@neat.is/mcp 0.2.5

package/dist/index.cjs

@@ -0,0 +1,775 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/index.ts
+var import_mcp2 = require("@modelcontextprotocol/sdk/server/mcp.js");
+var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
+var import_zod = require("zod");
+var import_types2 = require("@neat.is/types");
+
+// src/client.ts
+function createHttpClient(baseUrl2) {
+  const root = baseUrl2.replace(/\/$/, "");
+  return {
+    async get(path) {
+      const res = await fetch(`${root}${path}`);
+      if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new HttpError(res.status, `${res.status} ${res.statusText} on GET ${path}: ${body}`);
+      }
+      return await res.json();
+    },
+    async post(path, body) {
+      const res = await fetch(`${root}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body)
+      });
+      if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        throw new HttpError(res.status, `${res.status} ${res.statusText} on POST ${path}: ${text}`);
+      }
+      return await res.json();
+    }
+  };
+}
+var HttpError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "HttpError";
+  }
+  status;
+};
+
+// src/resources.ts
+var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
+var NODE_RESOURCE_MIME = "application/json";
+var INCIDENTS_URI = "neat://incidents/recent";
+var INCIDENTS_DEFAULT_LIMIT = 50;
+var POLICY_VIOLATIONS_URI = "neat://policies/violations";
+var POLICY_VIOLATIONS_DEFAULT_LIMIT = 100;
+function nodeUri(id) {
+  return `neat://node/${encodeURIComponent(id)}`;
+}
+function corePrefix(project) {
+  return project ? `/projects/${encodeURIComponent(project)}` : "";
+}
+function nameFromAttrs(attrs) {
+  return attrs.name ?? attrs.id;
+}
+async function listNodeResources(client2, project) {
+  const graph = await client2.get(`${corePrefix(project)}/graph`);
+  return {
+    resources: graph.nodes.map((n) => ({
+      uri: nodeUri(n.id),
+      name: nameFromAttrs(n),
+      description: `${n.type} \u2014 ${nameFromAttrs(n)}`,
+      mimeType: NODE_RESOURCE_MIME
+    }))
+  };
+}
+async function readNodeResource(client2, id, project) {
+  const uri = nodeUri(id);
+  const prefix = corePrefix(project);
+  try {
+    const [attrs, edges] = await Promise.all([
+      client2.get(`${prefix}/graph/node/${encodeURIComponent(id)}`),
+      client2.get(`${prefix}/graph/edges/${encodeURIComponent(id)}`)
+    ]);
+    const body = {
+      node: attrs,
+      // Outbound only — the issue spec says "attrs + outbound edges". Inbound
+      // edges are still reachable via the other endpoint and would double the
+      // payload for hub nodes (e.g. a shared database).
+      outboundEdges: edges.outbound
+    };
+    return {
+      contents: [
+        {
+          uri,
+          mimeType: NODE_RESOURCE_MIME,
+          text: JSON.stringify(body, null, 2)
+        }
+      ]
+    };
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      return {
+        contents: [
+          {
+            uri,
+            mimeType: NODE_RESOURCE_MIME,
+            text: JSON.stringify({ error: "node not found", id })
+          }
+        ]
+      };
+    }
+    throw err;
+  }
+}
+async function readPolicyViolationsResource(client2, limit = POLICY_VIOLATIONS_DEFAULT_LIMIT, project) {
+  const violations = await client2.get(
+    `${corePrefix(project)}/policies/violations`
+  );
+  const ordered = [...violations].reverse().slice(0, limit);
+  return {
+    contents: [
+      {
+        uri: POLICY_VIOLATIONS_URI,
+        mimeType: NODE_RESOURCE_MIME,
+        text: JSON.stringify(
+          { count: ordered.length, total: violations.length, violations: ordered },
+          null,
+          2
+        )
+      }
+    ]
+  };
+}
+async function readRecentIncidentsResource(client2, limit = INCIDENTS_DEFAULT_LIMIT, project) {
+  const events = await client2.get(`${corePrefix(project)}/incidents`);
+  const ordered = [...events].reverse().slice(0, limit);
+  return {
+    contents: [
+      {
+        uri: INCIDENTS_URI,
+        mimeType: NODE_RESOURCE_MIME,
+        text: JSON.stringify(
+          { count: ordered.length, total: events.length, events: ordered },
+          null,
+          2
+        )
+      }
+    ]
+  };
+}
+function incidentsChanged(prev, next) {
+  if (!prev) return false;
+  if (prev.total !== next.total) return true;
+  if (prev.lastId !== next.lastId) return true;
+  return false;
+}
+function registerResources(server2, client2, options = {}) {
+  const pollMs = options.incidentsPollMs ?? 5e3;
+  const project = options.project;
+  server2.registerResource(
+    "graph-node",
+    new import_mcp.ResourceTemplate("neat://node/{id}", {
+      list: async () => listNodeResources(client2, project)
+    }),
+    {
+      description: "A single graph node by id. Reading returns the node attributes plus its outbound edges as JSON.",
+      mimeType: NODE_RESOURCE_MIME
+    },
+    async (_uri, variables) => {
+      const raw = variables.id;
+      const id = Array.isArray(raw) ? raw[0] : raw;
+      if (typeof id !== "string" || id.length === 0) {
+        throw new Error("neat://node/{id} requires an id");
+      }
+      const decoded = id.includes("%") ? decodeURIComponent(id) : id;
+      return readNodeResource(client2, decoded, project);
+    }
+  );
+  server2.registerResource(
+    "incidents-recent",
+    INCIDENTS_URI,
+    {
+      description: "Most recent error events recorded by neat-core, newest first. JSON: { count, total, events[] }.",
+      mimeType: NODE_RESOURCE_MIME
+    },
+    async () => readRecentIncidentsResource(client2, INCIDENTS_DEFAULT_LIMIT, project)
+  );
+  server2.registerResource(
+    "policies-violations",
+    POLICY_VIOLATIONS_URI,
+    {
+      description: "Current policy violations from policy-violations.ndjson, newest first. JSON: { count, total, violations[] }.",
+      mimeType: NODE_RESOURCE_MIME
+    },
+    async () => readPolicyViolationsResource(client2, POLICY_VIOLATIONS_DEFAULT_LIMIT, project)
+  );
+  let stopped = false;
+  let timer = null;
+  let lastIncidents = null;
+  let lastViolations = null;
+  const tick = async () => {
+    if (stopped) return;
+    try {
+      const events = await client2.get(`${corePrefix(project)}/incidents`);
+      const next = {
+        total: events.length,
+        lastId: events.length > 0 ? events[events.length - 1].id : void 0
+      };
+      if (incidentsChanged(lastIncidents, next)) {
+        await server2.server.sendResourceUpdated({ uri: INCIDENTS_URI }).catch(() => {
+        });
+      }
+      lastIncidents = next;
+    } catch {
+    }
+    try {
+      const violations = await client2.get(
+        `${corePrefix(project)}/policies/violations`
+      );
+      const next = {
+        total: violations.length,
+        lastId: violations.length > 0 ? violations[violations.length - 1].id : void 0
+      };
+      if (incidentsChanged(lastViolations, next)) {
+        await server2.server.sendResourceUpdated({ uri: POLICY_VIOLATIONS_URI }).catch(() => {
+        });
+      }
+      lastViolations = next;
+    } catch {
+    }
+  };
+  if (pollMs > 0) {
+    timer = setInterval(() => {
+      void tick();
+    }, pollMs);
+    if (typeof timer.unref === "function") timer.unref();
+  }
+  return {
+    stop: () => {
+      stopped = true;
+      if (timer) clearInterval(timer);
+      timer = null;
+    }
+  };
+}
+
+// src/tools.ts
+var import_types = require("@neat.is/types");
+
+// src/format.ts
+function formatFooter(confidence, provenance) {
+  const c = confidence === void 0 ? "n/a" : confidence.toFixed(2);
+  const p = provenance === void 0 ? "n/a" : Array.isArray(provenance) ? [...new Set(provenance)].join(", ") : provenance;
+  return `confidence: ${c} \xB7 provenance: ${p}`;
+}
+function formatToolResponse(input) {
+  const sections = [input.summary.trim()];
+  if (input.block && input.block.trim().length > 0) {
+    sections.push(input.block.trimEnd());
+  }
+  sections.push(formatFooter(input.confidence, input.provenance));
+  const text = sections.join("\n\n");
+  return {
+    content: [{ type: "text", text }],
+    ...input.isError ? { isError: true } : {}
+  };
+}
+function formatEmptyResponse(summary) {
+  return formatToolResponse({ summary });
+}
+function formatErrorResponse(message) {
+  return formatToolResponse({ summary: message, isError: true });
+}
+
+// src/tools.ts
+function projectPath(project, suffix) {
+  if (!project) return suffix;
+  return `/projects/${encodeURIComponent(project)}${suffix}`;
+}
+async function withMissingNodeFallback(fn, notFoundMessage) {
+  try {
+    return await fn();
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      return formatEmptyResponse(notFoundMessage);
+    }
+    return formatErrorResponse(`Error talking to neat-core: ${err.message}`);
+  }
+}
+async function getRootCause(client2, input) {
+  const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
+  const path = projectPath(
+    input.project,
+    `/traverse/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
+  );
+  return withMissingNodeFallback(async () => {
+    const result = await client2.get(path);
+    const arrowPath = result.traversalPath.join(" \u2190 ");
+    const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
+    const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
+    const blockLines = [
+      `Traversal path: ${arrowPath}`,
+      `Edge provenances: ${provenances}`
+    ];
+    if (result.fixRecommendation) {
+      blockLines.push(`Recommended fix: ${result.fixRecommendation}`);
+    }
+    return formatToolResponse({
+      summary,
+      block: blockLines.join("\n"),
+      confidence: result.confidence,
+      provenance: result.edgeProvenances.length ? result.edgeProvenances : void 0
+    });
+  }, `No root cause found for ${input.errorNode}. The node may be healthy, or it may not exist in the graph.`);
+}
+async function getBlastRadius(client2, input) {
+  const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
+  const path = projectPath(
+    input.project,
+    `/traverse/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
+  );
+  return withMissingNodeFallback(async () => {
+    const result = await client2.get(path);
+    if (result.totalAffected === 0) {
+      return formatEmptyResponse(
+        `${result.origin} has no downstream dependencies. Nothing else would break if it failed.`
+      );
+    }
+    const sorted = [...result.affectedNodes].sort(
+      (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
+    );
+    const blockLines = sorted.map(formatBlastEntry);
+    const minConfidence = sorted.reduce(
+      (m, n) => Math.min(m, n.confidence),
+      Number.POSITIVE_INFINITY
+    );
+    const provenances = [...new Set(sorted.map((n) => n.edgeProvenance))];
+    return formatToolResponse({
+      summary: `Blast radius for ${result.origin}: ${result.totalAffected} affected node${result.totalAffected === 1 ? "" : "s"} reachable downstream.`,
+      block: blockLines.join("\n"),
+      confidence: Number.isFinite(minConfidence) ? minConfidence : void 0,
+      provenance: provenances.length ? provenances : void 0
+    });
+  }, `Node ${input.nodeId} not found in the graph.`);
+}
+function formatBlastEntry(n) {
+  const tag = n.edgeProvenance === import_types.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
+  return `  \u2022 ${n.nodeId} (distance ${n.distance}, ${n.edgeProvenance})${tag}`;
+}
+async function getDependencies(client2, input) {
+  const depth = input.depth ?? 3;
+  const path = projectPath(
+    input.project,
+    `/graph/node/${encodeURIComponent(input.nodeId)}/dependencies?depth=${depth}`
+  );
+  return withMissingNodeFallback(async () => {
+    const result = await client2.get(path);
+    if (result.total === 0) {
+      return formatEmptyResponse(
+        depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
+      );
+    }
+    const byDistance = /* @__PURE__ */ new Map();
+    for (const dep of result.dependencies) {
+      const ring = byDistance.get(dep.distance) ?? [];
+      ring.push(dep);
+      byDistance.set(dep.distance, ring);
+    }
+    const blockLines = [];
+    for (const distance of [...byDistance.keys()].sort((a, b) => a - b)) {
+      const label = distance === 1 ? "Direct (distance 1)" : `Distance ${distance}`;
+      blockLines.push(`${label}:`);
+      for (const dep of byDistance.get(distance)) {
+        blockLines.push(`  \u2022 ${dep.nodeId} \u2014 ${dep.edgeType} (${dep.provenance})`);
+      }
+    }
+    const provenances = [...new Set(result.dependencies.map((d) => d.provenance))];
+    const directCount = byDistance.get(1)?.length ?? 0;
+    const summary = depth === 1 ? `${input.nodeId} has ${directCount} direct dependenc${directCount === 1 ? "y" : "ies"}.` : `${input.nodeId} has ${result.total} dependenc${result.total === 1 ? "y" : "ies"} reachable to depth ${depth} (${directCount} direct).`;
+    return formatToolResponse({
+      summary,
+      block: blockLines.join("\n"),
+      provenance: provenances
+    });
+  }, `Node ${input.nodeId} not found in the graph.`);
+}
+async function getObservedDependencies(client2, input) {
+  return withMissingNodeFallback(async () => {
+    const edges = await client2.get(
+      projectPath(input.project, `/graph/edges/${encodeURIComponent(input.nodeId)}`)
+    );
+    const observed = edges.outbound.filter((e) => e.provenance === import_types.Provenance.OBSERVED);
+    if (observed.length === 0) {
+      const hasExtracted = edges.outbound.some((e) => e.provenance === import_types.Provenance.EXTRACTED);
+      const note = hasExtracted ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
+      return formatEmptyResponse(`No OBSERVED dependencies for ${input.nodeId}.${note}`);
+    }
+    const blockLines = observed.map((e) => `  \u2022 ${e.target} \u2014 ${e.type}${edgeMeta(e)}`);
+    return formatToolResponse({
+      summary: `${input.nodeId} has ${observed.length} runtime dependenc${observed.length === 1 ? "y" : "ies"} confirmed by OTel.`,
+      block: blockLines.join("\n"),
+      provenance: import_types.Provenance.OBSERVED
+    });
+  }, `Node ${input.nodeId} not found in the graph.`);
+}
+function edgeMeta(e) {
+  const bits = [];
+  if (e.signal) {
+    bits.push(`spans=${e.signal.spanCount}`);
+    if (e.signal.errorCount > 0) bits.push(`errors=${e.signal.errorCount}`);
+    if (e.signal.lastObservedAgeMs !== void 0) {
+      bits.push(`age=${formatDuration(e.signal.lastObservedAgeMs)}`);
+    }
+  } else if (e.callCount !== void 0) {
+    bits.push(`callCount=${e.callCount}`);
+  }
+  if (e.lastObserved) bits.push(`lastObserved=${e.lastObserved}`);
+  if (e.confidence !== void 0) bits.push(`confidence=${e.confidence}`);
+  return bits.length ? ` [${bits.join(", ")}]` : "";
+}
+function formatDuration(ms) {
+  if (ms < 1e3) return `${Math.round(ms)}ms`;
+  const s = Math.round(ms / 1e3);
+  if (s < 60) return `${s}s`;
+  const m = Math.round(s / 60);
+  if (m < 60) return `${m}m`;
+  const h = Math.round(m / 60);
+  if (h < 48) return `${h}h`;
+  return `${Math.round(h / 24)}d`;
+}
+async function getIncidentHistory(client2, input) {
+  return withMissingNodeFallback(async () => {
+    const events = await client2.get(
+      projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`)
+    );
+    if (events.length === 0) {
+      return formatEmptyResponse(`No incidents recorded against ${input.nodeId}.`);
+    }
+    const ordered = [...events].reverse().slice(0, input.limit ?? 20);
+    const blockLines = [];
+    for (const ev of ordered) {
+      blockLines.push(`  ${ev.timestamp} \u2014 ${ev.service}: ${ev.errorMessage}`);
+      blockLines.push(`    trace=${ev.traceId} span=${ev.spanId}`);
+    }
+    return formatToolResponse({
+      summary: `${input.nodeId} has ${events.length} recorded incident${events.length === 1 ? "" : "s"}; showing the ${ordered.length} most recent.`,
+      block: blockLines.join("\n"),
+      // ErrorEvents are observation records, not graph edges — provenance is
+      // OBSERVED by definition (the OTel span happened).
+      provenance: import_types.Provenance.OBSERVED
+    });
+  }, `Node ${input.nodeId} not found in the graph.`);
+}
+async function semanticSearch(client2, input) {
+  try {
+    const result = await client2.get(
+      projectPath(input.project, `/search?q=${encodeURIComponent(input.query)}`)
+    );
+    if (result.matches.length === 0) {
+      return formatEmptyResponse(`No matches for "${input.query}".`);
+    }
+    const provider = result.provider ?? "substring";
+    const blockLines = [];
+    let topScore;
+    for (const n of result.matches) {
+      const score = provider !== "substring" && typeof n.score === "number" ? n.score : void 0;
+      const scoreBit = score !== void 0 ? ` [score=${score.toFixed(2)}]` : "";
+      if (score !== void 0 && (topScore === void 0 || score > topScore)) topScore = score;
+      blockLines.push(
+        `  \u2022 ${n.id} (${n.type}) \u2014 ${n.name ?? n.id}${scoreBit}`
+      );
+    }
+    return formatToolResponse({
+      summary: `Found ${result.matches.length} match${result.matches.length === 1 ? "" : "es"} for "${input.query}" via ${provider} provider.`,
+      block: blockLines.join("\n"),
+      // Top similarity score doubles as a "how confident is the embedder
+      // about the best match" signal. Substring provider returns no score —
+      // the footer shows n/a in that case.
+      confidence: topScore
+    });
+  } catch (err) {
+    return formatErrorResponse(`Error talking to neat-core: ${err.message}`);
+  }
+}
+async function getGraphDiff(client2, input) {
+  try {
+    const result = await client2.get(
+      projectPath(
+        input.project,
+        `/graph/diff?against=${encodeURIComponent(input.againstSnapshot)}`
+      )
+    );
+    const total = result.added.nodes.length + result.added.edges.length + result.removed.nodes.length + result.removed.edges.length + result.changed.nodes.length + result.changed.edges.length;
+    const baseLabel = result.base.exportedAt ?? "unknown";
+    if (total === 0) {
+      return formatEmptyResponse(
+        `No differences between the current graph and ${input.againstSnapshot} (base exportedAt=${baseLabel}).`
+      );
+    }
+    const blockLines = [
+      `  base exportedAt:    ${baseLabel}`,
+      `  current exportedAt: ${result.current.exportedAt}`,
+      ""
+    ];
+    if (result.added.nodes.length || result.added.edges.length) {
+      blockLines.push("Added:");
+      for (const n of result.added.nodes) blockLines.push(`  + node ${n.id} (${n.type})`);
+      for (const e of result.added.edges)
+        blockLines.push(`  + edge ${e.id} \u2014 ${e.source} -> ${e.target} (${e.type}, ${e.provenance})`);
+      blockLines.push("");
+    }
+    if (result.removed.nodes.length || result.removed.edges.length) {
+      blockLines.push("Removed:");
+      for (const n of result.removed.nodes) blockLines.push(`  - node ${n.id} (${n.type})`);
+      for (const e of result.removed.edges)
+        blockLines.push(`  - edge ${e.id} \u2014 ${e.source} -> ${e.target} (${e.type}, ${e.provenance})`);
+      blockLines.push("");
+    }
+    if (result.changed.nodes.length || result.changed.edges.length) {
+      blockLines.push("Changed:");
+      for (const c of result.changed.nodes) {
+        blockLines.push(`  ~ node ${c.id} \u2014 ${summariseAttrDiff(c.before, c.after)}`);
+      }
+      for (const c of result.changed.edges) {
+        const provBit = c.before.provenance !== c.after.provenance ? `provenance ${c.before.provenance} \u2192 ${c.after.provenance}` : summariseAttrDiff(c.before, c.after);
+        blockLines.push(`  ~ edge ${c.id} \u2014 ${provBit}`);
+      }
+    }
+    return formatToolResponse({
+      summary: `Diff against ${input.againstSnapshot}: ${total} change${total === 1 ? "" : "s"} between the snapshot and the live graph.`,
+      block: blockLines.join("\n").trimEnd()
+      // Diff results don't have a per-result provenance — the diff spans
+      // every edge type and provenance kind. Footer shows n/a.
+    });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 400) {
+      return formatErrorResponse(
+        `Could not load snapshot ${input.againstSnapshot}: ${err.message}`
+      );
+    }
+    return formatErrorResponse(`Error talking to neat-core: ${err.message}`);
+  }
+}
+function summariseAttrDiff(before, after) {
+  const keys = /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)]);
+  const changed = [];
+  for (const k of keys) {
+    if (JSON.stringify(before[k]) !== JSON.stringify(after[k])) changed.push(k);
+  }
+  return changed.length === 0 ? "attributes differ" : `fields changed: ${changed.sort().join(", ")}`;
+}
+async function getRecentStaleEdges(client2, input) {
+  const params = new URLSearchParams();
+  if (input.limit !== void 0) params.set("limit", String(input.limit));
+  if (input.edgeType) params.set("edgeType", input.edgeType);
+  const qs = params.size > 0 ? `?${params.toString()}` : "";
+  try {
+    const events = await client2.get(
+      projectPath(input.project, `/incidents/stale${qs}`)
+    );
+    if (events.length === 0) {
+      return formatEmptyResponse(
+        input.edgeType ? `No stale ${input.edgeType} edges recorded.` : "No stale-edge transitions recorded yet."
+      );
+    }
+    const blockLines = events.map(
+      (e) => `  ${e.transitionedAt} \u2014 ${e.source} -[${e.edgeType}]-> ${e.target} (last seen ${e.lastObserved}, threshold ${formatDuration(e.thresholdMs)})`
+    );
+    return formatToolResponse({
+      summary: `${events.length} stale-edge transition${events.length === 1 ? "" : "s"} recorded${input.edgeType ? ` for ${input.edgeType}` : ""}.`,
+      block: blockLines.join("\n"),
+      // STALE by definition — every event is a transition into STALE.
+      provenance: import_types.Provenance.STALE
+    });
+  } catch (err) {
+    return formatErrorResponse(`Error talking to neat-core: ${err.message}`);
+  }
+}
+async function checkPolicies(client2, input) {
+  try {
+    let violations;
+    let allowed = true;
+    let hypothetical;
+    if (input.hypotheticalAction) {
+      const body = await postJson(
+        client2,
+        projectPath(input.project, "/policies/check"),
+        { hypotheticalAction: input.hypotheticalAction }
+      );
+      violations = body.violations;
+      allowed = body.allowed;
+      hypothetical = body.hypotheticalAction;
+    } else {
+      const qsParams = new URLSearchParams();
+      if (typeof input.scope === "object" && "policyId" in input.scope) {
+        qsParams.set("policyId", input.scope.policyId);
+      }
+      const qs = qsParams.size > 0 ? `?${qsParams.toString()}` : "";
+      violations = await client2.get(
+        projectPath(input.project, `/policies/violations${qs}`)
+      );
+      allowed = violations.every((v) => v.onViolation !== "block");
+    }
+    if (violations.length === 0) {
+      return formatEmptyResponse(
+        hypothetical ? `No violations would result from the hypothetical action (${hypothetical.kind}).` : "No policy violations recorded."
+      );
+    }
+    const blockCount = violations.filter((v) => v.onViolation === "block").length;
+    const summaryParts = [];
+    if (hypothetical) {
+      summaryParts.push(
+        `Hypothetical ${hypothetical.kind} would surface ${violations.length} violation${violations.length === 1 ? "" : "s"}`
+      );
+    } else {
+      summaryParts.push(
+        `${violations.length} policy violation${violations.length === 1 ? "" : "s"} currently recorded`
+      );
+    }
+    if (blockCount > 0) {
+      summaryParts.push(`${blockCount} of which block`);
+    }
+    if (!allowed && hypothetical) {
+      summaryParts.push("action denied");
+    }
+    const summary = summaryParts.join("; ") + ".";
+    const blockLines = violations.map((v) => {
+      const subject = v.subject.nodeId ?? v.subject.edgeId ?? v.subject.path?.[0] ?? "(global)";
+      return `  \u2022 [${v.severity}/${v.onViolation}] ${v.policyName}: ${v.message} \u2014 ${subject}`;
+    });
+    const severities = [...new Set(violations.map((v) => v.severity))];
+    return formatToolResponse({
+      summary,
+      block: blockLines.join("\n"),
+      // Confidence: hypothetical results inherit a 0.7 cap (the engine
+      // can't fully simulate every action shape in MVP); confirmed
+      // violations report 1.00 since the engine ran against current state.
+      confidence: hypothetical ? 0.7 : 1,
+      provenance: severities.join(" ")
+    });
+  } catch (err) {
+    return formatErrorResponse(`Error talking to neat-core: ${err.message}`);
+  }
+}
+async function postJson(client2, path, body) {
+  const c = client2;
+  if (typeof c.post !== "function") {
+    throw new Error("HttpClient does not support POST \u2014 required for check_policies dry-run");
+  }
+  return c.post(path, body);
+}
+
+// src/index.ts
+var baseUrl = process.env.NEAT_CORE_URL ?? "http://localhost:8080";
+var client = createHttpClient(baseUrl);
+var defaultProject = process.env.NEAT_DEFAULT_PROJECT;
+var projectFor = (input) => input.project ?? defaultProject;
+var projectField = import_zod.z.string().optional().describe(
+  "Project name when the core hosts more than one (set NEAT_PROJECTS=...). Omit to use the default project."
+);
+var server = new import_mcp2.McpServer({
+  name: "neat",
+  version: "0.1.0"
+});
+server.tool(
+  "get_root_cause",
+  "Trace a failing node up its dependency graph to find the underlying cause. Use this when something is breaking and you want to know which upstream component is the actual culprit.",
+  {
+    errorNode: import_zod.z.string().describe('Graph node id where the error surfaced, e.g. "database:payments-db"'),
+    errorId: import_zod.z.string().optional().describe("Specific error event id from incident history; if set, the result is coloured with that error message"),
+    project: projectField
+  },
+  async (input) => getRootCause(client, { ...input, project: projectFor(input) })
+);
+server.tool(
+  "get_blast_radius",
+  "List every node downstream of the given node \u2014 what would break if this node failed or was redeployed.",
+  {
+    nodeId: import_zod.z.string().describe("Graph node id to compute blast radius from"),
+    depth: import_zod.z.number().int().nonnegative().max(20).optional().describe("Max BFS depth (default 10)"),
+    project: projectField
+  },
+  async (input) => getBlastRadius(client, { ...input, project: projectFor(input) })
+);
+server.tool(
+  "get_dependencies",
+  "List the transitive outgoing dependencies of a node, BFS to depth N (default 3, max 10). Each result carries distance, edge type, and provenance \u2014 both static (EXTRACTED) and runtime (OBSERVED). Pass depth=1 for direct-only.",
+  {
+    nodeId: import_zod.z.string().describe("Graph node id to inspect"),
+    depth: import_zod.z.number().int().min(1).max(10).optional().describe("BFS depth (default 3, max 10). depth=1 returns direct dependencies only."),
+    project: projectField
+  },
+  async (input) => getDependencies(client, { ...input, project: projectFor(input) })
+);
+server.tool(
+  "get_observed_dependencies",
+  "List only the runtime (OBSERVED via OTel) outgoing dependencies of a node. Use this to compare what code SAYS the service depends on vs what production actually does.",
+  {
+    nodeId: import_zod.z.string().describe("Graph node id to inspect"),
+    project: projectField
+  },
+  async (input) => getObservedDependencies(client, { ...input, project: projectFor(input) })
+);
+server.tool(
+  "get_incident_history",
+  "Return recent OTel error events recorded against a node, most recent first.",
+  {
+    nodeId: import_zod.z.string().describe("Graph node id to query"),
+    limit: import_zod.z.number().int().positive().max(100).optional().describe("Max events to return (default 20)"),
+    project: projectField
+  },
+  async (input) => getIncidentHistory(client, { ...input, project: projectFor(input) })
+);
+server.tool(
+  "semantic_search",
+  "Search nodes by natural-language query. Uses embedding vectors when an embedder is available (Ollama nomic-embed-text \u2192 in-process MiniLM \u2192 substring fallback) \u2014 phrase the query the way you would describe what you want.",
+  {
+    query: import_zod.z.string().describe('Free-text query, e.g. "service handling checkout payments"'),
+    project: projectField
+  },
+  async (input) => semanticSearch(client, { ...input, project: projectFor(input) })
+);
+server.tool(
+  "get_graph_diff",
+  'Diff a saved graph snapshot against the current live graph. Useful for change reviews and post-incidents \u2014 answers "what changed in the architecture between then and now." Returns added/removed/changed nodes and edges with both snapshot timestamps.',
+  {
+    againstSnapshot: import_zod.z.string().describe(
+      'Path or http(s) URL of the snapshot to diff against (the "before" state). The current graph is the "after".'
+    ),
+    project: projectField
+  },
+  async (input) => getGraphDiff(client, { ...input, project: projectFor(input) })
+);
+server.tool(
+  "get_recent_stale_edges",
+  "List the most recent OBSERVED \u2192 STALE edge transitions. Use this to spot integrations that have gone quiet \u2014 a CALLS edge that just went stale typically means an upstream stopped calling, not that the link is healthy.",
+  {
+    limit: import_zod.z.number().int().positive().max(200).optional().describe("Max events to return (default 50)"),
+    edgeType: import_zod.z.string().optional().describe('Filter by edge type \u2014 e.g. "CALLS" or "CONNECTS_TO"'),
+    project: projectField
+  },
+  async (input) => getRecentStaleEdges(client, { ...input, project: projectFor(input) })
+);
+server.tool(
+  "check_policies",
+  "Inspect or dry-run the project's policy.json. Without hypotheticalAction, returns currently-recorded violations. With hypotheticalAction, returns violations that would result if the action were applied. Architectural assertions in five shapes (structural / compatibility / provenance / ownership / blast-radius).",
+  {
+    scope: import_types2.CheckPoliciesScopeSchema.optional().describe(
+      'Narrow to a subset. Default "all".'
+    ),
+    hypotheticalAction: import_types2.HypotheticalActionSchema.optional().describe(
+      "Dry-run mode: simulate the action and return resulting violations. Omit for current state."
+    ),
+    project: projectField
+  },
+  async (input) => checkPolicies(client, {
+    ...input,
+    project: projectFor(input)
+  })
+);
+var incidentsPollMs = process.env.NEAT_RESOURCE_POLL_MS ? Number(process.env.NEAT_RESOURCE_POLL_MS) : void 0;
+var resourceRegistration = registerResources(server, client, {
+  ...incidentsPollMs !== void 0 ? { incidentsPollMs } : {},
+  ...defaultProject ? { project: defaultProject } : {}
+});
+async function main() {
+  const transport = new import_stdio.StdioServerTransport();
+  await server.connect(transport);
+}
+var stopPolling = () => {
+  resourceRegistration.stop();
+};
+process.on("SIGTERM", stopPolling);
+process.on("SIGINT", stopPolling);
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});
+//# sourceMappingURL=index.cjs.map