@neat.is/mcp 0.4.20-dev.20260629 → 0.4.22

package/dist/index.js

@@ -374,7 +374,7 @@ async function getBlastRadius(client2, input) {
     const result = await client2.get(path);
     if (result.totalAffected === 0) {
       return formatEmptyResponse(
-        `${result.origin} has no downstream dependencies. Nothing else would break if it failed.`
+        `${result.origin} has no dependents. Nothing else would break if it failed.`
       );
     }
     const sorted = [...result.affectedNodes].sort(
@@ -387,7 +387,7 @@ async function getBlastRadius(client2, input) {
     );
     const provenances = [...new Set(sorted.map((n) => n.edgeProvenance))];
     return formatToolResponse({
-      summary: `Blast radius for ${result.origin}: ${result.totalAffected} affected node${result.totalAffected === 1 ? "" : "s"} reachable downstream.`,
+      summary: `Blast radius for ${result.origin}: ${result.totalAffected} dependent node${result.totalAffected === 1 ? "" : "s"} would break if it changed.`,
       block: blockLines.join("\n"),
       confidence: Number.isFinite(minConfidence) ? minConfidence : void 0,
       provenance: provenances.length ? provenances : void 0
@@ -435,20 +435,31 @@ async function getDependencies(client2, input) {
     });
   }, `Node ${input.nodeId} not found in the graph.`);
 }
+function observedDepLine(nodeId, e) {
+  const via = e.source !== nodeId ? ` (via ${e.source})` : "";
+  return `  \u2022 ${e.target} \u2014 ${e.type}${via}${edgeMeta(e)}`;
+}
 async function getObservedDependencies(client2, input) {
   return withMissingNodeFallback(async () => {
-    const edges = await client2.get(
-      projectPath(input.project, `/graph/edges/${encodeURIComponent(input.nodeId)}`)
+    const result = await client2.get(
+      projectPath(
+        input.project,
+        `/graph/observed-dependencies/${encodeURIComponent(input.nodeId)}`
+      )
     );
-    const observed = edges.outbound.filter((e) => e.provenance === Provenance.OBSERVED);
-    if (observed.length === 0) {
-      const hasExtracted = edges.outbound.some((e) => e.provenance === Provenance.EXTRACTED);
-      const note = hasExtracted ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
+    if (result.dependencies.length === 0) {
+      if (result.observed) {
+        return formatToolResponse({
+          summary: `${input.nodeId} makes no outbound runtime calls, but OTel has observed it receiving traffic on ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 it's a pure receiver.`,
+          provenance: Provenance.OBSERVED
+        });
+      }
+      const note = result.hasExtractedOutbound ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
       return formatEmptyResponse(`No OBSERVED dependencies for ${input.nodeId}.${note}`);
     }
-    const blockLines = observed.map((e) => `  \u2022 ${e.target} \u2014 ${e.type}${edgeMeta(e)}`);
+    const blockLines = result.dependencies.map((e) => observedDepLine(input.nodeId, e));
     return formatToolResponse({
-      summary: `${input.nodeId} has ${observed.length} runtime dependenc${observed.length === 1 ? "y" : "ies"} confirmed by OTel.`,
+      summary: `${input.nodeId} has ${result.dependencies.length} runtime dependenc${result.dependencies.length === 1 ? "y" : "ies"} confirmed by OTel.`,
       block: blockLines.join("\n"),
       provenance: Provenance.OBSERVED
     });
@@ -631,6 +642,15 @@ async function getRecentStaleEdges(client2, input) {
 }
 async function checkPolicies(client2, input) {
   try {
+    if (input.applicableTo) {
+      const body = await client2.get(
+        projectPath(
+          input.project,
+          `/policies/applicable?node=${encodeURIComponent(input.applicableTo)}`
+        )
+      );
+      return formatApplicablePolicies(body);
+    }
     let violations;
     let allowed = true;
     let hypothetical;
@@ -696,6 +716,27 @@ async function checkPolicies(client2, input) {
     return formatErrorResponse(`Error talking to neat-core: ${err.message}`);
   }
 }
+function formatApplicablePolicies(body) {
+  const { node, applicable } = body;
+  if (applicable.length === 0) {
+    return formatEmptyResponse(
+      `No policies apply to ${node}. Nothing to keep inside the lines here \u2014 and note this is advisory: NEAT surfaces policies for awareness, it never blocks your edit.`
+    );
+  }
+  const summary = `APPLICABLE POLICIES \u2014 ${applicable.length} ${applicable.length === 1 ? "policy applies" : "policies apply"} where you're working (${node}). Keep these in mind as you edit. They inform; they do not block. Nothing here gates or stops your change.`;
+  const lines = applicable.map((p) => {
+    const tail = p.match === "region" ? " [nearby]" : "";
+    return `  \u2022 [${p.severity}/${p.onViolation}] ${p.policyName}${tail}: ${p.reason}`;
+  });
+  return formatToolResponse({
+    summary,
+    block: lines.join("\n"),
+    // The policies themselves are declared in policy.json — EXTRACTED, fully
+    // known; the confidence is in the rule's existence, not a guess.
+    confidence: 1,
+    provenance: "EXTRACTED (policy.json)"
+  });
+}
 function buildDivergencesPath(input) {
   const params = new URLSearchParams();
   if (input.type && input.type.length > 0) params.set("type", input.type.join(","));
@@ -934,7 +975,7 @@ registerTool(
 );
 registerTool(
   "get_blast_radius",
-  "List every node downstream of the given node \u2014 what would break if this node failed or was redeployed.",
+  "List every node that depends on the given node \u2014 what would break if this node failed or was redeployed.",
   {
     nodeId: z.string().describe("Graph node id to compute blast radius from"),
     depth: z.number().int().nonnegative().max(20).optional().describe("Max BFS depth (default 10)"),
@@ -1016,7 +1057,7 @@ registerTool(
 );
 registerTool(
   "check_policies",
-  "Inspect or dry-run the project's policy.json. Without hypotheticalAction, returns currently-recorded violations. With hypotheticalAction, returns violations that would result if the action were applied. Architectural assertions in five shapes (structural / compatibility / provenance / ownership / blast-radius).",
+  "Inspect, dry-run, or get the soft guardrail for the project's policy.json. With applicableTo, returns the policies that apply where you are working \u2014 surfaced as context so you stay inside the lines (informs, never blocks). Without hypotheticalAction or applicableTo, returns currently-recorded violations. With hypotheticalAction, returns violations that would result if the action were applied. Architectural assertions in five shapes (structural / compatibility / provenance / ownership / blast-radius).",
   {
     scope: CheckPoliciesScopeSchema.optional().describe(
       'Narrow to a subset. Default "all".'
@@ -1024,6 +1065,9 @@ registerTool(
     hypotheticalAction: HypotheticalActionSchema.optional().describe(
       "Dry-run mode: simulate the action and return resulting violations. Omit for current state."
     ),
+    applicableTo: z.string().optional().describe(
+      "Soft guardrail (ADR-108): pass the node id you are about to edit and check_policies returns the policies that govern it, as a context block \u2014 so you stay inside the lines. Advisory only; never blocks."
+    ),
     project: projectField
   },
   async (input) => checkPolicies(client, {