0xray 3.0.14 → 3.1.1

package/dist/mcps/framework-help.server.js

@@ -1,13 +1,14 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } from "@modelcontextprotocol/sdk/types.js";
+import * as fs from "fs";
 import { frameworkLogger } from "../core/framework-logger.js";
 import { AGENT_REGISTRY } from "../agents/registry.js";
 class FrameworkHelpServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "xray/framework-help", version: "1.22.67",
+            name: "xray/framework-help", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -21,7 +22,7 @@ class FrameworkHelpServer {
             return {
                 tools: [
                     {
-                        name: "strray_get_capabilities",
+                        name: "xray_get_capabilities",
                         description: "Get comprehensive list of all 0xRay framework capabilities, commands, and available tools",
                         inputSchema: {
                             type: "object",
@@ -43,7 +44,7 @@ class FrameworkHelpServer {
                         },
                     },
                     {
-                        name: "strray_get_commands",
+                        name: "xray_get_commands",
                         description: "Get list of available 0xRay commands and their usage",
                         inputSchema: {
                             type: "object",
@@ -63,7 +64,7 @@ class FrameworkHelpServer {
                         },
                     },
                     {
-                        name: "strray_explain_capability",
+                        name: "xray_explain_capability",
                         description: "Get detailed explanation of a specific 0xRay capability",
                         inputSchema: {
                             type: "object",
@@ -84,11 +85,11 @@ class FrameworkHelpServer {
             const { name, arguments: args } = request.params;
             try {
                 switch (name) {
-                    case "strray_get_capabilities":
+                    case "xray_get_capabilities":
                         return this.handleGetCapabilities(args);
-                    case "strray_get_commands":
+                    case "xray_get_commands":
                         return this.handleGetCommands(args);
-                    case "strray_explain_capability":
+                    case "xray_explain_capability":
                         return this.handleExplainCapability(args);
                     default:
                         throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${name}`);
@@ -393,7 +394,7 @@ ${items.map(([name, desc]) => `- **${name}**: ${desc}`).join("\n")}
     }
 }
 // Auto-start if this file is run directly - conditional server initialization for development/testing
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new FrameworkHelpServer();
     server.start().catch((error) => frameworkLogger.log("mcps/framework-help", "run", "error", { error: String(error) }));
 }

package/dist/mcps/governance.server.js

@@ -18,7 +18,6 @@ import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { frameworkLogger } from "../core/framework-logger.js";
 import * as fs from "fs";
-import * as path from "path";
 import { fileURLToPath } from "url";
 import { randomUUID } from "crypto";
 import { getGovernanceService } from "../governance/governance-service.js";
@@ -29,7 +28,7 @@ class GovernanceServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "governance", version: "1.22.67",
+            name: "governance", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -395,7 +394,12 @@ class GovernanceServer {
      */
     async runHttp(port = parseInt(process.env.MCP_PORT ?? "3100", 10)) {
         await this.initializeGovernance();
-        const app = createMcpExpressApp();
+        const mcpHost = process.env.MCP_HOST || "127.0.0.1";
+        const allowedHosts = process.env.MCP_ALLOWED_HOSTS?.split(",");
+        const app = createMcpExpressApp({
+            host: mcpHost,
+            ...(allowedHosts ? { allowedHosts } : {}),
+        });
         const transport = new StreamableHTTPServerTransport({
             sessionIdGenerator: () => randomUUID(),
         });
@@ -441,7 +445,7 @@ class GovernanceServer {
     }
 }
 // Start the server if this file is run directly
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
     // If --port or MCP_PORT is set, use HTTP transport (for Grok CLI compatibility)
     const cliPort = process.argv.find((a) => a.startsWith("--port="))?.split("=")[1];

package/dist/mcps/knowledge-skills/api-design.server.js

@@ -7,12 +7,13 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import * as fs from "fs";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
 class XrayApiDesignServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "api-design", version: "1.22.67",
+            name: "api-design", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -116,7 +117,7 @@ class XrayApiDesignServer {
         });
     }
 }
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayApiDesignServer();
     server.run().catch(() => { });
 }

package/dist/mcps/knowledge-skills/architecture-patterns.server.js

@@ -7,12 +7,13 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import * as fs from "fs";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
 class XrayArchitecturePatternsServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "architecture-patterns", version: "1.22.67",
+            name: "architecture-patterns", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -106,7 +107,7 @@ class XrayArchitecturePatternsServer {
         });
     }
 }
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayArchitecturePatternsServer();
     server.run().catch(() => { });
 }

package/dist/mcps/knowledge-skills/bug-triage-specialist.server.js

@@ -8,12 +8,12 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 class BugTriageSpecialistServer {
     server;
     constructor() {
-        this.server = new Server({ name: "bug-triage-specialist", version: "1.22.67" }, { capabilities: { tools: {} } });
+        this.server = new Server({ name: "bug-triage-specialist", version: "3.1.0" }, { capabilities: { tools: {} } });
         this.setupToolHandlers();
     }
     setupToolHandlers() {
@@ -466,7 +466,7 @@ class BugTriageSpecialistServer {
         await this.server.connect(transport);
     }
 }
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
     const server = new BugTriageSpecialistServer();
     server.run();

package/dist/mcps/knowledge-skills/code-analyzer.server.js

@@ -242,7 +242,7 @@ class CodeAnalyzerServer {
         },
     ];
     constructor() {
-        this.server = new Server({ name: "code-analyzer", version: "1.22.67" }, { capabilities: { tools: {} } });
+        this.server = new Server({ name: "code-analyzer", version: "3.1.0" }, { capabilities: { tools: {} } });
         this.server.setRequestHandler(ListToolsRequestSchema, async () => ({
             tools: this.tools,
         }));
@@ -599,7 +599,7 @@ class CodeAnalyzerServer {
         });
     }
 }
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     new CodeAnalyzerServer().run().catch(() => { });
 }
 export default CodeAnalyzerServer;

package/dist/mcps/knowledge-skills/code-review.server.js

@@ -10,11 +10,12 @@ import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextpro
 import * as fs from "fs";
 import * as path from "path";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
+import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
 class XrayCodeReviewServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "code-review", version: "1.22.67",
+            name: "code-review", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -339,48 +340,22 @@ class XrayCodeReviewServer {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-        const text = `${proposalTitle} ${proposalDescription} ${evidence.join(" ")}`.toLowerCase();
-        let decision = "approve";
-        let confidence = 0.82;
-        let reasoning = "The proposal appears reasonable from a code quality and maintainability perspective.";
-        if (text.includes("aml") || text.includes("kyc") || text.includes("anti-money")) {
-            decision = "approve";
-            confidence = 0.88;
-            reasoning = "AML/KYC compliance code requires rigorous review: transaction monitoring must handle edge cases, avoid false positives from legitimate patterns, and maintain audit trails for regulatory inspection.";
-        }
-        else if (text.includes("psd2") || text.includes("strong customer authentication") || text.includes("payment initiation")) {
-            decision = "approve";
-            confidence = 0.90;
-            reasoning = "PSD2 SCA implementation must balance security with user experience. Code should use well-audited MFA libraries, avoid rolling custom authentication, and include comprehensive test coverage for all authentication flows.";
-        }
-        else if (text.includes("gdpr") || text.includes("right to erasure") || text.includes("data protection")) {
-            decision = "approve";
-            confidence = 0.92;
-            reasoning = "GDPR erasure pipelines require careful code review: cascading deletes must be transactional, audit logs must be preserved, and the 30-day SLA demands observability and monitoring integration.";
-        }
-        else if (text.includes("extract method")) {
-            decision = "approve";
-            confidence = 0.93;
-            reasoning = "Extract Method is a well-established refactoring pattern that improves readability and reduces cognitive load when applied consistently.";
-        }
-        else if (text.includes("test coverage")) {
-            decision = "approve";
-            confidence = 0.90;
-            reasoning = "Expanding automated test coverage generally improves long-term code health and reduces regression risk.";
-        }
-        else if (text.includes("increase timeout") && text.includes("flaky")) {
-            decision = "reject";
-            confidence = 0.72;
-            reasoning = "Repeatedly increasing timeouts to mask flaky tests is an anti-pattern that hides underlying race conditions or timing issues.";
-        }
-        if (proposalType === "fix" && text.includes("timeout")) {
-            confidence = Math.max(0.68, confidence - 0.08);
+        const vote = await tryLLMGovernance("code-review", proposalTitle, proposalDescription, evidence, proposalType);
+        if (!vote) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+                    },
+                ],
+            };
         }
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${decision}\nCONFIDENCE: ${confidence.toFixed(2)}\nREASONING: ${reasoning}`,
+                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
                 },
             ],
         };
@@ -840,7 +815,7 @@ class XrayCodeReviewServer {
     }
 }
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayCodeReviewServer();
     server.run().catch(() => { });
 }

package/dist/mcps/knowledge-skills/content-creator.server.js

@@ -7,7 +7,7 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 class SEOCopywriterServer {
     server;
@@ -86,7 +86,7 @@ class SEOCopywriterServer {
         },
     ];
     constructor() {
-        this.server = new Server({ name: "content-creator", version: "1.22.67" }, { capabilities: { tools: {} } });
+        this.server = new Server({ name: "content-creator", version: "3.1.0" }, { capabilities: { tools: {} } });
         this.server.setRequestHandler(ListToolsRequestSchema, async () => ({
             tools: this.tools,
         }));
@@ -248,7 +248,7 @@ class SEOCopywriterServer {
         await this.server.connect(transport);
     }
 }
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
     const server = new SEOCopywriterServer();
     server.run();

package/dist/mcps/knowledge-skills/database-design.server.js

@@ -14,7 +14,7 @@ class XrayDatabaseDesignServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "database-design", version: "1.22.67",
+            name: "database-design", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -815,7 +815,7 @@ class XrayDatabaseDesignServer {
     }
 }
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayDatabaseDesignServer();
     server.run().catch(() => { });
 }

package/dist/mcps/knowledge-skills/devops-deployment.server.js

@@ -6,13 +6,14 @@
  */
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import * as fs from "fs";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 class XrayDevOpsDeploymentServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "devops-deployment", version: "1.22.67",
+            name: "devops-deployment", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -1173,7 +1174,7 @@ spec:
     }
 }
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayDevOpsDeploymentServer();
     server.run().catch(() => { });
 }

package/dist/mcps/knowledge-skills/git-workflow.server.js

@@ -7,12 +7,13 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import * as fs from "fs";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
 class XrayGitWorkflowServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "git-workflow", version: "1.22.67",
+            name: "git-workflow", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -108,7 +109,7 @@ class XrayGitWorkflowServer {
         });
     }
 }
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayGitWorkflowServer();
     server.run().catch(() => { });
 }

package/dist/mcps/knowledge-skills/growth-strategist.server.js

@@ -7,7 +7,7 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 class MarketingExpertServer {
     server;
@@ -93,7 +93,7 @@ class MarketingExpertServer {
         },
     ];
     constructor() {
-        this.server = new Server({ name: "growth-strategist", version: "1.22.67" }, { capabilities: { tools: {} } });
+        this.server = new Server({ name: "growth-strategist", version: "3.1.0" }, { capabilities: { tools: {} } });
         this.server.setRequestHandler(ListToolsRequestSchema, async () => ({
             tools: this.tools,
         }));
@@ -353,7 +353,7 @@ class MarketingExpertServer {
         await this.server.connect(transport);
     }
 }
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
     const server = new MarketingExpertServer();
     server.run();

package/dist/mcps/knowledge-skills/log-monitor.server.js

@@ -8,7 +8,7 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 class LogMonitorServer {
     server;
@@ -60,7 +60,7 @@ class LogMonitorServer {
         },
     ];
     constructor() {
-        this.server = new Server({ name: "log-monitor", version: "1.22.67" }, { capabilities: { tools: {} } });
+        this.server = new Server({ name: "log-monitor", version: "3.1.0" }, { capabilities: { tools: {} } });
         this.setupToolHandlers();
     }
     setupToolHandlers() {
@@ -443,7 +443,7 @@ ${analysis.recommendations.map((r) => `- ${r}`).join("\n")}
         await this.server.connect(transport);
     }
 }
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
     const server = new LogMonitorServer();
     server.run();

package/dist/mcps/knowledge-skills/mobile-development.server.js

@@ -7,13 +7,13 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 class XrayMobileDevelopmentServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "mobile-development", version: "1.22.67",
+            name: "mobile-development", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -517,7 +517,7 @@ class HomePage extends StatelessWidget {
         await this.server.connect(transport);
     }
 }
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
     const server = new XrayMobileDevelopmentServer();
     server.start().catch(() => { });

package/dist/mcps/knowledge-skills/multimodal-looker.server.js

@@ -10,7 +10,7 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 import { frameworkLogger } from "../../core/framework-logger.js";
 /* ============================================================================
@@ -19,7 +19,7 @@ import { frameworkLogger } from "../../core/framework-logger.js";
 class MultimodalLookerServer {
     server;
     constructor() {
-        this.server = new Server({ name: "multimodal-looker", version: "1.22.67" }, { capabilities: { tools: {} } });
+        this.server = new Server({ name: "multimodal-looker", version: "3.1.0" }, { capabilities: { tools: {} } });
         this.setupToolHandlers();
     }
     /* --------------------------------------------------------------------------
@@ -1056,7 +1056,7 @@ class MultimodalLookerServer {
         await this.server.connect(transport);
     }
 }
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
     const server = new MultimodalLookerServer();
     server.run().catch((err) => frameworkLogger.log('multimodal-looker', 'run-error', 'error', { error: String(err) }));

package/dist/mcps/knowledge-skills/performance-optimization.server.js

@@ -16,7 +16,7 @@ class XrayPerformanceOptimizationServer {
     startTime;
     constructor() {
         this.server = new Server({
-            name: "performance-optimization", version: "1.22.67",
+            name: "performance-optimization", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -1578,7 +1578,7 @@ ${result.recommendations.slice(0, 5).map((r, i) => `${i + 1}. ${r}`).join("\n")
         });
     }
 }
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayPerformanceOptimizationServer();
     server.run().catch((error) => {
         frameworkLogger.log("mcp/performance-optimization", "run", "error", { error: String(error) });

package/dist/mcps/knowledge-skills/project-analysis.server.js

@@ -14,7 +14,7 @@ class ProjectAnalysisServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "project-analysis", version: "1.22.67",
+            name: "project-analysis", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -804,7 +804,7 @@ class ProjectAnalysisServer {
     }
 }
 // Start the server if run directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new ProjectAnalysisServer();
     server.run().catch((error) => frameworkLogger.log("mcps/project-analysis", "run", "error", { error: String(error) }));
 }

package/dist/mcps/knowledge-skills/refactoring-strategies.server.js

@@ -6,13 +6,14 @@
  */
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import * as fs from "fs";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 class XrayRefactoringStrategiesServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "refactoring-strategies", version: "1.22.67",
+            name: "refactoring-strategies", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -789,7 +790,7 @@ class XrayRefactoringStrategiesServer {
     }
 }
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayRefactoringStrategiesServer();
     server.run().catch(() => { });
 }

package/dist/mcps/knowledge-skills/security-audit.server.js

@@ -10,11 +10,12 @@ import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextpro
 import * as fs from "fs";
 import * as path from "path";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
+import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
 class XraySecurityAuditServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "security-audit", version: "1.22.67",
+            name: "security-audit", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -777,53 +778,22 @@ class XraySecurityAuditServer {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-        const text = `${proposalTitle} ${proposalDescription} ${evidence.join(" ")}`.toLowerCase();
-        let decision = "approve";
-        let confidence = 0.82;
-        let reasoning = "The proposal does not appear to introduce significant new security surface area.";
-        if (text.includes("aml") || text.includes("kyc") || text.includes("anti-money")) {
-            decision = "approve";
-            confidence = 0.91;
-            reasoning = "AML/KYC compliance measures are critical for regulatory security posture. Automated transaction monitoring closes vulnerability gaps in financial crime detection and demonstrates due diligence for regulatory inspections.";
-        }
-        else if (text.includes("psd2") || text.includes("strong customer authentication") || text.includes("payment initiation")) {
-            decision = "approve";
-            confidence = 0.93;
-            reasoning = "PSD2 SCA implementation is a mandatory security control for payment services. Multi-factor authentication with dynamic linking reduces unauthorized payment risk and satisfies EBA regulatory technical standards.";
-        }
-        else if (text.includes("gdpr") || text.includes("right to erasure") || text.includes("data protection")) {
-            decision = "approve";
-            confidence = 0.94;
-            reasoning = "GDPR compliance controls are foundational to data security posture. Automated data erasure pipelines reduce data breach exposure windows and satisfy supervisory authority inspection requirements.";
-        }
-        else if (text.includes("beneficial ownership") || text.includes("ubo") || text.includes("pep screening")) {
-            decision = "approve";
-            confidence = 0.87;
-            reasoning = "Beneficial ownership transparency and PEP screening are critical AML controls. Verifying ultimate beneficial owners reduces money laundering risk through corporate account structuring.";
-        }
-        else if (text.includes("extract method")) {
-            decision = "approve";
-            confidence = 0.88;
-            reasoning = "Extract Method refactoring improves security posture by reducing attack surface in large monolithic files and enabling better isolation of sensitive logic.";
-        }
-        else if (text.includes("test coverage")) {
-            decision = "approve";
-            confidence = 0.91;
-            reasoning = "Expanding test coverage is one of the highest-ROI security controls available — more tests surface regressions and boundary condition vulnerabilities earlier.";
-        }
-        else if (text.includes("increase timeout") && text.includes("flaky")) {
-            decision = "reject";
-            confidence = 0.75;
-            reasoning = "Repeatedly increasing timeouts to hide flaky tests can mask timing attacks, race conditions, and resource exhaustion vulnerabilities. Root cause remediation is required.";
-        }
-        if (proposalType === "fix" && text.includes("timeout")) {
-            confidence = Math.max(0.65, confidence - 0.10);
+        const vote = await tryLLMGovernance("security-audit", proposalTitle, proposalDescription, evidence, proposalType);
+        if (!vote) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+                    },
+                ],
+            };
         }
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${decision}\nCONFIDENCE: ${confidence.toFixed(2)}\nREASONING: ${reasoning}`,
+                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
                 },
             ],
         };
@@ -839,7 +809,7 @@ class XraySecurityAuditServer {
     }
 }
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XraySecurityAuditServer();
     server.run().catch(() => { });
 }