@cognium-ai/mcp-server 4.16.4 → 4.17.0

package/dist/tools/find-stale-dependencies.js

@@ -1,177 +0,0 @@
-/**
- * find_stale_dependencies MCP tool (Pillar I, Batch 2).
- *
- * Checks npm dependencies for:
- * 1. Staleness: last publish date via npm registry
- * 2. Known vulnerabilities: via OSV (Open Source Vulnerabilities) API
- *
- * npm package.json only (pypi/cargo/go deferred).
- *
- * @see https://github.com/cogniumhq/cognium-ai/issues/80
- */
-import { z } from 'zod';
-import { dependencyStalenessPass } from 'circle-ir-ai';
-const MAX_FINDINGS = 500;
-const SEVERITY_ORDER = {
-    info: 0,
-    low: 1,
-    medium: 2,
-    high: 3,
-    critical: 4,
-};
-const inputSchema = {
-    code_root: z.string().describe('Absolute path to the code root to scan'),
-    include_dev_deps: z.boolean().optional().default(false).describe('Include devDependencies (default: false)'),
-    severity_floor: z.enum(['info', 'low', 'medium', 'high', 'critical']).optional().default('low').describe('Minimum severity to report (default: low)'),
-    check_vulnerabilities: z.boolean().optional().default(true).describe('Check for known vulnerabilities via OSV database (default: true)'),
-};
-const outputSchema = {
-    findings: z.array(z.object({
-        kind: z.enum(['STALE_DEPENDENCY', 'VULNERABLE_DEPENDENCY']),
-        severity: z.enum(['low', 'medium', 'high', 'critical']),
-        location: z.object({
-            file: z.string(),
-            span: z.tuple([z.number(), z.number()]),
-        }),
-        evidence: z.object({
-            rule_id: z.string(),
-            dependency: z.string(),
-            current_version: z.string(),
-            latest_version: z.string().nullable(),
-            finding_type: z.enum(['staleness', 'maintainer', 'vulnerability']),
-            // Staleness fields
-            days_since_publish: z.number().optional(),
-            last_publish_date: z.string().optional(),
-            // Vulnerability fields
-            vuln_id: z.string().optional(),
-            cve: z.string().optional(),
-            cvss: z.number().optional(),
-            summary: z.string().optional(),
-        }),
-        suggested_action: z.string(),
-    })),
-    summary: z.object({
-        total: z.number(),
-        by_severity: z.object({
-            critical: z.number(),
-            high: z.number(),
-            medium: z.number(),
-            low: z.number(),
-        }),
-        by_finding_type: z.object({
-            staleness: z.number(),
-            maintainer: z.number(),
-            vulnerability: z.number(),
-        }),
-        truncated: z.boolean(),
-    }),
-};
-function trustFindingToMcp(f) {
-    const meta = f.meta;
-    const findingType = meta.findingType ?? 'staleness';
-    const days = meta.daysSincePublish ?? 0;
-    let action = 'Consider updating to the latest version.';
-    let kind = 'STALE_DEPENDENCY';
-    if (findingType === 'vulnerability') {
-        kind = 'VULNERABLE_DEPENDENCY';
-        const cve = meta.cve;
-        const vulnId = meta.vulnId;
-        const cvss = meta.cvss;
-        if (cvss && cvss >= 9.0) {
-            action = `CRITICAL vulnerability ${cve ?? vulnId}. Upgrade immediately or remove this dependency.`;
-        }
-        else if (cvss && cvss >= 7.0) {
-            action = `HIGH severity vulnerability ${cve ?? vulnId}. Upgrade to a patched version as soon as possible.`;
-        }
-        else {
-            action = `Known vulnerability ${cve ?? vulnId}. Upgrade to a patched version when available.`;
-        }
-    }
-    else if (findingType === 'maintainer') {
-        action = 'This package has zero maintainers on npm. High risk of abandonment - find an alternative.';
-    }
-    else if (days > 1095) {
-        action = 'This package has not been updated in over 3 years. Evaluate if it is still maintained or find an alternative.';
-    }
-    else if (days > 730) {
-        action = 'This package has not been updated in over 2 years. Check for security advisories and consider alternatives.';
-    }
-    else if (days > 365) {
-        action = 'This package has not been updated in over 1 year. Monitor for updates.';
-    }
-    return {
-        kind,
-        severity: f.severity === 'info' ? 'low' : f.severity,
-        location: {
-            file: f.location?.file ?? 'package.json',
-            span: [f.location?.line ?? 1, f.location?.line ?? 1],
-        },
-        evidence: {
-            rule_id: f.ruleId,
-            dependency: meta.dependency ?? 'unknown',
-            current_version: meta.currentVersion ?? 'unknown',
-            latest_version: meta.latestVersion ?? null,
-            finding_type: findingType,
-            // Staleness fields (only for staleness findings)
-            ...(findingType === 'staleness' && {
-                days_since_publish: meta.daysSincePublish ?? 0,
-                last_publish_date: meta.lastPublishDate ?? '',
-            }),
-            // Vulnerability fields (only for vulnerability findings)
-            ...(findingType === 'vulnerability' && {
-                vuln_id: meta.vulnId,
-                cve: meta.cve,
-                cvss: meta.cvss,
-                summary: meta.summary,
-            }),
-        },
-        suggested_action: action,
-    };
-}
-export function registerFindStaleDependencies(server) {
-    server.registerTool('find_stale_dependencies', {
-        title: 'Find Stale Dependencies',
-        description: 'Check npm dependencies for staleness and known vulnerabilities. ' +
-            'Staleness: flags packages not updated in >1 year (low), >2 years (medium), >3 years (high). ' +
-            'Vulnerabilities: queries OSV database for CVEs affecting your exact versions. ' +
-            'Also flags packages with zero maintainers. npm package.json only.',
-        inputSchema,
-        outputSchema,
-    }, async ({ code_root, include_dev_deps, severity_floor, check_vulnerabilities }) => {
-        const result = await dependencyStalenessPass(code_root, {
-            includeDevDeps: include_dev_deps,
-            checkVulnerabilities: check_vulnerabilities,
-        });
-        const floorValue = SEVERITY_ORDER[severity_floor ?? 'low'];
-        const filtered = result.findings.filter((f) => SEVERITY_ORDER[f.severity] >= floorValue);
-        const truncated = filtered.length > MAX_FINDINGS;
-        const findings = filtered.slice(0, MAX_FINDINGS).map(trustFindingToMcp);
-        // Count by finding type
-        const stalenessCount = filtered.filter((f) => f.meta?.findingType === 'staleness').length;
-        const maintainerCount = filtered.filter((f) => f.meta?.findingType === 'maintainer').length;
-        const vulnerabilityCount = filtered.filter((f) => f.meta?.findingType === 'vulnerability').length;
-        const output = {
-            findings,
-            summary: {
-                total: filtered.length,
-                by_severity: {
-                    critical: filtered.filter((f) => f.severity === 'critical').length,
-                    high: filtered.filter((f) => f.severity === 'high').length,
-                    medium: filtered.filter((f) => f.severity === 'medium').length,
-                    low: filtered.filter((f) => f.severity === 'low').length,
-                },
-                by_finding_type: {
-                    staleness: stalenessCount,
-                    maintainer: maintainerCount,
-                    vulnerability: vulnerabilityCount,
-                },
-                truncated,
-            },
-        };
-        return {
-            content: [{ type: 'text', text: JSON.stringify(output) }],
-            structuredContent: output,
-        };
-    });
-}
-//# sourceMappingURL=find-stale-dependencies.js.map

package/dist/tools/find-stale-dependencies.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"find-stale-dependencies.js","sourceRoot":"","sources":["../../src/tools/find-stale-dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,uBAAuB,EAAyC,MAAM,cAAc,CAAC;AAE9F,MAAM,YAAY,GAAG,GAAG,CAAC;AAIzB,MAAM,cAAc,GAAkC;IACpD,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACxE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IAC5G,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACrJ,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,kEAAkE,CAAC;CACzI,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QAC3D,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACxC,CAAC;QACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;YAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACrC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;YAClE,mBAAmB;YACnB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACzC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACxC,uBAAuB;YACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC/B,CAAC;QACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;KAC7B,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;QACF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;SAC1B,CAAC;QACF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;KACvB,CAAC;CACH,CAAC;AA0BF,SAAS,iBAAiB,CAAC,CAAe;IACxC,MAAM,IAAI,GAAG,CAAC,CAAC,IAA+B,CAAC;IAC/C,MAAM,WAAW,GAAI,IAAI,CAAC,WAA2B,IAAI,WAAW,CAAC;IACrE,MAAM,IAAI,GAAI,IAAI,CAAC,gBAA2B,IAAI,CAAC,CAAC;IAEpD,IAAI,MAAM,GAAG,0CAA0C,CAAC;IACxD,IAAI,IAAI,GAAiD,kBAAkB,CAAC;IAE5E,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;QACpC,IAAI,GAAG,uBAAuB,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAyB,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAA4B,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAA0B,CAAC;QAC7C,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;YACxB,MAAM,GAAG,0BAA0B,GAAG,IAAI,MAAM,kDAAkD,CAAC;QACrG,CAAC;aAAM,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;YAC/B,MAAM,GAAG,+BAA+B,GAAG,IAAI,MAAM,qDAAqD,CAAC;QAC7G,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,uBAAuB,GAAG,IAAI,MAAM,gDAAgD,CAAC;QAChG,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACxC,MAAM,GAAG,2FAA2F,CAAC;IACvG,CAAC;SAAM,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,+GAA+G,CAAC;IAC3H,CAAC;SAAM,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,6GAA6G,CAAC;IACzH,CAAC;SAAM,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,wEAAwE,CAAC;IACpF,CAAC;IAED,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAkD;QAC9F,QAAQ,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,cAAc;YACxC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;SACrD;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,MAAM;YACjB,UAAU,EAAG,IAAI,CAAC,UAAqB,IAAI,SAAS;YACpD,eAAe,EAAG,IAAI,CAAC,cAAyB,IAAI,SAAS;YAC7D,cAAc,EAAG,IAAI,CAAC,aAAwB,IAAI,IAAI;YACtD,YAAY,EAAE,WAAW;YACzB,iDAAiD;YACjD,GAAG,CAAC,WAAW,KAAK,WAAW,IAAI;gBACjC,kBAAkB,EAAG,IAAI,CAAC,gBAA2B,IAAI,CAAC;gBAC1D,iBAAiB,EAAG,IAAI,CAAC,eAA0B,IAAI,EAAE;aAC1D,CAAC;YACF,yDAAyD;YACzD,GAAG,CAAC,WAAW,KAAK,eAAe,IAAI;gBACrC,OAAO,EAAE,IAAI,CAAC,MAA4B;gBAC1C,GAAG,EAAE,IAAI,CAAC,GAAyB;gBACnC,IAAI,EAAE,IAAI,CAAC,IAA0B;gBACrC,OAAO,EAAE,IAAI,CAAC,OAA6B;aAC5C,CAAC;SACH;QACD,gBAAgB,EAAE,MAAM;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAiB;IAC7D,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,kEAAkE;YAClE,8FAA8F;YAC9F,gFAAgF;YAChF,mEAAmE;QACrE,WAAW;QACX,YAAY;KACb,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,qBAAqB,EAAE,EAAE,EAAE;QAC/E,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE;YACtD,cAAc,EAAE,gBAAgB;YAChC,oBAAoB,EAAE,qBAAqB;SAC5C,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAyB,CAAC,IAAI,UAAU,CACjE,CAAC;QAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAExE,wBAAwB;QACxB,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,IAAgC,EAAE,WAAW,KAAK,WAAW,CACxE,CAAC,MAAM,CAAC;QACT,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,IAAgC,EAAE,WAAW,KAAK,YAAY,CACzE,CAAC,MAAM,CAAC;QACT,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,IAAgC,EAAE,WAAW,KAAK,eAAe,CAC5E,CAAC,MAAM,CAAC;QAET,MAAM,MAAM,GAAG;YACb,QAAQ;YACR,OAAO,EAAE;gBACP,KAAK,EAAE,QAAQ,CAAC,MAAM;gBACtB,WAAW,EAAE;oBACX,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;oBAClE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;oBAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;oBAC9D,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;iBACzD;gBACD,eAAe,EAAE;oBACf,SAAS,EAAE,cAAc;oBACzB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,kBAAkB;iBAClC;gBACD,SAAS;aACV;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/find-typosquats.d.ts

@@ -1,11 +0,0 @@
-/**
- * find_typosquats MCP tool (Pillar I, Batch 2).
- *
- * Detects potential typosquat packages by comparing dependency names
- * against popular npm packages using Levenshtein distance.
- *
- * @see https://github.com/cogniumhq/cognium-ai/issues/80
- */
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerFindTyposquats(server: McpServer): void;
-//# sourceMappingURL=find-typosquats.d.ts.map

package/dist/tools/find-typosquats.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"find-typosquats.d.ts","sourceRoot":"","sources":["../../src/tools/find-typosquats.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgHzE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA2D9D"}

package/dist/tools/find-typosquats.js

@@ -1,141 +0,0 @@
-/**
- * find_typosquats MCP tool (Pillar I, Batch 2).
- *
- * Detects potential typosquat packages by comparing dependency names
- * against popular npm packages using Levenshtein distance.
- *
- * @see https://github.com/cogniumhq/cognium-ai/issues/80
- */
-import { z } from 'zod';
-import { typosquatDetectionPass } from 'circle-ir-ai';
-const MAX_FINDINGS = 500;
-const SEVERITY_ORDER = {
-    info: 0,
-    low: 1,
-    medium: 2,
-    high: 3,
-    critical: 4,
-};
-const inputSchema = {
-    code_root: z.string().describe('Absolute path to the code root to scan'),
-    include_dev_deps: z.boolean().optional().default(false).describe('Include devDependencies (default: false)'),
-    severity_floor: z.enum(['info', 'low', 'medium', 'high', 'critical']).optional().default('low').describe('Minimum severity to report (default: low)'),
-    check_homoglyphs: z.boolean().optional().default(true).describe('Detect homoglyph attacks like "rn" vs "m" (default: true)'),
-    check_popularity: z.boolean().optional().default(false).describe('Query npm for download counts (slower, default: false)'),
-};
-const outputSchema = {
-    findings: z.array(z.object({
-        kind: z.literal('TYPOSQUAT_RISK'),
-        severity: z.enum(['medium', 'high']),
-        location: z.object({
-            file: z.string(),
-            span: z.tuple([z.number(), z.number()]),
-        }),
-        evidence: z.object({
-            rule_id: z.string(),
-            dependency: z.string(),
-            similar_to: z.string(),
-            detection_method: z.enum(['levenshtein', 'homoglyph']),
-            distance: z.number().optional(),
-            homoglyph: z.string().optional(),
-            target_downloads: z.number().optional(),
-        }),
-        suggested_action: z.string(),
-    })),
-    summary: z.object({
-        total: z.number(),
-        by_severity: z.object({
-            critical: z.number(),
-            high: z.number(),
-            medium: z.number(),
-            low: z.number(),
-        }),
-        by_detection_method: z.object({
-            levenshtein: z.number(),
-            homoglyph: z.number(),
-        }),
-        truncated: z.boolean(),
-    }),
-};
-function trustFindingToMcp(f) {
-    const meta = f.meta;
-    const dependency = meta.dependency ?? 'unknown';
-    const similarTo = meta.similarTo ?? 'unknown';
-    const detectionMethod = meta.detectionMethod ?? 'levenshtein';
-    const distance = meta.distance;
-    const homoglyph = meta.homoglyph;
-    const targetDownloads = meta.targetDownloads;
-    let action;
-    if (detectionMethod === 'homoglyph') {
-        action = `"${dependency}" uses visual deception (${homoglyph}) to mimic "${similarTo}". This is a high-confidence typosquat attack. Remove immediately.`;
-    }
-    else if (distance === 1) {
-        action = `"${dependency}" is 1 character away from "${similarTo}". Verify this is intentional and not a typosquat attack.`;
-    }
-    else {
-        action = `"${dependency}" is similar to "${similarTo}". Verify this is the intended package.`;
-    }
-    return {
-        kind: 'TYPOSQUAT_RISK',
-        severity: f.severity === 'high' ? 'high' : 'medium',
-        location: {
-            file: f.location?.file ?? 'package.json',
-            span: [f.location?.line ?? 1, f.location?.line ?? 1],
-        },
-        evidence: {
-            rule_id: f.ruleId,
-            dependency,
-            similar_to: similarTo,
-            detection_method: detectionMethod,
-            ...(distance !== undefined && { distance }),
-            ...(homoglyph && { homoglyph }),
-            ...(targetDownloads !== undefined && { target_downloads: targetDownloads }),
-        },
-        suggested_action: action,
-    };
-}
-export function registerFindTyposquats(server) {
-    server.registerTool('find_typosquats', {
-        title: 'Find Typosquats',
-        description: 'Detect potential typosquat packages using Levenshtein distance and homoglyph detection. ' +
-            'Homoglyph attacks use visual deception (e.g., "rn" looks like "m", "1" looks like "l"). ' +
-            'Protects against attacks like "lodahs" (typo) or "rnaterial-ui" (homoglyph for "material-ui").',
-        inputSchema,
-        outputSchema,
-    }, async ({ code_root, include_dev_deps, severity_floor, check_homoglyphs, check_popularity }) => {
-        const result = await typosquatDetectionPass(code_root, {
-            includeDevDeps: include_dev_deps,
-            checkHomoglyphs: check_homoglyphs,
-            checkPopularity: check_popularity,
-        });
-        const floorValue = SEVERITY_ORDER[severity_floor ?? 'low'];
-        const filtered = result.findings.filter((f) => SEVERITY_ORDER[f.severity] >= floorValue);
-        const truncated = filtered.length > MAX_FINDINGS;
-        const findings = filtered.slice(0, MAX_FINDINGS).map(trustFindingToMcp);
-        // Count by detection method
-        const levenshteinCount = filtered.filter((f) => f.meta?.detectionMethod === 'levenshtein').length;
-        const homoglyphCount = filtered.filter((f) => f.meta?.detectionMethod === 'homoglyph').length;
-        const output = {
-            findings,
-            summary: {
-                total: filtered.length,
-                by_severity: {
-                    critical: filtered.filter((f) => f.severity === 'critical').length,
-                    high: filtered.filter((f) => f.severity === 'high').length,
-                    medium: filtered.filter((f) => f.severity === 'medium').length,
-                    low: filtered.filter((f) => f.severity === 'low').length,
-                },
-                by_detection_method: {
-                    levenshtein: levenshteinCount,
-                    homoglyph: homoglyphCount,
-                },
-                truncated,
-            },
-        };
-        return {
-            content: [{ type: 'text', text: JSON.stringify(output) }],
-            structuredContent: output,
-        };
-    });
-}
-//# sourceMappingURL=find-typosquats.js.map

package/dist/tools/find-typosquats.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"find-typosquats.js","sourceRoot":"","sources":["../../src/tools/find-typosquats.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,sBAAsB,EAAyC,MAAM,cAAc,CAAC;AAE7F,MAAM,YAAY,GAAG,GAAG,CAAC;AAIzB,MAAM,cAAc,GAAkC;IACpD,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACxE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IAC5G,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACrJ,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,2DAA2D,CAAC;IAC5H,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,wDAAwD,CAAC;CAC3H,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACxC,CAAC;QACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACxC,CAAC;QACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;KAC7B,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;QACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC;YAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;SACtB,CAAC;QACF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;KACvB,CAAC;CACH,CAAC;AAkBF,SAAS,iBAAiB,CAAC,CAAe;IACxC,MAAM,IAAI,GAAG,CAAC,CAAC,IAA+B,CAAC;IAC/C,MAAM,UAAU,GAAI,IAAI,CAAC,UAAqB,IAAI,SAAS,CAAC;IAC5D,MAAM,SAAS,GAAI,IAAI,CAAC,SAAoB,IAAI,SAAS,CAAC;IAC1D,MAAM,eAAe,GAAI,IAAI,CAAC,eAA+C,IAAI,aAAa,CAAC;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA8B,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAA+B,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAqC,CAAC;IAEnE,IAAI,MAAc,CAAC;IACnB,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;QACpC,MAAM,GAAG,IAAI,UAAU,4BAA4B,SAAS,eAAe,SAAS,oEAAoE,CAAC;IAC3J,CAAC;SAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,IAAI,UAAU,+BAA+B,SAAS,2DAA2D,CAAC;IAC7H,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,IAAI,UAAU,oBAAoB,SAAS,yCAAyC,CAAC;IAChG,CAAC;IAED,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QACnD,QAAQ,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,cAAc;YACxC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;SACrD;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,MAAM;YACjB,UAAU;YACV,UAAU,EAAE,SAAS;YACrB,gBAAgB,EAAE,eAAe;YACjC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;SAC5E;QACD,gBAAgB,EAAE,MAAM;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAiB;IACtD,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,0FAA0F;YAC1F,0FAA0F;YAC1F,gGAAgG;QAClG,WAAW;QACX,YAAY;KACb,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,EAAE,EAAE;QAC5F,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE;YACrD,cAAc,EAAE,gBAAgB;YAChC,eAAe,EAAE,gBAAgB;YACjC,eAAe,EAAE,gBAAgB;SAClC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAyB,CAAC,IAAI,UAAU,CACjE,CAAC;QAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAExE,4BAA4B;QAC5B,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,IAAgC,EAAE,eAAe,KAAK,aAAa,CAC9E,CAAC,MAAM,CAAC;QACT,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,IAAgC,EAAE,eAAe,KAAK,WAAW,CAC5E,CAAC,MAAM,CAAC;QAET,MAAM,MAAM,GAAG;YACb,QAAQ;YACR,OAAO,EAAE;gBACP,KAAK,EAAE,QAAQ,CAAC,MAAM;gBACtB,WAAW,EAAE;oBACX,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;oBAClE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;oBAC1D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;oBAC9D,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;iBACzD;gBACD,mBAAmB,EAAE;oBACnB,WAAW,EAAE,gBAAgB;oBAC7B,SAAS,EAAE,cAAc;iBAC1B;gBACD,SAAS;aACV;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/layer-bom.d.ts

@@ -1,15 +0,0 @@
-/**
- * layer_bom MCP tool (Conformis inventory primitive).
- *
- * Exposes the circle-ir-ai layer-BOM engine op — a 9-layer component inventory
- * (L2 Runtime … L8 Integration/API) with the dependency BOM sorted into
- * protocol/framework/data usage layers and a usage index (which of the repo's
- * own files import each). This is an *engine primitive* (like verify_spec_
- * conformance), not the Conformis campaign runner — the plan (conformis-
- * execution-plan.md §7) explicitly exposes `bom` via CLI + /api/bom + MCP.
- *
- * @see https://github.com/cogniumhq/cognium-ai (Conformis A3-S2)
- */
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerLayerBom(server: McpServer): void;
-//# sourceMappingURL=layer-bom.d.ts.map

package/dist/tools/layer-bom.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"layer-bom.d.ts","sourceRoot":"","sources":["../../src/tools/layer-bom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAuEzE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwBxD"}

package/dist/tools/layer-bom.js

@@ -1,98 +0,0 @@
-/**
- * layer_bom MCP tool (Conformis inventory primitive).
- *
- * Exposes the circle-ir-ai layer-BOM engine op — a 9-layer component inventory
- * (L2 Runtime … L8 Integration/API) with the dependency BOM sorted into
- * protocol/framework/data usage layers and a usage index (which of the repo's
- * own files import each). This is an *engine primitive* (like verify_spec_
- * conformance), not the Conformis campaign runner — the plan (conformis-
- * execution-plan.md §7) explicitly exposes `bom` via CLI + /api/bom + MCP.
- *
- * @see https://github.com/cogniumhq/cognium-ai (Conformis A3-S2)
- */
-import { z } from 'zod';
-import { generateBom } from 'circle-ir-ai';
-const inputSchema = {
-    code_root: z.string().describe('Absolute path to the repo root to inventory'),
-    usage: z.boolean().optional().default(true).describe('Build the usage index (import-site scan per classified component). Set false for a faster inventory-only BOM (default: true)'),
-};
-const componentSchema = z.object({
-    name: z.string(),
-    version: z.string().optional(),
-    layer: z.string(),
-    kind: z.string(),
-    ecosystem: z.string().optional(),
-    source: z.string(),
-    path: z.string().optional(),
-    direct: z.boolean().optional(),
-    usage_count: z.number().optional(),
-});
-const outputSchema = {
-    target: z.string(),
-    languages: z.array(z.string()),
-    layers: z.array(z.object({
-        layer: z.string(),
-        title: z.string(),
-        component_count: z.number(),
-        components: z.array(componentSchema),
-    })),
-    meta: z.object({
-        total_dependencies: z.number(),
-        total_components: z.number(),
-        populated_layers: z.array(z.string()),
-    }),
-};
-const LAYER_ORDER = ['L2', 'L3', 'L4', 'L5', 'L6', 'L7', 'L8', 'L9'];
-const MAX_COMPONENTS_PER_LAYER = 500;
-/** Map the RepoBom to a lean MCP output (drops verbose usageSites/usageIndex). */
-function toOutput(bom) {
-    return {
-        target: bom.target,
-        languages: bom.languages,
-        layers: LAYER_ORDER.map((l) => {
-            const lb = bom.layers[l];
-            return {
-                layer: l,
-                title: lb.title,
-                component_count: lb.components.length,
-                components: lb.components.slice(0, MAX_COMPONENTS_PER_LAYER).map((c) => ({
-                    name: c.name,
-                    version: c.version,
-                    layer: c.layer,
-                    kind: c.kind,
-                    ecosystem: c.ecosystem,
-                    source: c.source,
-                    path: c.path,
-                    direct: c.direct,
-                    usage_count: c.usageCount,
-                })),
-            };
-        }).filter((l) => l.component_count > 0),
-        meta: {
-            total_dependencies: bom.meta.totalDependencies,
-            total_components: bom.meta.totalComponents,
-            populated_layers: bom.meta.populatedLayers,
-        },
-    };
-}
-export function registerLayerBom(server) {
-    server.registerTool('layer_bom', {
-        title: 'Layer-BOM (9-layer inventory)',
-        description: 'Inventory a repo across the 9 canonical layers: L2 Runtime, L3 Protocols ' +
-            '(JWT/OAuth/gRPC/GraphQL/HTTP), L4 Supply-chain (direct + transitive deps), ' +
-            'L5 Framework (React/Expo/Spring/Django…), L6 Platform/Toolchain (Dockerfile/CI), ' +
-            'L7 Data (ORMs/drivers), L8 Integration/API (OpenAPI/GraphQL/proto specs). ' +
-            'Returns per-layer components plus a usage index (which of the repo\'s files ' +
-            'import each classified component). The Conformis inventory primitive.',
-        inputSchema,
-        outputSchema,
-    }, async ({ code_root, usage }) => {
-        const bom = await generateBom(code_root, { usage });
-        const output = toOutput(bom);
-        return {
-            content: [{ type: 'text', text: JSON.stringify(output) }],
-            structuredContent: output,
-        };
-    });
-}
-//# sourceMappingURL=layer-bom.js.map

package/dist/tools/layer-bom.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"layer-bom.js","sourceRoot":"","sources":["../../src/tools/layer-bom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAgB,MAAM,cAAc,CAAC;AAEzD,MAAM,WAAW,GAAG;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IAC7E,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,8HAA8H,CAAC;CACrL,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;QAC3B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;KACrC,CAAC,CAAC;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC9B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AAC9E,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,kFAAkF;AAClF,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5B,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO;gBACL,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,EAAE,CAAC,KAAK;gBACf,eAAe,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM;gBACrC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACvE,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,WAAW,EAAE,CAAC,CAAC,UAAU;iBAC1B,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC;QACvC,IAAI,EAAE;YACJ,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB;YAC9C,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;YAC1C,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;SAC3C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAChD,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,2EAA2E;YAC3E,6EAA6E;YAC7E,mFAAmF;YACnF,4EAA4E;YAC5E,8EAA8E;YAC9E,uEAAuE;QACzE,WAAW;QACX,YAAY;KACb,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,iBAAiB,EAAE,MAA4C;SAChE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/verify-spec-conformance.d.ts

@@ -1,9 +0,0 @@
-/**
- * `verify_spec_conformance` MCP tool.
- *
- * Runs spec-gap analysis over a code root against a Specifica spec directory
- * and reports an alignment score plus per-requirement coverage status.
- */
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerVerifySpecConformance(server: McpServer): void;
-//# sourceMappingURL=verify-spec-conformance.d.ts.map

package/dist/tools/verify-spec-conformance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify-spec-conformance.d.ts","sourceRoot":"","sources":["../../src/tools/verify-spec-conformance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA8BzE,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAsBrE"}

package/dist/tools/verify-spec-conformance.js

@@ -1,49 +0,0 @@
-/**
- * `verify_spec_conformance` MCP tool.
- *
- * Runs spec-gap analysis over a code root against a Specifica spec directory
- * and reports an alignment score plus per-requirement coverage status.
- */
-import { z } from 'zod';
-import { analyzeSpecGap } from 'circle-ir-ai';
-import { loadCircleIR } from '../analysis.js';
-import { toVerifyConformance } from '../mappers.js';
-const inputSchema = {
-    spec_dir: z.string().describe('Path to the .specifica/ directory containing spec.md'),
-    code_root: z.string().describe('Path to the code root to analyze'),
-};
-const evidenceSchema = z
-    .object({
-    function: z.string().optional(),
-    file: z.string().optional(),
-    span: z.tuple([z.number(), z.number()]).optional(),
-})
-    .passthrough();
-const outputSchema = {
-    alignment_score: z.number(),
-    requirements: z.array(z.object({
-        id: z.string(),
-        status: z.enum(['covered', 'partial', 'uncovered']),
-        evidence: evidenceSchema,
-    })),
-    summary: z.string(),
-};
-export function registerVerifySpecConformance(server) {
-    server.registerTool('verify_spec_conformance', {
-        title: 'Verify Spec Conformance',
-        description: 'Analyze how well code conforms to its Specifica spec. Returns an ' +
-            'alignment score (0-100) and per-requirement coverage status ' +
-            '(covered/partial/uncovered). "partial" = matched with confidence < 0.7.',
-        inputSchema,
-        outputSchema,
-    }, async ({ spec_dir, code_root }) => {
-        const { codePath, results } = await loadCircleIR(code_root);
-        const specGap = await analyzeSpecGap(codePath, results, { specDir: spec_dir });
-        const payload = toVerifyConformance(specGap);
-        return {
-            content: [{ type: 'text', text: JSON.stringify(payload) }],
-            structuredContent: payload,
-        };
-    });
-}
-//# sourceMappingURL=verify-spec-conformance.js.map

package/dist/tools/verify-spec-conformance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify-spec-conformance.js","sourceRoot":"","sources":["../../src/tools/verify-spec-conformance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,GAAG;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;CACnE,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,YAAY,GAAG;IACnB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,KAAK,CACnB,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACnD,QAAQ,EAAE,cAAc;KACzB,CAAC,CACH;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;AAEF,MAAM,UAAU,6BAA6B,CAAC,MAAiB;IAC7D,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,mEAAmE;YACnE,8DAA8D;YAC9D,yEAAyE;QAC3E,WAAW;QACX,YAAY;KACb,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;QAChC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,iBAAiB,EAAE,OAA6C;SACjE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/walk.d.ts

@@ -1,33 +0,0 @@
-/**
- * File walker for the MCP server.
- *
- * Recursively collects files under a root directory, applying default and
- * caller-supplied exclude globs via `minimatch` (per the repo convention of
- * never hand-rolling glob translation). Language detection is delegated to
- * circle-ir's `detectLanguage`.
- */
-import { type SupportedLanguage } from 'circle-ir';
-/** Directories/patterns excluded by default for every walk. */
-export declare const DEFAULT_EXCLUDES: string[];
-export interface WalkOptions {
-    /** Additional exclude globs (matched against the path relative to root). */
-    exclude?: string[];
-    /** Hard cap on number of files returned. Default 5000. */
-    maxFiles?: number;
-    /** Skip files larger than this many bytes. Default 1 MiB. */
-    maxFileBytes?: number;
-}
-export interface WalkedFile {
-    /** Absolute path. */
-    absolutePath: string;
-    /** Path relative to the walk root (used for matching/snippets). */
-    relativePath: string;
-}
-export interface SourceFile extends WalkedFile {
-    language: SupportedLanguage;
-}
-/** Walk all (non-excluded, size-bounded) files under `root`. */
-export declare function walkFiles(root: string, options?: WalkOptions): WalkedFile[];
-/** Walk and keep only files whose language circle-ir can detect. */
-export declare function collectSourceFiles(root: string, options?: WalkOptions): SourceFile[];
-//# sourceMappingURL=walk.d.ts.map

package/dist/walk.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnE,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,UAS5B,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,qBAAqB;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,UAAU,EAAE,CA6C/E;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,UAAU,EAAE,CAUxF"}