@papyruslabsai/seshat-mcp 0.13.2 → 0.13.4

package/dist/index.js

@@ -25,6 +25,7 @@ Use Seshat tools instead of grep/Read when you need to understand code structure
 - "What breaks if I change this?" → get_blast_radius
 - "What data does this read/write/mutate?" → get_data_flow
 - "Which functions touch the DB / require auth / throw?" → find_by_constraint
+- "What reads or writes the 'users' table?" → find_by_constraint(table="users")
 - "Which endpoints require auth and which don't?" → get_auth_matrix
 - "Where is sensitive data exposed without protection?" → find_exposure_leaks
 - "What should I read before modifying X?" → get_optimal_context
@@ -33,7 +34,7 @@ Use Seshat tools instead of grep/Read when you need to understand code structure
 All tools are read-only and safe to call speculatively — there is no cost to trying them.
 
 get_blast_radius and get_optimal_context are designed to be called iteratively. Start with any entity, then feed discovered entities back in to expand your understanding. Each round reveals new structure that informs where to look next. When answering "what does this system do?" questions, a few rounds of blast_radius → get_entity → blast_radius on the newly discovered symbols will build a complete picture faster than reading files.`;
-const TIER_ORDER = ['cartographer', 'analyst', 'architect'];
+const TIER_ORDER = ['cartographer', 'pro', 'analyst', 'architect', 'founder'];
 const TOOL_TIERS = {
     // Cartographer (free) — explore, navigate, and assess security surface
     list_projects: 'cartographer',
@@ -68,8 +69,10 @@ const TOOL_TIERS = {
 };
 const TIER_LABELS = {
     cartographer: 'Cartographer (Free)',
-    analyst: 'Analyst (Tier 2)',
-    architect: 'Architect (Tier 3)',
+    pro: 'Seshat Pro',
+    analyst: 'Seshat Shield',
+    architect: 'Architect',
+    founder: 'Founder (All Access)',
 };
 function tierAtLeast(userTier, requiredTier) {
     return TIER_ORDER.indexOf(userTier) >= TIER_ORDER.indexOf(requiredTier);
@@ -118,7 +121,7 @@ const TOOLS = [
     },
     {
         name: 'get_entity',
-        description: 'Get everything about one function or class — its signature, callers, callees, data flow, constraints, and source location. Use this when you need to deeply understand a single symbol before modifying it. Returns more than reading the source file because it includes the dependency context.',
+        description: 'Get everything about one function or class — its signature, callers, callees, data flow, constraints, source location, and database operations (which tables it reads/writes). Use this when you need to deeply understand a single symbol before modifying it. Returns more than reading the source file because it includes the dependency context.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -159,12 +162,13 @@ const TOOLS = [
     },
     {
         name: 'find_by_constraint',
-        description: 'Find every function with a specific behavior tag — AUTH (requires authentication), DB_ACCESS (touches database), THROWS (can throw), PURE (no side effects), NETWORK_IO (makes HTTP calls), VALIDATED (has input validation). Use this when you need to answer questions like "which functions write to the database?" or "what endpoints lack auth?"',
+        description: 'Find every function with a specific syntactic constraint tag — AUTH (requires authentication), DB_ACCESS (touches database), THROWS (explicit throw statement), PURE (no side effects), NETWORK_IO (makes HTTP calls), VALIDATED (has input validation). Also supports table-level queries: pass table="walks" to find every function that reads or writes the walks table (answers "what touches this table?" for schema migrations). Constraints are extracted from source syntax, not inferred. For semantic/behavioral properties (e.g., "can fail transitively"), use query_traits instead.',
         inputSchema: {
             type: 'object',
             properties: {
                 project: projectParam,
                 constraint: { type: 'string', description: 'Constraint tag to search for: AUTH, VALIDATED, PURE, THROWS, DB_ACCESS, NETWORK_IO, IMP, etc.' },
+                table: { type: 'string', description: 'Optional: filter to functions that touch a specific database table (e.g., "walks", "users"). Returns structured db_operations showing read/write/mutate per function.' },
             },
             required: ['constraint'],
         },
@@ -243,7 +247,7 @@ const TOOLS = [
     },
     {
         name: 'get_coupling_metrics',
-        description: 'Measure how tangled modules are. Returns coupling (cross-module dependencies), cohesion (within-module dependencies), and instability scores. High coupling + low cohesion = refactoring candidates. Use this when planning a refactor to find the worst offenders.',
+        description: 'Measure how tangled your code is. Returns coupling (cross-boundary dependencies), cohesion (within-group dependencies), and instability scores. High coupling + low cohesion = refactoring candidates. Start with group_by: "layer" for the architectural health view ("are my controllers more coupled than my services?"), then drill into group_by: "module" for specific hotspots.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -285,19 +289,19 @@ const TOOLS = [
     },
     {
         name: 'find_runtime_violations',
-        description: 'Find architectural boundary leaks where framework-agnostic code imports framework-specific code. Use this when separating core logic from framework dependencies.',
+        description: 'Find architectural boundary leaks where framework-agnostic code imports framework-specific code. Use this when separating core logic from framework dependencies. Returns 0 for most JS/Python codebases — a non-zero result indicates a serious boundary violation worth investigating.',
         inputSchema: { type: 'object', properties: { project: projectParam } },
         annotations: READ_ONLY_OPEN,
     },
     {
         name: 'find_ownership_violations',
-        description: 'Find memory and lifecycle issues — entities with complex ownership, unsafe blocks, escaping references, or illegal mutability on borrowed data. Most useful for Rust and C++ codebases.',
+        description: 'Find memory and lifecycle issues — entities with complex ownership, unsafe blocks, escaping references, or illegal mutability on borrowed data. Returns 0 for most JS/Python codebases — a non-zero result in those languages indicates a serious boundary violation worth investigating. Most detailed results for Rust and C++.',
         inputSchema: { type: 'object', properties: { project: projectParam } },
         annotations: READ_ONLY_OPEN,
     },
     {
         name: 'query_traits',
-        description: 'Find functions by abstract capability regardless of syntax — "fallible" (can fail), "asyncContext" (carries async state), "generator" (yields values). Use this when you need to find all code with a specific behavioral trait across the entire codebase.',
+        description: 'Find functions by inferred behavioral trait — "fallible" (can fail, including transitively via callees that throw), "asyncContext" (carries async state), "generator" (yields values). Traits are semantic properties inferred from the call graph, not just syntax. Use this when you need to find all code with a specific capability. For syntactic tags (explicit throw statements, DB access), use find_by_constraint instead.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -469,7 +473,7 @@ function getCloudUrl(path) {
 async function main() {
     const server = new Server({
         name: 'seshat',
-        version: '0.13.2',
+        version: '0.13.4',
     }, {
         capabilities: { tools: {} },
         instructions: SERVER_INSTRUCTIONS,

package/dist/tools/functors.js

@@ -135,6 +135,15 @@ export function findDeadCode(args, loader) {
     if (!include_tests) {
         deadEntities = deadEntities.filter((e) => entityLayer(e) !== 'test');
     }
+    // Separate schemas — they're often registered dynamically (e.g., fastify.addSchema())
+    // and appear "dead" from a static call graph but are alive at runtime.
+    const SCHEMA_TYPES = new Set(['schema', 'typealias', 'interface', 'type']);
+    const schemaEntities = deadEntities.filter((e) => {
+        const type = (typeof e.struct === 'string' ? e.struct : e.struct?.type || '').toLowerCase();
+        const layer = entityLayer(e);
+        return SCHEMA_TYPES.has(type) || layer === 'schema';
+    });
+    deadEntities = deadEntities.filter((e) => !schemaEntities.includes(e));
     // Group by layer for overview
     const byLayer = new Map();
     for (const e of deadEntities) {
@@ -148,6 +157,10 @@ export function findDeadCode(args, loader) {
         deadCount: deadEntities.length,
         deadByLayer: Object.fromEntries([...byLayer.entries()].sort((a, b) => b[1] - a[1])),
         dead: deadEntities.slice(0, 100).map(entitySummary),
+        ...(schemaEntities.length > 0 ? {
+            schemas_excluded: schemaEntities.length,
+            _note_schemas: `${schemaEntities.length} schema/type definitions excluded — no static references found, but schemas are often registered dynamically (e.g., fastify.addSchema()) and may be alive at runtime.`,
+        } : {}),
     };
 }
 // ─── Tool: find_layer_violations ─────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papyruslabsai/seshat-mcp",
-  "version": "0.13.2",
+  "version": "0.13.4",
   "description": "Semantic MCP server — exposes a codebase's structure, dependencies, and constraints as queryable tools",
   "type": "module",
   "bin": {