@primitivehub/mcp-server 0.1.0

package/dist/tools/audit-workspace.d.ts

@@ -0,0 +1,64 @@
+/**
+ * MCP tool: `audit_workspace`
+ *
+ * Active-surface audit: discovers + classifies + scans every agent-
+ * context artifact under a root path. Pure transport over
+ * `@primitivehub/phub`'s `runAudit` (ADR-0025).
+ *
+ * The agent uses this to ask "what context primitives are loadable in
+ * my workspace, and which trip Context CI v0.1?" — the answer it can
+ * never get from a file-at-a-time scan because the threat model is
+ * the file the agent didn't know about.
+ */
+export declare const AUDIT_WORKSPACE_TOOL: {
+    readonly name: "audit_workspace";
+    readonly description: "Recursively discover, classify, and scan every agent-context artifact (AGENTS.md, CLAUDE.md, .cursorrules, .claude/skills/**, mcp.json, …) under a root path. Reuses the same T1/T2/T5 detector roster as scan_text. Returns inventory + per-artifact verdicts + project-level summary. Use this as the active default — file-at-a-time scanning can't defend against files the agent didn't know about.";
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly properties: {
+            readonly root: {
+                readonly type: "string";
+                readonly description: "Directory to audit. Defaults to the server's cwd.";
+            };
+            readonly max_files: {
+                readonly type: "number";
+                readonly description: "Hard cap on artifacts traversed. Default 10000.";
+            };
+            readonly max_depth: {
+                readonly type: "number";
+                readonly description: "Maximum directory depth from root. Default 16.";
+            };
+            readonly strict: {
+                readonly type: "boolean";
+                readonly description: "Treat WARN verdicts as FAIL.";
+            };
+            readonly detectors: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+                readonly description: "Restrict to specific detectors. Accepts names / CCI IDs / threat categories.";
+            };
+            readonly policy_path: {
+                readonly type: "string";
+                readonly description: "Path to a .primitivehub/policy.yaml. Without this: auto-discover from cwd → git root.";
+            };
+            readonly allow_fail: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+            };
+        };
+    };
+};
+export interface AuditWorkspaceResultText {
+    type: "text";
+    text: string;
+}
+export declare function callAuditWorkspace(rawArgs: unknown): {
+    content: AuditWorkspaceResultText[];
+    isError: boolean;
+};
+//# sourceMappingURL=audit-workspace.d.ts.map

package/dist/tools/audit-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-workspace.d.ts","sourceRoot":"","sources":["../../src/tools/audit-workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCvB,CAAA;AAYV,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAoCD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,OAAO,GACf;IAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CA6B3D"}

package/dist/tools/audit-workspace.js

@@ -0,0 +1,113 @@
+/**
+ * MCP tool: `audit_workspace`
+ *
+ * Active-surface audit: discovers + classifies + scans every agent-
+ * context artifact under a root path. Pure transport over
+ * `@primitivehub/phub`'s `runAudit` (ADR-0025).
+ *
+ * The agent uses this to ask "what context primitives are loadable in
+ * my workspace, and which trip Context CI v0.1?" — the answer it can
+ * never get from a file-at-a-time scan because the threat model is
+ * the file the agent didn't know about.
+ */
+import { runAudit, } from "@primitivehub/phub";
+export const AUDIT_WORKSPACE_TOOL = {
+    name: "audit_workspace",
+    description: "Recursively discover, classify, and scan every agent-context artifact (AGENTS.md, CLAUDE.md, .cursorrules, .claude/skills/**, mcp.json, …) under a root path. Reuses the same T1/T2/T5 detector roster as scan_text. Returns inventory + per-artifact verdicts + project-level summary. Use this as the active default — file-at-a-time scanning can't defend against files the agent didn't know about.",
+    inputSchema: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+            root: {
+                type: "string",
+                description: "Directory to audit. Defaults to the server's cwd.",
+            },
+            max_files: {
+                type: "number",
+                description: "Hard cap on artifacts traversed. Default 10000.",
+            },
+            max_depth: {
+                type: "number",
+                description: "Maximum directory depth from root. Default 16.",
+            },
+            strict: { type: "boolean", description: "Treat WARN verdicts as FAIL." },
+            detectors: {
+                type: "array",
+                items: { type: "string" },
+                description: "Restrict to specific detectors. Accepts names / CCI IDs / threat categories.",
+            },
+            policy_path: {
+                type: "string",
+                description: "Path to a .primitivehub/policy.yaml. Without this: auto-discover from cwd → git root.",
+            },
+            allow_fail: {
+                type: "array",
+                items: { type: "string" },
+            },
+        },
+    },
+};
+function summarize(result) {
+    return {
+        root: result.root,
+        policySource: result.policySource,
+        truncated: result.truncated,
+        scanClean: result.scanClean,
+        exitCode: result.exitCode,
+        summary: result.summary,
+        artifacts: result.artifacts.map((a) => ({
+            path: a.path,
+            classification: a.classification,
+            digest: a.digest,
+            scanned: a.scanned,
+            flagged: a.flagged,
+            // Surface the post-policy verdicts only — these are what an
+            // agent acts on. Raw pre-policy verdicts are available via
+            // scan_text against the artifact path if needed.
+            verdicts: a.adjustedVerdicts.map((adj) => ({
+                cciId: adj.verdict.cciId,
+                severity: adj.verdict.severity,
+                passed: adj.verdict.passed,
+                summary: adj.verdict.summary,
+                diffHints: adj.verdict.diffHints,
+                allowedHints: adj.allowedHints.map((ah) => ({
+                    line: ah.hint.line,
+                    snippet: ah.hint.snippet,
+                    detailTag: ah.hint.detailTag,
+                    reason: ah.allowEntry.reason,
+                })),
+            })),
+        })),
+    };
+}
+export function callAuditWorkspace(rawArgs) {
+    const args = (rawArgs ?? {});
+    const auditOpts = {
+        json: true,
+        sarif: false,
+        strict: args.strict ?? false,
+        detectors: args.detectors ?? [],
+        maxFiles: args.max_files ?? 10000,
+        maxDepth: args.max_depth ?? 16,
+    };
+    if (args.policy_path !== undefined)
+        auditOpts.policyPath = args.policy_path;
+    if (args.allow_fail !== undefined)
+        auditOpts.allowFailFor = args.allow_fail;
+    let result;
+    try {
+        result = runAudit(args.root ?? process.cwd(), auditOpts);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: msg }, null, 2) }],
+            isError: true,
+        };
+    }
+    return {
+        content: [{ type: "text", text: JSON.stringify(summarize(result), null, 2) }],
+        isError: result.exitCode !== 0,
+    };
+}
+//# sourceMappingURL=audit-workspace.js.map

package/dist/tools/audit-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-workspace.js","sourceRoot":"","sources":["../../src/tools/audit-workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,QAAQ,GAIT,MAAM,oBAAoB,CAAA;AAE3B,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,IAAI,EAAE,iBAAiB;IACvB,WAAW,EACT,0YAA0Y;IAC5Y,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,UAAU,EAAE;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,mDAAmD;aACjE;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,iDAAiD;aAC/D;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,gDAAgD;aAC9D;YACD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,8BAA8B,EAAE;YACxE,SAAS,EAAE;gBACT,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,8EAA8E;aACjF;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,uFAAuF;aAC1F;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC1B;SACF;KACF;CACO,CAAA;AAiBV,SAAS,SAAS,CAAC,MAAmB;IACpC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,4DAA4D;YAC5D,2DAA2D;YAC3D,iDAAiD;YACjD,QAAQ,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACzC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK;gBACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;gBAC9B,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;gBAC5B,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;gBAChC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC1C,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI;oBAClB,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO;oBACxB,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS;oBAC5B,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM;iBAC7B,CAAC,CAAC;aACJ,CAAC,CAAC;SACJ,CAAC,CAAC;KACJ,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAuB,CAAA;IAElD,MAAM,SAAS,GAAiB;QAC9B,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;QAC/B,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK;QACjC,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;KAC/B,CAAA;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,CAAA;IAC3E,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAA;IAE3E,IAAI,MAAmB,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;KAC/B,CAAA;AACH,CAAC"}

package/dist/tools/check-lock.d.ts

@@ -0,0 +1,51 @@
+/**
+ * MCP tool: `check_lock`
+ *
+ * Compares the working tree against `.primitivehub/phub.lock`
+ * (ADR-0026) and reports drift. Pure transport over phub's audit
+ * surface with lockMode = "check".
+ *
+ * Foreshadows ADR-0029 (MCP runtime gate `verify_before_load`):
+ * the runtime gate is "check_lock + refuse-to-load on drift" applied
+ * at the agent's read time. This tool gives the agent the data;
+ * the gate is built when ADR-0029 lands.
+ */
+export declare const CHECK_LOCK_TOOL: {
+    readonly name: "check_lock";
+    readonly description: "Compare the workspace against .primitivehub/phub.lock and report drift (added / modified / removed / reclassified artifacts). Use this BEFORE consuming any agent-context primitive — drift means an artifact changed since the operator last sealed it. Returns drift summary; the agent decides whether to proceed.";
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly properties: {
+            readonly root: {
+                readonly type: "string";
+                readonly description: "Workspace root to check. Defaults to server cwd.";
+            };
+            readonly lock_path: {
+                readonly type: "string";
+                readonly description: "Override the auto-discovered lock path. Without this: ./.primitivehub/phub.lock.";
+            };
+            readonly policy_path: {
+                readonly type: "string";
+                readonly description: "Policy file path (same semantics as scan_text/audit_workspace).";
+            };
+            readonly max_files: {
+                readonly type: "number";
+                readonly description: "Hard cap on artifacts walked. Default 10000.";
+            };
+            readonly max_depth: {
+                readonly type: "number";
+                readonly description: "Max directory depth. Default 16.";
+            };
+        };
+    };
+};
+export interface CheckLockResultText {
+    type: "text";
+    text: string;
+}
+export declare function callCheckLock(rawArgs: unknown): {
+    content: CheckLockResultText[];
+    isError: boolean;
+};
+//# sourceMappingURL=check-lock.d.ts.map

package/dist/tools/check-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-lock.d.ts","sourceRoot":"","sources":["../../src/tools/check-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyBlB,CAAA;AAUV,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,GACf;IAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CA4CtD"}

package/dist/tools/check-lock.js

@@ -0,0 +1,82 @@
+/**
+ * MCP tool: `check_lock`
+ *
+ * Compares the working tree against `.primitivehub/phub.lock`
+ * (ADR-0026) and reports drift. Pure transport over phub's audit
+ * surface with lockMode = "check".
+ *
+ * Foreshadows ADR-0029 (MCP runtime gate `verify_before_load`):
+ * the runtime gate is "check_lock + refuse-to-load on drift" applied
+ * at the agent's read time. This tool gives the agent the data;
+ * the gate is built when ADR-0029 lands.
+ */
+import { runAudit, } from "@primitivehub/phub";
+export const CHECK_LOCK_TOOL = {
+    name: "check_lock",
+    description: "Compare the workspace against .primitivehub/phub.lock and report drift (added / modified / removed / reclassified artifacts). Use this BEFORE consuming any agent-context primitive — drift means an artifact changed since the operator last sealed it. Returns drift summary; the agent decides whether to proceed.",
+    inputSchema: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+            root: {
+                type: "string",
+                description: "Workspace root to check. Defaults to server cwd.",
+            },
+            lock_path: {
+                type: "string",
+                description: "Override the auto-discovered lock path. Without this: ./.primitivehub/phub.lock.",
+            },
+            policy_path: {
+                type: "string",
+                description: "Policy file path (same semantics as scan_text/audit_workspace).",
+            },
+            max_files: { type: "number", description: "Hard cap on artifacts walked. Default 10000." },
+            max_depth: { type: "number", description: "Max directory depth. Default 16." },
+        },
+    },
+};
+export function callCheckLock(rawArgs) {
+    const args = (rawArgs ?? {});
+    const auditOpts = {
+        json: true,
+        sarif: false,
+        strict: false,
+        detectors: [],
+        maxFiles: args.max_files ?? 10000,
+        maxDepth: args.max_depth ?? 16,
+        lockMode: "check",
+    };
+    if (args.lock_path !== undefined)
+        auditOpts.lockPath = args.lock_path;
+    if (args.policy_path !== undefined)
+        auditOpts.policyPath = args.policy_path;
+    let result;
+    try {
+        result = runAudit(args.root ?? process.cwd(), auditOpts);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: "text", text: JSON.stringify({ error: msg }, null, 2) }],
+            isError: true,
+        };
+    }
+    const lockState = result.lockState;
+    const payload = {
+        root: result.root,
+        lockMode: lockState?.mode ?? "off",
+        lockPath: lockState?.lockPath ?? null,
+        missing: lockState?.missing ?? false,
+        specVersionMismatch: lockState?.specVersionMismatch ?? false,
+        hasDrift: lockState?.hasDrift ?? false,
+        drift: lockState?.drift ?? null,
+        artifactCount: result.artifacts.length,
+        scanClean: result.scanClean,
+        exitCode: result.exitCode,
+    };
+    return {
+        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
+        isError: result.exitCode !== 0,
+    };
+}
+//# sourceMappingURL=check-lock.js.map

package/dist/tools/check-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-lock.js","sourceRoot":"","sources":["../../src/tools/check-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,QAAQ,GAGT,MAAM,oBAAoB,CAAA;AAE3B,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,YAAY;IAClB,WAAW,EACT,uTAAuT;IACzT,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,UAAU,EAAE;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,kDAAkD;aAChE;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,kFAAkF;aACrF;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,iEAAiE;aAC/E;YACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8CAA8C,EAAE;YAC1F,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;SAC/E;KACF;CACO,CAAA;AAeV,MAAM,UAAU,aAAa,CAC3B,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAkB,CAAA;IAE7C,MAAM,SAAS,GAAiB;QAC9B,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK;QACjC,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;QAC9B,QAAQ,EAAE,OAAO;KAClB,CAAA;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAA;IACrE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,CAAA;IAE3E,IAAI,MAAmB,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;IAClC,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,KAAK;QAClC,QAAQ,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI;QACrC,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,KAAK;QACpC,mBAAmB,EAAE,SAAS,EAAE,mBAAmB,IAAI,KAAK;QAC5D,QAAQ,EAAE,SAAS,EAAE,QAAQ,IAAI,KAAK;QACtC,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,IAAI;QAC/B,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QACtC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAA;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;KAC/B,CAAA;AACH,CAAC"}

package/dist/tools/scan-text.d.ts

@@ -0,0 +1,61 @@
+/**
+ * MCP tool: `scan_text`
+ *
+ * Runs the Context CI Top 10 v0.1 detector roster (T1/T2/T5) against
+ * arbitrary text. Pure transport over `@primitivehub/phub`'s `runScan`.
+ *
+ * The agent passes the text it's about to consume (e.g. a freshly
+ * downloaded AGENTS.md, an MCP server's response, a copied skill);
+ * the tool returns the post-policy verdicts. The agent decides what
+ * to do with the result.
+ */
+export declare const SCAN_TEXT_TOOL: {
+    readonly name: "scan_text";
+    readonly description: "Run the PrimitiveHub Context CI Top 10 v0.1 detectors (T1 prompt-injection, T2 Unicode-steganography, T5 unsafe-shell-install) against a string. Pure-local scan; no network. Returns per-detector verdicts, post-policy. Use this BEFORE loading any agent-context content from an untrusted source.";
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["content"];
+        readonly properties: {
+            readonly content: {
+                readonly type: "string";
+                readonly description: "The text to scan (typically markdown — AGENTS.md, CLAUDE.md, .cursorrules, a skill body, etc.).";
+            };
+            readonly filename: {
+                readonly type: "string";
+                readonly description: "Optional filename for the content (used for policy matching against per-file allow rules). Defaults to '<inline>'.";
+            };
+            readonly detectors: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+                readonly description: "Restrict to specific detectors. Accepts detector names (t1.prompt_injection), CCI IDs (CCI-001), or threat categories (T1). Empty/omitted = all.";
+            };
+            readonly strict: {
+                readonly type: "boolean";
+                readonly description: "Treat WARN verdicts as FAIL for the policy exit code.";
+            };
+            readonly policy_path: {
+                readonly type: "string";
+                readonly description: "Path to a .primitivehub/policy.yaml file (ADR-0018). Without this: auto-discover from cwd → git root, fall back to implicit default.";
+            };
+            readonly allow_fail: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+                readonly description: "Detector/CCI/threat IDs permitted to FAIL without rejecting the scan. Appended to policy.allow as synthetic entries.";
+            };
+        };
+    };
+};
+export interface ScanTextResultText {
+    type: "text";
+    text: string;
+}
+export declare function callScanText(rawArgs: unknown): {
+    content: ScanTextResultText[];
+    isError: boolean;
+};
+//# sourceMappingURL=scan-text.d.ts.map

package/dist/tools/scan-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-text.d.ts","sourceRoot":"","sources":["../../src/tools/scan-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCjB,CAAA;AAWV,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,OAAO,GACf;IAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CA6CrD"}

package/dist/tools/scan-text.js

@@ -0,0 +1,94 @@
+/**
+ * MCP tool: `scan_text`
+ *
+ * Runs the Context CI Top 10 v0.1 detector roster (T1/T2/T5) against
+ * arbitrary text. Pure transport over `@primitivehub/phub`'s `runScan`.
+ *
+ * The agent passes the text it's about to consume (e.g. a freshly
+ * downloaded AGENTS.md, an MCP server's response, a copied skill);
+ * the tool returns the post-policy verdicts. The agent decides what
+ * to do with the result.
+ */
+import { runScan } from "@primitivehub/phub";
+export const SCAN_TEXT_TOOL = {
+    name: "scan_text",
+    description: "Run the PrimitiveHub Context CI Top 10 v0.1 detectors (T1 prompt-injection, T2 Unicode-steganography, T5 unsafe-shell-install) against a string. Pure-local scan; no network. Returns per-detector verdicts, post-policy. Use this BEFORE loading any agent-context content from an untrusted source.",
+    inputSchema: {
+        type: "object",
+        additionalProperties: false,
+        required: ["content"],
+        properties: {
+            content: {
+                type: "string",
+                description: "The text to scan (typically markdown — AGENTS.md, CLAUDE.md, .cursorrules, a skill body, etc.).",
+            },
+            filename: {
+                type: "string",
+                description: "Optional filename for the content (used for policy matching against per-file allow rules). Defaults to '<inline>'.",
+            },
+            detectors: {
+                type: "array",
+                items: { type: "string" },
+                description: "Restrict to specific detectors. Accepts detector names (t1.prompt_injection), CCI IDs (CCI-001), or threat categories (T1). Empty/omitted = all.",
+            },
+            strict: {
+                type: "boolean",
+                description: "Treat WARN verdicts as FAIL for the policy exit code.",
+            },
+            policy_path: {
+                type: "string",
+                description: "Path to a .primitivehub/policy.yaml file (ADR-0018). Without this: auto-discover from cwd → git root, fall back to implicit default.",
+            },
+            allow_fail: {
+                type: "array",
+                items: { type: "string" },
+                description: "Detector/CCI/threat IDs permitted to FAIL without rejecting the scan. Appended to policy.allow as synthetic entries.",
+            },
+        },
+    },
+};
+export function callScanText(rawArgs) {
+    const args = (rawArgs ?? {});
+    if (typeof args.content !== "string") {
+        return errorResponse("content argument is required (string)");
+    }
+    const filename = args.filename ?? "<inline>";
+    const scanOpts = {
+        json: true,
+        sarif: false,
+        strict: args.strict ?? false,
+        detectors: args.detectors ?? [],
+        allowFail: args.allow_fail ?? [],
+    };
+    if (args.policy_path !== undefined) {
+        scanOpts.policyPath = args.policy_path;
+    }
+    const result = runScan(filename, args.content, scanOpts);
+    const summary = result.evaluation.summary;
+    const allowed = result.evaluation.adjusted.flatMap((a) => a.allowedHints.map((ah) => ({
+        cciId: a.verdict.cciId,
+        line: ah.hint.line,
+        snippet: ah.hint.snippet,
+        detailTag: ah.hint.detailTag,
+        reason: ah.allowEntry.reason,
+    })));
+    const payload = {
+        filename: result.filename,
+        policySource: result.policySource,
+        verdicts: result.verdicts,
+        policyAllowed: allowed,
+        summary,
+        exitCode: result.exitCode,
+    };
+    return {
+        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
+        isError: result.exitCode !== 0,
+    };
+}
+function errorResponse(message) {
+    return {
+        content: [{ type: "text", text: JSON.stringify({ error: message }, null, 2) }],
+        isError: true,
+    };
+}
+//# sourceMappingURL=scan-text.js.map

package/dist/tools/scan-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-text.js","sourceRoot":"","sources":["../../src/tools/scan-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAoB,MAAM,oBAAoB,CAAA;AAE9D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,IAAI,EAAE,WAAW;IACjB,WAAW,EACT,uSAAuS;IACzS,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,SAAS,CAAC;QACrB,UAAU,EAAE;YACV,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,iGAAiG;aAC/G;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,oHAAoH;aACvH;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,kJAAkJ;aACrJ;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,uDAAuD;aACrE;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sIAAsI;aACzI;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,sHAAsH;aACzH;SACF;KACF;CACO,CAAA;AAgBV,MAAM,UAAU,YAAY,CAC1B,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAiB,CAAA;IAE5C,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,aAAa,CAAC,uCAAuC,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAA;IAC5C,MAAM,QAAQ,GAAgB;QAC5B,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;QAC/B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;KACjC,CAAA;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,CAAA;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAExD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAA;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;QACtB,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI;QAClB,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO;QACxB,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS;QAC5B,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM;KAC7B,CAAC,CAAC,CACJ,CAAA;IAED,MAAM,OAAO,GAAG;QACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAA;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;KAC/B,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI;KACd,CAAA;AACH,CAAC"}

package/dist/tools/verify-before-load.d.ts

@@ -0,0 +1,74 @@
+/**
+ * MCP tool: `verify_before_load`
+ *
+ * The composite runtime gate. Per ADR-0029, every agent runtime that
+ * loads agent-context primitives MUST consult this tool before reading
+ * the content. Refuses-by-default for:
+ *   - missing lock (operator hasn't sealed anything)
+ *   - lock spec-version mismatch (Top 10 ratcheted; re-seal required)
+ *   - drift (working tree differs from lock)
+ *   - unattested artifacts (with requireAttestation set)
+ *   - scanner findings (T1/T2/T5 at v0.1)
+ *   - invalid Trust Bundle (when one is provided)
+ *
+ * Pure transport per ADR-0031 § 2 rule #1. Combines two existing
+ * primitives:
+ *   - `verifyBeforeLoad` from @primitivehub/phub  (workspace + lock + scan)
+ *   - `verifyBundle` from @primitivehub/verify    (cryptographic bundle)
+ *
+ * If a future ADR changes any check semantics, it changes in phub /
+ * verify; this file inherits the new behavior with zero edits.
+ */
+export declare const VERIFY_BEFORE_LOAD_TOOL: {
+    readonly name: "verify_before_load";
+    readonly description: "Composite runtime gate. Call this BEFORE loading any agent-context primitive — refuses-by-default for drift, unattested artifacts, scanner findings, or invalid Trust Bundles. Returns {safe, reasons[], checks}. The composite of check_lock + scan_text + (optional) verify_bundle.";
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["path"];
+        readonly properties: {
+            readonly path: {
+                readonly type: "string";
+                readonly description: "The artifact path to gate (relative to workspace_root, or absolute). The agent's 'I'm about to read this file' anchor.";
+            };
+            readonly workspace_root: {
+                readonly type: "string";
+                readonly description: "Workspace root. Defaults to the server's cwd.";
+            };
+            readonly policy_path: {
+                readonly type: "string";
+                readonly description: "Path to .primitivehub/policy.yaml. Auto-discover if absent.";
+            };
+            readonly lock_path: {
+                readonly type: "string";
+                readonly description: "Explicit lock path. Auto-discover if absent.";
+            };
+            readonly require_attestation: {
+                readonly type: "boolean";
+                readonly description: "If true, an 'unattested' lock entry counts as unsafe. Use when consuming registry primitives that should carry rekor:* or registry:* attestations. Default false (matches v0.1 lock semantics).";
+            };
+            readonly bundle: {
+                readonly description: "Optional Trust Bundle (JSON string OR parsed object). When provided, verify_bundle runs at the requested level and contributes its failures to the unsafe reasons.";
+                readonly oneOf: readonly [{
+                    readonly type: "string";
+                }, {
+                    readonly type: "object";
+                }];
+            };
+            readonly level: {
+                readonly type: "string";
+                readonly enum: readonly ["structural", "policy", "full"];
+                readonly description: "Bundle verification depth. Only meaningful when 'bundle' is provided. Default 'policy'.";
+            };
+        };
+    };
+};
+export interface VerifyBeforeLoadResultText {
+    type: "text";
+    text: string;
+}
+export declare function callVerifyBeforeLoad(rawArgs: unknown): Promise<{
+    content: VerifyBeforeLoadResultText[];
+    isError: boolean;
+}>;
+//# sourceMappingURL=verify-before-load.d.ts.map

package/dist/tools/verify-before-load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-before-load.d.ts","sourceRoot":"","sources":["../../src/tools/verify-before-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4C1B,CAAA;AAYV,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA0FtE"}