0xray 3.0.14 → 3.1.1

package/src/mcps/knowledge-skills/code-review.server.ts

@@ -15,6 +15,7 @@ import {
 import * as fs from "fs";
 import * as path from "path";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
+import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
 
 interface CodeReviewResult {
   file: string;
@@ -80,7 +81,7 @@ class XrayCodeReviewServer {
   constructor() {
     this.server = new Server(
       {
-        name: "code-review", version: "1.22.67",
+        name: "code-review", version: "3.1.0",
       },
       {
         capabilities: {
@@ -465,47 +466,31 @@ class XrayCodeReviewServer {
    */
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-    const text = `${proposalTitle} ${proposalDescription} ${evidence.join(" ")}`.toLowerCase();
-
-    let decision: "approve" | "reject" | "abstain" = "approve";
-    let confidence = 0.82;
-    let reasoning = "The proposal appears reasonable from a code quality and maintainability perspective.";
-
-    if (text.includes("aml") || text.includes("kyc") || text.includes("anti-money")) {
-      decision = "approve";
-      confidence = 0.88;
-      reasoning = "AML/KYC compliance code requires rigorous review: transaction monitoring must handle edge cases, avoid false positives from legitimate patterns, and maintain audit trails for regulatory inspection.";
-    } else if (text.includes("psd2") || text.includes("strong customer authentication") || text.includes("payment initiation")) {
-      decision = "approve";
-      confidence = 0.90;
-      reasoning = "PSD2 SCA implementation must balance security with user experience. Code should use well-audited MFA libraries, avoid rolling custom authentication, and include comprehensive test coverage for all authentication flows.";
-    } else if (text.includes("gdpr") || text.includes("right to erasure") || text.includes("data protection")) {
-      decision = "approve";
-      confidence = 0.92;
-      reasoning = "GDPR erasure pipelines require careful code review: cascading deletes must be transactional, audit logs must be preserved, and the 30-day SLA demands observability and monitoring integration.";
-    } else if (text.includes("extract method")) {
-      decision = "approve";
-      confidence = 0.93;
-      reasoning = "Extract Method is a well-established refactoring pattern that improves readability and reduces cognitive load when applied consistently.";
-    } else if (text.includes("test coverage")) {
-      decision = "approve";
-      confidence = 0.90;
-      reasoning = "Expanding automated test coverage generally improves long-term code health and reduces regression risk.";
-    } else if (text.includes("increase timeout") && text.includes("flaky")) {
-      decision = "reject";
-      confidence = 0.72;
-      reasoning = "Repeatedly increasing timeouts to mask flaky tests is an anti-pattern that hides underlying race conditions or timing issues.";
-    }
 
-    if (proposalType === "fix" && text.includes("timeout")) {
-      confidence = Math.max(0.68, confidence - 0.08);
+    const vote = await tryLLMGovernance(
+      "code-review",
+      proposalTitle,
+      proposalDescription,
+      evidence,
+      proposalType,
+    );
+
+    if (!vote) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+          },
+        ],
+      };
     }
 
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${decision}\nCONFIDENCE: ${confidence.toFixed(2)}\nREASONING: ${reasoning}`,
+          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
         },
       ],
     };
@@ -1124,7 +1109,7 @@ class XrayCodeReviewServer {
 }
 
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1]!)}`) {
   const server = new XrayCodeReviewServer();
   server.run().catch(() => {});
 }

package/src/mcps/knowledge-skills/content-creator.server.ts

@@ -11,7 +11,7 @@ import {
   CallToolRequestSchema,
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 
 interface Tool {
@@ -102,7 +102,7 @@ class SEOCopywriterServer {
 
   constructor() {
     this.server = new Server(
-      { name: "content-creator", version: "1.22.67" },
+      { name: "content-creator", version: "3.1.0" },
       { capabilities: { tools: {} } },
     );
 
@@ -291,7 +291,7 @@ class SEOCopywriterServer {
   }
 }
 
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
   const server = new SEOCopywriterServer();
   server.run();

package/src/mcps/knowledge-skills/database-design.server.ts

@@ -117,7 +117,7 @@ class XrayDatabaseDesignServer {
   constructor() {
     this.server = new Server(
       {
-        name: "database-design", version: "1.22.67",
+        name: "database-design", version: "3.1.0",
       },
       {
         capabilities: {
@@ -1192,7 +1192,7 @@ class XrayDatabaseDesignServer {
 }
 
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1]!)}`) {
   const server = new XrayDatabaseDesignServer();
   server.run().catch(() => {});
 }

package/src/mcps/knowledge-skills/devops-deployment.server.ts

@@ -7,6 +7,7 @@
 
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import * as fs from "fs";
 import { frameworkLogger } from "../../core/framework-logger.js";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
 import {
@@ -212,7 +213,7 @@ class XrayDevOpsDeploymentServer {
   constructor() {
     this.server = new Server(
       {
-        name: "devops-deployment", version: "1.22.67",
+        name: "devops-deployment", version: "3.1.0",
       },
       {
         capabilities: {
@@ -1614,7 +1615,7 @@ spec:
 }
 
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1]!)}`) {
   const server = new XrayDevOpsDeploymentServer();
   server.run().catch(() => {});
 }

package/src/mcps/knowledge-skills/git-workflow.server.ts

@@ -11,6 +11,7 @@ import {
   CallToolRequestSchema,
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
+import * as fs from "fs";
 import { frameworkLogger } from "../../core/framework-logger.js";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
 
@@ -32,7 +33,7 @@ class XrayGitWorkflowServer {
   constructor() {
     this.server = new Server(
       {
-        name: "git-workflow", version: "1.22.67",
+        name: "git-workflow", version: "3.1.0",
       },
       {
         capabilities: {
@@ -144,7 +145,7 @@ class XrayGitWorkflowServer {
   }
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1]!)}`) {
   const server = new XrayGitWorkflowServer();
   server.run().catch(() => {});
 }

package/src/mcps/knowledge-skills/growth-strategist.server.ts

@@ -11,7 +11,7 @@ import {
   CallToolRequestSchema,
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 
 interface Tool {
@@ -111,7 +111,7 @@ class MarketingExpertServer {
 
   constructor() {
     this.server = new Server(
-      { name: "growth-strategist", version: "1.22.67" },
+      { name: "growth-strategist", version: "3.1.0" },
       { capabilities: { tools: {} } },
     );
 
@@ -404,7 +404,7 @@ class MarketingExpertServer {
   }
 }
 
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
   const server = new MarketingExpertServer();
   server.run();

package/src/mcps/knowledge-skills/log-monitor.server.ts

@@ -12,7 +12,7 @@ import {
   CallToolRequestSchema,
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 
 interface LogEntry {
@@ -117,7 +117,7 @@ class LogMonitorServer {
 
   constructor() {
     this.server = new Server(
-      { name: "log-monitor", version: "1.22.67" },
+      { name: "log-monitor", version: "3.1.0" },
       { capabilities: { tools: {} } },
     );
     this.setupToolHandlers();
@@ -610,7 +610,7 @@ ${analysis.recommendations.map((r) => `- ${r}`).join("\n")}
   }
 }
 
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
   const server = new LogMonitorServer();
   server.run();

package/src/mcps/knowledge-skills/mobile-development.server.ts

@@ -11,7 +11,7 @@ import {
   CallToolRequestSchema,
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 
 interface IOSBlueprint {
@@ -113,7 +113,7 @@ class XrayMobileDevelopmentServer {
   constructor() {
     this.server = new Server(
       {
-        name: "mobile-development", version: "1.22.67",
+        name: "mobile-development", version: "3.1.0",
       },
       {
         capabilities: {
@@ -663,7 +663,7 @@ class HomePage extends StatelessWidget {
   }
 }
 
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
   const server = new XrayMobileDevelopmentServer();
   server.start().catch(() => {});

package/src/mcps/knowledge-skills/multimodal-looker.server.ts

@@ -14,7 +14,7 @@ import {
   CallToolRequestSchema,
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
-import * as path from "path";
+import * as fs from "fs";
 import { fileURLToPath } from "url";
 import { frameworkLogger } from "../../core/framework-logger.js";
 
@@ -167,7 +167,7 @@ class MultimodalLookerServer {
 
   constructor() {
     this.server = new Server(
-      { name: "multimodal-looker", version: "1.22.67" },
+      { name: "multimodal-looker", version: "3.1.0" },
       { capabilities: { tools: {} } },
     );
     this.setupToolHandlers();
@@ -1492,7 +1492,7 @@ class MultimodalLookerServer {
   }
 }
 
-const entryPoint = path.resolve(process.argv[1] ?? "");
+const entryPoint = fs.realpathSync(process.argv[1] ?? "");
 if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
   const server = new MultimodalLookerServer();
   server.run().catch((err) => frameworkLogger.log('multimodal-looker', 'run-error', 'error', { error: String(err) }));

package/src/mcps/knowledge-skills/performance-optimization.server.ts

@@ -224,7 +224,7 @@ class XrayPerformanceOptimizationServer {
   constructor() {
     this.server = new Server(
       {
-        name: "performance-optimization", version: "1.22.67",
+        name: "performance-optimization", version: "3.1.0",
       },
       {
         capabilities: {
@@ -2055,7 +2055,7 @@ ${result.recommendations.slice(0, 5).map((r, i) => `${i + 1}. ${r}`).join("\n")
   }
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1]!)}`) {
   const server = new XrayPerformanceOptimizationServer();
   server.run().catch((error) => {
     frameworkLogger.log("mcp/performance-optimization", "run", "error", { error: String(error) });

package/src/mcps/knowledge-skills/project-analysis.server.ts

@@ -142,7 +142,7 @@ class ProjectAnalysisServer {
   constructor() {
     this.server = new Server(
       {
-        name: "project-analysis", version: "1.22.67",
+        name: "project-analysis", version: "3.1.0",
       },
       {
         capabilities: {
@@ -1103,7 +1103,7 @@ class ProjectAnalysisServer {
 }
 
 // Start the server if run directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1]!)}`) {
   const server = new ProjectAnalysisServer();
   server.run().catch((error: unknown) => frameworkLogger.log("mcps/project-analysis", "run", "error", { error: String(error) }));
 }

package/src/mcps/knowledge-skills/refactoring-strategies.server.ts

@@ -7,6 +7,7 @@
 
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import * as fs from "fs";
 import { frameworkLogger } from "../../core/framework-logger.js";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
 import {
@@ -160,7 +161,7 @@ class XrayRefactoringStrategiesServer {
   constructor() {
     this.server = new Server(
       {
-        name: "refactoring-strategies", version: "1.22.67",
+        name: "refactoring-strategies", version: "3.1.0",
       },
       {
         capabilities: {
@@ -1084,7 +1085,7 @@ class XrayRefactoringStrategiesServer {
 }
 
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1]!)}`) {
   const server = new XrayRefactoringStrategiesServer();
   server.run().catch(() => {});
 }

package/src/mcps/knowledge-skills/security-audit.server.ts

@@ -15,6 +15,7 @@ import {
 import * as fs from "fs";
 import * as path from "path";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
+import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
 
 interface SecurityVulnerability {
   id: string;
@@ -90,7 +91,7 @@ class XraySecurityAuditServer {
   constructor() {
     this.server = new Server(
       {
-        name: "security-audit", version: "1.22.67",
+        name: "security-audit", version: "3.1.0",
       },
       {
         capabilities: {
@@ -1122,51 +1123,31 @@ class XraySecurityAuditServer {
    */
   async analyzeProposal(args: AnalyzeProposalArgs) {
     const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-    const text = `${proposalTitle} ${proposalDescription} ${evidence.join(" ")}`.toLowerCase();
-
-    let decision: "approve" | "reject" | "abstain" = "approve";
-    let confidence = 0.82;
-    let reasoning = "The proposal does not appear to introduce significant new security surface area.";
-
-    if (text.includes("aml") || text.includes("kyc") || text.includes("anti-money")) {
-      decision = "approve";
-      confidence = 0.91;
-      reasoning = "AML/KYC compliance measures are critical for regulatory security posture. Automated transaction monitoring closes vulnerability gaps in financial crime detection and demonstrates due diligence for regulatory inspections.";
-    } else if (text.includes("psd2") || text.includes("strong customer authentication") || text.includes("payment initiation")) {
-      decision = "approve";
-      confidence = 0.93;
-      reasoning = "PSD2 SCA implementation is a mandatory security control for payment services. Multi-factor authentication with dynamic linking reduces unauthorized payment risk and satisfies EBA regulatory technical standards.";
-    } else if (text.includes("gdpr") || text.includes("right to erasure") || text.includes("data protection")) {
-      decision = "approve";
-      confidence = 0.94;
-      reasoning = "GDPR compliance controls are foundational to data security posture. Automated data erasure pipelines reduce data breach exposure windows and satisfy supervisory authority inspection requirements.";
-    } else if (text.includes("beneficial ownership") || text.includes("ubo") || text.includes("pep screening")) {
-      decision = "approve";
-      confidence = 0.87;
-      reasoning = "Beneficial ownership transparency and PEP screening are critical AML controls. Verifying ultimate beneficial owners reduces money laundering risk through corporate account structuring.";
-    } else if (text.includes("extract method")) {
-      decision = "approve";
-      confidence = 0.88;
-      reasoning = "Extract Method refactoring improves security posture by reducing attack surface in large monolithic files and enabling better isolation of sensitive logic.";
-    } else if (text.includes("test coverage")) {
-      decision = "approve";
-      confidence = 0.91;
-      reasoning = "Expanding test coverage is one of the highest-ROI security controls available — more tests surface regressions and boundary condition vulnerabilities earlier.";
-    } else if (text.includes("increase timeout") && text.includes("flaky")) {
-      decision = "reject";
-      confidence = 0.75;
-      reasoning = "Repeatedly increasing timeouts to hide flaky tests can mask timing attacks, race conditions, and resource exhaustion vulnerabilities. Root cause remediation is required.";
-    }
 
-    if (proposalType === "fix" && text.includes("timeout")) {
-      confidence = Math.max(0.65, confidence - 0.10);
+    const vote = await tryLLMGovernance(
+      "security-audit",
+      proposalTitle,
+      proposalDescription,
+      evidence,
+      proposalType,
+    );
+
+    if (!vote) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+          },
+        ],
+      };
     }
 
     return {
       content: [
         {
           type: "text",
-          text: `DECISION: ${decision}\nCONFIDENCE: ${confidence.toFixed(2)}\nREASONING: ${reasoning}`,
+          text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
         },
       ],
     };
@@ -1185,7 +1166,7 @@ class XraySecurityAuditServer {
 }
 
 // Run the server if this file is executed directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1]!)}`) {
   const server = new XraySecurityAuditServer();
   server.run().catch(() => {});
 }

package/src/mcps/knowledge-skills/seo-consultant.server.ts

@@ -12,6 +12,7 @@ import {
   CallToolRequestSchema,
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
+import * as fs from "fs";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
 
 interface SEOIssue {
@@ -69,7 +70,7 @@ class SEOSpecialistServer {
 
   constructor() {
     this.server = new Server(
-      { name: "seo-consultant", version: "1.22.67" },
+      { name: "seo-consultant", version: "3.1.0" },
       { capabilities: { tools: {} } },
     );
 
@@ -1152,7 +1153,7 @@ Sitemap: ${baseUrl}/sitemap.xml`;
   }
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1]!)}`) {
   const server = new SEOSpecialistServer();
   server.run().catch(() => {});
 }

package/src/mcps/knowledge-skills/session-management.server.ts

@@ -11,6 +11,7 @@ import {
   CallToolRequestSchema,
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
+import * as fs from "fs";
 import { frameworkLogger } from "../../core/framework-logger.js";
 
 interface Tool {
@@ -161,7 +162,7 @@ class SessionManagementServer {
 
   constructor() {
     this.server = new Server(
-      { name: "session-management", version: "1.22.67" },
+      { name: "session-management", version: "3.1.0" },
       { capabilities: { tools: {} } },
     );
 
@@ -568,7 +569,7 @@ class SessionManagementServer {
   }
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (import.meta.url === `file://${fs.realpathSync(process.argv[1]!)}`) {
   const server = new SessionManagementServer();
   server.run().catch((error) => frameworkLogger.log("mcps/session-management", "run", "error", { error: String(error) }));
 }