@scopewatch/capability-inference 0.0.1

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { inferCapabilities } from './infer.js';
+export type { McpTool, InferredCapability, InferenceResult } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export { inferCapabilities } from './infer.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC"}

package/dist/infer.d.ts

@@ -0,0 +1,3 @@
+import type { McpTool, InferenceResult } from './types.js';
+export declare function inferCapabilities(server_id: string, tools: McpTool[]): InferenceResult;
+//# sourceMappingURL=infer.d.ts.map

package/dist/infer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infer.d.ts","sourceRoot":"","sources":["../src/infer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAsB,eAAe,EAAE,MAAM,YAAY,CAAC;AAsO/E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,eAAe,CAmBtF"}

package/dist/infer.js

@@ -0,0 +1,231 @@
+/**
+ * Real (not real-time-negotiated) capability inference for MCP tools that
+ * lack a declared manifest. Every result is tagged provenance: 'inferred' -
+ * this is a best-effort heuristic, not ground truth, and callers must render
+ * it with the hedged "appears to..." language Phase B already built for
+ * exactly this case.
+ *
+ * Design validated against 14 real tools from the actual, live
+ * @modelcontextprotocol/server-filesystem (see test/fixtures/real-filesystem-server-tools.json,
+ * captured directly from a real tools/list response, not invented).
+ *
+ * TWO STRUCTURAL DEFENSES against the noun/verb ambiguity inherent to
+ * scanning natural-language tool descriptions (a word like "modified" or
+ * "messages" can be a verb or a noun/adjective depending on context a
+ * keyword regex can't see):
+ *
+ * 1. Verb inference checks the tool's NAME first for the "which flavor"
+ *    decision (e.g. delete vs execute vs write within the destructive
+ *    pool) - terse, verb-led names carry none of the incidental nouns/
+ *    adjectives flowing description prose does.
+ *
+ * 2. The severity-override rule (see inferVerb, matchDangerousKeyword)
+ *    scans the FULL name+description text regardless of what the name
+ *    alone found - its purpose is catching a genuinely more dangerous
+ *    signal that a calm-sounding NAME might otherwise suppress (a tool
+ *    named "benign_reader" whose description says it "permanently
+ *    deletes" a file) - but it is deliberately narrowed to ONLY the
+ *    delete/execute patterns, not all six categories. The override's job
+ *    is specifically "is this secretly destructive," not "does the full
+ *    text contain any keyword at all" - scanning against all six was
+ *    strictly broader than that job required, and that excess breadth was
+ *    the exact path a stray 'send' match ("detailed error messages")
+ *    reappeared through even with name-first in place and no other bug
+ *    present.
+ *
+ * Confirmed directly, not assumed: with both defenses in place, temporarily
+ * reverting every word-specific exclusion in KEYWORD_PATTERNS below (the
+ * 'messag'/'creat'/'modif' exclusions and the 'sent'/'found' additions) and
+ * re-running the full fixture matrix - all 12 tests, including the ones
+ * that broke earlier iterations - passed with none of those patches in
+ * place. That's the actual signal that this closes the class of bug
+ * structurally rather than requiring an ever-growing patch list: the
+ * patches are kept anyway as defense-in-depth for the one path they still
+ * matter on (a generically-named tool with no name-first match still falls
+ * back to a full six-category scan for its default classification), but
+ * they are no longer load-bearing for the two cases that originally broke.
+ *
+ * This is not claimed as a complete solution to keyword-heuristic ambiguity
+ * over natural language - it structurally closed the specific interaction
+ * discovered so far. A future real server could still surface a new
+ * instance through the remaining fallback path; treat that as an
+ * interesting new fixture to add, not evidence of a regression.
+ */
+const SEVERITY = { read: 0, fetch: 1, send: 1, write: 2, delete: 3, execute: 3 };
+// Checked most-severe-first, so if a description contains multiple signal
+// words, the more alarming one is the one that gets detected.
+// NOTE: 'move'/'rename' are deliberately NOT in the write list - a relocation
+// both creates at the destination and vacates the source, which is closer to
+// a delete-shaped effect at the origin than a confident write signal. Left
+// unmatched, it correctly falls through to the destructive-pool default.
+//
+// Patterns are left-anchored word STEMS (\b before, no \b after), not whole
+// words - natural-language tool descriptions use conjugated forms
+// ("deletes", "deleting", "created") far more often than bare infinitives,
+// and \bdelete\b does not match "deletes" (no word boundary between "delete"
+// and the trailing "s"). Left-anchoring on the stem catches all common
+// inflections without needing to enumerate every conjugation.
+// Longer, distinctive words use a left-anchored stem (catches conjugations
+// like "deletes"/"deleting" without enumerating every form, since \bdelete\b
+// does not match "deletes" - no word boundary between "delete" and "s").
+// Short or common words (run, call, get) use exact whole-word matches
+// instead, since a left-anchored stem on a short word risks false positives
+// on unrelated words that merely start with it (e.g. "runtime", "callback",
+// "getter").
+// Audited for the conjugation gap that broke read_text_file's classification
+// (\bdelete\b does not match "deletes"): every stem below is left-anchored
+// (no trailing \b) unless the bare stem itself risks colliding with an
+// unrelated word (run->runtime, call->callback, get->getter, sent->sentence/
+// sentiment, found->foundation), in which case exact whole-word forms are
+// enumerated instead - including irregular past tenses (sent, found) that a
+// simple stem would miss entirely. Known residual gap, documented rather
+// than chased further: rarer irregulars (ran, got, gotten, ate) are not
+// exhaustively enumerated - see the module-level doc comment.
+const KEYWORD_PATTERNS = [
+    ['delete', /\b(delete|remov|destroy|purg|drop)/],
+    ['execute', /\b(execut|invok|spawn)|\b(run|runs|running|call|calls|calling|called)\b/],
+    // 'messag' deliberately excluded: "error messages", "log messages" etc. are
+    // extremely common boilerplate in tool descriptions that have nothing to do
+    // with the tool sending anything - a noun/verb ambiguity that produced a
+    // real false positive (read_text_file's "detailed error messages" phrase)
+    // during validation against real tool data. 'sent' added as an exact
+    // whole-word form since "send" the bare stem doesn't cover this irregular
+    // past tense, and a bare 'sent' stem would collide with "sentence"/
+    // "sentiment".
+    ['send', /\b(send|post|publish|notif|email)|\bsent\b/],
+    ['fetch', /\b(fetch|download|pull|scrap)/],
+    // 'creat' and 'modif' as bare stems are deliberately avoided: "creation
+    // time"/"last modified time" are extremely common metadata-field phrases
+    // (nouns/adjectives describing timestamps, as in get_file_info's own
+    // description) with nothing to do with the tool creating or modifying
+    // anything - the same noun/verb ambiguity as 'messag' above. Bare
+    // "modified" is excluded too (it's the specific form that appears in
+    // "last modified" boilerplate); "modify"/"modifies"/"modifying" - active
+    // verb forms far more likely to describe a real action - are kept.
+    ['write', /\b(writ|updat|edit|sav|upload)|\b(create|creates|created|creating|modify|modifies|modifying)\b/],
+    // 'found' added as an exact whole-word form (irregular past tense of
+    // "find" - the bare 'find' stem doesn't cover it), guarded against
+    // colliding with "foundation".
+    ['read', /\b(read|list|search|view|inspect|quer|find)|\b(get|gets|getting|found)\b/],
+];
+function normalize(text) {
+    return text.replace(/[_-]/g, ' ').toLowerCase();
+}
+function matchKeyword(text) {
+    for (const [verb, pattern] of KEYWORD_PATTERNS) {
+        if (pattern.test(text))
+            return verb;
+    }
+    return null;
+}
+// The severity-override's actual job is narrow: "does the full text contain
+// a delete or execute signal the name alone missed" - not "does the full
+// text contain ANY keyword at all." A name-first match to read/write/send/
+// fetch that isn't contradicted by an actual delete/execute signal has
+// nothing for the override to correct; scanning against all six categories
+// was strictly broader than that job requires, and that excess breadth was
+// exactly the path "detailed error messages" used to reappear as a false
+// 'send' override even with name-first in place and no other bug present.
+// Checking only the two categories the override actually exists to catch
+// removes that path entirely, rather than patching around it per word.
+const DANGEROUS_PATTERNS = KEYWORD_PATTERNS.filter(([verb]) => verb === 'delete' || verb === 'execute');
+function matchDangerousKeyword(text) {
+    for (const [verb, pattern] of DANGEROUS_PATTERNS) {
+        if (pattern.test(text))
+            return verb;
+    }
+    return null;
+}
+function inferVerb(tool) {
+    // Name-first: a tool's NAME is terse and verb-led by convention
+    // (read_file, write_file, delete_record) with none of the incidental
+    // nouns/adjectives that flowing description prose carries (a description
+    // saying "creation time" or "detailed error messages" is never mirrored
+    // in a tool's own name). Checking the name alone first for the "which
+    // flavor" decision (e.g. within the destructive pool: delete vs execute
+    // vs write), and only falling through to the noisier description text
+    // when the name itself gives no signal, structurally avoids the whole
+    // CLASS of noun/verb ambiguity that produced two real false positives
+    // (read_text_file, get_file_info) during validation - not just those two
+    // specific words.
+    //
+    // This alone is NOT sufficient, though: it must not let a calm-sounding
+    // NAME suppress a genuinely more dangerous signal sitting in the
+    // description (e.g. a tool named "benign_reader" whose description says
+    // it "permanently deletes" something). So dangerousKeywordVerb below
+    // ALWAYS scans the full name+description text, independent of what the
+    // name-first check found - but ONLY against the delete/execute patterns
+    // specifically (see matchDangerousKeyword), not all six categories. The
+    // override's actual job is narrow ("is this secretly destructive"), and
+    // scanning against all six was strictly broader than that job needed -
+    // that excess breadth was the exact path a stray 'send' match ("detailed
+    // error messages") used to reappear even with name-first in place.
+    const nameOnlyVerb = matchKeyword(normalize(tool.name));
+    const fullText = normalize(`${tool.name} ${tool.description}`);
+    const dangerousKeywordVerb = matchDangerousKeyword(fullText);
+    const keywordVerb = nameOnlyVerb ?? matchKeyword(fullText);
+    const ann = tool.annotations;
+    const warnings = [];
+    if (ann?.destructiveHint === true && ann?.readOnlyHint === true) {
+        warnings.push(`Tool '${tool.name}' declares contradictory annotations (destructiveHint and readOnlyHint both true); resolving to the more cautious (destructive) classification.`);
+    }
+    let hintVerb;
+    if (ann?.destructiveHint === true) {
+        hintVerb = keywordVerb === 'delete' || keywordVerb === 'execute' || keywordVerb === 'write' ? keywordVerb : 'delete';
+    }
+    else if (ann?.readOnlyHint === true) {
+        hintVerb = keywordVerb === 'fetch' ? 'fetch' : 'read';
+    }
+    else if (ann && ann.destructiveHint === false && ann.readOnlyHint === false) {
+        hintVerb = keywordVerb ?? 'write';
+    }
+    else {
+        hintVerb = keywordVerb ?? 'execute';
+    }
+    let finalVerb = hintVerb;
+    if (dangerousKeywordVerb && SEVERITY[dangerousKeywordVerb] > SEVERITY[hintVerb]) {
+        warnings.push(`Tool '${tool.name}': keyword evidence ('${dangerousKeywordVerb}') found in its name or description is more severe than the annotation/name-based classification ('${hintVerb}'); using the more cautious classification.`);
+        finalVerb = dangerousKeywordVerb;
+    }
+    return { verb: finalVerb, warnings };
+}
+const RESOURCE_PATTERNS = [
+    ['filesystem:*', /\b(path|paths|file|filepath|directory|dir)\b/],
+    ['repo:*', /\b(repo|repository)\b/],
+    ['http:*', /\b(url|uri|endpoint)\b/],
+];
+function inferResource(tool) {
+    // Deliberately scans ONLY the input schema's parameter names/descriptions,
+    // not the tool's free-text description - a description can casually
+    // mention path-shaped words ("...their nested paths...") without the tool
+    // actually taking any such parameter, which would otherwise produce a
+    // falsely specific resource guess instead of the honest wildcard fallback.
+    const props = tool.inputSchema?.properties ?? {};
+    const paramText = Object.entries(props)
+        .map(([key, val]) => `${key} ${val.description ?? ''}`)
+        .join(' ');
+    const text = normalize(paramText);
+    for (const [resource, pattern] of RESOURCE_PATTERNS) {
+        if (pattern.test(text))
+            return resource;
+    }
+    return '*';
+}
+export function inferCapabilities(server_id, tools) {
+    const capabilities = [];
+    const warnings = [];
+    for (const tool of tools) {
+        const { verb, warnings: toolWarnings } = inferVerb(tool);
+        const resource = inferResource(tool);
+        capabilities.push({
+            tool_id: tool.name,
+            verb,
+            resource,
+            provenance: 'inferred',
+            description: `inferred from tool name/description/schema (server: ${server_id})`,
+        });
+        warnings.push(...toolWarnings);
+    }
+    return { capabilities, warnings };
+}
+//# sourceMappingURL=infer.js.map

package/dist/infer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infer.js","sourceRoot":"","sources":["../src/infer.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,MAAM,QAAQ,GAAyB,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAEvG,0EAA0E;AAC1E,8DAA8D;AAC9D,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,EAAE;AACF,4EAA4E;AAC5E,kEAAkE;AAClE,2EAA2E;AAC3E,6EAA6E;AAC7E,uEAAuE;AACvE,8DAA8D;AAC9D,2EAA2E;AAC3E,6EAA6E;AAC7E,yEAAyE;AACzE,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,aAAa;AACb,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,8DAA8D;AAC9D,MAAM,gBAAgB,GAAqB;IACzC,CAAC,QAAQ,EAAE,oCAAoC,CAAC;IAChD,CAAC,SAAS,EAAE,yEAAyE,CAAC;IACtF,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,oEAAoE;IACpE,eAAe;IACf,CAAC,MAAM,EAAE,4CAA4C,CAAC;IACtD,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAC1C,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,qEAAqE;IACrE,yEAAyE;IACzE,mEAAmE;IACnE,CAAC,OAAO,EAAE,gGAAgG,CAAC;IAC3G,qEAAqE;IACrE,mEAAmE;IACnE,+BAA+B;IAC/B,CAAC,MAAM,EAAE,0EAA0E,CAAC;CACrF,CAAC;AAEF,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,MAAM,kBAAkB,GAAqB,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC;AAE1H,SAAS,qBAAqB,CAAC,IAAY;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,gEAAgE;IAChE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,kBAAkB;IAClB,EAAE;IACF,wEAAwE;IACxE,iEAAiE;IACjE,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,YAAY,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,GAAG,EAAE,eAAe,KAAK,IAAI,IAAI,GAAG,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC;QAChE,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,iJAAiJ,CACpK,CAAC;IACJ,CAAC;IAED,IAAI,QAAc,CAAC;IACnB,IAAI,GAAG,EAAE,eAAe,KAAK,IAAI,EAAE,CAAC;QAClC,QAAQ,GAAG,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvH,CAAC;SAAM,IAAI,GAAG,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC;QACtC,QAAQ,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,CAAC;SAAM,IAAI,GAAG,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QAC9E,QAAQ,GAAG,WAAW,IAAI,OAAO,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,WAAW,IAAI,SAAS,CAAC;IACtC,CAAC;IAED,IAAI,SAAS,GAAG,QAAQ,CAAC;IACzB,IAAI,oBAAoB,IAAI,QAAQ,CAAC,oBAAoB,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,yBAAyB,oBAAoB,sGAAsG,QAAQ,6CAA6C,CAC3N,CAAC;QACF,SAAS,GAAG,oBAAoB,CAAC;IACnC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,iBAAiB,GAAuB;IAC5C,CAAC,cAAc,EAAE,8CAA8C,CAAC;IAChE,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACnC,CAAC,QAAQ,EAAE,wBAAwB,CAAC;CACrC,CAAC;AAEF,SAAS,aAAa,CAAC,IAAa;IAClC,2EAA2E;IAC3E,oEAAoE;IACpE,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,IAAI,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;SACtD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAElC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,KAAgB;IACnE,MAAM,YAAY,GAAyB,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAErC,YAAY,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,IAAI;YACJ,QAAQ;YACR,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,uDAAuD,SAAS,GAAG;SACjF,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,32 @@
+/** A tool as returned by a real MCP server's tools/list response. */
+export type McpTool = {
+    name: string;
+    description: string;
+    inputSchema?: {
+        properties?: Record<string, {
+            type?: string;
+            description?: string;
+        }>;
+    };
+    /** Optional per the MCP spec - self-reported by the server author, not independently verified. */
+    annotations?: {
+        readOnlyHint?: boolean;
+        destructiveHint?: boolean;
+        idempotentHint?: boolean;
+        openWorldHint?: boolean;
+    };
+};
+export type InferredCapability = {
+    tool_id: string;
+    verb: 'read' | 'fetch' | 'send' | 'write' | 'delete' | 'execute';
+    resource: string;
+    provenance: 'inferred';
+    description: string;
+};
+export type InferenceResult = {
+    capabilities: InferredCapability[];
+    /** Non-fatal signals worth surfacing in diagnostics - contradictory self-reported
+     * annotations, or cases where keyword evidence overrode a declared hint. */
+    warnings: string[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,MAAM,MAAM,OAAO,GAAG;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QACZ,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACtE,CAAC;IACF,kGAAkG;IAClG,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC;gFAC4E;IAC5E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@scopewatch/capability-inference",
+  "version": "0.0.1",
+  "description": "Heuristic capability inference from real MCP tools/list data, for servers without declared capability metadata",
+  "license": "MIT",
+  "author": "Sathvik Putta <puttasathvik16@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PuttaSathvik16/scopewatch.git",
+    "directory": "packages/capability-inference"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "node --import tsx --test 'test/**/*.test.ts'",
+    "clean": "rm -rf dist"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0",
+    "tsx": "^4.19.0"
+  }
+}