@taiga-ai/mcp-server 0.16.0-rc.431 → 0.17.0-dev.438

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.16.0-rc.431",
+  "version": "0.17.0-dev.438",
   "description": "MCP server for Taiga -- gives AI assistants access to documents and products",
   "type": "module",
   "main": "./dist/index.js",

package/scripts/prepare-publish.cjs

@@ -5,9 +5,10 @@
  *
  * - Removes `private: true` so npm allows publishing
  * - Sets publishConfig to public access
- * - Strips workspace-only dependencies. `@taiga/types` is compile-time only
- *   (erased); `@taiga/feature-flags` is a runtime value but is bundled into
- *   dist/index.js by the rolldown build, so neither is a real runtime dep.
+ * - Strips workspace-only dependencies. `@taiga/types` and
+ *   `@taiga/feature-flags` carry runtime code, but the rolldown build bundles
+ *   both into dist/index.js, so neither is a real runtime dep. The `zod` that
+ *   `@taiga/types` imports stays external: it is a declared dependency.
  * - Drops the `types` entry points — the published artifact is a bundled CLI
  *   and ships no `.d.ts` (the build runs `tsc --noEmit`).
  * - Marks the bin entry executable. The bundler emits dist/index.js with mode

package/src/client.ts

@@ -632,6 +632,7 @@ export class TaigaClient {
 
   async listSetupTasks(opts: {
     productId?: string | undefined;
+    openOnly?: boolean | undefined;
     limit?: number | undefined;
     cursor?: string | undefined;
   }) {

package/src/server.integration.test.ts

@@ -1527,7 +1527,8 @@ describe('MCP server integration', () => {
         expect(result.isError).toBe(true);
         expect(parseToolResult(result)).toEqual({
           error: 'NOT_FOUND',
-          message: 'The requested resource does not exist',
+          message:
+            'The requested resource does not exist. taiga_list_products lists the products the key can see; a name is not an ID (taiga_get_product takes a slug).',
         });
       }
     });
@@ -1775,7 +1776,10 @@ describe('MCP server integration', () => {
         arguments: { factoryId: FACTORY_ID },
       });
 
-      expect(parseToolResult(result)).toEqual({ error: 'NOT_FOUND', message: 'The requested resource does not exist' });
+      expect(parseToolResult(result)).toEqual({
+        error: 'NOT_FOUND',
+        message: 'The requested resource does not exist. taiga_list_factories lists the factories the key can see.',
+      });
     });
 
     it('should report a factory the key cannot see as a factory miss, not an unpublished document', async () => {
@@ -1787,7 +1791,10 @@ describe('MCP server integration', () => {
         arguments: { factoryId: FACTORY_ID },
       });
 
-      expect(parseToolResult(result)).toEqual({ error: 'NOT_FOUND', message: 'The requested resource does not exist' });
+      expect(parseToolResult(result)).toEqual({
+        error: 'NOT_FOUND',
+        message: 'The requested resource does not exist. taiga_list_factories lists the factories the key can see.',
+      });
     });
 
     it('should point at the draft when a factory has one unpublished', async () => {
@@ -1849,7 +1856,7 @@ describe('MCP server integration', () => {
 
       expect(result.isError).toBe(true);
       expect(parseToolResult(result)).toMatchObject({
-        error: 'VALIDATION_FAILED',
+        error: 'VALIDATION_ERROR',
         message: expect.stringContaining('exactly once'),
       });
       expect(fetchSpy.mock.calls.length).toBe(before);
@@ -1862,7 +1869,7 @@ describe('MCP server integration', () => {
       const result = await client.callTool({ name: 'taiga_get_product', arguments: {} });
 
       expect(result.isError).toBe(true);
-      expect(parseToolResult(result).error).toBe('VALIDATION_FAILED');
+      expect(parseToolResult(result).error).toBe('VALIDATION_ERROR');
       expect(fetchSpy.mock.calls.length).toBe(before);
     });
   });
@@ -1955,7 +1962,6 @@ describe('MCP server integration', () => {
         slug: 'web',
         status: 'active',
         factoryId: FACTORY_ID,
-        kind: 'application',
         projectType: 'greenfield',
         defaultOrigin: 'plan',
       });
@@ -2292,7 +2298,7 @@ describe('MCP server integration', () => {
       for (const args of [{}, { productId: PRODUCT_ID, slug: 'web' }]) {
         const result = await client.callTool({ name: 'taiga_get_product_context', arguments: args });
         expect(result.isError).toBe(true);
-        expect(parseToolResult(result).error).toBe('VALIDATION_FAILED');
+        expect(parseToolResult(result).error).toBe('VALIDATION_ERROR');
       }
       expect(fetchSpy.mock.calls.length).toBe(before);
     });
@@ -2677,7 +2683,7 @@ describe('MCP server integration', () => {
       expect(failure).toMatchObject({ code: -32602 });
       // A slash command with no argument lands here; the message says how to pass one.
       expect(String((failure as Error).message)).toMatch(
-        /^VALIDATION_FAILED: Name the product exactly once: slug or productId or remoteUrl\. Pass the slug as the first argument \(\/taiga_start_session <slug>/
+        /^VALIDATION_ERROR: Name the product exactly once: slug or productId or remoteUrl\. Pass the slug as the first argument \(\/taiga_start_session <slug>/
       );
     });
 
@@ -3394,7 +3400,11 @@ describe('MCP server integration', () => {
 
       const none = await client.callTool({ name: 'taiga_get_plan', arguments: { itemId: OTHER_ITEM } });
       expect(none.isError).toBe(true);
-      expect(outcomeOf(none)).toEqual({ error: 'NOT_FOUND', message: 'No active plan found' });
+      expect(outcomeOf(none)).toEqual({
+        error: 'NOT_FOUND',
+        message:
+          'No active plan found. taiga_get_backlog_item says whether one is being generated (planningStatus planning) or failed, and taiga_plan_again asks for a new one.',
+      });
     });
 
     it('should approve a plan by its ID and reject one with the comment', async () => {
@@ -3529,7 +3539,7 @@ describe('MCP server integration', () => {
       const result = await client.callTool({ name: 'taiga_list_builds', arguments: { backlogItemId: ITEM_ID } });
 
       expect(result.isError).toBe(true);
-      expect(outcomeOf(result)).toMatchObject({ error: 'VALIDATION_FAILED' });
+      expect(outcomeOf(result)).toMatchObject({ error: 'VALIDATION_ERROR' });
       expect(fetchSpy.mock.calls.length).toBe(before);
     });
 
@@ -3650,7 +3660,7 @@ describe('MCP server integration', () => {
       });
 
       expect(result.isError).toBe(true);
-      expect(outcomeOf(result)).toMatchObject({ error: 'VALIDATION_FAILED' });
+      expect(outcomeOf(result)).toMatchObject({ error: 'VALIDATION_ERROR' });
       expect(fetchSpy.mock.calls.length).toBe(before);
     });
 
@@ -5033,8 +5043,10 @@ describe('MCP server integration', () => {
       expect(summary.controls.map((c: { controlId: string }) => c.controlId)).toEqual(['SEC-3.4']);
       expect(summary.violations[0]).toMatchObject({ id: VIOLATION_ID, title: 'Plaintext' });
       expect(summary.violations[0]).not.toHaveProperty('evidence');
-      expect(summary.resolvedViolations).toBe(2);
+      expect(summary.summary.resolvedViolations).toBe(2);
       expect(full.divergences[0].evidence).toBe('long evidence');
+      // The counts lead the full answer too.
+      expect(Object.keys(full)[0]).toBe('summary');
     });
 
     it('should fix a control or one violation through its own route', async () => {
@@ -6007,7 +6019,11 @@ describe('MCP server integration', () => {
       expect(finish.isError).toBe(true);
       expect(parseToolResult(finish)).toEqual({
         error: 'CONFLICT',
-        message: 'Every required document must be published before setup can be completed',
+        message:
+          'Every required document must be published before setup can be completed. An imported product gets ' +
+          'them from its import (taiga_start_import); a product started from scratch gets the specification from ' +
+          'the Discovery conversation in the web and the rest from taiga_generate_product_documents. A draft is ' +
+          'published with taiga_publish_product_document.',
         details: { reason: 'documents_incomplete', missingDocuments: ['threat_model', 'risk_register'] },
       });
       expect(parseToolResult(move)).toMatchObject({ error: 'CONFLICT', details: { reason: 'work_in_flight' } });
@@ -6050,18 +6066,18 @@ describe('MCP server integration', () => {
       });
 
       expect(parseToolResult(unknown)).toMatchObject({ error: 'NOT_FOUND', details: { accounts: expect.any(Array) } });
-      expect(parseToolResult(cursor).error).toBe('VALIDATION_FAILED');
+      expect(parseToolResult(cursor).error).toBe('VALIDATION_ERROR');
       const pagedSearch = await client.callTool({
         name: 'taiga_list_linkable_repositories',
         arguments: { installationId: INSTALL_ID, query: 'bill', cursor: 'abc' },
       });
-      expect(parseToolResult(pagedSearch).error).toBe('VALIDATION_FAILED');
-      expect(parseToolResult(notes).error).toBe('VALIDATION_FAILED');
+      expect(parseToolResult(pagedSearch).error).toBe('VALIDATION_ERROR');
+      expect(parseToolResult(notes).error).toBe('VALIDATION_ERROR');
       const updateNotes = await client.callTool({
         name: 'taiga_update_product',
         arguments: { productId: PRODUCT_ID, ownsInfrastructure: true, ownsDeployment: true, deploymentNotes: 'x' },
       });
-      expect(parseToolResult(updateNotes).error).toBe('VALIDATION_FAILED');
+      expect(parseToolResult(updateNotes).error).toBe('VALIDATION_ERROR');
       const asked = fetchSpy.mock.calls.map((c: unknown[]) => new URL(c[0] as string).pathname);
       expect(asked.filter((p: string) => p.includes('/github/installations/'))).toEqual([]);
       expect(asked).not.toContain('/v1/products');
@@ -6176,3 +6192,344 @@ describe('MCP server integration', () => {
     });
   });
 });
+
+// ---------------------------------------------------------------------------
+// What a fresh agent's review of the server found it needed (PRO-2759): a
+// miss that says where the right IDs are, a search by name, what a product
+// in setup waits for, an empty answer that says why, and a run that says
+// where it stopped.
+// ---------------------------------------------------------------------------
+
+describe('what the agent review found (PRO-2759)', () => {
+  const ENV_ID = '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a70';
+  const LINK_ID = '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a71';
+
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("adds to the API's 404 where the right IDs are, one hint per ID the call named, the product last", async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        [`GET /v1/backlog/${ITEM_ID}`]: refusal(404, 'NOT_FOUND', 'Backlog item not found'),
+        [`GET /v1/products/${PRODUCT_ID}/repositories/${LINK_ID}/branches`]: refusal(
+          404,
+          'NOT_FOUND',
+          'Repository link not found'
+        ),
+      },
+    });
+
+    const item = await client.callTool({ name: 'taiga_get_backlog_item', arguments: { itemId: ITEM_ID } });
+    expect(parseToolResult(item)).toEqual({
+      error: 'NOT_FOUND',
+      message:
+        "Backlog item not found. taiga_list_backlog_items lists a product's initiatives with their IDs; a run or " +
+        'plan ID is not one.',
+    });
+
+    const branches = await client.callTool({
+      name: 'taiga_list_repository_branches',
+      arguments: { productId: PRODUCT_ID, repositoryId: LINK_ID },
+    });
+    expect(parseToolResult(branches).message).toBe(
+      "Repository link not found. taiga_list_product_repositories lists the product's repository links; a GitHub " +
+        'repository id is not a link ID. taiga_list_products lists the products the key can see; a name is not ' +
+        'an ID (taiga_get_product takes a slug).'
+    );
+  });
+
+  it('sends a mistyped initiative on taiga_get_plan to the initiative list, and only a missing plan to planning', async () => {
+    const OTHER = '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a72';
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        [`GET /v1/backlog/${ITEM_ID}/plans/active`]: refusal(404, 'NOT_FOUND', 'No active plan found'),
+        [`GET /v1/backlog/${OTHER}/plans/active`]: refusal(404, 'NOT_FOUND', 'Backlog item not found'),
+      },
+    });
+
+    const noPlan = parseToolResult(await client.callTool({ name: 'taiga_get_plan', arguments: { itemId: ITEM_ID } }));
+    const noItem = parseToolResult(await client.callTool({ name: 'taiga_get_plan', arguments: { itemId: OTHER } }));
+
+    expect(noPlan.message).toContain('taiga_plan_again asks for a new one');
+    expect(noItem.message).toBe(
+      "Backlog item not found. taiga_list_backlog_items lists a product's initiatives with their IDs; a run or " +
+        'plan ID is not one.'
+    );
+  });
+
+  it('says a run that failed before any step started stopped while setting up, not at a step or the PR', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        [`GET /v1/builds/${BUILD_ID}`]: { data: { id: BUILD_ID, status: 'failed', hardeningResult: null } },
+        [`GET /v1/builds/${BUILD_ID}/steps`]: { data: [{ stepOrder: 1, title: 'Add the route', status: 'planned' }] },
+      },
+    });
+
+    const result = parseToolResult(
+      await client.callTool({ name: 'taiga_get_build', arguments: { buildId: BUILD_ID } })
+    );
+
+    expect(result.stoppedIn).toMatch(/^before the first step started/);
+  });
+
+  it('says where a product ID comes from when a name is passed for one', async () => {
+    const { client } = await bootMcpPair({ capabilities: ALL_CAPABILITIES });
+
+    const result = await client.callTool({ name: 'taiga_list_backlog_items', arguments: { productId: 'Web shop' } });
+
+    expect(result.isError).toBe(true);
+    expect((result.content as { text: string }[])[0]!.text).toContain(
+      'A product ID is a UUID, not a name: taiga_list_products (query finds one by name)'
+    );
+  });
+
+  it('finds a product by part of its name across pages, and refuses a cursor with a search', async () => {
+    const page1 = [
+      { id: PRODUCT_ID, name: 'Web shop', slug: 'web-shop', status: 'active', factoryId: FACTORY_ID, kind: null },
+      { id: 'p-2', name: 'Billing', slug: 'billing', status: 'active', factoryId: FACTORY_ID, kind: null },
+    ];
+    const page2 = [{ id: PRODUCT_ID_2, name: 'Shop admin', slug: 'admin', status: 'draft', factoryId: FACTORY_ID }];
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        '/v1/products': (url: string) => {
+          const second = new URL(url).searchParams.get('cursor') === 'c2';
+          const body = second ? { data: page2, nextCursor: null } : { data: page1, nextCursor: 'c2' };
+          return {
+            ok: true,
+            status: 200,
+            json: () => Promise.resolve(body),
+            text: () => Promise.resolve(JSON.stringify(body)),
+          };
+        },
+      },
+    });
+
+    const found = await client.callTool({ name: 'taiga_list_products', arguments: { query: 'SHOP' } });
+    expect(parseToolResult(found)).toEqual({
+      data: [
+        { id: PRODUCT_ID, name: 'Web shop', slug: 'web-shop', status: 'active', factoryId: FACTORY_ID },
+        { id: PRODUCT_ID_2, name: 'Shop admin', slug: 'admin', status: 'draft', factoryId: FACTORY_ID },
+      ],
+      nextCursor: null,
+    });
+
+    const paged = await client.callTool({ name: 'taiga_list_products', arguments: { query: 'shop', cursor: 'c2' } });
+    expect(parseToolResult(paged).error).toBe('VALIDATION_ERROR');
+  });
+
+  it('reads a policy by section, and keeps the sections that exist when one asked for does not', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: { [`GET /v1/tenants/current/documents/policy_security`]: { data: policyDocument() } },
+    });
+
+    const result = await client.callTool({
+      name: 'taiga_get_document',
+      arguments: { type: 'policy_security', sections: ['scope', 'secrets'] },
+    });
+
+    const doc = parseToolResult(result);
+    expect(Object.keys(doc.data.sections)).toEqual(['scope']);
+    expect(doc.omittedSections).toEqual([{ id: 'summary', characters: 'Old summary'.length }]);
+    expect(doc.unknownSections).toEqual(['secrets']);
+
+    const none = await client.callTool({
+      name: 'taiga_get_document',
+      arguments: { type: 'policy_security', sections: ['secrets'] },
+    });
+    expect(parseToolResult(none)).toEqual({
+      error: 'NOT_FOUND',
+      message: 'The policy_security has no section secrets; its sections are summary, scope.',
+    });
+  });
+
+  it('says what a product in setup waits for, and warns of a half turned off with nothing said about it', async () => {
+    const draft = {
+      id: PRODUCT_ID,
+      name: 'Web',
+      slug: 'web',
+      status: 'draft',
+      factoryId: FACTORY_ID,
+      discoveryStep: 'context',
+      settings: { projectType: 'brownfield', importStatus: 'pending' },
+      ownsInfrastructure: false,
+      deploymentNotes: null,
+    };
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        [`GET /v1/products/${PRODUCT_ID}`]: { data: draft },
+        [`PATCH /v1/products/${PRODUCT_ID}`]: { data: draft },
+      },
+    });
+
+    const product = parseToolResult(
+      await client.callTool({ name: 'taiga_get_product', arguments: { productId: PRODUCT_ID } })
+    );
+    expect(product.nextStep).toBe(
+      'Link its repository if it has none (taiga_list_linkable_repositories, taiga_link_repository), then ' +
+        'taiga_start_import: the import derives the documents from the code and runs by itself.'
+    );
+
+    const updated = parseToolResult(
+      await client.callTool({
+        name: 'taiga_update_product',
+        arguments: { productId: PRODUCT_ID, ownsInfrastructure: false },
+      })
+    );
+    expect(updated.nextStep).toBe(product.nextStep);
+    expect(updated.warnings).toEqual([expect.stringContaining('has no deploymentNotes')]);
+  });
+
+  it("reads the step of a product the write's answer leaves it out of, and says nothing rather than guess", async () => {
+    const written = { id: PRODUCT_ID, name: 'Web', slug: 'web', status: 'draft', factoryId: FACTORY_ID, settings: {} };
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        [`PATCH /v1/products/${PRODUCT_ID}`]: { data: written },
+        [`GET /v1/products/${PRODUCT_ID}`]: { data: { ...written, discoveryStep: 'documents' } },
+        [`PATCH /v1/products/${PRODUCT_ID_2}`]: { data: { ...written, id: PRODUCT_ID_2 } },
+      },
+    });
+
+    const read = parseToolResult(
+      await client.callTool({ name: 'taiga_update_product', arguments: { productId: PRODUCT_ID, name: 'Web' } })
+    );
+    // The product's read is unreachable here (the mock answers 404): no nextStep, not the conversation's.
+    const unread = parseToolResult(
+      await client.callTool({ name: 'taiga_update_product', arguments: { productId: PRODUCT_ID_2, name: 'Web' } })
+    );
+
+    expect(read.nextStep).toMatch(/^The specification is done/);
+    expect(unread).not.toHaveProperty('nextStep');
+  });
+
+  it('says nothing of where a merged run stopped, whatever its stale status says', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        [`GET /v1/builds/${BUILD_ID}`]: {
+          data: { id: BUILD_ID, status: 'failed', prMerged: true, hardeningResult: null },
+        },
+        [`GET /v1/builds/${BUILD_ID}/steps`]: { data: [{ stepOrder: 1, title: 'Add the route', status: 'completed' }] },
+      },
+    });
+
+    const result = parseToolResult(
+      await client.callTool({ name: 'taiga_get_build', arguments: { buildId: BUILD_ID } })
+    );
+
+    expect(result).not.toHaveProperty('stoppedIn');
+  });
+
+  it('lists the setup tasks still to do by default, each naming its product', async () => {
+    const task = {
+      id: 't-1',
+      productId: PRODUCT_ID,
+      productName: 'Web',
+      title: 'Add STRIPE_KEY',
+      inboxItemStatus: 'open',
+    };
+    const { client, fetchSpy } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: { '/v1/setup-tasks': { data: [task], nextCursor: null } },
+    });
+
+    const open = parseToolResult(await client.callTool({ name: 'taiga_list_setup_tasks', arguments: {} }));
+    await client.callTool({ name: 'taiga_list_setup_tasks', arguments: { includeDone: true } });
+
+    expect(open.data[0]).toMatchObject({ productName: 'Web' });
+    expect(sentUrl(fetchSpy, '/setup-tasks').searchParams.get('openOnly')).toBe('true');
+    const urls = fetchSpy.mock.calls.map((c: unknown[]) => c[0] as string).filter((u) => u.includes('/setup-tasks'));
+    expect(urls[1]).not.toContain('openOnly');
+  });
+
+  it('says where a failed run stopped: in hardening, when every step completed', async () => {
+    const run = { id: BUILD_ID, status: 'failed', failedReason: 'agent_stalled', hardeningResult: null };
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        [`GET /v1/builds/${BUILD_ID}`]: { data: run },
+        [`GET /v1/builds/${BUILD_ID}/steps`]: { data: [{ stepOrder: 1, title: 'Add the route', status: 'completed' }] },
+      },
+    });
+
+    const result = parseToolResult(
+      await client.callTool({ name: 'taiga_get_build', arguments: { buildId: BUILD_ID } })
+    );
+
+    expect(result.stoppedIn).toMatch(/^after the last step, in hardening/);
+  });
+
+  it('says why an empty deployments answer is empty, and refuses an environment that is not the product’s', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        [`GET /v1/products/${PRODUCT_ID}/environments`]: { data: [], nextCursor: null },
+        [`GET /v1/products/${PRODUCT_ID}/deployments/current`]: { data: { current: [], deploying: [] } },
+        [`GET /v1/products/${PRODUCT_ID}/deployments`]: { data: [], nextCursor: null },
+        [`GET /v1/products/${PRODUCT_ID}/deployments/sync-status`]: { data: {} },
+        [`GET /v1/products/${PRODUCT_ID}/monitoring/health`]: { data: [] },
+      },
+    });
+
+    const deployments = parseToolResult(
+      await client.callTool({ name: 'taiga_get_deployments', arguments: { productId: PRODUCT_ID } })
+    );
+    expect(deployments.note).toMatch(/^This product has no environments yet/);
+
+    const health = parseToolResult(
+      await client.callTool({ name: 'taiga_get_monitoring', arguments: { productId: PRODUCT_ID } })
+    );
+    expect(health.note).toMatch(/^No environment is monitored/);
+
+    // Every signal answers 404, as the API does for another product's environment.
+    const wrong = parseToolResult(
+      await client.callTool({
+        name: 'taiga_get_monitoring',
+        arguments: { productId: PRODUCT_ID, environmentId: ENV_ID },
+      })
+    );
+    expect(wrong.error).toBe('NOT_FOUND');
+  });
+
+  it('leads the policy standing with its counts', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        [`GET /v1/products/${PRODUCT_ID}/maintenance/policies`]: {
+          data: {
+            productId: PRODUCT_ID,
+            hasPolicies: true,
+            controls: [
+              { controlId: 'SEC-5.1', divergenceCount: 2 },
+              { controlId: 'SEC-1.1', divergenceCount: 0 },
+            ],
+            divergences: [
+              { id: 'v1', controlId: 'SEC-5.1', severity: 'high' },
+              { id: 'v2', controlId: 'SEC-5.1', severity: 'critical' },
+            ],
+            resolvedDivergences: [{}],
+          },
+        },
+      },
+    });
+
+    const standing = parseToolResult(
+      await client.callTool({ name: 'taiga_get_policy_standing', arguments: { productId: PRODUCT_ID } })
+    );
+
+    expect(Object.keys(standing)[0]).toBe('summary');
+    expect(standing.summary).toEqual({
+      controls: 1,
+      violations: 2,
+      bySeverity: { high: 1, critical: 1 },
+      resolvedViolations: 1,
+    });
+  });
+});

package/src/tools/autonomy.ts

@@ -3,7 +3,7 @@ import { z } from 'zod';
 import type { TaigaClient } from '../client.js';
 import { OPERATE_SETTING } from './annotations.js';
 import { runTool, toolError, toolResult } from './errors.js';
-import { productId } from './inputs.js';
+import { idInput, productId } from './inputs.js';
 import { pickFields } from './summarize.js';
 
 /**
@@ -44,7 +44,7 @@ export function registerAutonomyTools(server: McpServer, client: TaigaClient) {
       (params) =>
         runTool(async () => {
           if (params.autoBuild === undefined && params.autoMerge === undefined) {
-            return toolError('VALIDATION_FAILED', 'Set autoBuild, autoMerge or both.');
+            return toolError('VALIDATION_ERROR', 'Set autoBuild, autoMerge or both.');
           }
           // `true` and `null` mean the same at the product (the scopes above
           // decide), and the web writes null to allow; so does this.
@@ -72,7 +72,7 @@ export function registerAutonomyTools(server: McpServer, client: TaigaClient) {
           'organization and factories allow: where either has turned autonomous merge off, true changes nothing. ' +
           'Taiga merges through your rules, never around them. Ask the person first.',
         inputSchema: z.object({
-          itemId: z.string().uuid().describe('Backlog item ID -- get from taiga_list_backlog_items'),
+          itemId: idInput('backlog item', 'taiga_list_backlog_items (query finds one by title) gives it'),
           autoMerge: z
             .boolean()
             .nullable()