@cognium/mcp-server 0.1.0

package/dist/util/files.js

@@ -0,0 +1,184 @@
+/**
+ * File collection + language detection utilities.
+ *
+ * A small standalone reimplementation so the MCP server does not depend on
+ * the CLI package. Mirrors the extension → language mapping from
+ * `packages/cli/src/cli.ts`.
+ */
+import { statSync, readdirSync, readFileSync } from 'fs';
+import { extname, join, resolve } from 'path';
+const LANG_MAP = {
+    '.java': 'java',
+    '.js': 'javascript',
+    '.jsx': 'javascript',
+    '.mjs': 'javascript',
+    '.cjs': 'javascript',
+    '.ts': 'typescript',
+    '.tsx': 'typescript',
+    '.py': 'python',
+    '.go': 'go',
+    '.rs': 'rust',
+    '.sh': 'bash',
+    '.bash': 'bash',
+    '.html': 'html',
+    '.htm': 'html',
+};
+/** Directories skipped during recursive collection. */
+const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    'coverage',
+    '.next',
+    '.nuxt',
+    'target',
+    '__pycache__',
+    '.venv',
+    'venv',
+    '.tox',
+    '.pytest_cache',
+]);
+export function detectLanguage(filePath) {
+    const ext = extname(filePath).toLowerCase();
+    return LANG_MAP[ext] ?? null;
+}
+/**
+ * Recursively collect source files under `root`. Skips hidden dirs,
+ * `node_modules`, build outputs, and language-mismatched files.
+ */
+export function collectFiles(root, opts = {}) {
+    const absRoot = resolve(root);
+    const out = [];
+    const maxFiles = opts.maxFiles ?? 10_000;
+    const st = statSync(absRoot);
+    if (st.isFile()) {
+        const lang = detectLanguage(absRoot);
+        if (lang && (!opts.language || lang === opts.language)) {
+            out.push({
+                filePath: absRoot,
+                language: lang,
+                code: readFileSync(absRoot, 'utf8'),
+                mtimeMs: st.mtimeMs,
+            });
+        }
+        return out;
+    }
+    const stack = [absRoot];
+    while (stack.length > 0 && out.length < maxFiles) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (entry.name.startsWith('.') && entry.name !== '.')
+                continue;
+            if (SKIP_DIRS.has(entry.name))
+                continue;
+            const p = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(p);
+            }
+            else if (entry.isFile()) {
+                const lang = detectLanguage(p);
+                if (!lang)
+                    continue;
+                if (opts.language && lang !== opts.language)
+                    continue;
+                let stf;
+                try {
+                    stf = statSync(p);
+                }
+                catch {
+                    continue;
+                }
+                try {
+                    out.push({
+                        filePath: p,
+                        language: lang,
+                        code: readFileSync(p, 'utf8'),
+                        mtimeMs: stf.mtimeMs,
+                    });
+                }
+                catch {
+                    // unreadable — skip
+                }
+                if (out.length >= maxFiles)
+                    break;
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Cheap mtime index used for cache invalidation. Same walking logic as
+ * `collectFiles` but skips reading file contents.
+ */
+export function indexMtimes(root, opts = {}) {
+    const absRoot = resolve(root);
+    const out = new Map();
+    const maxFiles = opts.maxFiles ?? 10_000;
+    let st;
+    try {
+        st = statSync(absRoot);
+    }
+    catch {
+        return out;
+    }
+    if (st.isFile()) {
+        if (detectLanguage(absRoot))
+            out.set(absRoot, st.mtimeMs);
+        return out;
+    }
+    const stack = [absRoot];
+    while (stack.length > 0 && out.size < maxFiles) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (entry.name.startsWith('.') && entry.name !== '.')
+                continue;
+            if (SKIP_DIRS.has(entry.name))
+                continue;
+            const p = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(p);
+            }
+            else if (entry.isFile()) {
+                const lang = detectLanguage(p);
+                if (!lang)
+                    continue;
+                if (opts.language && lang !== opts.language)
+                    continue;
+                try {
+                    out.set(p, statSync(p).mtimeMs);
+                }
+                catch {
+                    // ignore
+                }
+                if (out.size >= maxFiles)
+                    break;
+            }
+        }
+    }
+    return out;
+}
+export function mtimesEqual(a, b) {
+    if (a.size !== b.size)
+        return false;
+    for (const [k, v] of a) {
+        if (b.get(k) !== v)
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=files.js.map

package/dist/util/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/util/files.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAG9C,MAAM,QAAQ,GAAsC;IAClD,OAAO,EAAE,MAAM;IACf,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,MAAM;CACf,CAAC;AAEF,uDAAuD;AACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,OAAO;IACP,OAAO;IACP,QAAQ;IACR,aAAa;IACb,OAAO;IACP,MAAM;IACN,MAAM;IACN,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AAC/B,CAAC;AAgBD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAuB,EAAE;IAClE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;IAEzC,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;gBACnC,OAAO,EAAE,EAAE,CAAC,OAAO;aACpB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACzB,IAAI,OAA8B,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG;gBAAE,SAAS;YAC/D,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACtD,IAAI,GAAuB,CAAC;gBAC5B,IAAI,CAAC;oBACH,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC;oBACH,GAAG,CAAC,IAAI,CAAC;wBACP,QAAQ,EAAE,CAAC;wBACX,QAAQ,EAAE,IAAI;wBACd,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;wBAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,oBAAoB;gBACtB,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ;oBAAE,MAAM;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAuB,EAAE;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;IAEzC,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QAChB,IAAI,cAAc,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACzB,IAAI,OAA8B,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG;gBAAE,SAAS;YAC/D,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACtD,IAAI,CAAC;oBACH,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,GAAG,CAAC,IAAI,IAAI,QAAQ;oBAAE,MAAM;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAAsB,EAAE,CAAsB;IACxE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/util/serialize.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Size-bounded serialization helpers.
+ *
+ * MCP tool responses go into the LLM context window. Every response body
+ * must be capped so a large scan doesn't blow the client's context budget
+ * or exceed the MCP transport's message size limit.
+ */
+/** Max characters for any single string field surfaced in a tool response. */
+export declare const MAX_STRING_LEN = 2048;
+/** Max entries in an unpaginated `findings[]` before truncation. */
+export declare const MAX_FINDINGS = 500;
+/** Max entries in an unpaginated `taint_paths[]` before truncation. */
+export declare const MAX_TAINT_PATHS = 200;
+/** Max entries in an unpaginated `entry_points[]` before truncation. */
+export declare const MAX_ENTRY_POINTS = 500;
+/** Truncate a string to `MAX_STRING_LEN`, appending a marker. */
+export declare function truncateString(s: string | undefined, max?: number): string | undefined;
+/** Truncate an array, returning both the slice and a truncation marker. */
+export declare function truncateArray<T>(items: T[], max: number): {
+    items: T[];
+    truncated: boolean;
+    totalCount: number;
+};
+/**
+ * Compact JSON serialization for MCP `text` content blocks. Uses 2-space
+ * indent for LLM readability but keeps arrays inline for large collections.
+ */
+export declare function toJson(value: unknown): string;
+//# sourceMappingURL=serialize.d.ts.map

package/dist/util/serialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/util/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC,oEAAoE;AACpE,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC,uEAAuE;AACvE,eAAO,MAAM,eAAe,MAAM,CAAC;AAEnC,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,SAAiB,GAAG,MAAM,GAAG,SAAS,CAI9F;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG;IACzD,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CASA;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE7C"}

package/dist/util/serialize.js

@@ -0,0 +1,42 @@
+/**
+ * Size-bounded serialization helpers.
+ *
+ * MCP tool responses go into the LLM context window. Every response body
+ * must be capped so a large scan doesn't blow the client's context budget
+ * or exceed the MCP transport's message size limit.
+ */
+/** Max characters for any single string field surfaced in a tool response. */
+export const MAX_STRING_LEN = 2048;
+/** Max entries in an unpaginated `findings[]` before truncation. */
+export const MAX_FINDINGS = 500;
+/** Max entries in an unpaginated `taint_paths[]` before truncation. */
+export const MAX_TAINT_PATHS = 200;
+/** Max entries in an unpaginated `entry_points[]` before truncation. */
+export const MAX_ENTRY_POINTS = 500;
+/** Truncate a string to `MAX_STRING_LEN`, appending a marker. */
+export function truncateString(s, max = MAX_STRING_LEN) {
+    if (s === undefined || s === null)
+        return undefined;
+    if (s.length <= max)
+        return s;
+    return s.slice(0, max - 20) + '… [truncated]';
+}
+/** Truncate an array, returning both the slice and a truncation marker. */
+export function truncateArray(items, max) {
+    if (items.length <= max) {
+        return { items, truncated: false, totalCount: items.length };
+    }
+    return {
+        items: items.slice(0, max),
+        truncated: true,
+        totalCount: items.length,
+    };
+}
+/**
+ * Compact JSON serialization for MCP `text` content blocks. Uses 2-space
+ * indent for LLM readability but keeps arrays inline for large collections.
+ */
+export function toJson(value) {
+    return JSON.stringify(value, null, 2);
+}
+//# sourceMappingURL=serialize.js.map

package/dist/util/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../src/util/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,oEAAoE;AACpE,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC;AAEhC,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,CAAqB,EAAE,GAAG,GAAG,cAAc;IACxE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,GAAG,eAAe,CAAC;AAChD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAI,KAAU,EAAE,GAAW;IAKtD,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC1B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,KAAK,CAAC,MAAM;KACzB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC"}

package/dist/util/wasm.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WASM initialization for circle-ir in Node.js.
+ *
+ * Resolves the tree-sitter grammar files from the installed `circle-ir`
+ * package via `createRequire` so the server works regardless of npm
+ * hoisting layout.
+ */
+export declare function ensureAnalyzer(): Promise<void>;
+//# sourceMappingURL=wasm.d.ts.map

package/dist/util/wasm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasm.d.ts","sourceRoot":"","sources":["../../src/util/wasm.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAwBpD"}

package/dist/util/wasm.js

@@ -0,0 +1,37 @@
+/**
+ * WASM initialization for circle-ir in Node.js.
+ *
+ * Resolves the tree-sitter grammar files from the installed `circle-ir`
+ * package via `createRequire` so the server works regardless of npm
+ * hoisting layout.
+ */
+import { createRequire } from 'module';
+import { dirname, join } from 'path';
+import { initAnalyzer, isAnalyzerInitialized } from 'circle-ir';
+let initPromise = null;
+export async function ensureAnalyzer() {
+    if (isAnalyzerInitialized())
+        return;
+    if (initPromise)
+        return initPromise;
+    initPromise = (async () => {
+        const require = createRequire(import.meta.url);
+        const circleIrPkg = require.resolve('circle-ir/package.json');
+        const wasmBase = join(dirname(circleIrPkg), 'dist', 'wasm') + '/';
+        await initAnalyzer({
+            wasmPath: wasmBase + 'web-tree-sitter.wasm',
+            languagePaths: {
+                bash: wasmBase + 'tree-sitter-bash.wasm',
+                go: wasmBase + 'tree-sitter-go.wasm',
+                java: wasmBase + 'tree-sitter-java.wasm',
+                javascript: wasmBase + 'tree-sitter-javascript.wasm',
+                typescript: wasmBase + 'tree-sitter-javascript.wasm',
+                python: wasmBase + 'tree-sitter-python.wasm',
+                rust: wasmBase + 'tree-sitter-rust.wasm',
+                html: wasmBase + 'tree-sitter-html.wasm',
+            },
+        });
+    })();
+    return initPromise;
+}
+//# sourceMappingURL=wasm.js.map

package/dist/util/wasm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasm.js","sourceRoot":"","sources":["../../src/util/wasm.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEhE,IAAI,WAAW,GAAyB,IAAI,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,qBAAqB,EAAE;QAAE,OAAO;IACpC,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;QACxB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC;QAClE,MAAM,YAAY,CAAC;YACjB,QAAQ,EAAE,QAAQ,GAAG,sBAAsB;YAC3C,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ,GAAG,uBAAuB;gBACxC,EAAE,EAAE,QAAQ,GAAG,qBAAqB;gBACpC,IAAI,EAAE,QAAQ,GAAG,uBAAuB;gBACxC,UAAU,EAAE,QAAQ,GAAG,6BAA6B;gBACpD,UAAU,EAAE,QAAQ,GAAG,6BAA6B;gBACpD,MAAM,EAAE,QAAQ,GAAG,yBAAyB;gBAC5C,IAAI,EAAE,QAAQ,GAAG,uBAAuB;gBACxC,IAAI,EAAE,QAAQ,GAAG,uBAAuB;aACzC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@cognium/mcp-server",
+  "version": "0.1.0",
+  "description": "Model Context Protocol server exposing the circle-ir SAST engine as structured tools for LLM agents (Claude Desktop, Claude Code, Cursor, cognium-ai).",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "module",
+  "bin": {
+    "mcp-server-cognium-dev": "dist/index.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc && chmod +x dist/index.js",
+    "clean": "rm -rf dist *.tsbuildinfo",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "sast",
+    "security",
+    "static-analysis",
+    "taint-analysis",
+    "circle-ir",
+    "cognium",
+    "llm-tools",
+    "claude"
+  ],
+  "author": {
+    "name": "Cognium Labs",
+    "url": "https://cognium.dev"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cogniumhq/cognium-dev.git",
+    "directory": "packages/mcp-server"
+  },
+  "homepage": "https://github.com/cogniumhq/cognium-dev/tree/main/packages/mcp-server#readme",
+  "bugs": {
+    "url": "https://github.com/cogniumhq/cognium-dev/issues"
+  },
+  "engines": {
+    "node": ">=20.19.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "circle-ir": "4.9.9",
+    "yaml": "^2.8.3",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^25.5.0",
+    "typescript": "^6.0.2",
+    "vitest": "^4.1.2"
+  }
+}