@4da/mcp-server 4.6.5 → 5.0.0

package/README.md

@@ -2,7 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/@4da/mcp-server?color=gold)](https://www.npmjs.com/package/@4da/mcp-server)
 [![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE)
-[![Node](https://img.shields.io/badge/Node-%3E%3D18-brightgreen)](https://nodejs.org/)
+[![Node](https://img.shields.io/badge/Node-%3E%3D20-brightgreen)](https://nodejs.org/)
 [![smithery badge](https://smithery.ai/badge/@4da/mcp-server)](https://smithery.ai/server/@4da/mcp-server)
 
 **Dependency intelligence for AI coding agents.** Live CVE scanning, dependency health checks, upgrade planning, ecosystem news, and persistent decision memory. Zero config, privacy-first.

package/dist/db.d.ts

@@ -107,7 +107,7 @@ export declare class FourDADatabase {
      * Get relevant content items scored by the Rust pipeline (preferred) or
      * TypeScript fallback scoring when Rust scores are unavailable.
      */
-    getRelevantContent(minScore?: number, sourceType?: string, limit?: number, sinceHours?: number): RelevantItem[];
+    getRelevantContent(minScore?: number, sourceType?: string, limit?: number, sinceHours?: number, requireCurrentVersion?: boolean): RelevantItem[];
     /**
      * Read the live freshness state of the feed database. Answered from ground truth, not from any
      * claim that a refresh ran — so DB-backed tools can tell the caller whether the curated feed is

package/dist/db.js

@@ -635,15 +635,16 @@ export class FourDADatabase {
      * Get relevant content items scored by the Rust pipeline (preferred) or
      * TypeScript fallback scoring when Rust scores are unavailable.
      */
-    getRelevantContent(minScore = 0.35, sourceType, limit = 20, sinceHours = 24) {
+    getRelevantContent(minScore = 0.35, sourceType, limit = 20, sinceHours = 24, requireCurrentVersion = false) {
         const sinceDate = new Date(Date.now() - sinceHours * 60 * 60 * 1000)
             .toISOString()
             .replace("T", " ")
             .slice(0, 19);
         const hasRustScores = this.hasColumn("source_items", "relevance_score");
         if (hasRustScores) {
-            return this.getRelevantContentFromRust(minScore, sourceType, limit, sinceDate);
+            return this.getRelevantContentFromRust(minScore, sourceType, limit, sinceDate, requireCurrentVersion);
         }
+        // TypeScript fallback computes scores fresh per call — current by construction.
         return this.getRelevantContentFallback(minScore, sourceType, limit, sinceDate);
     }
     /**
@@ -722,13 +723,57 @@ export class FourDADatabase {
      * Use Rust-computed relevance_score from the desktop app's scoring pipeline.
      * These scores are from the full 5-axis PASIFA engine — much more accurate.
      */
-    getRelevantContentFromRust(minScore, sourceType, limit, sinceDate) {
+    getRelevantContentFromRust(minScore, sourceType, limit, sinceDate, requireCurrentVersion = false) {
         // Grounding subquery — guarded: older/partial 4DA DBs may have relevance_score
         // (so the Rust path runs) but lack source_item_dependencies. Fall back to 0
         // (→ evidence_class "semantic_only") rather than throwing.
         const depCount = this.hasColumn("source_item_dependencies", "source_item_id")
             ? `(SELECT COUNT(*) FROM source_item_dependencies d WHERE d.source_item_id = source_items.id)`
             : `0`;
+        // Stale-epoch guard for deep-window fallbacks: when the caller widens to the
+        // 30-day window it reaches items whose stored score/signal columns may come
+        // from an OLDER scoring pipeline (a version bump makes the tail stale until
+        // the drain re-scores it). Ranking those raw scores against current ones —
+        // or trusting stale signal_type/signal_priority — produces claims the
+        // current pipeline doesn't stand behind. The MCP server can't import the
+        // Rust PIPELINE_VERSION constant, so the DB itself is the source of truth:
+        // MAX(scored_pipeline_version) IS the current brain's stamp (uncorrelated
+        // subquery, computed once per statement). Guarded on column existence for
+        // older desktop-app DBs.
+        const versionGuard = requireCurrentVersion && this.hasColumn("source_items", "scored_pipeline_version")
+            ? ` AND scored_pipeline_version = (SELECT MAX(scored_pipeline_version) FROM source_items)`
+            : ``;
+        // Curation guard: never return an item the current pipeline EXPLICITLY
+        // rejected. `feed_relevant` is the analysis run's persisted verdict, and a
+        // score threshold alone does not respect it — the desktop content graph hit
+        // exactly this and adopted corpus parity in Phase 95 (W4-5).
+        //
+        // It matters because a verdict can be negative while the score stays above
+        // the threshold. v18's look-alike gate makes ungrounded registry releases
+        // categorically non-relevant while deliberately KEEPING their capped score
+        // (0.37 / 0.42) for ranking and display, so `relevance_score >= 0.35` alone
+        // still surfaces them. Live 2026-07-26: 30 crates_io items inside the
+        // 30-day window were already `feed_relevant = 0` and were still returned.
+        //
+        // NULL is KEPT, not excluded: an unjudged item is "not yet curated", not
+        // "rejected", and dropping it would blank the tool on a fresh corpus
+        // (cold-start doctrine). Guarded on column existence for older 4DA DBs.
+        //
+        // Deliberately NOT extended with `feed_verdict_version = <current>` even
+        // though Phase 101 added that stamp, and even though the 720h deep-fallback
+        // above DOES gate on `scored_pipeline_version`. The asymmetry is intentional:
+        // the version guard there narrows a last-resort widening, whereas this guard
+        // sits on the PRIMARY path, so excluding not-yet-reconciled verdicts would
+        // empty the tool after every pipeline bump until the reconciliation pass
+        // caught up (measured on the desktop: 94% of live graph nodes held a stale
+        // verdict immediately after the v18 bump). The reconciliation converging is
+        // the fix — see `analysis_backfill::reconcile_stale_verdicts_cycle`. This
+        // note exists because `check-mcp-server-sync.cjs` asks "do MCP queries need
+        // updating?" on every db-layer change; the answer for the verdict stamp is
+        // no, by design.
+        const curationGuard = this.hasColumn("source_items", "feed_relevant")
+            ? ` AND (feed_relevant IS NULL OR feed_relevant = 1)`
+            : ``;
         let query = `
       SELECT id, source_type, source_id, url, title, content, content_hash,
              created_at, last_seen, relevance_score, content_type,
@@ -736,7 +781,7 @@ export class FourDADatabase {
              ${depCount} AS dep_match_count
       FROM source_items
       WHERE relevance_score >= ?
-        AND datetime(created_at) >= datetime(?)
+        AND datetime(created_at) >= datetime(?)${versionGuard}${curationGuard}
     `;
         const params = [minScore, sinceDate];
         if (sourceType) {
@@ -1008,12 +1053,13 @@ export class FourDADatabase {
                 context.ace.detected_tech.filter((dt) => itemTopics.some((t) => this.topicMatches(t, dt.name))).length *
                     0.05
             : 0;
-        const learnedScore = context.learned
-            ? context.learned.topic_affinities
-                .filter((ta) => ta.affinity_score > 0 && itemTopics.some((t) => this.topicMatches(t, ta.topic)))
-                .reduce((sum, ta) => sum + ta.affinity_score * 0.1 * ta.confidence, 0)
-            : 0;
-        // Anti-penalty from exclusions and anti-topics
+        // Learned affinity score DEMOTED in v19 (AD-029) — must mirror
+        // computeRelevanceScore so the explanation matches what actually
+        // scored (the two previously diverged on the anti-penalty weight too:
+        // scorer used *0.3, this explanation used *0.5).
+        const learnedScore = 0;
+        // Anti-penalty from user-authored exclusions only (learned anti-topics
+        // demoted with the rest of the behavioral stack, AD-029).
         let antiPenalty = 0;
         for (const exclusion of context.exclusions) {
             if (itemTopics.some((t) => this.topicMatches(t, exclusion))) {
@@ -1021,13 +1067,6 @@ export class FourDADatabase {
                 break;
             }
         }
-        if (antiPenalty === 0 && context.learned) {
-            for (const antiTopic of context.learned.anti_topics) {
-                if (itemTopics.some((t) => this.topicMatches(t, antiTopic.topic))) {
-                    antiPenalty = Math.max(antiPenalty, antiTopic.confidence * 0.5);
-                }
-            }
-        }
         const finalScore = Math.max(0, Math.min(1, staticScore + aceScore + learnedScore - antiPenalty));
         const scoreBreakdown = {
             embedding_similarity: null, // Not computing embedding similarity in MCP server
@@ -1087,12 +1126,17 @@ export class FourDADatabase {
                 message: `Item ${itemId} of type ${sourceType} not found`,
             };
         }
-        // Map action to signal strength
+        // Map action to signal strength — v19: unified onto the canonical ACE
+        // scale (src-tauri/src/ace/behavior/types.rs). The old MCP-only scale
+        // (click 0.3 / save 0.8 / dismiss -0.2 / mark_irrelevant -0.5) meant an
+        // agent-recorded rejection never crossed the Rust side's explicit-
+        // negative (-0.8) or anti-topic (-0.5 exclusive) thresholds, so agent
+        // feedback could never register a real rejection.
         const signalStrength = {
-            click: 0.3,
-            save: 0.8,
-            dismiss: -0.2,
-            mark_irrelevant: -0.5,
+            click: 0.55,
+            save: 1.0,
+            dismiss: -0.8,
+            mark_irrelevant: -1.0,
         };
         try {
             const stmt = this.db.prepare(`
@@ -1311,21 +1355,12 @@ export class FourDADatabase {
                 }
             }
         }
-        // Learned affinities
-        if (context.learned) {
-            for (const affinity of context.learned.topic_affinities) {
-                if (affinity.affinity_score > 0 &&
-                    itemTopics.some((t) => this.topicMatches(t, affinity.topic))) {
-                    score += affinity.affinity_score * 0.1 * affinity.confidence;
-                }
-            }
-            // Anti-topics penalty
-            for (const antiTopic of context.learned.anti_topics) {
-                if (itemTopics.some((t) => this.topicMatches(t, antiTopic.topic))) {
-                    score -= antiTopic.confidence * 0.3;
-                }
-            }
-        }
+        // Learned affinity/anti-topic weighting DEMOTED in v19 (AD-029) to
+        // mirror the Rust pipeline: this TypeScript fallback scorer applied
+        // its own behavioral weights (+affinity*0.1*confidence,
+        // -anti_confidence*0.3) whenever Rust scores were absent — a second,
+        // uncalibrated ranking regime fed by the same untrusted capture layer.
+        // Static identity + ACE stack matching above remain the scoring basis.
         return Math.max(0, Math.min(1, score));
     }
     /**

package/dist/http-transport.d.ts

@@ -1,15 +1,19 @@
 /**
  * 4DA MCP Server — Streamable HTTP Transport
  *
- * Implements the MCP Streamable HTTP transport (spec 2025-03-26) using
- * Node's built-in http module. No express or other framework needed.
+ * Serves MCP over HTTP using the v2 `createMcpHandler` entry (one factory,
+ * one endpoint, both protocol eras): 2026-07-28 requests are served natively;
+ * 2025-era requests get the established stateless serving (fresh instance per
+ * request — the same behavior as the previous per-request
+ * `StreamableHTTPServerTransport` wiring). Node's built-in http module only;
+ * no express or other framework needed.
  *
  * Security:
  * - Binds to 127.0.0.1 only (localhost)
  * - DNS rebinding protection via Origin header check
- * - Stateless mode (no session tracking)
+ * - Stateless (no session tracking)
  */
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { type Server } from "@modelcontextprotocol/server";
 export interface HttpServerOptions {
     port: number;
     host: string;
@@ -17,9 +21,9 @@ export interface HttpServerOptions {
 /**
  * Start a Streamable HTTP server for the MCP protocol.
  *
- * Uses stateless mode (sessionIdGenerator: undefined) — each request
- * gets its own transport instance. This is the simplest approach and
- * is compatible with serverless environments.
+ * Takes a server factory: `createMcpHandler` builds a fresh instance per
+ * request (stateless — compatible with serverless environments and simple
+ * round-robin load balancing).
  */
-export declare function startHttpServer(server: Server, options?: HttpServerOptions): Promise<void>;
+export declare function startHttpServer(factory: () => Server, options?: HttpServerOptions): Promise<void>;
 //# sourceMappingURL=http-transport.d.ts.map

package/dist/http-transport.js

@@ -2,52 +2,44 @@
 /**
  * 4DA MCP Server — Streamable HTTP Transport
  *
- * Implements the MCP Streamable HTTP transport (spec 2025-03-26) using
- * Node's built-in http module. No express or other framework needed.
+ * Serves MCP over HTTP using the v2 `createMcpHandler` entry (one factory,
+ * one endpoint, both protocol eras): 2026-07-28 requests are served natively;
+ * 2025-era requests get the established stateless serving (fresh instance per
+ * request — the same behavior as the previous per-request
+ * `StreamableHTTPServerTransport` wiring). Node's built-in http module only;
+ * no express or other framework needed.
  *
  * Security:
  * - Binds to 127.0.0.1 only (localhost)
  * - DNS rebinding protection via Origin header check
- * - Stateless mode (no session tracking)
+ * - Stateless (no session tracking)
  */
 import { createServer } from "node:http";
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { createMcpHandler } from "@modelcontextprotocol/server";
+import { toNodeHandler } from "@modelcontextprotocol/node";
 import { extractAuthClaims } from "./auth.js";
 const DEFAULT_PORT = 4840;
 const DEFAULT_HOST = "127.0.0.1";
 const __ht_dirname = dirname(fileURLToPath(import.meta.url));
 const SERVER_VERSION = JSON.parse(readFileSync(join(__ht_dirname, "..", "package.json"), "utf-8")).version;
-/**
- * Parse JSON body from an incoming HTTP request.
- */
-function parseBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        req.on("data", (chunk) => chunks.push(chunk));
-        req.on("end", () => {
-            try {
-                const raw = Buffer.concat(chunks).toString("utf-8");
-                resolve(raw ? JSON.parse(raw) : undefined);
-            }
-            catch (e) {
-                reject(e);
-            }
-        });
-        req.on("error", reject);
-    });
-}
 /**
  * Start a Streamable HTTP server for the MCP protocol.
  *
- * Uses stateless mode (sessionIdGenerator: undefined) — each request
- * gets its own transport instance. This is the simplest approach and
- * is compatible with serverless environments.
+ * Takes a server factory: `createMcpHandler` builds a fresh instance per
+ * request (stateless — compatible with serverless environments and simple
+ * round-robin load balancing).
  */
-export async function startHttpServer(server, options = { port: DEFAULT_PORT, host: DEFAULT_HOST }) {
+export async function startHttpServer(factory, options = { port: DEFAULT_PORT, host: DEFAULT_HOST }) {
     const { port, host } = options;
+    const mcpHandler = createMcpHandler(factory);
+    const handleMcpRequest = toNodeHandler(mcpHandler, {
+        onerror: (err) => {
+            console.error("MCP transport error:", err);
+        },
+    });
     const httpServer = createServer(async (req, res) => {
         // DNS rebinding protection: reject cross-origin requests from non-local origins
         const origin = req.headers.origin;
@@ -100,36 +92,9 @@ export async function startHttpServer(server, options = { port: DEFAULT_PORT, ho
             res.end(JSON.stringify({ error: "Not Found" }));
             return;
         }
-        // Parse JSON body for POST requests
-        let body = undefined;
-        if (req.method === "POST") {
-            try {
-                body = await parseBody(req);
-            }
-            catch {
-                res.writeHead(400, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ error: "Invalid JSON body" }));
-                return;
-            }
-        }
-        // Stateless mode: new transport per request
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
-        });
-        res.on("close", () => {
-            transport.close();
-        });
-        try {
-            await server.connect(transport);
-            await transport.handleRequest(req, res, body);
-        }
-        catch (err) {
-            console.error("MCP transport error:", err);
-            if (!res.headersSent) {
-                res.writeHead(500, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ error: "Internal server error" }));
-            }
-        }
+        // Hand off to the MCP handler — body parsing, era classification, and
+        // per-request instance construction happen inside the entry.
+        await handleMcpRequest(req, res);
     });
     httpServer.listen(port, host, () => {
         console.error(`4DA MCP Server v${SERVER_VERSION} (Streamable HTTP) listening on http://${host}:${port}/mcp`);
@@ -138,6 +103,7 @@ export async function startHttpServer(server, options = { port: DEFAULT_PORT, ho
     // Graceful shutdown
     const shutdown = () => {
         console.error("Shutting down HTTP server...");
+        void mcpHandler.close();
         httpServer.close();
         process.exit(0);
     };

package/dist/index.d.ts

@@ -1,29 +1,12 @@
 #!/usr/bin/env node
+import { Server } from "@modelcontextprotocol/server";
 /**
- * 4DA MCP Server
+ * Build a Server instance with every handler registered.
  *
- * Provides dependency-intelligence tools (CVE scanning, dependency health,
- * upgrade planning, ecosystem news, decision/agent memory) to Claude Code,
- * Claude Desktop, and other MCP hosts. Runs locally; the only data leaving the
- * machine is public package names/versions sent to registries (OSV, npm, etc.).
- *
- * SECURITY: the server trusts its local environment and does NOT implement
- * authentication. The optional --http transport is intended for localhost use;
- * do NOT expose it over a network without putting your own auth in front.
- */
-/**
- * 4DA MCP Server v4.6.3 — Dependency Intelligence for AI Coding Agents
- *
- * 14 tools across 5 categories. Live vulnerability scanning (OSV.dev),
- * ecosystem news, persistent memory, and tech stack awareness for any MCP host.
- *
- * Categories (canonical — matches schema-registry.ts `ToolCategory`):
- *   Security (3)      — vulnerability scanning, dependency health, upgrade planning
- *   Intelligence (7)  — briefing, ecosystem pulse, context, content feed,
- *                       actionable signals, knowledge gaps, feedback
- *   Decisions (2)     — decision memory, alignment checking
- *   Agent (1)         — cross-session persistent memory
- *   Identity (1)      — developer DNA profile
+ * The v2 serving entries take a factory: `serveStdio` pins one instance per
+ * connection; stateless HTTP (`createMcpHandler`) builds one per request.
+ * Handlers close over the module-level database singleton, so every instance
+ * shares the same lazily-initialized database and live-intelligence layer.
  */
-export {};
+export declare function buildServer(): Server;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -11,9 +11,6 @@
  * SECURITY: the server trusts its local environment and does NOT implement
  * authentication. The optional --http transport is intended for localhost use;
  * do NOT expose it over a network without putting your own auth in front.
- */
-/**
- * 4DA MCP Server v4.6.3 — Dependency Intelligence for AI Coding Agents
  *
  * 14 tools across 5 categories. Live vulnerability scanning (OSV.dev),
  * ecosystem news, persistent memory, and tech stack awareness for any MCP host.
@@ -25,10 +22,14 @@
  *   Decisions (2)     — decision memory, alignment checking
  *   Agent (1)         — cross-session persistent memory
  *   Identity (1)      — developer DNA profile
+ *
+ * Protocol: MCP TypeScript SDK v2. stdio serving goes through `serveStdio`,
+ * HTTP through `createMcpHandler` — both entries negotiate the era per
+ * connection/request, so 2025-era hosts (classic `initialize` handshake) and
+ * 2026-07-28 hosts (stateless `server/discover`) are both supported.
  */
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { CallToolRequestSchema, ListToolsRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { Server } from "@modelcontextprotocol/server";
 import { readFileSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -61,15 +62,18 @@ import { createDatabase, FourDADatabase } from "./db.js";
 // =============================================================================
 // Server Setup
 // =============================================================================
-const server = new Server({
-    name: "4da-server",
-    version: SERVER_VERSION,
-}, {
-    capabilities: {
-        tools: { listChanged: true },
-        resources: {},
-    },
-});
+/**
+ * Project root for scanning/scoping. FOURDA_PROJECT_DIR overrides cwd for
+ * hosts where cwd is meaningless (Claude Desktop launches extension servers
+ * from an app directory) — the .mcpb bundle wires its directory picker to it.
+ * A value still containing "${" is an unsubstituted host template; ignore it.
+ */
+function resolveProjectDir() {
+    const dir = process.env.FOURDA_PROJECT_DIR?.trim();
+    if (dir && !dir.includes("${"))
+        return dir;
+    return process.cwd();
+}
 // Database instance (lazy initialized)
 let db = null;
 let liveIntel = null;
@@ -85,9 +89,12 @@ function getDatabase() {
         // Initialize live intelligence layer
         liveIntel = new LiveIntelligence(db.getRawDb());
         setLiveIntelligence(liveIntel);
-        // Standalone mode: auto-populate from project scan
+        // Standalone mode: auto-populate from project scan.
+        // FOURDA_PROJECT_DIR overrides cwd for hosts where cwd is meaningless
+        // (Claude Desktop launches extension servers from an app directory, not
+        // the user's code) — the .mcpb bundle wires its directory picker to this.
         if (db.isStandalone) {
-            const cwd = process.cwd();
+            const cwd = resolveProjectDir();
             const scan = scanCurrentProject(cwd);
             db.populateFromScan(scan);
             const detected = [
@@ -132,7 +139,7 @@ function getDatabase() {
                 // database (the ACE engine indexes every local project) must not bleed
                 // into this project's vulnerability scan.
                 const norm = (p) => p.replace(/\\/g, "/").toLowerCase().replace(/\/+$/, "");
-                const rootNorm = norm(process.cwd());
+                const rootNorm = norm(resolveProjectDir());
                 const groups = new Map();
                 for (const row of rows) {
                     const projectPath = row.project_path || process.cwd();
@@ -168,128 +175,136 @@ function getDatabase() {
     return db;
 }
 // =============================================================================
-// Tool Handlers
+// Server Factory
 // =============================================================================
 /**
- * List available tools (SLIM)
- *
- * Returns one-liner descriptions only (~500 tokens vs ~4500).
- * Full schemas available via MCP Resources: 4da://schema/{tool_name}
- */
-server.setRequestHandler(ListToolsRequestSchema, async () => {
-    const database = getDatabase();
-    return {
-        tools: getSlimToolList(database.isStandalone ? true : undefined),
-    };
-});
-/**
- * List schema resources
+ * Build a Server instance with every handler registered.
  *
- * Exposes full tool schemas as MCP Resources for lazy loading.
- * Also exposes skill manifest for agent dispatch.
+ * The v2 serving entries take a factory: `serveStdio` pins one instance per
+ * connection; stateless HTTP (`createMcpHandler`) builds one per request.
+ * Handlers close over the module-level database singleton, so every instance
+ * shares the same lazily-initialized database and live-intelligence layer.
  */
-server.setRequestHandler(ListResourcesRequestSchema, async () => {
-    const resources = [
-        ...getSchemaResources(),
-        // Skill manifest for agent dispatch
-        {
-            uri: "4da://skills",
-            name: "Skill manifest",
-            description: "Registry of 4DA skills for Claude Code agent dispatch",
-            mimeType: "application/json",
-        },
-        // Category manifest for tool discovery
-        {
-            uri: "4da://categories",
-            name: "Tool categories",
-            description: "Tool groupings by category with tag metadata",
-            mimeType: "application/json",
+export function buildServer() {
+    const server = new Server({
+        name: "4da-server",
+        version: SERVER_VERSION,
+    }, {
+        capabilities: {
+            tools: { listChanged: true },
+            resources: {},
         },
-    ];
-    return { resources };
-});
-/**
- * Read a resource (schema or skill manifest)
- */
-server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
-    const uri = request.params.uri;
-    // Handle category manifest
-    if (uri === "4da://categories") {
+    });
+    // List available tools (SLIM): one-liner descriptions only (~500 tokens vs
+    // ~4500). Full schemas available via MCP Resources: 4da://schema/{tool_name}
+    server.setRequestHandler("tools/list", async () => {
+        const database = getDatabase();
         return {
-            contents: [
-                {
-                    uri,
-                    mimeType: "application/json",
-                    text: JSON.stringify(getCategoryManifest(), null, 2),
-                },
-            ],
+            tools: getSlimToolList(database.isStandalone ? true : undefined),
         };
-    }
-    // Handle skill manifest
-    if (uri === "4da://skills") {
-        const skillsPath = join(homedir(), ".local", "share", "4da", "skills", "registry.json");
-        if (!existsSync(skillsPath)) {
-            throw new Error("Skill manifest not found. Run 4DA setup to create it.");
+    });
+    // List schema resources: full tool schemas as MCP Resources for lazy
+    // loading, plus the skill and category manifests.
+    server.setRequestHandler("resources/list", async () => {
+        const resources = [
+            ...getSchemaResources(),
+            // Skill manifest for agent dispatch
+            {
+                uri: "4da://skills",
+                name: "Skill manifest",
+                description: "Registry of 4DA skills for Claude Code agent dispatch",
+                mimeType: "application/json",
+            },
+            // Category manifest for tool discovery
+            {
+                uri: "4da://categories",
+                name: "Tool categories",
+                description: "Tool groupings by category with tag metadata",
+                mimeType: "application/json",
+            },
+        ];
+        return { resources };
+    });
+    // Read a resource (schema or skill manifest)
+    server.setRequestHandler("resources/read", async (request) => {
+        const uri = request.params.uri;
+        // Handle category manifest
+        if (uri === "4da://categories") {
+            return {
+                contents: [
+                    {
+                        uri,
+                        mimeType: "application/json",
+                        text: JSON.stringify(getCategoryManifest(), null, 2),
+                    },
+                ],
+            };
         }
-        const skillsContent = readFileSync(skillsPath, "utf-8");
+        // Handle skill manifest
+        if (uri === "4da://skills") {
+            const skillsPath = join(homedir(), ".local", "share", "4da", "skills", "registry.json");
+            if (!existsSync(skillsPath)) {
+                throw new Error("Skill manifest not found. Run 4DA setup to create it.");
+            }
+            const skillsContent = readFileSync(skillsPath, "utf-8");
+            return {
+                contents: [
+                    {
+                        uri,
+                        mimeType: "application/json",
+                        text: skillsContent,
+                    },
+                ],
+            };
+        }
+        // Parse tool name from URI: 4da://schema/{tool_name}
+        const match = uri.match(/^4da:\/\/schema\/(.+)$/);
+        if (!match) {
+            throw new Error(`Invalid resource URI: ${uri}`);
+        }
+        const toolName = match[1];
+        if (!hasToolSchema(toolName)) {
+            throw new Error(`Unknown tool: ${toolName}`);
+        }
+        const schemaFile = getSchemaFilename(toolName);
+        if (!schemaFile) {
+            throw new Error(`No schema file for tool: ${toolName}`);
+        }
+        // Read schema from file
+        const schemaPath = join(__dirname, "schemas", schemaFile);
+        const schemaContent = readFileSync(schemaPath, "utf-8");
         return {
             contents: [
                 {
                     uri,
                     mimeType: "application/json",
-                    text: skillsContent,
-                },
-            ],
-        };
-    }
-    // Parse tool name from URI: 4da://schema/{tool_name}
-    const match = uri.match(/^4da:\/\/schema\/(.+)$/);
-    if (!match) {
-        throw new Error(`Invalid resource URI: ${uri}`);
-    }
-    const toolName = match[1];
-    if (!hasToolSchema(toolName)) {
-        throw new Error(`Unknown tool: ${toolName}`);
-    }
-    const schemaFile = getSchemaFilename(toolName);
-    if (!schemaFile) {
-        throw new Error(`No schema file for tool: ${toolName}`);
-    }
-    // Read schema from file
-    const schemaPath = join(__dirname, "schemas", schemaFile);
-    const schemaContent = readFileSync(schemaPath, "utf-8");
-    return {
-        contents: [
-            {
-                uri,
-                mimeType: "application/json",
-                text: schemaContent,
-            },
-        ],
-    };
-});
-/**
- * Execute a tool
- */
-server.setRequestHandler(CallToolRequestSchema, async (request) => {
-    const { name, arguments: args } = request.params;
-    try {
-        const database = getDatabase();
-        return await dispatchTool(name, database, args);
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify({ error: errorMessage }, null, 2),
+                    text: schemaContent,
                 },
             ],
-            isError: true,
         };
-    }
-});
+    });
+    // Execute a tool
+    server.setRequestHandler("tools/call", async (request) => {
+        const { name, arguments: args } = request.params;
+        try {
+            const database = getDatabase();
+            return await dispatchTool(name, database, args);
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify({ error: errorMessage }, null, 2),
+                    },
+                ],
+                isError: true,
+            };
+        }
+    });
+    return server;
+}
 // =============================================================================
 // Server Lifecycle
 // =============================================================================
@@ -297,8 +312,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
  * Start the MCP server
  *
  * Supports three modes:
- *   (default)  stdio transport — classic MCP, works with all hosts
- *   --http     Streamable HTTP transport (spec 2025-03-26)
+ *   (default)  stdio transport — serves 2025-era and 2026-07-28 hosts
+ *   --http     Streamable HTTP transport — stateless, both eras
  *   --setup    Configure editors for 4DA MCP
  */
 async function main() {
@@ -353,7 +368,7 @@ async function main() {
         const portIndex = args.indexOf("--port");
         const port = portIndex !== -1 ? parseInt(args[portIndex + 1], 10) : 4840;
         const host = args.includes("--host") ? args[args.indexOf("--host") + 1] : "127.0.0.1";
-        await startHttpServer(server, { port, host });
+        await startHttpServer(buildServer, { port, host });
         return;
     }
     // -------------------------------------------------------------------------
@@ -377,9 +392,14 @@ async function main() {
         console.error(`  Or run: npx @4da/mcp-server --doctor  for diagnostics`);
         console.error(``);
     }
-    // Default: stdio transport (existing behavior)
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
+    // Default: stdio serving. `serveStdio` owns the era decision per connection —
+    // a 2025-era `initialize` opening is served exactly as before; a 2026-07-28
+    // `server/discover` opening gets the stateless modern protocol.
+    serveStdio(buildServer, {
+        onerror: (error) => {
+            console.error(`[4DA] stdio serving error: ${error.message}`);
+        },
+    });
     // Handle graceful shutdown
     process.on("SIGINT", () => {
         console.error("[4DA] Received SIGINT — shutting down gracefully");
@@ -394,7 +414,7 @@ async function main() {
         process.exit(0);
     });
     const toolCount = getSlimToolList().length;
-    console.error(`4DA MCP Server v4.6.3 started — ${toolCount} tools, stdio transport`);
+    console.error(`4DA MCP Server v${SERVER_VERSION} started — ${toolCount} tools, stdio transport`);
     console.error("  Use --http for Streamable HTTP, --setup to configure editors, --doctor to check health");
 }
 main().catch((error) => {

package/dist/tool-dispatch.d.ts

@@ -4,6 +4,7 @@
  * Map-based dispatch for the 14 active tools.
  * Adding a new tool = add to this map + schema-registry + barrel export.
  */
+import type { CallToolResult } from "@modelcontextprotocol/server";
 import type { FourDADatabase } from "./db.js";
 /**
  * Executor signature — all tool execute functions follow this shape.
@@ -14,12 +15,7 @@ export type ToolExecutor = (db: FourDADatabase, params: any) => unknown | Promis
  * Dispatch a tool call by name. Awaits uniformly (no-op for sync executors).
  * Returns MCP-formatted response with JSON-serialized result.
  */
-export declare function dispatchTool(name: string, db: FourDADatabase, args: Record<string, unknown> | undefined): Promise<{
-    content: Array<{
-        type: string;
-        text: string;
-    }>;
-}>;
+export declare function dispatchTool(name: string, db: FourDADatabase, args: Record<string, unknown> | undefined): Promise<CallToolResult>;
 /** Check if a tool exists in the dispatch map */
 export declare function hasDispatchTool(name: string): boolean;
 /** Get count of registered tool executors */

package/dist/tools/get-actionable-signals.js

@@ -250,7 +250,11 @@ export function executeGetActionableSignals(db, params) {
         items = db.getRelevantContent(0.1, undefined, 200, 168); // Try 7 days
     }
     if (items.length === 0) {
-        items = db.getRelevantContent(0.0, undefined, 200, 720); // Try 30 days, any score
+        // Deep 30-day/any-score fallback reaches the stale-epoch tail after a
+        // pipeline-version bump. This path trusts stored signal_type/signal_priority
+        // verbatim (confidence 0.90 below), so it MUST only see current-version
+        // rows — stale persisted signals are claims the live brain no longer makes.
+        items = db.getRelevantContent(0.0, undefined, 200, 720, true);
     }
     // Get user's detected tech for cross-referencing
     const context = db.getUserContext(true, false);

package/dist/tools/get-relevant-content.js

@@ -60,7 +60,10 @@ export function executeGetRelevantContent(db, params) {
         items = db.getRelevantContent(minScore, params.source_type, limit, 168);
     }
     if (items.length === 0) {
-        items = db.getRelevantContent(0.0, params.source_type, limit, 720);
+        // Deep 30-day fallback at zero floor reaches the stale-epoch tail after a
+        // pipeline-version bump — require current-version scores so we never rank
+        // numbers the live scoring brain doesn't stand behind.
+        items = db.getRelevantContent(0.0, params.source_type, limit, 720, true);
     }
     return items;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4da/mcp-server",
-  "version": "4.6.5",
+  "version": "5.0.0",
   "mcpName": "io.github.4DA-Systems/4da-mcp-server",
   "description": "Dependency intelligence for AI coding agents. Live CVE scanning, dependency health, upgrade planning, ecosystem news, decision memory — zero config, privacy-first. 9 tools standalone, 14 total with desktop app.",
   "type": "module",
@@ -18,6 +18,17 @@
     "README.md",
     "LICENSE"
   ],
+  "scripts": {
+    "build": "tsc && pnpm run copy-schemas",
+    "copy-schemas": "node -e \"const fs=require('fs');const path=require('path');const src='src/schemas';const dst='dist/schemas';if(!fs.existsSync(dst))fs.mkdirSync(dst,{recursive:true});fs.readdirSync(src).filter(f=>f.endsWith('.json')).forEach(f=>fs.copyFileSync(path.join(src,f),path.join(dst,f)))\"",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "inspect": "npx @modelcontextprotocol/inspector node dist/index.js",
+    "setup": "node dist/setup.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "pnpm run build"
+  },
   "keywords": [
     "mcp",
     "mcp-server",
@@ -69,8 +80,9 @@
     "url": "https://github.com/4DA-Systems/4DA/issues"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "better-sqlite3": "^12.9.0"
+    "better-sqlite3": "^12.9.0",
+    "@modelcontextprotocol/node": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.0.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.11",
@@ -80,16 +92,18 @@
     "vitest": "^4.1.5"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
-  "scripts": {
-    "build": "tsc && pnpm run copy-schemas",
-    "copy-schemas": "node -e \"const fs=require('fs');const path=require('path');const src='src/schemas';const dst='dist/schemas';if(!fs.existsSync(dst))fs.mkdirSync(dst,{recursive:true});fs.readdirSync(src).filter(f=>f.endsWith('.json')).forEach(f=>fs.copyFileSync(path.join(src,f),path.join(dst,f)))\"",
-    "dev": "tsc --watch",
-    "start": "node dist/index.js",
-    "inspect": "npx @modelcontextprotocol/inspector node dist/index.js",
-    "setup": "node dist/setup.js",
-    "test": "vitest run",
-    "test:watch": "vitest"
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3",
+      "esbuild"
+    ],
+    "overrides": {
+      "fast-uri": ">=3.1.2",
+      "ip-address": "^10.1.1",
+      "vite": ">=7.3.5 <8",
+      "esbuild": ">=0.28.1"
+    }
   }
-}
+}