@4da/mcp-server 4.6.3 → 4.6.4

package/README.md

@@ -174,7 +174,7 @@ The MCP server works without the desktop app. On first run it creates a local da
 | Actionable signals + knowledge gaps | -- | Yes |
 | Compound intelligence (learns over time) | -- | Yes |
 
-> **[Download 4DA](https://github.com/runyourempire/4DA/releases/latest)** for the full experience.
+> **[Download 4DA](https://github.com/4DA-Systems/4DA/releases/latest)** for the full experience.
 
 ## Transports
 
@@ -219,7 +219,7 @@ Any tool that supports [MCP](https://modelcontextprotocol.io): Claude Code, Clau
 ## Build from Source
 
 ```bash
-git clone https://github.com/runyourempire/4DA.git
+git clone https://github.com/4DA-Systems/4DA.git
 cd 4DA/mcp-4da-server
 pnpm install
 pnpm build

package/dist/doctor.js

@@ -108,7 +108,7 @@ export function runDoctor() {
         console.log("  Standalone: scans your dependencies for known CVEs and provides project context.");
         console.log("  Full app: adds content scoring, source monitoring, and more.");
         console.log("");
-        console.log("  Desktop app: https://github.com/runyourempire/4DA/releases/latest");
+        console.log("  Desktop app: https://github.com/4DA-Systems/4DA/releases/latest");
         console.log("  Learn more: https://4da.ai");
         console.log("");
     }

package/dist/index.js

@@ -45,13 +45,25 @@ import { getSlimToolList, getSchemaResources, hasToolSchema, getSchemaFilename,
 import { dispatchTool } from "./tool-dispatch.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
+// Single source of truth for the server version — read from package.json so
+// serverInfo and --version can never drift from the published version again
+// (drift shipped in 4.6.1: serverInfo reported 4.6.0).
+const SERVER_VERSION = (() => {
+    try {
+        const pkg = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf8"));
+        return pkg.version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+})();
 import { createDatabase, FourDADatabase } from "./db.js";
 // =============================================================================
 // Server Setup
 // =============================================================================
 const server = new Server({
     name: "4da-server",
-    version: "4.6.3",
+    version: SERVER_VERSION,
 }, {
     capabilities: {
         tools: { listChanged: true },
@@ -293,7 +305,7 @@ async function main() {
     const args = process.argv.slice(2);
     // Version
     if (args.includes("--version") || args.includes("-v")) {
-        console.log("@4da/mcp-server 4.6.3");
+        console.log(`@4da/mcp-server ${SERVER_VERSION}`);
         return;
     }
     // Help
@@ -321,7 +333,7 @@ async function main() {
 
   Works standalone (scans your project on startup) or with the full
   4DA desktop app for content scoring, source monitoring, and more.
-  Desktop app: https://github.com/runyourempire/4DA/releases/latest
+  Desktop app: https://github.com/4DA-Systems/4DA/releases/latest
   Docs:        https://4da.ai
 `);
         return;

package/dist/schema-registry.d.ts

@@ -12,6 +12,17 @@
  */
 /** Tool categories — maps to the functional groupings in the MCP server */
 export type ToolCategory = "security" | "intelligence" | "decisions" | "agent" | "identity";
+/**
+ * MCP tool annotations (spec 2025-03-26+). Directory reviews (Anthropic
+ * Connectors, client marketplaces) expect these on every tool; a missing
+ * readOnlyHint/destructiveHint is a documented rejection cause.
+ */
+export interface ToolAnnotations {
+    readOnlyHint: boolean;
+    openWorldHint: boolean;
+    destructiveHint?: boolean;
+    idempotentHint?: boolean;
+}
 /** Shape of each entry in the tool registry */
 export interface ToolRegistryEntry {
     summary: string;
@@ -19,6 +30,7 @@ export interface ToolRegistryEntry {
     category: ToolCategory;
     tags: string[];
     standalone: boolean;
+    annotations: ToolAnnotations;
 }
 /**
  * Slim tool registry — one-liner descriptions + category/tag metadata.
@@ -37,6 +49,7 @@ export declare function getSlimToolList(standaloneOnly?: boolean): Array<{
     inputSchema: {
         type: "object";
     };
+    annotations: ToolAnnotations;
 }>;
 /**
  * Get list of schema resources for ListResources

package/dist/schema-registry.js

@@ -25,6 +25,7 @@ export const TOOL_REGISTRY = {
         category: "security",
         tags: ["security", "vulnerabilities", "cve", "dependencies", "osv"],
         standalone: true,
+        annotations: { readOnlyHint: true, openWorldHint: true },
     },
     dependency_health: {
         summary: "Dependency version freshness, deprecation, and CVE counts across npm/Rust/Python/Go. Call when the user asks whether their dependencies are outdated, stale, or need updating.",
@@ -32,6 +33,7 @@ export const TOOL_REGISTRY = {
         category: "security",
         tags: ["dependencies", "health", "outdated", "deprecated", "versions"],
         standalone: true,
+        annotations: { readOnlyHint: true, openWorldHint: true },
     },
     upgrade_planner: {
         summary: "Prioritized upgrade plan (CVE severity, deprecation, version distance), quick wins vs breaking changes. Call when the user asks what to upgrade, or after dependency_health surfaces problems.",
@@ -39,6 +41,7 @@ export const TOOL_REGISTRY = {
         category: "security",
         tags: ["upgrade", "dependencies", "recommendations", "versions"],
         standalone: true,
+        annotations: { readOnlyHint: true, openWorldHint: true },
     },
     // --- Intelligence (mixed) ---
     what_should_i_know: {
@@ -47,6 +50,7 @@ export const TOOL_REGISTRY = {
         category: "intelligence",
         tags: ["briefing", "advisories", "pre-task", "signals"],
         standalone: true,
+        annotations: { readOnlyHint: true, openWorldHint: true },
     },
     ecosystem_pulse: {
         summary: "Live Hacker News discussions filtered to the user's tech stack. Call when the user asks what is new or trending in their ecosystem.",
@@ -54,6 +58,7 @@ export const TOOL_REGISTRY = {
         category: "intelligence",
         tags: ["ecosystem", "news", "hacker-news", "live"],
         standalone: true,
+        annotations: { readOnlyHint: true, openWorldHint: true },
     },
     get_context: {
         summary: "What 4DA knows about the user: role, tech stack, interests, and learned affinities. Call FIRST when you need to know what the user works on before answering or recommending.",
@@ -61,6 +66,7 @@ export const TOOL_REGISTRY = {
         category: "intelligence",
         tags: ["context", "interests", "tech-stack", "profile"],
         standalone: true,
+        annotations: { readOnlyHint: true, openWorldHint: false },
     },
     get_relevant_content: {
         summary: "The user's personalized feed: articles, advisories, releases scored by relevance to their stack. Call when the user asks what to read, what is relevant to them, or for content on a topic.",
@@ -68,6 +74,7 @@ export const TOOL_REGISTRY = {
         category: "intelligence",
         tags: ["content", "feed", "relevance", "filter"],
         standalone: false,
+        annotations: { readOnlyHint: true, openWorldHint: false },
     },
     get_actionable_signals: {
         summary: "Classify content into prioritized signals (security_alert, breaking_change, tool_discovery, tech_trend, learning, competitive_intel). Call when the user wants what is urgent or actionable, not just relevant.",
@@ -75,6 +82,7 @@ export const TOOL_REGISTRY = {
         category: "intelligence",
         tags: ["signals", "priority", "actionable", "classification"],
         standalone: false,
+        annotations: { readOnlyHint: true, openWorldHint: false },
     },
     knowledge_gaps: {
         summary: "Dependencies the user relies on but never reads about, where a CVE or breaking change could surprise them. Call when the user asks what they are missing or where their blind spots are.",
@@ -82,6 +90,7 @@ export const TOOL_REGISTRY = {
         category: "intelligence",
         tags: ["gaps", "dependencies", "knowledge", "blind-spots"],
         standalone: false,
+        annotations: { readOnlyHint: true, openWorldHint: false },
     },
     record_feedback: {
         summary: "Record click/save/dismiss on a content item to sharpen future scoring. Call AFTER the user reacts to a surfaced item (opens, saves, or dismisses it).",
@@ -89,6 +98,7 @@ export const TOOL_REGISTRY = {
         category: "intelligence",
         tags: ["feedback", "learning", "save", "dismiss"],
         standalone: false,
+        annotations: { readOnlyHint: false, openWorldHint: false, destructiveHint: false, idempotentHint: false },
     },
     // --- Decisions (standalone) ---
     decision_memory: {
@@ -97,6 +107,7 @@ export const TOOL_REGISTRY = {
         category: "decisions",
         tags: ["decisions", "memory", "record", "architecture"],
         standalone: true,
+        annotations: { readOnlyHint: false, openWorldHint: false, destructiveHint: false, idempotentHint: false },
     },
     check_decision_alignment: {
         summary: "Check whether a technology or pattern aligns with the developer's recorded decisions. Call BEFORE suggesting a major tech change, new library, or architecture shift.",
@@ -104,6 +115,7 @@ export const TOOL_REGISTRY = {
         category: "decisions",
         tags: ["alignment", "decisions", "enforcement", "check"],
         standalone: true,
+        annotations: { readOnlyHint: true, openWorldHint: false },
     },
     // --- Agent (standalone) ---
     agent_memory: {
@@ -112,6 +124,7 @@ export const TOOL_REGISTRY = {
         category: "agent",
         tags: ["agent", "memory", "persistent", "cross-session"],
         standalone: true,
+        annotations: { readOnlyHint: false, openWorldHint: false, destructiveHint: false, idempotentHint: false },
     },
     // --- Identity (full-mode) ---
     developer_dna: {
@@ -120,6 +133,7 @@ export const TOOL_REGISTRY = {
         category: "identity",
         tags: ["identity", "dna", "profile", "tech-stack", "export"],
         standalone: false,
+        annotations: { readOnlyHint: true, openWorldHint: false },
     },
 };
 /**
@@ -133,6 +147,7 @@ export function getSlimToolList(standaloneOnly) {
         name,
         description: info.summary,
         inputSchema: { type: "object" },
+        annotations: info.annotations,
     }));
 }
 /**

package/dist/setup.js

@@ -158,7 +158,7 @@ export function runSetup(dryRun = false) {
     console.log("");
     console.log("  Note: This server reads data from the 4DA desktop app.");
     console.log("  If you haven't installed it yet:");
-    console.log("    https://github.com/runyourempire/4DA/releases/latest");
+    console.log("    https://github.com/4DA-Systems/4DA/releases/latest");
     console.log("");
     console.log("  Run: npx @4da/mcp-server --doctor  to verify everything works.\n");
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@4da/mcp-server",
-  "version": "4.6.3",
-  "mcpName": "io.github.runyourempire/4da-mcp-server",
+  "version": "4.6.4",
+  "mcpName": "io.github.4da-systems/4da-mcp-server",
   "description": "Dependency intelligence for AI coding agents. Live CVE scanning, dependency health, upgrade planning, ecosystem news, decision memory — zero config, privacy-first. 9 tools standalone, 14 total with desktop app.",
   "type": "module",
   "main": "dist/index.js",
@@ -18,17 +18,6 @@
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "tsc && pnpm run copy-schemas",
-    "copy-schemas": "node -e \"const fs=require('fs');const path=require('path');const src='src/schemas';const dst='dist/schemas';if(!fs.existsSync(dst))fs.mkdirSync(dst,{recursive:true});fs.readdirSync(src).filter(f=>f.endsWith('.json')).forEach(f=>fs.copyFileSync(path.join(src,f),path.join(dst,f)))\"",
-    "dev": "tsc --watch",
-    "start": "node dist/index.js",
-    "inspect": "npx @modelcontextprotocol/inspector node dist/index.js",
-    "setup": "node dist/setup.js",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "prepublishOnly": "pnpm run build"
-  },
   "keywords": [
     "mcp",
     "mcp-server",
@@ -72,12 +61,12 @@
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/runyourempire/4DA.git",
+    "url": "git+https://github.com/4DA-Systems/4DA.git",
     "directory": "mcp-4da-server"
   },
   "homepage": "https://4da.ai",
   "bugs": {
-    "url": "https://github.com/runyourempire/4DA/issues"
+    "url": "https://github.com/4DA-Systems/4DA/issues"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -93,16 +82,14 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "better-sqlite3",
-      "esbuild"
-    ],
-    "overrides": {
-      "fast-uri": ">=3.1.2",
-      "ip-address": "^10.1.1",
-      "vite": ">=7.3.5 <8",
-      "esbuild": ">=0.28.1"
-    }
+  "scripts": {
+    "build": "tsc && pnpm run copy-schemas",
+    "copy-schemas": "node -e \"const fs=require('fs');const path=require('path');const src='src/schemas';const dst='dist/schemas';if(!fs.existsSync(dst))fs.mkdirSync(dst,{recursive:true});fs.readdirSync(src).filter(f=>f.endsWith('.json')).forEach(f=>fs.copyFileSync(path.join(src,f),path.join(dst,f)))\"",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "inspect": "npx @modelcontextprotocol/inspector node dist/index.js",
+    "setup": "node dist/setup.js",
+    "test": "vitest run",
+    "test:watch": "vitest"
   }
-}
+}