@cairnkeep/cli 2.8.0 → 2.9.0

package/mcp-memory-server/dist/eval-report.js

@@ -578,6 +578,7 @@ export function renderEvalReport(value) {
         `Cairn evaluation report: ${report.experiment_id}`,
         `status: ${report.status}`,
         `evidence: ${report.evidence.evidence_scope === "offline-framework" ? "framework-only" : "live-evaluation"}`,
+        `MCP tool profile digest: ${report.evidence.mcp_tool_profile_digest ?? "not-recorded"}`,
         "All effects are estimates; small samples, missing intervals, and intervals crossing zero are inconclusive.",
         "",
         "Aggregates",

package/mcp-memory-server/dist/eval-runner.js

@@ -10,6 +10,7 @@ import { canonicalDigest, evalReportSchema, evalReportRuntimeContractDigest, } f
 import { EvalProcessError, runBoundedCommand, runBoundedJsonAdapter, } from "./eval-process.js";
 import { checkpointEvalReport, createEvalReportStore, } from "./eval-report.js";
 import { applyEvalWorkspaceOverlay, cleanupEvalWorkspace, createEvalWorkspace, runTaskPreparation, runTaskVerifier, } from "./eval-workspace.js";
+import { resolveMcpToolProfile } from "./mcp-tool-profile.js";
 const moduleDirectory = dirname(fileURLToPath(import.meta.url));
 const publishedReportSchemaPath = resolve(moduleDirectory, "..", "..", "schemas", "eval-report.schema.json");
 let reportSchemaDigestsCache;
@@ -735,6 +736,7 @@ function initialReport(plan, experimentId, fallbackExperimentKind) {
             package_version: plan.source.kind === "bundled_fake" ? plan.source.package_version : "0.1.0",
             runtime_id: "node-local",
             task_set_digest: plan.task_set_digest,
+            mcp_tool_profile_digest: resolveMcpToolProfile({ projectRoot: process.cwd() }).profile_digest,
             report_digest: canonicalDigest({ experiment_id: experimentId, plan_digest: plan.plan_digest }),
             schema_digests: [...evalReportSchemaDigests()],
             note_snapshot_digests: [],

package/mcp-memory-server/dist/eval-schema.js

@@ -309,6 +309,7 @@ const evidenceProvenanceSchema = z.strictObject({
     package_version: z.string().min(1).max(128),
     runtime_id: identifierSchema,
     task_set_digest: digestSchema,
+    mcp_tool_profile_digest: digestSchema.optional(),
     report_digest: digestSchema,
     schema_digests: z.array(digestSchema).length(2),
     note_snapshot_digests: z.array(digestSchema).max(MAX_TASKS),

package/mcp-memory-server/dist/index.js

@@ -17,6 +17,9 @@ import { EmbeddingCache, cosineSimilarity, embedTexts, getEmbeddingConfig, hashT
 import { computeRepoState, exploreCacheKey, normalizeExploreQuery, readExploreCache, writeExploreCache, } from "./explore-cache.js";
 import { canonicalTagsSchema, isTypedMemoryNodesEnabled, memoryImportEnvelopeSchema, noteNodeSchema, nodeTypeSchema, } from "./node-schema.js";
 import { attachNodeMetadata, applyReviewedTypedNode, commitMemoryImport, createTypedNode, deleteTypedNode, getTypedNode, invalidateReviewedTypedNode, listTypedHistory, planMemoryImport, supersedeTypedNode, } from "./node-store.js";
+import { contextPackHttpEnabled, contextPacksEnabled, listVisibleContext, readVisibleContext, searchVisibleContext } from "./context-pack.js";
+import { metadataForTool } from "./mcp-tool-catalog.js";
+import { profileAllowsTool, resolveMcpToolProfile } from "./mcp-tool-profile.js";
 const MINIMUM_NODE_MAJOR = 22;
 const nodeMajor = Number.parseInt(process.versions.node, 10);
 if (!Number.isInteger(nodeMajor) || nodeMajor < MINIMUM_NODE_MAJOR) {
@@ -822,8 +825,18 @@ function gitToplevel(cwd) {
 // only allows one connected transport per server). All instances share the
 // module-level helpers + AgentFS below. Enables a single long-lived process to
 // serve many concurrent clients within one trusted server-side storage domain.
-function buildMemoryServer(context, capabilitySnapshot, withCapability) {
+function buildMemoryServer(context, capabilitySnapshot, withCapability, toolProfile = resolveMcpToolProfile({ projectRoot: process.cwd() })) {
     const server = new McpServer({ name: "cairn-memory", version: "0.1.0" });
+    const registerTool = (name, config, callback) => {
+        const metadata = metadataForTool(name);
+        if (!profileAllowsTool(toolProfile, name))
+            return;
+        server.registerTool(name, {
+            ...config,
+            title: metadata.title,
+            annotations: metadata.annotations,
+        }, callback);
+    };
     const capabilityEnabled = (id) => capabilitySnapshot?.capabilities.find((state) => state.id === id)?.enabled ?? true;
     const registerCapabilityTool = (id, name, config, callback) => {
         if (!capabilityEnabled(id))
@@ -840,15 +853,22 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
                 },
             }, callback)
             : callback;
-        server.registerTool(name, config, handler);
+        registerTool(name, config, handler);
     };
     const memoryConfig = () => context.memoryConfig ?? getMemoryConfig();
     const scopeOptions = { projectId: context.projectId };
     const typedNodesEnabled = isTypedMemoryNodesEnabled();
     const artifactToolsEnabled = isArtifactStoreEnabled() && (!context.remote || isArtifactHttpEnabled());
+    const contextPackToolsEnabled = contextPacksEnabled() && (!context.remote || contextPackHttpEnabled());
     if (artifactToolsEnabled && context.remote && !context.projectId) {
         throw new ClientContextError("Remote artifact access requires X-Cairn-Project.");
     }
+    if (contextPackToolsEnabled && context.remote && !context.projectId) {
+        throw new ClientContextError("Remote context pack access requires X-Cairn-Project.");
+    }
+    const contextPackProject = context.remote
+        ? { projectId: context.projectId }
+        : { projectRoot: process.cwd() };
     let fallbackArtifactSessionRef;
     const resolveArtifactSessionRef = (sessionRef) => {
         if (sessionRef)
@@ -892,7 +912,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
                 generatedFileInputContentSchema,
             ]),
         }).strict();
-        server.registerTool("artifact_write", {
+        registerTool("artifact_write", {
             description: "Write one bounded inline artifact to the immutable project artifact store.",
             inputSchema: artifactWriteToolSchema,
             annotations: {
@@ -920,7 +940,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
                 structuredContent: payload,
             };
         });
-        server.registerTool("artifact_read", {
+        registerTool("artifact_read", {
             description: "Read one artifact by exact ID or an unambiguous ID prefix.",
             inputSchema: z.object({ artifact_id: artifactIdentifierSchema }).strict(),
             annotations: {
@@ -936,7 +956,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
                 structuredContent: payload,
             };
         });
-        server.registerTool("artifact_list", {
+        registerTool("artifact_list", {
             description: "List artifact metadata newest first with exact filters and opaque pagination.",
             inputSchema: z.object({
                 session_ref: artifactSessionRefSchema.optional(),
@@ -976,7 +996,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
                 structuredContent: payload,
             };
         });
-        server.registerTool("artifact_delete", {
+        registerTool("artifact_delete", {
             description: "Hard-delete one artifact by exact ID or an unambiguous ID prefix.",
             inputSchema: z.object({ artifact_id: artifactIdentifierSchema }).strict(),
             annotations: {
@@ -1013,7 +1033,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
             };
         });
     }
-    server.registerTool("memory_read", {
+    registerTool("memory_read", {
         description: "Read an exact key or search memory entries across AgentFS scopes.",
         // Plain object schema — a .refine() wrapper (ZodEffects) makes the SDK
         // publish an empty JSON Schema, hiding the parameters from clients.
@@ -1151,7 +1171,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
             structuredContent: payload,
         };
     });
-    server.registerTool("memory_list", {
+    registerTool("memory_list", {
         description: "List keys from a scoped AgentFS database.",
         inputSchema: z.object({
             scope: z.string(),
@@ -1189,7 +1209,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
             structuredContent: typedNodesEnabled ? { keys, nodes } : { keys },
         };
     });
-    server.registerTool("memory_delete", {
+    registerTool("memory_delete", {
         description: "Delete a key from a scoped AgentFS database.",
         inputSchema: z.object({
             scope: z.string(),
@@ -1273,7 +1293,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
             structuredContent: payload,
         };
     });
-    server.registerTool("memory_extract", {
+    registerTool("memory_extract", {
         description: "Extract durable memory candidates from a session summary or selected text. Review the returned candidates before writing them.",
         inputSchema: z.object({
             scope: z.string(),
@@ -1294,7 +1314,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
             structuredContent: payload,
         };
     });
-    server.registerTool("memory_supersede", {
+    registerTool("memory_supersede", {
         description: "Preserve the current value of a memory entry in hidden history, then write a new live value to the base key.",
         inputSchema: z.object({
             scope: z.string(),
@@ -1380,7 +1400,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
             await agent.close();
         }
     });
-    server.registerTool("memory_apply_reviewed", {
+    registerTool("memory_apply_reviewed", {
         description: "Idempotently apply a human-reviewed memory revision with durable provenance.",
         inputSchema: z.object({
             scope: z.string(),
@@ -1484,7 +1504,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
             await agent.close();
         }
     });
-    server.registerTool("memory_invalidate_reviewed", {
+    registerTool("memory_invalidate_reviewed", {
         description: "Invalidate a reviewed revision, removing it only when the live value still matches.",
         inputSchema: z.object({
             scope: z.string(),
@@ -1609,7 +1629,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
             await agent.close();
         }
     });
-    server.registerTool("memory_history", {
+    registerTool("memory_history", {
         description: "Read prior versions of a memory entry from the hidden history namespace.",
         inputSchema: z.object({
             scope: z.string(),
@@ -1678,7 +1698,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
         };
     });
     if (typedNodesEnabled) {
-        server.registerTool("memory_import", {
+        registerTool("memory_import", {
             description: "Validate, plan, and atomically import a bounded batch of typed memory nodes.",
             inputSchema: memoryImportEnvelopeSchema,
             annotations: {
@@ -1730,7 +1750,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
             };
         });
     }
-    server.registerTool("domain_knowledge_query", {
+    registerTool("domain_knowledge_query", {
         description: "Query an AnythingLLM workspace in query mode for domain knowledge.",
         inputSchema: z.object({
             workspace: z.string().min(1).optional(),
@@ -1750,7 +1770,7 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
             structuredContent: { workspace: workspaceSlug, answer },
         };
     });
-    server.registerTool("domain_knowledge_sync", {
+    registerTool("domain_knowledge_sync", {
         description: "Upload and embed configured project documentation into an AnythingLLM workspace. Uses anythingllm-projects.json so include/exclude rules are honored. Use mode='replace' with confirm_replace=true when stale workspace docs must be removed before re-embedding.",
         inputSchema: z.object({
             workspace: z.string().min(1).optional(),
@@ -1879,6 +1899,37 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability) {
         const payload = { ok: true, status: body.status, cluster_healthy: body.cluster_healthy ?? null };
         return { content: [{ type: "text", text: asToolText(payload) }], structuredContent: payload };
     });
+    if (contextPackToolsEnabled) {
+        registerTool("context_pack_list", {
+            description: "List documents and explicitly approved skills from context packs enabled for this project.",
+            inputSchema: z.object({}).strict(),
+        }, async () => {
+            const payload = await listVisibleContext(contextPackProject);
+            return { content: [{ type: "text", text: asToolText(payload) }], structuredContent: payload };
+        });
+        registerTool("context_pack_search", {
+            description: "Search documents and explicitly approved skills in context packs enabled for this project.",
+            inputSchema: z.object({
+                query: z.string().min(1).max(4096),
+                limit: z.number().int().min(1).max(100).optional(),
+            }).strict(),
+        }, async ({ query, limit }) => {
+            const payload = await searchVisibleContext(query, { ...contextPackProject, limit });
+            return { content: [{ type: "text", text: asToolText(payload) }], structuredContent: payload };
+        });
+        registerTool("context_pack_read", {
+            description: "Read a bounded UTF-8 range from one enabled context-pack document or approved skill.",
+            inputSchema: z.object({
+                pack: z.string().min(1).max(128),
+                path: z.string().min(1).max(512),
+                offset: z.number().int().min(0).optional(),
+                max_bytes: z.number().int().min(1).max(8192).optional(),
+            }).strict(),
+        }, async ({ pack, path, offset, max_bytes }) => {
+            const payload = await readVisibleContext(pack, path, { ...contextPackProject, offset, maxBytes: max_bytes });
+            return { content: [{ type: "text", text: asToolText(payload) }], structuredContent: payload };
+        });
+    }
     return server;
 }
 function createMemoryServer(context = {}) {

package/mcp-memory-server/dist/mcp-tool-catalog.js

@@ -0,0 +1,47 @@
+const observation = (title, openWorldHint = false) => ({
+    title,
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint },
+});
+const additive = (title, openWorldHint = false) => ({
+    title,
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint },
+});
+const mutation = (title, openWorldHint = false) => ({
+    title,
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint },
+});
+// This is the authoritative MCP catalog. Adding a registered tool without an
+// entry is a startup error, so clients can safely classify every Cairnkeep tool.
+export const MCP_TOOL_CATALOG = {
+    artifact_write: additive("Write artifact"),
+    artifact_read: observation("Read artifact"),
+    artifact_list: observation("List artifacts"),
+    artifact_delete: mutation("Delete artifact"),
+    memory_read: observation("Read memory"),
+    memory_write: mutation("Write memory"),
+    memory_list: observation("List memory"),
+    memory_delete: mutation("Delete memory"),
+    memory_search: observation("Search memory"),
+    memory_extract: observation("Extract memory candidates", true),
+    memory_supersede: mutation("Supersede memory"),
+    memory_apply_reviewed: mutation("Apply reviewed memory"),
+    memory_invalidate_reviewed: mutation("Invalidate reviewed memory"),
+    memory_history: observation("Read memory history"),
+    memory_import: mutation("Import memory"),
+    domain_knowledge_query: observation("Query domain knowledge", true),
+    domain_knowledge_sync: mutation("Synchronize domain knowledge", true),
+    context_explore: observation("Explore repository context", true),
+    route_check: observation("Check route", true),
+    context_pack_list: observation("List context packs"),
+    context_pack_search: observation("Search context packs"),
+    context_pack_read: observation("Read context pack file"),
+};
+export const MCP_TOOL_NAMES = Object.freeze(Object.keys(MCP_TOOL_CATALOG));
+export function isCairnToolName(value) {
+    return Object.hasOwn(MCP_TOOL_CATALOG, value);
+}
+export function metadataForTool(name) {
+    if (!isCairnToolName(name))
+        throw new Error(`MCP tool ${name} has no annotation contract.`);
+    return MCP_TOOL_CATALOG[name];
+}

package/mcp-memory-server/dist/mcp-tool-cli.js

@@ -0,0 +1,85 @@
+import { MCP_TOOL_CATALOG, MCP_TOOL_NAMES } from "./mcp-tool-catalog.js";
+import { resetMcpToolProfile, resolveMcpToolProfile, setMcpToolProfile } from "./mcp-tool-profile.js";
+function usage() {
+    process.stderr.write("Usage: cairn mcp-tools list [--json] | status [--project PATH] [--json] | set full|read-only [--project PATH] | set custom --tool NAME... [--project PATH] | reset [--project PATH]\n");
+    process.exit(2);
+}
+function option(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--"))
+        usage();
+    args.splice(index, 2);
+    return value;
+}
+function flags(args, name) {
+    const values = [];
+    for (let index = 0; index < args.length;) {
+        if (args[index] !== name) {
+            index += 1;
+            continue;
+        }
+        args.splice(index, 1);
+        let consumed = 0;
+        while (index < args.length && !args[index].startsWith("--")) {
+            values.push(args[index]);
+            args.splice(index, 1);
+            consumed += 1;
+        }
+        if (consumed === 0)
+            usage();
+    }
+    return values;
+}
+function output(value, json, human) {
+    process.stdout.write(`${json ? JSON.stringify(value) : human}\n`);
+}
+async function main() {
+    const args = process.argv.slice(2);
+    const command = args.shift();
+    const jsonIndex = args.indexOf("--json");
+    const json = jsonIndex >= 0;
+    if (json)
+        args.splice(jsonIndex, 1);
+    const projectRoot = option(args, "--project") ?? process.cwd();
+    if (command === "list") {
+        if (args.length)
+            usage();
+        const tools = MCP_TOOL_NAMES.map((name) => ({ name, title: MCP_TOOL_CATALOG[name].title, annotations: MCP_TOOL_CATALOG[name].annotations }));
+        output({ schema_version: 1, tools }, json, tools.map(({ name, annotations }) => `${name}\t${annotations.readOnlyHint ? "read-only" : "mutation"}`).join("\n"));
+        return;
+    }
+    if (command === "status") {
+        if (args.length)
+            usage();
+        const status = resolveMcpToolProfile({ projectRoot });
+        output(status, json, `Profile: ${status.mode}\nSource: ${status.source}\nDigest: ${status.profile_digest}\nTools: ${status.allowed_tools.join(", ")}`);
+        return;
+    }
+    if (command === "set") {
+        const mode = args.shift();
+        if (!mode || !["full", "read-only", "custom"].includes(mode))
+            usage();
+        const allowedTools = flags(args, "--tool");
+        if (args.length || (mode === "custom" && allowedTools.length === 0) || (mode !== "custom" && allowedTools.length > 0))
+            usage();
+        const status = await setMcpToolProfile({ projectRoot, mode, allowedTools });
+        output(status, json, `MCP tool profile set to ${mode} (${status.profile_digest}).`);
+        return;
+    }
+    if (command === "reset") {
+        if (args.length)
+            usage();
+        await resetMcpToolProfile(projectRoot);
+        const status = resolveMcpToolProfile({ projectRoot });
+        output(status, json, `Project MCP tool profile reset; effective profile is ${status.mode} from ${status.source}.`);
+        return;
+    }
+    usage();
+}
+main().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});

package/mcp-memory-server/dist/mcp-tool-profile.js

@@ -0,0 +1,162 @@
+import { createHash, randomBytes } from "node:crypto";
+import { closeSync, constants, existsSync, lstatSync, openSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { chmod, mkdir, open, rename, rm } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { MCP_TOOL_CATALOG, MCP_TOOL_NAMES, isCairnToolName } from "./mcp-tool-catalog.js";
+const MAX_CONFIG_BYTES = 64 * 1024;
+function paths(projectRoot) {
+    const root = resolve(projectRoot);
+    const directory = join(root, ".ai");
+    const config = join(directory, "mcp-tools.json");
+    if (dirname(directory) !== root || dirname(config) !== directory)
+        throw new Error("MCP tool profile path is unsafe.");
+    return { root, directory, config };
+}
+function exactAllowed(mode, requested) {
+    if (mode === "full")
+        return [...MCP_TOOL_NAMES];
+    if (mode === "read-only") {
+        return MCP_TOOL_NAMES.filter((name) => MCP_TOOL_CATALOG[name].annotations.readOnlyHint);
+    }
+    const unknown = requested.filter((name) => !isCairnToolName(name));
+    if (unknown.length)
+        throw new Error(`Unknown MCP tool name${unknown.length === 1 ? "" : "s"}: ${unknown.join(", ")}`);
+    if (requested.length === 0)
+        throw new Error("A custom MCP tool profile requires at least one allowed tool.");
+    const selected = new Set(requested);
+    return MCP_TOOL_NAMES.filter((name) => selected.has(name));
+}
+function canonicalProfile(mode, allowed) {
+    return { schema_version: 1, mode, allowed_tools: exactAllowed(mode, allowed) };
+}
+function storedProfile(mode, allowed) {
+    const effective = exactAllowed(mode, allowed);
+    return { schema_version: 1, mode, allowed_tools: mode === "custom" ? effective : [] };
+}
+export function mcpToolProfileDigest(config) {
+    return createHash("sha256").update(JSON.stringify(config), "utf8").digest("hex");
+}
+function parseConfig(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Invalid MCP tool profile configuration.");
+    const row = value;
+    if (Object.keys(row).some((key) => !["schema_version", "mode", "allowed_tools"].includes(key))
+        || row.schema_version !== 1
+        || !["full", "read-only", "custom"].includes(String(row.mode))
+        || !Array.isArray(row.allowed_tools)
+        || row.allowed_tools.some((name) => typeof name !== "string")) {
+        throw new Error("Invalid MCP tool profile configuration.");
+    }
+    const mode = row.mode;
+    const requested = row.allowed_tools;
+    const canonical = storedProfile(mode, requested);
+    if (mode !== "custom" && requested.length > 0)
+        throw new Error("Only custom MCP tool profiles may contain allowed_tools.");
+    if (mode === "custom" && new Set(requested).size !== requested.length)
+        throw new Error("Duplicate MCP tool names are not allowed.");
+    return canonical;
+}
+function readProjectConfig(projectRoot) {
+    const { directory, config } = paths(projectRoot);
+    if (!existsSync(config))
+        return undefined;
+    const dirInfo = lstatSync(directory);
+    const info = lstatSync(config);
+    if (!dirInfo.isDirectory() || dirInfo.isSymbolicLink() || !info.isFile() || info.isSymbolicLink()
+        || info.size > MAX_CONFIG_BYTES || (process.platform !== "win32" && (info.mode & 0o077) !== 0)) {
+        throw new Error("MCP tool profile configuration is unsafe.");
+    }
+    const fd = requireNoFollow(config);
+    try {
+        const bytes = readFileSync(fd);
+        if (bytes.byteLength > MAX_CONFIG_BYTES)
+            throw new Error("MCP tool profile configuration is too large.");
+        return parseConfig(JSON.parse(bytes.toString("utf8")));
+    }
+    finally {
+        // readFileSync does not own numeric descriptors.
+        closeSync(fd);
+    }
+}
+function requireNoFollow(path) {
+    return openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+}
+function environmentConfig(env) {
+    const rawMode = env.CAIRN_MCP_TOOL_PROFILE?.trim();
+    if (!rawMode)
+        return undefined;
+    if (!["full", "read-only", "custom"].includes(rawMode))
+        throw new Error("CAIRN_MCP_TOOL_PROFILE must be full, read-only, or custom.");
+    const allowed = (env.CAIRN_MCP_ALLOWED_TOOLS ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+    if (rawMode !== "custom" && allowed.length)
+        throw new Error("CAIRN_MCP_ALLOWED_TOOLS is valid only with the custom profile.");
+    return storedProfile(rawMode, allowed);
+}
+export function resolveMcpToolProfile(options = {}) {
+    const projectRoot = options.projectRoot ?? process.cwd();
+    const env = options.env ?? process.env;
+    const { root, config } = paths(projectRoot);
+    const environment = environmentConfig(env);
+    const project = environment ? undefined : readProjectConfig(root);
+    const source = environment ? "environment" : project ? "project" : "default";
+    const selected = environment ?? project ?? storedProfile("full", []);
+    const effective = canonicalProfile(selected.mode, selected.allowed_tools);
+    return { ...effective, source, profile_digest: mcpToolProfileDigest(effective), project_root: root, config_path: config, issues: [] };
+}
+async function atomicWrite(path, value) {
+    if (existsSync(dirname(path))) {
+        const existingDirectory = lstatSync(dirname(path));
+        if (!existingDirectory.isDirectory() || existingDirectory.isSymbolicLink())
+            throw new Error("MCP tool profile directory is unsafe.");
+    }
+    else {
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    }
+    const directoryInfo = lstatSync(dirname(path));
+    if (!directoryInfo.isDirectory() || directoryInfo.isSymbolicLink())
+        throw new Error("MCP tool profile directory is unsafe.");
+    if (existsSync(path)) {
+        const existing = lstatSync(path);
+        if (!existing.isFile() || existing.isSymbolicLink())
+            throw new Error("MCP tool profile configuration is unsafe.");
+    }
+    const temporary = join(dirname(path), `.${basename(path)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+    let handle;
+    try {
+        handle = await open(temporary, "wx", 0o600);
+        await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+        await handle.sync();
+        await handle.close();
+        handle = undefined;
+        await chmod(temporary, 0o600);
+        await rename(temporary, path);
+        await chmod(path, 0o600);
+    }
+    finally {
+        if (handle)
+            await handle.close().catch(() => undefined);
+        await rm(temporary, { force: true });
+    }
+}
+export async function setMcpToolProfile(options) {
+    const { root, config } = paths(options.projectRoot ?? process.cwd());
+    const value = storedProfile(options.mode, options.allowedTools ?? []);
+    await atomicWrite(config, value);
+    return resolveMcpToolProfile({ projectRoot: root, env: {} });
+}
+export async function resetMcpToolProfile(projectRoot = process.cwd()) {
+    const { config } = paths(projectRoot);
+    if (!existsSync(config))
+        return;
+    const info = lstatSync(config);
+    if (!info.isFile() || info.isSymbolicLink())
+        throw new Error("MCP tool profile configuration is unsafe.");
+    rmSync(config);
+}
+export function profileAllowsTool(status, name) {
+    return status.allowed_tools.includes(name);
+}
+export function canonicalProjectRoot(projectRoot) {
+    const resolved = resolve(projectRoot);
+    return existsSync(resolved) ? realpathSync(resolved) : resolved;
+}

package/mcp-memory-server/package.json

@@ -46,9 +46,11 @@
         "check:eval-statistics": "node scripts/smoke-eval-statistics.mjs",
         "check:skill-lifecycle": "node scripts/smoke-skill-lifecycle.mjs",
         "check:graph-cli": "node scripts/smoke-graph-cli.mjs",
+        "check:mcp-trust": "node scripts/smoke-mcp-trust.mjs",
+        "check:context-pack": "node scripts/smoke-context-pack.mjs",
         "check:notes": "npm run build && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment",
         "test": "npm run test:smoke",
-        "test:smoke": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:scope-guard && npm run check:http-guard && npm run check:remote-context && npm run check:explore-guard && npm run check:explore-cache && npm run check:explore-crossref && npm run check:route-guard && npm run check:reviewed-memory && npm run check:trajectory-roundtrip && npm run check:trajectory-redaction && npm run check:trajectory-retention && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment && npm run check:node-compat && npm run check:typed-nodes && npm run check:memory-import && npm run check:note-mcp && npm run check:node-doctor && npm run check:artifact-store && npm run check:artifact-mcp && npm run check:compaction-capture && npm run check:capability-contract && npm run check:capability-logging && npm run check:capability-harness && npm run check:capability-mcp && npm run check:eval-schema && npm run check:eval-process && npm run check:eval-statistics && npm run check:skill-lifecycle && npm run check:graph-cli",
+        "test:smoke": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:scope-guard && npm run check:http-guard && npm run check:remote-context && npm run check:explore-guard && npm run check:explore-cache && npm run check:explore-crossref && npm run check:route-guard && npm run check:reviewed-memory && npm run check:trajectory-roundtrip && npm run check:trajectory-redaction && npm run check:trajectory-retention && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment && npm run check:node-compat && npm run check:typed-nodes && npm run check:memory-import && npm run check:note-mcp && npm run check:node-doctor && npm run check:artifact-store && npm run check:artifact-mcp && npm run check:compaction-capture && npm run check:capability-contract && npm run check:capability-logging && npm run check:capability-harness && npm run check:capability-mcp && npm run check:eval-schema && npm run check:eval-process && npm run check:eval-statistics && npm run check:skill-lifecycle && npm run check:graph-cli && npm run check:mcp-trust && npm run check:context-pack",
         "test:search": "npm run build && npm run check:search",
         "test:memory": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:search",
         "test:all": "npm run test:memory"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cairnkeep/cli",
-  "version": "2.8.0",
+  "version": "2.9.0",
   "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
   "license": "Apache-2.0",
   "type": "module",

package/schemas/context-pack.schema.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://raw.githubusercontent.com/cairnkeep/cairnkeep/main/schemas/context-pack.schema.json",
+  "title": "Cairnkeep context pack manifest v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "id", "version", "title", "description", "license", "files"],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "id": { "type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$", "maxLength": 64 },
+    "version": { "type": "string", "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$", "maxLength": 128 },
+    "title": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "description": { "type": "string", "minLength": 1, "maxLength": 2048 },
+    "license": { "type": "string", "minLength": 1, "maxLength": 128 },
+    "files": {
+      "type": "array",
+      "maxItems": 1024,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "kind", "title", "description", "keywords", "sha256"],
+        "properties": {
+          "path": { "type": "string", "minLength": 1, "maxLength": 512 },
+          "kind": { "enum": ["document", "skill"] },
+          "title": { "type": "string", "minLength": 1, "maxLength": 256 },
+          "description": { "type": "string", "maxLength": 2048 },
+          "keywords": { "type": "array", "maxItems": 64, "items": { "type": "string", "minLength": 1, "maxLength": 128 } },
+          "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+        }
+      }
+    }
+  }
+}

package/schemas/eval-report.schema.json

@@ -412,6 +412,7 @@
         "package_version": { "type": "string", "minLength": 1, "maxLength": 128 },
         "runtime_id": { "$ref": "#/$defs/identifier" },
         "task_set_digest": { "$ref": "#/$defs/digest" },
+        "mcp_tool_profile_digest": { "$ref": "#/$defs/digest" },
         "report_digest": { "$ref": "#/$defs/digest" },
         "schema_digests": { "type": "array", "minItems": 2, "maxItems": 2, "items": { "$ref": "#/$defs/digest" } },
         "note_snapshot_digests": { "type": "array", "maxItems": 10000, "items": { "$ref": "#/$defs/digest" } },