@securityreviewai/security-review-mcp 0.2.13 → 0.2.15

package/README.md

@@ -4,7 +4,7 @@ TypeScript MCP server for [SecurityReview.ai](https://securityreview.ai), publis
 
 - Pure Node runtime (no Python bootstrap)
 - Stdio MCP server compatible with Cursor, Windsurf, Claude Desktop, ChatGPT MCP, and other MCP clients
-- 54 tools for project/document/review/workflow/integration operations
+- 55 tools for project/document/review/workflow/integration operations
 - 8 built-in security-analysis prompts
 - 4 read-only MCP resources
 
@@ -108,7 +108,7 @@ Compatibility flags (no-op, retained for older configs):
 - `--python <path>`
 - `--force-install`
 
-## Tool Catalog (54)
+## Tool Catalog (55)
 
 ### Projects
 
@@ -130,6 +130,7 @@ Compatibility flags (no-op, retained for older configs):
 | `get_project_profile_security_control` | Get one security control by ID |
 | `list_profile_compliance_requirements` | List compliance requirements in project profile |
 | `get_profile_compliance_requirement` | Get one compliance requirement by ID |
+| `get_guardrails` | Get vibe guardrails configured for a vibe review project |
 | `update_vibe_project_profile` | Push/update vibe profile data (architecture notes, tech categories, user groups, compliance requirements, language stacks, description) by project ID |
 
 ### Documents
@@ -238,6 +239,7 @@ Compatibility flags (no-op, retained for older configs):
 1. `create_project` (or resolve with `find_project_by_name`)
 2. `update_vibe_project_profile` — supply any combination of `architecture_notes`, `tech_categories`, `user_groups`, `compliance_requirements`, `language_stacks`, and `description`
 3. `get_full_project_profile` — verify the updated profile
+4. `get_guardrails` — fetch configured guardrails for vibe review projects
 
 ### 4) Bring in Jira/Confluence Context
 

package/dist/api/client.js

@@ -178,6 +178,18 @@ export class SraiApiClient {
             jsonBody: payload,
         });
     }
+    async getGuardrails(projectId) {
+        const path = `/api/projects/${projectId}/vibe-guardrails`;
+        try {
+            return await this.request("GET", path);
+        }
+        catch (error) {
+            if (error instanceof SraiApiError && error.statusCode === 404) {
+                return this.request("GET", `${path}/`);
+            }
+            throw error;
+        }
+    }
     async listDocuments(projectId) {
         return this.request("GET", `/api/projects/${projectId}/documents`);
     }

package/dist/tools/projectTools.js

@@ -101,6 +101,12 @@ export function registerProjectTools(server) {
             requirement_id: z.number().int(),
         },
     }, async ({ project_id, requirement_id }) => runTool(async () => getApiClient().getProjectProfileComplianceRequirement(project_id, requirement_id)));
+    server.registerTool("get_guardrails", {
+        description: "Get all vibe guardrails configured for a vibe review project. Returns each guardrail's title, rule type, category, instruction, and source references.",
+        inputSchema: {
+            project_id: z.number().int(),
+        },
+    }, async ({ project_id }) => runTool(async () => getApiClient().getGuardrails(project_id)));
     server.registerTool("update_vibe_project_profile", {
         description: "Push/update a project's vibe profile data by project ID. Accepts architecture notes, technology categories, user groups, compliance requirements, and other profile metadata. All fields are optional — only provided fields are sent to the API. Use this to populate or update a project profile in bulk from vibe/AI-generated context.",
         inputSchema: {

package/dist/tools/workflowTools.js

@@ -26,7 +26,7 @@ export function registerWorkflowTools(server) {
         },
     }, async ({ project_id, name, description }) => runTool(async () => getApiClient().createAiIdeWorkflow(project_id, name, description)));
     server.registerTool("create_ai_ide_event", {
-        description: "Create an AI IDE event under an existing AI IDE workflow. Include summary, developer details, mitigated threats (each threat must include severity: critical/high/medium/low), best practices, secure snippets, and optional event metadata.",
+        description: "Create an AI IDE event under an existing AI IDE workflow. Include summary, developer details, mitigated threats (each threat must include severity: critical/high/medium/low), best practices, secure snippets, applied guardrails, and optional event metadata.",
         inputSchema: {
             project_id: z.number().int(),
             workflow_id: z.number().int(),
@@ -44,9 +44,10 @@ export function registerWorkflowTools(server) {
                 .default([]),
             best_practices_achieved: z.array(z.object({}).catchall(z.unknown())).default([]),
             secure_code_snippets: z.array(z.object({}).catchall(z.unknown())).default([]),
+            guardrails_applied: z.array(z.object({}).catchall(z.unknown())).default([]),
             event_metadata: z.record(z.string(), z.unknown()).default({}),
         },
-    }, async ({ project_id, workflow_id, external_id, title, summary, developer_name, developer_email, threats_mitigated, best_practices_achieved, secure_code_snippets, event_metadata, }) => runTool(async () => getApiClient().createAiIdeEvent(project_id, workflow_id, {
+    }, async ({ project_id, workflow_id, external_id, title, summary, developer_name, developer_email, threats_mitigated, best_practices_achieved, secure_code_snippets, guardrails_applied, event_metadata, }) => runTool(async () => getApiClient().createAiIdeEvent(project_id, workflow_id, {
         external_id,
         title,
         summary,
@@ -55,6 +56,7 @@ export function registerWorkflowTools(server) {
         threats_mitigated,
         best_practices_achieved,
         secure_code_snippets,
+        guardrails_applied,
         event_metadata,
     })));
     server.registerTool("start_workflow", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securityreviewai/security-review-mcp",
-  "version": "0.2.13",
+  "version": "0.2.15",
   "description": "Security Review MCP server (pure Node/TypeScript, npx-ready)",
   "license": "UNLICENSED",
   "private": false,