davinci-resolve-mcp 2.222.0 → 2.224.0

package/CHANGELOG.md

@@ -2,6 +2,99 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v2.224.0 — native Resolve 21.1 DCTL encryption
+
+Contributed by @legionsound (#216), live-validated on Studio 21.1.0.14.
+
+### Added
+
+- **`dctl encrypt_native`**, with the granular twin `encrypt_dctl_native`,
+  calling native 21.1 DCTL encryption. The caller supplies an existing `.dctl`
+  input, a new `.dctle` output path and an optional expiry; the wrapper reports
+  the actual final path, size and hash. Tool count 376 → 377.
+- **A destination is never replaced.** Resolve writes into isolated staging and
+  only a verified non-empty regular file is published. The publish uses
+  `O_EXCL` creation at `0o600`, so a file that appears *during* encryption
+  cannot be clobbered, and the existence check uses `lexists` so a **dangling
+  symlink** counts as an occupied destination rather than a free one — the case
+  a plain existence test silently gets wrong. The cross-volume fallback removes
+  its own partial output if the copy fails.
+- Source bytes are preserved, and the action neither installs nor applies the
+  shader.
+
+### Changed
+
+- Classified **LOW** risk rather than MEDIUM, with a destructive-action hook
+  entry and dry-run refusal coverage. LOW is the honest rating here: the action
+  only ever creates a new file and is incapable of overwriting one, so grouping
+  it with operations that rewrite existing work would make the rating mean
+  less. Verified: `dctl.encrypt_native` classifies LOW / destructive /
+  recognised, and is in the destructive registry.
+- Two native boundaries handled explicitly rather than papered over: Resolve
+  appends `.dctle` itself, so a fixed staging stem prevents a doubled suffix on
+  a user-supplied name; and an empty expiry string is normalized to null,
+  because an isolated probe measured the native call returning false for `""`
+  and true for null or omission. Other expiry strings pass through untouched.
+
+### Validation
+
+- Full suite green: 3,478 passed, 1 skipped. Drift guards, api-parity and read/write
+  symmetry all clean with the 377 count.
+- Live evidence is @legionsound's on Studio 21.1.0.14, through both interfaces
+  with synthetic identity code: each exported a non-empty file, reported
+  correct size and hash, preserved the source bytes, produced owner-only
+  permissions, and refused a repeat export without altering the destination.
+  Not reproduced here; this machine is Studio 19.1.3.7, below the 21.1 floor.
+- **Not claimed**: that an encrypted shader is accepted by a render, and
+  nothing at all about cipher strength. Observed file sizes are recorded as
+  observations, not format guarantees.
+- This PR was branched from current `main` and merged **without adaptation** —
+  the first in the 21.1 series to need none.
+
+## What's New in v2.223.0 — native Resolve 21.1 DCTL validation
+
+Contributed by @legionsound (#215), live-validated on Studio 21.1.0.14.
+
+### Added
+
+- **`dctl validate_native`**, with the granular twin `validate_dctl_native`,
+  calling Resolve 21.1's own `ValidateDCTL`. The existing `dctl validate`
+  remains the static offline checker — this is new surface beside it, not a
+  change to what that action claims. Tool count 375 → 376.
+- **Source layout is passed through unchanged and native diagnostics are
+  returned verbatim.** That is the rule recorded in the ledger back in
+  v2.216.1, when @legionsound narrowed `ValidateDCTL` to being sensitive to
+  source layout — the same function validates multi-line and fails on one line
+  — and it is now implemented rather than merely written down: a wrapper that
+  reflowed the user's source to make validation pass would be hiding the very
+  behaviour the ledger entry exists to warn about.
+- `None` means valid, strings mean invalid, and an **unexpected native result
+  type is an error rather than a false success** — the distinction that keeps a
+  changed API from silently reading as "your shader is fine".
+- Version-gated and explicitly classified **read-only**: verified here as LOW /
+  non-destructive. It does not install, encrypt, apply or render a DCTL, and
+  a successful validation is not a rendered shader test.
+
+### Validation
+
+- Full suite green: 3,470 passed, 1 skipped. Focused contracts cover CRLF and
+  Unicode preservation, so the source that reaches Resolve is byte-for-byte
+  what the caller supplied.
+- Live evidence is @legionsound's on Studio 21.1.0.14, checked against the
+  official Resolve MCP and both community interfaces: the multi-line identity
+  fixture validates, its one-line form reproduces the known missing-return
+  diagnostic, and invalid source returns the missing-entry-function
+  diagnostic — with both wrappers matching native results exactly. Not
+  reproduced here; this machine is Studio 19.1.3.7, below the 21.1 floor.
+- **Not claimed**: encryption, and any statement that validation implies a
+  shader renders correctly.
+
+### Changed
+
+- Adapted on merge, as with #212, #213 and #214: counts resolved to **376**,
+  confirmed by the agent-rule generator, generated files regenerated rather
+  than hand-merged. No behaviour changed in the adaptation.
+
 ## What's New in v2.222.0 — native Resolve 21.1 timecode and waveform alignment
 
 Contributed by @legionsound (#212), live-validated on Studio 21.1.0.14.

package/README.md

@@ -2,10 +2,10 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-2.222.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.224.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
-[![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(375%20full)-blue.svg)](#server-modes)
+[![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(377%20full)-blue.svg)](#server-modes)
 [![Advanced](https://img.shields.io/badge/Advanced%20(offline)-18%20tools-blueviolet.svg)](#server-modes)
 [![Tested](https://img.shields.io/badge/Live%20Tested-93.6%25-green.svg)](docs/reference/api-coverage.md#test-results)
 [![DaVinci Resolve](https://img.shields.io/badge/DaVinci%20Resolve-18.5+-darkred.svg)](https://www.blackmagicdesign.com/products/davinciresolve)
@@ -133,7 +133,7 @@ The command starts a loopback-only server and opens the control panel in your br
 | Mode | Entry point | Tools | Best for |
 |------|-------------|-------|----------|
 | Compound | `src/server.py` | 36 | Default mode for most assistants. Related Resolve operations are grouped behind action parameters to keep context usage low. |
-| Full / granular | `src/server.py --full` or `src/resolve_mcp_server.py` | 375 | Power users who want one MCP tool per Resolve API method. |
+| Full / granular | `src/server.py --full` or `src/resolve_mcp_server.py` | 377 | Power users who want one MCP tool per Resolve API method. |
 
 The compound server is recommended unless you specifically need the granular one-tool-per-method surface.
 
@@ -365,7 +365,7 @@ The default server is a local stdio process launched by your MCP client; it does
 
 | Metric | Value |
 |--------|-------|
-| MCP Tools | **36** compound / **375** granular (live server) |
+| MCP Tools | **36** compound / **377** granular (live server) |
 | Advanced (offline) tools | **18** — .drp/.drt/.drx + DB authoring, no Resolve running |
 | Kernel Actions | **136** guarded workflow actions across 9 compound tools |
 | API Methods Covered | **361/361** (100%) |

package/README.zh-CN.md

@@ -2,17 +2,17 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-2.222.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.224.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
-[![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(375%20full)-blue.svg)](#服务器模式)
+[![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(377%20full)-blue.svg)](#服务器模式)
 [![Advanced](https://img.shields.io/badge/Advanced%20(offline)-18%20tools-blueviolet.svg)](#服务器模式)
 [![Tested](https://img.shields.io/badge/Live%20Tested-93.6%25-green.svg)](docs/reference/api-coverage.md#test-results)
 [![DaVinci Resolve](https://img.shields.io/badge/DaVinci%20Resolve-18.5+-darkred.svg)](https://www.blackmagicdesign.com/products/davinciresolve)
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v2.222.0 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v2.224.0 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 
@@ -88,7 +88,7 @@ venv/bin/python -m src.control_panel
 | 模式 | 入口 | 工具数 | 适合谁 |
 |------|------|--------|--------|
 | Compound（复合） | `src/server.py` | 36 | 大多数助手的默认模式。相关的 Resolve 操作按 action 参数分组，压低上下文占用。 |
-| Full / granular（细粒度） | `src/server.py --full` 或 `src/resolve_mcp_server.py` | 375 | 想要"一个 Resolve API 方法 = 一个 MCP 工具"的重度用户。 |
+| Full / granular（细粒度） | `src/server.py --full` 或 `src/resolve_mcp_server.py` | 377 | 想要"一个 Resolve API 方法 = 一个 MCP 工具"的重度用户。 |
 
 除非你明确需要一方法一工具的细粒度界面，否则推荐复合模式。
 
@@ -226,7 +226,7 @@ DRX 调色写入**针对 Resolve Studio 做过实机校准**：调色参数默
 
 | 指标 | 数值 |
 |------|------|
-| MCP 工具 | **36** 复合 / **375** 细粒度（实时服务器） |
+| MCP 工具 | **36** 复合 / **377** 细粒度（实时服务器） |
 | Advanced（离线）工具 | **18**——.drp/.drt/.drx + 数据库创作，无需 Resolve 运行 |
 | 内核 action | 9 个复合工具下 **136** 个带护栏的工作流 action |
 | API 方法覆盖 | **361/361**（100%） |

package/docs/SKILL.md

@@ -345,7 +345,7 @@ to the user as verified.
 | Mode | Entry point | Tool count | Use when |
 |---|---|---|---|
 | Compound (default) | `src/server.py` | 36 tools | Most workflows — keeps context lean |
-| Granular (full) | `src/server.py --full` | 375 tools | Power users needing one tool per API method |
+| Granular (full) | `src/server.py --full` | 377 tools | Power users needing one tool per API method |
 
 Resolve 21.1 adds [twelve read-only discovery controls](reference/resolve211-read-controls.md)
 for edition, presets, audio formats/codecs, normalization modes, speed, fades
@@ -2490,3 +2490,7 @@ Native timeline/clip output blanking: [21.1 controls](reference/resolve211-blank
 Native audio normalization: [21.1 controls](reference/resolve211-normalization.md), with independently measured exported-audio evidence.
 
 Native timecode/waveform alignment: [21.1 controls](reference/resolve211-alignment.md), including linked-item selection semantics and rendered video/audio evidence.
+
+Resolve-native DCTL validation: [21.1 controls](reference/resolve211-dctl-validation.md), separate from static validation and shader rendering.
+
+Native DCTL encryption: [21.1 controls](reference/resolve211-encryption.md), with explicit destination handling and export-evidence limits.

package/docs/contributing.md

@@ -64,7 +64,7 @@ davinci-resolve-mcp/
 ├── install.py                    # Universal installer (macOS/Windows/Linux)
 ├── src/
 │   ├── server.py                # Compound MCP server — 36 tools (default)
-│   ├── resolve_mcp_server.py    # Thin full-server entrypoint — 375 tools
+│   ├── resolve_mcp_server.py    # Thin full-server entrypoint — 377 tools
 │   ├── granular/                # Modular full-server implementation
 │   └── utils/                   # Platform detection, Resolve connection helpers
 ├── tests/                       # offline suite (test_*.py) + live harnesses (live_*.py):

package/docs/install.md

@@ -144,7 +144,7 @@ The MCP server comes in two modes:
 | Mode | File | Tools | Best For |
 |------|------|-------|----------|
 | **Compound** (default) | `src/server.py` | 36 | Most users — fast, clean, low context usage |
-| **Full** | `src/resolve_mcp_server.py` | 375 | Power users who want one tool per API method |
+| **Full** | `src/resolve_mcp_server.py` | 377 | Power users who want one tool per API method |
 
 The compound server's `timeline_item` tool includes dedicated actions for common workflows:
 
@@ -159,7 +159,7 @@ The compound server's `timeline_item` tool includes dedicated actions for common
 
 The installer uses the compound server by default. To use the full server:
 ```bash
-python src/server.py --full    # Launch full 375-tool server
+python src/server.py --full    # Launch full 377-tool server
 # Or point your MCP config directly at src/resolve_mcp_server.py
 ```
 

package/docs/reference/api-coverage.md

@@ -25,7 +25,7 @@ Every non-deprecated method in the bundled legacy README is represented. This
 does not claim complete coverage of the newer Resolve 21.1 typed API. The
 default compound server exposes **36 tools** that group related operations by
 action parameter, keeping LLM context windows lean. The full granular server
-provides **375 individual tools** for power users. The legacy coverage spans
+provides **377 individual tools** for power users. The legacy coverage spans
 13 API object classes. MCP-level kernel actions are tracked separately in
 [Kernel Action Coverage](../kernels/README.md).
 
@@ -640,3 +640,7 @@ Native timeline/clip output blanking: [21.1 controls](resolve211-blanking.md), w
 Native audio normalization: [21.1 controls](resolve211-normalization.md), with independently measured exported-audio evidence.
 
 Native timecode/waveform alignment: [21.1 controls](resolve211-alignment.md), including linked-item selection semantics and rendered video/audio evidence.
+
+Resolve-native DCTL validation: [21.1 controls](resolve211-dctl-validation.md), separate from static validation and shader rendering.
+
+Native DCTL encryption: [21.1 controls](resolve211-encryption.md), with explicit destination handling and export-evidence limits.

package/docs/reference/api-limitations.md

@@ -766,5 +766,5 @@ values, or automation-hostile modal prompts.
 - **Object:** `Resolve`
 - **Signature:** `(dctlSource) -> str | None  (21.1+)`
 - **Behavior:** Reported by @legionsound (issue #207) from Studio 21.1.0.14 on macOS; NOT reproduced here (no 21.1 install). The documented success result is None. A minimal identity transform written across several lines — `__DEVICE__ float3 transform(...)` with the body on its own lines — validates (None). The SAME function collapsed onto one line consistently returns 'DCTL Error: main DCTL function does not have return value.', which is false: the return statement is there. A genuinely invalid source returns 'cannot find main DCTL function.', so the validator does distinguish; it is the single-line layout it misreads. An earlier multi-line timeout did not reproduce after a Resolve restart with a 30-second limit. Nothing establishes a GPU compiler or render defect — this is the validator's parse, not the DCTL's execution. EncryptDCTL untested.
-- **Workaround / current handling:** Any wrapper around ValidateDCTL must pass the native diagnostic through verbatim and must not reflow or rewrite the user's source to dodge it; ship the multi-line identity fixture as the known-good control. A 'no return value' error on a one-line function is this quirk, not a missing return — re-run the validation with the function laid out across lines before believing it. This server's own `dctl validate` is a static, offline check (entry point, brace balance, float suffixes) and does not call ValidateDCTL at all.
+- **Workaround / current handling:** Any wrapper around ValidateDCTL must pass the native diagnostic through verbatim and must not reflow or rewrite the user's source to dodge it; ship the multi-line identity fixture as the known-good control. A 'no return value' error on a one-line function is this quirk, not a missing return — re-run the validation with the function laid out across lines before believing it. This server's own `dctl validate` is a static, offline check (entry point, brace balance, float suffixes) and does not call ValidateDCTL at all. The separate `dctl validate_native` and granular `validate_dctl_native` now expose the native validator without changing source or diagnostics. Both interfaces were contributor-validated against the three fixtures on Studio 21.1.0.14; see resolve211-dctl-validation.md.
 - **Tags:** dctl, validation, unreliable-return, version-gated, reported

package/docs/reference/resolve211-dctl-validation.md

@@ -0,0 +1,31 @@
+# Native DCTL validation in Resolve 21.1
+
+Compound `dctl validate_native` and granular `validate_dctl_native` accept a
+`source` string and call Resolve.ValidateDCTL. They return `valid`, `diagnostic`
+and `checker: resolve_native`. The source is passed unchanged, including its
+line layout. Native None means valid; a native string means invalid and is
+returned verbatim, including whitespace. An unexpected native result type is a
+protocol error, not a claim that the shader validated.
+
+The existing `dctl validate` remains the static offline checker. Native validation
+requires running Resolve 21.1 and a callable ValidateDCTL method. It does not
+install a DCTL, encrypt it, apply a grade or render the shader. A successful
+validation is not rendered-output evidence. The granular tool is read-only and
+the compound action is explicitly classified as non-destructive.
+
+## Contributor validation
+
+Contributor-validated on macOS Studio 21.1.0.14 against the official MCP and both
+actual community interfaces. The multiline identity fixture returns None. The
+same function on one line returns `DCTL Error: main DCTL function does not have
+return value.` Invalid source returns `cannot find main DCTL function.` Both
+wrappers preserve these diagnostics exactly. The source-layout limitation is
+already in api_truth; this wrapper exposes it honestly rather than reformatting
+user code to hide it.
+
+`python tests/live_resolve211_dctl.py` compares raw/native and both wrapper
+results for all three fixtures. It neither changes projects nor installs files.
+Unit tests also cover verbatim CRLF/Unicode source and diagnostic handling,
+invalid inputs, missing methods, unexpected native result types, read-only risk
+classification and preservation of the static checker route. Encryption and
+actual GPU execution remain separate work.

package/docs/reference/resolve211-encryption.md

@@ -0,0 +1,48 @@
+# Native Resolve 21.1 DCTL encryption
+
+Compound `dctl encrypt_native` and granular `encrypt_dctl_native` accept
+`input_path`, `output_path` and optional `expiry`. Input must be an existing .dctl;
+output must be a new .dctle. Existing destinations, including dangling symlinks,
+are refused. The source is never modified by the wrapper.
+
+The native Name and OutputFolder options are derived from an isolated staging
+file, then the completed file is published to the requested output path. This
+avoids native filename surprises: Resolve appends .dctle even when Name already
+ends with that suffix. Expiry null/omission means no expiry. Empty string is
+normalized to null because native empty-string expiry returned false in the
+contributor fixture while null succeeded. Other strings pass through as native
+ISO 8601 expiry requests; native failure is preserved.
+
+Resolve-facing staging uses the existing safe-directory helper. A successful
+native return must be accompanied by a non-empty regular encrypted file. An
+atomic no-replace hard link publishes it; filesystems without that support use
+exclusive file creation and copy. A failed copy removes only the new partial
+output. An output appearing during encryption is not overwritten. New files
+use owner-only permissions where the platform supports them. The result reports
+actual path, byte length and SHA-256, not a guessed native filename.
+
+The method has a 21.1 floor. The dctl tool has the destructive-action hook, and
+encrypt_native is registered/rated LOW because it only creates new output and
+never replaces existing content. Explicit compound dry runs refuse before the
+handler. The granular tool declares a write. No DCTL is installed or applied by
+this operation.
+
+## Contributor evidence and limits
+
+Contributor-validated on macOS Studio 21.1.0.14 via official MCP probes and both
+actual community wrappers, using a synthetic multiline identity shader. Native
+omitted/null expiry and a future date succeeded; empty string returned false in
+the isolated probe. Both wrappers created 2032-byte files in the tested runs,
+returned matching file hashes/sizes, left source bytes unchanged and refused a
+repeat export without changing the destination. These byte lengths are observed,
+not format requirements. Ciphertext equality across separate encryptions is not
+assumed.
+
+Tests exercise output races, missing native output, native false, cross-volume
+fallback, failed-copy cleanup, dangling symlinks, bad arguments and write gates.
+This is encryption/export evidence, not shader application or rendered-image
+acceptance, and not a security assessment of Blackmagic's encryption scheme.
+
+`tests/live_resolve211_encryption.py SOURCE_DCTL OUTPUT_DIR` uses a synthetic
+identity source and a fresh output directory. It does not install the results or
+change a project. Never substitute someone else's shader without authorization.

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "2.222.0"
+VERSION = "2.224.0"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds
@@ -1543,7 +1543,7 @@ def verify_resolve_connection(python_path, api_path, lib_path):
 
 def print_banner():
     title = f"DaVinci Resolve MCP Server — Installer v{VERSION}"
-    subtitle = "36 compound · 375 full · 3 platforms"
+    subtitle = "36 compound · 377 full · 3 platforms"
     print()
     print(bold("  ╔══════════════════════════════════════════════════════╗"))
     print(bold(f"  ║{title:^54}║"))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.222.0",
+  "version": "2.224.0",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -87,7 +87,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "2.222.0"
+VERSION = "2.224.0"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/granular/resolve_211.py

@@ -1,12 +1,14 @@
 """Native Resolve 21.1 discovery and editing controls."""
+from src.utils.resolve211_dctl import native_dctl_result
 from src.utils.resolve211_alignment import auto_align
 from src.utils.resolve211_normalization import normalize_audio
 from src.utils.resolve211_blanking import validate_blanking
+from src.utils.resolve211_encryption import encrypt_dctl
 from src.utils.resolve211_multicam import create_multicam, resolve_constant, GRADES
 from src.utils.resolve211_edits import validate_edit_options, validate_transition_options, transition_result
 from src.granular.common import (
     mcp, READ_ONLY_TOOL, WRITE_TOOL, DESTRUCTIVE_TOOL, get_resolve, get_current_project,
-    _get_timeline, _get_timeline_item, _find_clip_by_id, _requires_method, has_method,
+    _get_timeline, _get_timeline_item, _resolve_safe_dir, _find_clip_by_id, _requires_method, has_method,
 )
 
 
@@ -304,3 +306,28 @@ def auto_align_timeline_clips(item_ids: list[str], options: dict | None = None)
     if missing:
         return missing
     return auto_align(get_resolve(), timeline, item_ids, {} if options is None else options)
+
+
+@mcp.tool(annotations=READ_ONLY_TOOL)
+def validate_dctl_native(source: str) -> dict:
+    """Validate shader source with Resolve 21.1. Source layout and native diagnostics are preserved; success means validation, not a rendered shader test."""
+    if not isinstance(source, str):
+        return {"error": "source must be a string"}
+    r = get_resolve()
+    if r is None:
+        return {"error": "Not connected to DaVinci Resolve"}
+    missing = _requires_method(r, "ValidateDCTL", "21.1")
+    if missing:
+        return missing
+    return native_dctl_result(r, source)
+
+@mcp.tool(annotations=WRITE_TOOL)
+def encrypt_dctl_native(input_path: str, output_path: str, expiry: str | None = None) -> dict:
+    """Encrypt a .dctl to a new .dctle using Resolve 21.1. Never overwrites. Empty/null expiry means no expiry; ISO 8601 strings pass to Resolve. Source is unchanged."""
+    r = get_resolve()
+    if r is None:
+        return {"error": "Not connected to DaVinci Resolve"}
+    missing = _requires_method(r, "EncryptDCTL", "21.1")
+    if missing:
+        return missing
+    return encrypt_dctl(r, input_path, output_path, expiry, _resolve_safe_dir)

package/src/resolve_mcp_server.py

@@ -34,7 +34,7 @@ from src.utils.update_check import start_background_update_check
 if __name__ == "__main__":
     try:
         start_background_update_check(VERSION, project_dir, logger)
-        logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION} (375 granular tools)")
+        logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION} (377 granular tools)")
         run_fastmcp_stdio(mcp)
     except KeyboardInterrupt:
         logger.info("Server shutdown requested")

package/src/server.py

@@ -8,10 +8,10 @@ Each tool groups related operations via an 'action' parameter.
 
 Usage:
     python src/server.py              # Start the MCP server
-    python src/server.py --full       # Start the 375-tool granular server instead
+    python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "2.222.0"
+VERSION = "2.224.0"
 
 import base64
 import os
@@ -42,9 +42,11 @@ for p in [current_dir, project_dir]:
     if p not in sys.path:
         sys.path.insert(0, p)
 
+from src.utils.resolve211_encryption import encrypt_dctl
 from src.utils.resolve211_multicam import create_multicam, resolve_constant, GRADES
 from src.utils.resolve211_blanking import validate_blanking
 from src.utils.resolve211_alignment import auto_align
+from src.utils.resolve211_dctl import native_dctl_result
 from src.utils.resolve211_normalization import normalize_audio
 from src.utils.resolve211_edits import validate_edit_options, validate_transition_options, transition_result
 
@@ -31113,6 +31115,7 @@ _DCTL_VALID_CATEGORIES = ("lut", "aces_idt", "aces_odt")
 
 @mcp.tool()
 @_guard_missing_params
+@_destructive_op("dctl")
 def dctl(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
     """Author and install DCTL files (Color page custom shaders + ACES transforms).
 
@@ -31141,7 +31144,9 @@ def dctl(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]
         — ext: '.dctl' (default) or '.dctle' (encrypted)
       remove(name, category?, subdir?, ext?) -> {success}
       read(name, category?, subdir?, ext?) -> {source, encrypted}
+      encrypt_native(input_path, output_path, expiry?) -> {success, path?, bytes?, sha256?} — native 21.1; never overwrites.
       validate(source) -> {valid, errors, warnings, checker}
+      validate_native(source) -> {valid, diagnostic, checker} — Resolve 21.1 validation; source and diagnostic unchanged.
       template(kind, name, options?) -> {source, kind, name, suggested_category}
         — kind: 'transform' | 'transform_alpha' | 'transition' | 'matrix' |
                 'kernel' | 'lut_apply' | 'aces_idt' | 'aces_odt'
@@ -31295,6 +31300,27 @@ def dctl(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]
         return {"source": src, "path": target,
                 "encrypted": ext == ".dctle", "category": cat}
 
+    if action == "validate_native":
+        source = p.get("source")
+        if not isinstance(source, str):
+            return _err("validate_native requires a source string")
+        r = get_resolve()
+        if r is None:
+            return _not_connected_error()
+        missing = _requires_method(r, "ValidateDCTL", "21.1")
+        if missing:
+            return missing
+        return native_dctl_result(r, source)
+
+    if action == "encrypt_native":
+        r = get_resolve()
+        if r is None:
+            return _not_connected_error()
+        missing = _requires_method(r, "EncryptDCTL", "21.1")
+        if missing:
+            return missing
+        return encrypt_dctl(r, p.get("input_path"), p.get("output_path"), p.get("expiry"), _resolve_safe_dir)
+
     if action == "validate":
         source = p.get("source")
         if not isinstance(source, str):
@@ -31321,7 +31347,7 @@ def dctl(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]
         }
 
     return _unknown(action, ["path", "list", "install", "remove", "read",
-                             "validate", "template", "list_templates"])
+                             "encrypt_native", "validate_native", "validate", "template", "list_templates"])
 
 
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -32737,9 +32763,9 @@ if __name__ == "__main__":
     start_background_update_check(VERSION, project_dir, logger, env=_setup_update_env())
     _install_threaded_tool_dispatch(mcp)
 
-    # Support --full flag to run the 375-tool granular server instead
+    # Support --full flag to run the 377-tool granular server instead
     if "--full" in sys.argv:
-        logger.info("Starting full 375-tool granular server...")
+        logger.info("Starting full 377-tool granular server...")
         sys.argv = [arg for arg in sys.argv if arg != "--full"]
         from src.granular import mcp as granular_mcp
 

package/src/utils/api_truth.py

@@ -3263,7 +3263,12 @@ API_TRUTH: List[Dict[str, Any]] = [
                        "across lines before believing it. This server's own "
                        "`dctl validate` is a static, offline check (entry point, "
                        "brace balance, float suffixes) and does not call "
-                       "ValidateDCTL at all.",
+                       "ValidateDCTL at all. The separate `dctl validate_native` and "
+                       "granular `validate_dctl_native` now expose the native "
+                       "validator without changing source or diagnostics. Both "
+                       "interfaces were contributor-validated against the three "
+                       "fixtures on Studio 21.1.0.14; see "
+                       "resolve211-dctl-validation.md.",
         "tags": ["dctl", "validation", "unreliable-return", "version-gated", "reported"],
         "submit": "bug",
     },

package/src/utils/destructive_hook.py

@@ -63,6 +63,7 @@ SAFE_MODE_BLOCKED_RISK_LEVELS: FrozenSet[str] = frozenset({
 # replace_clip/link_*). The test_destructive_registry_drift guard asserts every
 # string here is a real handler so this can't regress.
 DESTRUCTIVE_ACTIONS_BY_TOOL: Dict[str, FrozenSet[str]] = {
+    "dctl": frozenset({"encrypt_native"}),
     "media_pool": frozenset({
         "delete_clips",
         "delete_folders",

package/src/utils/execution_lifecycle.py

@@ -193,6 +193,7 @@ class RiskClassificationHook(LifecycleHook):
     #: them unrecognised, i.e. it warns that the risk is unestablished for the
     #: actions whose risk is the best established of any we dispatch.
     _LOW_RISK_ACTIONS: Set[Tuple[str, str]] = {
+        ("dctl", "encrypt_native"),  # Creates a new file; never replaces existing content.
         ("timeline_markers", "add"),
         ("timeline_markers", "update_custom_data"),
         ("timeline_item_markers", "add"),
@@ -404,7 +405,7 @@ class RiskClassificationHook(LifecycleHook):
                 else BlastRadius.ITEM
             )
             reasons.append(f"Recoverable edit to existing state: {action}")
-        elif any(action.startswith(p) for p in cls._READ_ONLY_PREFIXES) or action in {"read", "status", "info"}:
+        elif any(action.startswith(p) for p in cls._READ_ONLY_PREFIXES) or action in {"read", "status", "info"} or pair == ("dctl", "validate_native"):
             level = RiskLevel.LOW
             destructive = False
             radius = BlastRadius.ITEM

package/src/utils/resolve211_dctl.py

@@ -0,0 +1,8 @@
+"""Native DCTL diagnostics are evidence; never reformat the user's shader source."""
+
+
+def native_dctl_result(resolve, source):
+    diagnostic=resolve.ValidateDCTL(source)
+    if diagnostic is not None and not isinstance(diagnostic,str):
+        return {'error':'ValidateDCTL returned an unexpected diagnostic type'}
+    return {'valid':diagnostic is None,'diagnostic':diagnostic,'checker':'resolve_native'}

package/src/utils/resolve211_encryption.py

@@ -0,0 +1,59 @@
+"""Stage native DCTL encryption, then publish without replacing an existing file."""
+import errno
+import hashlib
+import os
+from pathlib import Path
+import shutil
+import tempfile
+
+
+def encrypt_dctl(r, input_path, output_path, expiry, safe_dir):
+    if not isinstance(input_path,str) or not input_path or not isinstance(output_path,str) or not output_path:
+        return {'error':'input_path and output_path must be non-empty strings'}
+    if expiry is not None and not isinstance(expiry,str):
+        return {'error':'expiry must be an ISO 8601 string or null'}
+    source=Path(input_path).expanduser().absolute()
+    target=Path(output_path).expanduser().absolute()
+    if source.suffix.lower()!='.dctl' or not source.is_file():
+        return {'error':'input_path must name an existing .dctl file'}
+    if target.suffix.lower()!='.dctle':
+        return {'error':'output_path must end in .dctle'}
+    if os.path.lexists(target):
+        return {'error':'Output already exists; refusing to overwrite','success':False}
+    try:
+        target.parent.mkdir(parents=True,exist_ok=True)
+        staging_root=Path(safe_dir(str(target.parent.resolve())))
+        staging_root.mkdir(parents=True,exist_ok=True)
+        with tempfile.TemporaryDirectory(prefix='resolve-mcp-dctl-',dir=staging_root) as stage:
+            # Native Name is a stem: Resolve appends .dctle itself. Use a fixed
+            # staging name, so user filename characters never become native paths.
+            options={'Name':'encrypted','OutputFolder':stage,'Expiry':None if expiry=='' else expiry}
+            if not r.EncryptDCTL(str(source),options):
+                return {'success':False}
+            encrypted=Path(stage)/'encrypted.dctle'
+            if encrypted.is_symlink() or not encrypted.is_file() or encrypted.stat().st_size==0:
+                return {'success':False,'error':'Resolve reported success without a non-empty encrypted file'}
+            os.chmod(encrypted,0o600)
+            digest=hashlib.sha256(encrypted.read_bytes()).hexdigest()
+            size=encrypted.stat().st_size
+            try:
+                os.link(encrypted,target)
+            except OSError as exc:
+                if exc.errno not in (errno.EXDEV,errno.EPERM,errno.EOPNOTSUPP,errno.ENOSYS):
+                    raise
+                # Cross-volume/no-hardlink filesystem: exclusive creation still
+                # prevents overwriting an existing target, including a symlink.
+                fd=os.open(target,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
+                try:
+                    with os.fdopen(fd,'wb') as out, encrypted.open('rb') as src:
+                        shutil.copyfileobj(src,out)
+                        out.flush()
+                        os.fsync(out.fileno())
+                except BaseException:
+                    target.unlink(missing_ok=True)
+                    raise
+            return {'success':True,'path':str(target),'bytes':size,'sha256':digest}
+    except FileExistsError:
+        return {'success':False,'error':'Output appeared during encryption; refusing to overwrite'}
+    except Exception as exc:
+        return {'success':False,'error':'Encryption/export failed: '+(str(exc) or type(exc).__name__)}

package/src/utils/resolve_versions.py

@@ -226,6 +226,9 @@ _EVIDENCE_GATES: List[Dict[str, Any]] = [
 
 CODE_FLOORS: Dict[str, str] = {
     "Timeline.AutoAlignClips": "21.1",
+    "Resolve.ValidateDCTL": "21.1",
+
+    "Resolve.EncryptDCTL": "21.1",
     "MediaPool.CreateMulticamClip": "21.1",
     "TimelineItem.FlattenMulticam": "21.1",
     "Timeline.SetOutputBlanking": "21.1",