'legion.rbac_grants'       => :high
+      }.freeze
+
+      module_function
+
+      def filter_tools(tools, identity)
+        return tools unless governance_enabled?
+
+        risk_tier = identity&.dig(:risk_tier) || :low
+        tier_value = RISK_TIER_ORDER[risk_tier] || 0
+
+        tool_tiers = DEFAULT_TOOL_TIERS.merge(custom_tiers)
+        tools.select do |tool|
+          tool_tier = tool_tiers[tool_name(tool)] || :low
+          (RISK_TIER_ORDER[tool_tier] || 0) <= tier_value
+        end
+      end
+
+      def audit_invocation(tool_name:, identity:, params:, result:)
+        return unless audit_enabled? && defined?(Legion::Audit)
+
+        Legion::Audit.record(
+          event_type:   'mcp_tool_invocation',
+          principal_id: identity&.dig(:worker_id) || identity&.dig(:user_id) || 'unknown',
+          action:       "mcp.#{tool_name}",
+          resource:     'mcp_tool',
+          detail:       { param_keys: params&.keys, success: !result&.dig(:error) }
+        )
+      end
+
+      def governance_enabled?
+        Legion::Settings.dig(:mcp, :governance, :enabled) == true
+      end
+
+      def audit_enabled?
+        Legion::Settings.dig(:mcp, :governance, :audit_invocations) != false
+      end
+
+      def custom_tiers
+        Legion::Settings.dig(:mcp, :governance, :tool_risk_tiers) || {}
+      end
+
+      def tool_name(tool)
+        if tool.respond_to?(:tool_name)
+          tool.tool_name
+        elsif tool.respond_to?(:name)
+          tool.name
+        else
+          tool.to_s
+        end
+      end
+    end
+  end
+end

data/lib/legion/mcp/tools/create_chain.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Legion
+  module MCP
+    module Tools
+      class CreateChain < ::MCP::Tool
+        tool_name 'legion.create_chain'
+        description 'Create a new task chain.'
+
+        input_schema(
+          properties: {
+            name: { type: 'string', description: 'Chain name' }
+          },
+          required:   ['name']
+        )
+
+        class << self
+          def call(name:, **attrs)
+            return error_response('legion-data is not connected') unless data_connected?
+            return error_response('chain data model is not available') unless chain_model?
+
+            id = Legion::Data::Model::Chain.insert(attrs.merge(name: name))
+            record = Legion::Data::Model::Chain[id]
+            text_response(record.values)
+          rescue StandardError => e
+            error_response("Failed to create chain: #{e.message}")
+          end
+
+          private
+
+          def data_connected?
+            Legion::Settings[:data][:connected]
+          rescue StandardError
+            false
+          end
+
+          def chain_model? = Legion::Data::Model.const_defined?(:Chain)
+
+          def text_response(data)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump(data) }])
+          end
+
+          def error_response(msg)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump({ error: msg }) }], error: true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/mcp/tools/create_relationship.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Legion
+  module MCP
+    module Tools
+      class CreateRelationship < ::MCP::Tool
+        tool_name 'legion.create_relationship'
+        description 'Create a new relationship between tasks/functions.'
+
+        input_schema(
+          properties: {
+            trigger_function_id: { type: 'integer', description: 'Function ID that triggers this relationship' },
+            target_function_id:  { type: 'integer', description: 'Function ID to be triggered' }
+          },
+          required:   %w[trigger_function_id target_function_id]
+        )
+
+        class << self
+          def call(**attrs)
+            return error_response('legion-data is not connected') unless data_connected?
+            return error_response('relationship data model is not available') unless relationship_model?
+
+            id = Legion::Data::Model::Relationship.insert(attrs)
+            record = Legion::Data::Model::Relationship[id]
+            text_response(record.values)
+          rescue StandardError => e
+            error_response("Failed to create relationship: #{e.message}")
+          end
+
+          private
+
+          def data_connected?
+            Legion::Settings[:data][:connected]
+          rescue StandardError
+            false
+          end
+
+          def relationship_model? = Legion::Data::Model.const_defined?(:Relationship)
+
+          def text_response(data)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump(data) }])
+          end
+
+          def error_response(msg)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump({ error: msg }) }], error: true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/mcp/tools/create_schedule.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Legion
+  module MCP
+    module Tools
+      class CreateSchedule < ::MCP::Tool
+        tool_name 'legion.create_schedule'
+        description 'Create a new schedule. Requires function_id and either cron or interval.'
+
+        input_schema(
+          properties: {
+            function_id: { type: 'integer', description: 'Function ID to schedule' },
+            cron:        { type: 'string', description: 'Cron expression (e.g., "*/5 * * * *")' },
+            interval:    { type: 'integer', description: 'Interval in seconds' },
+            active:      { type: 'boolean', description: 'Whether schedule is active (default true)' },
+            payload:     { type: 'object', description: 'Payload to pass to the function', additionalProperties: true }
+          },
+          required:   ['function_id']
+        )
+
+        class << self
+          def call(function_id:, cron: nil, interval: nil, active: true, payload: {})
+            return error_response('legion-data is not connected') unless data_connected?
+            return error_response('lex-scheduler is not loaded') unless scheduler_loaded?
+            return error_response('cron or interval is required') if cron.nil? && interval.nil?
+
+            attrs = {
+              function_id: function_id.to_i,
+              active:      active,
+              payload:     Legion::JSON.dump(payload),
+              last_run:    Time.at(0)
+            }
+            attrs[:cron] = cron if cron
+            attrs[:interval] = interval.to_i if interval
+
+            id = Legion::Extensions::Scheduler::Data::Model::Schedule.insert(attrs)
+            record = Legion::Extensions::Scheduler::Data::Model::Schedule[id]
+            text_response(record.values)
+          rescue StandardError => e
+            error_response("Failed to create schedule: #{e.message}")
+          end
+
+          private
+
+          def data_connected?
+            Legion::Settings[:data][:connected]
+          rescue StandardError
+            false
+          end
+
+          def scheduler_loaded? = defined?(Legion::Extensions::Scheduler)
+
+          def text_response(data)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump(data) }])
+          end
+
+          def error_response(msg)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump({ error: msg }) }], error: true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/mcp/tools/delete_chain.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Legion
+  module MCP
+    module Tools
+      class DeleteChain < ::MCP::Tool
+        tool_name 'legion.delete_chain'
+        description 'Delete a task chain by ID.'
+
+        input_schema(
+          properties: {
+            id: { type: 'integer', description: 'Chain ID' }
+          },
+          required:   ['id']
+        )
+
+        class << self
+          def call(id:)
+            return error_response('legion-data is not connected') unless data_connected?
+            return error_response('chain data model is not available') unless chain_model?
+
+            record = Legion::Data::Model::Chain[id.to_i]
+            return error_response("Chain #{id} not found") unless record
+
+            record.delete
+            text_response({ deleted: true, id: id })
+          rescue StandardError => e
+            error_response("Failed to delete chain: #{e.message}")
+          end
+
+          private
+
+          def data_connected?
+            Legion::Settings[:data][:connected]
+          rescue StandardError
+            false
+          end
+
+          def chain_model? = Legion::Data::Model.const_defined?(:Chain)
+
+          def text_response(data)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump(data) }])
+          end
+
+          def error_response(msg)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump({ error: msg }) }], error: true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/mcp/tools/delete_relationship.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Legion
+  module MCP
+    module Tools
+      class DeleteRelationship < ::MCP::Tool
+        tool_name 'legion.delete_relationship'
+        description 'Delete a relationship by ID.'
+
+        input_schema(
+          properties: {
+            id: { type: 'integer', description: 'Relationship ID' }
+          },
+          required:   ['id']
+        )
+
+        class << self
+          def call(id:)
+            return error_response('legion-data is not connected') unless data_connected?
+            return error_response('relationship data model is not available') unless relationship_model?
+
+            record = Legion::Data::Model::Relationship[id.to_i]
+            return error_response("Relationship #{id} not found") unless record
+
+            record.delete
+            text_response({ deleted: true, id: id })
+          rescue StandardError => e
+            error_response("Failed to delete relationship: #{e.message}")
+          end
+
+          private
+
+          def data_connected?
+            Legion::Settings[:data][:connected]
+          rescue StandardError
+            false
+          end
+
+          def relationship_model? = Legion::Data::Model.const_defined?(:Relationship)
+
+          def text_response(data)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump(data) }])
+          end
+
+          def error_response(msg)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump({ error: msg }) }], error: true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/mcp/tools/delete_schedule.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Legion
+  module MCP
+    module Tools
+      class DeleteSchedule < ::MCP::Tool
+        tool_name 'legion.delete_schedule'
+        description 'Delete a schedule by ID.'
+
+        input_schema(
+          properties: {
+            id: { type: 'integer', description: 'Schedule ID' }
+          },
+          required:   ['id']
+        )
+
+        class << self
+          def call(id:)
+            return error_response('legion-data is not connected') unless data_connected?
+            return error_response('lex-scheduler is not loaded') unless scheduler_loaded?
+
+            record = Legion::Extensions::Scheduler::Data::Model::Schedule[id.to_i]
+            return error_response("Schedule #{id} not found") unless record
+
+            record.delete
+            text_response({ deleted: true, id: id })
+          rescue StandardError => e
+            error_response("Failed to delete schedule: #{e.message}")
+          end
+
+          private
+
+          def data_connected?
+            Legion::Settings[:data][:connected]
+          rescue StandardError
+            false
+          end
+
+          def scheduler_loaded? = defined?(Legion::Extensions::Scheduler)
+
+          def text_response(data)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump(data) }])
+          end
+
+          def error_response(msg)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump({ error: msg }) }], error: true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/mcp/tools/delete_task.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module Legion
+  module MCP
+    module Tools
+      class DeleteTask < ::MCP::Tool
+        tool_name 'legion.delete_task'
+        description 'Delete a task by ID.'
+
+        input_schema(
+          properties: {
+            id: { type: 'integer', description: 'Task ID' }
+          },
+          required:   ['id']
+        )
+
+        class << self
+          def call(id:)
+            return error_response('legion-data is not connected') unless data_connected?
+
+            task = Legion::Data::Model::Task[id.to_i]
+            return error_response("Task #{id} not found") unless task
+
+            task.delete
+            text_response({ deleted: true, id: id })
+          rescue StandardError => e
+            error_response("Failed to delete task: #{e.message}")
+          end
+
+          private
+
+          def data_connected?
+            Legion::Settings[:data][:connected]
+          rescue StandardError
+            false
+          end
+
+          def text_response(data)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump(data) }])
+          end
+
+          def error_response(msg)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump({ error: msg }) }], error: true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/mcp/tools/describe_runner.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module Legion
+  module MCP
+    module Tools
+      class DescribeRunner < ::MCP::Tool
+        tool_name 'legion.describe_runner'
+        description 'Discover available functions on a runner. Use dot notation (e.g., "http.request") or omit to list all.'
+
+        input_schema(
+          properties: {
+            runner: {
+              type:        'string',
+              description: 'Dot notation path: extension.runner (e.g., "http.request"). Omit to list all.'
+            }
+          }
+        )
+
+        class << self
+          def call(runner: nil)
+            return error_response('legion-data is not connected') unless data_connected?
+
+            runner ? describe_single(runner) : describe_all
+          rescue StandardError => e
+            error_response("Failed to describe runners: #{e.message}")
+          end
+
+          private
+
+          def data_connected?
+            Legion::Settings[:data][:connected]
+          rescue StandardError
+            false
+          end
+
+          def describe_single(runner)
+            parts = runner.split('.')
+            return error_response("Invalid format '#{runner}'. Expected: extension.runner") unless parts.length == 2
+
+            runners = Legion::Data::Model::Runner.all
+            matching = runners.select do |r|
+              ns = r.values[:namespace]&.downcase
+              ns&.include?(parts[0]) && ns.include?(parts[1])
+            end
+
+            return error_response("No runner found matching '#{runner}'") if matching.empty?
+
+            results = matching.map do |r|
+              functions = Legion::Data::Model::Function.where(runner_id: r.values[:id]).all
+              {
+                runner:    r.values[:namespace],
+                runner_id: r.values[:id],
+                functions: functions.map { |f| { id: f.values[:id], name: f.values[:name] } }
+              }
+            end
+
+            text_response(results)
+          end
+
+          def describe_all
+            extensions = Legion::Data::Model::Extension.all
+            catalog = extensions.map do |ext|
+              runners = Legion::Data::Model::Runner.where(extension_id: ext.values[:id]).all
+              {
+                extension:    ext.values[:name],
+                extension_id: ext.values[:id],
+                runners:      runners.map do |r|
+                  functions = Legion::Data::Model::Function.where(runner_id: r.values[:id]).all
+                  {
+                    runner:    r.values[:namespace],
+                    runner_id: r.values[:id],
+                    functions: functions.map { |f| { id: f.values[:id], name: f.values[:name] } }
+                  }
+                end
+              }
+            end
+
+            text_response(catalog)
+          end
+
+          def text_response(data)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump(data) }])
+          end
+
+          def error_response(message)
+            ::MCP::Tool::Response.new([{ type: 'text', text: Legion::JSON.dump({ error: message }) }], error: true)
+          end
+        end
+      end
+    end
+  end
+end