@papyruslabsai/seshat-mcp 0.13.2 → 0.13.3

package/dist/index.js

@@ -33,7 +33,7 @@ Use Seshat tools instead of grep/Read when you need to understand code structure
 All tools are read-only and safe to call speculatively — there is no cost to trying them.
 
 get_blast_radius and get_optimal_context are designed to be called iteratively. Start with any entity, then feed discovered entities back in to expand your understanding. Each round reveals new structure that informs where to look next. When answering "what does this system do?" questions, a few rounds of blast_radius → get_entity → blast_radius on the newly discovered symbols will build a complete picture faster than reading files.`;
-const TIER_ORDER = ['cartographer', 'analyst', 'architect'];
+const TIER_ORDER = ['cartographer', 'analyst', 'architect', 'founder'];
 const TOOL_TIERS = {
     // Cartographer (free) — explore, navigate, and assess security surface
     list_projects: 'cartographer',
@@ -70,6 +70,7 @@ const TIER_LABELS = {
     cartographer: 'Cartographer (Free)',
     analyst: 'Analyst (Tier 2)',
     architect: 'Architect (Tier 3)',
+    founder: 'Founder (All Access)',
 };
 function tierAtLeast(userTier, requiredTier) {
     return TIER_ORDER.indexOf(userTier) >= TIER_ORDER.indexOf(requiredTier);
@@ -159,7 +160,7 @@ const TOOLS = [
     },
     {
         name: 'find_by_constraint',
-        description: 'Find every function with a specific behavior tag — AUTH (requires authentication), DB_ACCESS (touches database), THROWS (can throw), PURE (no side effects), NETWORK_IO (makes HTTP calls), VALIDATED (has input validation). Use this when you need to answer questions like "which functions write to the database?" or "what endpoints lack auth?"',
+        description: 'Find every function with a specific syntactic constraint tag — AUTH (requires authentication), DB_ACCESS (touches database), THROWS (explicit throw statement), PURE (no side effects), NETWORK_IO (makes HTTP calls), VALIDATED (has input validation). Constraints are extracted from source syntax, not inferred. Use this when you need to answer "which functions write to the database?" or "what endpoints lack auth?" For semantic/behavioral properties (e.g., "can fail transitively"), use query_traits instead.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -243,7 +244,7 @@ const TOOLS = [
     },
     {
         name: 'get_coupling_metrics',
-        description: 'Measure how tangled modules are. Returns coupling (cross-module dependencies), cohesion (within-module dependencies), and instability scores. High coupling + low cohesion = refactoring candidates. Use this when planning a refactor to find the worst offenders.',
+        description: 'Measure how tangled your code is. Returns coupling (cross-boundary dependencies), cohesion (within-group dependencies), and instability scores. High coupling + low cohesion = refactoring candidates. Start with group_by: "layer" for the architectural health view ("are my controllers more coupled than my services?"), then drill into group_by: "module" for specific hotspots.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -285,19 +286,19 @@ const TOOLS = [
     },
     {
         name: 'find_runtime_violations',
-        description: 'Find architectural boundary leaks where framework-agnostic code imports framework-specific code. Use this when separating core logic from framework dependencies.',
+        description: 'Find architectural boundary leaks where framework-agnostic code imports framework-specific code. Use this when separating core logic from framework dependencies. Returns 0 for most JS/Python codebases — a non-zero result indicates a serious boundary violation worth investigating.',
         inputSchema: { type: 'object', properties: { project: projectParam } },
         annotations: READ_ONLY_OPEN,
     },
     {
         name: 'find_ownership_violations',
-        description: 'Find memory and lifecycle issues — entities with complex ownership, unsafe blocks, escaping references, or illegal mutability on borrowed data. Most useful for Rust and C++ codebases.',
+        description: 'Find memory and lifecycle issues — entities with complex ownership, unsafe blocks, escaping references, or illegal mutability on borrowed data. Returns 0 for most JS/Python codebases — a non-zero result in those languages indicates a serious boundary violation worth investigating. Most detailed results for Rust and C++.',
         inputSchema: { type: 'object', properties: { project: projectParam } },
         annotations: READ_ONLY_OPEN,
     },
     {
         name: 'query_traits',
-        description: 'Find functions by abstract capability regardless of syntax — "fallible" (can fail), "asyncContext" (carries async state), "generator" (yields values). Use this when you need to find all code with a specific behavioral trait across the entire codebase.',
+        description: 'Find functions by inferred behavioral trait — "fallible" (can fail, including transitively via callees that throw), "asyncContext" (carries async state), "generator" (yields values). Traits are semantic properties inferred from the call graph, not just syntax. Use this when you need to find all code with a specific capability. For syntactic tags (explicit throw statements, DB access), use find_by_constraint instead.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -469,7 +470,7 @@ function getCloudUrl(path) {
 async function main() {
     const server = new Server({
         name: 'seshat',
-        version: '0.13.2',
+        version: '0.13.3',
     }, {
         capabilities: { tools: {} },
         instructions: SERVER_INSTRUCTIONS,

package/dist/tools/functors.js

@@ -135,6 +135,15 @@ export function findDeadCode(args, loader) {
     if (!include_tests) {
         deadEntities = deadEntities.filter((e) => entityLayer(e) !== 'test');
     }
+    // Separate schemas — they're often registered dynamically (e.g., fastify.addSchema())
+    // and appear "dead" from a static call graph but are alive at runtime.
+    const SCHEMA_TYPES = new Set(['schema', 'typealias', 'interface', 'type']);
+    const schemaEntities = deadEntities.filter((e) => {
+        const type = (typeof e.struct === 'string' ? e.struct : e.struct?.type || '').toLowerCase();
+        const layer = entityLayer(e);
+        return SCHEMA_TYPES.has(type) || layer === 'schema';
+    });
+    deadEntities = deadEntities.filter((e) => !schemaEntities.includes(e));
     // Group by layer for overview
     const byLayer = new Map();
     for (const e of deadEntities) {
@@ -148,6 +157,10 @@ export function findDeadCode(args, loader) {
         deadCount: deadEntities.length,
         deadByLayer: Object.fromEntries([...byLayer.entries()].sort((a, b) => b[1] - a[1])),
         dead: deadEntities.slice(0, 100).map(entitySummary),
+        ...(schemaEntities.length > 0 ? {
+            schemas_excluded: schemaEntities.length,
+            _note_schemas: `${schemaEntities.length} schema/type definitions excluded — no static references found, but schemas are often registered dynamically (e.g., fastify.addSchema()) and may be alive at runtime.`,
+        } : {}),
     };
 }
 // ─── Tool: find_layer_violations ─────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papyruslabsai/seshat-mcp",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Semantic MCP server — exposes a codebase's structure, dependencies, and constraints as queryable tools",
   "type": "module",
   "bin": {