@cubis/foundry 0.3.34 → 0.3.36

package/mcp/src/vault/scanner.test.ts

@@ -0,0 +1,70 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { scanVaultRoots } from "./scanner.js";
+
+const tempDirs: string[] = [];
+
+function createTempDir(prefix: string): string {
+  const dir = mkdtempSync(path.join(os.tmpdir(), prefix));
+  tempDirs.push(dir);
+  return dir;
+}
+
+function createSkill(root: string, id: string): void {
+  const skillDir = path.join(root, id);
+  mkdirSync(skillDir, { recursive: true });
+  writeFileSync(
+    path.join(skillDir, "SKILL.md"),
+    `---\nname: ${id}\ndescription: ${id} description\n---\n`,
+    "utf8",
+  );
+}
+
+afterEach(() => {
+  while (tempDirs.length > 0) {
+    const dir = tempDirs.pop();
+    if (dir) {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }
+});
+
+describe("scanVaultRoots", () => {
+  it("discovers skill pointers and derives categories from skill ids", async () => {
+    const root = createTempDir("mcp-vault-");
+    createSkill(root, "react-expert");
+    createSkill(root, "database-design");
+    createSkill(root, "custom-skill");
+
+    // Hidden directory should be skipped.
+    const hidden = path.join(root, ".hidden");
+    mkdirSync(hidden, { recursive: true });
+    writeFileSync(path.join(hidden, "SKILL.md"), "ignored", "utf8");
+
+    const skills = await scanVaultRoots([root], "/unused");
+    const byId = Object.fromEntries(
+      skills.map((skill) => [skill.id, skill.category]),
+    );
+
+    expect(skills).toHaveLength(3);
+    expect(byId["react-expert"]).toBe("frontend");
+    expect(byId["database-design"]).toBe("data");
+    expect(byId["custom-skill"]).toBe("general");
+  });
+
+  it("skips missing roots and continues scanning valid roots", async () => {
+    const validRoot = createTempDir("mcp-vault-valid-");
+    createSkill(validRoot, "qa-automation-engineer");
+
+    const skills = await scanVaultRoots(
+      ["/definitely/missing/root", validRoot],
+      "/unused",
+    );
+
+    expect(skills).toHaveLength(1);
+    expect(skills[0].id).toBe("qa-automation-engineer");
+    expect(skills[0].category).toBe("testing");
+  });
+});

package/mcp/src/vault/scanner.ts

@@ -0,0 +1,145 @@
+/**
+ * Cubis Foundry MCP Server – vault scanner.
+ *
+ * Startup scan: stores only category/name/path metadata (lazy – no full SKILL.md read).
+ * Description extraction is deferred to browse/search operations.
+ */
+
+import { readdir, stat } from "node:fs/promises";
+import path from "node:path";
+import { logger } from "../utils/logger.js";
+import type { SkillPointer } from "./types.js";
+
+/**
+ * Scan vault root directories for SKILL.md files.
+ * Returns metadata-only pointers; does NOT read file content.
+ */
+export async function scanVaultRoots(
+  roots: string[],
+  basePath: string,
+): Promise<SkillPointer[]> {
+  const skills: SkillPointer[] = [];
+
+  for (const rootRel of roots) {
+    const rootAbs = path.resolve(basePath, rootRel);
+    let entries: string[];
+    try {
+      entries = await readdir(rootAbs);
+    } catch {
+      logger.warn(`Vault root not found, skipping: ${rootAbs}`);
+      continue;
+    }
+
+    for (const entry of entries) {
+      if (entry.startsWith(".")) continue;
+      const entryPath = path.join(rootAbs, entry);
+      const entryStat = await stat(entryPath).catch(() => null);
+      if (!entryStat?.isDirectory()) continue;
+
+      const skillFile = path.join(entryPath, "SKILL.md");
+      const skillStat = await stat(skillFile).catch(() => null);
+      if (!skillStat?.isFile()) continue;
+
+      // Derive category from the skill's frontmatter or default to "general"
+      // At scan time we only store the path; category is derived from directory structure
+      skills.push({
+        id: entry,
+        category: deriveCategory(entry),
+        path: skillFile,
+      });
+    }
+  }
+
+  logger.info(`Vault scan complete: ${skills.length} skills discovered`);
+  return skills;
+}
+
+/**
+ * Simple category derivation from skill ID conventions.
+ * Skills with common prefixes are grouped together.
+ */
+function deriveCategory(skillId: string): string {
+  const categoryMap: Record<string, string> = {
+    flutter: "mobile",
+    drift: "mobile",
+    gorouter: "mobile",
+    riverpod: "mobile",
+    react: "frontend",
+    next: "frontend",
+    nextjs: "frontend",
+    tailwind: "frontend",
+    vue: "frontend",
+    frontend: "frontend",
+    nestjs: "backend",
+    fastapi: "backend",
+    fastify: "backend",
+    nodejs: "backend",
+    golang: "backend",
+    rust: "backend",
+    python: "backend",
+    javascript: "backend",
+    typescript: "backend",
+    java: "backend",
+    kotlin: "backend",
+    csharp: "backend",
+    database: "data",
+    graphql: "data",
+    api: "api",
+    openapi: "api",
+    devops: "devops",
+    terraform: "devops",
+    deployment: "devops",
+    vercel: "devops",
+    security: "security",
+    penetration: "security",
+    "red-team": "security",
+    vulnerability: "security",
+    secure: "security",
+    test: "testing",
+    playwright: "testing",
+    qa: "testing",
+    tdd: "testing",
+    "find-bugs": "testing",
+    "fix-review": "testing",
+    monitoring: "observability",
+    sentry: "observability",
+    datadog: "observability",
+    performance: "performance",
+    "web-perf": "performance",
+    git: "tooling",
+    lint: "tooling",
+    cli: "tooling",
+    "clean-code": "practices",
+    plan: "practices",
+    brainstorm: "practices",
+    behavioral: "practices",
+    refactor: "practices",
+    architecture: "architecture",
+    microservices: "architecture",
+    "design-system": "design",
+    "mobile-design": "design",
+    "ui-ux": "design",
+    "web-design": "design",
+    "ux-ui": "design",
+    accessibility: "design",
+    documentation: "documentation",
+    "code-documenter": "documentation",
+    changelog: "documentation",
+    game: "game-dev",
+    seo: "marketing",
+    geo: "marketing",
+    i18n: "localization",
+    mcp: "mcp",
+    prompt: "ai",
+    "vercel-ai": "ai",
+    stripe: "payments",
+    saas: "saas",
+  };
+
+  // Match longest prefix first
+  const lower = skillId.toLowerCase();
+  for (const [prefix, category] of Object.entries(categoryMap)) {
+    if (lower.startsWith(prefix)) return category;
+  }
+  return "general";
+}

package/mcp/src/vault/types.ts

@@ -0,0 +1,21 @@
+/**
+ * Cubis Foundry MCP Server – vault types.
+ */
+
+export interface SkillPointer {
+  /** Skill identifier (directory name). */
+  id: string;
+  /** Category derived from parent directory or frontmatter. */
+  category: string;
+  /** Absolute path to the SKILL.md file. */
+  path: string;
+  /** Short description extracted from frontmatter (truncated). */
+  description?: string;
+}
+
+export interface VaultManifest {
+  /** All categories discovered. */
+  categories: string[];
+  /** All skill pointers (metadata only – no full content). */
+  skills: SkillPointer[];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cubis/foundry",
-  "version": "0.3.34",
+  "version": "0.3.36",
   "description": "Cubis Foundry CLI for workflow-first AI agent environments",
   "type": "module",
   "bin": {
@@ -11,7 +11,13 @@
   "files": [
     "bin",
     "workflows",
-    "mcp",
+    "mcp/dist",
+    "mcp/config.json",
+    "mcp/package.json",
+    "mcp/README.md",
+    "mcp/Dockerfile",
+    "mcp/.dockerignore",
+    "mcp/src",
     "README.md",
     "CHANGELOG.md"
   ],
@@ -22,6 +28,7 @@
     "test:attributes:strict": "node scripts/validate-platform-attributes.mjs --strict",
     "test:tech-md": "node scripts/test-tech-md-scanner.mjs",
     "test:smoke": "bash scripts/smoke-workflows.sh",
+    "test:mcp:docker": "bash scripts/test-mcp-docker.sh",
     "test:all": "npm run test:attributes && npm run test:smoke",
     "test:all:strict": "npm run test:attributes:strict && npm run test:smoke",
     "generate:platform-assets": "node scripts/generate-platform-assets.mjs",

package/workflows/scripts/generate-powers.mjs

@@ -20,13 +20,8 @@ const ROOT_PAIRS = [
   {
     label: "workflows",
     skillsRoot: path.join(ROOT, "workflows", "skills"),
-    powersRoot: path.join(ROOT, "workflows", "powers")
+    powersRoot: path.join(ROOT, "workflows", "powers"),
   },
-  {
-    label: "mcp",
-    skillsRoot: path.join(ROOT, "mcp", "skills"),
-    powersRoot: path.join(ROOT, "mcp", "powers")
-  }
 ];
 
 const ARGS = new Set(process.argv.slice(2));
@@ -36,7 +31,7 @@ const FROM_SKILLS = ARGS.has("--from-skills");
 const SYNC_SKILLS = ARGS.has("--sync-skills");
 
 const KIRO_REQUIRED_KEYS = {
-  inclusion: "manual"
+  inclusion: "manual",
 };
 
 async function pathExists(p) {
@@ -85,7 +80,7 @@ function parseFrontmatter(markdown) {
   if (!match) return null;
   return {
     frontmatterRaw: match[1],
-    body: match[2]
+    body: match[2],
   };
 }
 
@@ -138,7 +133,7 @@ async function processPowerDir(pair, powerName) {
       name: powerName,
       result: "skip",
       reason: "no SKILL.md found in skills/ or powers/",
-      pair: pair.label
+      pair: pair.label,
     };
   }
 
@@ -148,7 +143,7 @@ async function processPowerDir(pair, powerName) {
       name: powerName,
       result: "skip",
       reason: "POWER.md already exists (use --force to overwrite)",
-      pair: pair.label
+      pair: pair.label,
     };
   }
 
@@ -160,7 +155,7 @@ async function processPowerDir(pair, powerName) {
     name: powerName,
     result: powerExists ? "updated" : "created",
     source: path.relative(ROOT, skillSource),
-    pair: pair.label
+    pair: pair.label,
   };
 }
 
@@ -169,7 +164,8 @@ async function syncFromSkills(pair) {
   const created = [];
 
   for (const name of skillDirs) {
-    if (name.startsWith(".") || name.endsWith(".json") || name.endsWith(".md")) continue;
+    if (name.startsWith(".") || name.endsWith(".json") || name.endsWith(".md"))
+      continue;
 
     const powerDir = path.join(pair.powersRoot, name);
     const skillDir = path.join(pair.skillsRoot, name);
@@ -214,7 +210,9 @@ async function syncSkillsToPowers(pair) {
     }
 
     const canonicalContent = await readUtf8(canonicalSkill);
-    const existingContent = (await pathExists(powerSkill)) ? await readUtf8(powerSkill) : null;
+    const existingContent = (await pathExists(powerSkill))
+      ? await readUtf8(powerSkill)
+      : null;
 
     if (existingContent === canonicalContent) {
       unchanged.push(name);
@@ -232,14 +230,19 @@ async function main() {
   const pairResults = [];
 
   for (const pair of ROOT_PAIRS) {
-    if (!(await pathExists(pair.skillsRoot)) && !(await pathExists(pair.powersRoot))) {
+    if (
+      !(await pathExists(pair.skillsRoot)) &&
+      !(await pathExists(pair.powersRoot))
+    ) {
       continue;
     }
 
     if (FROM_SKILLS) {
       const created = await syncFromSkills(pair);
       if (created.length > 0) {
-        console.log(`${DRY_RUN ? "[dry-run] " : ""}Created ${created.length} missing powers from ${pair.label}/skills:`);
+        console.log(
+          `${DRY_RUN ? "[dry-run] " : ""}Created ${created.length} missing powers from ${pair.label}/skills:`,
+        );
         for (const name of created) {
           console.log(`  + ${pair.label}/${name}`);
         }
@@ -249,10 +252,14 @@ async function main() {
     if (SYNC_SKILLS) {
       const syncResult = await syncSkillsToPowers(pair);
       if (syncResult.synced.length > 0) {
-        console.log(`${DRY_RUN ? "[dry-run] " : ""}Synced ${syncResult.synced.length} SKILL.md files from ${pair.label}/skills to ${pair.label}/powers`);
+        console.log(
+          `${DRY_RUN ? "[dry-run] " : ""}Synced ${syncResult.synced.length} SKILL.md files from ${pair.label}/skills to ${pair.label}/powers`,
+        );
       }
       if (syncResult.missing.length > 0) {
-        console.log(`Skipping ${syncResult.missing.length} ${pair.label}/powers entries with no canonical ${pair.label}/skills source.`);
+        console.log(
+          `Skipping ${syncResult.missing.length} ${pair.label}/powers entries with no canonical ${pair.label}/skills source.`,
+        );
       }
     }
 
@@ -282,7 +289,9 @@ async function main() {
   console.log(`  Skipped: ${skipped.length}`);
 
   for (const result of [...created, ...updated]) {
-    console.log(`  ${result.result === "created" ? "+" : "~"} [${result.pair}] ${result.name} (${result.source})`);
+    console.log(
+      `  ${result.result === "created" ? "+" : "~"} [${result.pair}] ${result.name} (${result.source})`,
+    );
   }
 
   if (skipped.length > 0) {

package/workflows/skills/postman/SKILL.md

@@ -1,18 +1,17 @@
 ---
-name: "postman"
-description: "Compatibility wrapper skill. Canonical MCP skill moved to mcp/skills/postman."
-metadata:
-  deprecated: true
-  replaced_by: "postman"
-  moved_to: "mcp/skills/postman/SKILL.md"
-  removal_target: "v0.6.0"
+name: postman
+description: Automate API testing and collection management with Postman MCP. Use for workspace, collection, environment, and mock operations.
 ---
 
-# postman (Compatibility Wrapper)
+# Postman MCP
 
-This legacy workflow-path skill is kept for backward compatibility.
+Use this skill when you need to work with Postman through MCP tools.
 
-Canonical MCP skill path:
-- mcp/skills/postman/SKILL.md
+## Required Environment Variables
 
-Install MCP skills with: cbx workflows install --include-mcp
+- `POSTMAN_API_KEY_<PROFILE>` for authenticated Postman access.
+
+## Notes
+
+- Use environment variables for secrets. Do not inline API keys.
+- Prefer tool discovery (`getEnabledTools`) before making assumptions about available tool sets.

package/workflows/skills/skills_index.json

@@ -69,29 +69,6 @@
     "description": "Clarify requirements before implementing. Use when serious doubts arise.",
     "triggers": []
   },
-  {
-    "id": "atlassian-mcp",
-    "name": "atlassian-mcp",
-    "canonical_id": "atlassian-mcp",
-    "deprecated": false,
-    "replaced_by": null,
-    "path": ".agents/skills/atlassian-mcp/SKILL.md",
-    "description": "Use when querying Jira issues, searching Confluence pages, creating tickets, updating documentation, or integrating Atlassian tools via MCP protocol.",
-    "triggers": [
-      "Jira",
-      "Confluence",
-      "Atlassian",
-      "MCP",
-      "tickets",
-      "issues",
-      "wiki",
-      "JQL",
-      "CQL",
-      "sprint",
-      "backlog",
-      "project management"
-    ]
-  },
   {
     "id": "bash-linux",
     "name": "bash-linux",
@@ -122,16 +99,6 @@
     "description": "Socratic questioning protocol + user communication. MANDATORY for complex requests, new features, or unclear requirements. Includes progress reporting and error handling.",
     "triggers": []
   },
-  {
-    "id": "building-mcp-server-on-cloudflare",
-    "name": "building-mcp-server-on-cloudflare",
-    "canonical_id": "building-mcp-server-on-cloudflare",
-    "deprecated": false,
-    "replaced_by": null,
-    "path": ".agents/skills/building-mcp-server-on-cloudflare/SKILL.md",
-    "description": "Build and deploy remote MCP servers on Cloudflare Workers with tools, OAuth authentication, and production configuration.",
-    "triggers": []
-  },
   {
     "id": "changelog-generator",
     "name": "changelog-generator",
@@ -254,16 +221,6 @@
       "cache"
     ]
   },
-  {
-    "id": "datadog-automation",
-    "name": "datadog-automation",
-    "canonical_id": "datadog-automation",
-    "deprecated": false,
-    "replaced_by": null,
-    "path": ".agents/skills/datadog-automation/SKILL.md",
-    "description": "Automate Datadog tasks via Rube MCP (Composio): query metrics, search logs, manage monitors/dashboards, create events and downtimes. Always search tools first for current schemas.",
-    "triggers": []
-  },
   {
     "id": "debugging-wizard",
     "name": "debugging-wizard",
@@ -481,16 +438,6 @@
     "description": "Create conventional commits with intelligent staging and message generation",
     "triggers": []
   },
-  {
-    "id": "github-automation",
-    "name": "github-automation",
-    "canonical_id": "github-automation",
-    "deprecated": false,
-    "replaced_by": null,
-    "path": ".agents/skills/github-automation/SKILL.md",
-    "description": "Automate GitHub repositories, issues, pull requests, branches, CI/CD, and permissions via Rube MCP (Composio). Manage code workflows, review PRs, search code, and handle deployments programmatically.",
-    "triggers": []
-  },
   {
     "id": "golang-pro",
     "name": "golang-pro",
@@ -610,35 +557,6 @@
     "description": "Automatic quality control, linting, and static analysis procedures. Use after every code modification to ensure syntax correctness and project standards. Triggers: lint, format, check, validate, types, static analysis.",
     "triggers": []
   },
-  {
-    "id": "mcp-builder",
-    "name": "mcp-builder",
-    "canonical_id": "mcp-builder",
-    "deprecated": false,
-    "replaced_by": null,
-    "path": ".agents/skills/mcp-builder/SKILL.md",
-    "description": "MCP (Model Context Protocol) server building principles. Tool design, resource patterns, best practices.",
-    "triggers": []
-  },
-  {
-    "id": "mcp-developer",
-    "name": "mcp-developer",
-    "canonical_id": "mcp-developer",
-    "deprecated": false,
-    "replaced_by": null,
-    "path": ".agents/skills/mcp-developer/SKILL.md",
-    "description": "Use for implementing, debugging, and maintaining MCP servers/clients with SDKs, protocol compliance, transports, schemas, and security hardening.",
-    "triggers": [
-      "MCP",
-      "Model Context Protocol",
-      "MCP server",
-      "MCP client",
-      "Claude integration",
-      "AI tools",
-      "context protocol",
-      "JSON-RPC"
-    ]
-  },
   {
     "id": "microservices-architect",
     "name": "microservices-architect",
@@ -830,7 +748,7 @@
     "deprecated": false,
     "replaced_by": null,
     "path": ".agents/skills/postman/SKILL.md",
-    "description": "Automate API testing and collection management with Postman - create workspaces, collections, environments, and run tests programmatically",
+    "description": "Automate API testing and collection management with Postman MCP. Use for workspace, collection, environment, and mock operations.",
     "triggers": []
   },
   {
@@ -1004,16 +922,6 @@
     "description": "Run Semgrep static analysis scan on a codebase using parallel subagents. Automatically",
     "triggers": []
   },
-  {
-    "id": "sentry-automation",
-    "name": "sentry-automation",
-    "canonical_id": "sentry-automation",
-    "deprecated": false,
-    "replaced_by": null,
-    "path": ".agents/skills/sentry-automation/SKILL.md",
-    "description": "Automate Sentry tasks via Rube MCP (Composio): manage issues/events, configure alerts, track releases, monitor projects and teams. Always search tools first for current schemas.",
-    "triggers": []
-  },
   {
     "id": "seo-fundamentals",
     "name": "seo-fundamentals",
@@ -1082,6 +990,16 @@
     "description": "Runs CodeQL-based static security analysis (database build, query pack selection, and SARIF results) for vulnerability discovery and audits. Not for custom QL authoring or CI/CD setup.",
     "triggers": []
   },
+  {
+    "id": "stitch",
+    "name": "stitch",
+    "canonical_id": "stitch",
+    "deprecated": false,
+    "replaced_by": null,
+    "path": ".agents/skills/stitch/SKILL.md",
+    "description": "Automate Stitch workflows through Stitch MCP using mcp-remote transport.",
+    "triggers": []
+  },
   {
     "id": "stripe-best-practices",
     "name": "stripe-best-practices",

package/workflows/skills/stitch/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: stitch
+description: Automate Stitch workflows through Stitch MCP using mcp-remote transport.
+---
+
+# Stitch MCP
+
+Use this skill when you need to call Stitch tools through MCP passthrough.
+
+## Required Environment Variables
+
+- `STITCH_API_KEY_<PROFILE>` for Stitch API-key mode.
+
+## Notes
+
+- Stitch transport uses `mcp-remote` to `https://stitch.googleapis.com/mcp`.
+- Inject `X-Goog-Api-Key` from environment at runtime. Do not store raw keys in config files.