@cognium-ai/mcp-server 4.16.5 → 4.17.1

package/README.md

@@ -1,282 +1,52 @@
 # @cognium-ai/mcp-server
 
-An [MCP](https://modelcontextprotocol.io) server exposing Cognium's security
-scanning and spec-conformance tools over **stdio**. Backed by the
-[`circle-ir-ai`](https://www.npmjs.com/package/circle-ir-ai) engine.
+> **Deprecated — this is the last release.** This package is now a shim over
+> [`@cognium/mcp-server`](https://www.npmjs.com/package/@cognium/mcp-server), the one Cognium MCP
+> server. Move to it when you can; this shim keeps an existing install working meanwhile.
 
-## Tools Overview
-
-| Tool | Category | Description |
-|------|----------|-------------|
-| `find_credential_exposure` | Pillar I | Detect hardcoded secrets (AWS, GitHub, OpenAI, etc.) |
-| `check_license_compliance` | Pillar I | Flag copyleft licenses in dependencies |
-| `find_stale_dependencies` | Pillar I | Check npm registry for outdated packages |
-| `find_install_script_risk` | Pillar I | Detect malicious install script patterns |
-| `find_typosquats` | Pillar I | Detect typosquat package names |
-| `find_excessive_permissions` | Pillar I | Audit MCP config permissions |
-| `verify_spec_conformance` | Spec | Analyze code-to-spec alignment |
-| `find_spec_drift` | Spec | Report spec/code drift |
-| `find_pattern` | Utility | Regex search over code |
-
-## Install & run
+## Moving off the shim
 
 ```bash
-npm install -g @cognium-ai/mcp-server
-cognium-mcp          # speaks MCP JSON-RPC over stdin/stdout
+npm install -g @cognium/mcp-server circle-ir-ai
+mcp-server-cognium-dev          # speaks MCP JSON-RPC over stdin/stdout
 ```
 
-Or wire it into an MCP client config:
+Or in an MCP client config:
 
 ```json
 {
   "mcpServers": {
     "cognium": {
       "command": "npx",
-      "args": ["-y", "@cognium-ai/mcp-server"]
+      "args": ["-y", "-p", "@cognium/mcp-server", "-p", "circle-ir-ai", "mcp-server-cognium-dev"]
     }
   }
 }
 ```
 
-Inspect it interactively:
-
-```bash
-npx @modelcontextprotocol/inspector cognium-mcp
-```
-
-## Pillar I Security Tools
-
-All Pillar I tools return a common envelope:
-
-```jsonc
-{
-  "findings": [{ "kind": "...", "severity": "...", "location": {...}, "evidence": {...}, "suggested_action": "..." }],
-  "summary": { "total": N, "by_severity": {...}, "truncated": false }
-}
-```
-
-- `location.span` is **1-indexed line numbers** `[start_line, end_line]`
-- All tools accept `severity_floor` to filter results
-
-### `find_credential_exposure`
-
-Detect hardcoded secrets using SAST pattern matching.
-
-| Input | Type | Description |
-|-------|------|-------------|
-| `code_root` | string | Absolute path to scan |
-| `include_git_history` | boolean | Scan git history (default: false) |
-| `severity_floor` | enum | Minimum severity: info/low/medium/high/critical |
-
-**Evidence:** `rule_id`, `match_snippet` (redacted), `confidence`
-
-### `check_license_compliance`
-
-Flag copyleft licenses in npm/Cargo dependencies.
-
-| Input | Type | Description |
-|-------|------|-------------|
-| `code_root` | string | Absolute path to scan |
-| `include_dev_deps` | boolean | Include devDependencies (default: false) |
-| `severity_floor` | enum | Minimum severity |
-
-**Severity:** AGPL/SSPL=critical, GPL=high, LGPL/MPL=medium, EUPL/CPAL=low
-
-### `find_stale_dependencies`
-
-Check npm dependencies for staleness and known vulnerabilities.
-
-| Input | Type | Description |
-|-------|------|-------------|
-| `code_root` | string | Absolute path to scan |
-| `include_dev_deps` | boolean | Include devDependencies (default: false) |
-| `severity_floor` | enum | Minimum severity |
-| `check_vulnerabilities` | boolean | Query OSV for CVEs (default: true) |
-
-**Staleness severity:** >3 years=high, >2 years=medium, >1 year=low
-
-**Vulnerability severity:** CVSS ≥9.0=critical, ≥7.0=high, ≥4.0=medium, <4.0=low
-
-**Evidence:**
-- Staleness: `dependency`, `current_version`, `latest_version`, `days_since_publish`, `last_publish_date`
-- Vulnerability: `dependency`, `current_version`, `vuln_id`, `cve`, `cvss`, `summary`
-
-### `find_install_script_risk`
-
-Detect malicious patterns in npm lifecycle scripts (preinstall, postinstall, etc.).
-
-| Input | Type | Description |
-|-------|------|-------------|
-| `code_root` | string | Absolute path to scan |
-| `severity_floor` | enum | Minimum severity |
-
-**Rules:** piped downloads (critical), eval/exec (critical), base64 decode (high), env exfiltration (high), network downloads (medium), hidden file writes (medium)
-
-### `find_typosquats`
-
-Detect typosquat package names using Levenshtein distance and homoglyph detection.
-
-| Input | Type | Description |
-|-------|------|-------------|
-| `code_root` | string | Absolute path to scan |
-| `include_dev_deps` | boolean | Include devDependencies (default: false) |
-| `severity_floor` | enum | Minimum severity |
-| `check_homoglyphs` | boolean | Detect visual deception attacks (default: true) |
-| `check_popularity` | boolean | Query npm for download counts (default: false) |
-
-**Detection methods:**
-- **Levenshtein:** distance=1 is high, distance=2 is medium
-- **Homoglyph:** detects visual deception (`rn`→`m`, `1`→`l`, `0`→`o`, etc.) - always high severity
-
-**Evidence:** `dependency`, `similar_to`, `detection_method`, `distance`, `homoglyph`, `target_downloads`
-
-### `find_excessive_permissions`
-
-Audit MCP server configurations for overly broad permissions.
-
-| Input | Type | Description |
-|-------|------|-------------|
-| `code_root` | string | Absolute path to scan |
-| `severity_floor` | enum | Minimum severity |
-| `deep_analysis` | boolean | Run CircleIR to detect undisclosed capabilities (default: true) |
-
-**Config formats:** skill bundle (mcp.json), Claude Desktop, Cursor
-
-**Static rules:** broad filesystem paths, secret env vars, unrestricted network, dangerous commands
-
-**Deep analysis:** Cross-references declared permissions against actual code behavior. Detects undisclosed network, filesystem, or process execution capabilities.
+`@cognium/mcp-server` serves eleven deterministic tools on its own. With `circle-ir-ai`
+installed next to it, it also serves the ten tools this package used to: `verify_spec_conformance`,
+`find_spec_drift`, `find_pattern`, `find_credential_exposure`, `check_license_compliance`,
+`find_stale_dependencies`, `find_install_script_risk`, `find_typosquats`,
+`find_excessive_permissions` and `layer_bom`. They keep their names and arguments. Their
+documentation now lives with `circle-ir-ai`.
 
----
+## What the shim still does
 
-## Spec Tools
+- **`cognium-mcp`** prints a deprecation notice on stderr and then runs the one server over
+  stdio. `tools/list` is the 21 tools above.
+- **`buildServer()`** keeps its name and stays synchronous, and returns a server with the same
+  21 tools, so a host that mounted this package over its own transport needs no change.
+  `createServer()` from `@cognium/mcp-server` is re-exported for hosts that can await.
 
-### `verify_spec_conformance`
+## What changed for a caller
 
-Analyze how well code conforms to its [Specifica](https://www.npmjs.com/package/circle-ir-ai)
-spec.
-
-**Input**
-
-| field       | type   | description                                   |
-|-------------|--------|-----------------------------------------------|
-| `spec_dir`  | string | Path to the `.specifica/` directory (spec.md) |
-| `code_root` | string | Path to the code root to analyze              |
-
-**Output**
-
-```jsonc
-{
-  "alignment_score": 100,           // 0–100
-  "requirements": [
-    { "id": "REQ-001", "status": "covered",   "evidence": { "function": "calculateTotal" } },
-    { "id": "REQ-002", "status": "partial",   "evidence": { "function": "applyDiscount" } },
-    { "id": "REQ-003", "status": "uncovered", "evidence": {} }
-  ],
-  "summary": "2/3 requirements covered (67%); 0 undocumented behaviors"
-}
-```
-
-`status` is derived from the engine's match confidence:
-
-- `covered` — confidence **≥ 0.7**
-- `partial` — matched but confidence **< 0.7**
-- `uncovered` — no matching code behavior
-
-> The engine has no native "partial" state; it is a boundary heuristic at
-> confidence 0.7 over the engine's already-filtered match set
-> (min confidence 0.3).
->
-> **Empty spec:** if no requirements parse from `spec_dir` (missing, empty, or
-> malformed `spec.md`), `alignment_score` is reported as **0** with an
-> explanatory `summary` — never a misleading 100 — so a `>= N` gate fails
-> safely instead of passing on a spec that was never read.
-
-### `find_spec_drift`
-
-Report drift in both directions.
-
-**Input:** same as above (`spec_dir`, `code_root`).
-
-**Output**
-
-```jsonc
-{
-  "drifts": [
-    { "kind": "code_without_spec", "location": "deleteUser",  "suggested_action": "Document deleteUser: ..." },
-    { "kind": "spec_without_code", "location": "REQ-004",     "suggested_action": "Implement REQ-004: ..." }
-  ]
-}
-```
-
-- `code_without_spec` — an undocumented public behavior (engine
-  `undocumentedBehaviors`).
-- `spec_without_code` — a requirement with no matching code (engine
-  `uncoveredRequirements`).
-
-### `find_pattern`
-
-Search file contents under a code root with a JavaScript regular expression.
-
-**Input**
-
-| field       | type   | description                                       |
-|-------------|--------|---------------------------------------------------|
-| `pattern`   | string | JS `RegExp` source (applied with the global flag) |
-| `code_root` | string | Path to the code root to search                   |
-
-**Output**
-
-```jsonc
-{
-  "matches": [
-    { "file": "src/cart.ts", "span": [7, 7], "snippet": "return unitPrice * quantity;" }
-  ]
-}
-```
-
-> `span` is **line-based** `[startLine, endLine]` (1-based), **not** character
-> offsets. Files larger than 1 MiB, files detected as binary (NUL byte in the
-> leading window), and common build/vendor directories are skipped; results are
-> capped at 1000 matches.
->
-> The pattern is validated once up front (an invalid regex errors even over an
-> empty tree). A 2 s wall-clock budget bounds total scanning between matches;
-> it does not interrupt a single `exec`, so the 1 MiB per-file cap is the real
-> bound against a catastrophic-backtracking pattern.
-
-## Field mapping (engine → MCP boundary)
-
-The engine emits camelCase; this server renames to snake_case at the boundary.
-
-| MCP field                  | engine source (`SpecGapResult`)                         |
-|----------------------------|---------------------------------------------------------|
-| `alignment_score`          | `specAlignmentScore`                                    |
-| `requirements[].id`        | `coveredRequirements[].requirement.id` / `uncoveredRequirements[].requirement.id` |
-| `requirements[].status`    | derived from `coveredRequirements[].confidence` (≥0.7)  |
-| `requirements[].evidence.function` | `coveredRequirements[].matchedFunction`         |
-| `drifts` (code_without_spec) | `undocumentedBehaviors[]` → `{functionName, suggestion}` |
-| `drifts` (spec_without_code) | `uncoveredRequirements[]` → `{requirement.id, reason}`   |
-
-## Schema stability
-
-Tool input/output field names are **draft-stable through 2026-08-31**. Additive
-fields are non-breaking; renames or removals are breaking changes (major bump).
-
-## Runtime support
-
-Works under **Node** (≥18) and **Bun**. circle-ir's WASM is resolved via
-`createRequire(import.meta.url)` from `node_modules/circle-ir`, so no symlink is
-required under either runtime. Both are exercised by the CI stdio smoke matrix.
-
-## Development
-
-```bash
-npm install        # installs deps and builds (prepare → tsc)
-npm run typecheck
-npm test           # vitest: mapper unit tests
-npm run smoke      # spawn dist/index.js over stdio against the demo fixture
-```
+- `serverInfo` in the `initialize` result is `@cognium/mcp-server` and its version.
+- Every response from the ten tools carries `provenance`: `deterministic`, or `llm: <model>`.
+- `find_credential_exposure` with `llm_verify: true` is refused, with one line, unless the
+  install has a configured endpoint (`COGNIUM_ENDPOINT`) or a licence token.
 
 ## License
 
-PolyForm Noncommercial License 1.0.0 — see [LICENSE](./LICENSE).
+PolyForm Noncommercial License 1.0.0. `@cognium/mcp-server` itself is MIT; the ten tools come
+from `circle-ir-ai`, which is PolyForm Noncommercial. See [LICENSE](./LICENSE).

package/dist/deprecation.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The deprecation notice, in one place so the binary and the tests agree.
+ */
+export declare const DEPRECATION_NOTICE: string;
+//# sourceMappingURL=deprecation.d.ts.map

package/dist/deprecation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecation.d.ts","sourceRoot":"","sources":["../src/deprecation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,kBAAkB,QAGqB,CAAC"}

package/dist/deprecation.js

@@ -0,0 +1,7 @@
+/**
+ * The deprecation notice, in one place so the binary and the tests agree.
+ */
+export const DEPRECATION_NOTICE = '[@cognium-ai/mcp-server] deprecated (2026-10-01): this package is now a shim over @cognium/mcp-server ' +
+    'and this is its last release. Install @cognium/mcp-server and circle-ir-ai, and run ' +
+    '`mcp-server-cognium-dev`, to get the same tools.';
+//# sourceMappingURL=deprecation.js.map

package/dist/deprecation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecation.js","sourceRoot":"","sources":["../src/deprecation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,wGAAwG;IACxG,sFAAsF;IACtF,kDAAkD,CAAC"}

package/dist/index.d.ts

@@ -1,18 +1,24 @@
 #!/usr/bin/env node
 /**
- * Entry point for the Cognium MCP server.
+ * `@cognium-ai/mcp-server` — a shim.
  *
- * - As a bin (`cognium-mcp`): connects the server to stdio so MCP clients
- *   (e.g. cognium-code) can spawn it as a subprocess and communicate over
- *   stdin/stdout.
- * - As a library import (`import { buildServer } from '@cognium-ai/mcp-server'`):
- *   re-exports `buildServer` so HTTP transport hosts (e.g. circle-pack's
- *   `/api/mcp`) can build and connect to a configured `McpServer` without
- *   spawning a subprocess. The stdio bootstrap is guarded by an
- *   `import.meta.url === file://${process.argv[1]}` check so library
- *   consumers never accidentally start a stdio server on the host process's
- *   stdin/stdout.
+ * The server that used to live here is retired. Its ten tools moved into
+ * `circle-ir-ai/mcp`, and `@cognium/mcp-server` — the one MCP server —
+ * loads them next to its own eleven. This package now only forwards to it,
+ * for one release, so an existing install keeps working while it is moved.
+ *
+ * The entry keeps the two roles it always had, so nothing that used it has
+ * to change first:
+ *
+ * - As a bin (`cognium-mcp`, or this file run directly): prints the
+ *   deprecation notice on stderr, then serves the one server over stdio.
+ * - As a library import: re-exports `buildServer` and the one server's
+ *   `createServer`. The stdio bootstrap is guarded, so importing never
+ *   attaches a transport to the host process's stdin and stdout.
  */
 import { buildServer } from './server.js';
-export { buildServer };
+import { DEPRECATION_NOTICE } from './deprecation.js';
+export { buildServer, DEPRECATION_NOTICE };
+export { createServer, discoverModules, startupLines, SERVER_NAME, SERVER_VERSION } from '@cognium/mcp-server';
+export type { BuildServerOptions, Discovery, ToolModule } from '@cognium/mcp-server';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC/G,YAAY,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,27 +1,37 @@
 #!/usr/bin/env node
 /**
- * Entry point for the Cognium MCP server.
+ * `@cognium-ai/mcp-server` — a shim.
  *
- * - As a bin (`cognium-mcp`): connects the server to stdio so MCP clients
- *   (e.g. cognium-code) can spawn it as a subprocess and communicate over
- *   stdin/stdout.
- * - As a library import (`import { buildServer } from '@cognium-ai/mcp-server'`):
- *   re-exports `buildServer` so HTTP transport hosts (e.g. circle-pack's
- *   `/api/mcp`) can build and connect to a configured `McpServer` without
- *   spawning a subprocess. The stdio bootstrap is guarded by an
- *   `import.meta.url === file://${process.argv[1]}` check so library
- *   consumers never accidentally start a stdio server on the host process's
- *   stdin/stdout.
+ * The server that used to live here is retired. Its ten tools moved into
+ * `circle-ir-ai/mcp`, and `@cognium/mcp-server` — the one MCP server —
+ * loads them next to its own eleven. This package now only forwards to it,
+ * for one release, so an existing install keeps working while it is moved.
+ *
+ * The entry keeps the two roles it always had, so nothing that used it has
+ * to change first:
+ *
+ * - As a bin (`cognium-mcp`, or this file run directly): prints the
+ *   deprecation notice on stderr, then serves the one server over stdio.
+ * - As a library import: re-exports `buildServer` and the one server's
+ *   `createServer`. The stdio bootstrap is guarded, so importing never
+ *   attaches a transport to the host process's stdin and stdout.
  */
 import { realpathSync } from 'node:fs';
 import { pathToFileURL } from 'node:url';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createServer, startupLines } from '@cognium/mcp-server';
 import { buildServer } from './server.js';
-export { buildServer };
+import { DEPRECATION_NOTICE } from './deprecation.js';
+export { buildServer, DEPRECATION_NOTICE };
+export { createServer, discoverModules, startupLines, SERVER_NAME, SERVER_VERSION } from '@cognium/mcp-server';
 async function main() {
-    const server = buildServer();
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
+    // stderr: stdout belongs to the JSON-RPC stream.
+    process.stderr.write(`${DEPRECATION_NOTICE}\n`);
+    const { server, discovery } = await createServer();
+    for (const line of startupLines(discovery)) {
+        process.stderr.write(`${line}\n`);
+    }
+    await server.connect(new StdioServerTransport());
 }
 // Only run the stdio bootstrap when invoked as an executable, not when
 // imported as a library.
@@ -45,11 +55,9 @@ function computeIsMain() {
         return false;
     }
 }
-const isMain = computeIsMain();
-if (isMain) {
+if (computeIsMain()) {
     main().catch((err) => {
-        // Logging to stderr keeps stdout clean for the JSON-RPC stream.
-        console.error('Fatal error in cognium-mcp:', err);
+        process.stderr.write(`[@cognium-ai/mcp-server] fatal: ${err.stack ?? err}\n`);
         process.exit(1);
     });
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,uEAAuE;AACvE,yBAAyB;AACzB,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,0EAA0E;AAC1E,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,6DAA6D;AAC7D,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;AAC/B,IAAI,MAAM,EAAE,CAAC;IACX,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,gEAAgE;QAChE,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG/G,KAAK,UAAU,IAAI;IACjB,iDAAiD;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,kBAAkB,IAAI,CAAC,CAAC;IAChD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,uEAAuE;AACvE,yBAAyB;AACzB,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,0EAA0E;AAC1E,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,6DAA6D;AAC7D,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,aAAa,EAAE,EAAE,CAAC;IACpB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAoC,GAAa,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server.d.ts

@@ -1,6 +1,18 @@
 /**
- * Builds the Cognium MCP server and registers all tools.
+ * `buildServer()` under its old name and its old signature.
+ *
+ * This package used to build its own server with ten tools. Those tools now
+ * live in `circle-ir-ai/mcp` and are served by `@cognium/mcp-server`, which
+ * adds eleven of its own. A caller of `buildServer()` therefore still gets a
+ * server with the ten tools it had — plus the eleven — without changing a
+ * line.
+ *
+ * The one server's own `buildServer()` is synchronous and loads no modules;
+ * finding them is `createServer()`'s job, and that is asynchronous. To keep
+ * this entry synchronous the module is imported here directly, and put
+ * through the same `circle-ir` check the loader applies.
  */
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function buildServer(): McpServer;
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { type BuildServerOptions } from '@cognium/mcp-server';
+export declare function buildServer(opts?: Omit<BuildServerOptions, 'modules' | 'enablement'>): McpServer;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAYpE,wBAAgB,WAAW,IAAI,SAAS,CAyBvC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAML,KAAK,kBAAkB,EAExB,MAAM,qBAAqB,CAAC;AAG7B,wBAAgB,WAAW,CAAC,IAAI,GAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,GAAG,YAAY,CAAM,GAAG,SAAS,CAepG"}

package/dist/server.js

@@ -1,36 +1,31 @@
 /**
- * Builds the Cognium MCP server and registers all tools.
+ * `buildServer()` under its old name and its old signature.
+ *
+ * This package used to build its own server with ten tools. Those tools now
+ * live in `circle-ir-ai/mcp` and are served by `@cognium/mcp-server`, which
+ * adds eleven of its own. A caller of `buildServer()` therefore still gets a
+ * server with the ten tools it had — plus the eleven — without changing a
+ * line.
+ *
+ * The one server's own `buildServer()` is synchronous and loads no modules;
+ * finding them is `createServer()`'s job, and that is asynchronous. To keep
+ * this entry synchronous the module is imported here directly, and put
+ * through the same `circle-ir` check the loader applies.
  */
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { registerVerifySpecConformance } from './tools/verify-spec-conformance.js';
-import { registerFindSpecDrift } from './tools/find-spec-drift.js';
-import { registerFindPattern } from './tools/find-pattern.js';
-import { registerFindCredentialExposure } from './tools/find-credential-exposure.js';
-import { registerCheckLicenseCompliance } from './tools/check-license-compliance.js';
-import { registerFindStaleDependencies } from './tools/find-stale-dependencies.js';
-import { registerFindInstallScriptRisk } from './tools/find-install-script-risk.js';
-import { registerFindTyposquats } from './tools/find-typosquats.js';
-import { registerFindExcessivePermissions } from './tools/find-excessive-permissions.js';
-import { registerLayerBom } from './tools/layer-bom.js';
-export function buildServer() {
-    const server = new McpServer({
-        name: 'cognium-mcp',
-        version: '0.4.0',
+import { buildServer as buildOneServer, checkCircleIrRange, circleIrVersion, enablementForProcess, SERVER_NAME, } from '@cognium/mcp-server';
+import toolModule from 'circle-ir-ai/mcp';
+export function buildServer(opts = {}) {
+    const aiModule = toolModule;
+    const range = checkCircleIrRange(aiModule.circleIrRange, circleIrVersion());
+    if (!range.ok) {
+        process.stderr.write(`[${SERVER_NAME}] refused ${aiModule.id}: ${aiModule.id}@${aiModule.version} ${range.reason}. ` +
+            'Serving the deterministic floor only.\n');
+    }
+    const modules = range.ok ? [aiModule] : [];
+    return buildOneServer({
+        ...opts,
+        modules,
+        enablement: enablementForProcess({ installed: modules.length > 0 }),
     });
-    // Spec tools (legacy)
-    registerVerifySpecConformance(server);
-    registerFindSpecDrift(server);
-    registerFindPattern(server);
-    // Pillar I Batch 1
-    registerFindCredentialExposure(server);
-    registerCheckLicenseCompliance(server);
-    // Pillar I Batch 2
-    registerFindStaleDependencies(server);
-    registerFindInstallScriptRisk(server);
-    registerFindTyposquats(server);
-    registerFindExcessivePermissions(server);
-    // Conformis inventory primitive
-    registerLayerBom(server);
-    return server;
 }
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,UAAU,WAAW;IACzB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,sBAAsB;IACtB,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAE5B,mBAAmB;IACnB,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAEvC,mBAAmB;IACnB,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,gCAAgC,CAAC,MAAM,CAAC,CAAC;IAEzC,gCAAgC;IAChC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEzB,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,WAAW,IAAI,cAAc,EAC7B,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,WAAW,GAGZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAE1C,MAAM,UAAU,WAAW,CAAC,OAA2D,EAAE;IACvF,MAAM,QAAQ,GAAe,UAAU,CAAC;IACxC,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,WAAW,aAAa,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,IAAI;YAC7F,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,OAAO,cAAc,CAAC;QACpB,GAAG,IAAI;QACP,OAAO;QACP,UAAU,EAAE,oBAAoB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;KACpE,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cognium-ai/mcp-server",
-  "version": "4.16.5",
-  "description": "MCP server exposing Cognium spec-conformance, spec-drift, and pattern-search tools over stdio",
+  "version": "4.17.1",
+  "description": "Deprecated shim: forwards to @cognium/mcp-server, which now serves these tools via circle-ir-ai/mcp",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
@@ -41,14 +41,13 @@
   "files": [
     "dist",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "circle-ir": "4.9.29",
-    "circle-ir-ai": "^4.16.5",
-    "minimatch": "^10.2.5",
-    "zod": "^3.25.0"
+    "@cognium/mcp-server": "^0.2.0",
+    "@modelcontextprotocol/sdk": "^1.30.1",
+    "circle-ir-ai": "^4.19.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",

package/dist/analysis.d.ts

@@ -1,25 +0,0 @@
-/**
- * Circle-IR loading for the MCP server.
- *
- * Wraps circle-ir-ai's analyzer lifecycle: initialize the WASM-backed
- * analyzer once, walk the code root for supported source files, and run
- * circle-ir's `analyze` per file. The resulting `CircleIR[]` is the input to
- * `analyzeSpecGap` (used by the verify/drift tools).
- *
- * Mirrors the wiring recipe in cognium-ai's `spec-diff` command, but depends
- * only on `circle-ir` + `circle-ir-ai` (not the cognium-ai CLI).
- */
-import { type CircleIR } from 'circle-ir';
-import { type WalkOptions } from './walk.js';
-export interface LoadedCircleIR {
-    /** Absolute path to the analyzed code root. */
-    codePath: string;
-    /** Per-file circle-ir analysis results. */
-    results: CircleIR[];
-}
-/**
- * Walk `codeRoot`, analyze each supported source file, and return the
- * collected `CircleIR[]` alongside the resolved code path.
- */
-export declare function loadCircleIR(codeRoot: string, options?: WalkOptions): Promise<LoadedCircleIR>;
-//# sourceMappingURL=analysis.d.ts.map

package/dist/analysis.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"analysis.d.ts","sourceRoot":"","sources":["../src/analysis.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAW,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,OAAO,EAAE,QAAQ,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,cAAc,CAAC,CAwBzB"}