@harness-engineering/mcp-server 0.5.3 → 0.6.0

package/dist/src/server.js

@@ -1,6 +1,7 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { resolveProjectConfig } from './utils/config-resolver.js';
 import { validateToolDefinition, handleValidateProject } from './tools/validate.js';
 import { checkDependenciesDefinition, handleCheckDependencies } from './tools/architecture.js';
 import { checkDocsDefinition, handleCheckDocs, validateKnowledgeMapDefinition, handleValidateKnowledgeMap, } from './tools/docs.js';
@@ -25,6 +26,9 @@ import { queryGraphDefinition, handleQueryGraph, searchSimilarDefinition, handle
 import { getGraphResource, getEntitiesResource, getRelationshipsResource, } from './resources/graph.js';
 import { generateAgentDefinitionsDefinition, handleGenerateAgentDefinitions, } from './tools/agent-definitions.js';
 import { runSecurityScanDefinition, handleRunSecurityScan } from './tools/security.js';
+import { manageRoadmapDefinition, handleManageRoadmap } from './tools/roadmap.js';
+import { emitInteractionDefinition, handleEmitInteraction } from './tools/interaction.js';
+import { runCodeReviewDefinition, handleRunCodeReview } from './tools/review-pipeline.js';
 const TOOL_DEFINITIONS = [
     validateToolDefinition,
     checkDependenciesDefinition,
@@ -63,6 +67,9 @@ const TOOL_DEFINITIONS = [
     updatePerfBaselinesDefinition,
     getCriticalPathsDefinition,
     listStreamsDefinition,
+    manageRoadmapDefinition,
+    emitInteractionDefinition,
+    runCodeReviewDefinition,
 ];
 const TOOL_HANDLERS = {
     validate_project: handleValidateProject,
@@ -102,6 +109,9 @@ const TOOL_HANDLERS = {
     update_perf_baselines: handleUpdatePerfBaselines,
     get_critical_paths: handleGetCriticalPaths,
     list_streams: handleListStreams,
+    manage_roadmap: handleManageRoadmap,
+    emit_interaction: handleEmitInteraction,
+    run_code_review: handleRunCodeReview,
 };
 const RESOURCE_DEFINITIONS = [
     {
@@ -171,6 +181,7 @@ export function getResourceDefinitions() {
 }
 export function createHarnessServer(projectRoot) {
     const resolvedRoot = projectRoot ?? process.cwd();
+    let sessionChecked = false;
     const server = new Server({ name: 'harness-engineering', version: '0.1.0' }, { capabilities: { tools: {}, resources: {} } });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: TOOL_DEFINITIONS,
@@ -181,7 +192,43 @@ export function createHarnessServer(projectRoot) {
         if (!handler) {
             return { content: [{ type: 'text', text: `Unknown tool: ${name}` }], isError: true };
         }
-        return handler(args ?? {});
+        const result = await handler(args ?? {});
+        // On first tool invocation per session, check for updates
+        if (!sessionChecked) {
+            sessionChecked = true;
+            try {
+                const { getUpdateNotification, isUpdateCheckEnabled, shouldRunCheck, readCheckState, spawnBackgroundCheck, VERSION, } = await import('@harness-engineering/core');
+                // Read updateCheckInterval from project config (if available)
+                let configInterval;
+                try {
+                    const configResult = resolveProjectConfig(resolvedRoot);
+                    if (configResult.ok) {
+                        const raw = configResult.value.updateCheckInterval;
+                        if (typeof raw === 'number' && Number.isInteger(raw) && raw >= 0) {
+                            configInterval = raw;
+                        }
+                    }
+                }
+                catch {
+                    // Config read failure is non-fatal for update checks
+                }
+                const DEFAULT_INTERVAL = 86_400_000; // 24 hours
+                if (isUpdateCheckEnabled(configInterval)) {
+                    const state = readCheckState();
+                    if (shouldRunCheck(state, configInterval ?? DEFAULT_INTERVAL)) {
+                        spawnBackgroundCheck(VERSION);
+                    }
+                    const notification = getUpdateNotification(VERSION);
+                    if (notification) {
+                        result.content.push({ type: 'text', text: `\n---\n${notification}` });
+                    }
+                }
+            }
+            catch {
+                // Graceful degradation — update check failures must never break tool responses
+            }
+        }
+        return result;
     });
     server.setRequestHandler(ListResourcesRequestSchema, async () => ({
         resources: RESOURCE_DEFINITIONS,

package/dist/src/tools/agent.d.ts

@@ -69,11 +69,11 @@ export declare function handleRunAgentTask(input: {
         type: "text";
         text: string;
     }[];
-    isError?: undefined;
+    isError: boolean;
 } | {
     content: {
         type: "text";
         text: string;
     }[];
-    isError: boolean;
+    isError?: undefined;
 }>;

package/dist/src/tools/agent.js

@@ -1,4 +1,4 @@
-import * as path from 'path';
+import { sanitizePath } from '../utils/sanitize-path.js';
 export const addComponentDefinition = {
     name: 'add_component',
     description: 'Add a component (layer, doc, or component type) to the project using the harness CLI',
@@ -16,8 +16,9 @@ export const addComponentDefinition = {
         required: ['path', 'type', 'name'],
     },
 };
+const COMPONENT_NAME_REGEX = /^[a-z0-9][a-z0-9._-]{0,64}$/i;
 export async function handleAddComponent(input) {
-    const projectPath = path.resolve(input.path);
+    const projectPath = sanitizePath(input.path);
     const ALLOWED_TYPES = new Set(['layer', 'doc', 'component']);
     if (!ALLOWED_TYPES.has(input.type)) {
         return {
@@ -30,6 +31,19 @@ export async function handleAddComponent(input) {
             isError: true,
         };
     }
+    if (!COMPONENT_NAME_REGEX.test(input.name)) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: `Invalid component name: must match ${COMPONENT_NAME_REGEX} (lowercase alphanumeric, dots, hyphens, underscores, max 65 chars)`,
+                    }),
+                },
+            ],
+            isError: true,
+        };
+    }
     try {
         const { execFileSync } = await import('node:child_process');
         const output = execFileSync('npx', ['harness', 'add', input.type, input.name], {
@@ -67,8 +81,22 @@ export const runAgentTaskDefinition = {
         required: ['task'],
     },
 };
+const ALLOWED_AGENT_TASKS = new Set(['review', 'doc-review', 'test-review']);
 export async function handleRunAgentTask(input) {
-    const projectPath = input.path ? path.resolve(input.path) : process.cwd();
+    if (!ALLOWED_AGENT_TASKS.has(input.task)) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: `Invalid task: "${input.task}". Allowed tasks: ${[...ALLOWED_AGENT_TASKS].join(', ')}`,
+                    }),
+                },
+            ],
+            isError: true,
+        };
+    }
+    const projectPath = input.path ? sanitizePath(input.path) : process.cwd();
     try {
         const { execFileSync } = await import('node:child_process');
         const output = execFileSync('npx', ['harness', 'agent', 'run', input.task], {

package/dist/src/tools/architecture.js

@@ -1,6 +1,6 @@
-import * as path from 'path';
 import { resultToMcpResponse } from '../utils/result-adapter.js';
 import { resolveProjectConfig } from '../utils/config-resolver.js';
+import { sanitizePath } from '../utils/sanitize-path.js';
 export const checkDependenciesDefinition = {
     name: 'check_dependencies',
     description: 'Validate layer boundaries and detect circular dependencies',
@@ -13,7 +13,21 @@ export const checkDependenciesDefinition = {
     },
 };
 export async function handleCheckDependencies(input) {
-    const projectPath = path.resolve(input.path);
+    let projectPath;
+    try {
+        projectPath = sanitizePath(input.path);
+    }
+    catch (error) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+                },
+            ],
+            isError: true,
+        };
+    }
     const configResult = resolveProjectConfig(projectPath);
     if (!configResult.ok)
         return resultToMcpResponse(configResult);

package/dist/src/tools/cross-check.js

@@ -1,4 +1,5 @@
 import * as path from 'path';
+import { sanitizePath } from '../utils/sanitize-path.js';
 export const validateCrossCheckDefinition = {
     name: 'validate_cross_check',
     description: 'Validate plan-to-implementation coverage: checks that specs have plans and plans have implementations, detects staleness',
@@ -19,13 +20,41 @@ export const validateCrossCheckDefinition = {
     },
 };
 export async function handleValidateCrossCheck(input) {
-    const projectPath = path.resolve(input.path);
+    let projectPath;
+    try {
+        projectPath = sanitizePath(input.path);
+    }
+    catch (error) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+                },
+            ],
+            isError: true,
+        };
+    }
     try {
         const { runCrossCheck } = await import('@harness-engineering/cli');
+        const specsDir = path.resolve(projectPath, input.specsDir ?? 'docs/specs');
+        if (!specsDir.startsWith(projectPath)) {
+            return {
+                content: [{ type: 'text', text: 'Error: specsDir escapes project root' }],
+                isError: true,
+            };
+        }
+        const plansDir = path.resolve(projectPath, input.plansDir ?? 'docs/plans');
+        if (!plansDir.startsWith(projectPath)) {
+            return {
+                content: [{ type: 'text', text: 'Error: plansDir escapes project root' }],
+                isError: true,
+            };
+        }
         const result = await runCrossCheck({
             projectPath,
-            specsDir: path.resolve(projectPath, input.specsDir ?? 'docs/specs'),
-            plansDir: path.resolve(projectPath, input.plansDir ?? 'docs/plans'),
+            specsDir,
+            plansDir,
         });
         if (result.ok) {
             return { content: [{ type: 'text', text: JSON.stringify(result.value) }] };

package/dist/src/tools/docs.js

@@ -1,5 +1,6 @@
 import * as path from 'path';
 import { resultToMcpResponse } from '../utils/result-adapter.js';
+import { sanitizePath } from '../utils/sanitize-path.js';
 export const checkDocsDefinition = {
     name: 'check_docs',
     description: 'Analyze documentation coverage',
@@ -18,7 +19,8 @@ export async function handleCheckDocs(input) {
         const domain = input.domain ?? 'src';
         // Attempt to load graph for enhanced coverage analysis
         const { loadGraphStore } = await import('../utils/graph-loader.js');
-        const store = await loadGraphStore(path.resolve(input.path));
+        const projectPath = sanitizePath(input.path);
+        const store = await loadGraphStore(projectPath);
         let graphCoverage;
         if (store) {
             const { Assembler } = await import('@harness-engineering/graph');
@@ -31,8 +33,8 @@ export async function handleCheckDocs(input) {
             };
         }
         const result = await checkDocCoverage(domain, {
-            sourceDir: path.resolve(input.path, 'src'),
-            docsDir: path.resolve(input.path, 'docs'),
+            sourceDir: path.resolve(projectPath, 'src'),
+            docsDir: path.resolve(projectPath, 'docs'),
             graphCoverage,
         });
         return resultToMcpResponse(result);
@@ -63,7 +65,7 @@ export const validateKnowledgeMapDefinition = {
 export async function handleValidateKnowledgeMap(input) {
     try {
         const { validateKnowledgeMap } = await import('@harness-engineering/core');
-        const result = await validateKnowledgeMap(path.resolve(input.path));
+        const result = await validateKnowledgeMap(sanitizePath(input.path));
         return resultToMcpResponse(result);
     }
     catch (error) {

package/dist/src/tools/entropy.d.ts

@@ -35,6 +35,14 @@ export declare const applyFixesDefinition: {
                 type: string;
                 description: string;
             };
+            fixTypes: {
+                type: string;
+                items: {
+                    type: string;
+                    enum: string[];
+                };
+                description: string;
+            };
         };
         required: string[];
     };
@@ -42,4 +50,5 @@ export declare const applyFixesDefinition: {
 export declare function handleApplyFixes(input: {
     path: string;
     dryRun?: boolean;
+    fixTypes?: string[];
 }): Promise<import("../utils/result-adapter.js").McpToolResponse>;

package/dist/src/tools/entropy.js

@@ -1,6 +1,6 @@
-import * as path from 'path';
 import { Ok } from '@harness-engineering/core';
 import { resultToMcpResponse } from '../utils/result-adapter.js';
+import { sanitizePath } from '../utils/sanitize-path.js';
 async function loadEntropyGraphOptions(projectPath) {
     const { loadGraphStore } = await import('../utils/graph-loader.js');
     const store = await loadGraphStore(projectPath);
@@ -51,14 +51,14 @@ export async function handleDetectEntropy(input) {
         const { EntropyAnalyzer } = await import('@harness-engineering/core');
         const typeFilter = input.type ?? 'all';
         const analyzer = new EntropyAnalyzer({
-            rootDir: path.resolve(input.path),
+            rootDir: sanitizePath(input.path),
             analyze: {
                 drift: typeFilter === 'all' || typeFilter === 'drift',
                 deadCode: typeFilter === 'all' || typeFilter === 'dead-code',
                 patterns: typeFilter === 'all' || typeFilter === 'patterns',
             },
         });
-        const graphOptions = await loadEntropyGraphOptions(path.resolve(input.path));
+        const graphOptions = await loadEntropyGraphOptions(sanitizePath(input.path));
         const result = await analyzer.analyze(graphOptions);
         return resultToMcpResponse(result);
     }
@@ -82,6 +82,22 @@ export const applyFixesDefinition = {
         properties: {
             path: { type: 'string', description: 'Path to project root' },
             dryRun: { type: 'boolean', description: 'Preview fixes without applying' },
+            fixTypes: {
+                type: 'array',
+                items: {
+                    type: 'string',
+                    enum: [
+                        'unused-imports',
+                        'dead-files',
+                        'dead-exports',
+                        'commented-code',
+                        'orphaned-deps',
+                        'forbidden-import-replacement',
+                        'import-ordering',
+                    ],
+                },
+                description: 'Specific fix types to apply (default: all safe types)',
+            },
         },
         required: ['path'],
     },
@@ -90,16 +106,19 @@ export async function handleApplyFixes(input) {
     try {
         const { EntropyAnalyzer, createFixes, applyFixes, generateSuggestions } = await import('@harness-engineering/core');
         const analyzer = new EntropyAnalyzer({
-            rootDir: path.resolve(input.path),
+            rootDir: sanitizePath(input.path),
             analyze: { drift: true, deadCode: true, patterns: true },
         });
-        const graphOptions = await loadEntropyGraphOptions(path.resolve(input.path));
+        const graphOptions = await loadEntropyGraphOptions(sanitizePath(input.path));
         const analysisResult = await analyzer.analyze(graphOptions);
         if (!analysisResult.ok)
             return resultToMcpResponse(analysisResult);
         const report = analysisResult.value;
         const deadCode = report.deadCode;
-        const fixes = deadCode ? createFixes(deadCode, {}) : [];
+        const fixTypesConfig = input.fixTypes
+            ? { fixTypes: input.fixTypes }
+            : undefined;
+        const fixes = deadCode ? createFixes(deadCode, fixTypesConfig) : [];
         const suggestions = generateSuggestions(report.deadCode, report.drift, report.patterns);
         if (input.dryRun) {
             return { content: [{ type: 'text', text: JSON.stringify({ fixes, suggestions }) }] };

package/dist/src/tools/feedback.js

@@ -1,5 +1,5 @@
-import * as path from 'path';
 import { resultToMcpResponse } from '../utils/result-adapter.js';
+import { sanitizePath } from '../utils/sanitize-path.js';
 // ============ create_self_review ============
 export const createSelfReviewDefinition = {
     name: 'create_self_review',
@@ -33,8 +33,9 @@ export async function handleCreateSelfReview(input) {
         if (!parseResult.ok) {
             return resultToMcpResponse(parseResult);
         }
+        const projectPath = sanitizePath(input.path);
         const config = {
-            rootDir: path.resolve(input.path),
+            rootDir: projectPath,
             harness: {
                 context: true,
                 constraints: true,
@@ -49,7 +50,7 @@ export async function handleCreateSelfReview(input) {
         };
         // Attempt to load graph for enhanced review
         const { loadGraphStore } = await import('../utils/graph-loader.js');
-        const store = await loadGraphStore(path.resolve(input.path));
+        const store = await loadGraphStore(projectPath);
         let graphData;
         if (store) {
             const { GraphFeedbackAdapter } = await import('@harness-engineering/graph');
@@ -135,7 +136,7 @@ export async function handleAnalyzeDiff(input) {
         if (input.path) {
             try {
                 const { loadGraphStore } = await import('../utils/graph-loader.js');
-                const store = await loadGraphStore(path.resolve(input.path));
+                const store = await loadGraphStore(sanitizePath(input.path));
                 if (store) {
                     const { GraphFeedbackAdapter } = await import('@harness-engineering/graph');
                     const adapter = new GraphFeedbackAdapter(store);
@@ -207,7 +208,7 @@ export async function handleRequestPeerReview(input) {
         // Attempt to load graph for enhanced context
         try {
             const { loadGraphStore } = await import('../utils/graph-loader.js');
-            const store = await loadGraphStore(path.resolve(input.path));
+            const store = await loadGraphStore(sanitizePath(input.path));
             if (store) {
                 const { GraphFeedbackAdapter } = await import('@harness-engineering/graph');
                 const adapter = new GraphFeedbackAdapter(store);

package/dist/src/tools/generate-slash-commands.js

@@ -1,6 +1,7 @@
 import { Ok, Err } from '@harness-engineering/core';
 import { generateSlashCommands } from '@harness-engineering/cli';
 import { resultToMcpResponse } from '../utils/result-adapter.js';
+import { sanitizePath } from '../utils/sanitize-path.js';
 export const generateSlashCommandsDefinition = {
     name: 'generate_slash_commands',
     description: 'Generate native slash commands for Claude Code and Gemini CLI from harness skill metadata',
@@ -43,8 +44,8 @@ export async function handleGenerateSlashCommands(input) {
             platforms,
             global: input.global ?? false,
             includeGlobal: input.includeGlobal ?? false,
-            output: input.output,
-            skillsDir: input.skillsDir ?? '',
+            output: input.output ? sanitizePath(input.output) : undefined,
+            skillsDir: input.skillsDir ? sanitizePath(input.skillsDir) : '',
             dryRun: input.dryRun ?? false,
             yes: true,
         });

package/dist/src/tools/graph.js

@@ -1,13 +1,6 @@
 import * as path from 'path';
 import { loadGraphStore } from '../utils/graph-loader.js';
-// ── Shared helper ────────────────────────────────────────────────────
-function sanitizePath(inputPath) {
-    const resolved = path.resolve(inputPath);
-    if (resolved === '/' || resolved === path.parse(resolved).root) {
-        throw new Error('Invalid project path: cannot use filesystem root');
-    }
-    return resolved;
-}
+import { sanitizePath } from '../utils/sanitize-path.js';
 function graphNotFoundError() {
     return {
         content: [

package/dist/src/tools/init.js

@@ -1,6 +1,7 @@
 import * as path from 'path';
 import { resultToMcpResponse } from '../utils/result-adapter.js';
 import { resolveTemplatesDir } from '../utils/paths.js';
+import { sanitizePath } from '../utils/sanitize-path.js';
 export const initProjectDefinition = {
     name: 'init_project',
     description: 'Scaffold a new harness engineering project from a template',
@@ -29,14 +30,15 @@ export async function handleInitProject(input) {
         const resolveResult = engine.resolveTemplate(level, input.framework);
         if (!resolveResult.ok)
             return resultToMcpResponse(resolveResult);
+        const safePath = sanitizePath(input.path);
         const renderResult = engine.render(resolveResult.value, {
-            projectName: input.name ?? path.basename(input.path),
+            projectName: input.name ?? path.basename(safePath),
             level,
             framework: input.framework,
         });
         if (!renderResult.ok)
             return resultToMcpResponse(renderResult);
-        const writeResult = engine.write(renderResult.value, path.resolve(input.path), {
+        const writeResult = engine.write(renderResult.value, safePath, {
             overwrite: false,
         });
         return resultToMcpResponse(writeResult);

package/dist/src/tools/interaction.d.ts

@@ -0,0 +1,130 @@
+export declare const emitInteractionDefinition: {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            path: {
+                type: string;
+                description: string;
+            };
+            type: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            stream: {
+                type: string;
+                description: string;
+            };
+            question: {
+                type: string;
+                description: string;
+                properties: {
+                    text: {
+                        type: string;
+                        description: string;
+                    };
+                    options: {
+                        type: string;
+                        items: {
+                            type: string;
+                        };
+                        description: string;
+                    };
+                    default: {
+                        type: string;
+                        description: string;
+                    };
+                };
+                required: string[];
+            };
+            confirmation: {
+                type: string;
+                description: string;
+                properties: {
+                    text: {
+                        type: string;
+                        description: string;
+                    };
+                    context: {
+                        type: string;
+                        description: string;
+                    };
+                };
+                required: string[];
+            };
+            transition: {
+                type: string;
+                description: string;
+                properties: {
+                    completedPhase: {
+                        type: string;
+                        description: string;
+                    };
+                    suggestedNext: {
+                        type: string;
+                        description: string;
+                    };
+                    reason: {
+                        type: string;
+                        description: string;
+                    };
+                    artifacts: {
+                        type: string;
+                        items: {
+                            type: string;
+                        };
+                        description: string;
+                    };
+                    requiresConfirmation: {
+                        type: string;
+                        description: string;
+                    };
+                    summary: {
+                        type: string;
+                        description: string;
+                    };
+                };
+                required: string[];
+            };
+        };
+        required: string[];
+    };
+};
+interface EmitInteractionInput {
+    path: string;
+    type: 'question' | 'confirmation' | 'transition';
+    stream?: string;
+    question?: {
+        text: string;
+        options?: string[];
+        default?: string;
+    };
+    confirmation?: {
+        text: string;
+        context: string;
+    };
+    transition?: {
+        completedPhase: string;
+        suggestedNext: string;
+        reason: string;
+        artifacts: string[];
+        requiresConfirmation: boolean;
+        summary: string;
+    };
+}
+export declare function handleEmitInteraction(input: EmitInteractionInput): Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+}>;
+export {};