@4da/mcp-server 5.0.4 → 6.0.1

package/dist/tools/get-actionable-signals.js

@@ -6,195 +6,16 @@
  * breaking changes, tool discoveries, etc.) with priority levels.
  * Cross-references against the user's ACE-detected tech stack.
  */
+import { isMaintenanceNotice } from "../live/maintenance.js";
+import { presentedSeverity, scopeAdjustmentReason } from "../live/severity-scope.js";
 import { getLiveIntelligence } from "../live-singleton.js";
-// ============================================================================
-// Pattern Definitions
-// ============================================================================
-const SIGNAL_PATTERNS = {
-    security_alert: {
-        keywords: [
-            "cve", "vulnerability", "exploit", "breach", "security flaw",
-            "zero-day", "zero day", "0-day", "patch", "ransomware",
-            "malware", "rce", "injection attack", "xss", "csrf",
-            "privilege escalation", "backdoor", "supply chain attack",
-        ],
-        boostWords: ["critical", "urgent", "severe", "actively exploited", "emergency"],
-        weight: 1.0,
-    },
-    breaking_change: {
-        keywords: [
-            "breaking change", "deprecated", "end of life", "eol",
-            "migration guide", "major release", "drops support",
-            "removed in", "no longer supported", "sunset",
-            "backwards incompatible", "api change",
-        ],
-        boostWords: ["v2", "v3", "v4", "v5", "major version", "upgrade required"],
-        weight: 0.9,
-    },
-    tool_discovery: {
-        keywords: [
-            "new release", "just released", "announcing", "launch",
-            "alternative to", "built with", "replacement for",
-            "open source", "open-source", "introducing",
-            "we built", "i built", "show hn",
-        ],
-        boostWords: ["faster", "better", "simpler", "lightweight", "blazing"],
-        weight: 0.7,
-    },
-    tech_trend: {
-        keywords: [
-            "adoption", "growing", "trending", "benchmark",
-            "comparison", "state of", "survey", "report",
-            "market share", "ecosystem", "roadmap",
-        ],
-        boostWords: ["2025", "2026", "accelerating", "mainstream", "industry"],
-        weight: 0.6,
-    },
-    learning: {
-        keywords: [
-            "tutorial", "how to", "guide", "deep dive",
-            "explained", "best practices", "patterns",
-            "architecture", "lessons learned", "walkthrough",
-            "step by step", "from scratch",
-        ],
-        boostWords: ["advanced", "production", "real-world", "comprehensive"],
-        weight: 0.5,
-    },
-    competitive_intel: {
-        keywords: [
-            "acquired", "funding", "raised", "ipo",
-            "valuation", "market share", "competitor",
-            "pivots", "pivot", "layoffs", "shutdown",
-            "acqui-hire", "series a", "series b",
-        ],
-        boostWords: ["million", "billion", "disrupts", "overtakes"],
-        weight: 0.6,
-    },
-};
-const BASE_WEIGHTS = {
-    security_alert: 2,
-    breaking_change: 2,
-    tool_discovery: 1,
-    tech_trend: 1,
-    learning: 1,
-    competitive_intel: 1,
-};
-// Word-boundary matching prevents "rce" matching inside "source", "xss" inside "success", etc.
-function hasWordBoundary(text, term) {
-    let searchFrom = 0;
-    while (true) {
-        const pos = text.indexOf(term, searchFrom);
-        if (pos === -1)
-            return false;
-        const beforeOk = pos === 0 || !/[a-zA-Z0-9]/.test(text[pos - 1]);
-        const afterIdx = pos + term.length;
-        const afterOk = afterIdx >= text.length || !/[a-zA-Z0-9]/.test(text[afterIdx]);
-        if (beforeOk && afterOk)
-            return true;
-        searchFrom = pos + 1;
-    }
-}
-const PRIORITY_LABELS = {
-    security_alert: "Security Alert",
-    breaking_change: "Breaking Change",
-    tool_discovery: "Tool Discovery",
-    tech_trend: "Tech Trend",
-    learning: "Learning",
-    competitive_intel: "Competitive Intel",
-};
-const KEYWORD_MAP = new Map();
-// Initialize keyword map
-for (const [type, pattern] of Object.entries(SIGNAL_PATTERNS)) {
-    for (const kw of pattern.keywords) {
-        if (!KEYWORD_MAP.has(kw)) {
-            KEYWORD_MAP.set(kw, []);
-        }
-        KEYWORD_MAP.get(kw).push({ type, weight: pattern.weight, isBoost: false });
-    }
-    for (const bw of pattern.boostWords) {
-        if (!KEYWORD_MAP.has(bw)) {
-            KEYWORD_MAP.set(bw, []);
-        }
-        KEYWORD_MAP.get(bw).push({ type, weight: 0.2, isBoost: true });
-    }
-}
-function classify(title, content, relevanceScore, detectedTech) {
-    // Pre-compute lowercased text once
-    const textLower = `${title} ${content}`.toLowerCase();
-    const titleLower = title.toLowerCase();
-    // Track scores per signal type
-    const typeScores = {};
-    // Single pass through keyword map (word-boundary matched to prevent false positives)
-    for (const [keyword, entries] of KEYWORD_MAP.entries()) {
-        if (hasWordBoundary(textLower, keyword)) {
-            for (const entry of entries) {
-                if (!typeScores[entry.type]) {
-                    typeScores[entry.type] = { score: 0, matched: [] };
-                }
-                typeScores[entry.type].score += entry.weight;
-                typeScores[entry.type].matched.push(keyword);
-                // Boost if keyword is in title (only for non-boost words)
-                if (!entry.isBoost && hasWordBoundary(titleLower, keyword)) {
-                    typeScores[entry.type].score += entry.weight * 0.5;
-                }
-            }
-        }
-    }
-    // Find best type
-    let bestType = null;
-    let bestConfidence = 0;
-    let bestTriggers = [];
-    for (const [type, data] of Object.entries(typeScores)) {
-        const confidence = Math.min(data.score / 3.0, 1.0);
-        if (confidence > bestConfidence) {
-            bestType = type;
-            bestConfidence = confidence;
-            bestTriggers = data.matched;
-        }
-    }
-    if (!bestType)
-        return null;
-    // Require at least 2 keyword matches — single keyword produces too many false positives
-    if (bestTriggers.length < 2)
-        return null;
-    // Compute priority
-    let priorityScore = BASE_WEIGHTS[bestType];
-    const techMatch = detectedTech.find((t) => hasWordBoundary(textLower, t.toLowerCase()));
-    // Security alerts MUST mention something in the user's stack to be relevant.
-    // A CVE for "Prometheus" or "PraisonAI" is noise if the user doesn't use them.
-    // Only keep security alerts that explicitly name a technology the user has.
-    if (bestType === "security_alert" && !techMatch) {
-        return null;
-    }
-    if (techMatch)
-        priorityScore += 1;
-    if (relevanceScore > 0.7)
-        priorityScore += 1;
-    priorityScore = Math.min(priorityScore, 4);
-    const priority = priorityScore >= 4 ? "critical" : priorityScore === 3 ? "high" : priorityScore === 2 ? "medium" : "low";
-    // Generate action
-    const shortTitle = title.length > 60 ? title.substring(0, 60) + "..." : title;
-    let action;
-    if (bestType === "security_alert" && techMatch) {
-        action = `Review ${shortTitle} - affects your ${techMatch} stack`;
-    }
-    else if (bestType === "breaking_change" && techMatch) {
-        action = `Check migration path - ${techMatch} breaking change`;
-    }
-    else if (bestType === "tool_discovery" && techMatch) {
-        action = `Evaluate for your ${techMatch} workflow: ${shortTitle}`;
-    }
-    else {
-        action = `${PRIORITY_LABELS[bestType] || bestType}: ${shortTitle}`;
-    }
-    return {
-        signalType: bestType,
-        priority,
-        confidence: Math.round(bestConfidence * 100) / 100,
-        action,
-        triggers: bestTriggers,
-    };
-}
+import { driftAction } from "./install-drift-notes.js";
+import { normalizeStoredPriority } from "./signal-classifier.js";
+// The priority vocabulary lives in signal-classifier.ts; re-exported for existing importers.
+export { normalizeStoredPriority } from "./signal-classifier.js";
+/** Feed sources whose rows are structured facts (an advisory record, a registry release), not prose. */
+const STRUCTURED_SOURCES = new Set(["cve", "osv", "crates_io", "npm_registry", "pypi", "go_modules", "github"]);
+const ADVISORY_SOURCES = new Set(["cve", "osv"]);
 // ============================================================================
 // Tool Definition
 // ============================================================================
@@ -231,68 +52,172 @@ Use this to get prioritized, actionable intelligence from 4DA's feed.`,
             },
             since_hours: {
                 type: "number",
-                description: "Only include items from the last N hours. Default: 48",
+                description: "Only include items from the last N hours. Default: 48, max: 720 (30 days)",
                 default: 48,
             },
         },
     },
 };
+/** Widest window a caller may ask for: 30 days. */
+const MAX_SINCE_HOURS = 720;
+/** Windows past this reach rows the current scoring pipeline may not have re-scored. */
+const DEEP_WINDOW_HOURS = 168;
+/**
+ * Group scan entries that are the same vulnerability under different ids.
+ *
+ * OSV returns a GHSA record and a RUSTSEC (or CVE) record for one bug, each
+ * naming the other in `aliases`; injected one-per-record they read as two
+ * problems and doubled the advisory count in every briefing. Union-find over
+ * `[vulnId, ...aliases]` connects the records transitively (A knows B, B knows
+ * C), scoped to the affected (ecosystem, package, version) so one advisory
+ * against two packages — or two pinned versions of one package — stays two
+ * things to fix. The representative is the GHSA record when the cluster has
+ * one (the richest and most stable id), else the first seen; `ids` lists
+ * every identifier in first-seen order.
+ */
+export function clusterVulnerabilities(vulns) {
+    const parent = new Map();
+    const find = (key) => {
+        let root = key;
+        while (parent.get(root) !== root)
+            root = parent.get(root);
+        // Path compression keeps repeated lookups flat.
+        let cursor = key;
+        while (parent.get(cursor) !== root) {
+            const next = parent.get(cursor);
+            parent.set(cursor, root);
+            cursor = next;
+        }
+        return root;
+    };
+    const union = (a, b) => {
+        const ra = find(a);
+        const rb = find(b);
+        if (ra !== rb)
+            parent.set(ra, rb);
+    };
+    const scopeOf = (v) => `${v.ecosystem}\0${v.package}\0${v.currentVersion}`;
+    const idsOf = (v) => [v.vulnId, ...v.aliases].filter(Boolean);
+    for (const v of vulns) {
+        const scope = scopeOf(v);
+        const keys = idsOf(v).map((id) => `${scope}\0${id}`);
+        for (const key of keys)
+            if (!parent.has(key))
+                parent.set(key, key);
+        for (let i = 1; i < keys.length; i++)
+            union(keys[0], keys[i]);
+    }
+    const groups = new Map();
+    for (const v of vulns) {
+        const root = find(`${scopeOf(v)}\0${v.vulnId}`);
+        const members = groups.get(root);
+        if (members)
+            members.push(v);
+        else
+            groups.set(root, [v]);
+    }
+    return [...groups.values()].map((members) => {
+        const representative = members.find((m) => m.vulnId.startsWith("GHSA-")) ?? members[0];
+        const ids = [...new Set(members.flatMap(idsOf))];
+        return { representative, ids };
+    });
+}
+/** Latest relevance-judge verdict per item (`llm_judgments`), when the desktop app has judged it. */
+function judgeVerdicts(db, ids) {
+    const out = new Map();
+    if (ids.length === 0)
+        return out;
+    try {
+        const raw = db.getRawDb();
+        for (let i = 0; i < ids.length; i += 500) {
+            const chunk = ids.slice(i, i + 500);
+            const rows = raw
+                .prepare(`SELECT source_item_id AS id, relevance_score AS v FROM llm_judgments
+           WHERE id IN (SELECT MAX(id) FROM llm_judgments WHERE source_item_id IN (${chunk.map(() => "?").join(",")}) GROUP BY source_item_id)`)
+                .all(...chunk);
+            for (const row of rows)
+                out.set(row.id, row.v);
+        }
+    }
+    catch {
+        // No llm_judgments table (standalone or an older app): no verdicts.
+    }
+    return out;
+}
+/** What an agent can do with a signal of this type and source. */
+function actionFor(type, source) {
+    if (ADVISORY_SOURCES.has(source))
+        return "Advisory record: run vulnerability_scan to see whether your installed versions are affected.";
+    if (source === "crates_io" || source === "npm_registry" || source === "pypi" || source === "go_modules") {
+        return "New release of a dependency: call upgrade_impact for what changed before bumping.";
+    }
+    if (type === "security_alert")
+        return "Security news (not an advisory against your versions): read for context.";
+    if (type === "breaking_change")
+        return "Possible breaking change: check whether it touches a dependency you use.";
+    return "Read for context.";
+}
 // ============================================================================
 // Execution
 // ============================================================================
-export function executeGetActionableSignals(db, params) {
+export function executeGetActionableSignals(db, params, liveIntel = getLiveIntelligence()) {
     const limit = Math.max(1, Math.min(100, params.limit ?? 20));
-    const sinceHours = Math.max(1, Math.min(168, params.since_hours ?? 48));
-    // Get items from DB (reuse existing method with low min score to get more items)
-    // Try progressively wider time windows if no items found
-    let items = db.getRelevantContent(0.1, undefined, 200, sinceHours);
+    const sinceHours = Math.max(1, Math.min(MAX_SINCE_HOURS, params.since_hours ?? 48));
+    // Get items from DB (low min score to get more items). A signal_type filter
+    // is pushed into the read as well: the general read is capped at the top
+    // 200 ranked items across EVERY type, and on a real corpus that cap starved
+    // a type-specific pass — live 2026-09-07, the two in-window stored security
+    // alerts ranked 299th and 582nd, so a security-only read returned nothing.
+    // Stored matches are fetched by type and merged ahead of the general read,
+    // which still carries the unstamped rows for keyword classification.
+    const fetchItems = (minScore, hours, requireCurrentVersion) => {
+        const general = db.getRelevantContent(minScore, undefined, 200, hours, requireCurrentVersion);
+        if (!params.signal_type)
+            return general;
+        const stored = db.getRelevantContent(minScore, undefined, 200, hours, requireCurrentVersion, params.signal_type);
+        const seen = new Set(stored.map((item) => item.id));
+        return [...stored, ...general.filter((item) => !seen.has(item.id))];
+    };
+    // Try progressively wider time windows if no items found. A window wider
+    // than seven days reaches the stale-epoch tail, so it carries the same
+    // current-pipeline-version guard as the deep fallback below.
+    let items = fetchItems(0.1, sinceHours, sinceHours > DEEP_WINDOW_HOURS);
     if (items.length === 0 && sinceHours < 168) {
-        items = db.getRelevantContent(0.1, undefined, 200, 168); // Try 7 days
+        items = fetchItems(0.1, 168, false); // Try 7 days
     }
     if (items.length === 0) {
         // Deep 30-day/any-score fallback reaches the stale-epoch tail after a
         // pipeline-version bump. This path trusts stored signal_type/signal_priority
         // verbatim (confidence 0.90 below), so it MUST only see current-version
         // rows — stale persisted signals are claims the live brain no longer makes.
-        items = db.getRelevantContent(0.0, undefined, 200, 720, true);
+        items = fetchItems(0.0, 720, true);
     }
-    // Get user's detected tech for cross-referencing
-    const context = db.getUserContext(true, false);
-    const detectedTech = (context.ace?.detected_tech || []).map((t) => t.name);
     const signals = [];
+    const verdicts = judgeVerdicts(db, items.map((item) => item.id));
     for (const item of items) {
-        // Prefer pipeline-computed signals from DB over keyword re-classification
-        if (item.signal_type && item.signal_priority) {
-            const storedType = item.signal_type;
-            const storedPriority = item.signal_priority;
-            // Apply filters
-            if (params.priority_filter && storedPriority !== params.priority_filter)
-                continue;
-            if (params.signal_type && storedType !== params.signal_type)
-                continue;
-            signals.push({
-                id: item.id,
-                title: item.title,
-                url: item.url,
-                source_type: item.source_type,
-                relevance_score: item.relevance_score,
-                signal_type: storedType,
-                signal_priority: storedPriority,
-                action: `${storedType}: ${item.title.substring(0, 60)}`,
-                triggers: [],
-                confidence: 0.90,
-                discovered_ago: item.discovered_ago,
-            });
+        // Only the pipeline's own classifications, and only when they can be
+        // stood behind: a prose item (news, social, papers) appears when the
+        // relevance judge accepted it (latest verdict >= 0.5); a structured row
+        // (advisory record, registry release) may appear unjudged. Measured
+        // 2026-10-01: of 154 items stamped security_alert in 14 days the judge
+        // accepted 10, rejected 62 and never saw 82; 3 came from an advisory source.
+        if (!item.signal_type || !item.signal_priority)
             continue;
-        }
-        // Fallback: keyword classification for items without pipeline signals
-        const result = classify(item.title, item.content || "", item.relevance_score, detectedTech);
-        if (!result)
+        const verdict = verdicts.get(item.id);
+        const structured = STRUCTURED_SOURCES.has(item.source_type);
+        if (verdict !== undefined ? verdict < 0.5 : !structured)
             continue;
+        const storedType = item.signal_type;
+        let priority = normalizeStoredPriority(item.signal_priority);
+        // A headline about security is not an advisory against your versions:
+        // never above medium unless it comes from an advisory database.
+        if (storedType === "security_alert" && !ADVISORY_SOURCES.has(item.source_type) && (priority === "critical" || priority === "high")) {
+            priority = "medium";
+        }
         // Apply filters
-        if (params.priority_filter && result.priority !== params.priority_filter)
+        if (params.priority_filter && priority !== params.priority_filter)
             continue;
-        if (params.signal_type && result.signalType !== params.signal_type)
+        if (params.signal_type && storedType !== params.signal_type)
             continue;
         signals.push({
             id: item.id,
@@ -300,39 +225,77 @@ export function executeGetActionableSignals(db, params) {
             url: item.url,
             source_type: item.source_type,
             relevance_score: item.relevance_score,
-            signal_type: result.signalType,
-            signal_priority: result.priority,
-            action: result.action,
-            triggers: result.triggers,
-            confidence: result.confidence,
+            signal_type: storedType,
+            signal_priority: priority,
+            action: actionFor(storedType, item.source_type),
+            triggers: [],
+            // The judge's verdict when there is one; a structured row carries none.
+            confidence: verdict ?? (structured ? 0.5 : 0),
             discovered_ago: item.discovered_ago,
         });
     }
-    // Inject live vulnerability data as security_alert signals
-    const liveIntel = getLiveIntelligence();
-    if (liveIntel) {
-        const vulnResult = liveIntel.getVulnerabilities();
-        if (vulnResult && vulnResult.vulnerabilities.length > 0) {
-            for (const vuln of vulnResult.vulnerabilities) {
-                // Apply filters
-                const vulnPriority = vuln.severity === "critical" ? "critical" :
-                    vuln.severity === "high" ? "high" : "medium";
-                if (params.priority_filter && vulnPriority !== params.priority_filter)
-                    continue;
-                if (params.signal_type && params.signal_type !== "security_alert")
+    // Inject live vulnerability data as security_alert signals — one per
+    // vulnerability (alias clusters), not one per OSV record.
+    const vulnResult = liveIntel?.getVulnerabilities() ?? null;
+    if (vulnResult && vulnResult.vulnerabilities.length > 0) {
+        if (!params.signal_type || params.signal_type === "security_alert") {
+            for (const { representative: vuln, ids } of clusterVulnerabilities(vulnResult.vulnerabilities)) {
+                // The grade every surface shares (AD-046; twin of the app's
+                // `osv::identity::scope_adjusted_urgency`), not the raw advisory tier:
+                // a transitive of unknown scope read "CRITICAL: Sandbox Breakout" here
+                // while the app graded it High (sandbox@3.1.2, 2026-09-10).
+                const presented = presentedSeverity(vuln);
+                // Low stays low (a "LOW: ..." finding was listed at medium); an
+                // advisory with no severity at all is medium, not hidden.
+                let priority = presented === "critical" ? "critical" :
+                    presented === "high" ? "high" :
+                        presented === "low" ? "low" : "medium";
+                let relevance = presented === "critical" ? 1.0 : presented === "high" ? 0.9 : presented === "low" ? 0.5 : 0.7;
+                // An installed copy the lockfile does not pin is fixed by a reinstall,
+                // not an upgrade: the lockfile is already where it should be.
+                let action = vuln.installDriftOf
+                    ? driftAction(vuln)
+                    : vuln.fixedVersion
+                        ? `Upgrade ${vuln.package} to ${vuln.fixedVersion}`
+                        : `Review ${vuln.package} — no fix version published`;
+                const adjusted = scopeAdjustmentReason(vuln);
+                if (adjusted) {
+                    action += ` (the advisory rates it ${vuln.severity}; graded ${presented} as a ${adjusted})`;
+                }
+                let label = presented.toUpperCase();
+                // "X is unmaintained" is information to plan around, not a fix to
+                // apply today; an advisory against a crate this host never builds is
+                // not this host's exposure. Both stay visible at LOW so they cannot
+                // outrank, or be mistaken for, a live CVE — and the briefing's
+                // delegation verdict does not read them at all.
+                const maintenance = isMaintenanceNotice(vuln);
+                if (maintenance) {
+                    priority = "low";
+                    relevance = 0.3;
+                    action = "Maintenance notice — no fix to apply";
+                    label = "MAINTENANCE";
+                }
+                if (vuln.platformActive === false) {
+                    priority = "low";
+                    relevance = 0.3;
+                    action = `Not built on this host — ${action}`;
+                    // The title must agree with the priority: "MEDIUM: ... (glib@0.18.5)" at
+                    // priority low read as a medium issue on a Windows host that never builds glib.
+                    if (!maintenance)
+                        label = `NOT BUILT HERE (${presented})`;
+                }
+                if (params.priority_filter && priority !== params.priority_filter)
                     continue;
                 signals.push({
                     id: -1,
-                    title: `${vuln.severity.toUpperCase()}: ${vuln.summary} (${vuln.package}@${vuln.currentVersion})`,
+                    title: `${label}: ${vuln.summary} (${vuln.package}@${vuln.currentVersion})`,
                     url: vuln.references[0] || null,
                     source_type: "osv_live",
-                    relevance_score: vuln.severity === "critical" ? 1.0 : vuln.severity === "high" ? 0.9 : 0.7,
+                    relevance_score: relevance,
                     signal_type: "security_alert",
-                    signal_priority: vulnPriority,
-                    action: vuln.fixedVersion
-                        ? `Upgrade ${vuln.package} to ${vuln.fixedVersion}`
-                        : `Review ${vuln.package} — no fix version published`,
-                    triggers: [vuln.vulnId, ...vuln.aliases].filter(Boolean),
+                    signal_priority: priority,
+                    action,
+                    triggers: ids,
                     confidence: 1.0,
                     discovered_ago: vuln.published ? `published ${vuln.published}` : "recently",
                 });

package/dist/tools/get-context.d.ts

@@ -37,4 +37,6 @@ export declare function executeGetContext(db: FourDADatabase, params: GetContext
         ecosystem: string;
         isDev: boolean;
     }>;
+    resolved_dependencies_total?: number;
+    resolved_dependencies_note?: string;
 };

package/dist/tools/get-context.js

@@ -45,16 +45,24 @@ export function executeGetContext(db, params) {
     if (liveIntel) {
         const deps = liveIntel.getResolvedDeps();
         if (deps.length > 0) {
+            // Bounded: the full direct-dependency list ran this answer to ~30 KB
+            // on a 150-dependency project. vulnerability_scan / dependency_health
+            // are the tools for the whole list.
             return {
                 ...context,
-                resolved_dependencies: deps.map((d) => ({
+                resolved_dependencies: deps.slice(0, MAX_LISTED_DEPENDENCIES).map((d) => ({
                     name: d.name,
                     version: d.version,
                     ecosystem: d.ecosystem,
                     isDev: d.isDev,
                 })),
+                resolved_dependencies_total: deps.length,
+                ...(deps.length > MAX_LISTED_DEPENDENCIES
+                    ? { resolved_dependencies_note: `showing ${MAX_LISTED_DEPENDENCIES} of ${deps.length}; dependency_health lists them all` }
+                    : {}),
             };
         }
     }
     return context;
 }
+const MAX_LISTED_DEPENDENCIES = 40;

package/dist/tools/get-relevant-content.d.ts

@@ -40,4 +40,6 @@ export declare const getRelevantContentTool: {
 /**
  * Execute the get_relevant_content tool
  */
-export declare function executeGetRelevantContent(db: FourDADatabase, params: GetRelevantContentParams): RelevantItem[];
+export declare function executeGetRelevantContent(db: FourDADatabase, params: GetRelevantContentParams): Array<RelevantItem & {
+    judge_relevance: number | null;
+}>;

package/dist/tools/get-relevant-content.js

@@ -30,8 +30,13 @@ Use this to find content relevant to the user's current context.`,
             },
             source_type: {
                 type: "string",
-                description: 'Filter by source type: "hackernews", "arxiv", or "reddit". Leave empty for all sources.',
-                enum: ["hackernews", "arxiv", "reddit"],
+                description: "Only items from this source. Leave empty for all sources.",
+                // Every source the app fetches; the enum used to list three of them.
+                enum: [
+                    "hackernews", "reddit", "lobsters", "devto", "arxiv", "huggingface", "papers_with_code",
+                    "github", "crates_io", "npm_registry", "pypi", "go_modules", "cve", "osv", "stackoverflow",
+                    "rss", "youtube", "mastodon", "lemmy", "bluesky", "twitter", "producthunt",
+                ],
             },
             limit: {
                 type: "number",
@@ -64,5 +69,31 @@ export function executeGetRelevantContent(db, params) {
         // numbers the live scoring brain doesn't stand behind.
         items = db.getRelevantContent(0.0, params.source_type, limit, 720, true);
     }
-    return items;
+    // Items the relevance judge rejected are not "relevant content", whatever
+    // their score: measured 2026-10-01, 151 of 950 feed-relevant items carried
+    // a latest judge verdict below 0.5. Unjudged items stay (scored, not yet
+    // judged) and carry `judge_relevance: null`.
+    const verdicts = latestJudgeVerdicts(db, items.map((item) => item.id));
+    return items
+        .filter((item) => (verdicts.get(item.id) ?? 1) >= 0.5)
+        .map((item) => ({ ...item, judge_relevance: verdicts.get(item.id) ?? null }));
+}
+/** Latest relevance-judge verdict per item, when the desktop app has judged it. */
+function latestJudgeVerdicts(db, ids) {
+    const out = new Map();
+    if (ids.length === 0)
+        return out;
+    try {
+        const rows = db
+            .getRawDb()
+            .prepare(`SELECT source_item_id AS id, relevance_score AS v FROM llm_judgments
+         WHERE id IN (SELECT MAX(id) FROM llm_judgments WHERE source_item_id IN (${ids.map(() => "?").join(",")}) GROUP BY source_item_id)`)
+            .all(...ids);
+        for (const row of rows)
+            out.set(row.id, Math.round(row.v * 100) / 100);
+    }
+    catch {
+        // No llm_judgments table: nothing judged.
+    }
+    return out;
 }

package/dist/tools/index.d.ts

@@ -1,7 +1,7 @@
 /**
- * Tool exports for 4DA MCP Server — 14 tools across 5 categories
+ * Tool exports for 4DA MCP Server — 16 tools across 5 categories
  *
- * Security (3)     — vulnerability scanning, dependency health, upgrade planning
+ * Security (5)     — vulnerability scanning, dependency health, upgrade planning, upgrade impact, dependency check
  * Intelligence (6) — briefing, ecosystem news, context, content feed, signals, knowledge gaps, feedback
  * Decisions (2)    — decision memory, alignment checking
  * Agent (1)        — cross-session persistent memory
@@ -10,6 +10,8 @@
 export { vulnerabilityScanTool, executeVulnerabilityScan, } from "./vulnerability-scan.js";
 export { dependencyHealthTool, executeDependencyHealth, } from "./dependency-health.js";
 export { upgradePlannerTool, executeUpgradePlanner, } from "./upgrade-planner.js";
+export { dependencyCheckTool, executeDependencyCheck, } from "./dependency-check.js";
+export { upgradeImpactTool, executeUpgradeImpact, } from "./upgrade-impact.js";
 export { whatShouldIKnowTool, executeWhatShouldIKnow, } from "./what-should-i-know.js";
 export { ecosystemPulseTool, executeEcosystemPulse, } from "./ecosystem-pulse.js";
 export { getContextTool, executeGetContext } from "./get-context.js";

package/dist/tools/index.js

@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Tool exports for 4DA MCP Server — 14 tools across 5 categories
+ * Tool exports for 4DA MCP Server — 16 tools across 5 categories
  *
- * Security (3)     — vulnerability scanning, dependency health, upgrade planning
+ * Security (5)     — vulnerability scanning, dependency health, upgrade planning, upgrade impact, dependency check
  * Intelligence (6) — briefing, ecosystem news, context, content feed, signals, knowledge gaps, feedback
  * Decisions (2)    — decision memory, alignment checking
  * Agent (1)        — cross-session persistent memory
@@ -12,6 +12,8 @@
 export { vulnerabilityScanTool, executeVulnerabilityScan, } from "./vulnerability-scan.js";
 export { dependencyHealthTool, executeDependencyHealth, } from "./dependency-health.js";
 export { upgradePlannerTool, executeUpgradePlanner, } from "./upgrade-planner.js";
+export { dependencyCheckTool, executeDependencyCheck, } from "./dependency-check.js";
+export { upgradeImpactTool, executeUpgradeImpact, } from "./upgrade-impact.js";
 // Intelligence
 export { whatShouldIKnowTool, executeWhatShouldIKnow, } from "./what-should-i-know.js";
 export { ecosystemPulseTool, executeEcosystemPulse, } from "./ecosystem-pulse.js";