@mushi-mushi/mcp 0.29.0 → 0.29.1

package/README.md

@@ -29,7 +29,7 @@ Restart the editor and ask *"what's broken in prod?"*. For Cursor and Claude, `s
   "mcpServers": {
     "mushi-mushi": {
       "command": "npx",
-      "args": ["-y", "@mushi-mushi/mcp@0.29.0"],
+      "args": ["-y", "@mushi-mushi/mcp@0.29.1"],
       "env": {
         "MUSHI_API_KEY": "mushi_xxxxxxxxxxxxxxxxxxxx",
         "MUSHI_PROJECT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

package/dist/catalog.js

@@ -8,7 +8,7 @@ import {
   TOOL_CATALOG,
   USE_MUSHI_INTENTS,
   routeUseMushiIntent
-} from "./chunk-MOW6PVHK.js";
+} from "./chunk-6SHKBN6R.js";
 export {
   ALL_SCOPES,
   CODEBASE_TOOL_CATALOG,

package/dist/{chunk-MOW6PVHK.js → chunk-6SHKBN6R.js}

@@ -120,7 +120,7 @@ var TOOL_CATALOG = [
   {
     name: "list_gate_findings",
     title: "Gate findings",
-    description: "List recent inventory gate runs and their findings for a project, newest first. Returns { runs: [{ id, gate, status, findings_count, \u2026 }], findings: [{ severity, rule_id, message, file_path, node_id, \u2026 }] }. Filter by gate (dead_handler | mock_leak | api_contract | crawl | status_claim | spec_drift | orphan_endpoint | unknown_call | schema_drift | code_health | design_drift | ci_drift | deploy_drift | env_drift | radar | portfolio_radar | portfolio_radar_ci | store_review) or finding severity (info | warn | error). The *_drift gates are the App Recipe checks: design_drift is code that drifts off the design tokens, ci_drift / deploy_drift / env_drift are CI, deploy and env vars that drift from the recipe; radar is the Mushi setup checks (a rejected provider key, no spend cap or AI budget, a webhook that never delivered, a stale code index), each with a suggested_fix (a spend-cap fix is applied in the console by a signed-in project admin, not through an API key); portfolio_radar / portfolio_radar_ci / store_review are the app hole checks (prefer get_radar). Available on every plan. Read-only. Use to see which CI gates failed on the last crawl; use diff_inventory to compare two commits, or get_inventory for the full snapshot.",
+    description: "List recent inventory gate runs and their findings for a project, newest first. Returns { runs: [{ id, gate, status, findings_count, \u2026 }], findings: [{ severity, rule_id, message, file_path, node_id, \u2026 }] }. Filter by gate (dead_handler | mock_leak | api_contract | crawl | status_claim | spec_drift | orphan_endpoint | unknown_call | schema_drift | code_health | design_drift | ci_drift | deploy_drift | env_drift | radar | portfolio_radar | portfolio_radar_ci | portfolio_radar_vulns | store_review) or finding severity (info | warn | error). The *_drift gates are the App Recipe checks: design_drift is code that drifts off the design tokens, ci_drift / deploy_drift / env_drift are CI, deploy and env vars that drift from the recipe; radar is the Mushi setup checks (a rejected provider key, no spend cap or AI budget, a webhook that never delivered, a stale code index), each with a suggested_fix (a spend-cap fix is applied in the console by a signed-in project admin, not through an API key); portfolio_radar / portfolio_radar_ci / portfolio_radar_vulns / store_review are the app hole checks (prefer get_radar). Available on every plan. Read-only. Use to see which CI gates failed on the last crawl; use diff_inventory to compare two commits, or get_inventory for the full snapshot.",
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     useCase: "Show me what CI gates failed on the last run."

package/dist/clients.d.ts

@@ -49,7 +49,7 @@ import { FeatureGroup } from './feature-groups.js';
  * editor launch. Synced to package.json by `scripts/sync-mcp-pin.mjs` — never
  * hand-edit the version.
  */
-declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.29.0";
+declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.29.1";
 interface StdioConfig {
     command: string;
     args: string[];

package/dist/clients.js

@@ -8,7 +8,7 @@ import {
 } from "./chunk-7RWHDJPZ.js";
 
 // src/clients.ts
-var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.29.0";
+var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.29.1";
 var PIN_SPEC_RE = /^@mushi-mushi\/mcp@\d+\.\d+\.\d+$/;
 function pinOf(pinSpec) {
   return pinSpec && PIN_SPEC_RE.test(pinSpec) ? pinSpec : MCP_PIN_SPEC;

package/dist/index.js

@@ -196,7 +196,7 @@ var TOOL_CATALOG = [
   {
     name: "list_gate_findings",
     title: "Gate findings",
-    description: "List recent inventory gate runs and their findings for a project, newest first. Returns { runs: [{ id, gate, status, findings_count, \u2026 }], findings: [{ severity, rule_id, message, file_path, node_id, \u2026 }] }. Filter by gate (dead_handler | mock_leak | api_contract | crawl | status_claim | spec_drift | orphan_endpoint | unknown_call | schema_drift | code_health | design_drift | ci_drift | deploy_drift | env_drift | radar | portfolio_radar | portfolio_radar_ci | store_review) or finding severity (info | warn | error). The *_drift gates are the App Recipe checks: design_drift is code that drifts off the design tokens, ci_drift / deploy_drift / env_drift are CI, deploy and env vars that drift from the recipe; radar is the Mushi setup checks (a rejected provider key, no spend cap or AI budget, a webhook that never delivered, a stale code index), each with a suggested_fix (a spend-cap fix is applied in the console by a signed-in project admin, not through an API key); portfolio_radar / portfolio_radar_ci / store_review are the app hole checks (prefer get_radar). Available on every plan. Read-only. Use to see which CI gates failed on the last crawl; use diff_inventory to compare two commits, or get_inventory for the full snapshot.",
+    description: "List recent inventory gate runs and their findings for a project, newest first. Returns { runs: [{ id, gate, status, findings_count, \u2026 }], findings: [{ severity, rule_id, message, file_path, node_id, \u2026 }] }. Filter by gate (dead_handler | mock_leak | api_contract | crawl | status_claim | spec_drift | orphan_endpoint | unknown_call | schema_drift | code_health | design_drift | ci_drift | deploy_drift | env_drift | radar | portfolio_radar | portfolio_radar_ci | portfolio_radar_vulns | store_review) or finding severity (info | warn | error). The *_drift gates are the App Recipe checks: design_drift is code that drifts off the design tokens, ci_drift / deploy_drift / env_drift are CI, deploy and env vars that drift from the recipe; radar is the Mushi setup checks (a rejected provider key, no spend cap or AI budget, a webhook that never delivered, a stale code index), each with a suggested_fix (a spend-cap fix is applied in the console by a signed-in project admin, not through an API key); portfolio_radar / portfolio_radar_ci / portfolio_radar_vulns / store_review are the app hole checks (prefer get_radar). Available on every plan. Read-only. Use to see which CI gates failed on the last crawl; use diff_inventory to compare two commits, or get_inventory for the full snapshot.",
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     useCase: "Show me what CI gates failed on the last run."
@@ -1489,7 +1489,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/",
     markdown: "index.md",
     keywords: ["know", "ai-built", "app", "broke", "fix", "ready"],
-    headings: ["This is what a diagnosis looks like", "See it in action", "What this is (and is not)", "Get started with the SDK", "Install in your framework", "One queue. Sentry flows in, fixes flow out."],
+    headings: ["The problem it solves", "A real example from our own sites", "What this is (and is not)", "Where it stands today", "This is what a diagnosis looks like", "See it in action", "Get started", "Install it in your app"],
     excerpt: "Your AI shipped it. Mushi tells you why it broke: a plain-English diagnosis and a ready fix in your editor. Open source, Sentry optional."
   },
   {
@@ -1618,6 +1618,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["What's tracked", "Charts", "Controlling costs", "Export", "Related pages"],
     excerpt: "The Cost page shows LLM token use and estimated spend per model and pipeline for a Mushi project, so you can see what each diagnosis costs."
   },
+  {
+    title: "Spend credits",
+    url: docUrl("/admin/credits"),
+    route: "/admin/credits",
+    markdown: "admin/credits.md",
+    keywords: ["admin", "credits", "spend"],
+    headings: ["Cursor: fix bugs", "Cursor: improve your apps with skills", "Firecrawl: find bugs on your live sites", "Site audit", "Search rank", "Where the fixes go"],
+    excerpt: "Spend credits lists expiring Cursor and Firecrawl credits and every way Mushi can spend them fixing bugs, improving apps with skills and checking sites."
+  },
   {
     title: "Dashboard",
     url: docUrl("/admin/dashboard"),
@@ -2065,7 +2074,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/admin/ux-runs",
     markdown: "admin/ux-runs.md",
     keywords: ["admin", "ux-runs", "runs", "ux"],
-    headings: ["Run in the cloud", "What you see", "File as bug", "Where the changes are"],
+    headings: ["Run in the cloud", "What you see", "File as bug", "Audit signed-in screens", "Where the changes are"],
     excerpt: "Each screen your coding agent worked on in a mushi ux run, with its plan, every attempt, before and after screenshots, and what was kept."
   },
   {
@@ -2338,6 +2347,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["Storage", "Why both pgvector and AGE?", "Indexing", "Bug Ontology"],
     excerpt: "How Mushi links reports, components, fixes and developers in a per-project knowledge graph, with pgvector for similarity and Apache AGE for traversal."
   },
+  {
+    title: "Known holes in dependencies",
+    url: docUrl("/concepts/known-holes"),
+    route: "/concepts/known-holes",
+    markdown: "concepts/known-holes.md",
+    keywords: ["concepts", "known-holes", "known", "holes", "dependencies"],
+    headings: ["What Mushi checks", "What becomes a report", "How bad is it", "The fix", "What leaves Mushi", "Where to see it", "Data sources"],
+    excerpt: "Mushi checks the exact versions in your lockfiles and runtime pins against published advisories, and files each fixable hole as a bug with the upgrade."
+  },
   {
     title: "Multi-repo coordinated fixes",
     url: docUrl("/concepts/multi-repo-fixes"),
@@ -2812,7 +2830,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/quickstart",
     markdown: "quickstart/index.md",
     keywords: ["quickstart", "fix", "first", "bug", "60", "seconds", "choose", "stack"],
-    headings: ["Start here (MCP)", "Pick your stack", "How do I install the SDK?", "Troubleshooting"],
+    headings: ["What you need", "The fastest way: one command", "Start here (editor first)", "Pick your stack", "How do I install the SDK?", "Troubleshooting"],
     excerpt: "Install Mushi with npx mushi-mushi, connect Cursor or Claude Code over MCP, and turn user bug reports into plain-English diagnoses with ready fixes."
   },
   {
@@ -3889,6 +3907,7 @@ var GATE_IDS = [
   "radar",
   "portfolio_radar",
   "portfolio_radar_ci",
+  "portfolio_radar_vulns",
   "store_review"
 ];
 var GATE_FINDING_SEVERITIES = ["info", "warn", "error"];
@@ -6365,7 +6384,8 @@ function createMushiServer(config) {
         method: "PATCH",
         body: JSON.stringify({
           status: args.status,
-          reason: args.reason,
+          // Kept as a team note on the report (the console's Triage note).
+          note: args.reason,
           closed_reason: args.closedReason,
           reporter_message: args.reporterMessage
         })

package/dist/server.js

@@ -4,7 +4,7 @@ import {
   TDD_TOOL_CATALOG,
   TOOL_CATALOG,
   routeUseMushiIntent
-} from "./chunk-MOW6PVHK.js";
+} from "./chunk-6SHKBN6R.js";
 import {
   MUSHI_SERVER_METADATA
 } from "./chunk-FJRPC4VR.js";
@@ -32,7 +32,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/",
     markdown: "index.md",
     keywords: ["know", "ai-built", "app", "broke", "fix", "ready"],
-    headings: ["This is what a diagnosis looks like", "See it in action", "What this is (and is not)", "Get started with the SDK", "Install in your framework", "One queue. Sentry flows in, fixes flow out."],
+    headings: ["The problem it solves", "A real example from our own sites", "What this is (and is not)", "Where it stands today", "This is what a diagnosis looks like", "See it in action", "Get started", "Install it in your app"],
     excerpt: "Your AI shipped it. Mushi tells you why it broke: a plain-English diagnosis and a ready fix in your editor. Open source, Sentry optional."
   },
   {
@@ -161,6 +161,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["What's tracked", "Charts", "Controlling costs", "Export", "Related pages"],
     excerpt: "The Cost page shows LLM token use and estimated spend per model and pipeline for a Mushi project, so you can see what each diagnosis costs."
   },
+  {
+    title: "Spend credits",
+    url: docUrl("/admin/credits"),
+    route: "/admin/credits",
+    markdown: "admin/credits.md",
+    keywords: ["admin", "credits", "spend"],
+    headings: ["Cursor: fix bugs", "Cursor: improve your apps with skills", "Firecrawl: find bugs on your live sites", "Site audit", "Search rank", "Where the fixes go"],
+    excerpt: "Spend credits lists expiring Cursor and Firecrawl credits and every way Mushi can spend them fixing bugs, improving apps with skills and checking sites."
+  },
   {
     title: "Dashboard",
     url: docUrl("/admin/dashboard"),
@@ -608,7 +617,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/admin/ux-runs",
     markdown: "admin/ux-runs.md",
     keywords: ["admin", "ux-runs", "runs", "ux"],
-    headings: ["Run in the cloud", "What you see", "File as bug", "Where the changes are"],
+    headings: ["Run in the cloud", "What you see", "File as bug", "Audit signed-in screens", "Where the changes are"],
     excerpt: "Each screen your coding agent worked on in a mushi ux run, with its plan, every attempt, before and after screenshots, and what was kept."
   },
   {
@@ -881,6 +890,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["Storage", "Why both pgvector and AGE?", "Indexing", "Bug Ontology"],
     excerpt: "How Mushi links reports, components, fixes and developers in a per-project knowledge graph, with pgvector for similarity and Apache AGE for traversal."
   },
+  {
+    title: "Known holes in dependencies",
+    url: docUrl("/concepts/known-holes"),
+    route: "/concepts/known-holes",
+    markdown: "concepts/known-holes.md",
+    keywords: ["concepts", "known-holes", "known", "holes", "dependencies"],
+    headings: ["What Mushi checks", "What becomes a report", "How bad is it", "The fix", "What leaves Mushi", "Where to see it", "Data sources"],
+    excerpt: "Mushi checks the exact versions in your lockfiles and runtime pins against published advisories, and files each fixable hole as a bug with the upgrade."
+  },
   {
     title: "Multi-repo coordinated fixes",
     url: docUrl("/concepts/multi-repo-fixes"),
@@ -1355,7 +1373,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/quickstart",
     markdown: "quickstart/index.md",
     keywords: ["quickstart", "fix", "first", "bug", "60", "seconds", "choose", "stack"],
-    headings: ["Start here (MCP)", "Pick your stack", "How do I install the SDK?", "Troubleshooting"],
+    headings: ["What you need", "The fastest way: one command", "Start here (editor first)", "Pick your stack", "How do I install the SDK?", "Troubleshooting"],
     excerpt: "Install Mushi with npx mushi-mushi, connect Cursor or Claude Code over MCP, and turn user bug reports into plain-English diagnoses with ready fixes."
   },
   {
@@ -2498,6 +2516,7 @@ var GATE_IDS = [
   "radar",
   "portfolio_radar",
   "portfolio_radar_ci",
+  "portfolio_radar_vulns",
   "store_review"
 ];
 var GATE_FINDING_SEVERITIES = ["info", "warn", "error"];
@@ -4974,7 +4993,8 @@ function createMushiServer(config) {
         method: "PATCH",
         body: JSON.stringify({
           status: args.status,
-          reason: args.reason,
+          // Kept as a team note on the report (the console's Triage note).
+          note: args.reason,
           closed_reason: args.closedReason,
           reporter_message: args.reporterMessage
         })

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mushi-mushi/mcp",
   "mcpName": "io.github.kensaurus/mushi-mushi",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "license": "MIT",
   "description": "MCP server for Cursor, Claude Code and Copilot. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "type": "module",
@@ -44,7 +44,7 @@
   "dependencies": {
     "@modelcontextprotocol/core": "^2.3.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "zod": "^4.4.3",
+    "zod": "^4.6.7",
     "@mushi-mushi/core": "^1.33.2"
   },
   "peerDependencies": {