0xray 3.0.14 → 3.1.1

package/dist/mcps/knowledge-skills/seo-consultant.server.js

@@ -8,11 +8,12 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import * as fs from "fs";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
 class SEOSpecialistServer {
     server;
     constructor() {
-        this.server = new Server({ name: "seo-consultant", version: "1.22.67" }, { capabilities: { tools: {} } });
+        this.server = new Server({ name: "seo-consultant", version: "3.1.0" }, { capabilities: { tools: {} } });
         this.setupToolHandlers();
     }
     setupToolHandlers() {
@@ -930,7 +931,7 @@ Sitemap: ${baseUrl}/sitemap.xml`;
         });
     }
 }
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new SEOSpecialistServer();
     server.run().catch(() => { });
 }

package/dist/mcps/knowledge-skills/session-management.server.js

@@ -7,6 +7,7 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import * as fs from "fs";
 import { frameworkLogger } from "../../core/framework-logger.js";
 class SessionManagementServer {
     server;
@@ -132,7 +133,7 @@ class SessionManagementServer {
         },
     ];
     constructor() {
-        this.server = new Server({ name: "session-management", version: "1.22.67" }, { capabilities: { tools: {} } });
+        this.server = new Server({ name: "session-management", version: "3.1.0" }, { capabilities: { tools: {} } });
         this.server.setRequestHandler(ListToolsRequestSchema, async () => ({
             tools: this.tools,
         }));
@@ -463,7 +464,7 @@ class SessionManagementServer {
         });
     }
 }
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new SessionManagementServer();
     server.run().catch((error) => frameworkLogger.log("mcps/session-management", "run", "error", { error: String(error) }));
 }

package/dist/mcps/knowledge-skills/skill-invocation.server.js

@@ -3,16 +3,17 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
 import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 import { randomUUID } from "crypto";
 import { mcpClientManager } from "../mcp-client.js";
 import { frameworkLogger } from "../../core/framework-logger.js";
+import { skillInstallCommand, skillRegistryCommand } from "../../cli/commands/skill-install.js";
 class SkillInvocationServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "xray/skill-invocation", version: "1.22.67",
+            name: "xray/skill-invocation", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -274,6 +275,61 @@ class SkillInvocationServer {
                             required: ["storyType"],
                         },
                     },
+                    {
+                        name: "install-skill",
+                        description: "Install skills from the registry or any git repo",
+                        inputSchema: {
+                            type: "object",
+                            properties: {
+                                source: {
+                                    type: "string",
+                                    description: "Source name or git URL to install skills from",
+                                },
+                                path: {
+                                    type: "string",
+                                    description: "Subdirectory in repo containing skills",
+                                },
+                                force: {
+                                    type: "boolean",
+                                    description: "Reinstall even if already installed",
+                                },
+                            },
+                            required: ["source"],
+                        },
+                    },
+                    {
+                        name: "skill-registry-list",
+                        description: "List all available skill registry sources",
+                        inputSchema: {
+                            type: "object",
+                            properties: {},
+                        },
+                    },
+                    {
+                        name: "skill-registry-add",
+                        description: "Add a new source to the skills registry",
+                        inputSchema: {
+                            type: "object",
+                            properties: {
+                                name: { type: "string", description: "Unique source name" },
+                                url: { type: "string", description: "Repository URL" },
+                                desc: { type: "string", description: "Short description" },
+                                license: { type: "string", description: "License type" },
+                            },
+                            required: ["name", "url"],
+                        },
+                    },
+                    {
+                        name: "skill-registry-remove",
+                        description: "Remove a source from the skills registry",
+                        inputSchema: {
+                            type: "object",
+                            properties: {
+                                name: { type: "string", description: "Source name to remove" },
+                            },
+                            required: ["name"],
+                        },
+                    },
                 ],
             };
         });
@@ -308,6 +364,14 @@ class SkillInvocationServer {
                         return await this.handleSkillDocumentationGeneration(args);
                     case "skill-storyteller":
                         return await this.handleSkillStoryteller(args);
+                    case "install-skill":
+                        return await this.handleInstallSkill(args);
+                    case "skill-registry-list":
+                        return await this.handleSkillRegistryList();
+                    case "skill-registry-add":
+                        return await this.handleSkillRegistryAdd(args);
+                    case "skill-registry-remove":
+                        return await this.handleSkillRegistryRemove(args);
                     default:
                         throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${name}`);
                 }
@@ -626,6 +690,44 @@ class SkillInvocationServer {
             ],
         };
     }
+    async captureConsole(fn) {
+        const chunks = [];
+        const origLog = console.log;
+        console.log = (...args) => chunks.push(args.map(String).join(" "));
+        try {
+            await fn();
+        }
+        finally {
+            console.log = origLog;
+        }
+        return chunks.join("\n");
+    }
+    async handleInstallSkill(args) {
+        const opts = {};
+        if (args.path !== undefined)
+            opts.path = args.path;
+        if (args.force !== undefined)
+            opts.force = args.force;
+        const output = await this.captureConsole(() => skillInstallCommand(args.source, opts));
+        return { content: [{ type: "text", text: output || "Skill installation completed." }] };
+    }
+    async handleSkillRegistryList() {
+        const output = await this.captureConsole(() => skillRegistryCommand("list"));
+        return { content: [{ type: "text", text: output || "No registry sources configured." }] };
+    }
+    async handleSkillRegistryAdd(args) {
+        const registryArgs = { name: args.name, url: args.url };
+        if (args.desc !== undefined)
+            registryArgs.desc = args.desc;
+        if (args.license !== undefined)
+            registryArgs.license = args.license;
+        const output = await this.captureConsole(() => skillRegistryCommand("add", registryArgs));
+        return { content: [{ type: "text", text: output || "Source added." }] };
+    }
+    async handleSkillRegistryRemove(args) {
+        const output = await this.captureConsole(() => skillRegistryCommand("remove", { name: args.name }));
+        return { content: [{ type: "text", text: output || "Source removed." }] };
+    }
     async run() {
         const transport = new StdioServerTransport();
         await this.server.connect(transport);
@@ -706,7 +808,7 @@ class SkillInvocationServer {
     }
 }
 // Start the server if this file is run directly
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
     // If --port or MCP_PORT is set, use HTTP transport (for Grok CLI compatibility)
     const cliPort = process.argv.find((a) => a.startsWith("--port="))?.split("=")[1];

package/dist/mcps/knowledge-skills/strategist.server.js

@@ -7,7 +7,7 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 import { frameworkLogger } from "../../core/framework-logger.js";
 class StrategistServer {
@@ -78,7 +78,7 @@ class StrategistServer {
     ];
     constructor() {
         this.server = new Server({
-            name: "xray/strategist", version: "1.22.67",
+            name: "xray/strategist", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -209,7 +209,7 @@ class StrategistServer {
         await frameworkLogger.log("mcp-strategist", "server-started", "success");
     }
 }
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
     const server = new StrategistServer();
     server.start().catch((error) => frameworkLogger.log("mcps/strategist", "run", "error", { error: String(error) }));

package/dist/mcps/knowledge-skills/tech-writer.server.js

@@ -14,7 +14,7 @@ class XrayDocumentationGenerationServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "documentation-generation", version: "1.22.67",
+            name: "documentation-generation", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -727,7 +727,7 @@ class XrayDocumentationGenerationServer {
             openapi: "3.0.0",
             info: {
                 title: "API Documentation",
-                version: "1.22.67",
+                version: "3.1.0",
                 description: "Generated API documentation",
             },
             servers: [
@@ -1184,7 +1184,7 @@ class XrayDocumentationGenerationServer {
     }
 }
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayDocumentationGenerationServer();
     server.run().catch(() => { });
 }

package/dist/mcps/knowledge-skills/testing-best-practices.server.js

@@ -6,13 +6,14 @@
  */
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import * as fs from "fs";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 class XrayTestingBestPracticesServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "testing-best-practices", version: "1.22.67",
+            name: "testing-best-practices", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -859,7 +860,7 @@ class XrayTestingBestPracticesServer {
     }
 }
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayTestingBestPracticesServer();
     server.run().catch(() => { });
 }

package/dist/mcps/knowledge-skills/testing-strategy.server.js

@@ -16,7 +16,7 @@ class XrayTestingStrategyServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "testing-strategy", version: "1.22.67",
+            name: "testing-strategy", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -820,7 +820,7 @@ describe("${pathModule.basename(sourceFile, ".ts")}", () => {${testCases}
     }
 }
 // Start the server if run directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayTestingStrategyServer();
     server.run().catch(() => { });
 }

package/dist/mcps/knowledge-skills/ui-ux-design.server.js

@@ -7,12 +7,13 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import * as fs from "fs";
 import { frameworkLogger } from "../../core/framework-logger.js";
 class XrayUIUXDesignServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "ui-ux-design", version: "1.22.67",
+            name: "ui-ux-design", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -1475,7 +1476,7 @@ Available: ${Object.keys(system.components).length} component types
     async run() {
         const transport = new StdioServerTransport();
         await this.server.connect(transport);
-        await frameworkLogger.log("ui-ux-design.server", "-strray-ui-ux-design-mcp-server-running-", "info", { message: "xray UI/UX Design MCP Server running..." });
+        await frameworkLogger.log("ui-ux-design.server", "-xray-ui-ux-design-mcp-server-running-", "info", { message: "xray UI/UX Design MCP Server running..." });
         const cleanup = async (signal) => {
             await frameworkLogger.log("ui-ux-design.server", "-received-signal-shutting-down-gracefully-", "info", { message: `Received ${signal}, shutting down gracefully...` });
             // Set a timeout to force exit if graceful shutdown fails
@@ -1488,7 +1489,7 @@ Available: ${Object.keys(system.components).length} component types
                     await this.server.close();
                 }
                 clearTimeout(timeout);
-                await frameworkLogger.log("ui-ux-design.server", "-strray-mcp-server-shut-down-gracefully-", "info", { message: "xray MCP Server shut down gracefully" });
+                await frameworkLogger.log("ui-ux-design.server", "-xray-mcp-server-shut-down-gracefully-", "info", { message: "xray MCP Server shut down gracefully" });
                 process.exit(0);
             }
             catch (error) {
@@ -1531,7 +1532,7 @@ Available: ${Object.keys(system.components).length} component types
     }
 }
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayUIUXDesignServer();
     server.run().catch((error) => frameworkLogger.log("mcps/ui-ux-design", "run", "error", { error: String(error) }));
 }

package/dist/mcps/lint.server.js

@@ -13,14 +13,14 @@ class XrayLintServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "lint", version: "1.22.67",
+            name: "lint", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
             },
         });
         this.setupToolHandlers();
-        void frameworkLogger.log("lint.server", "-strray-lint-mcp-server-initialized-", "info", { message: "0xRay Lint MCP Server initialized" });
+        void frameworkLogger.log("lint.server", "-xray-lint-mcp-server-initialized-", "info", { message: "0xRay Lint MCP Server initialized" });
     }
     setupToolHandlers() {
         // List available tools
@@ -370,11 +370,11 @@ ${checkResults.details.map((d) => `• ${d}`).join("\n")}
     async run() {
         const transport = new StdioServerTransport();
         await this.server.connect(transport);
-        await frameworkLogger.log("lint.server", "-strray-lint-mcp-server-started-", "info", { message: "0xRay Lint MCP Server started" });
+        await frameworkLogger.log("lint.server", "-xray-lint-mcp-server-started-", "info", { message: "0xRay Lint MCP Server started" });
     }
 }
 // Start the server if run directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayLintServer();
     server.run().catch((error) => frameworkLogger.log("mcps/lint", "run", "error", { error: String(error) }));
 }

package/dist/mcps/mcp-client.js

@@ -98,7 +98,7 @@ export class MCPClient extends EventEmitter {
      * Pure MCP mode — simulation and generic fallbacks are disabled.
      */
     get isPureMcpMode() {
-        return process.env.STRRAY_FORCE_MCP_GOVERNANCE === 'true';
+        return process.env.XRAY_FORCE_MCP_GOVERNANCE === 'true';
     }
     /**
      * Register default simulation implementations
@@ -267,17 +267,17 @@ export class MCPClient extends EventEmitter {
             ],
             'framework-help': [
                 {
-                    name: 'strray_get_capabilities',
+                    name: 'xray_get_capabilities',
                     description: 'Get 0xRay framework capabilities',
                     inputSchema: { type: 'object', properties: {} },
                 },
                 {
-                    name: 'strray_get_commands',
+                    name: 'xray_get_commands',
                     description: 'Get available 0xRay commands',
                     inputSchema: { type: 'object', properties: {} },
                 },
                 {
-                    name: 'strray_explain_capability',
+                    name: 'xray_explain_capability',
                     description: 'Explain a specific capability',
                     inputSchema: {
                         type: 'object',
@@ -375,7 +375,7 @@ export class MCPClient extends EventEmitter {
             // === LAST RESORT: Generic fallback (disabled in pure mode) ===
             if (this.isPureMcpMode) {
                 throw new Error(`[PURE MCP] No real response for ${serverName}/${toolName}. ` +
-                    `All fallbacks are disabled when STRRAY_FORCE_MCP_GOVERNANCE=true.`);
+                    `All fallbacks are disabled when XRAY_FORCE_MCP_GOVERNANCE=true.`);
             }
             const fallbackResult = {
                 content: [

package/dist/mcps/model-health-check.server.js

@@ -7,12 +7,13 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { modelRouter } from "../core/model-router.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import fs from "fs";
 import { frameworkLogger } from "../core/framework-logger.js";
 class XrayModelHealthCheckServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "model-health-check", version: "1.22.67",
+            name: "model-health-check", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -221,7 +222,7 @@ class XrayModelHealthCheckServer {
     }
 }
 // Start the server if this file is run directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayModelHealthCheckServer();
     server.start().catch((error) => frameworkLogger.log("mcps/model-health-check", "run", "error", { error: String(error) }));
 }

package/dist/mcps/orchestrator/server.js

@@ -7,8 +7,9 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import * as fs from 'fs';
 import { frameworkLogger } from '../../core/framework-logger.js';
-import { StringRayStateManager } from '../../state/state-manager.js';
+import { XrayStateManager } from '../../state/state-manager.js';
 import { MultiAgentOrchestrationCoordinator } from '../../orchestrator/multi-agent-orchestration-coordinator.js';
 import { TaskHandler } from './handlers/task-handler.js';
 import { ComplexityHandler } from './handlers/complexity-handler.js';
@@ -29,7 +30,7 @@ export class OrchestratorServer {
     coordinator;
     constructor() {
         // Initialize actual coordinator
-        const stateManager = new StringRayStateManager();
+        const stateManager = new XrayStateManager();
         this.coordinator = new MultiAgentOrchestrationCoordinator(stateManager);
         // Initialize handlers
         this.taskHandler = new TaskHandler();
@@ -294,7 +295,7 @@ export function createOrchestratorServer() {
     return serverInstance;
 }
 // Run if called directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = createOrchestratorServer();
     server.start().catch((error) => {
         frameworkLogger.log('orchestrator.server', 'fatal-error', 'error', {

package/dist/mcps/orchestrator.server.js

@@ -6,10 +6,11 @@
  *
  * @deprecated Use src/mcps/orchestrator/server.ts instead
  */
+import * as fs from 'fs';
 import { frameworkLogger } from '../core/framework-logger.js';
 export { OrchestratorServer, createOrchestratorServer } from './orchestrator/server.js';
 // Run if called directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const { createOrchestratorServer } = await import('./orchestrator/server.js');
     const server = createOrchestratorServer();
     server.start().catch((error) => {

package/dist/mcps/performance-analysis.server.js

@@ -16,7 +16,7 @@ class XrayPerformanceAnalysisServer {
     startTime;
     constructor() {
         this.server = new Server({
-            name: "performance-analysis", version: "1.22.67",
+            name: "performance-analysis", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -512,7 +512,7 @@ ${results.recommendations.map((r) => `• 💡 ${r}`).join("\n") || "No recommen
     }
 }
 // Start the server if run directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayPerformanceAnalysisServer();
     server.run().catch((error) => frameworkLogger.log("mcps/performance-analysis", "run", "error", { error: String(error) }));
 }

package/dist/mcps/processor-pipeline.server.js

@@ -6,6 +6,7 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import * as fs from "fs";
 import { frameworkLogger } from "../core/framework-logger.js";
 import { CodexLoader } from "../enforcement/loaders/codex-loader.js";
 class XrayProcessorPipelineServer {
@@ -26,7 +27,7 @@ class XrayProcessorPipelineServer {
     constructor() {
         this.codexLoader = new CodexLoader();
         this.server = new Server({
-            name: "processor-pipeline", version: "1.22.67",
+            name: "processor-pipeline", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -554,7 +555,7 @@ ${complianceResults.actions.map((a) => `• 🔧 ${a}`).join("\n") || "None requ
     }
 }
 // Start the server if run directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayProcessorPipelineServer();
     server.run().catch((error) => frameworkLogger.log("mcps/processor-pipeline", "run", "error", { error: String(error) }));
 }

package/dist/mcps/registry.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.22.67",
+  "version": "3.1.0",
   "description": "0xRay Community MCPs Registry - curated API-focused MCP servers",
   "sources": [
     {

package/dist/mcps/researcher.server.js

@@ -13,11 +13,12 @@ import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextpro
 import * as fs from "fs";
 import * as path from "path";
 import { frameworkLogger } from "../core/framework-logger.js";
+import { tryLLMGovernance } from "../governance/llm-governance-provider.js";
 class XrayLibrarianServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "researcher", version: "1.22.67",
+            name: "researcher", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -400,48 +401,22 @@ class XrayLibrarianServer {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args || {};
-        const text = `${proposalTitle} ${proposalDescription} ${(evidence || []).join(" ")}`.toLowerCase();
-        let decision = "approve";
-        let confidence = 0.80;
-        let reasoning = "From a project-wide analysis perspective, the proposal aligns with observed recurring patterns and has supporting evidence in the corpus.";
-        if (text.includes("aml") || text.includes("kyc") || text.includes("anti-money")) {
-            decision = "approve";
-            confidence = 0.86;
-            reasoning = "AML/KYC compliance integration is a recurring pattern across financial services codebases. The corpus shows that automated transaction monitoring reduces regulatory incident frequency by approximately 60% when properly integrated with sanction list APIs.";
-        }
-        else if (text.includes("psd2") || text.includes("strong customer authentication") || text.includes("payment initiation")) {
-            decision = "approve";
-            confidence = 0.88;
-            reasoning = "PSD2 SCA patterns are well-established in the corpus across multiple implementations. The Berlin Group standards provide a reliable reference architecture, and existing integrations show consistent compliance with EBA regulatory technical standards.";
-        }
-        else if (text.includes("gdpr") || text.includes("right to erasure") || text.includes("data protection")) {
-            decision = "approve";
-            confidence = 0.91;
-            reasoning = "GDPR data erasure pipeline patterns appear in approximately 35% of enterprise codebases in the corpus. The most successful implementations use the saga pattern with compensating transactions for cross-system consistency.";
-        }
-        else if (text.includes("extract method")) {
-            decision = "approve";
-            confidence = 0.89;
-            reasoning = "The Extract Method pattern is a core refactoring technique that improves modularity; the corpus shows consistent positive outcomes when applied to repeated logic across many sessions.";
-        }
-        else if (text.includes("test coverage")) {
-            decision = "approve";
-            confidence = 0.94;
-            reasoning = "Test coverage expansion is one of the highest-leverage improvements for long-term project health, directly reducing regression incidents across 100+ sessions in the historical data.";
-        }
-        else if (text.includes("technical debt")) {
-            decision = "approve";
-            confidence = 0.85;
-            reasoning = "Systematic technical debt reduction is strongly supported by historical data showing fewer critical violations and faster feature delivery in low-debt modules.";
-        }
-        if (proposalType === "fix" && !text.includes("pattern") && !text.includes("recurring")) {
-            confidence = Math.max(0.68, confidence - 0.10);
+        const vote = await tryLLMGovernance("researcher", proposalTitle || "", proposalDescription || "", evidence || [], proposalType || "");
+        if (!vote) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+                    },
+                ],
+            };
         }
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${decision}\nCONFIDENCE: ${confidence.toFixed(2)}\nREASONING: ${reasoning}`,
+                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
                 },
             ],
         };
@@ -497,7 +472,7 @@ class XrayLibrarianServer {
     }
 }
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XrayLibrarianServer();
     server.run().catch((error) => frameworkLogger.log("mcps/researcher", "run", "error", { error: String(error) }));
 }

package/dist/mcps/security-scan.server.js

@@ -15,7 +15,7 @@ class XraySecurityScanServer {
     server;
     constructor() {
         this.server = new Server({
-            name: "security-scan", version: "1.22.67",
+            name: "security-scan", version: "3.1.0",
         }, {
             capabilities: {
                 tools: {},
@@ -524,7 +524,7 @@ ${results.recommendations.map((r) => `• ${r}`).join("\n") || "No recommendatio
     }
 }
 // Start the server if run directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1])}`) {
     const server = new XraySecurityScanServer();
     server.run().catch((error) => frameworkLogger.log("mcps/security-scan", "run", "error", { error: String(error) }));
 }