code-auditor-mcp 4.1.0 → 5.0.1

package/dist/mcp.js

@@ -66,8 +66,9 @@ import chalk from 'chalk';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, InitializeRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
-import { createWriteStream } from 'node:fs';
+import { createWriteStream, mkdirSync, realpathSync } from 'node:fs';
 import fs from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
 import { createAuditRunner } from './auditRunner.js';
 import { searchFunctions, findDefinition, syncFileIndex, getDatabase } from './codeIndexService.js';
 import { CodeMapGenerator } from './services/CodeMapGenerator.js';
@@ -75,19 +76,27 @@ import { analyzeDocumentation } from './analyzers/documentationAnalyzer.js';
 import { ConfigGeneratorFactory } from './generators/ConfigGeneratorFactory.js';
 import { resolveConfigGenerateDir } from './config/configGeneratePath.js';
 import { getInstallId, getTelemetryOptIn, setTelemetryOptIn, PRIVACY_MESSAGE, resolveTelemetryEndpoint } from './installConfig.js';
-import { MCP_DEFAULT_ANALYZERS } from './analyzers/ruleRegistry.js';
 import { DEFAULT_SERVER_URL, IS_DEV_MODE, PACKAGE_VERSION } from './constants.js';
+import { resolveMcpDevLogPath } from './dataPaths.js';
 import { getAuditJobStatus, getAuditResultsPage, getAuditResultsAsSarif, startAuditJob } from './mcpAuditJobs.js';
 import { CodeIndexDB } from './codeIndexDB.js';
+import { errorMessage } from './utils/errorMessage.js';
 import { logMcpDebug, logMcpInfo, mcpDebugStderr, mcpTraceStderr } from './mcpDiagnostics.js';
 import { assertAuditPathExists, formatMcpToolErrorPayload } from './mcpToolErrors.js';
 import { ToolRegistry } from './tool-registry.js';
 import { initParsers } from './languages/index.js';
 // ── Console / logging setup ──────────────────────────────────────────────────
 const originalConsoleError = console.error;
+// Tool input-schema descriptions, hoisted so the repeated schema entries
+// share one source.
+const OPTION_ANALYZER_OVERRIDES = 'Analyzer-specific configuration overrides.';
+const PROJECT_ROOT_DESCRIPTION = 'Project root.';
 let logStream = null;
 if (IS_DEV_MODE) {
-    const logFilePath = path.join(process.cwd(), 'mcp-server.log');
+    // Dev mode is opt-in (`--dev`); even so, the log lives in the OS cache, never
+    // in cwd — a consumer that opts in must not get a bare file in their tree.
+    const logFilePath = resolveMcpDevLogPath();
+    mkdirSync(path.dirname(logFilePath), { recursive: true });
     logStream = createWriteStream(logFilePath, { flags: 'a' });
     console.error(chalk.blue('[INFO]'), `Development mode: Logging to file: ${logFilePath}`);
 }
@@ -130,10 +139,17 @@ async function withAbortSignal(signal, phase, op) {
     return new Promise((resolve, reject) => {
         const onAbort = () => reject(new RequestAbortedError(`Request aborted during ${phase}`));
         signal.addEventListener('abort', onAbort, { once: true });
-        void op()
-            .then(resolve)
-            .catch(reject)
-            .finally(() => signal.removeEventListener('abort', onAbort));
+        void (async () => {
+            try {
+                resolve(await op());
+            }
+            catch (err) {
+                reject(err);
+            }
+            finally {
+                signal.removeEventListener('abort', onAbort);
+            }
+        })();
     });
 }
 function serializeForMcp(value) {
@@ -205,469 +221,386 @@ function registerProcessReliabilityHandlers() {
     }
 }
 // ── Tool registration ────────────────────────────────────────────────────────
-const DEFAULT_ANALYZERS = [...MCP_DEFAULT_ANALYZERS];
-function registerAllTools(registry) {
-    // ── audit ──────────────────────────────────────────────────────────────────
-    const auditActions = [
-        {
-            name: 'run',
-            description: 'Run a synchronous audit on the specified path. Returns a full audit result with violations.',
-            parameters: [
-                {
-                    name: 'path',
-                    type: 'string',
-                    required: false,
-                    description: 'File or directory path to audit (defaults to current directory).',
-                    default: process.cwd(),
-                },
-                {
-                    name: 'analyzers',
-                    type: 'array',
-                    required: false,
-                    description: `Analyzers to run (default: ${DEFAULT_ANALYZERS.join(', ')}).`,
-                    default: DEFAULT_ANALYZERS,
-                },
-                {
-                    name: 'minSeverity',
-                    type: 'string',
-                    required: false,
-                    description: 'Minimum severity level to report (high included by default).',
-                    default: 'high',
-                    enum: ['high', 'severe', 'critical'],
-                },
-                {
-                    name: 'indexFunctions',
-                    type: 'boolean',
-                    required: false,
-                    description: 'Index functions during audit (default: true).',
-                    default: true,
-                },
-                {
-                    name: 'analyzerConfigs',
-                    type: 'object',
-                    required: false,
-                    description: 'Analyzer-specific configuration overrides.',
-                },
-                {
-                    name: 'scope',
-                    type: 'string',
-                    required: false,
-                    description: 'Audit scope: "all" (default), "changed" (files differing from index), "git:<ref>" (diff against a git ref), or a comma-separated list of file paths.',
-                    default: 'all',
-                },
-            ],
-            handler: async (args, signal) => {
-                return withAbortSignal(signal, 'audit.run', async () => {
-                    const auditPath = path.resolve(args.path || process.cwd());
-                    await assertAuditPathExists(auditPath);
-                    const analyzers = args.analyzers ?? DEFAULT_ANALYZERS;
-                    const minSeverity = (args.minSeverity || 'high');
-                    const indexFunctions = args.indexFunctions !== false;
-                    const db = CodeIndexDB.getInstance();
-                    await db.initialize();
-                    const storedConfigs = await db.getAllAnalyzerConfigs(auditPath);
-                    const analyzerConfigs = {
-                        ...storedConfigs,
-                        ...(args.analyzerConfigs || {}),
-                    };
-                    const scope = args.scope || 'all';
-                    const runner = createAuditRunner({
-                        projectRoot: auditPath,
-                        enabledAnalyzers: analyzers,
-                        minSeverity,
-                        verbose: false,
-                        indexFunctions,
-                        scope: scope !== 'all' ? scope : undefined,
-                        ...(Object.keys(analyzerConfigs).length > 0 && { analyzerConfigs }),
-                    });
-                    const auditResult = await runner.run();
-                    if (indexFunctions && auditResult.metadata.fileToFunctionsMap) {
-                        try {
-                            for (const [filePath, functions] of Object.entries(auditResult.metadata.fileToFunctionsMap)) {
-                                await syncFileIndex(filePath, functions);
-                            }
-                        }
-                        catch {
-                            // indexing is best-effort for sync audit
-                        }
-                    }
-                    return {
-                        success: true,
-                        summary: auditResult.summary,
-                        violations: auditResult.analyzerResults,
-                        metadata: auditResult.metadata,
-                        guidance: 'The audit takes readings, not verdicts. Severity is urgency — how fast a defect bites, never whether you may ignore it; there is no "noise" tier. Work criticals first, then severe, then high. The coverage panel tells you what was actually measured. Documentation readings (missing JSDoc) are maintainability gaps. If you decline a reading, record why instead of silently dismissing it.',
-                    };
-                });
+// ── audit ──────────────────────────────────────────────────────────────────
+const auditActions = [
+    {
+        name: 'run',
+        description: 'Run a synchronous audit on the specified path. Returns a full audit result with violations.',
+        parameters: [
+            {
+                name: 'path',
+                type: 'string',
+                required: false,
+                description: 'File or directory path to audit (defaults to current directory).',
+                default: process.cwd(),
             },
-        },
-        {
-            name: 'start',
-            description: 'Start a background audit job. Returns immediately with a jobId. Poll `audit.status` until completed, then fetch pages with `audit.results`.',
-            parameters: [
-                {
-                    name: 'path',
-                    type: 'string',
-                    required: false,
-                    description: 'File or directory path to audit (defaults to current directory).',
-                    default: process.cwd(),
-                },
-                {
-                    name: 'analyzers',
-                    type: 'array',
-                    required: false,
-                    description: `Analyzers to run (default: ${DEFAULT_ANALYZERS.join(', ')}).`,
-                    default: DEFAULT_ANALYZERS,
-                },
-                {
-                    name: 'minSeverity',
-                    type: 'string',
-                    required: false,
-                    description: 'Minimum severity level to report (high included by default).',
-                    default: 'high',
-                    enum: ['high', 'severe', 'critical'],
-                },
-                {
-                    name: 'indexFunctions',
-                    type: 'boolean',
-                    required: false,
-                    description: 'Index functions during audit (default: true).',
-                    default: true,
-                },
-                {
-                    name: 'analyzerConfigs',
-                    type: 'object',
-                    required: false,
-                    description: 'Analyzer-specific configuration overrides.',
-                },
-                {
-                    name: 'scope',
-                    type: 'string',
-                    required: false,
-                    description: 'Audit scope: "all" (default), "changed" (files differing from index), "git:<ref>" (diff against a git ref), or a comma-separated list of file paths.',
-                    default: 'all',
-                },
-                {
-                    name: 'analyzerConcurrency',
-                    type: 'number',
-                    required: false,
-                    description: 'Max analyzers to run in parallel (default: 1).',
-                    default: 1,
-                },
-                {
-                    name: 'partitionStrategy',
-                    type: 'string',
-                    required: false,
-                    description: 'Partition mode: none | auto | top-level.',
-                    default: 'auto',
-                    enum: ['none', 'auto', 'top-level'],
-                },
-                {
-                    name: 'maxPartitions',
-                    type: 'number',
-                    required: false,
-                    description: 'Maximum number of folder partitions (default: 4).',
-                    default: 4,
-                },
-                {
-                    name: 'partitionThresholdFiles',
-                    type: 'number',
-                    required: false,
-                    description: 'Minimum files before auto partitioning (default: 250).',
-                    default: 250,
-                },
-                {
-                    name: 'workerCount',
-                    type: 'number',
-                    required: false,
-                    description: 'Number of worker processes (default: min(4, CPU-1)).',
-                },
-                {
-                    name: 'maxRetries',
-                    type: 'number',
-                    required: false,
-                    description: 'Retry attempts per shard (default: 1).',
-                    default: 1,
-                },
-                {
-                    name: 'shardTimeoutMs',
-                    type: 'number',
-                    required: false,
-                    description: 'Per-shard timeout in ms (default: 180000).',
-                    default: 180000,
-                },
-                {
-                    name: 'retryBackoffMs',
-                    type: 'number',
-                    required: false,
-                    description: 'Base retry backoff in ms (default: 500).',
-                    default: 500,
-                },
-                {
-                    name: 'jobTimeoutMs',
-                    type: 'number',
-                    required: false,
-                    description: 'Max wall time for the audit job (default 30m, cap 4h).',
-                },
-                {
-                    name: 'maxFilesPerRun',
-                    type: 'number',
-                    required: false,
-                    description: 'Per worker chunk size for file processing.',
-                },
-                {
-                    name: 'shardSoftBudgetMs',
-                    type: 'number',
-                    required: false,
-                    description: 'Per worker soft wall-clock budget.',
-                },
-                {
-                    name: 'generateCodeMap',
-                    type: 'boolean',
-                    required: false,
-                    description: 'Generate code map artifacts during audit (default: false).',
-                    default: false,
-                },
-            ],
-            handler: async (args, signal) => {
-                return withAbortSignal(signal, 'audit.start', () => startAuditJob(args, {
-                    defaultAnalyzers: DEFAULT_ANALYZERS,
-                    defaultMinSeverity: 'high',
-                    defaultGenerateCodeMap: false,
-                }));
+            {
+                name: 'minSeverity',
+                type: 'string',
+                required: false,
+                description: 'Minimum severity level to report (high included by default).',
+                default: 'high',
+                enum: ['high', 'severe', 'critical'],
             },
-        },
-        {
-            name: 'status',
-            description: 'Get current status for a previously started background audit job.',
-            parameters: [
-                {
-                    name: 'jobId',
-                    type: 'string',
-                    required: true,
-                    description: 'Job ID returned by `audit start`.',
-                },
-            ],
-            handler: async (args) => {
-                const jobId = args.jobId;
-                if (!jobId)
-                    throw new Error('audit.status requires jobId');
-                return await getAuditJobStatus(jobId);
+            {
+                name: 'indexFunctions',
+                type: 'boolean',
+                required: false,
+                description: 'Index functions during audit (default: true).',
+                default: true,
             },
-        },
-        {
-            name: 'results',
-            description: 'Fetch paginated violations for a completed audit result by resultId.',
-            parameters: [
-                {
-                    name: 'resultId',
-                    type: 'string',
-                    required: false,
-                    description: 'Result ID returned by `audit status` when completed. Also accepts legacy `auditId`.',
-                },
-                {
-                    name: 'auditId',
-                    type: 'string',
-                    required: false,
-                    description: 'Backward-compatible alias for resultId.',
-                },
-                {
-                    name: 'limit',
-                    type: 'number',
-                    required: false,
-                    description: 'Maximum violations per page (default: 50, max: 100).',
-                    default: 50,
-                },
-                {
-                    name: 'offset',
-                    type: 'number',
-                    required: false,
-                    description: 'Violation offset for pagination (default: 0).',
-                    default: 0,
-                },
-                {
-                    name: 'format',
-                    type: 'string',
-                    required: false,
-                    description: 'Output format. "json" (default, structured data) or "sarif" (SARIF 2.1.0 JSON string).',
-                },
-            ],
-            handler: async (args, signal) => {
-                const format = args.format || 'json';
-                if (format === 'sarif') {
-                    return withAbortSignal(signal, 'audit.results', () => getAuditResultsAsSarif(args));
-                }
-                return withAbortSignal(signal, 'audit.results', () => getAuditResultsPage(args));
+            {
+                name: 'analyzerConfigs',
+                type: 'object',
+                required: false,
+                description: OPTION_ANALYZER_OVERRIDES,
             },
-        },
-        {
-            name: 'health',
-            description: 'Quick health check of a codebase with key metrics and optional code map generation.',
-            parameters: [
-                {
-                    name: 'path',
-                    type: 'string',
-                    required: false,
-                    description: 'The directory path to check.',
-                    default: process.cwd(),
-                },
-                {
-                    name: 'threshold',
-                    type: 'number',
-                    required: false,
-                    description: 'Health score threshold (0-100) for pass/fail.',
-                    default: 70,
-                },
-                {
-                    name: 'indexFunctions',
-                    type: 'boolean',
-                    required: false,
-                    description: 'Automatically index functions during health check.',
-                    default: true,
-                },
-                {
-                    name: 'analyzerConfigs',
-                    type: 'object',
-                    required: false,
-                    description: 'Analyzer-specific configuration overrides.',
-                },
-                {
-                    name: 'generateCodeMap',
-                    type: 'boolean',
-                    required: false,
-                    description: 'Generate and return a human-readable code map.',
-                    default: true,
-                },
-            ],
-            handler: async (args) => {
+            {
+                name: 'scope',
+                type: 'string',
+                required: false,
+                description: 'Audit scope: "all" (default), "changed" (files differing from index), "git:<ref>" (diff against a git ref), or a comma-separated list of file paths.',
+                default: 'all',
+            },
+        ],
+        handler: async (args, signal) => {
+            return withAbortSignal(signal, 'audit.run', async () => {
                 const auditPath = path.resolve(args.path || process.cwd());
                 await assertAuditPathExists(auditPath);
-                const threshold = args.threshold || 70;
+                const minSeverity = (args.minSeverity || 'high');
                 const indexFunctions = args.indexFunctions !== false;
-                const generateCodeMap = args.generateCodeMap !== false;
                 const db = CodeIndexDB.getInstance();
                 await db.initialize();
-                const storedConfigs = await db.getAllAnalyzerConfigs(auditPath);
+                const storedConfigs = await db.analyzerConfig.getAllAnalyzerConfigs(auditPath);
                 const analyzerConfigs = {
                     ...storedConfigs,
                     ...(args.analyzerConfigs || {}),
                 };
-                const runner = createAuditRunner({
+                const scope = args.scope || 'all';
+                // Route through the single audit entry point shared with the CLI, so
+                // `.go` files dispatch to the Go phase rules instead of being silently
+                // skipped (task #255 — the stdio MCP server bypassed per-language
+                // dispatch and left every Go rule `notApplicable`).
+                const auditResult = await createAuditRunner({
                     projectRoot: auditPath,
-                    enabledAnalyzers: DEFAULT_ANALYZERS,
-                    minSeverity: 'high',
+                    minSeverity,
                     verbose: false,
                     indexFunctions,
+                    scope: scope !== 'all' ? scope : undefined,
                     ...(Object.keys(analyzerConfigs).length > 0 && { analyzerConfigs }),
-                    progressCallback: (p) => {
-                        if (p.phase === 'function-indexing' &&
-                            typeof p.current === 'number' &&
-                            typeof p.total === 'number' &&
-                            p.total > 0 &&
-                            p.current % 50 !== 0 &&
-                            p.current !== p.total)
-                            return;
-                        logMcpDebug('audit.health', p.message ?? p.phase ?? 'progress', {
-                            phase: p.phase,
-                            analyzer: p.analyzer,
-                            current: p.current,
-                            total: p.total,
-                        });
-                    },
-                });
-                const auditResult = await runner.run();
-                const healthScore = calculateHealthScore(auditResult);
-                let indexingResult = null;
+                }).run();
                 if (indexFunctions && auditResult.metadata.fileToFunctionsMap) {
                     try {
-                        const syncStats = { added: 0, updated: 0, removed: 0 };
                         for (const [filePath, functions] of Object.entries(auditResult.metadata.fileToFunctionsMap)) {
-                            const fileStats = await syncFileIndex(filePath, functions);
-                            syncStats.added += fileStats.added;
-                            syncStats.updated += fileStats.updated;
-                            syncStats.removed += fileStats.removed;
+                            await syncFileIndex(filePath, functions);
                         }
-                        indexingResult = {
-                            success: true,
-                            registered: syncStats.added + syncStats.updated,
-                            failed: 0,
-                            syncStats,
-                        };
                     }
                     catch {
-                        // best-effort
+                        // indexing is best-effort for sync audit
                     }
                 }
-                let codeMapResult = null;
-                if (generateCodeMap && indexingResult && indexingResult.success) {
+                return {
+                    success: true,
+                    summary: auditResult.summary,
+                    violations: auditResult.analyzerResults,
+                    metadata: auditResult.metadata,
+                    guidance: 'The audit takes readings, not verdicts. Severity is urgency — how fast a defect bites, never whether you may ignore it; there is no "noise" tier. Work criticals first, then severe, then high. The coverage panel tells you what was actually measured. Documentation readings (missing JSDoc) are maintainability gaps. If you decline a reading, record why instead of silently dismissing it.',
+                };
+            });
+        },
+    },
+    {
+        name: 'start',
+        description: 'Start a background audit job. Returns immediately with a jobId. Poll `audit.status` until completed, then fetch pages with `audit.results`.',
+        parameters: [
+            {
+                name: 'path',
+                type: 'string',
+                required: false,
+                description: 'File or directory path to audit (defaults to current directory).',
+                default: process.cwd(),
+            },
+            {
+                name: 'minSeverity',
+                type: 'string',
+                required: false,
+                description: 'Minimum severity level to report (high included by default).',
+                default: 'high',
+                enum: ['high', 'severe', 'critical'],
+            },
+            {
+                name: 'indexFunctions',
+                type: 'boolean',
+                required: false,
+                description: 'Index functions during audit (default: true).',
+                default: true,
+            },
+            {
+                name: 'analyzerConfigs',
+                type: 'object',
+                required: false,
+                description: OPTION_ANALYZER_OVERRIDES,
+            },
+            {
+                name: 'scope',
+                type: 'string',
+                required: false,
+                description: 'Audit scope: "all" (default), "changed" (files differing from index), "git:<ref>" (diff against a git ref), or a comma-separated list of file paths.',
+                default: 'all',
+            },
+            {
+                name: 'jobTimeoutMs',
+                type: 'number',
+                required: false,
+                description: 'Max wall time for the audit job (default 30m, cap 4h).',
+            },
+            {
+                name: 'generateCodeMap',
+                type: 'boolean',
+                required: false,
+                description: 'Generate code map artifacts during audit (default: false).',
+                default: false,
+            },
+        ],
+        handler: async (args, signal) => {
+            return withAbortSignal(signal, 'audit.start', () => startAuditJob(args, {
+                defaultMinSeverity: 'high',
+                defaultGenerateCodeMap: false,
+            }));
+        },
+    },
+    {
+        name: 'status',
+        description: 'Get current status for a previously started background audit job.',
+        parameters: [
+            {
+                name: 'jobId',
+                type: 'string',
+                required: true,
+                description: 'Job ID returned by `audit start`.',
+            },
+        ],
+        handler: async (args) => {
+            const jobId = args.jobId;
+            if (!jobId)
+                throw new Error('audit.status requires jobId');
+            return await getAuditJobStatus(jobId);
+        },
+    },
+    {
+        name: 'results',
+        description: 'Fetch paginated violations for a completed audit result by resultId.',
+        parameters: [
+            {
+                name: 'resultId',
+                type: 'string',
+                required: false,
+                description: 'Result ID returned by `audit status` when completed. Also accepts legacy `auditId`.',
+            },
+            {
+                name: 'auditId',
+                type: 'string',
+                required: false,
+                description: 'Backward-compatible alias for resultId.',
+            },
+            {
+                name: 'limit',
+                type: 'number',
+                required: false,
+                description: 'Maximum violations per page (default: 50, max: 100).',
+                default: 50,
+            },
+            {
+                name: 'offset',
+                type: 'number',
+                required: false,
+                description: 'Violation offset for pagination (default: 0).',
+                default: 0,
+            },
+            {
+                name: 'format',
+                type: 'string',
+                required: false,
+                description: 'Output format. "json" (default, structured data) or "sarif" (SARIF 2.1.0 JSON string).',
+            },
+        ],
+        handler: async (args, signal) => {
+            const format = args.format || 'json';
+            if (format === 'sarif') {
+                return withAbortSignal(signal, 'audit.results', () => getAuditResultsAsSarif(args));
+            }
+            return withAbortSignal(signal, 'audit.results', () => getAuditResultsPage(args));
+        },
+    },
+    {
+        name: 'health',
+        description: 'Quick health check of a codebase with key metrics and optional code map generation.',
+        parameters: [
+            {
+                name: 'path',
+                type: 'string',
+                required: false,
+                description: 'The directory path to check.',
+                default: process.cwd(),
+            },
+            {
+                name: 'threshold',
+                type: 'number',
+                required: false,
+                description: 'Health score threshold (0-100) for pass/fail.',
+                default: 70,
+            },
+            {
+                name: 'indexFunctions',
+                type: 'boolean',
+                required: false,
+                description: 'Automatically index functions during health check.',
+                default: true,
+            },
+            {
+                name: 'analyzerConfigs',
+                type: 'object',
+                required: false,
+                description: OPTION_ANALYZER_OVERRIDES,
+            },
+            {
+                name: 'generateCodeMap',
+                type: 'boolean',
+                required: false,
+                description: 'Generate and return a human-readable code map.',
+                default: true,
+            },
+        ],
+        handler: async (args) => {
+            const auditPath = path.resolve(args.path || process.cwd());
+            await assertAuditPathExists(auditPath);
+            const threshold = args.threshold || 70;
+            const indexFunctions = args.indexFunctions !== false;
+            const generateCodeMap = args.generateCodeMap !== false;
+            const db = CodeIndexDB.getInstance();
+            await db.initialize();
+            const storedConfigs = await db.analyzerConfig.getAllAnalyzerConfigs(auditPath);
+            const analyzerConfigs = {
+                ...storedConfigs,
+                ...(args.analyzerConfigs || {}),
+            };
+            const auditResult = await createAuditRunner({
+                projectRoot: auditPath,
+                minSeverity: 'high',
+                verbose: false,
+                indexFunctions,
+                ...(Object.keys(analyzerConfigs).length > 0 && { analyzerConfigs }),
+                progressCallback: (p) => {
+                    if (p.phase === 'function-indexing' &&
+                        typeof p.current === 'number' &&
+                        typeof p.total === 'number' &&
+                        p.total > 0 &&
+                        p.current % 50 !== 0 &&
+                        p.current !== p.total)
+                        return;
+                    logMcpDebug('audit.health', p.message ?? p.phase ?? 'progress', {
+                        phase: p.phase,
+                        analyzer: p.analyzer,
+                        current: p.current,
+                        total: p.total,
+                    });
+                },
+            }).run();
+            const healthScore = calculateHealthScore(auditResult);
+            let indexingResult = null;
+            if (indexFunctions && auditResult.metadata.fileToFunctionsMap) {
+                try {
+                    const syncStats = { added: 0, updated: 0, removed: 0 };
+                    for (const [filePath, functions] of Object.entries(auditResult.metadata.fileToFunctionsMap)) {
+                        const fileStats = await syncFileIndex(filePath, functions);
+                        syncStats.added += fileStats.added;
+                        syncStats.updated += fileStats.updated;
+                        syncStats.removed += fileStats.removed;
+                    }
+                    indexingResult = {
+                        success: true,
+                        registered: syncStats.added + syncStats.updated,
+                        failed: 0,
+                        syncStats,
+                    };
+                }
+                catch {
+                    // best-effort
+                }
+            }
+            let codeMapResult = null;
+            if (generateCodeMap && indexingResult && indexingResult.success) {
+                try {
+                    const mapGenerator = new CodeMapGenerator();
+                    const mapOptions = {
+                        includeComplexity: true,
+                        includeDocumentation: true,
+                        includeDependencies: true,
+                        includeUsage: false,
+                        groupByDirectory: true,
+                        maxDepth: 8,
+                        showUnusedImports: true,
+                        minComplexity: 7,
+                    };
+                    let documentation;
                     try {
-                        const mapGenerator = new CodeMapGenerator();
-                        const mapOptions = {
-                            includeComplexity: true,
-                            includeDocumentation: true,
-                            includeDependencies: true,
-                            includeUsage: false,
-                            groupByDirectory: true,
-                            maxDepth: 8,
-                            showUnusedImports: true,
-                            minComplexity: 7,
-                        };
-                        let documentation;
-                        try {
-                            const files = Object.keys(auditResult.metadata.fileToFunctionsMap || {});
-                            if (files.length > 0) {
-                                const docResult = await analyzeDocumentation(files);
-                                documentation = docResult.metrics;
-                            }
-                        }
-                        catch {
-                            // best-effort
+                        const files = Object.keys(auditResult.metadata.fileToFunctionsMap || {});
+                        if (files.length > 0) {
+                            const docResult = await analyzeDocumentation(files);
+                            documentation = docResult.metrics;
                         }
-                        const paginatedResult = await mapGenerator.generatePaginatedCodeMap(auditPath, {
-                            ...mapOptions,
-                            includeDocumentation: !!documentation,
-                        });
-                        codeMapResult = {
-                            success: true,
-                            mapId: paginatedResult.mapId,
-                            summary: paginatedResult.summary,
-                            quickPreview: paginatedResult.quickPreview,
-                            sections: paginatedResult.summary.sectionsAvailable,
-                            documentationCoverage: documentation?.coverageScore,
-                        };
                     }
-                    catch (error) {
-                        codeMapResult = {
-                            success: false,
-                            error: error instanceof Error ? error.message : 'Failed to generate code map',
-                        };
+                    catch {
+                        // best-effort
                     }
+                    const paginatedResult = await mapGenerator.generatePaginatedCodeMap(auditPath, {
+                        ...mapOptions,
+                        includeDocumentation: !!documentation,
+                    });
+                    codeMapResult = {
+                        success: true,
+                        mapId: paginatedResult.mapId,
+                        summary: paginatedResult.summary,
+                        quickPreview: paginatedResult.quickPreview,
+                        sections: paginatedResult.summary.sectionsAvailable,
+                        documentationCoverage: documentation?.coverageScore,
+                    };
                 }
-                return {
-                    healthScore,
-                    threshold,
-                    passed: healthScore >= threshold,
-                    status: healthScore >= threshold ? 'healthy' : 'needs-attention',
-                    metrics: {
-                        filesAnalyzed: auditResult.metadata.filesAnalyzed,
-                        totalViolations: auditResult.summary.totalViolations,
-                        criticalViolations: auditResult.summary.criticalIssues,
-                        severeViolations: auditResult.summary.severe,
-                        highViolations: auditResult.summary.high,
-                    },
-                    recommendation: getHealthRecommendation(healthScore, auditResult),
-                    ...(indexingResult && { functionIndexing: indexingResult }),
-                    ...(codeMapResult && { codeMap: codeMapResult }),
-                };
-            },
+                catch (error) {
+                    codeMapResult = {
+                        success: false,
+                        error: error instanceof Error ? error.message : 'Failed to generate code map',
+                    };
+                }
+            }
+            return {
+                healthScore,
+                threshold,
+                passed: healthScore >= threshold,
+                status: healthScore >= threshold ? 'healthy' : 'needs-attention',
+                metrics: {
+                    filesAnalyzed: auditResult.metadata.filesAnalyzed,
+                    totalViolations: auditResult.summary.totalViolations,
+                    criticalViolations: auditResult.summary.criticalIssues,
+                    severeViolations: auditResult.summary.severe,
+                    highViolations: auditResult.summary.high,
+                },
+                recommendation: getHealthRecommendation(healthScore, auditResult),
+                ...(indexingResult && { functionIndexing: indexingResult }),
+                ...(codeMapResult && { codeMap: codeMapResult }),
+            };
         },
-    ];
+    },
+];
+function registerAuditTool(registry) {
     registry.register({
         name: 'audit',
         description: 'Run code quality audits (synchronous or background), check status, fetch paginated results, and get health checks. Actions: run (sync audit, returns full results), start (background job), status (poll a job), results (paginated violations), health (score + code map).',
         actions: auditActions,
     });
-    // ── search ─────────────────────────────────────────────────────────────────
+}
+// ── search ─────────────────────────────────────────────────────────────────
+function registerSearchTool(registry) {
     registry.register({
         name: 'search',
         description: 'Search indexed functions and components. Actions: query (natural language + operators like entity:, component:, hook:, dep:, calls:, lang:, complexity:, exported:, jsdoc:, file:, unused-imports, name:), definition (exact function/component lookup).',
@@ -741,7 +674,9 @@ function registerAllTools(registry) {
             },
         ],
     });
-    // ── index ──────────────────────────────────────────────────────────────────
+}
+// ── index ──────────────────────────────────────────────────────────────────
+function registerIndexTool(registry) {
     registry.register({
         name: 'index',
         description: 'Manage the code index. Actions: sync (update from files with optional auto-whitelist), cleanup (remove deleted files), reset (clear analysis data, preserve tasks/config/whitelist), status (index statistics).',
@@ -857,7 +792,7 @@ function registerAllTools(registry) {
                 handler: async () => {
                     const db = CodeIndexDB.getInstance();
                     await db.initialize();
-                    const functionCount = await db.getFunctionCount();
+                    const functionCount = await db.functionIndex.getFunctionCount();
                     return {
                         success: true,
                         functionCount,
@@ -866,426 +801,431 @@ function registerAllTools(registry) {
             },
         ],
     });
-    // ── config ─────────────────────────────────────────────────────────────────
-    registry.register({
-        name: 'config',
-        description: 'Manage analyzer configurations, generate AI tool configs, manage whitelists, and manage invariant rules. Actions: get, set, reset (analyzer configs), generate (AI tool config files), whitelist_list, whitelist_add, whitelist_update, whitelist_detect, rules_list, rules_check.',
-        actions: [
+}
+// ── config ─────────────────────────────────────────────────────────────────
+const configActions = [
+    {
+        name: 'get',
+        description: 'Get current configuration for an analyzer (or all).',
+        parameters: [
             {
-                name: 'get',
-                description: 'Get current configuration for an analyzer (or all).',
-                parameters: [
-                    {
-                        name: 'analyzerName',
-                        type: 'string',
-                        required: false,
-                        description: 'Specific analyzer name, or omit to get all configs.',
-                    },
-                    {
-                        name: 'projectPath',
-                        type: 'string',
-                        required: false,
-                        description: 'Optional project path for project-specific config.',
-                    },
-                ],
-                handler: async (args) => {
-                    const analyzerName = args.analyzerName;
-                    const projectPath = args.projectPath;
-                    const db = CodeIndexDB.getInstance();
-                    await db.initialize();
-                    if (analyzerName) {
-                        const config = await db.getAnalyzerConfig(analyzerName, projectPath);
-                        return {
-                            success: true,
-                            analyzer: analyzerName,
-                            config: config || null,
-                            scope: projectPath ? 'project' : 'global',
-                            message: config ? 'Configuration found' : 'No custom configuration found, using defaults',
-                        };
-                    }
-                    const configs = await db.getAllAnalyzerConfigs(projectPath);
-                    return {
-                        success: true,
-                        configs,
-                        scope: projectPath ? 'project' : 'global',
-                        message: `Found ${Object.keys(configs).length} analyzer configurations`,
-                    };
-                },
+                name: 'analyzerName',
+                type: 'string',
+                required: false,
+                description: 'Specific analyzer name, or omit to get all configs.',
             },
             {
-                name: 'set',
-                description: 'Set or update analyzer configuration that persists across audit runs.',
-                parameters: [
-                    {
-                        name: 'analyzerName',
-                        type: 'string',
-                        required: true,
-                        description: 'The analyzer to configure (solid, dry, security, etc.).',
-                    },
-                    {
-                        name: 'config',
-                        type: 'object',
-                        required: true,
-                        description: 'Configuration object for the analyzer (e.g., thresholds, rules).',
-                    },
-                    {
-                        name: 'projectPath',
-                        type: 'string',
-                        required: false,
-                        description: 'Optional project path for project-specific config.',
-                    },
-                ],
-                handler: async (args) => {
-                    const analyzerName = args.analyzerName;
-                    const config = args.config;
-                    const projectPath = args.projectPath;
-                    const db = CodeIndexDB.getInstance();
-                    await db.initialize();
-                    await db.storeAnalyzerConfig(analyzerName, config, {
-                        projectPath,
-                        isGlobal: !projectPath,
-                    });
-                    return {
-                        success: true,
-                        message: `Configuration for ${analyzerName} analyzer has been saved${projectPath ? ` for project ${projectPath}` : ' globally'}`,
-                        analyzer: analyzerName,
-                        scope: projectPath ? 'project' : 'global',
-                        config,
-                    };
-                },
+                name: 'projectPath',
+                type: 'string',
+                required: false,
+                description: 'Optional project path for project-specific config.',
             },
+        ],
+        handler: async (args) => {
+            const analyzerName = args.analyzerName;
+            const projectPath = args.projectPath;
+            const db = CodeIndexDB.getInstance();
+            await db.initialize();
+            if (analyzerName) {
+                const config = await db.analyzerConfig.getAnalyzerConfig(analyzerName, projectPath);
+                return {
+                    success: true,
+                    analyzer: analyzerName,
+                    config: config || null,
+                    scope: projectPath ? 'project' : 'global',
+                    message: config ? 'Configuration found' : 'No custom configuration found, using defaults',
+                };
+            }
+            const configs = await db.analyzerConfig.getAllAnalyzerConfigs(projectPath);
+            return {
+                success: true,
+                configs,
+                scope: projectPath ? 'project' : 'global',
+                message: `Found ${Object.keys(configs).length} analyzer configurations`,
+            };
+        },
+    },
+    {
+        name: 'set',
+        description: 'Set or update analyzer configuration that persists across audit runs.',
+        parameters: [
             {
-                name: 'reset',
-                description: 'Reset analyzer configuration to defaults.',
-                parameters: [
-                    {
-                        name: 'analyzerName',
-                        type: 'string',
-                        required: false,
-                        description: 'Specific analyzer to reset, or omit to reset all.',
-                    },
-                    {
-                        name: 'projectPath',
-                        type: 'string',
-                        required: false,
-                        description: 'Optional project path to reset only project-specific config.',
-                    },
-                ],
-                handler: async (args) => {
-                    const analyzerName = args.analyzerName;
-                    const projectPath = args.projectPath;
-                    const db = CodeIndexDB.getInstance();
-                    await db.initialize();
-                    if (analyzerName) {
-                        const deleted = await db.deleteAnalyzerConfig(analyzerName, {
-                            projectPath,
-                            isGlobal: !projectPath,
-                        });
-                        return {
-                            success: deleted,
-                            message: deleted
-                                ? `Configuration for ${analyzerName} analyzer has been reset${projectPath ? ` for project ${projectPath}` : ' globally'}`
-                                : `No configuration found for ${analyzerName} analyzer`,
-                            analyzer: analyzerName,
-                            scope: projectPath ? 'project' : 'global',
-                        };
-                    }
-                    await db.resetAnalyzerConfigs(projectPath);
-                    return {
-                        success: true,
-                        message: projectPath
-                            ? `All project-specific configurations for ${projectPath} have been reset`
-                            : 'All analyzer configurations have been reset to defaults',
-                        scope: projectPath ? 'project' : 'global',
-                    };
-                },
+                name: 'analyzerName',
+                type: 'string',
+                required: true,
+                description: 'The analyzer to configure (solid, dry, security, etc.).',
             },
             {
-                name: 'generate',
-                description: 'Generate configuration files for AI coding assistants (Cursor, Claude, Copilot, etc.).',
-                parameters: [
-                    {
-                        name: 'tools',
-                        type: 'array',
-                        required: true,
-                        description: 'AI tools to configure (claude, codex, cursor, gemini, copilot, continue, awsq, codeium, vscode, cline, zcode).',
-                    },
-                    {
-                        name: 'outputDir',
-                        type: 'string',
-                        required: false,
-                        description: 'Output directory for configuration files.',
-                        default: '.',
-                    },
-                    {
-                        name: 'serverUrl',
-                        type: 'string',
-                        required: false,
-                        description: 'MCP server URL (default: auto-detected).',
-                        default: DEFAULT_SERVER_URL,
-                    },
-                    {
-                        name: 'overwrite',
-                        type: 'boolean',
-                        required: false,
-                        description: 'Overwrite existing files (default: false).',
-                        default: false,
-                    },
-                ],
-                handler: async (args) => {
-                    const tools = args.tools;
-                    const serverUrl = args.serverUrl || DEFAULT_SERVER_URL;
-                    const rawOutputDir = args.outputDir || '.';
-                    // Containment (Spec 61 R5.1): generated configs land only inside the
-                    // working directory. `~` expansion still resolves (so a project under
-                    // `~` keeps working), but it is no longer a way to escape cwd.
-                    const outputDir = resolveConfigGenerateDir(rawOutputDir, process.cwd());
-                    const overwrite = args.overwrite || false;
-                    if (!Array.isArray(tools) || tools.length === 0)
-                        throw new Error('tools parameter must be a non-empty array');
-                    const factory = new ConfigGeneratorFactory(serverUrl);
-                    const generatedFiles = [];
-                    const errors = [];
-                    for (const tool of tools) {
-                        try {
-                            const generator = factory.createGenerator(tool);
-                            if (!generator) {
-                                errors.push(`Unknown tool: ${tool}`);
-                                continue;
-                            }
-                            const config = generator.generateConfig();
-                            const outputPath = path.resolve(outputDir, config.filename);
-                            let fileExists = false;
-                            try {
-                                await fs.access(outputPath);
-                                fileExists = true;
-                            }
-                            catch {
-                                // doesn't exist
-                            }
-                            if (fileExists && !overwrite) {
-                                errors.push(`File already exists: ${config.filename} (use overwrite: true to replace)`);
-                                continue;
-                            }
-                            await fs.mkdir(path.dirname(outputPath), { recursive: true });
-                            await fs.writeFile(outputPath, config.content);
-                            generatedFiles.push(config.filename);
-                            if (config.additionalFiles) {
-                                for (const additionalFile of config.additionalFiles) {
-                                    const additionalPath = path.resolve(outputDir, additionalFile.filename);
-                                    await fs.mkdir(path.dirname(additionalPath), { recursive: true });
-                                    await fs.writeFile(additionalPath, additionalFile.content);
-                                    generatedFiles.push(additionalFile.filename);
-                                }
-                            }
-                        }
-                        catch (error) {
-                            errors.push(`Failed to generate config for ${tool}: ${error instanceof Error ? error.message : 'Unknown error'}`);
-                        }
-                    }
-                    return {
-                        success: errors.length === 0,
-                        generatedFiles,
-                        errors: errors.length > 0 ? errors : undefined,
-                        totalRequested: tools.length,
-                        totalGenerated: generatedFiles.length,
-                    };
-                },
+                name: 'config',
+                type: 'object',
+                required: true,
+                description: 'Configuration object for the analyzer (e.g., thresholds, rules).',
             },
             {
-                name: 'whitelist_list',
-                description: 'Get current whitelist entries for dependency and class instantiation checks.',
-                parameters: [
-                    {
-                        name: 'type',
-                        type: 'string',
-                        required: false,
-                        description: 'Filter by type: platform-api, framework-class, project-dep, shared-library, node-builtin.',
-                        enum: ['platform-api', 'framework-class', 'project-dep', 'shared-library', 'node-builtin'],
-                    },
-                    {
-                        name: 'status',
-                        type: 'string',
-                        required: false,
-                        description: 'Filter by status: active, pending, rejected, disabled.',
-                        enum: ['active', 'pending', 'rejected', 'disabled'],
-                    },
-                ],
-                handler: async (args) => {
-                    const { handleWhitelistGet } = await import('./mcp-tools/whitelistTools.js');
-                    return handleWhitelistGet(args);
-                },
+                name: 'projectPath',
+                type: 'string',
+                required: false,
+                description: 'Optional project path for project-specific config.',
             },
+        ],
+        handler: async (args) => {
+            const analyzerName = args.analyzerName;
+            const config = args.config;
+            const projectPath = args.projectPath;
+            const db = CodeIndexDB.getInstance();
+            await db.initialize();
+            await db.analyzerConfig.storeAnalyzerConfig(analyzerName, config, {
+                projectPath,
+                isGlobal: !projectPath,
+            });
+            return {
+                success: true,
+                message: `Configuration for ${analyzerName} analyzer has been saved${projectPath ? ` for project ${projectPath}` : ' globally'}`,
+                analyzer: analyzerName,
+                scope: projectPath ? 'project' : 'global',
+                config,
+            };
+        },
+    },
+    {
+        name: 'reset',
+        description: 'Reset analyzer configuration to defaults.',
+        parameters: [
             {
-                name: 'whitelist_add',
-                description: 'Add a new entry to the whitelist.',
-                parameters: [
-                    {
-                        name: 'name',
-                        type: 'string',
-                        required: true,
-                        description: 'Class name or import path to whitelist.',
-                    },
-                    {
-                        name: 'type',
-                        type: 'string',
-                        required: true,
-                        description: 'Type of whitelist entry.',
-                        enum: ['platform-api', 'framework-class', 'project-dep', 'shared-library', 'node-builtin'],
-                    },
-                    {
-                        name: 'description',
-                        type: 'string',
-                        required: false,
-                        description: 'Explanation of why this is whitelisted.',
-                    },
-                    {
-                        name: 'patterns',
-                        type: 'array',
-                        required: false,
-                        description: 'Additional patterns to match (e.g., ["fs/*", "node:fs"]).',
-                    },
-                ],
-                handler: async (args) => {
-                    const { handleWhitelistAdd } = await import('./mcp-tools/whitelistTools.js');
-                    return handleWhitelistAdd(args);
-                },
+                name: 'analyzerName',
+                type: 'string',
+                required: false,
+                description: 'Specific analyzer to reset, or omit to reset all.',
             },
             {
-                name: 'whitelist_update',
-                description: 'Update the status of a whitelist entry.',
-                parameters: [
-                    {
-                        name: 'name',
-                        type: 'string',
-                        required: true,
-                        description: 'Name of the whitelist entry to update.',
-                    },
-                    {
-                        name: 'status',
-                        type: 'string',
-                        required: true,
-                        description: 'New status for the entry.',
-                        enum: ['active', 'pending', 'rejected', 'disabled'],
-                    },
-                ],
-                handler: async (args) => {
-                    const { handleWhitelistUpdateStatus } = await import('./mcp-tools/whitelistTools.js');
-                    return handleWhitelistUpdateStatus(args);
-                },
+                name: 'projectPath',
+                type: 'string',
+                required: false,
+                description: 'Optional project path to reset only project-specific config.',
             },
+        ],
+        handler: async (args) => {
+            const analyzerName = args.analyzerName;
+            const projectPath = args.projectPath;
+            const db = CodeIndexDB.getInstance();
+            await db.initialize();
+            if (analyzerName) {
+                const deleted = await db.analyzerConfig.deleteAnalyzerConfig(analyzerName, {
+                    projectPath,
+                    isGlobal: !projectPath,
+                });
+                return {
+                    success: deleted,
+                    message: deleted
+                        ? `Configuration for ${analyzerName} analyzer has been reset${projectPath ? ` for project ${projectPath}` : ' globally'}`
+                        : `No configuration found for ${analyzerName} analyzer`,
+                    analyzer: analyzerName,
+                    scope: projectPath ? 'project' : 'global',
+                };
+            }
+            await db.analyzerConfig.resetAnalyzerConfigs(projectPath);
+            return {
+                success: true,
+                message: projectPath
+                    ? `All project-specific configurations for ${projectPath} have been reset`
+                    : 'All analyzer configurations have been reset to defaults',
+                scope: projectPath ? 'project' : 'global',
+            };
+        },
+    },
+    {
+        name: 'generate',
+        description: 'Generate configuration files for AI coding assistants (Cursor, Claude, Copilot, etc.).',
+        parameters: [
             {
-                name: 'whitelist_detect',
-                description: 'Detect potential whitelist candidates from package.json and usage patterns.',
-                parameters: [
-                    {
-                        name: 'path',
-                        type: 'string',
-                        required: false,
-                        description: 'Project path to analyze (defaults to current directory).',
-                        default: process.cwd(),
-                    },
-                    {
-                        name: 'includePackageJson',
-                        type: 'boolean',
-                        required: false,
-                        description: 'Include dependencies from package.json.',
-                        default: true,
-                    },
-                    {
-                        name: 'autoPopulate',
-                        type: 'boolean',
-                        required: false,
-                        description: 'Automatically add high-confidence entries.',
-                        default: false,
-                    },
-                ],
-                handler: async (args) => {
-                    const { handleWhitelistDetect } = await import('./mcp-tools/whitelistTools.js');
-                    return handleWhitelistDetect(args);
-                },
+                name: 'tools',
+                type: 'array',
+                required: true,
+                description: 'AI tools to configure (claude, codex, cursor, gemini, copilot, continue, awsq, codeium, vscode, cline, zcode).',
             },
             {
-                name: 'rules_list',
-                description: 'List all configured invariant rules from .codeauditor.json. Shows rule IDs, kinds, severity, and messages.',
-                parameters: [
-                    {
-                        name: 'configPath',
-                        type: 'string',
-                        required: false,
-                        description: 'Path to .codeauditor.json (defaults to auto-detect in current working tree).',
-                    },
-                ],
-                handler: async (args) => {
-                    const { readFileSync } = await import('fs');
-                    const path = await import('path');
-                    const configPath = args.configPath ||
-                        path.join(process.cwd(), '.codeauditor.json');
-                    try {
-                        const raw = readFileSync(configPath, 'utf-8');
-                        const config = JSON.parse(raw);
-                        const rules = config?.rules ?? [];
-                        return {
-                            rules: rules.map((r) => ({
-                                id: r.id,
-                                kind: r.kind,
-                                severity: r.severity,
-                                message: r.message || null,
-                            })),
-                            count: rules.length,
-                            configPath,
-                        };
-                    }
-                    catch (err) {
-                        return {
-                            error: `Failed to read rules: ${err.message}`,
-                            configPath,
-                            rules: [],
-                            count: 0,
-                        };
-                    }
-                },
+                name: 'outputDir',
+                type: 'string',
+                required: false,
+                description: 'Output directory for configuration files.',
+                default: '.',
             },
             {
-                name: 'rules_check',
-                description: 'Validate the current .codeauditor.json rules (schema, duplicate IDs, valid globs/regex, mutual exclusivity). Returns any config errors.',
-                parameters: [
-                    {
-                        name: 'configPath',
-                        type: 'string',
-                        required: false,
-                        description: 'Path to .codeauditor.json (defaults to auto-detect in current working tree).',
-                    },
-                ],
-                handler: async (args) => {
-                    const { validateRulesConfig } = await import('./invariants/ruleValidator.js');
-                    const { readFileSync } = await import('fs');
-                    const path = await import('path');
-                    const configPath = args.configPath ||
-                        path.join(process.cwd(), '.codeauditor.json');
+                name: 'serverUrl',
+                type: 'string',
+                required: false,
+                description: 'MCP server URL (default: auto-detected).',
+                default: DEFAULT_SERVER_URL,
+            },
+            {
+                name: 'overwrite',
+                type: 'boolean',
+                required: false,
+                description: 'Overwrite existing files (default: false).',
+                default: false,
+            },
+        ],
+        handler: async (args) => {
+            const tools = args.tools;
+            const serverUrl = args.serverUrl || DEFAULT_SERVER_URL;
+            const rawOutputDir = args.outputDir || '.';
+            // Containment (Spec 61 R5.1): generated configs land only inside the
+            // working directory. `~` expansion still resolves (so a project under
+            // `~` keeps working), but it is no longer a way to escape cwd.
+            const outputDir = resolveConfigGenerateDir(rawOutputDir, process.cwd());
+            const overwrite = args.overwrite || false;
+            if (!Array.isArray(tools) || tools.length === 0)
+                throw new Error('tools parameter must be a non-empty array');
+            const factory = new ConfigGeneratorFactory(serverUrl);
+            const generatedFiles = [];
+            const errors = [];
+            for (const tool of tools) {
+                try {
+                    const generator = factory.createGenerator(tool);
+                    if (!generator) {
+                        errors.push(`Unknown tool: ${tool}`);
+                        continue;
+                    }
+                    const config = generator.generateConfig();
+                    const outputPath = path.resolve(outputDir, config.filename);
+                    let fileExists = false;
                     try {
-                        const raw = readFileSync(configPath, 'utf-8');
-                        const config = JSON.parse(raw);
-                        const rulesArray = config?.rules;
-                        const errors = validateRulesConfig({ rules: rulesArray ?? [] });
-                        return {
-                            valid: errors.length === 0,
-                            errors: errors.map(e => ({ ruleId: e.ruleId || null, message: e.message })),
-                            configPath,
-                        };
+                        await fs.access(outputPath);
+                        fileExists = true;
                     }
-                    catch (err) {
-                        return {
-                            valid: false,
-                            errors: [{ message: `Failed to read/parse config: ${err.message}` }],
-                            configPath,
-                        };
+                    catch {
+                        // doesn't exist
                     }
-                },
+                    if (fileExists && !overwrite) {
+                        errors.push(`File already exists: ${config.filename} (use overwrite: true to replace)`);
+                        continue;
+                    }
+                    await fs.mkdir(path.dirname(outputPath), { recursive: true });
+                    await fs.writeFile(outputPath, config.content);
+                    generatedFiles.push(config.filename);
+                    if (config.additionalFiles) {
+                        for (const additionalFile of config.additionalFiles) {
+                            const additionalPath = path.resolve(outputDir, additionalFile.filename);
+                            await fs.mkdir(path.dirname(additionalPath), { recursive: true });
+                            await fs.writeFile(additionalPath, additionalFile.content);
+                            generatedFiles.push(additionalFile.filename);
+                        }
+                    }
+                }
+                catch (error) {
+                    errors.push(`Failed to generate config for ${tool}: ${errorMessage(error)}`);
+                }
+            }
+            return {
+                success: errors.length === 0,
+                generatedFiles,
+                errors: errors.length > 0 ? errors : undefined,
+                totalRequested: tools.length,
+                totalGenerated: generatedFiles.length,
+            };
+        },
+    },
+    {
+        name: 'whitelist_list',
+        description: 'Get current whitelist entries for dependency and class instantiation checks.',
+        parameters: [
+            {
+                name: 'type',
+                type: 'string',
+                required: false,
+                description: 'Filter by type: platform-api, framework-class, project-dep, shared-library, node-builtin.',
+                enum: ['platform-api', 'framework-class', 'project-dep', 'shared-library', 'node-builtin'],
+            },
+            {
+                name: 'status',
+                type: 'string',
+                required: false,
+                description: 'Filter by status: active, pending, rejected, disabled.',
+                enum: ['active', 'pending', 'rejected', 'disabled'],
+            },
+        ],
+        handler: async (args) => {
+            const { handleWhitelistGet } = await import('./mcp-tools/whitelistTools.js');
+            return handleWhitelistGet(args);
+        },
+    },
+    {
+        name: 'whitelist_add',
+        description: 'Add a new entry to the whitelist.',
+        parameters: [
+            {
+                name: 'name',
+                type: 'string',
+                required: true,
+                description: 'Class name or import path to whitelist.',
+            },
+            {
+                name: 'type',
+                type: 'string',
+                required: true,
+                description: 'Type of whitelist entry.',
+                enum: ['platform-api', 'framework-class', 'project-dep', 'shared-library', 'node-builtin'],
+            },
+            {
+                name: 'description',
+                type: 'string',
+                required: false,
+                description: 'Explanation of why this is whitelisted.',
+            },
+            {
+                name: 'patterns',
+                type: 'array',
+                required: false,
+                description: 'Additional patterns to match (e.g., ["fs/*", "node:fs"]).',
+            },
+        ],
+        handler: async (args) => {
+            const { handleWhitelistAdd } = await import('./mcp-tools/whitelistTools.js');
+            return handleWhitelistAdd(args);
+        },
+    },
+    {
+        name: 'whitelist_update',
+        description: 'Update the status of a whitelist entry.',
+        parameters: [
+            {
+                name: 'name',
+                type: 'string',
+                required: true,
+                description: 'Name of the whitelist entry to update.',
+            },
+            {
+                name: 'status',
+                type: 'string',
+                required: true,
+                description: 'New status for the entry.',
+                enum: ['active', 'pending', 'rejected', 'disabled'],
             },
         ],
+        handler: async (args) => {
+            const { handleWhitelistUpdateStatus } = await import('./mcp-tools/whitelistTools.js');
+            return handleWhitelistUpdateStatus(args);
+        },
+    },
+    {
+        name: 'whitelist_detect',
+        description: 'Detect potential whitelist candidates from package.json and usage patterns.',
+        parameters: [
+            {
+                name: 'path',
+                type: 'string',
+                required: false,
+                description: 'Project path to analyze (defaults to current directory).',
+                default: process.cwd(),
+            },
+            {
+                name: 'includePackageJson',
+                type: 'boolean',
+                required: false,
+                description: 'Include dependencies from package.json.',
+                default: true,
+            },
+            {
+                name: 'autoPopulate',
+                type: 'boolean',
+                required: false,
+                description: 'Automatically add high-confidence entries.',
+                default: false,
+            },
+        ],
+        handler: async (args) => {
+            const { handleWhitelistDetect } = await import('./mcp-tools/whitelistTools.js');
+            return handleWhitelistDetect(args);
+        },
+    },
+    {
+        name: 'rules_list',
+        description: 'List all configured invariant rules from .codeauditor.json. Shows rule IDs, kinds, severity, and messages.',
+        parameters: [
+            {
+                name: 'configPath',
+                type: 'string',
+                required: false,
+                description: 'Path to .codeauditor.json (defaults to auto-detect in current working tree).',
+            },
+        ],
+        handler: async (args) => {
+            const { readFileSync } = await import('fs');
+            const path = await import('path');
+            const configPath = args.configPath ||
+                path.join(process.cwd(), '.codeauditor.json');
+            try {
+                const raw = readFileSync(configPath, 'utf-8');
+                const config = JSON.parse(raw);
+                const rules = config?.rules ?? [];
+                return {
+                    rules: rules.map((r) => ({
+                        id: r.id,
+                        kind: r.kind,
+                        severity: r.severity,
+                        message: r.message || null,
+                    })),
+                    count: rules.length,
+                    configPath,
+                };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to read rules: ${err.message}`,
+                    configPath,
+                    rules: [],
+                    count: 0,
+                };
+            }
+        },
+    },
+    {
+        name: 'rules_check',
+        description: 'Validate the current .codeauditor.json rules (schema, duplicate IDs, valid globs/regex, mutual exclusivity). Returns any config errors.',
+        parameters: [
+            {
+                name: 'configPath',
+                type: 'string',
+                required: false,
+                description: 'Path to .codeauditor.json (defaults to auto-detect in current working tree).',
+            },
+        ],
+        handler: async (args) => {
+            const { validateRulesConfig } = await import('./invariants/ruleValidator.js');
+            const { readFileSync } = await import('fs');
+            const path = await import('path');
+            const configPath = args.configPath ||
+                path.join(process.cwd(), '.codeauditor.json');
+            try {
+                const raw = readFileSync(configPath, 'utf-8');
+                const config = JSON.parse(raw);
+                const rulesArray = config?.rules;
+                const errors = validateRulesConfig({ rules: rulesArray ?? [] });
+                return {
+                    valid: errors.length === 0,
+                    errors: errors.map(e => ({ ruleId: e.ruleId || null, message: e.message })),
+                    configPath,
+                };
+            }
+            catch (err) {
+                return {
+                    valid: false,
+                    errors: [{ message: `Failed to read/parse config: ${err.message}` }],
+                    configPath,
+                };
+            }
+        },
+    },
+];
+function registerConfigTool(registry) {
+    registry.register({
+        name: 'config',
+        description: 'Manage analyzer configurations, generate AI tool configs, manage whitelists, and manage invariant rules. Actions: get, set, reset (analyzer configs), generate (AI tool config files), whitelist_list, whitelist_add, whitelist_update, whitelist_detect, rules_list, rules_check.',
+        actions: configActions,
     });
-    // ── telemetry ──────────────────────────────────────────────────────────────
+}
+// ── telemetry ──────────────────────────────────────────────────────────────
+function registerTelemetryTool(registry) {
     registry.register({
         name: 'telemetry',
         description: 'Manage anonymous dismissal feedback opt-in (default OFF). Actions: status, enable, disable. When enabled, a dismissal and its reason are sent to the feedback endpoint, grouped by an anonymous install ID generated locally.',
@@ -1338,7 +1278,9 @@ function registerAllTools(registry) {
             },
         ],
     });
-    // ── code_map ───────────────────────────────────────────────────────────────
+}
+// ── code_map ───────────────────────────────────────────────────────────────
+function registerCodeMapTool(registry) {
     registry.register({
         name: 'code_map',
         description: 'Retrieve sections of previously generated code maps. Actions: get (retrieve a specific section), list (list all available sections for a map).',
@@ -1366,7 +1308,7 @@ function registerAllTools(registry) {
                     if (!mapId || !sectionType)
                         return { success: false, error: 'Both mapId and sectionType are required' };
                     const db = await getDatabase();
-                    const section = await db.getCodeMapSection(mapId, sectionType);
+                    const section = await db.codeMap.getCodeMapSection(mapId, sectionType);
                     if (section) {
                         return { success: true, mapId, sectionType, content: section.content, metadata: section.metadata };
                     }
@@ -1389,13 +1331,15 @@ function registerAllTools(registry) {
                     if (!mapId)
                         return { success: false, error: 'mapId is required' };
                     const db = await getDatabase();
-                    const sections = await db.listCodeMapSections(mapId);
+                    const sections = await db.codeMap.listCodeMapSections(mapId);
                     return { success: true, mapId, sections, totalSections: sections.length };
                 },
             },
         ],
     });
-    // ── tasks ──────────────────────────────────────────────────────────────────
+}
+// ── tasks ──────────────────────────────────────────────────────────────────
+function registerTasksTool(registry) {
     registry.register({
         name: 'tasks',
         description: 'Manage a persistent per-project task queue. Tasks survive index resets. Actions: create, list, list_tree, get, update, complete, delete, from_audit (create tasks from audit violations with deduplication).',
@@ -1404,7 +1348,7 @@ function registerAllTools(registry) {
                 name: 'create',
                 description: 'Create a new task.',
                 parameters: [
-                    { name: 'projectPath', type: 'string', required: false, description: 'Project root.' },
+                    { name: 'projectPath', type: 'string', required: false, description: PROJECT_ROOT_DESCRIPTION },
                     { name: 'title', type: 'string', required: true, description: 'Task title.' },
                     { name: 'description', type: 'string', required: false, description: 'Longer description.' },
                     { name: 'status', type: 'string', required: false, description: 'Initial status.', enum: ['pending', 'in_progress', 'blocked', 'done', 'cancelled'] },
@@ -1428,7 +1372,7 @@ function registerAllTools(registry) {
                 name: 'list',
                 description: 'List tasks (flat). Supports filtering by status, priority, labels, source, query text search.',
                 parameters: [
-                    { name: 'projectPath', type: 'string', required: false, description: 'Project root.' },
+                    { name: 'projectPath', type: 'string', required: false, description: PROJECT_ROOT_DESCRIPTION },
                     { name: 'status', type: 'string', required: false, description: 'Filter by status.', enum: ['pending', 'in_progress', 'blocked', 'done', 'cancelled'] },
                     { name: 'priority', type: 'string', required: false, description: 'Filter by priority.', enum: ['low', 'medium', 'high'] },
                     { name: 'label', type: 'string', required: false, description: 'Filter by label.' },
@@ -1448,7 +1392,7 @@ function registerAllTools(registry) {
                 name: 'list_tree',
                 description: 'List tasks as a tree (parent-child hierarchy).',
                 parameters: [
-                    { name: 'projectPath', type: 'string', required: false, description: 'Project root.' },
+                    { name: 'projectPath', type: 'string', required: false, description: PROJECT_ROOT_DESCRIPTION },
                     { name: 'status', type: 'string', required: false, description: 'Filter by status.', enum: ['pending', 'in_progress', 'blocked', 'done', 'cancelled'] },
                     { name: 'limit', type: 'number', required: false, description: 'Max tasks (default 500).' },
                 ],
@@ -1461,7 +1405,7 @@ function registerAllTools(registry) {
                 name: 'get',
                 description: 'Get a single task by ID.',
                 parameters: [
-                    { name: 'projectPath', type: 'string', required: false, description: 'Project root.' },
+                    { name: 'projectPath', type: 'string', required: false, description: PROJECT_ROOT_DESCRIPTION },
                     { name: 'taskId', type: 'string', required: true, description: 'Task ID.' },
                 ],
                 handler: async (args, signal) => {
@@ -1473,7 +1417,7 @@ function registerAllTools(registry) {
                 name: 'update',
                 description: 'Update a task with a patch of partial fields.',
                 parameters: [
-                    { name: 'projectPath', type: 'string', required: false, description: 'Project root.' },
+                    { name: 'projectPath', type: 'string', required: false, description: PROJECT_ROOT_DESCRIPTION },
                     { name: 'taskId', type: 'string', required: true, description: 'Task ID.' },
                     { name: 'patch', type: 'object', required: true, description: 'Partial fields to update.' },
                 ],
@@ -1486,7 +1430,7 @@ function registerAllTools(registry) {
                 name: 'complete',
                 description: 'Mark a task as completed.',
                 parameters: [
-                    { name: 'projectPath', type: 'string', required: false, description: 'Project root.' },
+                    { name: 'projectPath', type: 'string', required: false, description: PROJECT_ROOT_DESCRIPTION },
                     { name: 'taskId', type: 'string', required: true, description: 'Task ID.' },
                 ],
                 handler: async (args, signal) => {
@@ -1498,7 +1442,7 @@ function registerAllTools(registry) {
                 name: 'delete',
                 description: 'Delete a task. Mode: reject (default, refuse if subtasks exist), detach (move subtasks up), cascade (delete subtree).',
                 parameters: [
-                    { name: 'projectPath', type: 'string', required: false, description: 'Project root.' },
+                    { name: 'projectPath', type: 'string', required: false, description: PROJECT_ROOT_DESCRIPTION },
                     { name: 'taskId', type: 'string', required: true, description: 'Task ID.' },
                     { name: 'mode', type: 'string', required: false, description: 'Delete mode.', enum: ['reject', 'detach', 'cascade'] },
                 ],
@@ -1511,10 +1455,9 @@ function registerAllTools(registry) {
                 name: 'from_audit',
                 description: 'Create tasks from audit violations with deduplication. Each violation gets a stable fingerprint; violations matching existing open tasks are skipped.',
                 parameters: [
-                    { name: 'projectPath', type: 'string', required: false, description: 'Project root.' },
+                    { name: 'projectPath', type: 'string', required: false, description: PROJECT_ROOT_DESCRIPTION },
                     { name: 'auditJobId', type: 'string', required: false, description: 'Audit job ID. Omit to use most recent completed audit.' },
                     { name: 'severities', type: 'array', required: false, description: 'Severities to include (default: critical, severe).' },
-                    { name: 'analyzers', type: 'array', required: false, description: 'Filter violations by analyzer name.' },
                     { name: 'paths', type: 'array', required: false, description: 'Filter violations by file path globs.' },
                 ],
                 handler: async (args, signal) => {
@@ -1524,7 +1467,9 @@ function registerAllTools(registry) {
             },
         ],
     });
-    // ── guide ──────────────────────────────────────────────────────────────────
+}
+// ── guide ──────────────────────────────────────────────────────────────────
+function registerGuideTool(registry) {
     registry.register({
         name: 'guide',
         description: 'Get recommended workflows and best practices for using the code auditor tools effectively. Single action: get.',
@@ -1555,7 +1500,7 @@ function registerAllTools(registry) {
                     catch (error) {
                         return {
                             success: false,
-                            error: error instanceof Error ? error.message : 'Unknown error',
+                            error: errorMessage(error),
                             availableScenarios: [
                                 'initial-setup',
                                 'react-development',
@@ -1571,6 +1516,20 @@ function registerAllTools(registry) {
         ],
     });
 }
+/**
+ * Register every MCP tool and its actions on the given registry.
+ * @param registry - The tool registry to register tools on.
+ */
+export function registerAllTools(registry) {
+    registerAuditTool(registry);
+    registerSearchTool(registry);
+    registerIndexTool(registry);
+    registerConfigTool(registry);
+    registerTelemetryTool(registry);
+    registerCodeMapTool(registry);
+    registerTasksTool(registry);
+    registerGuideTool(registry);
+}
 // ── MCP Server ───────────────────────────────────────────────────────────────
 async function startMcpServer() {
     logMcpInfo('startup', `code-auditor-mcp ${PACKAGE_VERSION} (stdio)`, {
@@ -1727,9 +1686,31 @@ async function main() {
     // --stdio (default): start the MCP server
     await startMcpServer();
 }
-main().catch((error) => {
-    console.error(chalk.red('[ERROR]'), 'Failed to start:', error);
-    console.error(chalk.red('[ERROR]'), 'Stack:', error.stack);
-    process.exitCode = 1;
-});
+// Start the server only when this file is the entry point (mirrors mcp-ui-simple).
+// Guarding `main()` lets tests import `registerAllTools` without booting the stdio
+// server (Spec 66 follow-up R5 — the entry-point conformance test must enumerate
+// the real `audit.run` / `audit.health` handlers, not a fake).
+//
+// Compare realpaths, not string-built URLs: `import.meta.url` is symlink-resolved
+// by Node, while `process.argv[1]` under a pnpm/npm `.bin` shim is the shim path
+// (or a symlinked path) that Node does not resolve. The two string forms diverge
+// on a symlinked install, so the naive `file://${argv[1]}` comparison never matches
+// and the published `code-auditor-mcp` bin boots to an immediate silent exit.
+function isMainModule() {
+    if (!process.argv[1])
+        return false;
+    try {
+        return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+    }
+    catch {
+        return false;
+    }
+}
+if (isMainModule()) {
+    main().catch((error) => {
+        console.error(chalk.red('[ERROR]'), 'Failed to start:', error);
+        console.error(chalk.red('[ERROR]'), 'Stack:', error.stack);
+        process.exitCode = 1;
+    });
+}
 //# sourceMappingURL=mcp.js.map