@cognium/mcp-server 0.1.0

package/dist/tools/describe-source.js

@@ -0,0 +1,64 @@
+/**
+ * `describe_source` tool — enumerate taint-source patterns known to
+ * circle-ir for a given source category (e.g. `http_param`, `http_header`,
+ * `db_result`, `env`, `file`).
+ *
+ * Used by an LLM to answer "where would attacker-controlled data enter
+ * this codebase from `http_body`?" without guessing framework APIs.
+ */
+import { z } from 'zod';
+import { textResult, errorResult } from './types.js';
+import { loadSourceCatalog } from '../resources/catalogs.js';
+export const describeSourceInputShape = {
+    source_type: z.string()
+        .describe('Source category, e.g. "http_param", "http_header", "http_body", "http_cookie", "db_result", "env", "file".'),
+    language: z.enum(['java', 'javascript', 'typescript', 'python', 'go', 'rust', 'bash', 'html'])
+        .optional()
+        .describe('Restrict patterns to this language.'),
+};
+export const describeSourceConfig = {
+    title: 'Describe taint source category',
+    description: 'Return every taint-source pattern (method / class / property / annotation) that circle-ir treats as ' +
+        'a source of the given category. Use when the LLM needs to know "which framework APIs count as an ' +
+        'HTTP body source?" or "what constitutes an env-var source?"',
+    inputSchema: describeSourceInputShape,
+};
+export function makeDescribeSourceHandler(_ctx) {
+    return async (args) => {
+        const catalog = loadSourceCatalog();
+        const matches = catalog.filter((s) => {
+            if (s.type !== args.source_type)
+                return false;
+            if (args.language && s.languages && !s.languages.includes(args.language))
+                return false;
+            return true;
+        });
+        if (matches.length === 0) {
+            const known = [...new Set(catalog.map((s) => s.type))].sort();
+            return errorResult(`No source patterns for source_type "${args.source_type}"` +
+                (args.language ? ` in language "${args.language}"` : '') +
+                `. Known source types: ${known.join(', ')}`);
+        }
+        return textResult({
+            source_type: args.source_type,
+            language: args.language ?? 'any',
+            totalPatterns: matches.length,
+            patterns: matches.slice(0, 200).map((s) => ({
+                method: s.method,
+                class: s.class,
+                property: s.property,
+                object: s.object,
+                annotation: s.annotation,
+                methodAnnotation: s.methodAnnotation,
+                severity: s.severity,
+                returnTainted: s.returnTainted,
+                paramTainted: s.paramTainted,
+                propertyTainted: s.propertyTainted,
+                languages: s.languages,
+                note: s.note,
+            })),
+            truncated: matches.length > 200,
+        });
+    };
+}
+//# sourceMappingURL=describe-source.js.map

package/dist/tools/describe-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-source.js","sourceRoot":"","sources":["../../src/tools/describe-source.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;SACpB,QAAQ,CAAC,4GAA4G,CAAC;IACzH,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;SAC3F,QAAQ,EAAE;SACV,QAAQ,CAAC,qCAAqC,CAAC;CAC1C,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,KAAK,EAAE,gCAAgC;IACvC,WAAW,EACT,sGAAsG;QACtG,mGAAmG;QACnG,6DAA6D;IAC/D,WAAW,EAAE,wBAAwB;CAC7B,CAAC;AAEX,MAAM,UAAU,yBAAyB,CAAC,IAAiB;IACzD,OAAO,KAAK,EAAE,IAAgD,EAAuB,EAAE;QACrF,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACnC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC9C,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAiB,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChG,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9D,OAAO,WAAW,CAChB,uCAAuC,IAAI,CAAC,WAAW,GAAG;gBAC1D,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,yBAAyB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5C,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;YAChB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;YAChC,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1C,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC,CAAC;YACH,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG;SAChC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/explain-finding.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `explain_finding` tool — enrich a single SastFinding with CWE metadata,
+ * remediation guidance, and sanitizer alternatives.
+ */
+import { z } from 'zod';
+import type { ToolContext, ToolResult } from './types.js';
+export declare const explainFindingInputShape: {
+    readonly project_root: z.ZodString;
+    readonly finding_id: z.ZodString;
+};
+export declare const explainFindingConfig: {
+    readonly title: "Explain finding";
+    readonly description: string;
+    readonly inputSchema: {
+        readonly project_root: z.ZodString;
+        readonly finding_id: z.ZodString;
+    };
+};
+export declare function makeExplainFindingHandler(ctx: ToolContext): (args: {
+    project_root: string;
+    finding_id: string;
+}) => Promise<ToolResult>;
+//# sourceMappingURL=explain-finding.d.ts.map

package/dist/tools/explain-finding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain-finding.d.ts","sourceRoot":"","sources":["../../src/tools/explain-finding.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI1D,eAAO,MAAM,wBAAwB;;;CAG3B,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;;CAOvB,CAAC;AAEX,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,WAAW,IAC1C,MAAM;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,UAAU,CAAC,CAoCvF"}

package/dist/tools/explain-finding.js

@@ -0,0 +1,65 @@
+/**
+ * `explain_finding` tool — enrich a single SastFinding with CWE metadata,
+ * remediation guidance, and sanitizer alternatives.
+ */
+import { z } from 'zod';
+import { RULE_DEFINITIONS } from 'circle-ir';
+import { resolve } from 'path';
+import { textResult, errorResult } from './types.js';
+import { truncateString } from '../util/serialize.js';
+export const explainFindingInputShape = {
+    project_root: z.string().describe('Absolute path to the project root that was previously scanned.'),
+    finding_id: z.string().describe('The `id` field of a SastFinding returned by `scan`.'),
+};
+export const explainFindingConfig = {
+    title: 'Explain finding',
+    description: 'Return full context for a single SastFinding: CWE metadata (name, short/full description, remediation, ' +
+        'CVSS-like score), source-code snippet, and — if the finding is a taint sink — the list of sanitizers ' +
+        'that would neutralize it. Use before proposing a fix so the LLM cites authoritative rule content.',
+    inputSchema: explainFindingInputShape,
+};
+export function makeExplainFindingHandler(ctx) {
+    return async (args) => {
+        const projectRoot = resolve(args.project_root);
+        // Try every cached option-set for this root.
+        // We don't know which option-set was used at scan time, so we scan them all.
+        for (const opts of enumerateCachedOptionSets(ctx, projectRoot)) {
+            const { analysis } = await ctx.cache.getOrCompute(projectRoot, opts);
+            for (const fa of analysis.files) {
+                for (const f of fa.analysis.findings ?? []) {
+                    if (f.id !== args.finding_id)
+                        continue;
+                    const rule = f.rule_id in RULE_DEFINITIONS
+                        ? RULE_DEFINITIONS[f.rule_id]
+                        : undefined;
+                    return textResult({
+                        finding: {
+                            ...f,
+                            message: truncateString(f.message),
+                            snippet: truncateString(f.snippet),
+                            fix: truncateString(f.fix),
+                        },
+                        rule: rule
+                            ? {
+                                name: rule.name,
+                                shortDescription: rule.shortDescription,
+                                fullDescription: rule.fullDescription,
+                                remediation: rule.remediation,
+                                cvssScore: rule.cvssScore,
+                                severityLevel: rule.severityLevel,
+                                cwe: rule.cwe,
+                            }
+                            : { note: 'No RULE_DEFINITIONS entry — this rule_id is a quality/reliability pass, not a taint sink. Consult PASSES.md via `cognium://passes` resource for canonical metadata.' },
+                    });
+                }
+            }
+        }
+        return errorResult(`Finding not found: ${args.finding_id}. Call \`scan\` first (or with the same option-set that produced the id).`);
+    };
+}
+function enumerateCachedOptionSets(_ctx, _projectRoot) {
+    // MVP: only try the default option-set. If none is cached, the caller
+    // is instructed to run `scan` first.
+    return [{}];
+}
+//# sourceMappingURL=explain-finding.js.map

package/dist/tools/explain-finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain-finding.js","sourceRoot":"","sources":["../../src/tools/explain-finding.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAiB,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;IACnG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;CAC9E,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,KAAK,EAAE,iBAAiB;IACxB,WAAW,EACT,yGAAyG;QACzG,uGAAuG;QACvG,mGAAmG;IACrG,WAAW,EAAE,wBAAwB;CAC7B,CAAC;AAEX,MAAM,UAAU,yBAAyB,CAAC,GAAgB;IACxD,OAAO,KAAK,EAAE,IAAkD,EAAuB,EAAE;QACvF,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,6CAA6C;QAC7C,6EAA6E;QAC7E,KAAK,MAAM,IAAI,IAAI,yBAAyB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YAC/D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrE,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAChC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBAC3C,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU;wBAAE,SAAS;oBACvC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,gBAAgB;wBACxC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAmB,CAAC;wBACzC,CAAC,CAAC,SAAS,CAAC;oBACd,OAAO,UAAU,CAAC;wBAChB,OAAO,EAAE;4BACP,GAAG,CAAC;4BACJ,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;4BAClC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;4BAClC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC;yBAC3B;wBACD,IAAI,EAAE,IAAI;4BACR,CAAC,CAAC;gCACA,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gCACvC,eAAe,EAAE,IAAI,CAAC,eAAe;gCACrC,WAAW,EAAE,IAAI,CAAC,WAAW;gCAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gCACzB,aAAa,EAAE,IAAI,CAAC,aAAa;gCACjC,GAAG,EAAE,IAAI,CAAC,GAAG;6BACd;4BACD,CAAC,CAAC,EAAE,IAAI,EAAE,qKAAqK,EAAE;qBACpL,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC,sBAAsB,IAAI,CAAC,UAAU,2EAA2E,CAAC,CAAC;IACvI,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAiB,EAAE,YAAoB;IACxE,sEAAsE;IACtE,qCAAqC;IACrC,OAAO,CAAC,EAAE,CAAC,CAAC;AACd,CAAC"}

package/dist/tools/find-similar.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `find_similar` tool — given a finding id (from a prior `scan`), return
+ * every other finding in the same project that shares the same
+ * `rule_id` + `sink_type` (or matches by structural similarity of the
+ * source→sink pair).
+ *
+ * Answers "did I miss this pattern anywhere else in the code?" — a
+ * common LLM follow-up after triaging one issue.
+ */
+import { z } from 'zod';
+import type { ToolContext, ToolResult } from './types.js';
+export declare const findSimilarInputShape: {
+    readonly project_root: z.ZodString;
+    readonly finding_id: z.ZodString;
+    readonly match_by: z.ZodOptional<z.ZodEnum<["rule_and_sink", "rule", "sink"]>>;
+    readonly max_results: z.ZodOptional<z.ZodNumber>;
+};
+export declare const findSimilarConfig: {
+    readonly title: "Find structurally similar findings";
+    readonly description: string;
+    readonly inputSchema: {
+        readonly project_root: z.ZodString;
+        readonly finding_id: z.ZodString;
+        readonly match_by: z.ZodOptional<z.ZodEnum<["rule_and_sink", "rule", "sink"]>>;
+        readonly max_results: z.ZodOptional<z.ZodNumber>;
+    };
+};
+export declare function makeFindSimilarHandler(ctx: ToolContext): (args: {
+    project_root: string;
+    finding_id: string;
+    match_by?: "rule_and_sink" | "rule" | "sink";
+    max_results?: number;
+}) => Promise<ToolResult>;
+//# sourceMappingURL=find-similar.d.ts.map

package/dist/tools/find-similar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-similar.d.ts","sourceRoot":"","sources":["../../src/tools/find-similar.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI1D,eAAO,MAAM,qBAAqB;;;;;CAQxB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;;;;CAOpB,CAAC;AAEX,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,IACvC,MAAM;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,KAAG,OAAO,CAAC,UAAU,CAAC,CA8ExB"}

package/dist/tools/find-similar.js

@@ -0,0 +1,107 @@
+/**
+ * `find_similar` tool — given a finding id (from a prior `scan`), return
+ * every other finding in the same project that shares the same
+ * `rule_id` + `sink_type` (or matches by structural similarity of the
+ * source→sink pair).
+ *
+ * Answers "did I miss this pattern anywhere else in the code?" — a
+ * common LLM follow-up after triaging one issue.
+ */
+import { z } from 'zod';
+import { resolve } from 'path';
+import { textResult, errorResult } from './types.js';
+import { truncateArray, truncateString, MAX_FINDINGS } from '../util/serialize.js';
+export const findSimilarInputShape = {
+    project_root: z.string().describe('Absolute path to the project root.'),
+    finding_id: z.string()
+        .describe('Anchor finding id (from `scan` output). Similar findings are relative to this one.'),
+    match_by: z.enum(['rule_and_sink', 'rule', 'sink']).optional()
+        .describe('Similarity axis: `rule_and_sink` (default) matches rule_id + taint sink_type, `rule` matches rule_id only, `sink` matches sink_type only.'),
+    max_results: z.number().int().min(1).max(200).optional()
+        .describe('Cap on returned findings. Defaults to 50.'),
+};
+export const findSimilarConfig = {
+    title: 'Find structurally similar findings',
+    description: 'Given one SastFinding id, return other findings in the same project that share the same rule_id ' +
+        'and/or taint sink type. Use after triaging a finding to catch the same vulnerability pattern ' +
+        'elsewhere without re-scanning or re-prompting.',
+    inputSchema: findSimilarInputShape,
+};
+export function makeFindSimilarHandler(ctx) {
+    return async (args) => {
+        const root = resolve(args.project_root);
+        const { analysis, cacheHit } = await ctx.cache.getOrCompute(root, {});
+        const matchBy = args.match_by ?? 'rule_and_sink';
+        const cap = Math.min(args.max_results ?? 50, MAX_FINDINGS);
+        // Locate anchor.
+        let anchor = null;
+        for (const fa of analysis.files) {
+            for (const f of fa.analysis.findings ?? []) {
+                if (f.id === args.finding_id) {
+                    const sink = fa.analysis.taint?.flows?.find((fl) => fl.sink_line === f.line);
+                    anchor = {
+                        rule_id: f.rule_id,
+                        sink_type: sink?.sink_type,
+                        file: fa.file,
+                        line: f.line,
+                    };
+                    break;
+                }
+            }
+            if (anchor)
+                break;
+        }
+        if (!anchor) {
+            return errorResult(`Finding not found: ${args.finding_id}. Call \`scan\` first, then pass an id from its output.`);
+        }
+        // Collect matches (exclude the anchor itself).
+        const matches = [];
+        for (const fa of analysis.files) {
+            for (const f of fa.analysis.findings ?? []) {
+                if (f.id === args.finding_id)
+                    continue;
+                const sink = fa.analysis.taint?.flows?.find((fl) => fl.sink_line === f.line);
+                const sinkType = sink?.sink_type;
+                const ruleMatch = f.rule_id === anchor.rule_id;
+                const sinkMatch = sinkType && anchor.sink_type && sinkType === anchor.sink_type;
+                let isMatch = false;
+                if (matchBy === 'rule_and_sink')
+                    isMatch = Boolean(ruleMatch && (anchor.sink_type ? sinkMatch : true));
+                else if (matchBy === 'rule')
+                    isMatch = ruleMatch;
+                else if (matchBy === 'sink')
+                    isMatch = Boolean(sinkMatch);
+                if (!isMatch)
+                    continue;
+                matches.push({
+                    id: f.id,
+                    rule_id: f.rule_id,
+                    category: f.category,
+                    severity: f.severity,
+                    file: fa.file,
+                    line: f.line,
+                    sink_type: sinkType,
+                    message: truncateString(f.message, 512),
+                    snippet: truncateString(f.snippet, 512),
+                });
+            }
+        }
+        const { items, truncated, totalCount } = truncateArray(matches, cap);
+        return textResult({
+            projectRoot: root,
+            cacheHit,
+            anchor: {
+                id: args.finding_id,
+                rule_id: anchor.rule_id,
+                sink_type: anchor.sink_type,
+                file: anchor.file,
+                line: anchor.line,
+            },
+            matchBy,
+            totalMatches: totalCount,
+            truncated,
+            similar: items,
+        });
+    };
+}
+//# sourceMappingURL=find-similar.js.map

package/dist/tools/find-similar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-similar.js","sourceRoot":"","sources":["../../src/tools/find-similar.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEnF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACvE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;SACnB,QAAQ,CAAC,oFAAoF,CAAC;IACjG,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC3D,QAAQ,CAAC,2IAA2I,CAAC;IACxJ,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;SACrD,QAAQ,CAAC,2CAA2C,CAAC;CAChD,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,KAAK,EAAE,oCAAoC;IAC3C,WAAW,EACT,kGAAkG;QAClG,+FAA+F;QAC/F,gDAAgD;IAClD,WAAW,EAAE,qBAAqB;CAC1B,CAAC;AAEX,MAAM,UAAU,sBAAsB,CAAC,GAAgB;IACrD,OAAO,KAAK,EAAE,IAKb,EAAuB,EAAE;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;QAE3D,iBAAiB;QACjB,IAAI,MAAM,GAA+E,IAAI,CAAC;QAC9F,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC7E,MAAM,GAAG;wBACP,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,SAAS,EAAE,IAAI,EAAE,SAAS;wBAC1B,IAAI,EAAE,EAAE,CAAC,IAAI;wBACb,IAAI,EAAE,CAAC,CAAC,IAAI;qBACb,CAAC;oBACF,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,MAAM;gBAAE,MAAM;QACpB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,WAAW,CAChB,sBAAsB,IAAI,CAAC,UAAU,yDAAyD,CAC/F,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,MAAM,OAAO,GAAmC,EAAE,CAAC;QACnD,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU;oBAAE,SAAS;gBACvC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7E,MAAM,QAAQ,GAAG,IAAI,EAAE,SAAS,CAAC;gBAEjC,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;gBAC/C,MAAM,SAAS,GAAG,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,QAAQ,KAAK,MAAM,CAAC,SAAS,CAAC;gBAEhF,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,IAAI,OAAO,KAAK,eAAe;oBAAE,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;qBAClG,IAAI,OAAO,KAAK,MAAM;oBAAE,OAAO,GAAG,SAAS,CAAC;qBAC5C,IAAI,OAAO,KAAK,MAAM;oBAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;gBAE1D,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,OAAO,CAAC,IAAI,CAAC;oBACX,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,SAAS,EAAE,QAAQ;oBACnB,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;oBACvC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;iBACxC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAErE,OAAO,UAAU,CAAC;YAChB,WAAW,EAAE,IAAI;YACjB,QAAQ;YACR,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI,CAAC,UAAU;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;YACD,OAAO;YACP,YAAY,EAAE,UAAU;YACxB,SAAS;YACT,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/list-entry-points.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `list_entry_points` tool — enumerate attacker-reachable entry points.
+ */
+import { z } from 'zod';
+import type { ToolContext, ToolResult } from './types.js';
+export declare const listEntryPointsInputShape: {
+    readonly project_root: z.ZodString;
+    readonly language: z.ZodOptional<z.ZodEnum<["java", "javascript", "typescript", "python", "go", "rust", "bash", "html"]>>;
+};
+export declare const listEntryPointsConfig: {
+    readonly title: "List attacker-reachable entry points";
+    readonly description: string;
+    readonly inputSchema: {
+        readonly project_root: z.ZodString;
+        readonly language: z.ZodOptional<z.ZodEnum<["java", "javascript", "typescript", "python", "go", "rust", "bash", "html"]>>;
+    };
+};
+export declare function makeListEntryPointsHandler(ctx: ToolContext): (args: {
+    project_root: string;
+    language?: "java" | "javascript" | "typescript" | "python" | "go" | "rust" | "bash" | "html";
+}) => Promise<ToolResult>;
+//# sourceMappingURL=list-entry-points.d.ts.map

package/dist/tools/list-entry-points.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-entry-points.d.ts","sourceRoot":"","sources":["../../src/tools/list-entry-points.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI1D,eAAO,MAAM,yBAAyB;;;CAK5B,CAAC;AAEX,eAAO,MAAM,qBAAqB;;;;;;;CAQxB,CAAC;AAEX,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,WAAW,IAC3C,MAAM;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;CAC9F,KAAG,OAAO,CAAC,UAAU,CAAC,CA0CxB"}

package/dist/tools/list-entry-points.js

@@ -0,0 +1,71 @@
+/**
+ * `list_entry_points` tool — enumerate attacker-reachable entry points.
+ */
+import { z } from 'zod';
+import { resolve } from 'path';
+import { textResult } from './types.js';
+import { truncateArray, MAX_ENTRY_POINTS } from '../util/serialize.js';
+export const listEntryPointsInputShape = {
+    project_root: z.string().describe('Absolute path to the project root.'),
+    language: z.enum(['java', 'javascript', 'typescript', 'python', 'go', 'rust', 'bash', 'html'])
+        .optional()
+        .describe('Restrict to a single language.'),
+};
+export const listEntryPointsConfig = {
+    title: 'List attacker-reachable entry points',
+    description: 'Enumerate all entry-point methods (HTTP route handlers, middlewares, event listeners, cron/queue ' +
+        'consumers) grouped by framework and language. Sourced from circle-ir `runtime_registrations` — the ' +
+        'call-graph edges that framework registration establishes but the raw AST does not surface. Answers ' +
+        '"what is the attack surface of this codebase?"',
+    inputSchema: listEntryPointsInputShape,
+};
+export function makeListEntryPointsHandler(ctx) {
+    return async (args) => {
+        const root = resolve(args.project_root);
+        const { analysis, cacheHit } = await ctx.cache.getOrCompute(root, {});
+        const entryPoints = [];
+        for (const fa of analysis.files) {
+            if (args.language && fa.analysis.meta.language !== args.language)
+                continue;
+            for (const reg of fa.analysis.runtime_registrations ?? []) {
+                entryPoints.push({
+                    file: fa.file,
+                    language: fa.analysis.meta.language,
+                    kind: reg.kind,
+                    framework: reg.framework,
+                    method: reg.handler.name,
+                    handlerLine: reg.handler.line,
+                    registrar: {
+                        method: reg.registrar.method,
+                        receiver: reg.registrar.receiver,
+                        line: reg.registrar.line,
+                    },
+                    route: reg.path,
+                });
+            }
+        }
+        const byFramework = countBy(entryPoints, e => String(e.framework ?? 'unknown'));
+        const byLanguage = countBy(entryPoints, e => String(e.language ?? 'unknown'));
+        const byKind = countBy(entryPoints, e => String(e.kind ?? 'unknown'));
+        const { items, truncated, totalCount } = truncateArray(entryPoints, MAX_ENTRY_POINTS);
+        return textResult({
+            projectRoot: root,
+            cacheHit,
+            totalEntryPoints: totalCount,
+            truncated,
+            byFramework,
+            byLanguage,
+            byKind,
+            entryPoints: items,
+        });
+    };
+}
+function countBy(items, key) {
+    const out = {};
+    for (const i of items) {
+        const k = key(i);
+        out[k] = (out[k] ?? 0) + 1;
+    }
+    return out;
+}
+//# sourceMappingURL=list-entry-points.js.map

package/dist/tools/list-entry-points.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-entry-points.js","sourceRoot":"","sources":["../../src/tools/list-entry-points.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEvE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;SAC3F,QAAQ,EAAE;SACV,QAAQ,CAAC,gCAAgC,CAAC;CACrC,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EACT,mGAAmG;QACnG,qGAAqG;QACrG,qGAAqG;QACrG,gDAAgD;IAClD,WAAW,EAAE,yBAAyB;CAC9B,CAAC;AAEX,MAAM,UAAU,0BAA0B,CAAC,GAAgB;IACzD,OAAO,KAAK,EAAE,IAGb,EAAuB,EAAE;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEtE,MAAM,WAAW,GAAmC,EAAE,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAC3E,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;gBAC1D,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ;oBACnC,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;oBACxB,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;oBAC7B,SAAS,EAAE;wBACT,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;wBAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ;wBAChC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI;qBACzB;oBACD,KAAK,EAAE,GAAG,CAAC,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC;QAChF,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC;QAEtE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAEtF,OAAO,UAAU,CAAC;YAChB,WAAW,EAAE,IAAI;YACjB,QAAQ;YACR,gBAAgB,EAAE,UAAU;YAC5B,SAAS;YACT,WAAW;YACX,UAAU;YACV,MAAM;YACN,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAI,KAAU,EAAE,GAAqB;IACnD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/tools/list-reachable-sinks.d.ts

@@ -0,0 +1,33 @@
+/**
+ * `list_reachable_sinks` tool — enumerate every sink of a given category
+ * that has a demonstrated taint flow (per-file or cross-file). Filters
+ * out sinks that are lexically present but not reachable from any source.
+ *
+ * Answers "which SQL sinks in this project actually receive tainted
+ * data?" — the deterministic answer an LLM cannot produce alone.
+ */
+import { z } from 'zod';
+import type { ToolContext, ToolResult } from './types.js';
+export declare const listReachableSinksInputShape: {
+    readonly project_root: z.ZodString;
+    readonly sink_type: z.ZodOptional<z.ZodString>;
+    readonly language: z.ZodOptional<z.ZodEnum<["java", "javascript", "typescript", "python", "go", "rust", "bash", "html"]>>;
+    readonly min_confidence: z.ZodOptional<z.ZodNumber>;
+};
+export declare const listReachableSinksConfig: {
+    readonly title: "List reachable sinks (with taint flow)";
+    readonly description: string;
+    readonly inputSchema: {
+        readonly project_root: z.ZodString;
+        readonly sink_type: z.ZodOptional<z.ZodString>;
+        readonly language: z.ZodOptional<z.ZodEnum<["java", "javascript", "typescript", "python", "go", "rust", "bash", "html"]>>;
+        readonly min_confidence: z.ZodOptional<z.ZodNumber>;
+    };
+};
+export declare function makeListReachableSinksHandler(ctx: ToolContext): (args: {
+    project_root: string;
+    sink_type?: string;
+    language?: string;
+    min_confidence?: number;
+}) => Promise<ToolResult>;
+//# sourceMappingURL=list-reachable-sinks.d.ts.map

package/dist/tools/list-reachable-sinks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-reachable-sinks.d.ts","sourceRoot":"","sources":["../../src/tools/list-reachable-sinks.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI1D,eAAO,MAAM,4BAA4B;;;;;CAS/B,CAAC;AAEX,eAAO,MAAM,wBAAwB;;;;;;;;;CAQ3B,CAAC;AAiBX,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,WAAW,IAC9C,MAAM;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,KAAG,OAAO,CAAC,UAAU,CAAC,CAkFxB"}

package/dist/tools/list-reachable-sinks.js

@@ -0,0 +1,116 @@
+/**
+ * `list_reachable_sinks` tool — enumerate every sink of a given category
+ * that has a demonstrated taint flow (per-file or cross-file). Filters
+ * out sinks that are lexically present but not reachable from any source.
+ *
+ * Answers "which SQL sinks in this project actually receive tainted
+ * data?" — the deterministic answer an LLM cannot produce alone.
+ */
+import { z } from 'zod';
+import { resolve } from 'path';
+import { textResult } from './types.js';
+import { truncateArray, truncateString, MAX_FINDINGS } from '../util/serialize.js';
+export const listReachableSinksInputShape = {
+    project_root: z.string().describe('Absolute path to the project root.'),
+    sink_type: z.string().optional()
+        .describe('Restrict to this sink category (e.g. "sql_injection", "command_injection", "xss").'),
+    language: z.enum(['java', 'javascript', 'typescript', 'python', 'go', 'rust', 'bash', 'html'])
+        .optional()
+        .describe('Restrict to one language.'),
+    min_confidence: z.number().min(0).max(1).optional()
+        .describe('Minimum flow confidence to include (0.0 - 1.0). Defaults to include all.'),
+};
+export const listReachableSinksConfig = {
+    title: 'List reachable sinks (with taint flow)',
+    description: 'List every sink of the requested category that has an actual taint flow reaching it (per-file OR ' +
+        'cross-file). Sinks with no reaching flow are excluded — this is the crucial difference vs. plain ' +
+        '"list all method calls named `Runtime.exec`". Use before proposing fixes so the LLM only inspects ' +
+        'sinks that are truly reachable from attacker-controlled input.',
+    inputSchema: listReachableSinksInputShape,
+};
+export function makeListReachableSinksHandler(ctx) {
+    return async (args) => {
+        const root = resolve(args.project_root);
+        const { analysis, cacheHit } = await ctx.cache.getOrCompute(root, {});
+        const minLevel = args.min_confidence ?? 0;
+        const passesConfidence = (c) => {
+            if (c === undefined)
+                return true;
+            return c >= minLevel;
+        };
+        const reachable = [];
+        // Per-file taint flows.
+        for (const fa of analysis.files) {
+            const lang = fa.analysis.meta.language;
+            if (args.language && lang !== args.language)
+                continue;
+            for (const flow of fa.analysis.taint?.flows ?? []) {
+                if (args.sink_type && flow.sink_type !== args.sink_type)
+                    continue;
+                if (!passesConfidence(flow.confidence))
+                    continue;
+                reachable.push({
+                    file: fa.file,
+                    language: lang,
+                    sink_type: flow.sink_type,
+                    sink_line: flow.sink_line,
+                    source_type: flow.source_type,
+                    source_line: flow.source_line,
+                    confidence: flow.confidence,
+                    sanitized: flow.sanitized,
+                    scope: 'per-file',
+                });
+            }
+        }
+        // Cross-file taint paths (indexed on the analysis root).
+        for (const path of analysis.taint_paths) {
+            if (args.sink_type && path.sink.type !== args.sink_type)
+                continue;
+            // Language filter is best-effort: find the file's language via the sink file.
+            if (args.language) {
+                const fa = analysis.files.find((f) => f.file === path.sink.file);
+                if (!fa)
+                    continue;
+                if (fa.analysis.meta.language !== args.language)
+                    continue;
+            }
+            if (!passesConfidence(path.confidence))
+                continue;
+            reachable.push({
+                file: path.sink.file,
+                language: analysis.files.find((f) => f.file === path.sink.file)?.analysis.meta.language ?? 'unknown',
+                sink_type: path.sink.type,
+                sink_line: path.sink.line,
+                source_type: path.source.type,
+                source_line: path.source.line,
+                confidence: path.confidence,
+                scope: 'cross-file',
+                path_id: path.id,
+                path_hops: path.hops.length,
+                snippet: truncateString(path.sink.code, 512),
+            });
+        }
+        const byType = {};
+        const byLanguage = {};
+        for (const r of reachable) {
+            byType[r.sink_type] = (byType[r.sink_type] ?? 0) + 1;
+            byLanguage[r.language] = (byLanguage[r.language] ?? 0) + 1;
+        }
+        const { items, truncated, totalCount } = truncateArray(reachable, MAX_FINDINGS);
+        return textResult({
+            projectRoot: root,
+            cacheHit,
+            filters: {
+                sink_type: args.sink_type ?? 'any',
+                language: args.language ?? 'any',
+                min_confidence: args.min_confidence ?? 'any',
+            },
+            totalReachable: totalCount,
+            truncated,
+            bySinkType: byType,
+            byLanguage,
+            sinks: items,
+        });
+    };
+}
+//# sourceMappingURL=list-reachable-sinks.js.map

package/dist/tools/list-reachable-sinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-reachable-sinks.js","sourceRoot":"","sources":["../../src/tools/list-reachable-sinks.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEnF,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC7B,QAAQ,CAAC,oFAAoF,CAAC;IACjG,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;SAC3F,QAAQ,EAAE;SACV,QAAQ,CAAC,2BAA2B,CAAC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;SAChD,QAAQ,CAAC,0EAA0E,CAAC;CAC/E,CAAC;AAEX,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,KAAK,EAAE,wCAAwC;IAC/C,WAAW,EACT,mGAAmG;QACnG,mGAAmG;QACnG,oGAAoG;QACpG,gEAAgE;IAClE,WAAW,EAAE,4BAA4B;CACjC,CAAC;AAiBX,MAAM,UAAU,6BAA6B,CAAC,GAAgB;IAC5D,OAAO,KAAK,EAAE,IAKb,EAAuB,EAAE;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEtE,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;QAC1C,MAAM,gBAAgB,GAAG,CAAC,CAAU,EAAE,EAAE;YACtC,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,CAAC,IAAI,QAAQ,CAAC;QACvB,CAAC,CAAC;QAEF,MAAM,SAAS,GAAoB,EAAE,CAAC;QAEtC,wBAAwB;QACxB,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;YACvC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACtD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBAClD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;oBAAE,SAAS;gBAClE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;oBAAE,SAAS;gBACjD,SAAS,CAAC,IAAI,CAAC;oBACb,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,QAAQ,EAAE,IAAI;oBACd,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,KAAK,EAAE,UAAU;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS;gBAAE,SAAS;YAClE,8EAA8E;YAC9E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjE,IAAI,CAAC,EAAE;oBAAE,SAAS;gBAClB,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;oBAAE,SAAS;YAC5D,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;gBAAE,SAAS;YACjD,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACpB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS;gBACpG,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACzB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACzB,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBAC7B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;gBAC3B,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAEhF,OAAO,UAAU,CAAC;YAChB,WAAW,EAAE,IAAI;YACjB,QAAQ;YACR,OAAO,EAAE;gBACP,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK;gBAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;gBAChC,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,KAAK;aAC7C;YACD,cAAc,EAAE,UAAU;YAC1B,SAAS;YACT,UAAU,EAAE,MAAM;YAClB,UAAU;YACV,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/refresh.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `refresh` tool — manual cache invalidation. The server auto-invalidates
+ * on file mtime change, but callers may want to force a re-scan (e.g.
+ * after a git checkout or when developing analyzer rules).
+ */
+import { z } from 'zod';
+import type { ToolContext, ToolResult } from './types.js';
+export declare const refreshInputShape: {
+    readonly project_root: z.ZodOptional<z.ZodString>;
+};
+export declare const refreshConfig: {
+    readonly title: "Refresh analysis cache";
+    readonly description: string;
+    readonly inputSchema: {
+        readonly project_root: z.ZodOptional<z.ZodString>;
+    };
+};
+export declare function makeRefreshHandler(ctx: ToolContext): (args: {
+    project_root?: string;
+}) => Promise<ToolResult>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/tools/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/tools/refresh.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG1D,eAAO,MAAM,iBAAiB;;CAGpB,CAAC;AAEX,eAAO,MAAM,aAAa;;;;;;CAOhB,CAAC;AAEX,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,IACnC,MAAM;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,UAAU,CAAC,CAiBpE"}