@bicon/mcp-composer 0.16.0 → 0.17.0

package/README.md

@@ -1,7 +1,13 @@
-# BICon Initiative Composer (MCP server)
+# BICon Composer & Analyst (MCP server)
+
+Shown in Claude Desktop as **BICon Composer & Analyst** from the release after 0.16.0 (named BICon Initiative
+Composer until 2026-10-25; the npm package `@bicon/mcp-composer`, the extension
+id (manifest `name`) `bicon-initiative-composer` and the tool names are
+unchanged; only the label changed).
 
 An [MCP](https://modelcontextprotocol.io) server that helps an AI client — e.g.
-Claude Desktop — set up a portfolio initiative conversationally. Creating an
+Claude Desktop — set up a portfolio initiative conversationally, and analyse a
+full portfolio backup read-only (see the analysis tools below). Creating an
 initiative by hand means filling ~15 metadata fields **and rating 30
 sub-dimensions across four scoring dimensions** (plus optional economics and a
 large EU-AI-Act block); this server lets an assistant run that interview and
@@ -177,7 +183,7 @@ double-click, or Claude Desktop → Settings → Extensions → Install. Claude
 Desktop runs the server on its own built-in Node runtime, so there is nothing
 else to install and no configuration file to edit. Then **quit Claude Desktop
 completely and reopen** (see *Stale instances*), start a **new chat** and ask:
-*"Use the BICon Initiative Composer to help me set up a new initiative."*
+*"Use the BICon Composer & Analyst to help me set up a new initiative."*
 
 Why the extension is primary: current Claude Desktop builds manage local MCP
 servers as Desktop Extensions and treat `claude_desktop_config.json` as their

package/dist/index.mjs

@@ -19729,7 +19729,7 @@ function date4(params) {
 }
 
 // src/version.ts
-var COMPOSER_VERSION = true ? "0.16.0" : readPackageVersion();
+var COMPOSER_VERSION = true ? "0.17.0" : readPackageVersion();
 
 // ../../api-zod/src/generated/api.ts
 var HealthCheckResponse = object({
@@ -19989,7 +19989,7 @@ var listSnapshotsResponseInitiativesItemFollowUpsMax = 50;
 var listSnapshotsResponseInitiativesItemQualityFactorsItemStateMax = 5;
 var listSnapshotsResponseInitiativesItemQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var listSnapshotsResponseInitiativesItemQualityFactorsItemNoteMax = 2e3;
-var listSnapshotsResponseInitiativesItemQualityFactorsMax = 7;
+var listSnapshotsResponseInitiativesItemQualityFactorsMax = 8;
 var listSnapshotsResponseInitiativesItemDependsOnMax = 1e3;
 var listSnapshotsResponseInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var listSnapshotsResponseInitiativesItemRequiredSkillsMax = 1e3;
@@ -20229,7 +20229,7 @@ var ListSnapshotsResponseItem = object({
       "note": string2().max(listSnapshotsResponseInitiativesItemFollowUpsItemNoteMax).optional()
     }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(listSnapshotsResponseInitiativesItemFollowUpsMax).optional(),
     "qualityFactors": array(object({
-      "factor": _enum2(["reliability", "security", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+      "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
       "required": _enum2(["low", "medium", "high"]).optional(),
       "state": number2().min(1).max(listSnapshotsResponseInitiativesItemQualityFactorsItemStateMax).optional(),
       "targetDate": string2().regex(listSnapshotsResponseInitiativesItemQualityFactorsItemTargetDateRegExp).optional(),
@@ -20400,7 +20400,7 @@ var createSnapshotBodyInitiativesItemFollowUpsMax = 50;
 var createSnapshotBodyInitiativesItemQualityFactorsItemStateMax = 5;
 var createSnapshotBodyInitiativesItemQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var createSnapshotBodyInitiativesItemQualityFactorsItemNoteMax = 2e3;
-var createSnapshotBodyInitiativesItemQualityFactorsMax = 7;
+var createSnapshotBodyInitiativesItemQualityFactorsMax = 8;
 var createSnapshotBodyInitiativesItemDependsOnMax = 1e3;
 var createSnapshotBodyInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var createSnapshotBodyInitiativesItemRequiredSkillsMax = 1e3;
@@ -20640,7 +20640,7 @@ var CreateSnapshotBody = object({
       "note": string2().max(createSnapshotBodyInitiativesItemFollowUpsItemNoteMax).optional()
     }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(createSnapshotBodyInitiativesItemFollowUpsMax).optional(),
     "qualityFactors": array(object({
-      "factor": _enum2(["reliability", "security", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+      "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
       "required": _enum2(["low", "medium", "high"]).optional(),
       "state": number2().min(1).max(createSnapshotBodyInitiativesItemQualityFactorsItemStateMax).optional(),
       "targetDate": string2().regex(createSnapshotBodyInitiativesItemQualityFactorsItemTargetDateRegExp).optional(),
@@ -20817,7 +20817,7 @@ var renameSnapshotResponseInitiativesItemFollowUpsMax = 50;
 var renameSnapshotResponseInitiativesItemQualityFactorsItemStateMax = 5;
 var renameSnapshotResponseInitiativesItemQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var renameSnapshotResponseInitiativesItemQualityFactorsItemNoteMax = 2e3;
-var renameSnapshotResponseInitiativesItemQualityFactorsMax = 7;
+var renameSnapshotResponseInitiativesItemQualityFactorsMax = 8;
 var renameSnapshotResponseInitiativesItemDependsOnMax = 1e3;
 var renameSnapshotResponseInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var renameSnapshotResponseInitiativesItemRequiredSkillsMax = 1e3;
@@ -21057,7 +21057,7 @@ var RenameSnapshotResponse = object({
       "note": string2().max(renameSnapshotResponseInitiativesItemFollowUpsItemNoteMax).optional()
     }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(renameSnapshotResponseInitiativesItemFollowUpsMax).optional(),
     "qualityFactors": array(object({
-      "factor": _enum2(["reliability", "security", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+      "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
       "required": _enum2(["low", "medium", "high"]).optional(),
       "state": number2().min(1).max(renameSnapshotResponseInitiativesItemQualityFactorsItemStateMax).optional(),
       "targetDate": string2().regex(renameSnapshotResponseInitiativesItemQualityFactorsItemTargetDateRegExp).optional(),
@@ -21229,7 +21229,7 @@ var listInitiativesResponseFollowUpsMax = 50;
 var listInitiativesResponseQualityFactorsItemStateMax = 5;
 var listInitiativesResponseQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var listInitiativesResponseQualityFactorsItemNoteMax = 2e3;
-var listInitiativesResponseQualityFactorsMax = 7;
+var listInitiativesResponseQualityFactorsMax = 8;
 var listInitiativesResponseDependsOnMax = 1e3;
 var listInitiativesResponseRequiredSkillsItemRunFteMin = 0;
 var listInitiativesResponseRequiredSkillsMax = 1e3;
@@ -21463,7 +21463,7 @@ var ListInitiativesResponseItem = object({
     "note": string2().max(listInitiativesResponseFollowUpsItemNoteMax).optional()
   }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(listInitiativesResponseFollowUpsMax).optional(),
   "qualityFactors": array(object({
-    "factor": _enum2(["reliability", "security", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+    "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
     "required": _enum2(["low", "medium", "high"]).optional(),
     "state": number2().min(1).max(listInitiativesResponseQualityFactorsItemStateMax).optional(),
     "targetDate": string2().regex(listInitiativesResponseQualityFactorsItemTargetDateRegExp).optional(),
@@ -21631,7 +21631,7 @@ var createInitiativeBodyOneFollowUpsMax = 50;
 var createInitiativeBodyOneQualityFactorsItemStateMax = 5;
 var createInitiativeBodyOneQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var createInitiativeBodyOneQualityFactorsItemNoteMax = 2e3;
-var createInitiativeBodyOneQualityFactorsMax = 7;
+var createInitiativeBodyOneQualityFactorsMax = 8;
 var createInitiativeBodyOneDependsOnMax = 1e3;
 var createInitiativeBodyOneRequiredSkillsItemRunFteMin = 0;
 var createInitiativeBodyOneRequiredSkillsMax = 1e3;
@@ -21865,7 +21865,7 @@ var CreateInitiativeBody = object({
     "note": string2().max(createInitiativeBodyOneFollowUpsItemNoteMax).optional()
   }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(createInitiativeBodyOneFollowUpsMax).optional(),
   "qualityFactors": array(object({
-    "factor": _enum2(["reliability", "security", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+    "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
     "required": _enum2(["low", "medium", "high"]).optional(),
     "state": number2().min(1).max(createInitiativeBodyOneQualityFactorsItemStateMax).optional(),
     "targetDate": string2().regex(createInitiativeBodyOneQualityFactorsItemTargetDateRegExp).optional(),
@@ -22043,7 +22043,7 @@ var getInitiativeResponseFollowUpsMax = 50;
 var getInitiativeResponseQualityFactorsItemStateMax = 5;
 var getInitiativeResponseQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var getInitiativeResponseQualityFactorsItemNoteMax = 2e3;
-var getInitiativeResponseQualityFactorsMax = 7;
+var getInitiativeResponseQualityFactorsMax = 8;
 var getInitiativeResponseDependsOnMax = 1e3;
 var getInitiativeResponseRequiredSkillsItemRunFteMin = 0;
 var getInitiativeResponseRequiredSkillsMax = 1e3;
@@ -22277,7 +22277,7 @@ var GetInitiativeResponse = object({
     "note": string2().max(getInitiativeResponseFollowUpsItemNoteMax).optional()
   }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(getInitiativeResponseFollowUpsMax).optional(),
   "qualityFactors": array(object({
-    "factor": _enum2(["reliability", "security", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+    "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
     "required": _enum2(["low", "medium", "high"]).optional(),
     "state": number2().min(1).max(getInitiativeResponseQualityFactorsItemStateMax).optional(),
     "targetDate": string2().regex(getInitiativeResponseQualityFactorsItemTargetDateRegExp).optional(),
@@ -22447,7 +22447,7 @@ var updateInitiativeBodyOneFollowUpsMax = 50;
 var updateInitiativeBodyOneQualityFactorsItemStateMax = 5;
 var updateInitiativeBodyOneQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var updateInitiativeBodyOneQualityFactorsItemNoteMax = 2e3;
-var updateInitiativeBodyOneQualityFactorsMax = 7;
+var updateInitiativeBodyOneQualityFactorsMax = 8;
 var updateInitiativeBodyOneDependsOnMax = 1e3;
 var updateInitiativeBodyOneRequiredSkillsItemRunFteMin = 0;
 var updateInitiativeBodyOneRequiredSkillsMax = 1e3;
@@ -22681,7 +22681,7 @@ var UpdateInitiativeBody = object({
     "note": string2().max(updateInitiativeBodyOneFollowUpsItemNoteMax).optional()
   }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(updateInitiativeBodyOneFollowUpsMax).optional(),
   "qualityFactors": array(object({
-    "factor": _enum2(["reliability", "security", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+    "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
     "required": _enum2(["low", "medium", "high"]).optional(),
     "state": number2().min(1).max(updateInitiativeBodyOneQualityFactorsItemStateMax).optional(),
     "targetDate": string2().regex(updateInitiativeBodyOneQualityFactorsItemTargetDateRegExp).optional(),
@@ -22856,7 +22856,7 @@ var updateInitiativeResponseFollowUpsMax = 50;
 var updateInitiativeResponseQualityFactorsItemStateMax = 5;
 var updateInitiativeResponseQualityFactorsItemTargetDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var updateInitiativeResponseQualityFactorsItemNoteMax = 2e3;
-var updateInitiativeResponseQualityFactorsMax = 7;
+var updateInitiativeResponseQualityFactorsMax = 8;
 var updateInitiativeResponseDependsOnMax = 1e3;
 var updateInitiativeResponseRequiredSkillsItemRunFteMin = 0;
 var updateInitiativeResponseRequiredSkillsMax = 1e3;
@@ -23090,7 +23090,7 @@ var UpdateInitiativeResponse = object({
     "note": string2().max(updateInitiativeResponseFollowUpsItemNoteMax).optional()
   }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(updateInitiativeResponseFollowUpsMax).optional(),
   "qualityFactors": array(object({
-    "factor": _enum2(["reliability", "security", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
+    "factor": _enum2(["reliability", "security", "safety", "performance", "usability", "maintainability", "compatibility", "dataQuality"]),
     "required": _enum2(["low", "medium", "high"]).optional(),
     "state": number2().min(1).max(updateInitiativeResponseQualityFactorsItemStateMax).optional(),
     "targetDate": string2().regex(updateInitiativeResponseQualityFactorsItemTargetDateRegExp).optional(),
@@ -23377,6 +23377,7 @@ var MAX_FOLLOW_UPS_PER_INITIATIVE = 50;
 var QUALITY_FACTORS = [
   "reliability",
   "security",
+  "safety",
   "performance",
   "usability",
   "maintainability",
@@ -23719,6 +23720,7 @@ var EN_DIGITAL = {
   // Quality factor help (docs/quality-factors-concept-2026-10-21.md).
   "quality.factor.reliability.help": "Does the service stay up and behave correctly? Availability against the agreed SLA, incident rate, recovery time after an outage, batch and job success.",
   "quality.factor.security.help": "Is the platform protected? Access control and roles, protection of customer data, secure interfaces, pen test or security review done, findings closed.",
+  "quality.factor.safety.help": "Can it cause harm when it fails? Safety-critical processes it touches (payments, physical operations, client advice), fail-safe behaviour and a manual fallback, hazard or impact analysis done, safety incidents.",
   "quality.factor.performance.help": "Is it fast enough at peak load? Page and API response times, throughput at month-end or campaign peaks, headroom to grow.",
   "quality.factor.usability.help": "Can customers and staff use it without help? Task completion, adoption, accessibility, number of support calls.",
   "quality.factor.maintainability.help": "Can the team change and run it safely? Code quality, automated tests and deployment, documentation, technical debt, dependency on single experts.",
@@ -23937,6 +23939,7 @@ var DE_DIGITAL = {
   // Quality factor help (docs/quality-factors-concept-2026-10-21.md).
   "quality.factor.reliability.help": "Bleibt der Dienst verf\xFCgbar und arbeitet korrekt? Verf\xFCgbarkeit gegen\xFCber dem vereinbarten SLA, St\xF6rungsrate, Wiederherstellungszeit nach Ausf\xE4llen, Erfolg von Batches und Jobs.",
   "quality.factor.security.help": "Ist die Plattform gesch\xFCtzt? Zugriffsschutz und Rollen, Schutz der Kundendaten, sichere Schnittstellen, Pentest oder Sicherheitspr\xFCfung erfolgt, Befunde behoben.",
+  "quality.factor.safety.help": "Kann es bei einem Fehler Schaden anrichten? Sicherheitskritische Abl\xE4ufe, die es ber\xFChrt (Zahlungen, physische Abl\xE4ufe, Kundenberatung), ausfallsicheres Verhalten und ein manueller R\xFCckfall, Gef\xE4hrdungs- oder Auswirkungsanalyse erfolgt, Vorf\xE4lle mit Personen- oder Sachschaden.",
   "quality.factor.performance.help": "Ist es bei Spitzenlast schnell genug? Antwortzeiten von Seiten und APIs, Durchsatz am Monatsende oder bei Kampagnen, Reserve f\xFCr Wachstum.",
   "quality.factor.usability.help": "K\xF6nnen Kundinnen, Kunden und Mitarbeitende es ohne Hilfe nutzen? Aufgabenerfolg, Akzeptanz, Barrierefreiheit, Zahl der Supportanfragen.",
   "quality.factor.maintainability.help": "Kann das Team es sicher \xE4ndern und betreiben? Codequalit\xE4t, automatisierte Tests und Deployments, Dokumentation, technische Schulden, Abh\xE4ngigkeit von einzelnen Fachleuten.",
@@ -24209,11 +24212,25 @@ var EN_INNOVATION = {
   // Quality factor help (docs/quality-factors-concept-2026-10-21.md).
   "quality.factor.reliability.help": "Does the prototype or pilot work reliably enough for the next stage? Repeatable results, uptime during the trial, known failure modes.",
   "quality.factor.security.help": "Is what the pilot handles protected? Access to lab and trial data, protection of IP, a security review before real users or data come in.",
+  "quality.factor.safety.help": "Is it safe for the people and the environment it reaches? Hazard and risk analysis (e.g. ISO 14971 for medical devices), safety testing in the trial, adverse events, what must be shown before the next stage.",
   "quality.factor.performance.help": "Will it hold at the next stage's scale? Throughput and cost per unit at pilot volume, a credible path to production volume. Often still Low required before Pilot.",
   "quality.factor.usability.help": "Can the intended users work with it? Feedback from trial users, task success, what must change before roll-out.",
-  "quality.factor.maintainability.help": "Can someone other than the inventors run and change it? Documentation, reproducible build or protocol, technical debt taken on for speed. Often still Low required before Pilot.",
-  "quality.factor.compatibility.help": "Does it fit what it must plug into? Interfaces to lab, production or partner systems, standards, lock-in to a partner.",
-  "quality.factor.dataQuality.help": "Is the data behind the results fit for purpose? Accuracy, completeness and lineage of experimental and trial data (ISO/IEC 25012). The Quality of Evidence slider rates feasibility before delivery; this rates the delivered state."
+  "quality.factor.maintainability.help": "Can the work be handed over? Someone other than the inventors can run and change it: documentation, a reproducible build or protocol, technical debt taken on for speed, no single expert. Often still Low required before Pilot.",
+  "quality.factor.compatibility.help": "Does it fit the operation that takes it over? Interfaces to lab, clinical, production or partner systems and their processes, standards, lock-in to a partner.",
+  "quality.factor.dataQuality.help": "Is the data behind the results fit for purpose? Accuracy, completeness and lineage of experimental and trial data (ISO/IEC 25012). The Quality of Evidence slider rates feasibility before delivery; this rates the delivered state.",
+  // R&D labels for the same factor keys (docs/quality-factors-innovation-concept-2026-10-25.md):
+  // the stored keys stay, so ratings survive a mode switch.
+  "quality.factor.reliability": "Robustness and reproducibility",
+  "quality.factor.security": "Security and IP protection",
+  "quality.factor.safety": "Product safety",
+  "quality.factor.performance": "Scale-up and unit cost",
+  "quality.factor.usability": "User acceptance",
+  "quality.factor.maintainability": "Transferability",
+  "quality.factor.compatibility": "Fit with operations",
+  "quality.factor.dataQuality": "Data and result quality",
+  "evaluate.quality.subtitle": "Is the result solid enough for the next stage? Rate each factor that matters: how much it is required here, and how well the result meets it today. Factors after ISO/IEC 25010, adapted for R&D. The ratings flag gaps; they do not change any score.",
+  "evaluate.quality.notePlaceholder": "e.g. results repeated at 2 sites; transfer protocol v1",
+  "method.qf.what": "Each initiative can rate eight <strong>quality factors</strong> of the result it delivers, after the product-quality model of ISO/IEC 25010:2023, adapted for R&amp;D: robustness and reproducibility, security and IP protection, product safety, scale-up and unit cost, user acceptance, transferability, fit with operations, and data and result quality (ISO/IEC 25012). The factors are the same in every mode; labels and help texts follow the mode, so ratings survive a mode switch."
 };
 var DE_INNOVATION = {
   "brand.app": "BICon Portfolio Steering",
@@ -24481,11 +24498,24 @@ var DE_INNOVATION = {
   // Quality factor help (docs/quality-factors-concept-2026-10-21.md).
   "quality.factor.reliability.help": "Funktioniert der Prototyp oder Pilot zuverl\xE4ssig genug f\xFCr die n\xE4chste Stufe? Wiederholbare Ergebnisse, Verf\xFCgbarkeit w\xE4hrend des Versuchs, bekannte Fehlerbilder.",
   "quality.factor.security.help": "Ist gesch\xFCtzt, was der Pilot verarbeitet? Zugriff auf Labor- und Versuchsdaten, Schutz des geistigen Eigentums, Sicherheitspr\xFCfung, bevor echte Nutzer oder Daten dazukommen.",
+  "quality.factor.safety.help": "Ist es sicher f\xFCr die Menschen und die Umwelt, die es erreicht? Gef\xE4hrdungs- und Risikoanalyse (z. B. ISO 14971 f\xFCr Medizinprodukte), Sicherheitstests im Versuch, unerw\xFCnschte Ereignisse, was vor der n\xE4chsten Stufe nachgewiesen sein muss.",
   "quality.factor.performance.help": "H\xE4lt es im Massstab der n\xE4chsten Stufe? Durchsatz und St\xFCckkosten im Pilotvolumen, ein glaubw\xFCrdiger Weg zum Produktionsvolumen. Vor dem Pilot oft noch niedrig gefordert.",
   "quality.factor.usability.help": "K\xF6nnen die vorgesehenen Nutzerinnen und Nutzer damit arbeiten? R\xFCckmeldungen aus dem Versuch, Aufgabenerfolg, was vor dem Rollout \xE4ndern muss.",
-  "quality.factor.maintainability.help": "Kann jemand ausser den Erfinderinnen und Erfindern es betreiben und \xE4ndern? Dokumentation, reproduzierbarer Aufbau oder reproduzierbares Protokoll, technische Schulden zugunsten der Geschwindigkeit. Vor dem Pilot oft noch niedrig gefordert.",
-  "quality.factor.compatibility.help": "Passt es zu dem, woran es angeschlossen werden muss? Schnittstellen zu Labor-, Produktions- oder Partnersystemen, Standards, Abh\xE4ngigkeit von einem Partner.",
-  "quality.factor.dataQuality.help": "Sind die Daten hinter den Ergebnissen f\xFCr den Zweck geeignet? Richtigkeit, Vollst\xE4ndigkeit und Herkunft der Versuchs- und Testdaten (ISO/IEC 25012). Der Schieberegler Qualit\xE4t der Evidenz bewertet die Machbarkeit vor der Lieferung; hier wird der gelieferte Stand bewertet."
+  "quality.factor.maintainability.help": "L\xE4sst sich die Arbeit \xFCbergeben? Jemand ausser den Erfinderinnen und Erfindern kann das Ergebnis betreiben und \xE4ndern: Dokumentation, reproduzierbarer Aufbau oder reproduzierbares Protokoll, technische Schulden zugunsten der Geschwindigkeit, keine Abh\xE4ngigkeit von einzelnen Fachleuten. Vor dem Pilot oft noch niedrig gefordert.",
+  "quality.factor.compatibility.help": "Passt es in den Betrieb, der es \xFCbernimmt? Schnittstellen zu Labor-, Klinik-, Produktions- oder Partnersystemen und deren Abl\xE4ufen, Standards, Abh\xE4ngigkeit von einem Partner.",
+  "quality.factor.dataQuality.help": "Sind die Daten hinter den Ergebnissen f\xFCr den Zweck geeignet? Richtigkeit, Vollst\xE4ndigkeit und Herkunft der Versuchs- und Testdaten (ISO/IEC 25012). Der Schieberegler Qualit\xE4t der Evidenz bewertet die Machbarkeit vor der Lieferung; hier wird der gelieferte Stand bewertet.",
+  // F&E-Bezeichnungen für dieselben Faktorschlüssel (docs/quality-factors-innovation-concept-2026-10-25.md).
+  "quality.factor.reliability": "Robustheit und Reproduzierbarkeit",
+  "quality.factor.security": "Informationssicherheit und Schutz geistigen Eigentums",
+  "quality.factor.safety": "Produktsicherheit",
+  "quality.factor.performance": "Hochskalierung und St\xFCckkosten",
+  "quality.factor.usability": "Nutzerakzeptanz",
+  "quality.factor.maintainability": "\xDCbertragbarkeit",
+  "quality.factor.compatibility": "Integration in den Betrieb",
+  "quality.factor.dataQuality": "Daten- und Ergebnisqualit\xE4t",
+  "evaluate.quality.subtitle": "Ist das Ergebnis solide genug f\xFCr die n\xE4chste Stufe? Bewerten Sie jeden Faktor, der z\xE4hlt: wie stark er hier gefordert ist und wie gut das Ergebnis ihn heute erf\xFCllt. Faktoren nach ISO/IEC 25010, ausgelegt f\xFCr F&E. Die Bewertung zeigt L\xFCcken; sie ver\xE4ndert keinen Score.",
+  "evaluate.quality.notePlaceholder": "z. B. Ergebnisse an 2 Standorten wiederholt; Transferprotokoll v1",
+  "method.qf.what": "Jede Initiative kann acht <strong>Qualit\xE4tsfaktoren</strong> des gelieferten Ergebnisses bewerten, nach dem Produktqualit\xE4tsmodell der ISO/IEC 25010:2023, f\xFCr F&amp;E ausgelegt: Robustheit und Reproduzierbarkeit, Informationssicherheit und Schutz geistigen Eigentums, Produktsicherheit, Hochskalierung und St\xFCckkosten, Nutzerakzeptanz, \xDCbertragbarkeit, Integration in den Betrieb sowie Daten- und Ergebnisqualit\xE4t (ISO/IEC 25012). Die Faktoren sind in jedem Modus gleich; Bezeichnungen und Hilfetexte folgen dem Modus, die Bewertungen bleiben bei einem Moduswechsel erhalten."
 };
 var DEMO_DIGITAL = {
   "Advisor Copilot": {
@@ -25862,8 +25892,8 @@ var OPTIONAL_SECTIONS = [
   {
     key: "qualityFactors",
     hint: {
-      en: "[{factor, required?, state?, targetDate?, note?}] \u2014 is the delivered solution good enough to run? One row per factor that was rated (after ISO/IEC 25010): reliability (availability, stable output), security, performance (speed, running cost at load), usability, maintainability, compatibility (interfaces, lock-in), dataQuality (the delivered data, not the feasibility slider). required low | medium | high = how much the factor matters here; state 1\u20135 as a whole number (1 unknown or poor, 2 weak, 3 adequate, 4 good, 5 proven in production); targetDate when a gap should be closed; note = evidence or an SLA figure. A gap = required high with state 1\u20132, or required medium with state 1; nothing here changes a score. Ask for the factors that matter once the initiative is at Pilot or later. On an update, send every rating the initiative keeps: the file replaces the list.",
-      de: "[{factor, required?, state?, targetDate?, note?}] \u2014 ist die gelieferte L\xF6sung gut genug f\xFCr den Betrieb? Eine Zeile je bewertetem Faktor (nach ISO/IEC 25010): reliability (Verf\xFCgbarkeit, stabile Ergebnisse), security, performance (Tempo, Betriebskosten unter Last), usability, maintainability, compatibility (Schnittstellen, Anbieterabh\xE4ngigkeit), dataQuality (die gelieferten Daten, nicht der Machbarkeits-Regler). required low | medium | high = wie stark der Faktor hier z\xE4hlt; state 1\u20135 als ganze Zahl (1 unbekannt oder ungen\xFCgend, 2 schwach, 3 ausreichend, 4 gut, 5 im Betrieb bew\xE4hrt); targetDate, bis wann eine L\xFCcke geschlossen sein soll; note = Nachweis oder SLA-Wert. Eine L\xFCcke = gefordert hoch mit Stand 1\u20132 oder gefordert mittel mit Stand 1; nichts davon \xE4ndert einen Score. Ab Pilot nach den Faktoren fragen, die z\xE4hlen. Bei einem Update alle Bewertungen senden, die bleiben sollen: die Datei ersetzt die Liste."
+      en: "[{factor, required?, state?, targetDate?, note?}] \u2014 is the delivered solution good enough to run? One row per factor that was rated (after ISO/IEC 25010): reliability (availability, stable output), security, safety (harm to people or the environment, fail-safe behaviour), performance (speed, running cost at load), usability, maintainability, compatibility (interfaces, lock-in), dataQuality (the delivered data, not the feasibility slider). In an innovation portfolio the app names them for R&D: reliability = robustness and reproducibility, security = security and IP protection, safety = product safety, performance = scale-up and unit cost, usability = user acceptance, maintainability = transferability, compatibility = fit with operations, dataQuality = data and result quality. required low | medium | high = how much the factor matters here; state 1\u20135 as a whole number (1 unknown or poor, 2 weak, 3 adequate, 4 good, 5 proven in production); targetDate when a gap should be closed; note = evidence or an SLA figure. A gap = required high with state 1\u20132, or required medium with state 1; nothing here changes a score. Ask for the factors that matter once the initiative is at Pilot or later. On an update, send every rating the initiative keeps: the file replaces the list.",
+      de: "[{factor, required?, state?, targetDate?, note?}] \u2014 ist die gelieferte L\xF6sung gut genug f\xFCr den Betrieb? Eine Zeile je bewertetem Faktor (nach ISO/IEC 25010): reliability (Verf\xFCgbarkeit, stabile Ergebnisse), security, safety (Schaden f\xFCr Menschen oder Umwelt, ausfallsicheres Verhalten), performance (Tempo, Betriebskosten unter Last), usability, maintainability, compatibility (Schnittstellen, Anbieterabh\xE4ngigkeit), dataQuality (die gelieferten Daten, nicht der Machbarkeits-Regler). In einem Innovationsportfolio nennt die App sie f\xFCr F&E: reliability = Robustheit und Reproduzierbarkeit, security = Informationssicherheit und Schutz geistigen Eigentums, safety = Produktsicherheit, performance = Hochskalierung und St\xFCckkosten, usability = Nutzerakzeptanz, maintainability = \xDCbertragbarkeit, compatibility = Integration in den Betrieb, dataQuality = Daten- und Ergebnisqualit\xE4t. required low | medium | high = wie stark der Faktor hier z\xE4hlt; state 1\u20135 als ganze Zahl (1 unbekannt oder ungen\xFCgend, 2 schwach, 3 ausreichend, 4 gut, 5 im Betrieb bew\xE4hrt); targetDate, bis wann eine L\xFCcke geschlossen sein soll; note = Nachweis oder SLA-Wert. Eine L\xFCcke = gefordert hoch mit Stand 1\u20132 oder gefordert mittel mit Stand 1; nichts davon \xE4ndert einen Score. Ab Pilot nach den Faktoren fragen, die z\xE4hlen. Bei einem Update alle Bewertungen senden, die bleiben sollen: die Datei ersetzt die Liste."
     }
   },
   {
@@ -26147,7 +26177,7 @@ var SECTION_DESCRIPTIONS = {
   milestones: `Milestones (max 30, title \u2264300 chars): baselineDate = the plan, forecastDate = today's expectation (omit = baseline), doneDate = reached. Dates dd/mm/yyyy or yyyy-mm-dd; ids minted \u2014 an id you give (e.g. "m1") is a label a follow-up's milestoneId can point at. An update replaces the list: send all.`,
   risks: `Risks (max 50, title \u2264300 chars): category delivery|vendor|data|people|regulatory|technical|financial; probability and impact 1\u20135 as whole numbers (score = product); status open|mitigating|closed|occurred (occurred = an issue, with occurredDate); residualProbability + residualImpact = the expectation after mitigation (both or neither); owner (free text), mitigation (the plan), raisedDate, reviewDate, note. Dates dd/mm/yyyy or yyyy-mm-dd; ids minted \u2014 an id you give (e.g. "r1") is a label a follow-up's riskId can point at. An update replaces the list: send all.`,
   followUps: "Follow-ups (max 50, title \u2264300 chars): who does what by when \u2014 title, dueDate, assigneeName (free text; assigneeUserId only when the user gives a member id from the app), doneDate once done, note; milestoneId / riskId = the id label of a milestone or risk in THIS spec (the Composer keeps the link when it mints the stored ids). Dates dd/mm/yyyy or yyyy-mm-dd; ids minted. An update replaces the list: send all.",
-  qualityFactors: "Quality factors of the delivered solution (one row per factor, at most 7): factor reliability|security|performance|usability|maintainability|compatibility|dataQuality; required low|medium|high; state 1\u20135 as a whole number (1 unknown or poor \u2026 5 proven in production); targetDate; note (evidence or SLA). Leave out a factor nobody rated. An update replaces the list: send all.",
+  qualityFactors: "Quality factors of the delivered solution (one row per factor, at most 8): factor reliability|security|safety|performance|usability|maintainability|compatibility|dataQuality; required low|medium|high; state 1\u20135 as a whole number (1 unknown or poor \u2026 5 proven in production); targetDate; note (evidence or SLA). Leave out a factor nobody rated. An update replaces the list: send all.",
   requiredSkills: "Required skills [{skillId, fte, runFte?}] \u2014 fte is the build-phase demand, the optional runFte the run-team demand after the planned end (absent = build fte continues, 0 = no run demand). skillId must be the id of a skill that exists in the organisation. With the portfolio context the Composer validates it (read_portfolio_context \u2192 lists.skills gives id + name); without it, leave the list empty and link skills in the app."
 };
 var contextWire = () => external_exports.preprocess(parseIfString, external_exports.union([external_exports.string().regex(/^ctx_[0-9a-f]{16}$/, "a contextId looks like ctx_<16 hex>"), external_exports.object({}).passthrough()]));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bicon/mcp-composer",
-  "version": "0.16.0",
-  "description": "MCP server that helps an AI client compose a valid BICon portfolio initiative and hand it back as an import file (draft-first, no auth, no API calls).",
+  "version": "0.17.0",
+  "description": "BICon Composer & Analyst: MCP server that helps an AI client compose a valid BICon portfolio initiative as an import file, and analyse a full portfolio backup read-only (draft-first, no auth, no API calls).",
   "license": "UNLICENSED",
   "author": "BICon Establishment",
   "homepage": "https://www.bicon.digital",