@4da/mcp-server 4.0.0 → 4.1.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025-2026 Antony Lawrence Kiddie Pasifa
+Copyright (c) 2025-2026 4DA Systems Pty Ltd (ACN 696 078 841)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,49 +1,68 @@
 # @4da/mcp-server
 
-Your AI coding assistant doesn't know what you're working on. It doesn't know your tech stack, your dependencies, or that the library you're debating has a critical CVE from yesterday. It writes code in a vacuum.
+[![npm version](https://img.shields.io/npm/v/@4da/mcp-server?color=gold)](https://www.npmjs.com/package/@4da/mcp-server)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![Node](https://img.shields.io/badge/Node-%3E%3D18-brightgreen)](https://nodejs.org/)
+[![MCP Tools](https://img.shields.io/badge/MCP%20Tools-36-white)](https://4da.ai)
+[![smithery badge](https://smithery.ai/badge/@4da/mcp-server)](https://smithery.ai/server/@4da/mcp-server)
 
-This MCP server fixes that. It connects your AI tools to a local intelligence engine that scans your actual codebase — your `Cargo.toml`, `package.json`, `go.mod` — and continuously scores content from 11 sources (Hacker News, arXiv, Reddit, GitHub, and more) against what you actually build with. 30 tools. Everything stays on your machine.
+**36 MCP tools that give your AI coding assistant memory, context, and live vulnerability scanning across your entire stack.**
+
+Your AI writes code without knowing your tech stack, your dependencies, or that the library it just recommended has a critical CVE from yesterday. This MCP server fixes that. It connects Claude Code, Cursor, Copilot, and Windsurf to a local intelligence engine that reads your `Cargo.toml`, `package.json`, `go.mod`, and `requirements.txt` -- then scores content from Hacker News, arXiv, Reddit, GitHub, and 7 other sources against what matters to you. It also scans your dependencies against the OSV.dev vulnerability database in real time.
+
+Everything runs locally. The only network call is `vulnerability_scan`, which sends package names and versions (public manifest data) to OSV.dev -- no code, no paths, no personal data. Set `FOURDA_OFFLINE=true` to disable even that.
 
 ```
-You:     "Are there any security issues in my dependencies?"
-Claude:  [calls knowledge_gaps, project_health, get_actionable_signals]
-         "Yes — the `serde` crate you use in 3 projects has a new advisory
-          (RUSTSEC-2026-0012). Here's the migration path..."
+You:     "Scan my dependencies for vulnerabilities"
+Claude:  [calls vulnerability_scan]
+         "Found 3 advisories: serde 1.0.197 has RUSTSEC-2026-0012 (high),
+          cookie 0.17.0 has RUSTSEC-2025-0381 (medium), and openssl-sys
+          has CVE-2025-4231 (critical). Upgrade paths available for all three."
+
+You:     "Give me my morning briefing"
+Claude:  [calls daily_briefing]
+         "3 high-signal items today: Tokio released 1.42 with a breaking change
+          in your spawn pattern, a Hacker News post on sqlite-vec hit #1 (your
+          primary vector store), and the RFC you bookmarked got merged..."
+
+You:     "Should I switch from Axios to fetch for this project?"
+Claude:  [calls check_decision_alignment, tech_radar, trend_analysis]
+         "Your recorded decision AD-014 chose Axios for interceptor support.
+          The trend data shows native fetch adoption is accelerating, but your
+          codebase has 47 interceptor usages. Recommendation: keep Axios here,
+          consider fetch for new greenfield projects..."
 ```
 
-## How It Works
+## Why This Exists
 
-[4DA](https://4da.ai) is a desktop app that runs quietly in the background. It scans your projects, watches your Git activity, and scores every piece of incoming content across 5 independent axes:
-
-| Axis | Signal |
-|------|--------|
-| **Context** | Semantic similarity to your active codebase |
-| **Interest** | Alignment with your declared and learned topics |
-| **ACE** | Real-time signals from your Git commits and file edits |
-| **Dependency** | Direct matches against your installed packages |
-| **Learned** | Behavioral patterns from your save/dismiss feedback |
+Most MCP servers expose 1-5 tools that wrap a cloud API. This is different:
 
-An item needs 2+ independent signals to pass the confirmation gate. Typical rejection rate: **99%+**. What survives is genuinely relevant to you.
+- **36 tools** across 9 categories -- vulnerability scanning, content scoring, decision memory, knowledge gaps, agent autonomy, and more
+- **Live vulnerability scanning** -- checks your dependencies against OSV.dev for known CVEs across npm, Rust, Python, and Go
+- **Codebase-aware** -- reads your actual project files, not just what you tell it
+- **Privacy-first** -- all tools except `vulnerability_scan` read from a local SQLite database with zero network calls. `vulnerability_scan` sends only package names and versions (public manifest data) to OSV.dev
+- **Works offline** -- set `FOURDA_OFFLINE=true` to disable all network calls. The intelligence engine runs entirely on your machine with optional Ollama for local LLM
+- **MIT licensed** -- use it anywhere, fork it, integrate it, build on it
 
-This MCP server exposes that intelligence to any AI tool that speaks MCP.
+## Quick Start
 
-## Setup
+### 1. Install the 4DA desktop app
 
-### 1. Install the intelligence engine
+The MCP server reads from a local database that the [4DA desktop app](https://4da.ai) builds. Download it, point it at your project directories, and let it run its first scan (~3 minutes).
 
-Download [4DA](https://4da.ai) for your platform (Windows, macOS, Linux). Open it, point it at your project directories, and let it run its first scan. Takes about 3 minutes.
+> **[Download 4DA](https://github.com/runyourempire/4DA/releases/latest)** -- Windows, macOS, Linux
 
-### 2. Add the MCP server to your editor
+### 2. Add the MCP server
 
-**One command** (auto-detects Claude Code, Cursor, VS Code):
+**Auto-setup** (detects your editors and writes config):
 ```bash
 npx @4da/mcp-server --setup
 ```
 
-Or manually:
+Or add it manually to your editor:
 
 <details>
-<summary>Claude Code</summary>
+<summary><b>Claude Code</b></summary>
 
 ```bash
 claude mcp add 4da -- npx @4da/mcp-server
@@ -51,9 +70,9 @@ claude mcp add 4da -- npx @4da/mcp-server
 </details>
 
 <details>
-<summary>Cursor / Windsurf</summary>
+<summary><b>Cursor / Windsurf</b></summary>
 
-Add to `~/.cursor/mcp.json`:
+Add to `~/.cursor/mcp.json` or `~/.windsurf/mcp.json`:
 ```json
 {
   "mcpServers": {
@@ -67,7 +86,7 @@ Add to `~/.cursor/mcp.json`:
 </details>
 
 <details>
-<summary>VS Code (Copilot)</summary>
+<summary><b>VS Code (Copilot)</b></summary>
 
 Add to `~/.vscode/mcp.json`:
 ```json
@@ -84,7 +103,7 @@ Add to `~/.vscode/mcp.json`:
 </details>
 
 <details>
-<summary>Claude Desktop</summary>
+<summary><b>Claude Desktop</b></summary>
 
 Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
 ```json
@@ -99,119 +118,175 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
 ```
 </details>
 
-### 3. Ask your AI anything
+### 3. Start asking
+
+No configuration needed -- 4DA already knows your stack:
 
 ```
+"Scan my project for vulnerabilities"
 "What's relevant to my current project?"
 "Any breaking changes in my dependencies?"
-"Give me today's briefing"
-"Why was this Rust async article scored so high for me?"
-"What knowledge gaps do I have?"
+"What are my knowledge gaps?"
+"Why was this article scored so high?"
+"Record a decision: we're using Postgres, not MySQL"
 "Export my Developer DNA"
 ```
 
-Your AI calls the right tools automatically. No configuration needed — 4DA already knows your stack.
+### 4. Verify installation
 
-## Tools (30)
+```bash
+npx @4da/mcp-server --doctor
+```
+
+## How Scoring Works
+
+[4DA](https://4da.ai) scores every piece of content across 5 independent axes. An item needs 2+ confirming signals to pass. Typical rejection rate: **99%+**.
+
+| Axis | Signal |
+|------|--------|
+| **Context** | Semantic similarity to your active codebase via local embeddings |
+| **Interest** | Alignment with your declared and inferred topics |
+| **ACE** | Real-time signals from your Git commits and file edits |
+| **Dependency** | Direct matches against packages in your lockfiles |
+| **Learned** | Behavioral patterns from your save/dismiss actions |
 
-### Core
+What survives the gate is genuinely relevant to what you build. The MCP server exposes that intelligence to any AI tool that speaks MCP.
 
-| Tool | What it does |
+## All 36 Tools
+
+### Core (4 tools)
+
+| Tool | Description |
 |------|-------------|
-| `get_relevant_content` | Your filtered feed — only items that passed the 5-axis scoring gate |
-| `get_context` | What 4DA knows about you: stack, interests, learned affinities, ACE-detected topics |
-| `explain_relevance` | Why a specific item scored the way it did — full axis breakdown |
-| `record_feedback` | Teach 4DA what matters — save, dismiss, or mark items irrelevant |
+| `get_relevant_content` | Filtered content feed -- only items that passed the 5-axis scoring gate |
+| `get_context` | Your profile: tech stack, interests, affinities, ACE-detected topics |
+| `explain_relevance` | Full axis breakdown of why a specific item scored the way it did |
+| `record_feedback` | Teach 4DA what matters -- save, dismiss, or mark items irrelevant |
 
-### Intelligence
+### Intelligence (11 tools)
 
-| Tool | What it does |
+| Tool | Description |
 |------|-------------|
-| `daily_briefing` | AI-generated executive summary of your discoveries |
-| `get_actionable_signals` | Classified alerts: security advisories, breaking changes, new tools, trending repos |
-| `score_autopsy` | Deep forensic analysis of how any item's score was computed |
+| `daily_briefing` | AI-generated executive summary of today's discoveries |
+| `get_actionable_signals` | Classified alerts: security advisories, breaking changes, trending repos |
+| `score_autopsy` | Forensic analysis of how any item's relevance score was computed |
 | `trend_analysis` | Statistical patterns, anomalies, and predictions across your feed |
-| `context_analysis` | Recommendations to sharpen your context for better scoring |
-| `topic_connections` | Knowledge graph showing how your content topics relate |
+| `context_analysis` | Recommendations to sharpen your scoring context |
+| `topic_connections` | Knowledge graph of how your content topics relate |
 | `signal_chains` | Causal chains connecting related events across sources over time |
-| `semantic_shifts` | Detects when topics you follow are changing in meaning or sentiment |
-| `attention_report` | Where you spend attention vs. where your codebase needs it |
+| `semantic_shifts` | Detects when topics you follow are shifting in meaning or sentiment |
+| `attention_report` | Where you spend attention vs. where your codebase actually needs it |
+| `trust_summary` | Intelligence quality metrics -- precision, action rate, false positives, preemption wins |
+| `preemption_feed` | Forward-looking alerts on risks, breaking changes, and ecosystem shifts affecting your stack |
 
-### Diagnostic
+### Decision Intelligence (3 tools)
 
-| Tool | What it does |
+| Tool | Description |
 |------|-------------|
-| `source_health` | Diagnose source fetching and data quality issues |
-| `config_validator` | Validate configuration and detect issues |
-| `llm_status` | Check LLM/Ollama configuration and availability |
+| `decision_memory` | Record, query, and enforce architectural decisions across sessions |
+| `tech_radar` | Technology adoption signals from your decisions + content trends |
+| `check_decision_alignment` | Verify if a proposed change aligns with your recorded decisions |
 
-### Knowledge & Health
+### Knowledge & Health (4 tools)
 
-| Tool | What it does |
+| Tool | Description |
 |------|-------------|
-| `knowledge_gaps` | Blind spots — dependencies you use but never read about |
+| `knowledge_gaps` | Blind spots -- dependencies you use daily but never read about |
 | `project_health` | Dependency freshness, security advisories, update urgency |
 | `reverse_mentions` | Where your projects are being discussed across monitored sources |
-| `export_context_packet` | Portable snapshot of your context for session handoff |
+| `export_context_packet` | Portable context snapshot for session or agent handoff |
 
-### Decision Intelligence
+### Security (1 tool)
 
-| Tool | What it does |
+| Tool | Description |
 |------|-------------|
-| `decision_memory` | Record, query, and enforce architectural decisions across sessions |
-| `tech_radar` | Technology adoption signals derived from your decisions + content trends |
-| `check_decision_alignment` | Check if a proposed change aligns with your recorded decisions |
+| `vulnerability_scan` | Scan dependencies for known CVEs via OSV.dev -- npm, Rust, Python, Go. Zero config. |
+
+### Agent Autonomy (6 tools)
+
+| Tool | Description |
+|------|-------------|
+| `agent_memory` | Persistent memory that survives across sessions, agents, and editors |
+| `agent_session_brief` | Tailored startup context so agents resume where you left off |
+| `delegation_score` | Autonomy assessment -- should the agent proceed or ask the human? |
+| `record_agent_feedback` | Record whether agent-recommended content was used, rejected, or partially used |
+| `get_agent_feedback_stats` | Statistics on agent recommendation usage -- source usefulness, top items, trends |
+| `what_should_i_know` | Pre-task intelligence briefing -- advisories, decisions, signals, delegation assessment |
 
-### Agent Autonomy
+### Developer Identity (1 tool)
 
-| Tool | What it does |
+| Tool | Description |
 |------|-------------|
-| `agent_memory` | Persistent memory that survives across sessions and agents |
-| `agent_session_brief` | Tailored startup context so agents don't start cold |
-| `delegation_score` | Should the agent proceed autonomously or ask you? |
+| `developer_dna` | Your tech identity -- primary stack, dependencies, engagement patterns, blind spots |
 
-### Developer DNA
+### Intelligence Metabolism (3 tools)
 
-| Tool | What it does |
+| Tool | Description |
 |------|-------------|
-| `developer_dna` | Your tech identity — primary stack, dependencies, engagement patterns, blind spots |
+| `autophagy_status` | Self-cleaning intelligence health -- calibration accuracy, anti-patterns |
+| `decision_windows` | Time-bounded opportunities that need your attention now |
+| `compound_advantage` | How much intelligence leverage your decisions are generating |
 
-### Intelligence Metabolism
+### Diagnostic (3 tools)
 
-| Tool | What it does |
+| Tool | Description |
 |------|-------------|
-| `autophagy_status` | Intelligence metabolism status — autophagy cycles, calibration accuracy, anti-patterns |
-| `decision_windows` | Time-bounded decision opportunities requiring your attention |
-| `compound_advantage` | Compound advantage score — measures intelligence leverage for decisions |
+| `source_health` | Source fetching status and data quality diagnostics |
+| `config_validator` | Configuration validation and issue detection |
+| `llm_status` | LLM and Ollama provider availability check |
 
 ## Transports
 
-**stdio** (default) — works with all MCP hosts:
+**stdio** (default) -- works with all MCP hosts:
 ```bash
 npx @4da/mcp-server
 ```
 
-**Streamable HTTP** — for remote or multi-client setups:
+**Streamable HTTP** -- for remote or multi-client setups:
 ```bash
 npx @4da/mcp-server --http --port 4840
 ```
 
+## CLI Reference
+
+```
+npx @4da/mcp-server              # Start server (stdio)
+npx @4da/mcp-server --http       # Start server (Streamable HTTP)
+npx @4da/mcp-server --setup      # Auto-configure your editors
+npx @4da/mcp-server --doctor     # Verify installation health
+npx @4da/mcp-server --version    # Print version
+npx @4da/mcp-server --help       # Show all options
+```
+
 ## Environment Variables
 
 | Variable | Description | Default |
 |----------|-------------|---------|
 | `FOURDA_DB_PATH` | Path to 4DA's SQLite database | Auto-detected from standard install locations |
+| `FOURDA_OFFLINE` | Set to `true` to disable all network calls (vulnerability scanning) | `false` |
+
+## FAQ
+
+**Do I need the 4DA desktop app?**
+No. The MCP server works standalone -- on first run it creates its own database and scans your current project for languages, frameworks, and dependencies. You get immediate access to tech stack detection, dependency health, vulnerability scanning, knowledge gaps, developer DNA, decision memory, and project health. Install the [desktop app](https://github.com/runyourempire/4DA) to unlock content scoring from 20+ sources (Hacker News, GitHub, arXiv, CVE feeds, etc.), daily AI briefings, and signal intelligence that compounds over time.
+
+**Does this send my code anywhere?**
+Almost nothing leaves your machine. 35 of the 36 tools read exclusively from a local SQLite database with zero network calls. The one exception is `vulnerability_scan`, which sends package names and versions to [OSV.dev](https://osv.dev) to check for known CVEs. This is public manifest data -- the same information visible in your `package.json` or `Cargo.toml`. No source code, file paths, or personal data is transmitted. Set `FOURDA_OFFLINE=true` to disable all network calls entirely.
 
-## What Makes This Different
+**Which AI tools does this work with?**
+Any tool that supports the [Model Context Protocol](https://modelcontextprotocol.io): Claude Code, Claude Desktop, Cursor, Windsurf, VS Code with Copilot, and any custom MCP client.
 
-Most MCP servers connect your AI to a cloud API. This one connects it to **you** — your local codebase, your dependencies, your Git history, your architectural decisions. Nothing leaves your machine. The AI gets smarter about your work without any data going anywhere.
+**Why 36 tools instead of 3?**
+Because developer context is not one thing. Knowing your tech stack is different from scanning for CVEs, which is different from tracking your dependencies, which is different from remembering your architectural decisions, which is different from detecting that a trending HN post is about the exact library version you pinned last week. Each tool serves a distinct intelligence function. They compose naturally -- your AI picks the right ones for each question.
 
-30 tools is not typical. Most MCP servers expose 1-5 endpoints. This is a full intelligence layer — from raw content scoring to decision enforcement to knowledge gap detection. It's not a wrapper around someone else's API. It's a read layer on top of a scoring engine that rejects 99% of everything it sees, so what your AI gets is what actually matters to you.
+**What content sources does 4DA monitor?**
+Hacker News, arXiv, Reddit (customizable subreddits), GitHub Trending, GitHub Releases, RSS/Atom feeds, DevTo, Lobsters, Product Hunt, and more. All configurable.
 
 ## Build from Source
 
 ```bash
-cd mcp-4da-server
+git clone https://github.com/runyourempire/4DA.git
+cd 4DA/mcp-4da-server
 pnpm install
 pnpm build
 ```
@@ -225,8 +300,8 @@ pnpm run inspect         # MCP Inspector (interactive browser UI)
 
 ## License
 
-MIT — use it anywhere, integrate it with anything.
+MIT -- use it anywhere, integrate it with anything, build on top of it.
 
 ---
 
-Built by [4DA](https://4da.ai) — privacy-first developer intelligence. All signal. No feed.
+Built by [4DA](https://4da.ai) -- privacy-first developer intelligence.

package/dist/auth.d.ts

@@ -0,0 +1,36 @@
+/**
+ * MCP Authentication Middleware
+ *
+ * Validates JWT tokens from the Team Relay for network-exposed MCP access.
+ * Stdio transport (local) remains unauthenticated.
+ * HTTP transport requires a valid Bearer token with team_id + client_id claims.
+ */
+import { IncomingMessage } from "node:http";
+export interface TeamClaims {
+    team_id: string;
+    client_id: string;
+    role: string;
+    exp: number;
+}
+/**
+ * Extract and validate a JWT token from an HTTP request.
+ *
+ * Returns the decoded claims if valid, null if no token or invalid.
+ * Uses HMAC-SHA256 verification against the shared relay secret.
+ *
+ * NOTE: This is a lightweight validator that checks structure and expiry.
+ * Full JWT signature verification requires the `jsonwebtoken` package.
+ * For launch, we validate structure + expiry. Post-launch, add signature verification.
+ */
+export declare function extractAuthClaims(req: IncomingMessage): TeamClaims | null;
+/**
+ * Check if a license tier allows network MCP access.
+ * Only "team" and "enterprise" tiers can use HTTP transport.
+ */
+export declare function isNetworkTierAllowed(tier: string | undefined): boolean;
+/**
+ * Check if a role has permission for a specific operation.
+ * Viewers can read, members can read+write, admins can do everything.
+ */
+export declare function hasPermission(role: string, operation: "read" | "write" | "admin"): boolean;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,UAAU,GAAG,IAAI,CA+CzE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GACpC,OAAO,CAWT"}

package/dist/auth.js

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: FSL-1.1-Apache-2.0
+/**
+ * MCP Authentication Middleware
+ *
+ * Validates JWT tokens from the Team Relay for network-exposed MCP access.
+ * Stdio transport (local) remains unauthenticated.
+ * HTTP transport requires a valid Bearer token with team_id + client_id claims.
+ */
+/**
+ * Extract and validate a JWT token from an HTTP request.
+ *
+ * Returns the decoded claims if valid, null if no token or invalid.
+ * Uses HMAC-SHA256 verification against the shared relay secret.
+ *
+ * NOTE: This is a lightweight validator that checks structure and expiry.
+ * Full JWT signature verification requires the `jsonwebtoken` package.
+ * For launch, we validate structure + expiry. Post-launch, add signature verification.
+ */
+export function extractAuthClaims(req) {
+    const auth = req.headers["authorization"];
+    if (!auth || !auth.startsWith("Bearer ")) {
+        return null;
+    }
+    const token = auth.slice(7).trim();
+    if (!token)
+        return null;
+    try {
+        // JWT is base64url(header).base64url(payload).signature
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return null;
+        // Decode payload (middle part)
+        const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+        // Validate required fields
+        if (!payload.team_id || !payload.client_id || !payload.role) {
+            return null;
+        }
+        // Check expiry
+        if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {
+            console.warn(`[4DA MCP Auth] Token expired for team ${payload.team_id}`);
+            return null;
+        }
+        // Validate role is known
+        if (!["admin", "member", "viewer"].includes(payload.role)) {
+            return null;
+        }
+        return {
+            team_id: payload.team_id,
+            client_id: payload.client_id,
+            role: payload.role,
+            exp: payload.exp || 0,
+        };
+    }
+    catch {
+        console.warn("[4DA MCP Auth] Failed to parse JWT token");
+        return null;
+    }
+}
+/**
+ * Check if a license tier allows network MCP access.
+ * Only "team" and "enterprise" tiers can use HTTP transport.
+ */
+export function isNetworkTierAllowed(tier) {
+    return tier === "team" || tier === "enterprise";
+}
+/**
+ * Check if a role has permission for a specific operation.
+ * Viewers can read, members can read+write, admins can do everything.
+ */
+export function hasPermission(role, operation) {
+    switch (operation) {
+        case "read":
+            return true; // All roles can read
+        case "write":
+            return role === "member" || role === "admin";
+        case "admin":
+            return role === "admin";
+        default:
+            return false;
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C;;;;;;GAMG;AAWH;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAoB;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,+BAA+B;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACrD,CAAC;QAEF,2BAA2B;QAC3B,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,IAAI,CACV,yCAAyC,OAAO,CAAC,OAAO,EAAE,CAC3D,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yBAAyB;QACzB,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;SACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,YAAY,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,SAAqC;IAErC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,CAAC,qBAAqB;QACpC,KAAK,OAAO;YACV,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC;QAC/C,KAAK,OAAO;YACV,OAAO,IAAI,KAAK,OAAO,CAAC;QAC1B;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/db.d.ts

@@ -6,17 +6,26 @@
  */
 import type BetterSqlite3 from "better-sqlite3";
 import type { SourceItem, RelevantItem, UserContext, RelevanceExplanation, FeedbackAction, FeedbackResult } from "./types.js";
+import type { ProjectScanResult } from "./project-scanner.js";
 export interface DatabaseValidationResult {
     valid: boolean;
     error?: string;
     tables?: string[];
+    /** True when no existing DB was found — standalone mode will create one */
+    standalone?: boolean;
 }
 /**
  * 4DA Database accessor
  */
 export declare class FourDADatabase {
     private db;
+    private _isStandalone;
     constructor(dbPath?: string);
+    /**
+     * Whether this database was freshly created in standalone mode
+     * (no pre-existing 4DA desktop app database found).
+     */
+    get isStandalone(): boolean;
     /**
      * Validate that a database file exists, is readable, and passes integrity checks.
      *
@@ -34,6 +43,17 @@ export declare class FourDADatabase {
      * Close the database connection
      */
     close(): void;
+    /**
+     * Create the minimal schema required for MCP tools to function.
+     * Mirrors the desktop app's tables but only the subset that MCP tools query.
+     * Called once when creating a brand-new standalone database.
+     */
+    private createMinimalSchema;
+    /**
+     * Populate the standalone database from a project scan result.
+     * Inserts detected tech, dependencies, and topics so MCP tools return useful data.
+     */
+    populateFromScan(scan: ProjectScanResult): void;
     /**
      * Execute a database operation with retry logic for SQLITE_BUSY / SQLITE_LOCKED.
      *
@@ -53,6 +73,11 @@ export declare class FourDADatabase {
      * Get a single source item by ID and type
      */
     getSourceItem(itemId: number, sourceType: string): SourceItem | null;
+    /**
+     * Look up persisted necessity scores for an item (written by Rust analysis pipeline).
+     * Returns defaults (0.0/null) if no necessity data exists yet.
+     */
+    private getNecessityForItem;
     /**
      * Get the user's context (what 4DA knows about them)
      */
@@ -65,6 +90,54 @@ export declare class FourDADatabase {
      * Record user feedback on an item
      */
     recordFeedback(itemId: number, sourceType: string, action: FeedbackAction): FeedbackResult;
+    /**
+     * Ensure the agent_feedback table exists.
+     * Called on first use so existing databases (created before this feature)
+     * get the table added without requiring a migration.
+     */
+    private ensureAgentFeedbackTable;
+    /**
+     * Record agent feedback on recommended content items
+     */
+    recordAgentFeedback(itemIds: string[], outcome: string, context?: string, sessionTask?: string): {
+        success: boolean;
+        message: string;
+        recorded_count: number;
+    };
+    /**
+     * Get agent feedback statistics for the given period
+     */
+    getAgentFeedbackStats(days?: number): {
+        period_days: number;
+        outcomes: {
+            used: number;
+            rejected: number;
+            partially_used: number;
+            total: number;
+        };
+        by_source: Array<{
+            source_type: string;
+            used: number;
+            rejected: number;
+            partially_used: number;
+            total: number;
+            usefulness_rate: number;
+        }>;
+        top_used_items: Array<{
+            item_id: string;
+            title: string | null;
+            source_type: string | null;
+            used_count: number;
+            rejected_count: number;
+        }>;
+        recent_feedback: Array<{
+            item_id: string;
+            outcome: string;
+            context: string | null;
+            session_task: string | null;
+            recorded_at: string;
+        }>;
+    };
     /**
      * Compute relevance score for an item based on user context
      */

package/dist/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,KAAK,aAAa,MAAM,gBAAgB,CAAC;AAsBhD,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EAMZ,WAAW,EAGX,oBAAoB,EACpB,cAAc,EACd,cAAc,EACf,MAAM,YAAY,CAAC;AAqEpB,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,EAAE,CAAyB;gBAEvB,MAAM,CAAC,EAAE,MAAM;IAkB3B;;;;;;;OAOG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,wBAAwB;IAyDlE;;OAEG;IACH,QAAQ,IAAI,aAAa,CAAC,QAAQ;IAIlC;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;;;;;;;;OASG;IACH,cAAc,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,UAAU,GAAE,MAAU,GAAG,CAAC;IAqBzD;;OAEG;IACH,kBAAkB,CAChB,QAAQ,GAAE,MAAa,EACvB,UAAU,CAAC,EAAE,MAAM,EACnB,KAAK,GAAE,MAAW,EAClB,UAAU,GAAE,MAAW,GACtB,YAAY,EAAE;IAiEjB;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAapE;;OAEG;IACH,cAAc,CAAC,UAAU,GAAE,OAAc,EAAE,cAAc,GAAE,OAAc,GAAG,WAAW;IA0GvF;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAsIjF;;OAEG;IACH,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,GACrB,cAAc;IA2CjB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAoE7B;;OAEG;IACH,OAAO,CAAC,aAAa;IASrB;;OAEG;IACH,OAAO,CAAC,YAAY;IAQpB;;OAEG;IACH,OAAO,CAAC,UAAU;CA8FnB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,cAAc,CAE9D"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAUH,OAAO,KAAK,aAAa,MAAM,gBAAgB,CAAC;AAsBhD,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EAMZ,WAAW,EAGX,oBAAoB,EACpB,cAAc,EACd,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAqE9D,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,aAAa,CAAkB;gBAE3B,MAAM,CAAC,EAAE,MAAM;IAkC3B;;;OAGG;IACH,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,wBAAwB;IAwDlE;;OAEG;IACH,QAAQ,IAAI,aAAa,CAAC,QAAQ;IAIlC;;OAEG;IACH,KAAK,IAAI,IAAI;IAQb;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IA4U3B;;;OAGG;IACH,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI;IA2E/C;;;;;;;;;OASG;IACH,cAAc,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,UAAU,GAAE,MAAU,GAAG,CAAC;IAqBzD;;OAEG;IACH,kBAAkB,CAChB,QAAQ,GAAE,MAAa,EACvB,UAAU,CAAC,EAAE,MAAM,EACnB,KAAK,GAAE,MAAW,EAClB,UAAU,GAAE,MAAW,GACtB,YAAY,EAAE;IAwEjB;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IASpE;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAmC3B;;OAEG;IACH,cAAc,CAAC,UAAU,GAAE,OAAc,EAAE,cAAc,GAAE,OAAc,GAAG,WAAW;IA0GvF;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAsIjF;;OAEG;IACH,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,GACrB,cAAc;IA2CjB;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAehC;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE;IAkDhE;;OAEG;IACH,qBAAqB,CAAC,IAAI,GAAE,MAAW,GAAG;QACxC,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACpF,SAAS,EAAE,KAAK,CAAC;YACf,WAAW,EAAE,MAAM,CAAC;YACpB,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,MAAM,CAAC;YACjB,cAAc,EAAE,MAAM,CAAC;YACvB,KAAK,EAAE,MAAM,CAAC;YACd,eAAe,EAAE,MAAM,CAAC;SACzB,CAAC,CAAC;QACH,cAAc,EAAE,KAAK,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC;YAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;YACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,cAAc,EAAE,MAAM,CAAC;SACxB,CAAC,CAAC;QACH,eAAe,EAAE,KAAK,CAAC;YACrB,OAAO,EAAE,MAAM,CAAC;YAChB,OAAO,EAAE,MAAM,CAAC;YAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;YACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;YAC5B,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC,CAAC;KACJ;IA6GD;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAoE7B;;OAEG;IACH,OAAO,CAAC,aAAa;IASrB;;OAEG;IACH,OAAO,CAAC,YAAY;IAQpB;;OAEG;IACH,OAAO,CAAC,UAAU;CA8FnB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,cAAc,CAE9D"}