@4da/mcp-server 5.0.4 → 6.0.0

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@4da/mcp-server",
-  "version": "5.0.4",
+  "version": "6.0.0",
   "mcpName": "io.github.4DA-Systems/4da-mcp-server",
-  "description": "Dependency intelligence for AI coding agents. Live CVE scanning, dependency health, upgrade planning, ecosystem news, decision memory — zero config, privacy-first. 9 tools standalone, 14 total with desktop app.",
+  "description": "Upgrade intelligence for AI coding agents: what changes between your installed and target version (changelog, breaking changes, the files you import it from), a pre-install verdict on each bump, vulnerability scanning at osv-scanner parity across npm/pnpm/yarn, Cargo, Python and Go lockfiles, ranked upgrade plans, task-scoped briefings, decision memory. Local, no account. 11 tools standalone, 16 with the desktop app.",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
@@ -16,12 +16,12 @@
     "!dist/test-setup.*",
     "!dist/**/*.map",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {
     "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\"",
-    "build": "pnpm run clean && tsc && pnpm run copy-schemas",
-    "copy-schemas": "node -e \"const fs=require('fs');const path=require('path');const src='src/schemas';const dst='dist/schemas';if(!fs.existsSync(dst))fs.mkdirSync(dst,{recursive:true});fs.readdirSync(src).filter(f=>f.endsWith('.json')).forEach(f=>fs.copyFileSync(path.join(src,f),path.join(dst,f)))\"",
+    "build": "pnpm run clean && tsc",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "inspect": "npx @modelcontextprotocol/inspector node dist/index.js",
@@ -41,33 +41,30 @@
     "windsurf",
     "copilot",
     "vscode",
-    "ai-tools",
     "ai-agent",
     "ai-coding",
     "developer-tools",
-    "developer-intelligence",
-    "developer-productivity",
-    "developer-context",
-    "codebase-awareness",
-    "codebase-context",
-    "code-context",
-    "code-intelligence",
-    "content-scoring",
-    "relevance-scoring",
-    "privacy-first",
-    "local-first",
-    "offline",
-    "hacker-news",
-    "arxiv",
-    "reddit",
-    "github",
-    "knowledge-gaps",
-    "tech-radar",
+    "dependencies",
+    "dependency-upgrade",
+    "upgrade",
+    "changelog",
+    "breaking-changes",
+    "vulnerability",
+    "vulnerability-scanner",
+    "security",
+    "cve",
+    "osv",
+    "supply-chain",
+    "lockfile",
+    "npm",
+    "cargo",
+    "pypi",
+    "go-modules",
     "decision-memory",
-    "dependency-tracking",
-    "security-advisories",
     "agent-memory",
-    "sqlite"
+    "privacy-first",
+    "local-first",
+    "offline"
   ],
   "author": "4DA",
   "license": "Apache-2.0",
@@ -81,20 +78,20 @@
     "url": "https://github.com/4DA-Systems/4DA/issues"
   },
   "dependencies": {
-    "better-sqlite3": "^12.9.0",
     "@modelcontextprotocol/node": "^2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",
+    "better-sqlite3": "^12.9.0",
     "hono": "^4.12.34"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.11",
     "@types/node": "^26.0.1",
-    "typescript": "^5.3.0",
+    "typescript": "^7.0.2",
     "vite": "~7.3.5",
-    "vitest": "^4.1.5"
+    "vitest": "^5.0.1"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.0.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [

package/dist/schemas/agent-memory.json

@@ -1,49 +0,0 @@
-{
-  "name": "agent_memory",
-  "description": "Cross-agent persistent memory — store and recall discoveries, decisions, context, and warnings across sessions and tools.\n\nEnables AI agents to build institutional knowledge that persists beyond individual conversations. Supports storing, recalling by topic, filtering by tags, and retrieving recent entries. Call to store a discovery, decision, or warning worth keeping, or to recall prior context before starting work.",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "action": {
-        "type": "string",
-        "enum": ["store", "recall", "recall_by_tags", "get_recent"],
-        "description": "Action to perform"
-      },
-      "session_id": {
-        "type": "string",
-        "description": "Session identifier (for store)"
-      },
-      "agent_type": {
-        "type": "string",
-        "description": "Agent identifier, e.g. claude_code, cursor, windsurf (for store)"
-      },
-      "memory_type": {
-        "type": "string",
-        "enum": ["discovery", "decision", "context", "warning", "preference"],
-        "description": "Type of memory (for store). Default: context"
-      },
-      "content": {
-        "type": "string",
-        "description": "Memory content text (for store)"
-      },
-      "tags": {
-        "type": "array",
-        "items": { "type": "string" },
-        "description": "Tags for categorization and retrieval"
-      },
-      "confidence": {
-        "type": "number",
-        "description": "Confidence level 0.0-1.0 (for store)"
-      },
-      "topic": {
-        "type": "string",
-        "description": "Topic to recall memories about (for recall)"
-      },
-      "limit": {
-        "type": "number",
-        "description": "Maximum memories to return (for recall/get_recent). Default: 10"
-      }
-    },
-    "required": ["action"]
-  }
-}

package/dist/schemas/decision-enforcement.json

@@ -1,22 +0,0 @@
-{
-  "name": "check_decision_alignment",
-  "description": "Check if a technology or pattern aligns with active decisions before suggesting changes.\n\nPrevents AI agents from recommending technologies or patterns that contradict settled developer decisions. Returns alignment status and relevant decisions. Call BEFORE suggesting a major tech change, new library, or architecture shift, to avoid contradicting settled decisions.",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "technology": {
-        "type": "string",
-        "description": "Technology name to check (e.g., 'postgresql', 'redis', 'graphql')"
-      },
-      "pattern": {
-        "type": "string",
-        "description": "Architecture pattern to check (e.g., 'microservices', 'event-driven')"
-      },
-      "context": {
-        "type": "string",
-        "description": "Additional context about the proposed change"
-      }
-    },
-    "required": ["technology"]
-  }
-}

package/dist/schemas/decision-memory.json

@@ -1,54 +0,0 @@
-{
-  "name": "decision_memory",
-  "description": "Manage developer decisions — record, list, check alignment, update, or supersede.\n\nPersistent decision memory that tracks technology choices, architecture patterns, and workflow preferences. Prevents re-litigation of settled decisions across sessions. Call when the user makes, changes, or asks about a settled decision, choice, or convention.",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "action": {
-        "type": "string",
-        "enum": ["record", "list", "check_alignment", "update", "supersede"],
-        "description": "Action to perform"
-      },
-      "decision_type": {
-        "type": "string",
-        "enum": ["tech_choice", "architecture", "workflow", "pattern", "dependency"],
-        "description": "Type of decision (for record)"
-      },
-      "subject": {
-        "type": "string",
-        "description": "Subject of the decision (e.g., 'database', 'auth-strategy')"
-      },
-      "decision": {
-        "type": "string",
-        "description": "The decision made (for record)"
-      },
-      "rationale": {
-        "type": "string",
-        "description": "Why this decision was made (for record)"
-      },
-      "alternatives_rejected": {
-        "type": "array",
-        "items": { "type": "string" },
-        "description": "Alternatives that were considered and rejected"
-      },
-      "context_tags": {
-        "type": "array",
-        "items": { "type": "string" },
-        "description": "Tags for filtering and retrieval"
-      },
-      "confidence": {
-        "type": "number",
-        "description": "Confidence level 0.0-1.0 (for record)"
-      },
-      "id": {
-        "type": "number",
-        "description": "Decision ID (for update/supersede)"
-      },
-      "technology": {
-        "type": "string",
-        "description": "Technology to check alignment for (check_alignment action)"
-      }
-    },
-    "required": ["action"]
-  }
-}

package/dist/schemas/dependency-health.json

@@ -1,27 +0,0 @@
-{
-  "name": "dependency_health",
-  "description": "Assess health of project dependencies — version freshness, deprecation status, known CVEs across npm, Rust, Python, and Go. Auto-detects from lock files.\n\nReturns a health score (0-100), outdated/deprecated/vulnerable counts, and per-dependency details including semver distance and registry metadata.\n\nPrivacy: sends only package names (public manifest data). No code or personal data transmitted. Call when the user asks whether their dependencies are outdated, stale, deprecated, or need updating.",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "include_dev": {
-        "type": "boolean",
-        "description": "Include devDependencies in health check. Default: false."
-      },
-      "ecosystem_filter": {
-        "type": "string",
-        "enum": ["npm", "crates.io", "PyPI", "Go"],
-        "description": "Only show dependencies from this ecosystem."
-      },
-      "sort_by": {
-        "type": "string",
-        "enum": ["risk", "name", "outdated"],
-        "description": "Sort order. 'risk' prioritizes vulnerable+deprecated+outdated. Default: risk."
-      },
-      "limit": {
-        "type": "number",
-        "description": "Maximum dependencies to return. Default: 50."
-      }
-    }
-  }
-}

package/dist/schemas/developer-dna.json

@@ -1,219 +0,0 @@
-{
-  "name": "developer_dna",
-  "description": "Export your Developer DNA — a comprehensive profile of your tech identity built from project scans, explicit interests, and local interaction history. Includes primary stack, adjacent tech, top dependencies, engaged topics, blind spots, source engagement rates, and aggregate stats. Call when the user asks for a summary of their developer profile, identity, or tech fingerprint.",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "include_blind_spots": {
-        "type": "boolean",
-        "description": "Include blind spot analysis (dependencies with stale engagement). Default: true",
-        "default": true
-      },
-      "max_dependencies": {
-        "type": "number",
-        "description": "Maximum dependencies to include. Default: 30",
-        "default": 30
-      },
-      "max_topics": {
-        "type": "number",
-        "description": "Maximum engaged topics to include. Default: 20",
-        "default": 20
-      }
-    }
-  },
-  "outputSchema": {
-    "$schema": "http://json-schema.org/draft-07/schema#",
-    "title": "DeveloperDna",
-    "description": "Comprehensive developer identity profile built from local project data and engagement signals.",
-    "type": "object",
-    "required": [
-      "generated_at",
-      "primary_stack",
-      "adjacent_tech",
-      "top_dependencies",
-      "interests",
-      "top_engaged_topics",
-      "blind_spots",
-      "source_engagement",
-      "stats",
-      "identity_summary"
-    ],
-    "properties": {
-      "generated_at": {
-        "type": "string",
-        "format": "date-time",
-        "description": "ISO 8601 timestamp when this DNA profile was generated."
-      },
-      "primary_stack": {
-        "type": "array",
-        "items": { "type": "string" },
-        "description": "Technologies from the user's declared tech stack (user_identity + tech_stack tables)."
-      },
-      "adjacent_tech": {
-        "type": "array",
-        "items": { "type": "string" },
-        "description": "Technologies detected by ACE in local projects but not in the declared stack."
-      },
-      "top_dependencies": {
-        "type": "array",
-        "items": { "$ref": "#/outputSchema/definitions/DependencyEntry" },
-        "description": "Most-used project dependencies across scanned projects."
-      },
-      "interests": {
-        "type": "array",
-        "items": { "type": "string" },
-        "description": "Explicit interest topics declared by the user."
-      },
-      "top_engaged_topics": {
-        "type": "array",
-        "items": { "$ref": "#/outputSchema/definitions/EngagedTopic" },
-        "description": "Topics with highest positive engagement from interaction data."
-      },
-      "blind_spots": {
-        "type": "array",
-        "items": { "$ref": "#/outputSchema/definitions/BlindSpotEntry" },
-        "description": "Dependencies in the codebase with stale or zero engagement."
-      },
-      "source_engagement": {
-        "type": "array",
-        "items": { "$ref": "#/outputSchema/definitions/SourceEngagement" },
-        "description": "Engagement rates broken down by content source type."
-      },
-      "stats": {
-        "$ref": "#/outputSchema/definitions/DnaStats",
-        "description": "Aggregate statistics about the developer's 4DA usage."
-      },
-      "identity_summary": {
-        "type": "string",
-        "description": "Human-readable one-paragraph summary of the developer's technical identity."
-      }
-    },
-    "definitions": {
-      "DependencyEntry": {
-        "type": "object",
-        "required": ["name", "project_path"],
-        "properties": {
-          "name": {
-            "type": "string",
-            "description": "Package or library name."
-          },
-          "project_path": {
-            "type": "string",
-            "description": "Path to the project that uses this dependency."
-          }
-        }
-      },
-      "EngagedTopic": {
-        "type": "object",
-        "required": ["topic", "interactions", "percent_of_total"],
-        "properties": {
-          "topic": {
-            "type": "string",
-            "description": "The topic name."
-          },
-          "interactions": {
-            "type": "integer",
-            "minimum": 0,
-            "description": "Total positive interaction count for this topic."
-          },
-          "percent_of_total": {
-            "type": "number",
-            "minimum": 0,
-            "maximum": 100,
-            "description": "Percentage of total interactions attributed to this topic."
-          }
-        }
-      },
-      "BlindSpotEntry": {
-        "type": "object",
-        "required": ["dependency", "severity", "days_stale"],
-        "properties": {
-          "dependency": {
-            "type": "string",
-            "description": "The dependency or technology name."
-          },
-          "severity": {
-            "type": "string",
-            "enum": ["critical", "high", "medium", "low"],
-            "description": "How urgent the knowledge gap is."
-          },
-          "days_stale": {
-            "type": "integer",
-            "minimum": 0,
-            "description": "Days since last engagement with content about this dependency."
-          }
-        }
-      },
-      "SourceEngagement": {
-        "type": "object",
-        "required": ["source_type", "items_seen", "items_saved", "engagement_rate"],
-        "properties": {
-          "source_type": {
-            "type": "string",
-            "description": "Content source identifier (e.g., hackernews, reddit, arxiv, rss)."
-          },
-          "items_seen": {
-            "type": "integer",
-            "minimum": 0,
-            "description": "Total items fetched from this source."
-          },
-          "items_saved": {
-            "type": "integer",
-            "minimum": 0,
-            "description": "Items the user explicitly saved from this source."
-          },
-          "engagement_rate": {
-            "type": "number",
-            "minimum": 0,
-            "maximum": 1,
-            "description": "Ratio of items_saved to items_seen (0..1)."
-          }
-        }
-      },
-      "DnaStats": {
-        "type": "object",
-        "required": [
-          "total_items_processed",
-          "total_relevant",
-          "rejection_rate",
-          "project_count",
-          "dependency_count",
-          "days_active"
-        ],
-        "properties": {
-          "total_items_processed": {
-            "type": "integer",
-            "minimum": 0,
-            "description": "Total content items ingested by 4DA."
-          },
-          "total_relevant": {
-            "type": "integer",
-            "minimum": 0,
-            "description": "Items that passed the relevance threshold."
-          },
-          "rejection_rate": {
-            "type": "number",
-            "minimum": 0,
-            "maximum": 1,
-            "description": "Fraction of items rejected as irrelevant (0..1)."
-          },
-          "project_count": {
-            "type": "integer",
-            "minimum": 0,
-            "description": "Number of distinct projects scanned by ACE."
-          },
-          "dependency_count": {
-            "type": "integer",
-            "minimum": 0,
-            "description": "Total unique dependencies across all projects."
-          },
-          "days_active": {
-            "type": "integer",
-            "minimum": 0,
-            "description": "Days since the earliest source item was ingested."
-          }
-        }
-      }
-    }
-  }
-}

package/dist/schemas/ecosystem-pulse.json

@@ -1,17 +0,0 @@
-{
-  "name": "ecosystem_pulse",
-  "description": "Live ecosystem news relevant to your tech stack. Surfaces trending Hacker News discussions filtered by your detected technologies. Updated on server startup.\n\nPrivacy: No personal data sent. Only generic tech keywords used for filtering. Call when the user asks what is new, trending, or happening in their ecosystem or tech community.",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "min_points": {
-        "type": "number",
-        "description": "Minimum HN points to include. Default: 0"
-      },
-      "limit": {
-        "type": "number",
-        "description": "Maximum headlines to return. Default: 15"
-      }
-    }
-  }
-}

package/dist/schemas/get-actionable-signals.json

@@ -1,29 +0,0 @@
-{
-  "name": "get_actionable_signals",
-  "description": "Classify content into actionable signal types (security_alert, breaking_change, tool_discovery, tech_trend, learning, competitive_intel) with priority levels. Cross-references against user's tech stack. Call when the user wants to know what is actionable or urgent, not just what is relevant.",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "priority_filter": {
-        "type": "string",
-        "description": "Filter by priority level",
-        "enum": ["critical", "high", "medium", "low"]
-      },
-      "signal_type": {
-        "type": "string",
-        "description": "Filter by signal type",
-        "enum": ["security_alert", "breaking_change", "tool_discovery", "tech_trend", "learning", "competitive_intel"]
-      },
-      "limit": {
-        "type": "number",
-        "description": "Maximum signals to return (default: 20, max: 100)",
-        "default": 20
-      },
-      "since_hours": {
-        "type": "number",
-        "description": "Only include items from last N hours (default: 48)",
-        "default": 48
-      }
-    }
-  }
-}

package/dist/schemas/get-context.json

@@ -1,17 +0,0 @@
-{
-  "name": "get_context",
-  "description": "Get the user's context - what 4DA knows about them.\n\nReturns information about:\n- Static Identity: User-declared role, tech stack, domains, interests, and exclusions\n- ACE Context (optional): Auto-detected technologies and active topics from recent activity\n- Learned Preferences (optional): retained compatibility field; implicit preference learning no longer contributes to scoring\n\nCall FIRST when you need to understand what the user works on or cares about before answering or recommending.",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "include_ace": {
-        "type": "boolean",
-        "description": "Include ACE-detected context (detected tech, active topics). Default: true"
-      },
-      "include_learned": {
-        "type": "boolean",
-        "description": "Include the retained learned-preferences compatibility field. Default: true"
-      }
-    }
-  }
-}

package/dist/schemas/get-relevant-content.json

@@ -1,26 +0,0 @@
-{
-  "name": "get_relevant_content",
-  "description": "Get filtered relevant content from 4DA's personalized feed.\n\nReturns content items that match the user's explicit interests, tech stack, and ACE-detected context.\nItems are scored based on:\n- Explicit interests declared by the user\n- Tech stack and domains\n- ACE-detected context (recent files, projects, git activity)\n\nIMPORTANT for autonomous use: each item carries an `evidence_class` describing how it is grounded. The relevance_score float is NOT comparable across classes — gate actions on evidence_class, not the number:\n- \"osv_verified\": a security advisory matching one of the user's INSTALLED dependencies — safe to act on\n- \"dependency_grounded\": matched one of the user's declared dependencies — trustworthy\n- \"semantic_only\": topical/embedding relevance with NO dependency edge — surface to the human, verify before acting\n- \"keyword_heuristic\": standalone-mode keyword score (no Rust pipeline) — weakest signal\n\nCall when the user asks what to read, what is relevant to them, or for content on a topic.",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "min_score": {
-        "type": "number",
-        "description": "Minimum relevance score (0.0-1.0). Default: 0.35"
-      },
-      "source_type": {
-        "type": "string",
-        "description": "Filter by source type: \"hackernews\", \"arxiv\", or \"reddit\". Leave empty for all sources.",
-        "enum": ["hackernews", "arxiv", "reddit"]
-      },
-      "limit": {
-        "type": "number",
-        "description": "Maximum number of items to return. Default: 20, max: 100"
-      },
-      "since_hours": {
-        "type": "number",
-        "description": "Only include items discovered in the last N hours. Default: 24"
-      }
-    }
-  }
-}

package/dist/schemas/knowledge-gaps.json

@@ -1,14 +0,0 @@
-{
-  "name": "knowledge_gaps",
-  "description": "Detect knowledge gaps in your project dependencies.\n\nIdentifies dependencies you use but haven't been tracking content about — blind spots where a breaking change, security advisory, or major release could catch you off guard. Call when the user asks what they are missing, what they are not tracking, or where their blind spots are.",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "min_severity": {
-        "type": "string",
-        "enum": ["critical", "high", "medium", "low"],
-        "description": "Minimum gap severity to include. Default: medium"
-      }
-    }
-  }
-}

package/dist/schemas/record-feedback.json

@@ -1,24 +0,0 @@
-{
-  "name": "record_feedback",
-  "description": "Record explicit user interaction history for a content item.\n\nFeedback actions:\n- \"click\": User clicked/opened the item\n- \"save\": User saved/bookmarked the item\n- \"dismiss\": User dismissed the item\n- \"mark_irrelevant\": User marked item as not relevant\n\nThis records what happened; it does not train content preferences (interaction counts only graduate scoring's bootstrap gate). Call after the user reacts to a surfaced item (opens, saves, or dismisses it).",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "item_id": {
-        "type": "number",
-        "description": "The database ID of the item"
-      },
-      "source_type": {
-        "type": "string",
-        "description": "The source type: \"hackernews\", \"arxiv\", or \"reddit\"",
-        "enum": ["hackernews", "arxiv", "reddit"]
-      },
-      "action": {
-        "type": "string",
-        "description": "The feedback action: \"click\", \"save\", \"dismiss\", or \"mark_irrelevant\"",
-        "enum": ["click", "save", "dismiss", "mark_irrelevant"]
-      }
-    },
-    "required": ["item_id", "source_type", "action"]
-  }
-}

package/dist/schemas/upgrade-planner.json

@@ -1,22 +0,0 @@
-{
-  "name": "upgrade_planner",
-  "description": "Ranked standalone upgrade recommendations for project dependencies — call before upgrading, adding, or auditing any dependency to pick the safest order. Combines vulnerability severity, deprecation status, and version distance into a prioritized plan.\n\nSplits recommendations three ways: quick wins (safe patch/minor upgrades), breaking changes (major version bumps), and transitive CVEs marked waiting_on_upstream (not declared in your manifest — the fix arrives via a parent package update or a lockfile refresh). Call dependency_health first for registry context and vulnerability_scan first for a CVE-aware plan; without a scan the output says it is CVE-blind.\n\nProvenance: standalone heuristic — a point-in-time plan from local lockfiles plus live registry/OSV lookups, not the 4DA desktop app's cross-project, version-confirmed plan.\n\nPrivacy: live mode may query public registries and OSV with package names and versions. It never sends source code.",
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "include_dev": {
-        "type": "boolean",
-        "description": "Include devDependencies. Default: false."
-      },
-      "max_recommendations": {
-        "type": "number",
-        "description": "Maximum recommendations to return. Default: 20."
-      },
-      "risk_threshold": {
-        "type": "string",
-        "enum": ["all", "low", "medium", "high", "critical"],
-        "description": "Only show upgrades at or above this risk level. Default: all."
-      }
-    }
-  }
-}