@qulib/mcp 0.4.0 → 0.4.2

package/README.md

@@ -31,6 +31,7 @@ Tools:
 - **`explore_auth(url, timeoutMs?)`** — list all sign-in paths (OAuth, unknown SSO heuristics, forms, magic link) and what the agent must collect before `analyze_app`. Prefer this on unfamiliar apps.
 - **`analyze_app`** — quality scan (optional form-login or storage-state auth). **Default payload is summary-first:** `summary`, `topGaps`, `costIntelligenceSummary`, `nextDeterministicChecks`, small previews. Set **`includeFullReport: true`** for the full `analyzeApp` result (all scenarios). Optional harness overrides: **`llmMaxOutputTokensPerCall`**, **`llmTokenBudget`** (legacy), **`testGenerationLimit`**, **`enableLlmScenarios`** (default true when omitted).
 - **`detect_auth(url, timeoutMs?)`** — single-pattern auth guess with a short recommendation (lighter than `explore_auth`).
+- **`qulib_score_automation(repoPath, includeFullDimensions?)`** — score a local automation repo across six dimensions (test coverage breadth, framework adoption, test-id hygiene, CI integration, auth test coverage, component test ratio). Returns an overall 0–100 score, maturity level (L1–L5), and top recommendations. Each dimension carries an **`applicability`** field (`applicable` / `not_applicable` / `unknown`); the overall score normalizes across applicable dimensions only so absent capabilities never get silent partial credit. **`repoPath`** must be an absolute path on the MCP host. Pass **`includeFullDimensions: true`** for per-dimension evidence and reasons.
 
 Returns from `analyze_app`:
 
@@ -87,9 +88,11 @@ When the model sees **`unrecognizedButtons`**, it can ask the user to register a
 
 | | Default (`includeFullReport` omitted or false) | `includeFullReport: true` |
 |--|--|--|
-| Size | Small: top gaps, cost summary, next checks | Full `gapAnalysis` with every scenario |
+| Size | Small: top gaps, cost summary, next checks, `repoInventorySummary` (counts only) | Full `gapAnalysis` (all scenarios) and full `repoInventory` (test files, missing test IDs) |
 | When to use | Routine agent turns, chat context limits | Deep dives, exporting full scenario JSON |
 
+> **0.4.2 note:** The compact response now ships `repoInventorySummary` (route/test/missing-id counts plus framework verdict) instead of the full `repoInventory`. Agents that need the raw `testFiles` or `missingTestIds` arrays should pass `includeFullReport: true`.
+
 Example (full):
 
 ```json

package/dist/compact-analyze-payload.d.ts

@@ -3,66 +3,59 @@ export declare function buildCompactAnalyzePayload(result: AnalyzeResult, includ
     includeFullReport: boolean;
     note: string;
     detectedAuth?: {
-        type: "unknown" | "form-login" | "none" | "oauth" | "magic-link";
+        type: "unknown" | "form-login" | "oauth" | "magic-link" | "none";
         loginUrl: string | null;
-        hasAuth: boolean;
         provider: string | null;
+        hasAuth: boolean;
         observedSelectors: {
             usernameSelector: string | null;
             passwordSelector: string | null;
             submitSelector: string | null;
         } | null;
         oauthButtons: {
-            provider: string;
             text: string;
+            provider: string;
         }[];
         recommendation: string;
+        authOptions?: {
+            type: "unknown" | "form-login" | "oauth" | "oauth-unknown" | "form-multi" | "magic-link";
+            label: string;
+            id: string;
+            provider: string | null;
+            source: "built-in" | "user-local" | "heuristic";
+            automatable: boolean;
+            confidence: "high" | "medium" | "low";
+            requirements: {
+                method: "storage-state";
+                instruction: string;
+            } | {
+                method: "credentials";
+                fields: {
+                    type: "password" | "text" | "email" | "select" | "checkbox";
+                    name: string;
+                    label: string;
+                    observedOptions: string[];
+                }[];
+            } | {
+                method: "unknown";
+                instruction: string;
+            };
+        }[] | undefined;
     } | undefined;
-    repoInventory: {
-        scannedAt: string;
-        routes: {
-            path: string;
-            method: "unknown" | "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
-            file: string;
-        }[];
-        repoPath: string;
-        testFiles: {
-            type: "playwright" | "cypress-e2e" | "cypress-component" | "jest" | "vitest" | "other";
-            file: string;
-            coveredPaths: string[];
-        }[];
-        missingTestIds: string[];
-        cypressStructure: {
-            detected: boolean;
-            hasCommandsFile: boolean;
-            existingE2eFiles: string[];
-            existingComponentFiles: string[];
-            e2eFolder?: string | undefined;
-            componentFolder?: string | undefined;
-            fixturesFolder?: string | undefined;
-            supportFolder?: string | undefined;
-        };
+    repoInventorySummary: {
         framework?: {
-            confidence: "high" | "medium" | "low";
-            evidence: string[];
             primary: "unknown" | "nextjs-app-router" | "nextjs-pages-router" | "express" | "remix" | "nuxt" | "sveltekit" | "astro" | "vite";
+            confidence: "high" | "medium" | "low";
             testFrameworks: ("playwright" | "cypress-e2e" | "cypress-component" | "jest" | "vitest" | "other")[];
+            evidenceCount: number;
         } | undefined;
-        automationMaturity?: {
-            label: string;
-            level: number;
-            computedAt: string;
-            repoPath: string;
-            overallScore: number;
-            dimensions: {
-                recommendations: string[];
-                dimension: "test-coverage-breadth" | "framework-adoption" | "test-id-hygiene" | "ci-integration" | "auth-test-coverage" | "component-test-ratio";
-                score: number;
-                weight: number;
-                evidence: string[];
-            }[];
-            topRecommendations: string[];
-        } | undefined;
+        repoPath: string;
+        scannedAt: string;
+        routeCount: number;
+        testFileCount: number;
+        missingTestIdCount: number;
+        interactiveTsxFilesScanned: number | null;
+        cypressDetected: boolean;
     } | null;
     decisionLogPreview: {
         timestamp: string;

package/dist/compact-analyze-payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compact-analyze-payload.d.ts","sourceRoot":"","sources":["../src/compact-analyze-payload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqBjD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAkFs3L,CAAC;2BAA6C,CAAC;0BAA4C,CAAC;yBAA2C,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAAkqT,CAAC;sBAA4C,CAAC;sBAA4C,CAAC;iBAAuC,CAAC;;;;;;;;;;;;;;;;;uBAAghB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;EAD/4gB"}
+{"version":3,"file":"compact-analyze-payload.d.ts","sourceRoot":"","sources":["../src/compact-analyze-payload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqBjD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAuG+9d,CAAC;sBAA4C,CAAC;sBAA4C,CAAC;iBAAuC,CAAC;;;;;;;;;;;;;;;;;uBAAghB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;EAD9sf"}

package/dist/compact-analyze-payload.js

@@ -33,6 +33,26 @@ export function buildCompactAnalyzePayload(result, includeFullReport) {
         }
         : null;
     const ps = result.publicSurface;
+    const repo = result.repoInventory;
+    const repoInventorySummary = repo
+        ? {
+            repoPath: repo.repoPath,
+            scannedAt: repo.scannedAt,
+            routeCount: repo.routes.length,
+            testFileCount: repo.testFiles.length,
+            missingTestIdCount: repo.missingTestIds.length,
+            interactiveTsxFilesScanned: repo.interactiveTsxFilesScanned ?? null,
+            cypressDetected: repo.cypressStructure.detected,
+            ...(repo.framework && {
+                framework: {
+                    primary: repo.framework.primary,
+                    confidence: repo.framework.confidence,
+                    testFrameworks: repo.framework.testFrameworks,
+                    evidenceCount: repo.framework.evidence.length,
+                },
+            }),
+        }
+        : null;
     return {
         summary: {
             status: result.status,
@@ -78,18 +98,18 @@ export function buildCompactAnalyzePayload(result, includeFullReport) {
             pagesSkipped: result.routeInventory.pagesSkipped,
             budgetExceeded: result.routeInventory.budgetExceeded,
         },
-        ...(result.repoInventory?.automationMaturity && {
+        ...(repo?.automationMaturity && {
             automationMaturitySummary: {
-                overallScore: result.repoInventory.automationMaturity.overallScore,
-                level: result.repoInventory.automationMaturity.level,
-                label: result.repoInventory.automationMaturity.label,
-                topRecommendations: result.repoInventory.automationMaturity.topRecommendations,
+                overallScore: repo.automationMaturity.overallScore,
+                level: repo.automationMaturity.level,
+                label: repo.automationMaturity.label,
+                topRecommendations: repo.automationMaturity.topRecommendations,
             },
         }),
-        repoInventory: result.repoInventory,
+        repoInventorySummary,
         decisionLogPreview: result.decisionLog.slice(-8),
         ...(result.detectedAuth !== undefined && { detectedAuth: result.detectedAuth }),
         includeFullReport: false,
-        note: 'Summary-first payload. Pass includeFullReport: true for full gapAnalysis (all scenarios and generatedTests).',
+        note: 'Summary-first payload. Pass includeFullReport: true for the full gapAnalysis (all scenarios, generated tests) and the full repoInventory (test files, missing test IDs).',
     };
 }

package/dist/index.js

@@ -8,9 +8,12 @@
 // TODO(@qulib/mcp): Evaluate tool-level permission modeling when MCP spec stabilizes.
 // Today: all tools are equally trusted. Future: read-only tools (detect_auth, explore_auth)
 // vs. write-capable tools (analyze_app with writeArtifacts) should carry different trust levels.
+import { createRequire } from 'node:module';
 import { isAbsolute, normalize, resolve } from 'node:path';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+const requirePkg = createRequire(import.meta.url);
+const pkg = requirePkg('../package.json');
 import { analyzeApp, detectAuth, exploreAuth, scanRepo, computeAutomationMaturity, } from '@qulib/core';
 import { z } from 'zod';
 import { buildCompactAnalyzePayload } from './compact-analyze-payload.js';
@@ -39,6 +42,12 @@ const mcpProgressLog = {
     error: (message) => log.error(message),
     debug: (message) => log.debug(message),
 };
+// NOTE: MCP `auth` shape intentionally flattens the core `AuthConfigSchema` so an LLM
+// can populate it without nested objects. We translate it back into core's nested
+// `AuthConfig` (with `credentials: { username, password }` and `selectors: { ... }`)
+// before passing it to `analyzeApp` below. If core's `AuthConfigSchema` changes, mirror
+// the change here. Drift is allowed because the surfaces serve different consumers
+// (LLM tool input vs internal harness contract), but the translation must stay 1:1.
 const FormLoginMcpAuthSchema = z.object({
     type: z.literal('form-login'),
     loginUrl: z.string().url(),
@@ -83,7 +92,7 @@ function validateAbsoluteRepoPath(repoPath) {
 }
 const mcpServer = new McpServer({
     name: 'qulib-mcp',
-    version: '0.4.0',
+    version: pkg.version,
     description: 'Qulib QA intelligence platform — gap analysis, auth exploration, and quality scoring for deployed web applications',
 }, {
     capabilities: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qulib/mcp",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "MCP server for Qulib — AI-callable QA gap analysis",
   "license": "MIT",
   "author": "Tapesh Nagarwal",
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@qulib/core": "0.4.0",
+    "@qulib/core": "0.4.2",
     "zod": "^3.23.0"
   },
   "devDependencies": {