@viberaven/mcp 1.5.1 → 1.5.3

package/README.md

@@ -18,11 +18,7 @@ For agent-mode artifacts, use `npx -y viberaven --agent-mode`.
 npx -y @viberaven/mcp
 ```
 
-You can also start the MCP server from the main CLI package:
-
-```bash
-npx -y viberaven mcp
-```
+This package is the only MCP entrypoint in 1.5.3. The main `viberaven` CLI package does not start an MCP server.
 
 ## Tools
 
@@ -30,12 +26,12 @@ npx -y viberaven mcp
 - `viberaven_verify` -> `npx -y viberaven check --json`
 - `viberaven_audit` -> `npx -y viberaven audit --vercel-supabase`
 - `viberaven_init_rules` -> `npx -y viberaven init`
-- `viberaven_clean_plan` -> `npx -y viberaven clean --plan`
+- `viberaven_clean_plan` -> `npx -y viberaven clean --plan`: writes and returns a context cleanup review plan; deletes nothing (fixed in 1.5.2)
 - `viberaven_strict_gate` -> `npx -y viberaven --strict --json`
 - `viberaven_gate_result` -> `npx -y viberaven --json`
 - `viberaven_context_map` -> `npx -y viberaven --condense`
 - `viberaven_actions` -> `npx -y viberaven actions`
-- `viberaven_verify_action` -> `npx -y viberaven verify --action <id>`
+- `viberaven_verify_action` -> `npx -y viberaven --verify --action <id>`
 - `viberaven_heal_plan` -> `npx -y viberaven --heal --plan`
 - `viberaven_heal_prompt` -> `npx -y viberaven --heal --prompt`
 - `viberaven_heal_apply` -> `npx -y viberaven --heal --apply`

package/dist/lib/cli-runner.js

@@ -52,7 +52,7 @@ function mcpVersion() {
     } catch {
     }
   }
-  found ??= true ? "1.5.1" : void 0;
+  found ??= true ? "1.5.3" : void 0;
   if (!found || !PLAIN_VERSION.test(found)) {
     throw new Error(`Could not read a valid ${MCP_PACKAGE} version (got ${JSON.stringify(found)}), so the matching ${CLI_PACKAGE} cannot be pinned.`);
   }

package/dist/server.js

@@ -22,6 +22,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var server_exports = {};
 __export(server_exports, {
   ALL_TOOLS: () => ALL_TOOLS,
+  INSTRUCTIONS: () => INSTRUCTIONS,
   SERVER_INFO: () => SERVER_INFO
 });
 module.exports = __toCommonJS(server_exports);
@@ -38,7 +39,7 @@ var cwdSchema = {
 var readinessTools = [
   {
     name: "viberaven_check_readiness",
-    description: "Run BEFORE deploying, shipping to real users, or touching auth, database/RLS, billing, webhooks, or environment variables. Runs the local `viberaven check` (no login, no API key, no telemetry) for launch blockers (missing RLS, leaked secrets, unbounded queries, unsigned webhooks) and writes a prioritized task list to .viberaven/agent-tasklist.md plus a machine verdict to .viberaven/gate-result.json. Calling this first avoids wasted code-generation re-runs by surfacing production risks before you write code.",
+    description: "Useful before an AI-built app on Vercel and Supabase launches or is handed off. Runs the local `viberaven check` (no login, no API key, no telemetry), which reads the repository for launch gaps (missing RLS in migrations, leaked secrets, unbounded queries, unsigned webhooks) and writes a prioritized task list to .viberaven/agent-tasklist.md plus a verdict to .viberaven/gate-result.json. This is advice, not a gate: the user decides when to ship. It reads repo files and does not query the live database.",
     inputSchema: cwdSchema
   },
   {
@@ -48,17 +49,17 @@ var readinessTools = [
   },
   {
     name: "viberaven_strict_gate",
-    description: 'Run the strict production gate and return the machine verdict. Call this right before a deploy or CI pass to confirm gate.status === "clear". Returns JSON suitable for blocking a pipeline.',
+    description: "Run `viberaven --strict --json` and return the verdict from .viberaven/gate-result.json (gate.status is clear, warning or not_clear). Useful before a deploy or CI run when the user wants the verdict as JSON. The user decides whether to ship.",
     inputSchema: cwdSchema
   },
   {
     name: "viberaven_gate_result",
-    description: "Return the current contents of .viberaven/gate-result.json without re-scanning. Use this to read the last machine verdict before deciding whether to deploy.",
+    description: "Run a fresh local scan (`viberaven --json`) and return the verdict it writes to .viberaven/gate-result.json (gate.status is clear, warning or not_clear). It rewrites the .viberaven artifacts; it does not read an older result without scanning.",
     inputSchema: cwdSchema
   },
   {
     name: "viberaven_context_map",
-    description: "Refresh and return .viberaven/context-map.json \u2014 a compact summary of the last scan for the next agent step. Use this to load minimal context before acting on a gap.",
+    description: "Refresh and return .viberaven/context-map.json, a compact summary of the last scan for the next agent step. Use this to load minimal context before acting on a gap.",
     inputSchema: cwdSchema
   }
 ];
@@ -67,7 +68,7 @@ var readinessTools = [
 var auditTools = [
   {
     name: "viberaven_audit",
-    description: "Run local Vercel + Supabase production checks: table RLS presence, policy quality, view/function boundaries, service-role boundaries, and Vercel pooler usage. Call this when the project uses Supabase or Vercel and you need a focused infra audit beyond the general readiness gate. Pass json: true for machine-readable output.",
+    description: "Run local Vercel + Supabase production checks: table RLS presence, policy quality, view/function boundaries, service-role boundaries, and Vercel pooler usage. Call this when the project uses Supabase or Vercel and you need a focused infra audit beyond the general readiness check. Pass json: true for machine-readable output.",
     inputSchema: {
       type: "object",
       properties: {
@@ -93,7 +94,7 @@ var healSchema = {
 var healTools = [
   {
     name: "viberaven_heal_plan",
-    description: "Write a non-destructive heal plan for a specific gap or target file. Call this BEFORE viberaven_heal_apply to preview the exact repo-code change. Does not modify files.",
+    description: "Write a non-destructive heal plan (.viberaven/heal-plan.md) for a specific gap or target file, to review before viberaven_heal_apply. The plan names the target and the verify command. For rls_disabled it also shows the new migration it would write and its SQL, or why it will not write one; other gaps get no patch preview. Does not modify source files.",
     inputSchema: healSchema
   },
   {
@@ -103,7 +104,7 @@ var healTools = [
   },
   {
     name: "viberaven_heal_apply",
-    description: "Apply a guarded, low-risk repo-code heal recipe for a supported gap. Only call this after viberaven_heal_plan. Pass yes: true to skip confirmation. Returns the applied change summary.",
+    description: "Apply a guarded repo-code heal recipe for a supported gap. Only call this after viberaven_heal_plan. Pass yes: true to skip confirmation. The rls_disabled recipe writes a migration that enables row level security with no policies, so browser reads of those tables return no rows until policies exist: call it only after the user agrees. Its task leaves out yes: true; pass yes: true only once the user agrees. Returns the applied change summary, with any warnings.",
     inputSchema: healSchema
   }
 ];
@@ -112,7 +113,7 @@ var healTools = [
 var rulesTools = [
   {
     name: "viberaven_init_rules",
-    description: "Install bounded VibeRaven agent-instruction rules into native AI instruction files (CLAUDE.md / AGENTS.md / .cursor/rules). Call this once per project so coding agents pull VibeRaven into the deploy/auth/RLS workflow. Use dryRun: true to preview first.",
+    description: "Install bounded VibeRaven agent-instruction rules into native AI instruction files (CLAUDE.md / AGENTS.md / .cursor/rules), so coding agents know when a VibeRaven pass applies. Use dryRun: true to preview first.",
     inputSchema: {
       type: "object",
       properties: {
@@ -125,7 +126,7 @@ var rulesTools = [
   },
   {
     name: "viberaven_clean_plan",
-    description: "Write a non-destructive cleanup plan for generated .viberaven artifacts and logs. Call this when the .viberaven directory has grown stale. Does not delete anything \u2014 it only produces a reviewable plan.",
+    description: "Write a non-destructive cleanup plan for generated .viberaven artifacts and logs. Call this when the .viberaven directory has grown stale. Does not delete anything; it only produces a reviewable plan.",
     inputSchema: {
       type: "object",
       properties: { cwd: { type: "string", description: "Project root. Defaults to current working directory." } },
@@ -161,7 +162,7 @@ var actionTools = [
 var npmTools = [
   {
     name: "viberaven_validate_npm_package",
-    description: "Check whether an npm package name exists and looks safe before installing it. Call this BEFORE adding any new dependency. After installing, run viberaven_check_readiness to re-gate the change.",
+    description: "Look up npm package names on the public registry (registry.npmjs.org). Returns not_found when the registry has no such package or cannot be reached, suspicious when the registry answers with an error other than 404, and suspicious when the package was first published less than 14 days ago and its name is within 2 character edits of a popular package (a typosquat signal), or when it has an empty description, no listed maintainers and 3 or fewer published versions. Anything else is ok, which only means none of these signals fired; it is not a security review of the package. Useful when an agent is about to add a dependency the project has not used before.",
     inputSchema: {
       type: "object",
       properties: {
@@ -191,7 +192,7 @@ function mcpVersion() {
     } catch {
     }
   }
-  found ??= true ? "1.5.1" : void 0;
+  found ??= true ? "1.5.3" : void 0;
   if (!found || !PLAIN_VERSION.test(found)) {
     throw new Error(`Could not read a valid ${MCP_PACKAGE} version (got ${JSON.stringify(found)}), so the matching ${CLI_PACKAGE} cannot be pinned.`);
   }
@@ -361,8 +362,17 @@ async function handleRequest(method, params) {
 }
 
 // src/server.ts
-var SERVER_INFO = { name: "viberaven-mcp", version: "1.5.1" };
-var server = new import_server.Server(SERVER_INFO, { capabilities: { tools: {} } });
+var SERVER_INFO = { name: "viberaven-mcp", version: "1.5.3" };
+var INSTRUCTIONS = [
+  "VibeRaven reads a repository and lists launch gaps for AI-built apps that deploy on Vercel and use Supabase.",
+  "Suggest one viberaven_check_readiness run before such an app launches or is handed off, after a Supabase migration or policy change,",
+  "or when the user pastes a production error about RLS, env vars, the database connection, the service role key or a Stripe webhook.",
+  "This is advice, not a gate: the user decides when to ship.",
+  "It is a repository check, not a live database test. It cannot show which RLS policies are live in production, and a clear result is not a security audit.",
+  "Do not use it for apps that do not use Vercel and Supabase, for general SQL or deployment questions, or for one local error.",
+  "After fixes, call viberaven_verify once per batch, not after every edit."
+].join(" ");
+var server = new import_server.Server(SERVER_INFO, { capabilities: { tools: {} }, instructions: INSTRUCTIONS });
 server.setRequestHandler(
   import_types.ListToolsRequestSchema,
   async (request) => handleRequest("tools/list", request.params)
@@ -384,5 +394,6 @@ if (require.main === module) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ALL_TOOLS,
+  INSTRUCTIONS,
   SERVER_INFO
 });

package/dist/tools/index.js

@@ -39,7 +39,7 @@ var cwdSchema = {
 var readinessTools = [
   {
     name: "viberaven_check_readiness",
-    description: "Run BEFORE deploying, shipping to real users, or touching auth, database/RLS, billing, webhooks, or environment variables. Runs the local `viberaven check` (no login, no API key, no telemetry) for launch blockers (missing RLS, leaked secrets, unbounded queries, unsigned webhooks) and writes a prioritized task list to .viberaven/agent-tasklist.md plus a machine verdict to .viberaven/gate-result.json. Calling this first avoids wasted code-generation re-runs by surfacing production risks before you write code.",
+    description: "Useful before an AI-built app on Vercel and Supabase launches or is handed off. Runs the local `viberaven check` (no login, no API key, no telemetry), which reads the repository for launch gaps (missing RLS in migrations, leaked secrets, unbounded queries, unsigned webhooks) and writes a prioritized task list to .viberaven/agent-tasklist.md plus a verdict to .viberaven/gate-result.json. This is advice, not a gate: the user decides when to ship. It reads repo files and does not query the live database.",
     inputSchema: cwdSchema
   },
   {
@@ -49,17 +49,17 @@ var readinessTools = [
   },
   {
     name: "viberaven_strict_gate",
-    description: 'Run the strict production gate and return the machine verdict. Call this right before a deploy or CI pass to confirm gate.status === "clear". Returns JSON suitable for blocking a pipeline.',
+    description: "Run `viberaven --strict --json` and return the verdict from .viberaven/gate-result.json (gate.status is clear, warning or not_clear). Useful before a deploy or CI run when the user wants the verdict as JSON. The user decides whether to ship.",
     inputSchema: cwdSchema
   },
   {
     name: "viberaven_gate_result",
-    description: "Return the current contents of .viberaven/gate-result.json without re-scanning. Use this to read the last machine verdict before deciding whether to deploy.",
+    description: "Run a fresh local scan (`viberaven --json`) and return the verdict it writes to .viberaven/gate-result.json (gate.status is clear, warning or not_clear). It rewrites the .viberaven artifacts; it does not read an older result without scanning.",
     inputSchema: cwdSchema
   },
   {
     name: "viberaven_context_map",
-    description: "Refresh and return .viberaven/context-map.json \u2014 a compact summary of the last scan for the next agent step. Use this to load minimal context before acting on a gap.",
+    description: "Refresh and return .viberaven/context-map.json, a compact summary of the last scan for the next agent step. Use this to load minimal context before acting on a gap.",
     inputSchema: cwdSchema
   }
 ];
@@ -68,7 +68,7 @@ var readinessTools = [
 var auditTools = [
   {
     name: "viberaven_audit",
-    description: "Run local Vercel + Supabase production checks: table RLS presence, policy quality, view/function boundaries, service-role boundaries, and Vercel pooler usage. Call this when the project uses Supabase or Vercel and you need a focused infra audit beyond the general readiness gate. Pass json: true for machine-readable output.",
+    description: "Run local Vercel + Supabase production checks: table RLS presence, policy quality, view/function boundaries, service-role boundaries, and Vercel pooler usage. Call this when the project uses Supabase or Vercel and you need a focused infra audit beyond the general readiness check. Pass json: true for machine-readable output.",
     inputSchema: {
       type: "object",
       properties: {
@@ -94,7 +94,7 @@ var healSchema = {
 var healTools = [
   {
     name: "viberaven_heal_plan",
-    description: "Write a non-destructive heal plan for a specific gap or target file. Call this BEFORE viberaven_heal_apply to preview the exact repo-code change. Does not modify files.",
+    description: "Write a non-destructive heal plan (.viberaven/heal-plan.md) for a specific gap or target file, to review before viberaven_heal_apply. The plan names the target and the verify command. For rls_disabled it also shows the new migration it would write and its SQL, or why it will not write one; other gaps get no patch preview. Does not modify source files.",
     inputSchema: healSchema
   },
   {
@@ -104,7 +104,7 @@ var healTools = [
   },
   {
     name: "viberaven_heal_apply",
-    description: "Apply a guarded, low-risk repo-code heal recipe for a supported gap. Only call this after viberaven_heal_plan. Pass yes: true to skip confirmation. Returns the applied change summary.",
+    description: "Apply a guarded repo-code heal recipe for a supported gap. Only call this after viberaven_heal_plan. Pass yes: true to skip confirmation. The rls_disabled recipe writes a migration that enables row level security with no policies, so browser reads of those tables return no rows until policies exist: call it only after the user agrees. Its task leaves out yes: true; pass yes: true only once the user agrees. Returns the applied change summary, with any warnings.",
     inputSchema: healSchema
   }
 ];
@@ -113,7 +113,7 @@ var healTools = [
 var rulesTools = [
   {
     name: "viberaven_init_rules",
-    description: "Install bounded VibeRaven agent-instruction rules into native AI instruction files (CLAUDE.md / AGENTS.md / .cursor/rules). Call this once per project so coding agents pull VibeRaven into the deploy/auth/RLS workflow. Use dryRun: true to preview first.",
+    description: "Install bounded VibeRaven agent-instruction rules into native AI instruction files (CLAUDE.md / AGENTS.md / .cursor/rules), so coding agents know when a VibeRaven pass applies. Use dryRun: true to preview first.",
     inputSchema: {
       type: "object",
       properties: {
@@ -126,7 +126,7 @@ var rulesTools = [
   },
   {
     name: "viberaven_clean_plan",
-    description: "Write a non-destructive cleanup plan for generated .viberaven artifacts and logs. Call this when the .viberaven directory has grown stale. Does not delete anything \u2014 it only produces a reviewable plan.",
+    description: "Write a non-destructive cleanup plan for generated .viberaven artifacts and logs. Call this when the .viberaven directory has grown stale. Does not delete anything; it only produces a reviewable plan.",
     inputSchema: {
       type: "object",
       properties: { cwd: { type: "string", description: "Project root. Defaults to current working directory." } },
@@ -162,7 +162,7 @@ var actionTools = [
 var npmTools = [
   {
     name: "viberaven_validate_npm_package",
-    description: "Check whether an npm package name exists and looks safe before installing it. Call this BEFORE adding any new dependency. After installing, run viberaven_check_readiness to re-gate the change.",
+    description: "Look up npm package names on the public registry (registry.npmjs.org). Returns not_found when the registry has no such package or cannot be reached, suspicious when the registry answers with an error other than 404, and suspicious when the package was first published less than 14 days ago and its name is within 2 character edits of a popular package (a typosquat signal), or when it has an empty description, no listed maintainers and 3 or fewer published versions. Anything else is ok, which only means none of these signals fired; it is not a security review of the package. Useful when an agent is about to add a dependency the project has not used before.",
     inputSchema: {
       type: "object",
       properties: {
@@ -192,7 +192,7 @@ function mcpVersion() {
     } catch {
     }
   }
-  found ??= true ? "1.5.1" : void 0;
+  found ??= true ? "1.5.3" : void 0;
   if (!found || !PLAIN_VERSION.test(found)) {
     throw new Error(`Could not read a valid ${MCP_PACKAGE} version (got ${JSON.stringify(found)}), so the matching ${CLI_PACKAGE} cannot be pinned.`);
   }

package/package.json

@@ -1,56 +1,57 @@
-{
-  "name": "@viberaven/mcp",
-  "version": "1.5.1",
-  "description": "MCP server for VibeRaven production-readiness: check_readiness, verify, heal, audit, and strict gate tools for Cursor, Claude Code, and Codex.",
-  "license": "MIT",
-  "author": "VibeRaven",
-  "mcpName": "io.github.ohad6k/viberaven",
-  "homepage": "https://viberaven.dev/mcp.md",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ohad6k/VibeRaven.git",
-    "directory": "packages/mcp"
-  },
-  "bugs": {
-    "url": "https://github.com/ohad6k/VibeRaven/issues"
-  },
-  "keywords": [
-    "viberaven",
-    "mcp",
-    "claude-code",
-    "codex",
-    "cursor",
-    "launch-readiness",
-    "production"
-  ],
-  "publishConfig": {
-    "access": "public",
-    "tag": "latest"
-  },
-  "bin": {
-    "viberaven-mcp": "dist/server.js"
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "scripts": {
-    "build": "node scripts/build.mjs",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "presmoke": "npm run build",
-    "smoke": "node scripts/smoke.mjs",
-    "pretest": "npm run build",
-    "test": "vitest run"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0"
-  },
-  "devDependencies": {
-    "esbuild": "^0.25.0",
-    "typescript": "^5.8.0",
-    "vitest": "^3.2.0"
-  }
-}
+{
+  "name": "@viberaven/mcp",
+  "version": "1.5.3",
+  "description": "MCP server for VibeRaven production-readiness: check_readiness, verify, heal, audit, and strict gate tools for Cursor, Claude Code, and Codex.",
+  "license": "MIT",
+  "author": "VibeRaven",
+  "mcpName": "io.github.ohad6k/viberaven",
+  "homepage": "https://viberaven.dev/mcp.md",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ohad6k/VibeRaven.git",
+    "directory": "packages/mcp"
+  },
+  "bugs": {
+    "url": "https://github.com/ohad6k/VibeRaven/issues"
+  },
+  "keywords": [
+    "viberaven",
+    "mcp",
+    "claude-code",
+    "codex",
+    "cursor",
+    "launch-readiness",
+    "production"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "bin": {
+    "viberaven-mcp": "dist/server.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "presmoke": "npm run build",
+    "smoke": "node scripts/smoke.mjs",
+    "prepublishOnly": "npm run build && npm test",
+    "pretest": "npm run build",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  },
+  "devDependencies": {
+    "esbuild": "^0.25.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.2.0"
+  }
+}