@orangepro/orangepro-mcp 0.2.29 → 0.2.31

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/README.md +246 -199
  2. package/dist/local/analyze/coverage.js +93 -12
  3. package/dist/local/analyze/coverageArtifacts.js +8 -1
  4. package/dist/local/autoProve.js +8 -6
  5. package/dist/local/cli.js +10 -2
  6. package/dist/local/cliArgs.js +2 -0
  7. package/dist/local/generate/draftGuidance.js +30 -0
  8. package/dist/local/generate/generator.js +105 -18
  9. package/dist/local/generate/prompt.js +23 -4
  10. package/dist/local/generate/promptV5.js +24 -1
  11. package/dist/local/generate/providers.js +28 -15
  12. package/dist/local/operations.js +93 -13
  13. package/dist/local/pack/coverageReport.js +13 -3
  14. package/dist/local/viz/behaviorReportData.js +40 -3
  15. package/dist/local/viz/behaviorReportHtml.js +43 -5
  16. package/docs/local-proof-kit.md +8 -0
  17. package/package.json +1 -1
package/README.md CHANGED
@@ -1,117 +1,126 @@
1
- # OrangePro MCP
1
+ <p align="center">
2
+ <img src="https://github.com/OrangeproAI/orangepro-mcp/raw/main/docs/logo-horizontal.svg" alt="OrangePro" width="320" />
3
+ </p>
4
+
5
+ <p align="center">
6
+ <strong>Find the behaviors your tests miss. Generate grounded tests that actually run.</strong>
7
+ </p>
8
+
9
+ <p align="center">
10
+ <a href="https://www.npmjs.com/package/@orangepro/mcp-server"><img src="https://badge.fury.io/js/@orangepro%2Fmcp-server.svg" alt="npm version" /></a>
11
+ <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="MIT License" /></a>
12
+ <a href="https://www.npmjs.com/package/@orangepro/mcp-server"><img src="https://img.shields.io/npm/dw/@orangepro/mcp-server.svg" alt="npm downloads" /></a>
13
+ <a href="https://glama.ai/mcp/servers/OrangeproAI/orangepro-mcp"><img src="https://glama.ai/mcp/servers/OrangeproAI/orangepro-mcp/badges/score.svg" alt="Glama score" /></a>
14
+ <a href="https://registry.modelcontextprotocol.io/?q=orangepro"><img src="https://img.shields.io/badge/MCP_Registry-orangepro-orange.svg" alt="MCP Registry" /></a>
15
+ </p>
2
16
 
3
- [![npm version](https://badge.fury.io/js/@orangepro%2Fmcp-server.svg )](https://www.npmjs.com/package/@orangepro/mcp-server )
4
- [![MIT License](https://img.shields.io/badge/license-MIT-green.svg )](LICENSE)
5
- [![npm downloads](https://img.shields.io/npm/dw/@orangepro/mcp-server.svg )](https://www.npmjs.com/package/@orangepro/mcp-server )
6
- [![orangepro-mcp MCP server](https://glama.ai/mcp/servers/OrangeproAI/orangepro-mcp/badges/score.svg )](https://glama.ai/mcp/servers/OrangeproAI/orangepro-mcp )
7
- [![MCP Registry](https://img.shields.io/badge/MCP_Registry-ai.orangepro%2Fmcp-orange.svg )](https://registry.modelcontextprotocol.io/?q=orangepro )
8
-
9
- **Find the behaviors your tests miss. Generate grounded tests that actually run.**
10
-
11
- `opro` builds a knowledge graph from your local checkout, maps every behavior in your code, shows which ones are tested and which aren't, and generates integration-level tests grounded in real symbols — not hallucinated imports. It runs as a CLI and a local stdio MCP server.
17
+ ---
12
18
 
13
- Once you run the mcp server against a repo, you can get behavior-coverage/html
14
- **<a href="https://orangeproai.github.io/orangepro-mcp/twenty-crm-behavior-coverage.html" target="_blank">→ Live example: Twenty CRM behavior coverage report</a>**
19
+ OrangePro maps every public behavior in your codebase, scores each one by real test evidence, and shows you the structural blind spots before your users find them. Runs locally. Your code never leaves your machine.
15
20
 
16
- <img width="895" alt="OrangePro system map — entry lanes, services, evidence tiers" src="https://github.com/user-attachments/assets/1ceba779-e0ec-4ec1-99ce-001bc3589b42" />
21
+ ```bash
22
+ npx -y @orangepro/mcp-server@latest start .
23
+ ```
17
24
 
18
- *Fig 1: System map — entry lanes (GraphQL, HTTP, Jobs) flowing into services, sized by traffic, colored by evidence tier, red-ringed by risk.*
25
+ <!-- TODO: Replace with a terminal GIF showing the command running and report opening -->
19
26
 
20
- <img width="818" height="1284" alt="Screenshot 2026-07-30 at 4 38 35 PM" src="https://github.com/user-attachments/assets/1c41475d-be2a-4c6d-ace6-c6546573bf97" />
27
+ ---
21
28
 
29
+ ## Table of Contents
22
30
 
23
- *Fig 2: Priority gaps — top 20 unproven behaviors ranked by blast radius, with generated test drafts and applicable testing categories.*
31
+ - [What you get](#what-you-get)
32
+ - [Evidence tiers](#evidence-tiers)
33
+ - [Quick start](#quick-start)
34
+ - [Use with your coding agent](#use-with-your-coding-agent)
35
+ - [How it works](#how-it-works)
36
+ - [Language support](#language-support)
37
+ - [Privacy](#privacy)
38
+ - [CLI reference](#cli-reference)
39
+ - [MCP tools](#mcp-tools-18-total)
40
+ - [Platform](#whats-on-the-hosted-platform)
41
+ - [Contributing](#contributing)
24
42
 
25
43
  ---
26
- Install the target repository's dependencies first, then run OrangePro from that repository:
27
44
 
28
- ```bash
29
- cd /path/to/your/repo
30
- npm install # or pnpm install / bun install / the repository's package manager
45
+ ## What you get
31
46
 
32
- # Optional: enables AI candidate links, candidate flows, and test generation.
33
- export ANTHROPIC_API_KEY="..." # or OPENAI_API_KEY / OLLAMA_BASE_URL
47
+ One command produces an interactive HTML report:
34
48
 
35
- npx -y @orangepro/mcp-server@latest start . --prompt-version v5
49
+ ```bash
50
+ npx -y @orangepro/mcp-server@latest start .
36
51
  open .orangepro/behavior-coverage.html
37
52
  ```
53
+ The report has two modes: **Simple** (integration-level blind spots, plain English) and **Expert** (full behavior list, evidence tiers, flows, system map). Toggle with the pill switch at the top.
38
54
 
39
- With no model key, the same command still performs deterministic analysis, renders the report, and dynamically proves eligible behaviors using existing tests. With a key, it also discovers AI candidate flows and drafts grounded tests for the highest-risk gaps. AI output never changes evidence tiers; only the mutation-kill oracle can mint **Dynamically Proven**.
55
+ **<a href="https://orangeproai.github.io/orangepro-mcp/twenty-crm-behavior-coverage.html" target="_blank">→ Live example: Twenty CRM (5,237 behaviors mapped)</a>**
40
56
 
41
- The command writes:
57
+ <img width="895" alt="OrangePro system map — entry lanes, services, evidence tiers" src="https://github.com/user-attachments/assets/1ceba779-e0ec-4ec1-99ce-001bc3589b42](https://github.com/user-attachments/assets/a4d85b98-4f19-4647-8dd9-db5911574f49" />
42
58
 
43
- ```
44
- .orangepro/
45
- ├── behavior-coverage.html ← open this: system map, risks, flows, behaviors
46
- ├── graph.json ← deterministic evidence graph
47
- ├── COVERAGE_REPORT.md ← coverage and gap summary
48
- ├── rtm.md ← requirements traceability matrix
49
- └── ai/ ← candidate AI links/flows when a provider is configured
59
+ *System map — entry lanes (GraphQL, HTTP, Jobs) flowing into services, sized by traffic, colored by evidence tier, red-ringed by risk.*
50
60
 
51
- orangepro_generated/ ← contained generated tests; existing source files are untouched
52
- ```
53
61
 
54
- The report opens on a **system map** of your repo — entry lanes (GraphQL/HTTP/Jobs) flowing into the services they reach, sized by traffic, colored by evidence tier, risk-ringed — identical on every run. Each completed rerun shows a **delta banner** against the previous completed run. The report discloses when bounded path enumeration prunes additional branch expansions. Every behavior gets a plain-English description; every top risk gets a deterministic context line and a state-aware next step.
62
+ <img width="818" alt="Priority gaps" src="https://github.com/user-attachments/assets/30a512b6-7830-48db-a00f-a616e7176ea8" />
55
63
 
56
- Run `opro export` when you want a machine-readable evidence pack.
64
+ *Priority gaps of another open source Project HONO — top 20 unproven behaviors ranked by blast radius, with generated test drafts.*
57
65
 
58
66
  ---
59
67
 
60
- ## Install
68
+ ## Evidence tiers
61
69
 
62
- ```bash
63
- # No install needed: run the full local workflow in the current repository
64
- npx -y @orangepro/mcp-server@latest start . --prompt-version v5
70
+ Every behavior gets exactly one tier. Nothing is labeled "tested" on faith.
65
71
 
66
- # Or global install
67
- npm install -g @orangepro/orangepro-mcp
68
- opro start . --prompt-version v5
72
+ | Tier | Color | What it means |
73
+ |------|-------|---------------|
74
+ | **Dynamically Proven** | 🟢 | A real test kills a targeted mutation of this behavior |
75
+ | **Runtime-covered** | 🟢 | Coverage tool executed this code |
76
+ | **Statically Linked** | 🟡 | A test imports and calls this code — structural link, not proof |
77
+ | **Unconfirmed Candidate** | ⚪ | A similar test file exists — a lead, not evidence |
78
+ | **No Signal** | 🔴 | Nothing tests this behavior |
69
79
 
70
- # Or from source
71
- git clone https://github.com/OrangeproAI/orangepro-mcp.git
72
- cd orangepro-mcp && npm ci && npm run build && npm link
73
- ```
80
+ > **"Dynamically Proven 0" is normal on first run.** Proof requires running tests against targeted mutations. That's the trust model.
74
81
 
75
82
  ---
76
83
 
77
- ## Use with your coding agent
84
+ ## Quick start
85
+
86
+ ```bash
87
+ cd /path/to/your/repo
88
+ npm install # install the repo's own dependencies first
78
89
 
79
- OrangePro runs as an MCP server. Any MCP-compatible agent (Cursor, Claude Code, Codex, Copilot, OpenCode) can drive it.
90
+ npx -y @orangepro/mcp-server@latest start .
91
+ open .orangepro/behavior-coverage.html
92
+ ```
80
93
 
81
- ### Quick agent setup
94
+ No API key needed. The report shows your system map, evidence tiers, priority gaps, and delta since last run.
82
95
 
83
- If you already have `opro` on your PATH, print the exact config for your client:
96
+ **Want test generation?** Add a model key (BYOK):
84
97
 
85
98
  ```bash
86
- opro agent --client codex
87
- opro agent --client claude-code
88
- opro agent --client cursor
89
- opro agent --client opencode
90
- opro agent --client generic
99
+ export ANTHROPIC_API_KEY="..." # or OPENAI_API_KEY / OLLAMA_BASE_URL
100
+ npx -y @orangepro/mcp-server@latest start .
91
101
  ```
92
102
 
93
- No global install is required. These commands use the published package:
103
+ AI output never changes evidence tiers. Only the mutation-kill oracle can mint Dynamically Proven.
94
104
 
95
- ```bash
96
- # Codex
97
- npx -y @orangepro/mcp-server@latest agent --client codex
105
+ **Output:**
98
106
 
99
- # Claude Code
100
- npx -y @orangepro/mcp-server@latest agent --client claude-code
107
+ ```
108
+ .orangepro/
109
+ ├── behavior-coverage.html ← open this
110
+ ├── graph.json ← deterministic evidence graph
111
+ ├── COVERAGE_REPORT.md ← coverage and gap summary
112
+ └── ai/ ← candidate flows (when a key is configured)
101
113
 
102
- # Cursor
103
- npx -y @orangepro/mcp-server@latest agent --client cursor
114
+ orangepro_generated/ ← generated tests; your source files are never touched
115
+ ```
104
116
 
105
- # OpenCode
106
- npx -y @orangepro/mcp-server@latest agent --client opencode
117
+ Each rerun shows a **delta banner**: what entered the codebase, what moved up in risk, what got resolved.
107
118
 
108
- # Generic MCP clients, including VS Code/Copilot-style MCP settings
109
- npx -y @orangepro/mcp-server@latest agent --client generic
110
- ```
119
+ ---
111
120
 
112
- ### Manual MCP config
121
+ ## Use with your coding agent
113
122
 
114
- Add to your client's MCP config:
123
+ OrangePro runs as an MCP server. Add to your client's config:
115
124
 
116
125
  ```json
117
126
  {
@@ -124,48 +133,127 @@ Add to your client's MCP config:
124
133
  }
125
134
  ```
126
135
 
127
- | Client | Config location |
136
+ | Client | Where to put it |
128
137
  | --- | --- |
129
138
  | Claude Code | `.mcp.json` or `~/.claude.json` |
130
139
  | Cursor | `~/.cursor/mcp.json` or Settings → MCP |
131
- | Codex | Config printed by `opro agent --client codex` or `npx -y @orangepro/mcp-server@latest agent --client codex` |
132
- | VS Code / Copilot | MCP settings; use the `generic` config if your client accepts raw MCP server JSON |
133
- | OpenCode | Config printed by `opro agent --client opencode` |
134
-
135
- ### The workflow
140
+ | VS Code / Copilot | MCP settings |
141
+ | Codex / OpenCode | Run `npx -y @orangepro/mcp-server@latest agent --client codex` |
136
142
 
137
- Tell your agent:
143
+ **The workflow:** Tell your agent:
138
144
 
139
145
  > "Use `orangepro_start`, then `orangepro_generate_tests` with base_ref=main. Write each test to its suggested_path, run it, and report pass/fail."
140
146
 
141
147
  The agent writes the test, runs it, calls `orangepro_prove`, and the behavior turns Dynamically Proven. One prompt, full loop.
142
148
 
143
- ### MCP tools (18 total)
149
+ ---
144
150
 
145
- | Tool | What it does |
146
- |------|--------------|
147
- | `orangepro_start` | One-command setup: analyze + report + next actions |
148
- | `orangepro_analyze_sources` | Build/refresh the evidence graph |
149
- | `orangepro_generate_tests` | Generate grounded tests for gaps |
150
- | `orangepro_prove` | Run mutation-kill oracle on a behavior |
151
- | `orangepro_prove_loop` | Setup commands + dynamic proof + report refresh for one behavior |
152
- | `orangepro_find_test_gaps` | List behaviors with weak/missing tests, ranked by risk |
153
- | `orangepro_graph_score` | Graph readiness score (0–100) |
154
- | `orangepro_status` | Workspace state without generating anything |
155
- | `orangepro_doctor` | Recommend next evidence to improve quality |
156
- | `orangepro_rtm` | Requirements traceability matrix |
157
- | `orangepro_stats` | Aggregate statistics |
158
- | `orangepro_changed_impact` | What a diff touches (requires git + base ref) |
159
- | `orangepro_record_run` | Record a test run result |
160
- | `orangepro_explain_test` | Explain why a test was generated |
161
- | `orangepro_export_evidence_pack` | Export metadata-only evidence pack |
162
- | `orangepro_update_graph` | Incremental graph update |
163
- | `orangepro_ai_links` | Weak behavior→symbol suggestions (optional AI) |
164
- | `orangepro_ai_flows` | Candidate flow discovery (optional AI) |
151
+ ## Works with
152
+
153
+ <p>
154
+ <strong>Claude Code</strong> · <strong>Cursor</strong> · <strong>GitHub Copilot</strong> · <strong>Codex</strong> · <strong>Windsurf</strong> · <strong>OpenCode</strong> · <strong>VS Code</strong>
155
+ </p>
156
+
157
+ Any MCP-compatible agent can drive OrangePro. No vendor lock-in.
158
+
159
+ ---
160
+
161
+ ## How it works
162
+
163
+ ```
164
+ ┌─────────────┐ ┌──────────────┐ ┌─────────────┐
165
+ │ Your Code │ ──► │ Knowledge │ ──► │ Evidence │
166
+ │ (any lang) │ │ Graph │ │ Tiers │
167
+ └─────────────┘ └──────────────┘ └─────────────┘
168
+ │
169
+ ┌──────┴──────┐
170
+ ▼ ▼
171
+ ┌───────────┐ ┌──────────┐
172
+ │ Gap Report│ │ Generate │
173
+ │ + Risks │ │ Tests │
174
+ └───────────┘ └──────────┘
175
+ ```
176
+
177
+ | Phase | What happens | Needs a model key? |
178
+ |-------|-------------|-------------------|
179
+ | **Analyze** | AST walk → behaviors, flows, evidence tiers | No |
180
+ | **Score** | Graph readiness score (0–100) | No |
181
+ | **Generate** | Grounded tests for top gaps | Yes (BYOK) |
182
+ | **Prove** | Mutation-kill oracle confirms test breaks if behavior changes | No |
183
+
184
+ Same code = same score. Deterministic. Always.
185
+
186
+ ---
187
+
188
+ ## Language support
189
+
190
+ | Language | Static mapping | Generated tests | Dynamic proof |
191
+ |----------|:-:|:-:|:-:|
192
+ | TypeScript / JavaScript | ✓ | ✓ Jest / Vitest / Mocha | ✓ |
193
+ | Python | ✓ | ✓ pytest | ✓ |
194
+ | Go | ✓ | ✓ `*_test.go` | ✓ |
195
+ | Java | ✓ | ✓ JUnit 4/5 | ✓ |
196
+ | Kotlin, Rust, PHP, C#, Ruby, Swift, C, C++ | ✓ | planned | planned |
197
+
198
+ Static mapping works across many languages via tree-sitter. Dynamic proof is deliberately narrower — each language needs a runner, mutation locator, and sandbox profile.
199
+
200
+ ---
201
+
202
+ ## Highest-value local run
203
+
204
+ Use the repository's own setup and test commands first, and keep unit and integration
205
+ coverage in separate artifacts. Then run `opro start`; it performs analysis, ingests
206
+ the artifacts, attempts targeted proof, generates report-visible drafts, and writes the
207
+ final report. A separate `opro analyze` is unnecessary when `opro start` follows it.
208
+
209
+ ```bash
210
+ # 1. Install/build exactly as the repository documents.
211
+ # 2. Run the repository's unit and integration coverage commands separately.
212
+ # 3. Record artifact provenance (example paths and commands):
213
+ mkdir -p .orangepro
214
+ # create .orangepro/coverage-suites.json using the schema below
215
+
216
+ opro coverage . # optional preflight: discover/generate artifacts
217
+ opro start . --proof-limit 5 --generate-limit 20
218
+ ```
219
+
220
+ ```json
221
+ {
222
+ "artifacts": {
223
+ ".orangepro/coverage/unit.coverprofile": {
224
+ "suite": "unit",
225
+ "command": "make unit-test-coverage"
226
+ },
227
+ ".orangepro/coverage/integration.coverprofile": {
228
+ "suite": "integration",
229
+ "command": "make integration-test-coverage"
230
+ }
231
+ }
232
+ }
233
+ ```
234
+
235
+ Without this manifest, OrangePro conservatively infers clear `unit`/`integration` names
236
+ and labels everything else `unclassified`; it never guesses that an aggregate profile is
237
+ unit-only. The report shows unit, integration, their overlap, unclassified coverage, and
238
+ the combined union separately. `--proof-limit` controls dynamic proof attempts (which
239
+ may draft a test for proof); `--generate-limit` independently controls the additional
240
+ report-visible risk-gap drafting lane. A generation run
241
+ also records its terminal status and exact reason, so a compiler/import failure is not
242
+ misreported as a generic dependency problem.
165
243
 
166
244
  ---
167
245
 
168
- ## CLI reference
246
+ ## Privacy
247
+
248
+ - **No stored source.** Reads code in-process. Never uploads to an OrangePro server.
249
+ - **No existing-source mutation.** Never edits your source or test files.
250
+ - **Your keys stay yours.** Read from env at call time, never persisted.
251
+ - **BYOK is direct.** Code context goes to the model provider you configure. OrangePro is not in that path.
252
+
253
+ ---
254
+
255
+ <details>
256
+ <summary><strong>CLI reference</strong></summary>
169
257
 
170
258
  ```bash
171
259
  opro # analyze + report + agent next actions
@@ -175,39 +263,66 @@ opro score # graph readiness (0–100)
175
263
  opro gaps --limit 10 # top 10 untested behaviors
176
264
  opro generate --base main # tests for PR diff
177
265
  opro generate --single # top gap, whole repo
178
- opro prove # mutation-kill oracle (use the prove_run args returned by generate)
266
+ opro prove # mutation-kill oracle
179
267
  opro rtm # traceability matrix
180
268
  opro export # metadata-only evidence pack
181
269
  opro mcp # run as MCP server (stdio)
182
270
  opro doctor # what evidence to add next
183
- opro doctor --proof # explain why dynamic proof could not close
184
- opro coverage # ingest runtime coverage
271
+ opro coverage # discover/generate artifacts; analyze or start ingests them
185
272
  ```
186
273
 
187
274
  Add `--json` to any read command for machine output. Run `opro help` for the full reference.
188
275
 
189
- ---
276
+ </details>
277
+
278
+ <details>
279
+ <summary><strong>MCP tools (18 total)</strong></summary>
280
+
281
+ | Tool | What it does |
282
+ |------|--------------|
283
+ | `orangepro_start` | One-command setup: analyze + report + next actions |
284
+ | `orangepro_analyze_sources` | Build/refresh the evidence graph |
285
+ | `orangepro_generate_tests` | Generate grounded tests for gaps |
286
+ | `orangepro_prove` | Run mutation-kill oracle on a behavior |
287
+ | `orangepro_prove_loop` | Setup + dynamic proof + report refresh for one behavior |
288
+ | `orangepro_find_test_gaps` | List behaviors with weak/missing tests, ranked by risk |
289
+ | `orangepro_graph_score` | Graph readiness score (0–100) |
290
+ | `orangepro_status` | Workspace state without generating anything |
291
+ | `orangepro_doctor` | Recommend next evidence to improve quality |
292
+ | `orangepro_rtm` | Requirements traceability matrix |
293
+ | `orangepro_stats` | Aggregate statistics |
294
+ | `orangepro_changed_impact` | What a diff touches (requires git + base ref) |
295
+ | `orangepro_record_run` | Record a test run result |
296
+ | `orangepro_explain_test` | Explain why a test was generated |
297
+ | `orangepro_export_evidence_pack` | Export metadata-only evidence pack |
298
+ | `orangepro_update_graph` | Incremental graph update |
299
+ | `orangepro_ai_links` | Weak behavior→symbol suggestions (optional AI) |
300
+ | `orangepro_ai_flows` | Candidate flow discovery (optional AI) |
301
+
302
+ </details>
190
303
 
191
- ## PR workflow
304
+ <details>
305
+ <summary><strong>PR workflow</strong></summary>
192
306
 
193
307
  ```bash
194
308
  opro generate --base main # tests for what this branch changed
195
- opro generate --pr 1234 # checks out PR #1234 — mutates your working tree; needs gh + confirmation (prefer --base)
309
+ opro generate --pr 1234 # checks out PR #1234
196
310
  opro generate --changed # current branch diff vs main
197
311
  ```
198
312
 
199
313
  Each generated test includes:
200
314
  - **Grounding** — the real files, symbols, and existing tests it cites
201
315
  - **Run hints** — where to write it, how to run it
202
- - **Scenario bucket + technique** — what failure mode it targets and how
316
+ - **Scenario bucket** — what failure mode it targets
203
317
 
204
- If the environment can't run tests yet (dependencies not installed, runner unconfigured), rejected drafts are kept as **Manual tests** — scenario, Given/When/Then steps, synthetic test data, and expected outcome in plain English, with the exact blocker named. Install dependencies and re-run `opro start` to turn them into runnable tests. Runnable tests always replace Manual tests for the same behavior; the two are never mixed.
318
+ If dependencies aren't installed, tests are kept as **Manual tests** (Given/When/Then steps with the blocker named). Install dependencies and re-run to convert them to runnable tests.
205
319
 
206
- ---
320
+ </details>
207
321
 
208
- ## Test categories
322
+ <details>
323
+ <summary><strong>Test categories</strong></summary>
209
324
 
210
- Generation is evidence-gated. A category is produced only when the graph has supporting evidence — never padded with generic filler. These are the local generation buckets. The report additionally shows each risk's **applicable testing categories** (contract, boundary limits, integration flow, state lifecycle, failure recovery, …), derived deterministically from graph facts. Categories with generated drafts are highlighted as drafts; they are not coverage or proof, and remaining applicable categories stay outlined. Neither taxonomy changes evidence tiers.
325
+ Generation is evidence-gated. A category is produced only when the graph has supporting evidence.
211
326
 
212
327
  | Category | What it targets |
213
328
  |----------|-----------------|
@@ -218,43 +333,10 @@ Generation is evidence-gated. A category is produced only when the graph has sup
218
333
  | Security / privacy | Auth, injection, data leakage |
219
334
  | Regression | Pinning a previously-broken behavior |
220
335
 
221
- ---
222
-
223
- ## Evidence tiers
224
-
225
- Every behavior gets exactly one tier. Nothing is labeled "tested" on faith.
336
+ </details>
226
337
 
227
- | Tier | What it means | How you get there |
228
- |------|---------------|------------------|
229
- | **Dynamically Proven** | A real test kills a targeted mutant of this behavior | `opro prove` after writing/running a test |
230
- | **Runtime-covered** | Coverage tool executed this code | `opro start --generate-coverage` |
231
- | **Statically Linked** | A test **imports and calls** this code — a hard structural link | Automatic during analysis |
232
- | **Unconfirmed Candidate** | A lexically similar test file exists, but nothing links it — a lead, **not evidence** | Automatic; upgrade it by writing the linking test |
233
- | **No Signal** | Nothing tests this behavior yet | — |
234
-
235
- > **"Dynamically Proven 0" is normal on first run.** Static analysis always runs. Dynamic proof requires running tests against targeted mutations. That's the trust model — nothing is Dynamically Proven until a real test kills a real mutant.
236
-
237
- When runtime coverage is available, `opro start` also compares Runtime-covered and Dynamically Proven behaviors over the same deterministic denominator. It never compares source-line coverage with behavior proof or folds off-denominator proofs into that percentage.
238
-
239
- ---
240
-
241
- ## Language support
242
-
243
- OrangePro separates static mapping, generated tests, runtime coverage, and dynamic proof. Those are different confidence bars.
244
-
245
- | Language | Static behavior extraction | Generated tests | Runtime coverage | Dynamic proof |
246
- |----------|:--------------------------:|:---------------:|:----------------:|:-------------:|
247
- | TypeScript / JavaScript | ✓ | ✓ Jest / Vitest / Mocha / AVA-style drafts | ✓ lcov.info | ✓ Vitest / Jest / Mocha |
248
- | Python | ✓ | ✓ pytest | ✓ coverage.py / pytest-cov XML | ✓ pytest |
249
- | Go | ✓ | ✓ same-package `*_test.go` | ✓ coverprofile | ✓ `go test` |
250
- | Java | ✓ | ✓ JUnit 4/5 | ✓ JaCoCo XML | ✓ Maven/JUnit |
251
- | Kotlin, Rust, PHP, C#, Ruby, Swift, C, C++ | ✓ static behavior extraction | planned | planned where standard coverage exists | planned proof profiles |
252
-
253
- Static mapping works across many languages through tree-sitter and repo metadata. Dynamic proof is deliberately narrower: each language needs a runner, mutation locator, sandbox profile, and false-proof regressions before it can mint Dynamically Proven.
254
-
255
- ---
256
-
257
- ## Model setup (BYOK)
338
+ <details>
339
+ <summary><strong>Model setup (BYOK)</strong></summary>
258
340
 
259
341
  Analysis, scoring, and proof need no model key. Generation does.
260
342
 
@@ -268,56 +350,20 @@ Auto-detect order: OpenAI → Ollama → Anthropic. Override with `--provider` a
268
350
 
269
351
  Run `opro setup` to configure interactively. Keys stay in your environment — never written to graph, config, or artifacts.
270
352
 
271
- ---
353
+ </details>
272
354
 
273
- ## AI candidate lanes
355
+ <details>
356
+ <summary><strong>AI candidate lanes</strong></summary>
274
357
 
275
- With a provider key, OrangePro can stage weak AI behavior→symbol links and AI-suggested candidate flows. These are ready for local use as review/generation worklists, but they are not evidence:
358
+ With a provider key, OrangePro stages weak AI behavior→symbol links and AI-suggested candidate flows. These are review/generation worklists, not evidence:
276
359
 
277
360
  - AI links appear as `AI-linked` suggestions.
278
361
  - AI flows are stored separately from deterministic flows.
279
- - Neither lane changes Dynamically Proven, Runtime-covered, Statically Linked, denominator counts, or evidence tiers.
280
-
281
- Use them when you want the agent to find likely service-boundary flows faster; ignore them when you want a deterministic-only report.
282
-
283
- ---
362
+ - Neither lane changes evidence tiers or denominator counts.
284
363
 
285
- ## How it works
364
+ Use them when you want the agent to find likely service-boundary flows faster; ignore them for a deterministic-only report.
286
365
 
287
- OrangePro separates **analysis** (what your code does) from **proof** (whether tests actually verify it).
288
-
289
- ```
290
- ┌─────────────┐ ┌──────────────┐ ┌─────────────┐
291
- │ Your Code │ ──► │ Knowledge │ ──► │ Evidence │
292
- │ (any lang) │ │ Graph │ │ Tiers │
293
- └─────────────┘ └──────────────┘ └─────────────┘
294
- │
295
- ┌──────┴──────┐
296
- ▼ ▼
297
- ┌───────────┐ ┌──────────┐
298
- │ Gap Report│ │ Generate │
299
- │ + Risks │ │ Tests │
300
- └───────────┘ └──────────┘
301
- ```
302
-
303
- | Phase | What happens | Needs a model key? |
304
- |-------|-------------|-------------------|
305
- | **Analyze** | AST walk → behaviors, flows, evidence tiers | No |
306
- | **Score** | Graph readiness score (0–100) with reasons | No |
307
- | **Generate** | Grounded tests for top gaps, per-behavior | Yes (BYOK) |
308
- | **Prove** | Mutation-kill oracle confirms test actually breaks if behavior changes | No |
309
-
310
- Reruns are cache-accelerated: unchanged files skip re-parsing, BYOK stages don't re-spend tokens on unchanged inputs, and proof certificates persist in a local ledger until the certified file changes. Upgrading the tool auto-invalidates caches.
311
-
312
- ---
313
-
314
- ## Privacy
315
-
316
- - **No stored source.** Reads code in-process. Never uploads to an OrangePro server.
317
- - **No existing-source mutation.** Never edits existing source or test files. Writes metadata to `.orangepro/`; keyed auto-drive may write new, reviewable tests under `orangepro_generated/`.
318
- - **Metadata-only exports.** File paths, names, hashes, scores — not raw source.
319
- - **Your keys stay yours.** Read from env at call time, never persisted.
320
- - **BYOK is direct.** When AI lanes are enabled, grounded code context is sent directly to the model provider you configure; OrangePro's hosted service is not in that path.
366
+ </details>
321
367
 
322
368
  ---
323
369
 
@@ -326,25 +372,26 @@ Reruns are cache-accelerated: unchanged files skip re-parsing, BYOK stages don't
326
372
  This repo is the free local tool. The [OrangePro platform](https://orangepro.ai) adds:
327
373
 
328
374
  - Persistent knowledge graph across PRs and repos
329
- - Managed dynamic proof at scale (larger budgets, CI workers, service setup profiles)
330
- - PR/CI policy gates over Dynamically Proven, Runtime-covered, and risk deltas
375
+ - PR/CI policy gates over evidence tiers and risk deltas
331
376
  - Jira / Confluence / TestRail / OpenAPI enrichment
332
377
  - Cross-repo intelligence and recurring-flow memory
333
378
  - Production incident correlation and regression targeting
334
- - Full test lifecycle management and team dashboards
379
+ - Team dashboards and test lifecycle management
335
380
 
336
381
  ---
337
382
 
338
383
  ## Contributing
339
384
 
340
385
  ```bash
341
- npm run build # compile to dist/
342
- npm test # vitest
343
- npm run typecheck # type check without emitting
386
+ git clone https://github.com/OrangeproAI/orangepro-mcp.git
387
+ cd orangepro-mcp && npm ci && npm run build
388
+ npm test
344
389
  ```
345
390
 
346
- See [docs/local-proof-kit.md](docs/local-proof-kit.md) for the full development reference.
391
+ PRs welcome. Please open an issue first for large changes.
347
392
 
348
- ## License
393
+ ---
349
394
 
350
- [MIT](LICENSE) © OrangePro
395
+ <p align="center">
396
+ MIT License · <a href="https://orangepro.ai">orangepro.ai</a>
397
+ </p>