@skaleagents/swarm 0.5.0 → 0.6.1

package/dist/application/tools.js

@@ -0,0 +1,94 @@
+import { z } from "zod";
+import { requireApiAuth, unauthorizedContent } from "../auth.js";
+import { ScanInputError } from "../iac/parse.js";
+import { contextSchema, fileSchema, planReview, consultationInstructions, } from "./intake.js";
+import { reviewApplication } from "./review.js";
+async function run(remote, compute) {
+    if (!remote) {
+        const auth = await requireApiAuth();
+        if (!auth.ok)
+            return unauthorizedContent(auth);
+    }
+    try {
+        const output = compute();
+        return {
+            content: [
+                { type: "text", text: JSON.stringify(output, null, 2) },
+            ],
+            structuredContent: output,
+        };
+    }
+    catch (error) {
+        if (!(error instanceof ScanInputError))
+            throw error;
+        return {
+            isError: true,
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        error: "invalid_input",
+                        message: error.message,
+                    }),
+                },
+            ],
+        };
+    }
+}
+export function registerConsultation(server, remote) {
+    const annotations = {
+        readOnlyHint: true,
+        destructiveHint: false,
+        openWorldHint: false,
+    };
+    const security = { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] };
+    server.registerTool("plan_architecture_review", {
+        title: "Plan a whole-application architecture review",
+        description: "Start an interactive architecture consultation. Supply repository-relative file paths and known project context. Returns prioritized files to read, review areas, and up to three follow-up questions. Covers the whole application, including Next.js apps, not only infrastructure or scaling.",
+        annotations,
+        _meta: security,
+        inputSchema: {
+            filePaths: z
+                .array(z.string().min(1).max(300))
+                .max(3000)
+                .describe("Repository file inventory, relative to the application package root; use the client's workspace tools to list files"),
+            context: contextSchema,
+        },
+    }, ({ filePaths, context }) => run(remote, () => planReview(filePaths, context)));
+    server.registerTool("review_application_architecture", {
+        title: "Review whole-application architecture",
+        description: "Review related source files as an application. Builds a JS/TS import graph, checks Next.js server/client and runtime boundaries, maps routes and mutations, and returns evidence-backed findings plus questions covering data, auth, reliability, tests, deployment and product fit. Pass answers in context on subsequent calls. No repository fetch or execution; the connected assistant reasons about system-level tradeoffs using the returned evidence.",
+        annotations,
+        _meta: security,
+        inputSchema: {
+            files: z
+                .array(fileSchema)
+                .min(1)
+                .max(80)
+                .describe("Related source/config/test files with repository-relative paths; include package.json and tsconfig.json. At most 500,000 combined content characters"),
+            context: contextSchema,
+        },
+    }, ({ files, context }) => run(remote, () => reviewApplication(files, context)));
+    server.registerPrompt("architecture_consultation", {
+        title: "Independent application architecture consultation",
+        description: "Guide a multi-turn whole-application review with source evidence, follow-up questions, and design tradeoffs.",
+        argsSchema: {
+            goal: z
+                .string()
+                .max(3000)
+                .optional()
+                .describe("The architecture question or business goal to assess"),
+        },
+    }, ({ goal }) => ({
+        description: "Evidence-led architecture consultation",
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: `${consultationInstructions}\n\nReview goal: ${goal || "Assess the whole application's architecture and explain the highest-priority improvements."}`,
+                },
+            },
+        ],
+    }));
+}

package/dist/iac/scan.js

@@ -1,5 +1,6 @@
 import { parseIac } from "./parse.js";
 import { resourceFindings } from "./rules.js";
+import { VERSION } from "../version.js";
 export const severityRank = {
     info: 0,
     low: 1,
@@ -30,7 +31,7 @@ export function scanIac(content, options = {}) {
     const limit = options.maxFindings ?? 100;
     return {
         status: "completed",
-        engineVersion: "0.5.0",
+        engineVersion: VERSION,
         format: parsed.format,
         focus: options.focus ?? "general",
         summary: `Scanned ${parsed.resources.length} resources; ${findings.length} findings match the selected filters.`,

package/dist/review.d.ts

@@ -16,4 +16,4 @@ export type Finding = {
 export declare function architectureFindings(content: string, focus: string): Finding[];
 export declare function literalCredential(value: string): boolean;
 export declare function externalHttp(value: string): boolean;
-export declare function fetchPublicBotHints(token?: string): Promise<string[]>;
+export declare function fetchPublicBotHints(): Promise<string[]>;

package/dist/review.js

@@ -168,13 +168,12 @@ export function externalHttp(value) {
         return false;
     }
 }
-export async function fetchPublicBotHints(token) {
+export async function fetchPublicBotHints() {
     try {
         const res = await fetch(`${getApiUrl()}/api/bots`, {
             signal: AbortSignal.timeout(10_000),
             headers: {
                 Accept: "application/json",
-                ...(token ? { Authorization: `Bearer ${token}` } : {}),
             },
         });
         if (!res.ok)

package/dist/server.js

@@ -1,9 +1,11 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-import { getApiAccessToken, requireApiAuth, unauthorizedContent, } from "./auth.js";
+import { requireApiAuth, unauthorizedContent } from "./auth.js";
 import { architectureFindings, fetchPublicBotHints } from "./review.js";
 import { looksLikeIac, ScanInputError } from "./iac/parse.js";
 import { filterFindings, scanIac, summarize } from "./iac/scan.js";
+import { registerConsultation } from "./application/tools.js";
+import { VERSION } from "./version.js";
 const contentSchema = z
     .string()
     .min(1)
@@ -48,13 +50,13 @@ function inputError(error) {
     };
 }
 export function createServer(remote = false) {
-    const server = new McpServer({
-        name: "skaleagents-swarm",
-        version: "0.5.0",
+    const server = new McpServer({ name: "skaleagents-swarm", version: VERSION }, {
+        instructions: "For a whole application architecture consultation, start with plan_architecture_review, read relevant files with the client's workspace tools, then call review_application_architecture. Ask its follow-up questions and carry answers forward in context. Use review_architecture for individual source snippets and scan_iac for infrastructure. Ground conclusions in the returned evidence and coverage limits.",
     });
+    registerConsultation(server, remote);
     server.registerTool("review_architecture", {
         title: "Review architecture",
-        description: "Review application source or parsed infrastructure for security, reliability, and cost risks. Returns located findings, rule IDs, remediation and coverage limits.",
+        description: "Review individual source snippets or parsed infrastructure for security, reliability, and cost risks. For a whole application or Next.js architecture consultation, use plan_architecture_review and review_application_architecture instead.",
         annotations: {
             readOnlyHint: true,
             destructiveHint: false,
@@ -77,14 +79,11 @@ export function createServer(remote = false) {
                 .describe("Content format: terraform, cloudformation, kubernetes, application, auto"),
         },
     }, async ({ content, focus, format, minSeverity, maxFindings }) => {
-        let token;
+        const botHints = fetchPublicBotHints();
         if (!remote) {
             const auth = await requireApiAuth();
             if (!auth.ok)
                 return unauthorizedContent(auth);
-            token = (await getApiAccessToken()) ?? undefined;
-            if (!token)
-                return unauthorizedContent({ ok: false, reason: "oauth_failed" });
         }
         try {
             const options = { focus, minSeverity, maxFindings };
@@ -92,13 +91,13 @@ export function createServer(remote = false) {
                 (format !== "auto" || looksLikeIac(content))) {
                 return result({
                     ...scanIac(content, { ...options, format }),
-                    botHints: await fetchPublicBotHints(token),
+                    botHints: await botHints,
                 });
             }
             const findings = filterFindings(architectureFindings(content, focus).slice(1), options);
             return result({
                 status: "completed",
-                engineVersion: "0.5.0",
+                engineVersion: VERSION,
                 format: "application",
                 focus,
                 summary: `Application review completed; ${findings.length} findings match the selected filters.`,
@@ -109,7 +108,7 @@ export function createServer(remote = false) {
                 limitations: [
                     "Application checks are text patterns, not a language-aware or runtime analysis. Findings do not establish that code is safe.",
                 ],
-                botHints: await fetchPublicBotHints(token),
+                botHints: await botHints,
             });
         }
         catch (error) {

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const VERSION = "0.6.1";

package/dist/version.js

@@ -0,0 +1 @@
+export const VERSION = "0.6.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -24,7 +24,8 @@
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts",
     "typecheck": "tsc --noEmit",
-    "test": "tsx --test src/*.test.ts src/iac/*.test.ts",
+    "test": "tsx --test src/*.test.ts src/iac/*.test.ts src/application/*.test.ts && npm run build && node --test scripts/*.test.mjs",
+    "benchmark:tool": "npm run build && node scripts/benchmark-tool-latency.mjs",
     "smoke": "tsx scripts/smoke-tools.mjs"
   },
   "engines": {
@@ -33,12 +34,12 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "hcl2-parser": "^1.0.3",
+    "typescript": "^5.9.3",
     "yaml": "^2.9.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^22.20.1",
-    "tsx": "^4.23.12",
-    "typescript": "^5.7.3"
+    "tsx": "^4.23.12"
   }
 }