@homenshum/convex-mcp-nodebench 0.4.0 → 0.7.0

package/dist/index.js

@@ -26,6 +26,16 @@ import { cronTools } from "./tools/cronTools.js";
 import { componentTools } from "./tools/componentTools.js";
 import { httpTools } from "./tools/httpTools.js";
 import { critterTools } from "./tools/critterTools.js";
+import { authorizationTools } from "./tools/authorizationTools.js";
+import { queryEfficiencyTools } from "./tools/queryEfficiencyTools.js";
+import { actionAuditTools } from "./tools/actionAuditTools.js";
+import { typeSafetyTools } from "./tools/typeSafetyTools.js";
+import { transactionSafetyTools } from "./tools/transactionSafetyTools.js";
+import { storageAuditTools } from "./tools/storageAuditTools.js";
+import { paginationTools } from "./tools/paginationTools.js";
+import { dataModelingTools } from "./tools/dataModelingTools.js";
+import { devSetupTools } from "./tools/devSetupTools.js";
+import { migrationTools } from "./tools/migrationTools.js";
 import { CONVEX_GOTCHAS } from "./gotchaSeed.js";
 import { REGISTRY } from "./tools/toolRegistry.js";
 import { initEmbeddingIndex } from "./tools/embeddingProvider.js";
@@ -41,6 +51,16 @@ const ALL_TOOLS = [
     ...componentTools,
     ...httpTools,
     ...critterTools,
+    ...authorizationTools,
+    ...queryEfficiencyTools,
+    ...actionAuditTools,
+    ...typeSafetyTools,
+    ...transactionSafetyTools,
+    ...storageAuditTools,
+    ...paginationTools,
+    ...dataModelingTools,
+    ...devSetupTools,
+    ...migrationTools,
 ];
 const toolMap = new Map();
 for (const tool of ALL_TOOLS) {
@@ -59,10 +79,40 @@ const server = new Server({
 getDb();
 seedGotchasIfEmpty(CONVEX_GOTCHAS);
 // ── Background: initialize embedding index for semantic search ───────
-const embeddingCorpus = REGISTRY.map((entry) => ({
+// Uses Agent-as-a-Graph bipartite corpus: tool nodes + domain nodes for graph-aware retrieval
+const descMap = new Map(ALL_TOOLS.map((t) => [t.name, t.description]));
+// Tool nodes: individual tools with full metadata text
+const toolCorpus = REGISTRY.map((entry) => ({
     name: entry.name,
-    text: `${entry.name} ${entry.tags.join(" ")} ${entry.category} ${entry.phase}`,
+    text: `${entry.name} ${entry.tags.join(" ")} ${entry.category} ${entry.phase} ${descMap.get(entry.name) ?? ""}`,
+    nodeType: "tool",
 }));
+// Domain nodes: aggregate category descriptions for upward traversal
+// When a domain matches, all tools in that domain get a sibling boost
+const categoryTools = new Map();
+for (const entry of REGISTRY) {
+    const list = categoryTools.get(entry.category) ?? [];
+    list.push(entry.name);
+    categoryTools.set(entry.category, list);
+}
+const domainCorpus = [...categoryTools.entries()].map(([category, toolNames]) => {
+    const allTags = new Set();
+    const descs = [];
+    for (const tn of toolNames) {
+        const e = REGISTRY.find((r) => r.name === tn);
+        if (e)
+            e.tags.forEach((t) => allTags.add(t));
+        const d = descMap.get(tn);
+        if (d)
+            descs.push(d);
+    }
+    return {
+        name: `domain:${category}`,
+        text: `${category} domain: ${toolNames.join(" ")} ${[...allTags].join(" ")} ${descs.map(d => d.slice(0, 80)).join(" ")}`,
+        nodeType: "domain",
+    };
+});
+const embeddingCorpus = [...toolCorpus, ...domainCorpus];
 initEmbeddingIndex(embeddingCorpus).catch(() => {
     /* Embedding init failed — semantic search stays disabled */
 });

package/dist/tools/actionAuditTools.d.ts

@@ -0,0 +1,2 @@
+import type { McpTool } from "../types.js";
+export declare const actionAuditTools: McpTool[];

package/dist/tools/actionAuditTools.js

@@ -0,0 +1,180 @@
+import { readFileSync, existsSync, readdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { getDb, genId } from "../db.js";
+import { getQuickRef } from "./toolRegistry.js";
+// ── Helpers ──────────────────────────────────────────────────────────
+function findConvexDir(projectDir) {
+    const candidates = [join(projectDir, "convex"), join(projectDir, "src", "convex")];
+    for (const c of candidates) {
+        if (existsSync(c))
+            return c;
+    }
+    return null;
+}
+function collectTsFiles(dir) {
+    const results = [];
+    if (!existsSync(dir))
+        return results;
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== "_generated") {
+            results.push(...collectTsFiles(full));
+        }
+        else if (entry.isFile() && entry.name.endsWith(".ts")) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function auditActions(convexDir) {
+    const files = collectTsFiles(convexDir);
+    const issues = [];
+    let totalActions = 0;
+    let actionsWithDbAccess = 0;
+    let actionsWithoutNodeDirective = 0;
+    let actionsWithoutErrorHandling = 0;
+    let actionCallingAction = 0;
+    // Node APIs that require "use node" directive
+    const nodeApis = /\b(require|__dirname|__filename|Buffer\.|process\.env|fs\.|path\.|crypto\.|child_process|net\.|http\.|https\.)\b/;
+    for (const filePath of files) {
+        const content = readFileSync(filePath, "utf-8");
+        const relativePath = filePath.replace(convexDir, "").replace(/^[\\/]/, "");
+        const lines = content.split("\n");
+        const hasUseNode = /["']use node["']/.test(content);
+        const actionPattern = /export\s+(?:const\s+(\w+)\s*=|default)\s+(action|internalAction)\s*\(/g;
+        let m;
+        while ((m = actionPattern.exec(content)) !== null) {
+            const funcName = m[1] || "default";
+            const funcType = m[2];
+            totalActions++;
+            const startLine = content.slice(0, m.index).split("\n").length - 1;
+            // Extract body using brace tracking
+            let depth = 0;
+            let foundOpen = false;
+            let endLine = Math.min(startLine + 100, lines.length);
+            for (let j = startLine; j < lines.length; j++) {
+                for (const ch of lines[j]) {
+                    if (ch === "{") {
+                        depth++;
+                        foundOpen = true;
+                    }
+                    if (ch === "}")
+                        depth--;
+                }
+                if (foundOpen && depth <= 0) {
+                    endLine = j + 1;
+                    break;
+                }
+            }
+            const body = lines.slice(startLine, endLine).join("\n");
+            // Check 1: ctx.db access in action (FATAL — not allowed)
+            if (/ctx\.db\.(get|query|insert|patch|replace|delete)\s*\(/.test(body)) {
+                actionsWithDbAccess++;
+                issues.push({
+                    severity: "critical",
+                    location: `${relativePath}:${startLine + 1}`,
+                    functionName: funcName,
+                    message: `${funcType} "${funcName}" accesses ctx.db directly. Actions cannot access the database — use ctx.runQuery/ctx.runMutation instead.`,
+                    fix: "Move DB operations into a query or mutation, then call via ctx.runQuery(internal.file.func, args) or ctx.runMutation(...)",
+                });
+            }
+            // Check 2: Node API usage without "use node"
+            if (!hasUseNode && nodeApis.test(body)) {
+                actionsWithoutNodeDirective++;
+                issues.push({
+                    severity: "critical",
+                    location: `${relativePath}:${startLine + 1}`,
+                    functionName: funcName,
+                    message: `${funcType} "${funcName}" uses Node.js APIs but file lacks "use node" directive. Will fail in Convex runtime.`,
+                    fix: `Add "use node"; at the top of ${relativePath}`,
+                });
+            }
+            // Check 3: External API calls without try/catch
+            const hasFetch = /\bfetch\s*\(/.test(body);
+            const hasAxios = /\baxios\b/.test(body);
+            const hasExternalCall = hasFetch || hasAxios;
+            const hasTryCatch = /try\s*\{/.test(body);
+            if (hasExternalCall && !hasTryCatch) {
+                actionsWithoutErrorHandling++;
+                issues.push({
+                    severity: "warning",
+                    location: `${relativePath}:${startLine + 1}`,
+                    functionName: funcName,
+                    message: `${funcType} "${funcName}" makes external API calls without try/catch. Network failures will crash the action.`,
+                    fix: "Wrap fetch/axios calls in try/catch and handle errors gracefully",
+                });
+            }
+            // Check 4: Action calling another action
+            if (/ctx\.runAction\s*\(/.test(body)) {
+                actionCallingAction++;
+                issues.push({
+                    severity: "warning",
+                    location: `${relativePath}:${startLine + 1}`,
+                    functionName: funcName,
+                    message: `${funcType} "${funcName}" calls ctx.runAction(). Only call action from action when crossing runtimes (V8 ↔ Node). Otherwise extract shared logic into a helper function.`,
+                    fix: "Extract shared logic into an async helper, or use ctx.runMutation/ctx.runQuery as intermediary",
+                });
+            }
+            // Check 5: Very long action body (likely doing too much)
+            const bodyLines = endLine - startLine;
+            if (bodyLines > 80) {
+                issues.push({
+                    severity: "info",
+                    location: `${relativePath}:${startLine + 1}`,
+                    functionName: funcName,
+                    message: `${funcType} "${funcName}" is ${bodyLines} lines long. Consider splitting into smaller actions or extracting helpers.`,
+                    fix: "Break large actions into smaller, focused functions",
+                });
+            }
+        }
+    }
+    return {
+        issues,
+        stats: {
+            totalActions,
+            actionsWithDbAccess,
+            actionsWithoutNodeDirective,
+            actionsWithoutErrorHandling,
+            actionCallingAction,
+        },
+    };
+}
+// ── Tool Definition ─────────────────────────────────────────────────
+export const actionAuditTools = [
+    {
+        name: "convex_audit_actions",
+        description: 'Audit Convex actions for: ctx.db access (fatal — actions cannot access DB directly), missing "use node" directive for Node APIs, external API calls without error handling, and action-calling-action anti-patterns.',
+        inputSchema: {
+            type: "object",
+            properties: {
+                projectDir: {
+                    type: "string",
+                    description: "Absolute path to the project root containing a convex/ directory",
+                },
+            },
+            required: ["projectDir"],
+        },
+        handler: async (args) => {
+            const projectDir = resolve(args.projectDir);
+            const convexDir = findConvexDir(projectDir);
+            if (!convexDir) {
+                return { error: "No convex/ directory found" };
+            }
+            const { issues, stats } = auditActions(convexDir);
+            const db = getDb();
+            db.prepare("INSERT INTO audit_results (id, project_dir, audit_type, issues_json, issue_count) VALUES (?, ?, ?, ?, ?)").run(genId("audit"), projectDir, "action_audit", JSON.stringify(issues), issues.length);
+            return {
+                summary: {
+                    ...stats,
+                    totalIssues: issues.length,
+                    critical: issues.filter((i) => i.severity === "critical").length,
+                    warnings: issues.filter((i) => i.severity === "warning").length,
+                },
+                issues: issues.slice(0, 30),
+                quickRef: getQuickRef("convex_audit_actions"),
+            };
+        },
+    },
+];
+//# sourceMappingURL=actionAuditTools.js.map

package/dist/tools/authorizationTools.d.ts

@@ -0,0 +1,2 @@
+import type { McpTool } from "../types.js";
+export declare const authorizationTools: McpTool[];

package/dist/tools/authorizationTools.js

@@ -0,0 +1,201 @@
+import { readFileSync, existsSync, readdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { getDb, genId } from "../db.js";
+import { getQuickRef } from "./toolRegistry.js";
+// ── Helpers ──────────────────────────────────────────────────────────
+function findConvexDir(projectDir) {
+    const candidates = [join(projectDir, "convex"), join(projectDir, "src", "convex")];
+    for (const c of candidates) {
+        if (existsSync(c))
+            return c;
+    }
+    return null;
+}
+function collectTsFiles(dir) {
+    const results = [];
+    if (!existsSync(dir))
+        return results;
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== "_generated") {
+            results.push(...collectTsFiles(full));
+        }
+        else if (entry.isFile() && entry.name.endsWith(".ts")) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function auditAuthorization(convexDir) {
+    const files = collectTsFiles(convexDir);
+    const issues = [];
+    let totalPublic = 0;
+    let withAuth = 0;
+    let withoutAuth = 0;
+    let uncheckedIdentity = 0;
+    const funcTypes = ["query", "mutation", "action"];
+    const writeSensitive = /admin|delete|purge|remove|destroy|drop|reset|wipe|erase|revoke/i;
+    const dbWriteOps = /ctx\.db\.(insert|patch|replace|delete)\s*\(/;
+    for (const filePath of files) {
+        const content = readFileSync(filePath, "utf-8");
+        const relativePath = filePath.replace(convexDir, "").replace(/^[\\/]/, "");
+        const lines = content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            for (const ft of funcTypes) {
+                const exportPattern = new RegExp(`export\\s+(?:const\\s+(\\w+)\\s*=|default)\\s+${ft}\\s*\\(`);
+                const match = line.match(exportPattern);
+                if (!match)
+                    continue;
+                const funcName = match[1] || "default";
+                totalPublic++;
+                // Extract function body using brace tracking
+                let depth = 0;
+                let foundOpen = false;
+                let endLine = Math.min(i + 100, lines.length);
+                for (let j = i; j < lines.length; j++) {
+                    for (const ch of lines[j]) {
+                        if (ch === "{") {
+                            depth++;
+                            foundOpen = true;
+                        }
+                        if (ch === "}")
+                            depth--;
+                    }
+                    if (foundOpen && depth <= 0) {
+                        endLine = j + 1;
+                        break;
+                    }
+                }
+                const body = lines.slice(i, endLine).join("\n");
+                const hasAuthCheck = /ctx\.auth\.getUserIdentity\s*\(\s*\)/.test(body) ||
+                    /getUserIdentity/.test(body);
+                const hasDbWrite = dbWriteOps.test(body);
+                const isSensitiveName = writeSensitive.test(funcName);
+                if (hasAuthCheck) {
+                    withAuth++;
+                    // Check: getUserIdentity called but return not null-checked
+                    const identityAssign = body.match(/(?:const|let)\s+(\w+)\s*=\s*await\s+ctx\.auth\.getUserIdentity\s*\(\s*\)/);
+                    if (identityAssign) {
+                        const varName = identityAssign[1];
+                        // Look for null check: if (!var), if (var === null), if (var == null), if (!var)
+                        const hasNullCheck = new RegExp(`if\\s*\\(\\s*!${varName}\\b|if\\s*\\(\\s*${varName}\\s*===?\\s*null|if\\s*\\(\\s*!${varName}\\s*\\)`).test(body);
+                        if (!hasNullCheck) {
+                            uncheckedIdentity++;
+                            issues.push({
+                                severity: "critical",
+                                location: `${relativePath}:${i + 1}`,
+                                functionName: funcName,
+                                message: `${ft} "${funcName}" calls getUserIdentity() but doesn't check for null. Unauthenticated users will get undefined identity.`,
+                                fix: `Add: if (!${varName}) { throw new Error("Not authenticated"); }`,
+                            });
+                        }
+                    }
+                }
+                else {
+                    withoutAuth++;
+                    // Critical: public mutation/action with DB writes but no auth
+                    if ((ft === "mutation" || ft === "action") && hasDbWrite) {
+                        issues.push({
+                            severity: "critical",
+                            location: `${relativePath}:${i + 1}`,
+                            functionName: funcName,
+                            message: `Public ${ft} "${funcName}" writes to DB without auth check. Any client can call this.`,
+                            fix: `Add: const identity = await ctx.auth.getUserIdentity(); if (!identity) throw new Error("Not authenticated");`,
+                        });
+                    }
+                    // Critical: sensitive-named function without auth
+                    if (isSensitiveName) {
+                        issues.push({
+                            severity: "critical",
+                            location: `${relativePath}:${i + 1}`,
+                            functionName: funcName,
+                            message: `Public ${ft} "${funcName}" has a sensitive name but no auth check. Consider making it internal or adding auth.`,
+                            fix: `Either change to internal${ft.charAt(0).toUpperCase() + ft.slice(1)} or add auth check`,
+                        });
+                    }
+                    // Warning: public query reading user-specific data without auth
+                    if (ft === "query" && /ctx\.db\.get|ctx\.db\.query/.test(body) && /user|profile|account|email/i.test(body)) {
+                        issues.push({
+                            severity: "warning",
+                            location: `${relativePath}:${i + 1}`,
+                            functionName: funcName,
+                            message: `Public query "${funcName}" accesses user-related data without auth. Consider if unauthenticated access is intended.`,
+                            fix: "Add auth check if this data should be protected",
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return {
+        issues,
+        stats: {
+            totalPublicFunctions: totalPublic,
+            publicWithAuth: withAuth,
+            publicWithoutAuth: withoutAuth,
+            uncheckedIdentity,
+        },
+    };
+}
+// ── Tool Definition ─────────────────────────────────────────────────
+export const authorizationTools = [
+    {
+        name: "convex_audit_authorization",
+        description: "Audit Convex functions for authorization issues: public mutations/actions writing to DB without auth checks, getUserIdentity() without null checks, sensitive-named functions without auth, and unprotected user data queries.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                projectDir: {
+                    type: "string",
+                    description: "Absolute path to the project root containing a convex/ directory",
+                },
+            },
+            required: ["projectDir"],
+        },
+        handler: async (args) => {
+            const projectDir = resolve(args.projectDir);
+            const convexDir = findConvexDir(projectDir);
+            if (!convexDir) {
+                return { error: "No convex/ directory found" };
+            }
+            const { issues, stats } = auditAuthorization(convexDir);
+            // Store audit result
+            const db = getDb();
+            db.prepare("INSERT INTO audit_results (id, project_dir, audit_type, issues_json, issue_count) VALUES (?, ?, ?, ?, ?)").run(genId("audit"), projectDir, "authorization", JSON.stringify(issues), issues.length);
+            const critical = issues.filter((i) => i.severity === "critical");
+            const warnings = issues.filter((i) => i.severity === "warning");
+            // Group by issue type
+            const byType = {};
+            for (const issue of issues) {
+                const type = issue.message.includes("without auth check") ? "no_auth_on_write" :
+                    issue.message.includes("null") ? "unchecked_identity" :
+                        issue.message.includes("sensitive name") ? "sensitive_no_auth" :
+                            issue.message.includes("user-related") ? "unprotected_user_data" :
+                                "other";
+                if (!byType[type])
+                    byType[type] = { count: 0, examples: [] };
+                byType[type].count++;
+                if (byType[type].examples.length < 3)
+                    byType[type].examples.push(issue);
+            }
+            return {
+                summary: {
+                    ...stats,
+                    totalIssues: issues.length,
+                    critical: critical.length,
+                    warnings: warnings.length,
+                    authCoverage: stats.totalPublicFunctions > 0
+                        ? `${stats.publicWithAuth}/${stats.totalPublicFunctions} (${Math.round(100 * stats.publicWithAuth / stats.totalPublicFunctions)}%)`
+                        : "0/0",
+                },
+                issuesByType: Object.entries(byType)
+                    .sort(([, a], [, b]) => b.count - a.count)
+                    .map(([type, data]) => ({ type, count: data.count, examples: data.examples })),
+                quickRef: getQuickRef("convex_audit_authorization"),
+            };
+        },
+    },
+];
+//# sourceMappingURL=authorizationTools.js.map

package/dist/tools/critterTools.js

@@ -32,22 +32,26 @@ function scoreCritterCheck(input) {
     const taskLower = input.task.toLowerCase().trim();
     const whyLower = input.why.toLowerCase().trim();
     const whoLower = input.who.toLowerCase().trim();
-    // Check 1: Circular reasoning
+    // Check 1: Circular reasoning (threshold 0.5)
     const taskWords = new Set(taskLower.split(/\s+/).filter((w) => w.length > 3));
     const whyWords = whyLower.split(/\s+/).filter((w) => w.length > 3);
     const overlap = whyWords.filter((w) => taskWords.has(w));
-    if (whyWords.length > 0 && overlap.length / whyWords.length > 0.7) {
+    if (whyWords.length > 0 && overlap.length / whyWords.length > 0.5) {
         score -= 30;
         feedback.push("Circular: your 'why' mostly restates the task. What user outcome does this enable?");
     }
     // Check 2: Vague audience
-    const vagueAudiences = ["users", "everyone", "people", "the team", "stakeholders", "clients"];
+    const vagueAudiences = ["users", "everyone", "people", "the team", "stakeholders", "clients", "customers", "developers"];
     if (vagueAudiences.includes(whoLower)) {
         score -= 20;
         feedback.push(`"${input.who}" is too broad. Which user role or API consumer specifically?`);
     }
-    // Check 3: Too short
-    if (whyLower.length < 10) {
+    // Check 3: Empty or too short
+    if (whyLower.length === 0) {
+        score -= 40;
+        feedback.push("Empty 'why': you haven't stated any purpose at all.");
+    }
+    else if (whyLower.length < 10) {
         score -= 25;
         feedback.push("The 'why' is too short. What problem does this solve?");
     }
@@ -61,6 +65,73 @@ function scoreCritterCheck(input) {
         score -= 15;
         feedback.push("Citing authority instead of understanding purpose. Why does this matter to the product?");
     }
+    // Check 5: Non-answer patterns (count matches, -20 each, cap -40)
+    const nonAnswerPatterns = [
+        "just because", "don't know", "not sure", "why not", "might need it",
+        "no reason", "no idea", "whatever", "idk", "tbd",
+    ];
+    const nonAnswerHits = nonAnswerPatterns.filter((p) => whyLower.includes(p)).length;
+    if (nonAnswerHits > 0) {
+        const nonAnswerPenalty = Math.min(nonAnswerHits * 20, 40);
+        score -= nonAnswerPenalty;
+        feedback.push("Non-answer: your 'why' signals unclear purpose. What specific problem does this solve?");
+    }
+    // Check 6: Repetitive padding (why + who)
+    const whyAllWords = whyLower.split(/\s+/).filter((w) => w.length > 2);
+    if (whyAllWords.length >= 5) {
+        const whyUniqueWords = new Set(whyAllWords);
+        if (whyUniqueWords.size / whyAllWords.length < 0.4) {
+            score -= 25;
+            feedback.push("Repetitive: your 'why' repeats the same words. Articulate distinct reasoning.");
+        }
+    }
+    const whoAllWords = whoLower.split(/\s+/).filter((w) => w.length > 2);
+    if (whoAllWords.length >= 5) {
+        const whoUniqueWords = new Set(whoAllWords);
+        if (whoUniqueWords.size / whoAllWords.length < 0.4) {
+            score -= 25;
+            feedback.push("Repetitive: your 'who' repeats the same words. Name a real audience.");
+        }
+    }
+    // Check 7: Buzzword-heavy corporate-speak (scans why + who)
+    const buzzwords = [
+        "leverage", "synergies", "synergy", "paradigm", "holistic", "alignment",
+        "transformation", "innovative", "disruptive", "best practices",
+        "streamline", "ecosystem", "actionable", "circle back",
+    ];
+    const allText = `${whyLower} ${whoLower}`;
+    const buzzCount = buzzwords.filter((b) => allText.includes(b)).length;
+    if (buzzCount >= 4) {
+        score -= 35;
+        feedback.push("Buzzword-heavy: corporate-speak without concrete meaning. What specific problem does this solve?");
+    }
+    else if (buzzCount >= 3) {
+        score -= 30;
+        feedback.push("Buzzword-heavy: corporate-speak without concrete meaning. What specific problem does this solve?");
+    }
+    else if (buzzCount >= 2) {
+        score -= 20;
+        feedback.push("Buzzword-heavy: corporate-speak without concrete meaning. What specific problem does this solve?");
+    }
+    // Check 8: Hedging language
+    const hedgeWords = ["could", "potentially", "maybe", "possibly", "might", "perhaps", "hopefully"];
+    const hedgeCount = hedgeWords.filter((h) => {
+        const regex = new RegExp(`\\b${h}\\b`, "i");
+        return regex.test(whyLower);
+    }).length;
+    if (hedgeCount >= 2) {
+        score -= 15;
+        feedback.push("Hedging: too many 'could/maybe/potentially' signals uncertain value. Be definitive.");
+    }
+    // Check 9: Task-word echo — same word from task repeated 3+ times in why
+    for (const tw of taskWords) {
+        const twCount = whyWords.filter((w) => w === tw).length;
+        if (twCount >= 3) {
+            score -= 20;
+            feedback.push(`Echo: "${tw}" appears ${twCount} times in your 'why' — this is filler, not reasoning.`);
+            break;
+        }
+    }
     // Bonus for specificity
     if (input.success_looks_like && input.success_looks_like.length > 20) {
         score += 10;

package/dist/tools/dataModelingTools.d.ts

@@ -0,0 +1,2 @@
+import type { McpTool } from "../types.js";
+export declare const dataModelingTools: McpTool[];