@elixium.ai/mcp-server 0.3.6 → 0.5.0

package/README.md

@@ -125,6 +125,30 @@ If you're using multiple MCP servers, combine them in the same config:
 > If you set `ELIXIUM_BOARD_SLUG`, the MCP server will only read/write stories for that board.
 > The server resolves the board slug to a boardId on startup, so the slug must match an existing board.
 
+## Required Scopes (for Scoped API Keys)
+
+If you generate a **scoped** API key (via the Command Center → Integrations → *Advanced: Key Scopes*), the key must include the scopes below to use the corresponding MCP tools. An **unscoped** key (all scopes picker collapsed when generating) has full access and works with every tool.
+
+| Tool category | Tools | Required scopes |
+|---|---|---|
+| **Read stories** | `list_stories`, `get_story`, `get_iteration_context`, `prepare_implementation`, `estimate_cost` | `stories:read` |
+| **Write stories** | `create_story`, `update_story`, `start_story`, `propose_test_plan`, `submit_for_review`, `record_learning`, `create_hypothesis` | `stories:read` + `stories:write` |
+| **Read epics** | `list_epics`, `get_epic_cost_rollup` | `epics:read` |
+| **Write epics** | `create_epic`, `update_epic`, `prioritize_epic` | `epics:read` + `epics:write` |
+| **Read boards** | `list_boards`, `select_board` | `boards:read` |
+| **Write boards** | `create_board` | `boards:read` + `boards:write` |
+| **Read workspace config** | `get_feature_config`, `get_infrastructure_profile` | `workspace:read` |
+| **Team decisions** | `list_decisions`, `search_decisions` | `stories:read` |
+| **Team decisions (write)** | `record_decision` | `stories:read` + `stories:write` |
+| **Objectives** | `list_objectives` | `stories:read` |
+
+**Recommended baseline for full MCP functionality:**
+```
+stories:read, stories:write, epics:read, epics:write, boards:read, workspace:read
+```
+
+If a scoped key is missing a scope, the MCP server surfaces an actionable error message naming the missing scope and directing you to regenerate the key with the required scope. You do NOT need to restart the MCP server after regenerating — just update `ELIXIUM_API_KEY` in your config and reload the server.
+
 ## Usage
 Once configured, your AI agent will have access to tools like:
 - `list_stories` - View all stories on the board

package/dist/board-context.js

@@ -0,0 +1,111 @@
+/**
+ * Board context management for multi-board MCP support.
+ *
+ * Provides runtime board selection that overrides the static
+ * ELIXIUM_BOARD_SLUG env var. All board-aware tools (list_stories,
+ * create_story, list_epics, etc.) use getActiveBoardSlug() to
+ * determine which board to operate on.
+ */
+// Runtime-selected board slug (overrides env var when set)
+let runtimeBoardSlug = null;
+let runtimeBoardId = null;
+/**
+ * Get the active board slug, preferring runtime selection over env var.
+ */
+export const getActiveBoardSlug = (envSlug) => {
+    if (runtimeBoardSlug)
+        return runtimeBoardSlug;
+    if (!envSlug)
+        return null;
+    const normalized = envSlug.trim().toLowerCase();
+    return normalized.length > 0 ? normalized : null;
+};
+/**
+ * Get the runtime-selected board ID (if select_board was called).
+ */
+export const getRuntimeBoardId = () => runtimeBoardId;
+/**
+ * Select a board by slug. Validates that the board exists via API.
+ * Returns the matched board or throws if not found.
+ */
+export const selectBoard = async (client, slug) => {
+    const normalized = slug.trim().toLowerCase();
+    if (!normalized) {
+        throw new Error("Board slug cannot be empty");
+    }
+    const response = await client.get("/boards");
+    const boards = Array.isArray(response.data) ? response.data : [];
+    const match = boards.find((b) => {
+        if (typeof b?.slug !== "string")
+            return false;
+        return b.slug.trim().toLowerCase() === normalized;
+    });
+    if (!match?.id) {
+        const available = boards
+            .filter((b) => !b.is_archived)
+            .map((b) => b.slug)
+            .join(", ");
+        throw new Error(`Board "${slug}" not found. Available boards: ${available || "none"}`);
+    }
+    runtimeBoardSlug = normalized;
+    runtimeBoardId = match.id;
+    return normalizeBoardResponse(match);
+};
+/**
+ * List all boards for the current workspace.
+ */
+export const listBoards = async (client, opts) => {
+    const response = await client.get("/boards");
+    let boards = Array.isArray(response.data) ? response.data : [];
+    if (!opts?.includeArchived) {
+        boards = boards.filter((b) => !b.is_archived);
+    }
+    const summaries = boards.map((b) => normalizeBoardResponse(b));
+    // Mark the currently selected board
+    const activeSlug = getActiveBoardSlug();
+    for (const board of summaries) {
+        if (activeSlug && board.slug === activeSlug) {
+            board.selected = true;
+        }
+    }
+    return { boards: summaries };
+};
+/**
+ * Create a new board via API.
+ */
+export const createBoard = async (client, args) => {
+    const name = args.name?.trim();
+    if (!name) {
+        throw new Error("Board name cannot be empty");
+    }
+    const slug = args.slug?.trim().toLowerCase() ||
+        name
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, "-")
+            .replace(/^-|-$/g, "");
+    const response = await client.post("/boards", {
+        name,
+        slug,
+        description: args.description || "",
+    });
+    return normalizeBoardResponse(response.data);
+};
+/**
+ * Reset runtime board selection (for testing).
+ */
+export const resetBoardContext = () => {
+    runtimeBoardSlug = null;
+    runtimeBoardId = null;
+};
+/**
+ * Normalize API board response to BoardSummary.
+ */
+const normalizeBoardResponse = (raw) => ({
+    id: raw.id,
+    slug: raw.slug,
+    name: raw.name,
+    description: raw.description || "",
+    isArchived: raw.is_archived ?? raw.isArchived ?? false,
+    createdAt: raw.created_at ?? raw.createdAt ?? "",
+    ...(raw.storyCount != null ? { storyCount: raw.storyCount } : {}),
+});

package/dist/constants/workflowModelLabels.js

@@ -0,0 +1,59 @@
+/**
+ * Canonical workflow model labels for MCP tool responses.
+ *
+ * Story 69c3a615 — surfaces the active workflow model in `start_story` and
+ * `submit_for_review` responses so agents (and through them, users) know
+ * what state transitions to expect. Story 79f641d5 (Team Profile UI) will
+ * import the same constants to keep terminology aligned across layers.
+ *
+ * AC: "model name matches the Team Profile UI's label exactly (no
+ * terminology drift between layers)" — this module is the single source.
+ */
+export const WORKFLOW_MODEL_NAMES = {
+    /** Pivotal-style 4-state model with explicit `delivered` step. */
+    pivotal4State: "4-state (Pivotal)",
+    /** Trunk-based 3-state model — no delivered step, finished → accepted. */
+    trunk3State: "3-state (simple)",
+};
+/** Per-state parenthetical explanations under each model. */
+export const WORKFLOW_MODEL_STATE_EXPLANATION = {
+    pivotal4State: {
+        delivered: "work is on main, awaiting acceptance",
+        finished: "PR pending merge, advances to delivered when merged",
+    },
+    trunk3State: {
+        finished: "story moves directly to accepted on human review",
+    },
+};
+/** At-start (no state yet) explanations — used by `start_story`. */
+export const WORKFLOW_MODEL_START_EXPLANATION = {
+    pivotal4State: "submit will set delivered (auto-merge) or finished (PR pending)",
+    trunk3State: "submit advances to finished, accept moves to accepted",
+};
+/**
+ * Formats the canonical "Workflow Model:" line for MCP tool responses.
+ *
+ * Examples:
+ *   { useDeliveredState: true, state: "delivered" }
+ *     → "4-state (Pivotal — work is on main, awaiting acceptance)"
+ *   { useDeliveredState: false, state: "finished" }
+ *     → "3-state (simple — story moves directly to accepted on human review)"
+ *   { useDeliveredState: true } (no state — start_story case)
+ *     → "4-state (Pivotal — submit will set delivered (auto-merge) or finished (PR pending))"
+ *
+ * Single-line output guarantee: the returned string never contains a newline
+ * — callers can safely interpolate it as one row in a markdown response.
+ */
+export function formatWorkflowModelLine(args) {
+    const modelKey = args.useDeliveredState ? "pivotal4State" : "trunk3State";
+    const baseName = args.useDeliveredState ? "4-state" : "3-state";
+    const typeLabel = args.useDeliveredState ? "Pivotal" : "simple";
+    let explanation = WORKFLOW_MODEL_START_EXPLANATION[modelKey];
+    if (args.state) {
+        const stateExplanations = WORKFLOW_MODEL_STATE_EXPLANATION[modelKey];
+        const found = stateExplanations[args.state];
+        if (found)
+            explanation = found;
+    }
+    return `${baseName} (${typeLabel} — ${explanation})`;
+}

package/dist/index.js

@@ -5,6 +5,9 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import axios from "axios";
 import * as http from "node:http";
+import { CREATE_STORY_INPUT_SCHEMA, UPDATE_STORY_INPUT_SCHEMA, GET_STAKEHOLDERS_INPUT_SCHEMA, PROPOSE_FIELD_DRAFT_INPUT_SCHEMA, ENDORSE_PROPOSAL_INPUT_SCHEMA, REJECT_PROPOSAL_INPUT_SCHEMA, DRAFT_HYPOTHESIS_INPUT_SCHEMA, GET_TRUST_LEAKAGE_INPUT_SCHEMA, } from "./toolSchemas.js";
+import { deriveStakeholders } from "./stakeholders.js";
+import { formatWorkflowModelLine } from "./constants/workflowModelLabels.js";
 const API_KEY = process.env.ELIXIUM_API_KEY;
 const API_URL = process.env.ELIXIUM_API_URL || "https://elixium.ai/api";
 const BOARD_SLUG = process.env.ELIXIUM_BOARD_SLUG;
@@ -44,6 +47,7 @@ const SSE_PATH = ensurePath(getArgValue("--sse-path") ?? process.env.ELIXIUM_MCP
 const MESSAGE_PATH = ensurePath(getArgValue("--message-path") ??
     process.env.ELIXIUM_MCP_MESSAGE_PATH ??
     "/message", "/message");
+import { listBoards, createBoard, selectBoard, getActiveBoardSlug, getRuntimeBoardId, } from "./board-context.js";
 import * as fs from "fs";
 import * as path from "path";
 import { fileURLToPath } from "url";
@@ -98,6 +102,119 @@ const client = axios.create({
         ...(BOARD_SLUG ? { "x-board-slug": BOARD_SLUG } : {}),
     },
 });
+// ── Contract Scanning for prepare_implementation ──
+const CONTRACT_STOP_WORDS = new Set([
+    "the", "a", "an", "is", "are", "was", "were", "be", "been", "being",
+    "have", "has", "had", "do", "does", "did", "will", "would", "could",
+    "should", "may", "might", "shall", "can", "for", "and", "nor", "but",
+    "or", "yet", "so", "in", "on", "at", "to", "of", "by", "with", "from",
+    "up", "about", "into", "through", "during", "before", "after", "above",
+    "below", "between", "out", "off", "over", "under", "again", "further",
+    "then", "once", "here", "there", "when", "where", "why", "how", "all",
+    "each", "every", "both", "few", "more", "most", "other", "some", "such",
+    "no", "not", "only", "own", "same", "than", "too", "very", "just",
+    "because", "as", "until", "while", "that", "this", "these", "those",
+    "it", "its", "we", "they", "add", "update", "fix", "implement", "create",
+    "new", "remove", "change", "make", "use", "set", "get", "check", "ensure",
+    "story", "feature", "bug", "chore", "task",
+]);
+function extractKeywords(title, description = "") {
+    const text = `${title} ${description}`.toLowerCase();
+    const words = text
+        .replace(/[^a-z0-9\s-]/g, " ")
+        .split(/\s+/)
+        .filter((w) => w.length > 2 && !CONTRACT_STOP_WORDS.has(w));
+    return [...new Set(words)];
+}
+function categorizeMatch(content) {
+    if (/\b(create|generate|produce|emit|publish|write|return|send|build|insert)\b/i.test(content))
+        return "producer";
+    if (/\b(consume|read|validate|verify|import|parse|receive|fetch|load|decode|check)\b/i.test(content))
+        return "consumer";
+    return "reference";
+}
+function scanCodebaseForContracts(keywords, cwd) {
+    if (keywords.length === 0)
+        return [];
+    const matches = [];
+    const searchDirs = ["app", "backend/api/src", "mcp-server/src", "components"].map(d => path.join(cwd, d));
+    const extensions = new Set([".ts", ".tsx", ".js", ".jsx"]);
+    const maxMatches = 50;
+    function searchDir(dir) {
+        if (matches.length >= maxMatches)
+            return;
+        try {
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                if (matches.length >= maxMatches)
+                    return;
+                const fullPath = path.join(dir, entry.name);
+                if (entry.isDirectory()) {
+                    if (entry.name === "node_modules" || entry.name === ".next" || entry.name === "dist")
+                        continue;
+                    searchDir(fullPath);
+                }
+                else if (extensions.has(path.extname(entry.name))) {
+                    try {
+                        const content = fs.readFileSync(fullPath, "utf-8");
+                        const lines = content.split("\n");
+                        for (let i = 0; i < lines.length && matches.length < maxMatches; i++) {
+                            const line = lines[i];
+                            const lineLower = line.toLowerCase();
+                            if (keywords.some((kw) => lineLower.includes(kw))) {
+                                const trimmed = line.trim();
+                                if (trimmed.length > 0 && !trimmed.startsWith("//") && !trimmed.startsWith("*")) {
+                                    matches.push({
+                                        file: path.relative(cwd, fullPath),
+                                        line: i + 1,
+                                        content: trimmed.substring(0, 200),
+                                        role: categorizeMatch(trimmed),
+                                    });
+                                }
+                            }
+                        }
+                    }
+                    catch { /* skip unreadable files */ }
+                }
+            }
+        }
+        catch { /* skip inaccessible dirs */ }
+    }
+    for (const dir of searchDirs) {
+        if (fs.existsSync(dir))
+            searchDir(dir);
+    }
+    return matches;
+}
+function formatContractsSection(matches) {
+    if (matches.length === 0) {
+        return "\n## Integration Contracts\nNo downstream consumers detected.\n";
+    }
+    const producers = matches.filter((m) => m.role === "producer");
+    const consumers = matches.filter((m) => m.role === "consumer");
+    const references = matches.filter((m) => m.role === "reference");
+    let section = "\n## Integration Contracts\n\nThis story touches systems with upstream/downstream dependencies:\n";
+    if (producers.length > 0) {
+        section += "\n**Produces (writes/creates/returns):**\n";
+        for (const p of producers.slice(0, 10)) {
+            section += `- \`${p.file}:${p.line}\` — ${p.content}\n`;
+        }
+    }
+    if (consumers.length > 0) {
+        section += "\n**Consumed by (reads/validates/imports):**\n";
+        for (const c of consumers.slice(0, 10)) {
+            section += `- \`${c.file}:${c.line}\` — ${c.content}\n`;
+        }
+    }
+    if (references.length > 0 && producers.length + consumers.length < 5) {
+        section += "\n**Other references:**\n";
+        for (const r of references.slice(0, 5)) {
+            section += `- \`${r.file}:${r.line}\` — ${r.content}\n`;
+        }
+    }
+    section += "\n> **Note:** This section is informational. Review these contracts before writing your test plan.\n";
+    return section;
+}
 const LANE_TITLE = {
     backlog: "Backlog",
     icebox: "Icebox",
@@ -153,6 +270,10 @@ const normalizeBoardSlug = (value) => {
 let cachedBoardId = null;
 let cachedBoardSlug = null;
 const resolveBoardId = async () => {
+    // Prefer runtime selection from select_board tool
+    const runtimeId = getRuntimeBoardId();
+    if (runtimeId)
+        return runtimeId;
     const slug = normalizeBoardSlug(BOARD_SLUG);
     if (!slug)
         return null;
@@ -202,6 +323,7 @@ const fetchFeatureConfig = async () => {
                 aiTools: true,
                 teamDecisions: false,
                 ragKnowledgeBase: false,
+                useDeliveredState: true,
             },
             source: {
                 balancedTeam: "error-fallback",
@@ -210,6 +332,7 @@ const fetchFeatureConfig = async () => {
                 aiTools: "error-fallback",
                 teamDecisions: "error-fallback",
                 ragKnowledgeBase: "error-fallback",
+                useDeliveredState: "error-fallback",
             },
         };
     }
@@ -336,7 +459,7 @@ const formatDorWarnings = (boardSettings, dorChecklist) => {
 };
 const fetchStories = async () => {
     const boardId = await resolveBoardId();
-    const slug = normalizeBoardSlug(BOARD_SLUG);
+    const slug = getActiveBoardSlug(BOARD_SLUG) ?? normalizeBoardSlug(BOARD_SLUG);
     const isMainBoard = slug === "main";
     // For the "main" board, fetch ALL stories (no boardId filter) then filter
     // client-side. This matches the frontend behavior: legacy stories have
@@ -354,7 +477,7 @@ const fetchStories = async () => {
 };
 const fetchEpics = async () => {
     const boardId = await resolveBoardId();
-    const slug = normalizeBoardSlug(BOARD_SLUG);
+    const slug = getActiveBoardSlug(BOARD_SLUG) ?? normalizeBoardSlug(BOARD_SLUG);
     const isMainBoard = slug === "main";
     const response = await client.get("/epics", {
         params: boardId && !isMainBoard ? { boardId } : undefined,
@@ -434,6 +557,55 @@ const createServer = () => {
         const teamDecisionsEnabled = featureConfig.features.teamDecisions;
         const ragKnowledgeBaseEnabled = featureConfig.features.ragKnowledgeBase;
         const baseTools = [
+            {
+                name: "list_boards",
+                description: "List all boards in the workspace. Returns id, name, slug, and story count for each board. Marks the currently selected board.",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        includeArchived: {
+                            type: "boolean",
+                            description: "Include archived boards (default false)",
+                        },
+                    },
+                },
+            },
+            {
+                name: "create_board",
+                description: "Create a new board in the workspace. Auto-generates slug from name if not provided. Max 3 active boards per tenant.",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        name: {
+                            type: "string",
+                            description: "Name for the new board",
+                        },
+                        description: {
+                            type: "string",
+                            description: "Optional description",
+                        },
+                        slug: {
+                            type: "string",
+                            description: "Optional custom slug (auto-generated from name if omitted)",
+                        },
+                    },
+                    required: ["name"],
+                },
+            },
+            {
+                name: "select_board",
+                description: "Switch the active board context. All subsequent tool calls (list_stories, create_story, list_epics, etc.) will operate against the selected board. Overrides ELIXIUM_BOARD_SLUG env var for this session.",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        slug: {
+                            type: "string",
+                            description: "Slug of the board to select (case-insensitive)",
+                        },
+                    },
+                    required: ["slug"],
+                },
+            },
             {
                 name: "get_feature_config",
                 description: "Get the feature configuration for this board/workspace. Returns enabled features, team profile, and smart defaults context.",
@@ -476,52 +648,8 @@ const createServer = () => {
             },
             {
                 name: "create_story",
-                description: "Create a new story on the Elixium board",
-                inputSchema: {
-                    type: "object",
-                    properties: {
-                        title: { type: "string", description: "Title of the story" },
-                        description: {
-                            type: "string",
-                            description: "Description of the story",
-                        },
-                        acceptanceCriteria: {
-                            type: "string",
-                            description: "Acceptance criteria in Given/When/Then format",
-                        },
-                        lane: {
-                            type: "string",
-                            description: "Lane to add the story to (case-insensitive)",
-                            enum: [
-                                "Backlog",
-                                "Icebox",
-                                "Current",
-                                "Done",
-                                "BACKLOG",
-                                "ICEBOX",
-                                "CURRENT",
-                                "DONE",
-                            ],
-                        },
-                        points: {
-                            type: "number",
-                            description: "Points (0, 1, 2, 3, 5, 8)",
-                        },
-                        requester: {
-                            type: "string",
-                            description: "Email of the person requesting this story. Defaults to ELIXIUM_USER_EMAIL env var or API key owner.",
-                        },
-                        epicId: {
-                            type: "string",
-                            description: "Epic ID to link this story to (optional). Use list_epics to find epic IDs.",
-                        },
-                        testPlan: {
-                            type: "string",
-                            description: "Markdown test plan describing test strategy (optional). Sets the test_plan field without changing workflow_stage.",
-                        },
-                    },
-                    required: ["title"],
-                },
+                description: "Create a new story on the Elixium board. Accepts storyType (feature/bug/chore/platform) at create time.",
+                inputSchema: CREATE_STORY_INPUT_SCHEMA,
             },
             {
                 name: "get_iteration_context",
@@ -600,58 +728,38 @@ const createServer = () => {
             },
             {
                 name: "update_story",
-                description: "Update fields on an existing story",
-                inputSchema: {
-                    type: "object",
-                    properties: {
-                        storyId: { type: "string", description: "ID of the story" },
-                        title: { type: "string", description: "Updated title" },
-                        description: { type: "string", description: "Updated description" },
-                        lane: {
-                            type: "string",
-                            description: "Lane to move the story to (case-insensitive)",
-                            enum: [
-                                "Backlog",
-                                "Icebox",
-                                "Current",
-                                "Done",
-                                "BACKLOG",
-                                "ICEBOX",
-                                "CURRENT",
-                                "DONE",
-                            ],
-                        },
-                        points: {
-                            type: "number",
-                            description: "Updated points (0, 1, 2, 3, 5, 8)",
-                        },
-                        state: {
-                            type: "string",
-                            description: "Story state (unstarted, started, finished, delivered, accepted, rejected)",
-                        },
-                        outcome_summary: {
-                            type: "string",
-                            description: "Learning outcome summary",
-                        },
-                        acceptanceCriteria: {
-                            type: "string",
-                            description: "Acceptance criteria in Given/When/Then format",
-                        },
-                        sortOrder: {
-                            type: "number",
-                            description: "Sort order within the lane (lower = higher priority)",
-                        },
-                        epicId: {
-                            type: "string",
-                            description: "Epic ID to link this story to. Set to empty string to unlink.",
-                        },
-                        testPlan: {
-                            type: "string",
-                            description: "Markdown test plan. Updates test_plan field without changing workflow_stage.",
-                        },
-                    },
-                    required: ["storyId"],
-                },
+                description: "Update fields on an existing story. Accepts Learning Loop fields (hypothesis, confidence_score, hidden_unknowns, risk_profile) and storyType in addition to the basics.",
+                inputSchema: UPDATE_STORY_INPUT_SCHEMA,
+            },
+            {
+                name: "get_stakeholders",
+                description: "Derive the set of trust audiences this story needs to earn trust with. Returns an array of {audience, reason} entries based on the story's risk_profile, its linked epic's hypothesis/successMetrics, and the workspace's compliance frameworks. Pure derivation — no mutations, no AI calls.",
+                inputSchema: GET_STAKEHOLDERS_INPUT_SCHEMA,
+            },
+            {
+                name: "propose_field_draft",
+                description: "Submit an AI-drafted value for a Learning Loop field as a pending proposal. The draft does NOT change the story until a human endorses via endorse_proposal. Caller should disclose `provider` (LLM model) and `agent` (client+version) for trust attribution.",
+                inputSchema: PROPOSE_FIELD_DRAFT_INPUT_SCHEMA,
+            },
+            {
+                name: "endorse_proposal",
+                description: "Endorse a pending field proposal. Updates the underlying story field with the proposal's draft_value and emits a proposal.endorsed audit event. Only humans should endorse — the agent should never call this on its own draft.",
+                inputSchema: ENDORSE_PROPOSAL_INPUT_SCHEMA,
+            },
+            {
+                name: "reject_proposal",
+                description: "Reject a pending field proposal with a required reason. Story field is unchanged; reason is captured for agent learning + audit.",
+                inputSchema: REJECT_PROPOSAL_INPUT_SCHEMA,
+            },
+            {
+                name: "draft_hypothesis",
+                description: "Reference consumer of the proposal primitive: backend calls AI_PROVIDER to generate a hypothesis draft for the given story, then submits it as a pending proposal. Pattern for §4 outcome-from-evidence and §6 v2 missing-field drafter to follow.",
+                inputSchema: DRAFT_HYPOTHESIS_INPUT_SCHEMA,
+            },
+            {
+                name: "get_trust_leakage",
+                description: "Return the tenant's off-system decision report: commits authored since `since` on the workspace's configured Git provider (GitHub, GitHub Enterprise, GitLab, or Gitea) whose messages do NOT reference any story on the board. Nudge signal, not a gate. Requires workspace_git_provider to be configured via POST /workspace/git-provider first.",
+                inputSchema: GET_TRUST_LEAKAGE_INPUT_SCHEMA,
             },
             {
                 name: "prepare_implementation",
@@ -757,6 +865,14 @@ const createServer = () => {
                             type: "boolean",
                             description: "If true with trunkBased, creates a short-lived branch that auto-merges to main on submit_for_review. Branch is deleted after merge.",
                         },
+                        skipGates: {
+                            type: "boolean",
+                            description: "If true, bypasses the test plan approval gate. For hotfixes/emergencies only. Bypass is recorded in the story audit trail.",
+                        },
+                        skipReason: {
+                            type: "string",
+                            description: "Reason for bypassing gates (e.g., 'hotfix for production outage'). Recorded in the audit trail.",
+                        },
                     },
                     required: ["storyId"],
                 },
@@ -784,6 +900,20 @@ const createServer = () => {
                     required: ["storyId", "testPlan"],
                 },
             },
+            {
+                name: "draft_test_plan",
+                description: "Return a starter test plan scaffold seeded from the story's hidden_unknowns and hypothesis. The agent edits this scaffold and calls propose_test_plan with the final version. Makes Icebox premortem assumptions load-bearing at test authoring time.",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        storyId: {
+                            type: "string",
+                            description: "ID of the story to draft a test plan for",
+                        },
+                    },
+                    required: ["storyId"],
+                },
+            },
             {
                 name: "approve_tests",
                 description: "Approve a proposed test plan so implementation can proceed. Transitions workflow from tests_proposed to tests_approved. This is the human approval gate in the TDD workflow.",
@@ -974,7 +1104,7 @@ const createServer = () => {
         try {
             const toolName = request.params.name;
             // Check TDD workflow tools
-            const tddWorkflowTools = ["start_story", "propose_test_plan", "get_test_plan", "submit_for_review", "review_pr"];
+            const tddWorkflowTools = ["start_story", "propose_test_plan", "draft_test_plan", "get_test_plan", "submit_for_review", "review_pr"];
             if (tddWorkflowTools.includes(toolName)) {
                 const enabled = await isTddWorkflowEnabled();
                 if (!enabled) {
@@ -1046,6 +1176,50 @@ const createServer = () => {
                 }
             }
             switch (toolName) {
+                case "list_boards": {
+                    const args = request.params.arguments;
+                    const result = await listBoards(client, {
+                        includeArchived: args?.includeArchived,
+                    });
+                    return {
+                        content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    };
+                }
+                case "create_board": {
+                    const args = request.params.arguments;
+                    const board = await createBoard(client, {
+                        name: args.name,
+                        description: args.description,
+                        slug: args.slug,
+                    });
+                    // Invalidate feature config cache since board list changed
+                    cachedFeatureConfig = null;
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `# Board Created\n\n- **Name:** ${board.name}\n- **Slug:** ${board.slug}\n- **ID:** ${board.id}\n\n> Use \`select_board\` with slug "${board.slug}" to switch to this board.`,
+                            },
+                        ],
+                    };
+                }
+                case "select_board": {
+                    const args = request.params.arguments;
+                    const board = await selectBoard(client, args.slug);
+                    // Invalidate caches so subsequent calls use new board context
+                    cachedFeatureConfig = null;
+                    cachedBoardId = null;
+                    cachedBoardSlug = null;
+                    cachedLaneStyle = null;
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `# Board Selected\n\n- **Name:** ${board.name}\n- **Slug:** ${board.slug}\n- **ID:** ${board.id}\n\nAll subsequent tool calls will operate against this board.`,
+                            },
+                        ],
+                    };
+                }
                 case "get_feature_config": {
                     const config = await fetchFeatureConfig();
                     const formattedConfig = `
@@ -1321,6 +1495,134 @@ ${config.infrastructureProfile?.provider ? `- Provider: ${config.infrastructureP
                         ],
                     };
                 }
+                case "get_stakeholders": {
+                    const args = request.params.arguments;
+                    const { storyId } = args;
+                    assertUUID(storyId, "storyId");
+                    // Fetch story + feature config in parallel; the story tells us
+                    // whether to fetch a linked epic.
+                    const [storyResponse, featureConfig] = await Promise.all([
+                        client.get(`/stories/${storyId}`),
+                        fetchFeatureConfig(),
+                    ]);
+                    const story = storyResponse.data;
+                    // If the story is linked to an epic, fetch the epic too.
+                    let epic = null;
+                    if (story.epic_id) {
+                        try {
+                            const epicResponse = await client.get(`/epics/${story.epic_id}`);
+                            epic = epicResponse.data;
+                        }
+                        catch {
+                            // Epic fetch failure is non-fatal — derivation simply won't
+                            // add the `execs` audience in this case.
+                            epic = null;
+                        }
+                    }
+                    // Read from canonical field name `complianceFrameworks` (per
+                    // types.ts InfrastructureProfile); fall back to `compliance` for
+                    // any shipped callers that use the older name. Values are
+                    // normalized case-insensitively in deriveStakeholders.
+                    const infra = featureConfig.infrastructureProfile ?? {};
+                    const workspaceCompliance = Array.isArray(infra.complianceFrameworks)
+                        ? infra.complianceFrameworks
+                        : Array.isArray(infra.compliance)
+                            ? infra.compliance
+                            : [];
+                    const stakeholders = deriveStakeholders({
+                        story: {
+                            story_type: story.story_type ?? null,
+                            title: story.title ?? null,
+                            risk_profile: story.risk_profile ?? null,
+                            epic_id: story.epic_id ?? null,
+                        },
+                        epic: epic
+                            ? {
+                                hypothesis: epic.hypothesis ?? null,
+                                successMetrics: epic.successMetrics ?? null,
+                            }
+                            : null,
+                        workspaceCompliance,
+                    });
+                    const payload = {
+                        storyId: story.id,
+                        stakeholders,
+                        derived_from: {
+                            story_type: story.story_type ?? null,
+                            risk_profile: story.risk_profile ?? null,
+                            epic_id: story.epic_id ?? null,
+                            compliance_frameworks: workspaceCompliance,
+                        },
+                    };
+                    return {
+                        content: [
+                            { type: "text", text: JSON.stringify(payload, null, 2) },
+                        ],
+                    };
+                }
+                case "propose_field_draft": {
+                    const args = request.params.arguments;
+                    const { storyId, fieldName, draftValue, provider, agent } = args;
+                    assertUUID(storyId, "storyId");
+                    const response = await client.post(`/stories/${storyId}/proposals`, {
+                        field_name: fieldName,
+                        draft_value: draftValue,
+                        ...(provider ? { provider } : {}),
+                        ...(agent ? { agent } : {}),
+                    });
+                    return {
+                        content: [
+                            { type: "text", text: JSON.stringify(response.data, null, 2) },
+                        ],
+                    };
+                }
+                case "endorse_proposal": {
+                    const args = request.params.arguments;
+                    const { proposalId } = args;
+                    assertUUID(proposalId, "proposalId");
+                    const response = await client.post(`/proposals/${proposalId}/endorse`, {});
+                    return {
+                        content: [
+                            { type: "text", text: JSON.stringify(response.data, null, 2) },
+                        ],
+                    };
+                }
+                case "reject_proposal": {
+                    const args = request.params.arguments;
+                    const { proposalId, reason } = args;
+                    assertUUID(proposalId, "proposalId");
+                    const response = await client.post(`/proposals/${proposalId}/reject`, { reason });
+                    return {
+                        content: [
+                            { type: "text", text: JSON.stringify(response.data, null, 2) },
+                        ],
+                    };
+                }
+                case "draft_hypothesis": {
+                    const args = request.params.arguments;
+                    const { storyId, context } = args;
+                    assertUUID(storyId, "storyId");
+                    const response = await client.post(`/stories/${storyId}/proposals/draft`, { field_name: "hypothesis", ...(context ? { context } : {}) });
+                    return {
+                        content: [
+                            { type: "text", text: JSON.stringify(response.data, null, 2) },
+                        ],
+                    };
+                }
+                case "get_trust_leakage": {
+                    const args = (request.params.arguments ?? {});
+                    const query = {};
+                    if (args.since)
+                        query.since = String(args.since);
+                    if (args.repo)
+                        query.repo = String(args.repo);
+                    const response = await client.get(`/trust-leakage`, { params: query });
+                    return {
+                        content: [
+                            { type: "text", text: JSON.stringify(response.data, null, 2) },
+                        ],
+                    };
+                }
                 case "prepare_implementation": {
                     const args = request.params.arguments;
                     const { storyId } = args;
@@ -1402,6 +1704,17 @@ ${config.infrastructureProfile?.provider ? `- Provider: ${config.infrastructureP
                         }).join("\n");
                         knowledgeSection = `\n## Related Knowledge\n${formatted}\n`;
                     }
+                    // Scan codebase for integration contracts (non-blocking)
+                    let contractsSection = "";
+                    try {
+                        const keywords = extractKeywords(story.title, story.description || "");
+                        const cwd = process.cwd();
+                        const contractMatches = scanCodebaseForContracts(keywords, cwd);
+                        contractsSection = formatContractsSection(contractMatches);
+                    }
+                    catch {
+                        contractsSection = "\n## Integration Contracts\nContract scanning unavailable.\n";
+                    }
                     const formattedBrief = `
 # Implementation Brief: ${story.title}
 
@@ -1414,7 +1727,7 @@ ${acceptanceCriteria}
 ## Assumptions
 Here are the assumptions I think we’re testing:
 ${assumptions}
-${decisionsSection}${knowledgeSection}
+${decisionsSection}${knowledgeSection}${contractsSection}
 ${formatTeamContext(teamConfig)}
 ${formatDorDodSection(boardSettings, story.dorChecklist, story.dodChecklist)}
 ## Proposal
@@ -1428,7 +1741,7 @@ Here’s the smallest change that will validate it:
                 // TDD Workflow Handlers
                 case "start_story": {
                     const args = request.params.arguments;
-                    const { storyId, branchPrefix, trunkBased, autoMerge } = args;
+                    const { storyId, branchPrefix, trunkBased, autoMerge, skipGates, skipReason } = args;
                     if (!storyId) {
                         throw new Error("storyId is required");
                     }
@@ -1439,6 +1752,8 @@ Here’s the smallest change that will validate it:
                             branchPrefix: branchPrefix || "feat",
                             trunkBased,
                             autoMerge,
+                            ...(skipGates && { skipGates: true }),
+                            ...(skipReason && { skipReason }),
                         }),
                         fetchFeatureConfig(),
                         fetchBoardSettings(),
@@ -1448,6 +1763,9 @@ Here’s the smallest change that will validate it:
                     const dorWarnings = formatDorWarnings(boardSettings, result.dorChecklist);
                     const isTrunk = result.trunkBased;
                     const isAutoMerge = result.autoMerge;
+                    const workflowModelLine = formatWorkflowModelLine({
+                        useDeliveredState: teamConfig.features.useDeliveredState,
+                    });
                     let formattedResult;
                     if (isTrunk && !isAutoMerge) {
                         formattedResult = `
@@ -1456,6 +1774,7 @@ Here’s the smallest change that will validate it:
 **Mode:** Direct to main (trunk-based development)
 **Feature Flag:** \`${result.featureFlagName || "none"}\`
 **Workflow Stage:** ${result.workflow_stage}
+**Workflow Model:** ${workflowModelLine}
 
 ## Acceptance Criteria
 ${result.acceptance_criteria || "No specific AC provided."}
@@ -1482,6 +1801,7 @@ ${dorWarnings}`;
 **Branch:** \`${result.branch}\`
 **Feature Flag:** \`${result.featureFlagName || "none"}\`
 **Workflow Stage:** ${result.workflow_stage}
+**Workflow Model:** ${workflowModelLine}
 
 ## Acceptance Criteria
 ${result.acceptance_criteria || "No specific AC provided."}
@@ -1506,6 +1826,7 @@ ${dorWarnings}`;
 
 **Branch:** \`${result.branch}\`
 **Workflow Stage:** ${result.workflow_stage}
+**Workflow Model:** ${workflowModelLine}
 
 ## Acceptance Criteria
 ${result.acceptance_criteria || "No specific AC provided."}
@@ -1612,6 +1933,30 @@ ${(result.test_file_paths || []).map((p) => `- \`${p}\``).join("\n") || "No test
 ${result.message}
 
 > 🛑 **BLOCKED:** Implementation cannot proceed until a human approves this test plan.
+`;
+                    return {
+                        content: [{ type: "text", text: formattedResult.trim() }],
+                    };
+                }
+                case "draft_test_plan": {
+                    const args = request.params.arguments;
+                    const { storyId } = args;
+                    if (!storyId) {
+                        throw new Error("storyId is required");
+                    }
+                    assertUUID(storyId, "storyId");
+                    const response = await client.get(`/stories/${storyId}/draft-test-plan`);
+                    const result = response.data;
+                    const formattedResult = `
+# Drafted Test Plan
+
+**Story ID:** ${storyId}
+
+> This is a scaffold seeded from the story's \`hidden_unknowns\` and \`hypothesis\`. Edit freely, then call \`propose_test_plan\` with the final version.
+
+---
+
+${result.testPlan}
 `;
                     return {
                         content: [{ type: "text", text: formattedResult.trim() }],
@@ -1648,13 +1993,20 @@ ${result.message}
                         throw new Error("storyId is required");
                     }
                     assertUUID(storyId, "storyId");
-                    const response = await client.post(`/stories/${storyId}/submit-review`, {
-                        commitHash,
-                        testResults,
-                        implementationNotes,
-                    });
+                    const [response, submitFeatureConfig] = await Promise.all([
+                        client.post(`/stories/${storyId}/submit-review`, {
+                            commitHash,
+                            testResults,
+                            implementationNotes,
+                        }),
+                        fetchFeatureConfig(),
+                    ]);
                     const result = response.data;
                     const isAutoMerge = result.autoMerge;
+                    const submitWorkflowModelLine = formatWorkflowModelLine({
+                        useDeliveredState: submitFeatureConfig.features.useDeliveredState,
+                        state: result.state,
+                    });
                     let autoMergeSection = "";
                     if (isAutoMerge && result.autoMergeInstructions) {
                         const instr = result.autoMergeInstructions;
@@ -1688,6 +2040,7 @@ git branch -d ${instr.sourceBranch}
 **Status:** ${result.status}
 **Workflow Stage:** ${result.workflow_stage}
 **State:** ${result.state}
+**Workflow Model:** ${submitWorkflowModelLine}
 ${result.trunkBased ? `**Mode:** Trunk-based${isAutoMerge ? " + Auto-merge" : ""}` : ""}
 ${result.featureFlagName ? `**Feature Flag:** \`${result.featureFlagName}\`` : ""}
 
@@ -2103,7 +2456,17 @@ ${depList || "No dependencies detected."}
             if (error.response?.status) {
                 errorText += ` (HTTP ${error.response.status})`;
             }
-            if (error.response?.data) {
+            // Enhanced 403 handling for RBAC and API key scope errors
+            if (error.response?.status === 403 && error.response?.data) {
+                const data = error.response.data;
+                if (data.required && data.currentScopes) {
+                    errorText = `🔑 API key missing scope: ${data.required}\n\nYour key has scopes: [${data.currentScopes.join(", ")}]\nRegenerate your API key with the required scope to use this tool.\n\nIn Elixium → Integrations → Generate API Key (with scopes)`;
+                }
+                else if (data.required && data.currentLevel) {
+                    errorText = `🔒 Insufficient permissions: ${data.required}\n\nYour access level is "${data.currentLevel}". This operation requires a higher access level.\nContact your workspace owner to update your role.`;
+                }
+            }
+            else if (error.response?.data) {
                 const data = error.response.data;
                 const detail = typeof data === "string" ? data : JSON.stringify(data);
                 errorText += `\nDetails: ${detail}`;

package/dist/stakeholders.js

@@ -0,0 +1,72 @@
+/**
+ * Stakeholder derivation — mcp-server local mirror of the logic in
+ * `lib/trust-audiences.ts` (story 72d27a2a / §7).
+ *
+ * Why duplicated: mcp-server is a separately-published npm package with
+ * its own `tsconfig.json` (rootDir = `./src`). It can't import from the
+ * parent repo's `lib/` without a workspace-level refactor. For now, the
+ * derivation logic lives independently here.
+ *
+ * **Drift guard:** `tests/stakeholder-detection-mcp-parity.spec.ts`
+ * imports both this module and `lib/trust-audiences.ts` and asserts they
+ * produce identical output on a fixture matrix. If either copy is
+ * updated without the other, that test fails.
+ *
+ * If/when a shared workspace package is introduced, consolidate.
+ */
+export const AUDIENCE_KEYS = [
+    "peers",
+    "institutional_memory",
+    "onboarders",
+    "risk_committee",
+    "governance",
+    "execs",
+];
+// Case-insensitive: accepts uppercase forms historically used in test
+// fixtures AND the lowercase enum values from types.ts.
+const REGULATED_FRAMEWORKS_NORMALIZED = new Set([
+    "hipaa",
+    "soc2",
+    "fedramp-moderate",
+    "fedramp-high",
+    "fedramp",
+]);
+function isRegulatedFramework(framework) {
+    return REGULATED_FRAMEWORKS_NORMALIZED.has(framework.toLowerCase());
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+export function deriveStakeholders(input) {
+    const result = [];
+    const seen = new Set();
+    function add(audience, reason) {
+        if (seen.has(audience))
+            return;
+        seen.add(audience);
+        result.push({ audience, reason });
+    }
+    add("peers", "always needed");
+    add("institutional_memory", "always needed");
+    add("onboarders", "always needed");
+    if (nonEmpty(input.story.risk_profile)) {
+        add("risk_committee", `risk_profile = "${input.story.risk_profile}"`);
+    }
+    if (input.story.risk_profile === "Compliance") {
+        add("governance", "risk_profile flags Compliance");
+    }
+    const regulated = (input.workspaceCompliance ?? []).find((f) => isRegulatedFramework(f));
+    if (regulated) {
+        add("governance", `workspace compliance: ${regulated}`);
+    }
+    const epic = input.epic;
+    if (epic) {
+        if (nonEmpty(epic.hypothesis)) {
+            add("execs", "epic has hypothesis");
+        }
+        else if (nonEmpty(epic.successMetrics)) {
+            add("execs", "epic has successMetrics");
+        }
+    }
+    return result;
+}

package/dist/toolSchemas.js

@@ -0,0 +1,235 @@
+/**
+ * MCP tool input schemas — extracted from `index.ts` so they can be imported
+ * directly by behavior tests instead of grepped from source (Tier 5.7).
+ *
+ * Pattern for new MCP tools in this package: define the inputSchema here as
+ * an exported `as const` literal, then reference it from the tool definition
+ * in `index.ts`. Story 50e536ca will eventually migrate the remaining inline
+ * schemas to this module.
+ *
+ * Keep enums and field shapes locked to the backend Zod validators
+ * (`backend/api/src/validators/storySchemas.ts`). Drift between the MCP
+ * schema and the backend validator means LLMs can send fields that get
+ * silently stripped (or be told to send valid fields the backend rejects).
+ * Cross-spec drift guards live in the test specs.
+ */
+const STORY_TYPE_ENUM = ["feature", "bug", "chore", "platform"];
+const RISK_PROFILE_ENUM = [
+    "User",
+    "Tech",
+    "Market",
+    "Compliance",
+    "Model_Drift",
+];
+const LANE_ENUM = [
+    "Backlog",
+    "Icebox",
+    "Current",
+    "Done",
+    "BACKLOG",
+    "ICEBOX",
+    "CURRENT",
+    "DONE",
+];
+export const CREATE_STORY_INPUT_SCHEMA = {
+    type: "object",
+    properties: {
+        title: { type: "string", description: "Title of the story" },
+        description: {
+            type: "string",
+            description: "Description of the story",
+        },
+        acceptanceCriteria: {
+            type: "string",
+            description: "Acceptance criteria in Given/When/Then format",
+        },
+        lane: {
+            type: "string",
+            description: "Lane to add the story to (case-insensitive)",
+            enum: LANE_ENUM,
+        },
+        points: {
+            type: "number",
+            description: "Points (0, 1, 2, 3, 5, 8)",
+        },
+        requester: {
+            type: "string",
+            description: "Email of the person requesting this story. Defaults to ELIXIUM_USER_EMAIL env var or API key owner.",
+        },
+        epicId: {
+            type: "string",
+            description: "Epic ID to link this story to (optional). Use list_epics to find epic IDs.",
+        },
+        testPlan: {
+            type: "string",
+            description: "Markdown test plan describing test strategy (optional). Sets the test_plan field without changing workflow_stage.",
+        },
+        storyType: {
+            type: "string",
+            description: "Categorizes the story for filtering and Learning Loop signals (feature, bug, chore, platform).",
+            enum: STORY_TYPE_ENUM,
+        },
+    },
+    required: ["title"],
+};
+// ─── Story 0ad8e319 (§2): Agent-proposal primitive ──────────────────────
+const PROPOSABLE_FIELD_NAMES_FOR_MCP = [
+    "hypothesis",
+    "hidden_unknowns",
+    "confidence_score",
+    "risk_profile",
+    "outcome_summary",
+];
+export const PROPOSE_FIELD_DRAFT_INPUT_SCHEMA = {
+    type: "object",
+    properties: {
+        storyId: {
+            type: "string",
+            description: "UUID of the story this proposal is for",
+        },
+        fieldName: {
+            type: "string",
+            description: "Which Learning Loop field this proposal targets. Must be one of the proposable fields.",
+            enum: PROPOSABLE_FIELD_NAMES_FOR_MCP,
+        },
+        draftValue: {
+            type: ["string", "number", "null"],
+            description: "The proposed value for the field. Type matches the field: string for hypothesis/hidden_unknowns/risk_profile/outcome_summary, number for confidence_score, null to propose clearing the field.",
+        },
+        provider: {
+            type: "string",
+            description: "Optional: the LLM provider+model that generated this draft (e.g., 'anthropic.claude-sonnet-4.5', 'google.gemini-2.0-flash'). Strongly encouraged — disclosed on the proposal badge so humans see which model drafted it.",
+        },
+        agent: {
+            type: "string",
+            description: "Optional: the agent client+version that submitted the proposal (e.g., 'claude-code/1.2.3', 'cursor/0.40.0'). Used for per-agent calibration signatures.",
+        },
+    },
+    required: ["storyId", "fieldName", "draftValue"],
+};
+export const ENDORSE_PROPOSAL_INPUT_SCHEMA = {
+    type: "object",
+    properties: {
+        proposalId: {
+            type: "string",
+            description: "UUID of the pending proposal to endorse. Endorsement updates the underlying story field with the proposal's draft_value and emits a proposal.endorsed audit event.",
+        },
+    },
+    required: ["proposalId"],
+};
+export const REJECT_PROPOSAL_INPUT_SCHEMA = {
+    type: "object",
+    properties: {
+        proposalId: {
+            type: "string",
+            description: "UUID of the pending proposal to reject.",
+        },
+        reason: {
+            type: "string",
+            description: "Required reason the proposal was rejected. Captured for agent learning + audit.",
+        },
+    },
+    required: ["proposalId", "reason"],
+};
+export const DRAFT_HYPOTHESIS_INPUT_SCHEMA = {
+    type: "object",
+    properties: {
+        storyId: {
+            type: "string",
+            description: "UUID of the story to draft a hypothesis for. Reference consumer of the proposal primitive — calls the configured AI_PROVIDER on the backend to generate a draft hypothesis, then submits it as a pending proposal. Pattern for §4 outcome-from-evidence and §6 v2 missing-field drafter to follow.",
+        },
+        context: {
+            type: "string",
+            description: "Optional additional context to seed the AI draft (e.g., domain notes, prior hypotheses).",
+        },
+    },
+    required: ["storyId"],
+};
+export const GET_STAKEHOLDERS_INPUT_SCHEMA = {
+    type: "object",
+    properties: {
+        storyId: {
+            type: "string",
+            description: "UUID of the story to derive stakeholders for. Returns which audiences (peers, execs, governance, risk_committee, institutional_memory, onboarders) this card needs to earn trust with, based on story metadata + linked epic + workspace compliance frameworks.",
+        },
+    },
+    required: ["storyId"],
+};
+export const GET_TRUST_LEAKAGE_INPUT_SCHEMA = {
+    type: "object",
+    properties: {
+        since: {
+            type: "string",
+            description: "Optional ISO-8601 timestamp. Return only commits authored on or after this instant. Defaults to 30 days ago.",
+        },
+        repo: {
+            type: "string",
+            description: "Optional repo override in 'owner/repo' form. Defaults to the workspace's configured default_repo for the tenant's provider.",
+        },
+    },
+    required: [],
+};
+export const UPDATE_STORY_INPUT_SCHEMA = {
+    type: "object",
+    properties: {
+        storyId: { type: "string", description: "ID of the story" },
+        title: { type: "string", description: "Updated title" },
+        description: { type: "string", description: "Updated description" },
+        lane: {
+            type: "string",
+            description: "Lane to move the story to (case-insensitive)",
+            enum: LANE_ENUM,
+        },
+        points: {
+            type: "number",
+            description: "Updated points (0, 1, 2, 3, 5, 8)",
+        },
+        state: {
+            type: "string",
+            description: "Story state (unstarted, started, finished, delivered, accepted, rejected)",
+        },
+        outcome_summary: {
+            type: "string",
+            description: "Learning outcome summary",
+        },
+        acceptanceCriteria: {
+            type: "string",
+            description: "Acceptance criteria in Given/When/Then format",
+        },
+        sortOrder: {
+            type: "number",
+            description: "Sort order within the lane (lower = higher priority)",
+        },
+        epicId: {
+            type: "string",
+            description: "Epic ID to link this story to. Set to empty string to unlink.",
+        },
+        testPlan: {
+            type: "string",
+            description: "Markdown test plan. Updates test_plan field without changing workflow_stage.",
+        },
+        storyType: {
+            type: "string",
+            description: "Categorizes the story for filtering and Learning Loop signals (feature, bug, chore, platform).",
+            enum: STORY_TYPE_ENUM,
+        },
+        hypothesis: {
+            type: "string",
+            description: "We believe that... — drives Learning Loop AI prompts and earns trust with execs/board.",
+        },
+        confidence_score: {
+            type: "number",
+            description: "How confident we are this delivers value (0-100). Earns trust with peers and calibration-minded leaders.",
+        },
+        hidden_unknowns: {
+            type: "string",
+            description: "Assumptions or open questions that could invalidate the hypothesis. Earns trust with risk committee / staff engineering.",
+        },
+        risk_profile: {
+            type: "string",
+            description: "Categorizes risk (User, Tech, Market, Compliance, Model_Drift). Earns trust with governance and compliance audiences.",
+            enum: RISK_PROFILE_ENUM,
+        },
+    },
+    required: ["storyId"],
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elixium.ai/mcp-server",
-  "version": "0.3.6",
+  "version": "0.5.0",
   "type": "module",
   "description": "MCP Server for Elixium.ai",
   "mcpName": "io.github.IndirectTek/mcp-server",
@@ -23,7 +23,7 @@
     "dev": "ts-node src/index.ts"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^0.6.0",
+    "@modelcontextprotocol/sdk": "^1.25.2",
     "axios": "^1.6.0",
     "zod": "^3.22.0"
   },