@massa-ai/mcp-client 1.7.1 → 1.8.0

package/dist/config-cli.js

@@ -542,6 +542,9 @@ var init_massa_ai_config = __esm(() => {
     },
     handoffs: {
       enabled: true
+    },
+    security: {
+      corsOrigins: []
     }
   };
 });
@@ -563,6 +566,7 @@ __export(exports_config_loader, {
 import fs from "fs";
 import path3 from "path";
 import os2 from "os";
+import crypto2 from "crypto";
 function getConfigDir() {
   return CONFIG_DIR;
 }
@@ -591,7 +595,8 @@ function loadConfig() {
       llm: { ...defaultMassaAiConfig.llm, ...userConfig.llm },
       memory: { ...defaultMassaAiConfig.memory, ...userConfig.memory },
       hooks: { ...defaultMassaAiConfig.hooks, ...userConfig.hooks },
-      handoffs: { ...defaultMassaAiConfig.handoffs, ...userConfig.handoffs }
+      handoffs: { ...defaultMassaAiConfig.handoffs, ...userConfig.handoffs },
+      security: { ...defaultMassaAiConfig.security, ...userConfig.security }
     };
   } catch (error) {
     console.error(`Error loading config from ${CONFIG_FILE}:`, error);
@@ -635,7 +640,17 @@ function saveConfig(config) {
   if (!fs.existsSync(CONFIG_DIR)) {
     fs.mkdirSync(CONFIG_DIR, { recursive: true });
   }
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
+  const unique = `${process.pid}.${++tempFileCounter}.${crypto2.randomBytes(6).toString("hex")}`;
+  const tempFile = path3.join(CONFIG_DIR, `.config.json.${unique}.tmp`);
+  try {
+    fs.writeFileSync(tempFile, JSON.stringify(config, null, 2));
+    fs.renameSync(tempFile, CONFIG_FILE);
+  } catch (error) {
+    try {
+      fs.unlinkSync(tempFile);
+    } catch {}
+    throw error;
+  }
 }
 function initConfig() {
   if (!fs.existsSync(CONFIG_FILE)) {
@@ -663,7 +678,7 @@ function getConfigForEnv() {
   env.ENABLE_METRICS = String(config.logging.enableMetrics);
   return env;
 }
-var CONFIG_DIR, CONFIG_FILE, migrationAttempted = false;
+var CONFIG_DIR, CONFIG_FILE, migrationAttempted = false, tempFileCounter = 0;
 var init_config_loader = __esm(() => {
   init_massa_ai_config();
   init_xdg();
@@ -706,9 +721,18 @@ var init_env = __esm(() => {
     if (cfg.embedding?.apiKey && !process.env.OLLAMA_API_KEY) {
       process.env.OLLAMA_API_KEY = cfg.embedding.apiKey;
     }
+    const securityApiKey = cfg.security?.apiKey?.trim();
+    if (securityApiKey && !process.env.MASSA_AI_API_KEY?.trim()) {
+      process.env.MASSA_AI_API_KEY = securityApiKey;
+    }
   } catch {}
 });
 
+// ../../packages/shared/dist/config/api-key.js
+var init_api_key = __esm(() => {
+  init_config_loader();
+});
+
 // ../../packages/shared/dist/config/db-guard.js
 function requirePostgresDatabaseUrl(databaseUrl = process.env.DATABASE_URL) {
   if (!databaseUrl?.trim()) {
@@ -765,6 +789,13 @@ function envString(key, fallback) {
   const s = process.env[key];
   return s === undefined || s === "" ? fallback : s;
 }
+function envList(key, fallback) {
+  const s = process.env[key];
+  if (s === undefined)
+    return fallback;
+  const parsed = s.split(",").map((v) => v.trim()).filter((v) => v.length > 0);
+  return parsed.length > 0 ? parsed : fallback;
+}
 function validateCapturePolicyConfig(raw2) {
   if (!raw2 || typeof raw2 !== "object")
     throw new TypeError("capturePolicy must be an object");
@@ -952,6 +983,7 @@ var init_config = __esm(() => {
   init_config_loader();
   init_massa_ai_config();
   init_config_loader();
+  init_api_key();
   DEFAULT_ALLOWED_EXTENSIONS = [
     ".ts",
     ".js",
@@ -1111,7 +1143,8 @@ var init_config = __esm(() => {
         "**/generated/**",
         "*.min.js",
         "*.min.css"
-      ]
+      ],
+      corsOrigins: envList("MASSA_AI_API_CORS_ORIGINS", fileConfig.security?.corsOrigins ?? [])
     },
     logging: {
       level: process.env.LOG_LEVEL || fileConfig.logging?.level || "info",
@@ -99799,7 +99832,7 @@ var require_cert_signatures = __commonJS((exports, module) => {
 
 // ../../node_modules/pg/lib/crypto/sasl.js
 var require_sasl = __commonJS((exports, module) => {
-  var crypto2 = require_utils4();
+  var crypto3 = require_utils4();
   var { signatureAlgorithmHashFromCertificate } = require_cert_signatures();
   function saslprep(password) {
     const nonAsciiSpace = /[\u00A0\u1680\u2000-\u200B\u202F\u205F\u3000]/g;
@@ -99818,7 +99851,7 @@ var require_sasl = __commonJS((exports, module) => {
     if (mechanism === "SCRAM-SHA-256-PLUS" && typeof stream2.getPeerCertificate !== "function") {
       throw new Error("SASL: Mechanism SCRAM-SHA-256-PLUS requires a certificate");
     }
-    const clientNonce = crypto2.randomBytes(18).toString("base64");
+    const clientNonce = crypto3.randomBytes(18).toString("base64");
     const gs2Header = mechanism === "SCRAM-SHA-256-PLUS" ? "p=tls-server-end-point" : stream2 ? "y" : "n";
     return {
       mechanism,
@@ -99859,20 +99892,20 @@ var require_sasl = __commonJS((exports, module) => {
       let hashName = signatureAlgorithmHashFromCertificate(peerCert);
       if (hashName === "MD5" || hashName === "SHA-1")
         hashName = "SHA-256";
-      const certHash = await crypto2.hashByName(hashName, peerCert);
+      const certHash = await crypto3.hashByName(hashName, peerCert);
       const bindingData = Buffer.concat([Buffer.from("p=tls-server-end-point,,"), Buffer.from(certHash)]);
       channelBinding = bindingData.toString("base64");
     }
     const clientFinalMessageWithoutProof = "c=" + channelBinding + ",r=" + sv.nonce;
     const authMessage = clientFirstMessageBare + "," + serverFirstMessage + "," + clientFinalMessageWithoutProof;
     const saltBytes = Buffer.from(sv.salt, "base64");
-    const saltedPassword = await crypto2.deriveKey(saslprep(password), saltBytes, sv.iteration);
-    const clientKey = await crypto2.hmacSha256(saltedPassword, "Client Key");
-    const storedKey = await crypto2.sha256(clientKey);
-    const clientSignature = await crypto2.hmacSha256(storedKey, authMessage);
+    const saltedPassword = await crypto3.deriveKey(saslprep(password), saltBytes, sv.iteration);
+    const clientKey = await crypto3.hmacSha256(saltedPassword, "Client Key");
+    const storedKey = await crypto3.sha256(clientKey);
+    const clientSignature = await crypto3.hmacSha256(storedKey, authMessage);
     const clientProof = xorBuffers(Buffer.from(clientKey), Buffer.from(clientSignature)).toString("base64");
-    const serverKey = await crypto2.hmacSha256(saltedPassword, "Server Key");
-    const serverSignatureBytes = await crypto2.hmacSha256(serverKey, authMessage);
+    const serverKey = await crypto3.hmacSha256(saltedPassword, "Server Key");
+    const serverSignatureBytes = await crypto3.hmacSha256(serverKey, authMessage);
     session.message = "SASLResponse";
     session.serverSignature = Buffer.from(serverSignatureBytes).toString("base64");
     session.response = clientFinalMessageWithoutProof + ",p=" + clientProof;
@@ -101980,7 +102013,7 @@ var require_client2 = __commonJS((exports, module) => {
   var Query = require_query();
   var defaults2 = require_defaults();
   var Connection = require_connection();
-  var crypto2 = require_utils4();
+  var crypto3 = require_utils4();
   var activeQueryDeprecationNotice = nodeUtils.deprecate(() => {}, "Client.activeQuery is deprecated and will be removed in pg@9.0");
   var queryQueueDeprecationNotice = nodeUtils.deprecate(() => {}, "Client.queryQueue is deprecated and will be removed in pg@9.0.");
   var pgPassDeprecationNotice = nodeUtils.deprecate(() => {}, "pgpass support is deprecated and will be removed in pg@9.0. " + "You can provide an async function as the password property to the Client/Pool constructor that returns a password instead. Within this function you can call the pgpass module in your own code.");
@@ -102212,7 +102245,7 @@ var require_client2 = __commonJS((exports, module) => {
     _handleAuthMD5Password(msg) {
       this._getPassword(async () => {
         try {
-          const hashedPassword = await crypto2.postgresMd5PasswordHash(this.user, this.password, msg.salt);
+          const hashedPassword = await crypto3.postgresMd5PasswordHash(this.user, this.password, msg.salt);
           this.connection.password(hashedPassword);
         } catch (e) {
           this.emit("error", e);
@@ -105267,10 +105300,7 @@ class EmbeddingService {
   async embed(text2) {
     await this.ensureInitialized();
     if (!this.provider) {
-      const msg = "No embedding provider available. Configure OLLAMA_BASE_URL or an API key.";
-      if (false) {}
-      logger.warn(msg + " Using random embeddings (dev only).");
-      return new Array(384).fill(0).map(() => Math.random());
+      throw new Error(NO_PROVIDER_MESSAGE);
     }
     try {
       return await this.provider.embedQuery(text2);
@@ -105284,10 +105314,7 @@ class EmbeddingService {
   async embedBatch(texts) {
     await this.ensureInitialized();
     if (!this.provider) {
-      const msg = "No embedding provider available. Configure OLLAMA_BASE_URL or an API key.";
-      if (false) {}
-      logger.warn(msg + " Using random embeddings (dev only).");
-      return texts.map(() => new Array(384).fill(0).map(() => Math.random()));
+      throw new Error(NO_PROVIDER_MESSAGE);
     }
     try {
       return await this.provider.embedBatch(texts);
@@ -105299,7 +105326,10 @@ class EmbeddingService {
     }
   }
   getDimensions() {
-    return this.provider?.dimensions || 384;
+    if (!this.provider) {
+      throw new Error(NO_PROVIDER_MESSAGE);
+    }
+    return this.provider.dimensions;
   }
   getProviderInfo() {
     if (!this.provider)
@@ -105316,6 +105346,7 @@ class EmbeddingService {
     return dotProduct / (magnitude1 * magnitude2);
   }
 }
+var NO_PROVIDER_MESSAGE = "No embedding provider available. Configure OLLAMA_BASE_URL or an API key.";
 var init_embedding_service = __esm(() => {
   init_dist();
   init_embeddings();
@@ -107714,6 +107745,12 @@ class ProjectIdentityAliasResolver {
       return projectId;
     }
   }
+  resolveCached(projectId) {
+    if (!projectId)
+      return;
+    const cached2 = this.cache.get(projectId);
+    return cached2 && cached2.expiresAt > this.now() ? cached2.canonical : undefined;
+  }
   async resolveWithTimeout(projectId) {
     let timer;
     try {
@@ -109473,7 +109510,7 @@ var init_vector_store_factory = __esm(() => {
 });
 
 // ../../packages/core/dist/services/search/search-cache-pg.js
-import crypto2 from "crypto";
+import crypto3 from "crypto";
 
 class SearchCachePg {
   pool = null;
@@ -109530,7 +109567,7 @@ class SearchCachePg {
       projectId,
       options: this.normalizeOptions(options)
     });
-    return crypto2.createHash("sha256").update(payload).digest("hex");
+    return crypto3.createHash("sha256").update(payload).digest("hex");
   }
   normalizeOptions(options) {
     const searchAffectingParams = [
@@ -112227,7 +112264,7 @@ async function _indexProjectInternalImpl(rlm, projectPath, projectId, options =
       projectId
     });
     options.onProgress?.(0, filteredFiles.length);
-    const centralityMap = await rlm.symbolRepo.getCentrality(projectId);
+    const centralityMap = await rlm.symbolRepo.getCentrality(await getProjectIdentityAliasResolver().resolve(projectId));
     let filesIndexed = 0;
     let chunksIndexed = 0;
     let errors4 = 0;
@@ -112374,7 +112411,7 @@ async function ensureFreshIndexImpl(rlm, projectId, projectPath, options = {}) {
     projectId,
     fileCount: filesToReindex.length
   });
-  const centralityMap = await rlm.symbolRepo.getCentrality(projectId);
+  const centralityMap = await rlm.symbolRepo.getCentrality(await getProjectIdentityAliasResolver().resolve(projectId));
   let filesIndexed = 0;
   let chunksIndexed = 0;
   let errors4 = 0;
@@ -115584,6 +115621,8 @@ async function buildGraphStreamImpl(_rlm, resultSets, maxResults, projectId, rep
         const row = await Promise.resolve(repo.getById(id));
         if (!row || row.deleted_at !== null)
           continue;
+        if (projectId && row.project_id !== projectId)
+          continue;
         out.push({
           id: row.id,
           content: row.content,
@@ -121755,7 +121794,8 @@ class PgObservationStore {
     return this.hydrating;
   }
   insert(obs) {
-    this.mirror.set(obs.id, obs);
+    const cachedCanonical = getProjectIdentityAliasResolver().resolveCached(obs.projectId);
+    this.mirror.set(obs.id, cachedCanonical && cachedCanonical !== obs.projectId ? { ...obs, projectId: cachedCanonical } : obs);
     this.ensureHydrated();
     (async () => {
       try {
@@ -123303,10 +123343,8 @@ var init_models_dev_client = __esm(() => {
 
 // ../../packages/core/dist/services/graph/relation-extractor.js
 class RelationExtractor {
-  embeddingService;
   graphStore;
   constructor(graphStore) {
-    this.embeddingService = new EmbeddingService;
     this.graphStore = graphStore ?? getGraphStore();
   }
   async extractRelations(memoryId, options) {
@@ -123480,7 +123518,6 @@ class RelationExtractor {
 var DEFAULT_OPTIONS, CONTRADICTION_SIGNALS, RESOLUTION_SIGNALS, DERIVATION_SIGNALS, SUPPORT_SIGNALS;
 var init_relation_extractor = __esm(() => {
   init_dist();
-  init_embeddings();
   init_graph_store_factory();
   init_memory_repository_factory();
   DEFAULT_OPTIONS = {
@@ -128911,7 +128948,7 @@ class ResolveStage {
       timestamp: Date.now()
     });
     const knownRelPaths = new Set(files.map((f) => f.file.relativePath));
-    const { index: symbolIndex, definitions: repositoryDefinitions } = await this.buildSymbolIndex(ctx.projectId, files);
+    const { index: symbolIndex, fqns: knownFqns, definitions: repositoryDefinitions } = await this.buildSymbolIndex(ctx.projectId, files);
     if (ctx.abortSignal?.aborted)
       throw ctx.abortSignal.reason;
     const rootAliases = this.loadTsConfigPaths(ctx.projectPath);
@@ -128949,7 +128986,7 @@ class ResolveStage {
     const resolved = [];
     let processed = 0;
     for (const parsedFile of files) {
-      const resolvedFile = parsedFile.structure && session2 ? this.resolveStructuralFile(parsedFile, session2, knownRelPaths, rootAliases, monorepoPackages) : this.resolveFile(parsedFile, ctx.projectPath, knownRelPaths, rootAliases, monorepoPackages, symbolIndex);
+      const resolvedFile = parsedFile.structure && session2 ? this.resolveStructuralFile(parsedFile, session2, knownRelPaths, rootAliases, monorepoPackages) : this.resolveFile(parsedFile, ctx.projectPath, knownRelPaths, rootAliases, monorepoPackages, symbolIndex, knownFqns);
       resolved.push(resolvedFile);
       processed++;
       if (processed % 50 === 0) {
@@ -129081,7 +129118,7 @@ class ResolveStage {
       defaultExport: false
     });
   }
-  resolveFile(parsed, projectPath, knownRelPaths, rootAliases, monorepoPackages, symbolIndex) {
+  resolveFile(parsed, projectPath, knownRelPaths, rootAliases, monorepoPackages, symbolIndex, knownFqns) {
     const fromDir = path17.dirname(path17.join(projectPath, parsed.file.relativePath));
     const packageAliases = this.getPackageAliases(parsed.file.relativePath, monorepoPackages);
     const allAliases = [...packageAliases, ...rootAliases];
@@ -129108,7 +129145,7 @@ class ResolveStage {
     }
     const localNames = new Set(parsed.symbols.map((s) => s.name));
     const resolvedEdges = (parsed.rawEdges ?? []).map((edge) => {
-      const targetFqn = this.resolveEdgeTarget(edge.symbolName, parsed.file.relativePath, localNames, importNameToPath, namespaceToPath, symbolIndex);
+      const targetFqn = this.resolveEdgeTarget(edge.symbolName, parsed.file.relativePath, localNames, importNameToPath, namespaceToPath, symbolIndex, knownFqns);
       const meta3 = { ...edge.meta ?? {} };
       if (edge.callerSymbol) {
         meta3.callerFqn = `${parsed.file.relativePath}#${edge.callerSymbol}`;
@@ -129122,7 +129159,7 @@ class ResolveStage {
       resolvedEdges
     };
   }
-  resolveEdgeTarget(name26, thisFile, localNames, importNameToPath, namespaceToPath, symbolIndex) {
+  resolveEdgeTarget(name26, thisFile, localNames, importNameToPath, namespaceToPath, symbolIndex, knownFqns) {
     if (localNames.has(name26))
       return `${thisFile}#${name26}`;
     const importedPath = importNameToPath.get(name26);
@@ -129131,6 +129168,8 @@ class ResolveStage {
     const nsPath = namespaceToPath.get("*") ?? namespaceToPath.get("default");
     if (nsPath) {
       const nsFqn = `${nsPath}#${name26}`;
+      if (knownFqns.has(nsFqn))
+        return nsFqn;
       if (symbolIndex.has(name26))
         return symbolIndex.get(name26);
       return nsFqn;
@@ -129140,10 +129179,12 @@ class ResolveStage {
   }
   async buildSymbolIndex(projectId, files) {
     const index = new Map;
+    const fqns = new Set;
     let repositoryDefinitions = [];
     try {
       repositoryDefinitions = await this.symbolRepository.listAllDefinitions(projectId);
       for (const def of repositoryDefinitions) {
+        fqns.add(`${def.file_path}#${def.name}`);
         if (index.has(def.name))
           continue;
         index.set(def.name, `${def.file_path}#${def.name}`);
@@ -129160,6 +129201,7 @@ class ResolveStage {
     const inBatch = new Map;
     for (const f of files) {
       for (const sym of f.symbols) {
+        fqns.add(`${f.file.relativePath}#${sym.name}`);
         if (inBatch.has(sym.name))
           continue;
         inBatch.set(sym.name, `${f.file.relativePath}#${sym.name}`);
@@ -129168,7 +129210,7 @@ class ResolveStage {
     for (const [name26, fqn] of inBatch) {
       index.set(name26, fqn);
     }
-    return { index, definitions: repositoryDefinitions };
+    return { index, fqns, definitions: repositoryDefinitions };
   }
   resolveSpecifier(specifier, fromDir, projectPath, knownRelPaths, aliases) {
     if (specifier.startsWith("./") || specifier.startsWith("../")) {
@@ -130289,6 +130331,10 @@ var init_pipeline = __esm(() => {
           });
         } catch (beginError) {
           if (beginError.message.startsWith("graph_generation_stale_active:") && generationRetry < 3) {
+            stopManagedRunHeartbeat = true;
+            managedRunTimerController.abort();
+            if (managedRunHeartbeat)
+              await managedRunHeartbeat;
             return this.runInternal(input, generationRetry + 1);
           }
           throw beginError;
@@ -132372,6 +132418,13 @@ function isSeatbeltAvailable() {
   }
   return _seatbeltAvailable;
 }
+function warnSandboxUnavailable() {
+  if (_warnedAboutNoSandbox)
+    return;
+  _warnedAboutNoSandbox = true;
+  const missingTool = process.platform === "darwin" ? "sandbox-exec" : "docker";
+  logger.warn(`sandbox: MASSA_AI_EXECUTOR_SANDBOX=auto found no '${missingTool}' on this platform, ` + `so code is executing with best-effort containment and no OS-level isolation. ` + `Install '${missingTool}', or set MASSA_AI_EXECUTOR_SANDBOX=on to fail loudly instead of falling back.`, { missingTool, platform: process.platform, effectiveMode: "none" });
+}
 function getSandboxMode() {
   const env4 = process.env.MASSA_AI_EXECUTOR_SANDBOX ?? "auto";
   if (env4 === "none")
@@ -132389,6 +132442,7 @@ function getSandboxMode() {
     return "seatbelt";
   if (isLinux && isDockerAvailable())
     return "docker";
+  warnSandboxUnavailable();
   return "none";
 }
 function _buildSeatbeltProfile(projectRoot, tmpDir) {
@@ -132456,7 +132510,7 @@ function wrapSpawn(cmd, cwd, tmpDir, mode) {
   }
   return cmd;
 }
-var _dockerAvailable = null, _seatbeltAvailable = null;
+var _dockerAvailable = null, _seatbeltAvailable = null, _warnedAboutNoSandbox = false;
 var init_sandbox = __esm(() => {
   init_dist();
 });
@@ -132618,7 +132672,8 @@ class PolyglotExecutor {
         stdout: "",
         stderr: `Blocked: path "${filePath}" resolves outside the project root (${root}).`,
         exitCode: 1,
-        timedOut: false
+        timedOut: false,
+        sandboxMode: getSandboxMode()
       };
       return err;
     }
@@ -132627,7 +132682,8 @@ class PolyglotExecutor {
         stdout: "",
         stderr: `Blocked: path "${filePath}" matches a deny-listed pattern (secrets/credentials).`,
         exitCode: 1,
-        timedOut: false
+        timedOut: false,
+        sandboxMode: getSandboxMode()
       };
       return err;
     }
@@ -132678,7 +132734,8 @@ ${body}`;
           stderr: `Compilation failed:
 ${message}`,
           exitCode: 1,
-          timedOut: false
+          timedOut: false,
+          sandboxMode: getSandboxMode()
         };
       }
       return await this.#spawn([binPath], cwd, cwd, timeout, false);
@@ -132721,7 +132778,8 @@ ${message}`,
             timedOut: true,
             backgrounded: true,
             command: cmd.join(" "),
-            cwd
+            cwd,
+            sandboxMode
           });
         } else {
           killTree(proc2);
@@ -132760,7 +132818,8 @@ ${message}`,
           exitCode: timedOut ? null : exitCode,
           timedOut,
           command: cmd.join(" "),
-          cwd
+          cwd,
+          sandboxMode
         });
       });
       proc2.on("error", (err) => {
@@ -132774,7 +132833,8 @@ ${message}`,
           exitCode: null,
           timedOut: false,
           command: cmd.join(" "),
-          cwd
+          cwd,
+          sandboxMode
         });
       });
     });
@@ -133112,6 +133172,7 @@ var init_intent_search = __esm(() => {
 var init_executor2 = __esm(() => {
   init_executor();
   init_executor();
+  init_sandbox();
   init_run_pool();
   init_runtime();
   init_intent_search();

package/dist/index.js

@@ -25539,6 +25539,9 @@ var init_massa_ai_config = __esm(() => {
     },
     handoffs: {
       enabled: true
+    },
+    security: {
+      corsOrigins: []
     }
   };
 });
@@ -25560,6 +25563,7 @@ __export(exports_config_loader, {
 import fs from "fs";
 import path3 from "path";
 import os2 from "os";
+import crypto2 from "crypto";
 function getConfigDir() {
   return CONFIG_DIR;
 }
@@ -25588,7 +25592,8 @@ function loadConfig() {
       llm: { ...defaultMassaAiConfig.llm, ...userConfig.llm },
       memory: { ...defaultMassaAiConfig.memory, ...userConfig.memory },
       hooks: { ...defaultMassaAiConfig.hooks, ...userConfig.hooks },
-      handoffs: { ...defaultMassaAiConfig.handoffs, ...userConfig.handoffs }
+      handoffs: { ...defaultMassaAiConfig.handoffs, ...userConfig.handoffs },
+      security: { ...defaultMassaAiConfig.security, ...userConfig.security }
     };
   } catch (error51) {
     console.error(`Error loading config from ${CONFIG_FILE}:`, error51);
@@ -25632,7 +25637,17 @@ function saveConfig(config2) {
   if (!fs.existsSync(CONFIG_DIR)) {
     fs.mkdirSync(CONFIG_DIR, { recursive: true });
   }
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config2, null, 2));
+  const unique = `${process.pid}.${++tempFileCounter}.${crypto2.randomBytes(6).toString("hex")}`;
+  const tempFile = path3.join(CONFIG_DIR, `.config.json.${unique}.tmp`);
+  try {
+    fs.writeFileSync(tempFile, JSON.stringify(config2, null, 2));
+    fs.renameSync(tempFile, CONFIG_FILE);
+  } catch (error51) {
+    try {
+      fs.unlinkSync(tempFile);
+    } catch {}
+    throw error51;
+  }
 }
 function initConfig() {
   if (!fs.existsSync(CONFIG_FILE)) {
@@ -25660,7 +25675,7 @@ function getConfigForEnv() {
   env.ENABLE_METRICS = String(config2.logging.enableMetrics);
   return env;
 }
-var CONFIG_DIR, CONFIG_FILE, migrationAttempted = false;
+var CONFIG_DIR, CONFIG_FILE, migrationAttempted = false, tempFileCounter = 0;
 var init_config_loader = __esm(() => {
   init_massa_ai_config();
   init_xdg();
@@ -25703,9 +25718,18 @@ var init_env = __esm(() => {
     if (cfg.embedding?.apiKey && !process.env.OLLAMA_API_KEY) {
       process.env.OLLAMA_API_KEY = cfg.embedding.apiKey;
     }
+    const securityApiKey = cfg.security?.apiKey?.trim();
+    if (securityApiKey && !process.env.MASSA_AI_API_KEY?.trim()) {
+      process.env.MASSA_AI_API_KEY = securityApiKey;
+    }
   } catch {}
 });
 
+// ../../packages/shared/dist/config/api-key.js
+var init_api_key = __esm(() => {
+  init_config_loader();
+});
+
 // ../../packages/shared/dist/config/db-guard.js
 function requirePostgresDatabaseUrl(databaseUrl = process.env.DATABASE_URL) {
   if (!databaseUrl?.trim()) {
@@ -25762,6 +25786,13 @@ function envString(key, fallback) {
   const s = process.env[key];
   return s === undefined || s === "" ? fallback : s;
 }
+function envList(key, fallback) {
+  const s = process.env[key];
+  if (s === undefined)
+    return fallback;
+  const parsed = s.split(",").map((v) => v.trim()).filter((v) => v.length > 0);
+  return parsed.length > 0 ? parsed : fallback;
+}
 function validateCapturePolicyConfig(raw2) {
   if (!raw2 || typeof raw2 !== "object")
     throw new TypeError("capturePolicy must be an object");
@@ -25949,6 +25980,7 @@ var init_config = __esm(() => {
   init_config_loader();
   init_massa_ai_config();
   init_config_loader();
+  init_api_key();
   DEFAULT_ALLOWED_EXTENSIONS = [
     ".ts",
     ".js",
@@ -26108,7 +26140,8 @@ var init_config = __esm(() => {
         "**/generated/**",
         "*.min.js",
         "*.min.css"
-      ]
+      ],
+      corsOrigins: envList("MASSA_AI_API_CORS_ORIGINS", fileConfig.security?.corsOrigins ?? [])
     },
     logging: {
       level: process.env.LOG_LEVEL || fileConfig.logging?.level || "info",
@@ -106358,7 +106391,7 @@ var require_cert_signatures = __commonJS((exports, module) => {
 
 // ../../node_modules/pg/lib/crypto/sasl.js
 var require_sasl = __commonJS((exports, module) => {
-  var crypto2 = require_utils5();
+  var crypto3 = require_utils5();
   var { signatureAlgorithmHashFromCertificate } = require_cert_signatures();
   function saslprep(password) {
     const nonAsciiSpace = /[\u00A0\u1680\u2000-\u200B\u202F\u205F\u3000]/g;
@@ -106377,7 +106410,7 @@ var require_sasl = __commonJS((exports, module) => {
     if (mechanism === "SCRAM-SHA-256-PLUS" && typeof stream2.getPeerCertificate !== "function") {
       throw new Error("SASL: Mechanism SCRAM-SHA-256-PLUS requires a certificate");
     }
-    const clientNonce = crypto2.randomBytes(18).toString("base64");
+    const clientNonce = crypto3.randomBytes(18).toString("base64");
     const gs2Header = mechanism === "SCRAM-SHA-256-PLUS" ? "p=tls-server-end-point" : stream2 ? "y" : "n";
     return {
       mechanism,
@@ -106418,20 +106451,20 @@ var require_sasl = __commonJS((exports, module) => {
       let hashName = signatureAlgorithmHashFromCertificate(peerCert);
       if (hashName === "MD5" || hashName === "SHA-1")
         hashName = "SHA-256";
-      const certHash = await crypto2.hashByName(hashName, peerCert);
+      const certHash = await crypto3.hashByName(hashName, peerCert);
       const bindingData = Buffer.concat([Buffer.from("p=tls-server-end-point,,"), Buffer.from(certHash)]);
       channelBinding = bindingData.toString("base64");
     }
     const clientFinalMessageWithoutProof = "c=" + channelBinding + ",r=" + sv.nonce;
     const authMessage = clientFirstMessageBare + "," + serverFirstMessage + "," + clientFinalMessageWithoutProof;
     const saltBytes = Buffer.from(sv.salt, "base64");
-    const saltedPassword = await crypto2.deriveKey(saslprep(password), saltBytes, sv.iteration);
-    const clientKey = await crypto2.hmacSha256(saltedPassword, "Client Key");
-    const storedKey = await crypto2.sha256(clientKey);
-    const clientSignature = await crypto2.hmacSha256(storedKey, authMessage);
+    const saltedPassword = await crypto3.deriveKey(saslprep(password), saltBytes, sv.iteration);
+    const clientKey = await crypto3.hmacSha256(saltedPassword, "Client Key");
+    const storedKey = await crypto3.sha256(clientKey);
+    const clientSignature = await crypto3.hmacSha256(storedKey, authMessage);
     const clientProof = xorBuffers(Buffer.from(clientKey), Buffer.from(clientSignature)).toString("base64");
-    const serverKey = await crypto2.hmacSha256(saltedPassword, "Server Key");
-    const serverSignatureBytes = await crypto2.hmacSha256(serverKey, authMessage);
+    const serverKey = await crypto3.hmacSha256(saltedPassword, "Server Key");
+    const serverSignatureBytes = await crypto3.hmacSha256(serverKey, authMessage);
     session.message = "SASLResponse";
     session.serverSignature = Buffer.from(serverSignatureBytes).toString("base64");
     session.response = clientFinalMessageWithoutProof + ",p=" + clientProof;
@@ -108539,7 +108572,7 @@ var require_client2 = __commonJS((exports, module) => {
   var Query = require_query();
   var defaults2 = require_defaults2();
   var Connection = require_connection();
-  var crypto2 = require_utils5();
+  var crypto3 = require_utils5();
   var activeQueryDeprecationNotice = nodeUtils.deprecate(() => {}, "Client.activeQuery is deprecated and will be removed in pg@9.0");
   var queryQueueDeprecationNotice = nodeUtils.deprecate(() => {}, "Client.queryQueue is deprecated and will be removed in pg@9.0.");
   var pgPassDeprecationNotice = nodeUtils.deprecate(() => {}, "pgpass support is deprecated and will be removed in pg@9.0. " + "You can provide an async function as the password property to the Client/Pool constructor that returns a password instead. Within this function you can call the pgpass module in your own code.");
@@ -108771,7 +108804,7 @@ var require_client2 = __commonJS((exports, module) => {
     _handleAuthMD5Password(msg) {
       this._getPassword(async () => {
         try {
-          const hashedPassword = await crypto2.postgresMd5PasswordHash(this.user, this.password, msg.salt);
+          const hashedPassword = await crypto3.postgresMd5PasswordHash(this.user, this.password, msg.salt);
           this.connection.password(hashedPassword);
         } catch (e) {
           this.emit("error", e);
@@ -111826,10 +111859,7 @@ class EmbeddingService {
   async embed(text2) {
     await this.ensureInitialized();
     if (!this.provider) {
-      const msg = "No embedding provider available. Configure OLLAMA_BASE_URL or an API key.";
-      if (false) {}
-      logger.warn(msg + " Using random embeddings (dev only).");
-      return new Array(384).fill(0).map(() => Math.random());
+      throw new Error(NO_PROVIDER_MESSAGE);
     }
     try {
       return await this.provider.embedQuery(text2);
@@ -111843,10 +111873,7 @@ class EmbeddingService {
   async embedBatch(texts) {
     await this.ensureInitialized();
     if (!this.provider) {
-      const msg = "No embedding provider available. Configure OLLAMA_BASE_URL or an API key.";
-      if (false) {}
-      logger.warn(msg + " Using random embeddings (dev only).");
-      return texts.map(() => new Array(384).fill(0).map(() => Math.random()));
+      throw new Error(NO_PROVIDER_MESSAGE);
     }
     try {
       return await this.provider.embedBatch(texts);
@@ -111858,7 +111885,10 @@ class EmbeddingService {
     }
   }
   getDimensions() {
-    return this.provider?.dimensions || 384;
+    if (!this.provider) {
+      throw new Error(NO_PROVIDER_MESSAGE);
+    }
+    return this.provider.dimensions;
   }
   getProviderInfo() {
     if (!this.provider)
@@ -111875,6 +111905,7 @@ class EmbeddingService {
     return dotProduct / (magnitude1 * magnitude2);
   }
 }
+var NO_PROVIDER_MESSAGE = "No embedding provider available. Configure OLLAMA_BASE_URL or an API key.";
 var init_embedding_service = __esm(() => {
   init_dist();
   init_embeddings();
@@ -114273,6 +114304,12 @@ class ProjectIdentityAliasResolver {
       return projectId;
     }
   }
+  resolveCached(projectId) {
+    if (!projectId)
+      return;
+    const cached2 = this.cache.get(projectId);
+    return cached2 && cached2.expiresAt > this.now() ? cached2.canonical : undefined;
+  }
   async resolveWithTimeout(projectId) {
     let timer;
     try {
@@ -116032,7 +116069,7 @@ var init_vector_store_factory = __esm(() => {
 });
 
 // ../../packages/core/dist/services/search/search-cache-pg.js
-import crypto2 from "crypto";
+import crypto3 from "crypto";
 
 class SearchCachePg {
   pool = null;
@@ -116089,7 +116126,7 @@ class SearchCachePg {
       projectId,
       options: this.normalizeOptions(options)
     });
-    return crypto2.createHash("sha256").update(payload).digest("hex");
+    return crypto3.createHash("sha256").update(payload).digest("hex");
   }
   normalizeOptions(options) {
     const searchAffectingParams = [
@@ -118786,7 +118823,7 @@ async function _indexProjectInternalImpl(rlm, projectPath, projectId, options =
       projectId
     });
     options.onProgress?.(0, filteredFiles.length);
-    const centralityMap = await rlm.symbolRepo.getCentrality(projectId);
+    const centralityMap = await rlm.symbolRepo.getCentrality(await getProjectIdentityAliasResolver().resolve(projectId));
     let filesIndexed = 0;
     let chunksIndexed = 0;
     let errors4 = 0;
@@ -118933,7 +118970,7 @@ async function ensureFreshIndexImpl(rlm, projectId, projectPath, options = {}) {
     projectId,
     fileCount: filesToReindex.length
   });
-  const centralityMap = await rlm.symbolRepo.getCentrality(projectId);
+  const centralityMap = await rlm.symbolRepo.getCentrality(await getProjectIdentityAliasResolver().resolve(projectId));
   let filesIndexed = 0;
   let chunksIndexed = 0;
   let errors4 = 0;
@@ -122143,6 +122180,8 @@ async function buildGraphStreamImpl(_rlm, resultSets, maxResults, projectId, rep
         const row = await Promise.resolve(repo.getById(id));
         if (!row || row.deleted_at !== null)
           continue;
+        if (projectId && row.project_id !== projectId)
+          continue;
         out.push({
           id: row.id,
           content: row.content,
@@ -127094,7 +127133,7 @@ class ResolveStage {
       timestamp: Date.now()
     });
     const knownRelPaths = new Set(files.map((f) => f.file.relativePath));
-    const { index: symbolIndex, definitions: repositoryDefinitions } = await this.buildSymbolIndex(ctx.projectId, files);
+    const { index: symbolIndex, fqns: knownFqns, definitions: repositoryDefinitions } = await this.buildSymbolIndex(ctx.projectId, files);
     if (ctx.abortSignal?.aborted)
       throw ctx.abortSignal.reason;
     const rootAliases = this.loadTsConfigPaths(ctx.projectPath);
@@ -127132,7 +127171,7 @@ class ResolveStage {
     const resolved = [];
     let processed = 0;
     for (const parsedFile of files) {
-      const resolvedFile = parsedFile.structure && session2 ? this.resolveStructuralFile(parsedFile, session2, knownRelPaths, rootAliases, monorepoPackages) : this.resolveFile(parsedFile, ctx.projectPath, knownRelPaths, rootAliases, monorepoPackages, symbolIndex);
+      const resolvedFile = parsedFile.structure && session2 ? this.resolveStructuralFile(parsedFile, session2, knownRelPaths, rootAliases, monorepoPackages) : this.resolveFile(parsedFile, ctx.projectPath, knownRelPaths, rootAliases, monorepoPackages, symbolIndex, knownFqns);
       resolved.push(resolvedFile);
       processed++;
       if (processed % 50 === 0) {
@@ -127264,7 +127303,7 @@ class ResolveStage {
       defaultExport: false
     });
   }
-  resolveFile(parsed, projectPath, knownRelPaths, rootAliases, monorepoPackages, symbolIndex) {
+  resolveFile(parsed, projectPath, knownRelPaths, rootAliases, monorepoPackages, symbolIndex, knownFqns) {
     const fromDir = path14.dirname(path14.join(projectPath, parsed.file.relativePath));
     const packageAliases = this.getPackageAliases(parsed.file.relativePath, monorepoPackages);
     const allAliases = [...packageAliases, ...rootAliases];
@@ -127291,7 +127330,7 @@ class ResolveStage {
     }
     const localNames = new Set(parsed.symbols.map((s) => s.name));
     const resolvedEdges = (parsed.rawEdges ?? []).map((edge) => {
-      const targetFqn = this.resolveEdgeTarget(edge.symbolName, parsed.file.relativePath, localNames, importNameToPath, namespaceToPath, symbolIndex);
+      const targetFqn = this.resolveEdgeTarget(edge.symbolName, parsed.file.relativePath, localNames, importNameToPath, namespaceToPath, symbolIndex, knownFqns);
       const meta3 = { ...edge.meta ?? {} };
       if (edge.callerSymbol) {
         meta3.callerFqn = `${parsed.file.relativePath}#${edge.callerSymbol}`;
@@ -127305,7 +127344,7 @@ class ResolveStage {
       resolvedEdges
     };
   }
-  resolveEdgeTarget(name26, thisFile, localNames, importNameToPath, namespaceToPath, symbolIndex) {
+  resolveEdgeTarget(name26, thisFile, localNames, importNameToPath, namespaceToPath, symbolIndex, knownFqns) {
     if (localNames.has(name26))
       return `${thisFile}#${name26}`;
     const importedPath = importNameToPath.get(name26);
@@ -127314,6 +127353,8 @@ class ResolveStage {
     const nsPath = namespaceToPath.get("*") ?? namespaceToPath.get("default");
     if (nsPath) {
       const nsFqn = `${nsPath}#${name26}`;
+      if (knownFqns.has(nsFqn))
+        return nsFqn;
       if (symbolIndex.has(name26))
         return symbolIndex.get(name26);
       return nsFqn;
@@ -127323,10 +127364,12 @@ class ResolveStage {
   }
   async buildSymbolIndex(projectId, files) {
     const index = new Map;
+    const fqns = new Set;
     let repositoryDefinitions = [];
     try {
       repositoryDefinitions = await this.symbolRepository.listAllDefinitions(projectId);
       for (const def of repositoryDefinitions) {
+        fqns.add(`${def.file_path}#${def.name}`);
         if (index.has(def.name))
           continue;
         index.set(def.name, `${def.file_path}#${def.name}`);
@@ -127343,6 +127386,7 @@ class ResolveStage {
     const inBatch = new Map;
     for (const f of files) {
       for (const sym of f.symbols) {
+        fqns.add(`${f.file.relativePath}#${sym.name}`);
         if (inBatch.has(sym.name))
           continue;
         inBatch.set(sym.name, `${f.file.relativePath}#${sym.name}`);
@@ -127351,7 +127395,7 @@ class ResolveStage {
     for (const [name26, fqn] of inBatch) {
       index.set(name26, fqn);
     }
-    return { index, definitions: repositoryDefinitions };
+    return { index, fqns, definitions: repositoryDefinitions };
   }
   resolveSpecifier(specifier, fromDir, projectPath, knownRelPaths, aliases) {
     if (specifier.startsWith("./") || specifier.startsWith("../")) {
@@ -128472,6 +128516,10 @@ var init_pipeline = __esm(() => {
           });
         } catch (beginError) {
           if (beginError.message.startsWith("graph_generation_stale_active:") && generationRetry < 3) {
+            stopManagedRunHeartbeat = true;
+            managedRunTimerController.abort();
+            if (managedRunHeartbeat)
+              await managedRunHeartbeat;
             return this.runInternal(input, generationRetry + 1);
           }
           throw beginError;
@@ -131594,10 +131642,8 @@ var init_memory_service = __esm(() => {
 
 // ../../packages/core/dist/services/graph/relation-extractor.js
 class RelationExtractor {
-  embeddingService;
   graphStore;
   constructor(graphStore) {
-    this.embeddingService = new EmbeddingService;
     this.graphStore = graphStore ?? getGraphStore();
   }
   async extractRelations(memoryId, options) {
@@ -131771,7 +131817,6 @@ class RelationExtractor {
 var DEFAULT_OPTIONS, CONTRADICTION_SIGNALS, RESOLUTION_SIGNALS, DERIVATION_SIGNALS, SUPPORT_SIGNALS;
 var init_relation_extractor = __esm(() => {
   init_dist();
-  init_embeddings();
   init_graph_store_factory();
   init_memory_repository_factory();
   DEFAULT_OPTIONS = {
@@ -135276,7 +135321,8 @@ class PgObservationStore {
     return this.hydrating;
   }
   insert(obs) {
-    this.mirror.set(obs.id, obs);
+    const cachedCanonical = getProjectIdentityAliasResolver().resolveCached(obs.projectId);
+    this.mirror.set(obs.id, cachedCanonical && cachedCanonical !== obs.projectId ? { ...obs, projectId: cachedCanonical } : obs);
     this.ensureHydrated();
     (async () => {
       try {
@@ -138515,6 +138561,13 @@ function isSeatbeltAvailable() {
   }
   return _seatbeltAvailable;
 }
+function warnSandboxUnavailable() {
+  if (_warnedAboutNoSandbox)
+    return;
+  _warnedAboutNoSandbox = true;
+  const missingTool = process.platform === "darwin" ? "sandbox-exec" : "docker";
+  logger.warn(`sandbox: MASSA_AI_EXECUTOR_SANDBOX=auto found no '${missingTool}' on this platform, ` + `so code is executing with best-effort containment and no OS-level isolation. ` + `Install '${missingTool}', or set MASSA_AI_EXECUTOR_SANDBOX=on to fail loudly instead of falling back.`, { missingTool, platform: process.platform, effectiveMode: "none" });
+}
 function getSandboxMode() {
   const env4 = process.env.MASSA_AI_EXECUTOR_SANDBOX ?? "auto";
   if (env4 === "none")
@@ -138532,6 +138585,7 @@ function getSandboxMode() {
     return "seatbelt";
   if (isLinux && isDockerAvailable())
     return "docker";
+  warnSandboxUnavailable();
   return "none";
 }
 function _buildSeatbeltProfile(projectRoot, tmpDir) {
@@ -138599,7 +138653,7 @@ function wrapSpawn(cmd, cwd, tmpDir, mode) {
   }
   return cmd;
 }
-var _dockerAvailable = null, _seatbeltAvailable = null;
+var _dockerAvailable = null, _seatbeltAvailable = null, _warnedAboutNoSandbox = false;
 var init_sandbox = __esm(() => {
   init_dist();
 });
@@ -138761,7 +138815,8 @@ class PolyglotExecutor {
         stdout: "",
         stderr: `Blocked: path "${filePath}" resolves outside the project root (${root}).`,
         exitCode: 1,
-        timedOut: false
+        timedOut: false,
+        sandboxMode: getSandboxMode()
       };
       return err;
     }
@@ -138770,7 +138825,8 @@ class PolyglotExecutor {
         stdout: "",
         stderr: `Blocked: path "${filePath}" matches a deny-listed pattern (secrets/credentials).`,
         exitCode: 1,
-        timedOut: false
+        timedOut: false,
+        sandboxMode: getSandboxMode()
       };
       return err;
     }
@@ -138821,7 +138877,8 @@ ${body}`;
           stderr: `Compilation failed:
 ${message}`,
           exitCode: 1,
-          timedOut: false
+          timedOut: false,
+          sandboxMode: getSandboxMode()
         };
       }
       return await this.#spawn([binPath], cwd, cwd, timeout, false);
@@ -138864,7 +138921,8 @@ ${message}`,
             timedOut: true,
             backgrounded: true,
             command: cmd.join(" "),
-            cwd
+            cwd,
+            sandboxMode
           });
         } else {
           killTree(proc2);
@@ -138903,7 +138961,8 @@ ${message}`,
           exitCode: timedOut ? null : exitCode,
           timedOut,
           command: cmd.join(" "),
-          cwd
+          cwd,
+          sandboxMode
         });
       });
       proc2.on("error", (err) => {
@@ -138917,7 +138976,8 @@ ${message}`,
           exitCode: null,
           timedOut: false,
           command: cmd.join(" "),
-          cwd
+          cwd,
+          sandboxMode
         });
       });
     });
@@ -139255,6 +139315,7 @@ var init_intent_search = __esm(() => {
 var init_executor2 = __esm(() => {
   init_executor();
   init_executor();
+  init_sandbox();
   init_run_pool();
   init_runtime();
   init_intent_search();
@@ -139318,7 +139379,8 @@ class ExecutorController {
           timedOut: finalResult.timedOut,
           backgrounded: finalResult.backgrounded ?? false,
           command: finalResult.command,
-          cwd: finalResult.cwd
+          cwd: finalResult.cwd,
+          sandboxMode: finalResult.sandboxMode
         }
       };
     } catch (error51) {
@@ -139354,7 +139416,8 @@ class ExecutorController {
           exitCode: finalResult.exitCode,
           timedOut: finalResult.timedOut,
           command: finalResult.command,
-          cwd: finalResult.cwd
+          cwd: finalResult.cwd,
+          sandboxMode: finalResult.sandboxMode
         }
       };
     } catch (error51) {
@@ -139398,7 +139461,8 @@ class ExecutorController {
             stdout: r.stdout,
             stderr: r.stderr,
             exitCode: r.exitCode,
-            timedOut: r.timedOut
+            timedOut: r.timedOut,
+            sandboxMode: r.sandboxMode
           };
         }
         return {
@@ -139406,7 +139470,8 @@ class ExecutorController {
           stdout: "",
           stderr: String(s.reason ?? "unknown error"),
           exitCode: null,
-          timedOut: false
+          timedOut: false,
+          sandboxMode: getSandboxMode()
         };
       });
       const anyFailed = results.some((r) => r.exitCode !== 0 || r.timedOut);
@@ -165500,7 +165565,7 @@ class ApiClient {
   maxRetries;
   constructor(config3) {
     this.baseUrl = config3?.baseUrl || process.env.MASSA_AI_API_URL || "http://localhost:3333";
-    this.apiKey = config3?.apiKey || process.env.MASSA_AI_API_KEY || "";
+    this.apiKey = (config3?.apiKey || process.env.MASSA_AI_API_KEY || "").trim();
     this.timeoutMs = typeof config3?.timeoutMs === "number" ? config3.timeoutMs : parsePositiveIntEnv(process.env.MASSA_AI_PROXY_TIMEOUT_MS, 120000, { allowZero: true });
     this.maxRetries = config3?.maxRetries || 2;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massa-ai/mcp-client",
-  "version": "1.7.1",
+  "version": "1.8.0",
   "description": "massa-ai MCP server - Semantic code search, memory, and context compression via Model Context Protocol",
   "author": "luizgmassa",
   "type": "module",
@@ -20,8 +20,8 @@
     "type-check": "tsc --noEmit"
   },
   "dependencies": {
-    "@massa-ai/core": "^1.7.1",
-    "@massa-ai/shared": "^1.7.1",
+    "@massa-ai/core": "^1.8.0",
+    "@massa-ai/shared": "^1.8.0",
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "devDependencies": {