driftdetect-mcp 0.4.0 → 0.4.2

package/dist/server.js

@@ -5,9 +5,10 @@
  */
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
-import { PatternStore, ManifestStore, HistoryStore, DNAStore, PlaybookGenerator, AIContextBuilder, GENE_IDS, BoundaryStore, } from 'driftdetect-core';
+import { PatternStore, ManifestStore, HistoryStore, DNAStore, PlaybookGenerator, AIContextBuilder, GENE_IDS, BoundaryStore, createCallGraphAnalyzer, createBoundaryScanner, createSemanticDataAccessScanner, createImpactAnalyzer, createDeadCodeDetector, createCoverageAnalyzer, } from 'driftdetect-core';
 import { PackManager } from './packs.js';
 import { FeedbackManager } from './feedback.js';
+import { handleProjects } from './tools/discovery/projects.js';
 const PATTERN_CATEGORIES = [
     'structural', 'components', 'styling', 'api', 'auth', 'errors',
     'data-access', 'testing', 'logging', 'security', 'config',
@@ -38,6 +39,14 @@ const TOOLS = [
                     type: 'number',
                     description: 'Minimum confidence score (0.0-1.0)',
                 },
+                limit: {
+                    type: 'number',
+                    description: 'Maximum patterns to return (default: 30)',
+                },
+                includeExamples: {
+                    type: 'boolean',
+                    description: 'Include example locations (default: true, set false for compact output)',
+                },
             },
             required: [],
         },
@@ -56,6 +65,18 @@ const TOOLS = [
                     type: 'string',
                     description: 'Filter by category',
                 },
+                limit: {
+                    type: 'number',
+                    description: 'Maximum patterns to return (default: 20)',
+                },
+                offset: {
+                    type: 'number',
+                    description: 'Skip first N patterns for pagination (default: 0)',
+                },
+                compact: {
+                    type: 'boolean',
+                    description: 'Return summary only without full pattern details (default: false)',
+                },
             },
             required: ['path'],
         },
@@ -74,6 +95,14 @@ const TOOLS = [
                     type: 'string',
                     description: 'Filter by category',
                 },
+                limit: {
+                    type: 'number',
+                    description: 'Maximum patterns to return (default: 10)',
+                },
+                maxLocations: {
+                    type: 'number',
+                    description: 'Maximum locations per pattern (default: 5)',
+                },
             },
             required: ['pattern'],
         },
@@ -394,6 +423,83 @@ const TOOLS = [
                     type: 'boolean',
                     description: 'Include boundary violations in response (default: true)',
                 },
+                limit: {
+                    type: 'number',
+                    description: 'Maximum items per section (default: 10)',
+                },
+            },
+            required: [],
+        },
+    },
+    // Call Graph Tool
+    {
+        name: 'drift_callgraph',
+        description: 'Build and query call graphs for code reachability analysis. Answers "What data can this code access?", "Who can reach this data?", "What breaks if I change this?", "What code is never called?", and "Which sensitive data paths are tested?" Use this to understand the impact of security findings or code changes.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                action: {
+                    type: 'string',
+                    enum: ['status', 'build', 'reach', 'inverse', 'function', 'security', 'impact', 'dead', 'coverage'],
+                    description: 'Action to perform (default: status). "status" shows overview, "build" builds the call graph, "reach" finds what data a location can access, "inverse" finds who can access specific data, "function" shows function details, "security" shows security-prioritized view (P0-P4 tiers), "impact" analyzes what breaks if you change a file or function, "dead" finds functions that are never called, "coverage" analyzes test coverage for sensitive data access paths',
+                },
+                location: {
+                    type: 'string',
+                    description: 'Code location for "reach" action (file:line or function_name)',
+                },
+                target: {
+                    type: 'string',
+                    description: 'Data target for "inverse" action (table or table.field), or file/function for "impact" action',
+                },
+                functionName: {
+                    type: 'string',
+                    description: 'Function name for "function" action',
+                },
+                maxDepth: {
+                    type: 'number',
+                    description: 'Maximum traversal depth (default: 10)',
+                },
+                confidence: {
+                    type: 'string',
+                    enum: ['high', 'medium', 'low'],
+                    description: 'Minimum confidence level for "dead" action (default: low)',
+                },
+                limit: {
+                    type: 'number',
+                    description: 'Maximum items per section in output (default: 10)',
+                },
+            },
+            required: [],
+        },
+    },
+    // Projects Tool
+    {
+        name: 'drift_projects',
+        description: 'List and manage registered drift projects. Enables working across multiple codebases. Use this to see all projects, switch between them, or get details about a specific project.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                action: {
+                    type: 'string',
+                    enum: ['list', 'info', 'switch', 'recent'],
+                    description: 'Action to perform (default: list). "list" shows all projects, "info" shows details for a project, "switch" changes active project, "recent" shows recently used projects',
+                },
+                project: {
+                    type: 'string',
+                    description: 'Project name, ID, or path (for info/switch actions)',
+                },
+                language: {
+                    type: 'string',
+                    description: 'Filter by language (for list action)',
+                },
+                framework: {
+                    type: 'string',
+                    description: 'Filter by framework (for list action)',
+                },
+                limit: {
+                    type: 'number',
+                    description: 'Maximum projects to return (default: all)',
+                },
             },
             required: [],
         },
@@ -449,6 +555,10 @@ export function createDriftMCPServer(config) {
                     return await handleDNACheck(config.projectRoot, dnaStore, args);
                 case 'drift_boundaries':
                     return await handleBoundaries(boundaryStore, args);
+                case 'drift_callgraph':
+                    return await handleCallGraph(config.projectRoot, args);
+                case 'drift_projects':
+                    return await handleProjects(args);
                 default:
                     return {
                         content: [{ type: 'text', text: `Unknown tool: ${name}` }],
@@ -496,6 +606,11 @@ async function handlePatterns(store, args) {
     if (args.minConfidence !== undefined) {
         patterns = patterns.filter(p => p.confidence.score >= args.minConfidence);
     }
+    const totalCount = patterns.length;
+    const limit = args.limit ?? 30;
+    const includeExamples = args.includeExamples ?? true;
+    // Apply limit
+    patterns = patterns.slice(0, limit);
     // Format for AI consumption
     const result = patterns.map(p => ({
         id: p.id,
@@ -507,13 +622,22 @@ async function handlePatterns(store, args) {
         confidenceLevel: p.confidence.level,
         locationCount: p.locations.length,
         outlierCount: p.outliers.length,
-        exampleLocations: p.locations.slice(0, 3).map(l => ({
-            file: l.file,
-            line: l.line,
-        })),
+        ...(includeExamples ? {
+            exampleLocations: p.locations.slice(0, 2).map(l => ({
+                file: l.file,
+                line: l.line,
+            })),
+        } : {}),
     }));
+    // Add pagination info
+    const output = {
+        patterns: result,
+        total: totalCount,
+        showing: result.length,
+        ...(totalCount > limit ? { truncated: true, hint: `Use limit parameter to see more (showing ${limit} of ${totalCount})` } : {}),
+    };
     return {
-        content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+        content: [{ type: 'text', text: JSON.stringify(output, null, 2) }],
     };
 }
 async function handleFiles(store, args) {
@@ -530,6 +654,80 @@ async function handleFiles(store, args) {
             content: [{ type: 'text', text: `No patterns found in "${args.path}"` }],
         };
     }
+    const limit = args.limit ?? 20;
+    const offset = args.offset ?? 0;
+    const compact = args.compact ?? false;
+    // Handle array results (from glob patterns)
+    if (Array.isArray(result)) {
+        const totalCount = result.length;
+        const paginatedResult = result.slice(offset, offset + limit);
+        if (compact) {
+            // Return summary only
+            const summary = {
+                totalFiles: totalCount,
+                showing: paginatedResult.length,
+                offset,
+                files: paginatedResult.map((r) => ({
+                    file: r.file,
+                    patternCount: r.patterns?.length ?? 0,
+                })),
+                ...(totalCount > offset + limit ? {
+                    truncated: true,
+                    hint: `Use offset=${offset + limit} to see next page`
+                } : {}),
+            };
+            return {
+                content: [{ type: 'text', text: JSON.stringify(summary, null, 2) }],
+            };
+        }
+        const output = {
+            totalFiles: totalCount,
+            showing: paginatedResult.length,
+            offset,
+            results: paginatedResult,
+            ...(totalCount > offset + limit ? {
+                truncated: true,
+                hint: `Use offset=${offset + limit} to see next page`
+            } : {}),
+        };
+        return {
+            content: [{ type: 'text', text: JSON.stringify(output, null, 2) }],
+        };
+    }
+    // Single file result - limit patterns within the file
+    if (result.patterns && Array.isArray(result.patterns)) {
+        const totalPatterns = result.patterns.length;
+        const paginatedPatterns = result.patterns.slice(offset, offset + limit);
+        if (compact) {
+            const summary = {
+                file: result.file,
+                totalPatterns,
+                showing: paginatedPatterns.length,
+                categories: [...new Set(result.patterns.map((p) => p.category))],
+                ...(totalPatterns > offset + limit ? {
+                    truncated: true,
+                    hint: `Use offset=${offset + limit} to see next page`
+                } : {}),
+            };
+            return {
+                content: [{ type: 'text', text: JSON.stringify(summary, null, 2) }],
+            };
+        }
+        const output = {
+            ...result,
+            patterns: paginatedPatterns,
+            totalPatterns,
+            showing: paginatedPatterns.length,
+            offset,
+            ...(totalPatterns > offset + limit ? {
+                truncated: true,
+                hint: `Use offset=${offset + limit} to see next page`
+            } : {}),
+        };
+        return {
+            content: [{ type: 'text', text: JSON.stringify(output, null, 2) }],
+        };
+    }
     return {
         content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
     };
@@ -542,18 +740,36 @@ async function handleWhere(store, args) {
     if (args.category) {
         patterns = patterns.filter(p => p.category === args.category);
     }
+    const limit = args.limit ?? 10;
+    const maxLocations = args.maxLocations ?? 5;
+    const totalPatterns = patterns.length;
+    // Apply pattern limit
+    patterns = patterns.slice(0, limit);
     const result = patterns.map(p => ({
         id: p.id,
         name: p.name,
         category: p.category,
-        locations: p.locations.map(l => ({
+        totalLocations: p.locations.length,
+        locations: p.locations.slice(0, maxLocations).map(l => ({
             file: l.file,
             line: l.line,
             column: l.column,
         })),
+        ...(p.locations.length > maxLocations ? {
+            locationsHint: `Showing ${maxLocations} of ${p.locations.length}. Use maxLocations parameter to see more.`
+        } : {}),
     }));
+    const output = {
+        patterns: result,
+        total: totalPatterns,
+        showing: result.length,
+        ...(totalPatterns > limit ? {
+            truncated: true,
+            hint: `Showing ${limit} of ${totalPatterns} patterns. Use limit parameter to see more.`
+        } : {}),
+    };
     return {
-        content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+        content: [{ type: 'text', text: JSON.stringify(output, null, 2) }],
     };
 }
 async function handleExport(store, args) {
@@ -1829,6 +2045,7 @@ async function handleBoundaries(store, args) {
     await store.initialize();
     const action = args.action ?? 'overview';
     const includeViolations = args.includeViolations ?? true;
+    const limit = args.limit ?? 10;
     switch (action) {
         case 'overview': {
             const accessMap = store.getAccessMap();
@@ -1846,12 +2063,16 @@ async function handleBoundaries(store, args) {
                     accessCount: info.accessedBy.length,
                     hasSensitive: info.sensitiveFields.length > 0,
                 }))
-                    .sort((a, b) => b.accessCount - a.accessCount)
-                    .slice(0, 10);
-                for (const table of tableEntries) {
+                    .sort((a, b) => b.accessCount - a.accessCount);
+                const totalTables = tableEntries.length;
+                const limitedTables = tableEntries.slice(0, limit);
+                for (const table of limitedTables) {
                     const sensitive = table.hasSensitive ? ' ⚠️' : '';
                     output += `- **${table.name}**${sensitive}: ${table.accessCount} access points\n`;
                 }
+                if (totalTables > limit) {
+                    output += `\n*... and ${totalTables - limit} more tables. Use \`drift_boundaries action="table" table="<name>"\` for details.*\n`;
+                }
                 output += '\n';
             }
             if (sensitiveFields.length > 0) {
@@ -1862,11 +2083,15 @@ async function handleBoundaries(store, args) {
                     fieldCounts.set(key, (fieldCounts.get(key) ?? 0) + 1);
                 }
                 const sortedFields = Array.from(fieldCounts.entries())
-                    .sort((a, b) => b[1] - a[1])
-                    .slice(0, 10);
-                for (const [fieldName, count] of sortedFields) {
+                    .sort((a, b) => b[1] - a[1]);
+                const totalFields = sortedFields.length;
+                const limitedFields = sortedFields.slice(0, limit);
+                for (const [fieldName, count] of limitedFields) {
                     output += `- **${fieldName}**: ${count} locations\n`;
                 }
+                if (totalFields > limit) {
+                    output += `\n*... and ${totalFields - limit} more fields. Use \`drift_boundaries action="sensitive"\` for full list.*\n`;
+                }
                 output += '\n';
             }
             if (includeViolations) {
@@ -1874,12 +2099,13 @@ async function handleBoundaries(store, args) {
                 if (rules) {
                     const violations = store.checkAllViolations();
                     if (violations.length > 0) {
+                        const limitedViolations = violations.slice(0, limit);
                         output += `## ⚠️ Violations (${violations.length})\n\n`;
-                        for (const v of violations.slice(0, 5)) {
+                        for (const v of limitedViolations) {
                             output += `- **${v.file}:${v.line}** - ${v.message}\n`;
                         }
-                        if (violations.length > 5) {
-                            output += `- ... and ${violations.length - 5} more\n`;
+                        if (violations.length > limit) {
+                            output += `\n*... and ${violations.length - limit} more. Use \`drift_boundaries action="check"\` for full list.*\n`;
                         }
                     }
                     else {
@@ -2117,4 +2343,835 @@ async function handleBoundaries(store, args) {
             };
     }
 }
+// ============================================================================
+// Call Graph Handler Function
+// ============================================================================
+/**
+ * Handle drift_callgraph tool - Call graph analysis
+ */
+async function handleCallGraph(projectRoot, args) {
+    const action = args.action ?? 'status';
+    const maxDepth = args.maxDepth ?? 10;
+    const limit = args.limit ?? 10;
+    const analyzer = createCallGraphAnalyzer({ rootDir: projectRoot });
+    switch (action) {
+        case 'build': {
+            try {
+                // File patterns to scan
+                const filePatterns = [
+                    '**/*.ts',
+                    '**/*.tsx',
+                    '**/*.js',
+                    '**/*.jsx',
+                    '**/*.py',
+                ];
+                // Step 1: Run semantic data access scanner (tree-sitter/TypeScript compiler based)
+                const semanticScanner = createSemanticDataAccessScanner({ rootDir: projectRoot });
+                const semanticResult = await semanticScanner.scanDirectory({ patterns: filePatterns });
+                // Use semantic results as primary source
+                let dataAccessPoints = semanticResult.accessPoints;
+                // Step 2: Fall back to boundary scanner for additional coverage (regex-based)
+                const boundaryScanner = createBoundaryScanner({ rootDir: projectRoot });
+                await boundaryScanner.initialize();
+                const boundaryResult = await boundaryScanner.scanDirectory({ patterns: filePatterns });
+                // Merge boundary results with semantic results (semantic takes precedence)
+                for (const [, accessPoint] of Object.entries(boundaryResult.accessMap.accessPoints)) {
+                    const existing = dataAccessPoints.get(accessPoint.file) ?? [];
+                    // Only add if not already detected by semantic scanner
+                    const isDuplicate = existing.some(ap => ap.line === accessPoint.line && ap.table === accessPoint.table);
+                    if (!isDuplicate) {
+                        existing.push(accessPoint);
+                        dataAccessPoints.set(accessPoint.file, existing);
+                    }
+                }
+                // Step 3: Build call graph with data access points
+                await analyzer.initialize();
+                const graph = await analyzer.scan(filePatterns, dataAccessPoints);
+                let output = '# Call Graph Built\n\n';
+                output += `- **Functions:** ${graph.stats.totalFunctions}\n`;
+                output += `- **Call Sites:** ${graph.stats.totalCallSites}\n`;
+                output += `- **Resolved:** ${graph.stats.resolvedCallSites} (${Math.round(graph.stats.resolvedCallSites / Math.max(1, graph.stats.totalCallSites) * 100)}%)\n`;
+                output += `- **Entry Points:** ${graph.entryPoints.length}\n`;
+                output += `- **Data Accessors:** ${graph.dataAccessors.length}\n\n`;
+                // Semantic scanner stats (primary)
+                if (semanticResult.stats.accessPointsFound > 0) {
+                    output += '## Data Access Detection (Semantic)\n\n';
+                    output += `- **Files Scanned:** ${semanticResult.stats.filesScanned}\n`;
+                    output += `- **Access Points:** ${semanticResult.stats.accessPointsFound}\n`;
+                    if (Object.keys(semanticResult.stats.byOrm).length > 0) {
+                        const orms = Object.entries(semanticResult.stats.byOrm)
+                            .sort((a, b) => b[1] - a[1])
+                            .map(([orm, count]) => `${orm}: ${count}`)
+                            .join(', ');
+                        output += `- **By ORM:** ${orms}\n`;
+                    }
+                    output += '\n';
+                }
+                // Boundary stats (fallback)
+                if (boundaryResult.stats.accessPointsFound > 0) {
+                    output += '## Data Access Detection (Regex Fallback)\n\n';
+                    output += `- **Tables Found:** ${boundaryResult.stats.tablesFound}\n`;
+                    output += `- **Access Points:** ${boundaryResult.stats.accessPointsFound}\n`;
+                    output += `- **Sensitive Fields:** ${boundaryResult.stats.sensitiveFieldsFound}\n\n`;
+                }
+                const languages = Object.entries(graph.stats.byLanguage)
+                    .filter(([, count]) => count > 0)
+                    .sort((a, b) => b[1] - a[1]);
+                if (languages.length > 0) {
+                    output += '## By Language\n\n';
+                    for (const [lang, count] of languages) {
+                        output += `- **${lang}:** ${count} functions\n`;
+                    }
+                }
+                return { content: [{ type: 'text', text: output }] };
+            }
+            catch (error) {
+                return {
+                    content: [{ type: 'text', text: `Error building call graph: ${error}` }],
+                    isError: true,
+                };
+            }
+        }
+        case 'status': {
+            try {
+                await analyzer.initialize();
+                const graph = analyzer.getGraph();
+                if (!graph) {
+                    return {
+                        content: [{
+                                type: 'text',
+                                text: '# No Call Graph Found\n\n' +
+                                    'Run `drift_callgraph action="build"` to build the call graph first.\n\n' +
+                                    'The call graph enables:\n' +
+                                    '- Forward reachability: "What data can this code access?"\n' +
+                                    '- Inverse reachability: "Who can access this data?"\n' +
+                                    '- Security impact analysis\n',
+                            }],
+                    };
+                }
+                let output = '# Call Graph Status\n\n';
+                output += `- **Functions:** ${graph.stats.totalFunctions}\n`;
+                output += `- **Call Sites:** ${graph.stats.totalCallSites} (${graph.stats.resolvedCallSites} resolved)\n`;
+                output += `- **Entry Points:** ${graph.entryPoints.length}\n`;
+                output += `- **Data Accessors:** ${graph.dataAccessors.length}\n\n`;
+                if (graph.entryPoints.length > 0) {
+                    output += '## Entry Points\n\n';
+                    const limitedEntryPoints = graph.entryPoints.slice(0, limit);
+                    for (const id of limitedEntryPoints) {
+                        const func = graph.functions.get(id);
+                        if (func) {
+                            output += `- **${func.qualifiedName}** @ ${func.file}:${func.startLine}\n`;
+                        }
+                    }
+                    if (graph.entryPoints.length > limit) {
+                        output += `\n*... and ${graph.entryPoints.length - limit} more entry points*\n`;
+                    }
+                    output += '\n';
+                }
+                if (graph.dataAccessors.length > 0) {
+                    output += '## Data Accessors\n\n';
+                    const limitedAccessors = graph.dataAccessors.slice(0, limit);
+                    for (const id of limitedAccessors) {
+                        const func = graph.functions.get(id);
+                        if (func) {
+                            const tables = [...new Set(func.dataAccess.map(d => d.table))];
+                            output += `- **${func.qualifiedName}** → [${tables.join(', ')}]\n`;
+                        }
+                    }
+                    if (graph.dataAccessors.length > limit) {
+                        output += `\n*... and ${graph.dataAccessors.length - limit} more data accessors*\n`;
+                    }
+                }
+                return { content: [{ type: 'text', text: output }] };
+            }
+            catch (error) {
+                return {
+                    content: [{ type: 'text', text: `Error: ${error}` }],
+                    isError: true,
+                };
+            }
+        }
+        case 'reach': {
+            if (!args.location) {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: 'Error: location parameter required for "reach" action.\n\n' +
+                                'Examples:\n' +
+                                '- `drift_callgraph action="reach" location="src/auth.py:45"`\n' +
+                                '- `drift_callgraph action="reach" location="login_user"`',
+                        }],
+                    isError: true,
+                };
+            }
+            try {
+                await analyzer.initialize();
+                const graph = analyzer.getGraph();
+                if (!graph) {
+                    return {
+                        content: [{ type: 'text', text: 'No call graph found. Run build first.' }],
+                        isError: true,
+                    };
+                }
+                // Parse location
+                let result;
+                if (args.location.includes(':')) {
+                    const parts = args.location.split(':');
+                    const file = parts[0];
+                    const lineStr = parts[1];
+                    if (file && lineStr) {
+                        const line = parseInt(lineStr, 10);
+                        if (!isNaN(line)) {
+                            result = analyzer.getReachableData(file, line, { maxDepth });
+                        }
+                    }
+                }
+                if (!result) {
+                    // Try as function name
+                    let funcId;
+                    for (const [id, func] of graph.functions) {
+                        if (func.name === args.location || func.qualifiedName === args.location) {
+                            funcId = id;
+                            break;
+                        }
+                    }
+                    if (funcId) {
+                        result = analyzer.getReachableDataFromFunction(funcId, { maxDepth });
+                    }
+                    else {
+                        return {
+                            content: [{ type: 'text', text: `Function or location '${args.location}' not found.` }],
+                            isError: true,
+                        };
+                    }
+                }
+                let output = '# Reachability Analysis\n\n';
+                output += `**Origin:** ${args.location}\n`;
+                output += `**Tables Reachable:** ${result.tables.join(', ') || 'none'}\n`;
+                output += `**Functions Traversed:** ${result.functionsTraversed}\n`;
+                output += `**Max Depth:** ${result.maxDepth}\n\n`;
+                if (result.sensitiveFields.length > 0) {
+                    output += '## ⚠️ Sensitive Fields Accessible\n\n';
+                    for (const sf of result.sensitiveFields) {
+                        output += `- **${sf.field.table}.${sf.field.field}** (${sf.field.sensitivityType})\n`;
+                        output += `  - ${sf.accessCount} access point(s), ${sf.paths.length} path(s)\n`;
+                    }
+                    output += '\n';
+                }
+                if (result.reachableAccess.length > 0) {
+                    output += '## Data Access Points\n\n';
+                    for (const ra of result.reachableAccess.slice(0, 15)) {
+                        output += `- **${ra.access.operation}** ${ra.access.table}.${ra.access.fields.join(', ')}\n`;
+                        output += `  - Path: ${ra.path.map(p => p.functionName).join(' → ')}\n`;
+                    }
+                    if (result.reachableAccess.length > 15) {
+                        output += `- ... and ${result.reachableAccess.length - 15} more\n`;
+                    }
+                }
+                return { content: [{ type: 'text', text: output }] };
+            }
+            catch (error) {
+                return {
+                    content: [{ type: 'text', text: `Error: ${error}` }],
+                    isError: true,
+                };
+            }
+        }
+        case 'inverse': {
+            if (!args.target) {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: 'Error: target parameter required for "inverse" action.\n\n' +
+                                'Examples:\n' +
+                                '- `drift_callgraph action="inverse" target="users"`\n' +
+                                '- `drift_callgraph action="inverse" target="users.password_hash"`',
+                        }],
+                    isError: true,
+                };
+            }
+            try {
+                await analyzer.initialize();
+                const graph = analyzer.getGraph();
+                if (!graph) {
+                    return {
+                        content: [{ type: 'text', text: 'No call graph found. Run build first.' }],
+                        isError: true,
+                    };
+                }
+                const parts = args.target.split('.');
+                const table = parts[0] ?? '';
+                const field = parts.length > 1 ? parts.slice(1).join('.') : undefined;
+                const result = analyzer.getCodePathsToData(field ? { table, field, maxDepth } : { table, maxDepth });
+                let output = '# Inverse Reachability\n\n';
+                output += `**Target:** ${args.target}\n`;
+                output += `**Direct Accessors:** ${result.totalAccessors}\n`;
+                output += `**Entry Points That Can Reach:** ${result.entryPoints.length}\n\n`;
+                if (result.accessPaths.length > 0) {
+                    output += '## Access Paths\n\n';
+                    for (const ap of result.accessPaths.slice(0, 10)) {
+                        const entryFunc = graph.functions.get(ap.entryPoint);
+                        if (entryFunc) {
+                            output += `### ${entryFunc.qualifiedName}\n`;
+                            output += `- Path: ${ap.path.map(p => p.functionName).join(' → ')}\n\n`;
+                        }
+                    }
+                    if (result.accessPaths.length > 10) {
+                        output += `... and ${result.accessPaths.length - 10} more paths\n`;
+                    }
+                }
+                else {
+                    output += 'No entry points can reach this data.\n';
+                }
+                return { content: [{ type: 'text', text: output }] };
+            }
+            catch (error) {
+                return {
+                    content: [{ type: 'text', text: `Error: ${error}` }],
+                    isError: true,
+                };
+            }
+        }
+        case 'function': {
+            if (!args.functionName) {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: 'Error: functionName parameter required for "function" action.',
+                        }],
+                    isError: true,
+                };
+            }
+            try {
+                await analyzer.initialize();
+                const graph = analyzer.getGraph();
+                if (!graph) {
+                    return {
+                        content: [{ type: 'text', text: 'No call graph found. Run build first.' }],
+                        isError: true,
+                    };
+                }
+                let func;
+                for (const [, f] of graph.functions) {
+                    if (f.name === args.functionName || f.qualifiedName === args.functionName) {
+                        func = f;
+                        break;
+                    }
+                }
+                if (!func) {
+                    return {
+                        content: [{ type: 'text', text: `Function '${args.functionName}' not found.` }],
+                        isError: true,
+                    };
+                }
+                let output = `# Function: ${func.qualifiedName}\n\n`;
+                output += `- **File:** ${func.file}:${func.startLine}\n`;
+                output += `- **Language:** ${func.language}\n`;
+                if (func.className)
+                    output += `- **Class:** ${func.className}\n`;
+                output += `- **Exported:** ${func.isExported ? 'yes' : 'no'}\n`;
+                output += `- **Async:** ${func.isAsync ? 'yes' : 'no'}\n\n`;
+                if (func.parameters.length > 0) {
+                    output += '## Parameters\n\n';
+                    for (const p of func.parameters) {
+                        output += `- **${p.name}**${p.type ? `: ${p.type}` : ''}\n`;
+                    }
+                    output += '\n';
+                }
+                if (func.calls.length > 0) {
+                    output += `## Calls (${func.calls.length})\n\n`;
+                    for (const c of func.calls.slice(0, 10)) {
+                        const status = c.resolved ? '✓' : '?';
+                        output += `- ${status} **${c.calleeName}** (line ${c.line})\n`;
+                    }
+                    if (func.calls.length > 10) {
+                        output += `- ... and ${func.calls.length - 10} more\n`;
+                    }
+                    output += '\n';
+                }
+                if (func.calledBy.length > 0) {
+                    output += `## Called By (${func.calledBy.length})\n\n`;
+                    for (const c of func.calledBy.slice(0, 10)) {
+                        const caller = graph.functions.get(c.callerId);
+                        output += `- **${caller?.qualifiedName ?? c.callerId}**\n`;
+                    }
+                    if (func.calledBy.length > 10) {
+                        output += `- ... and ${func.calledBy.length - 10} more\n`;
+                    }
+                    output += '\n';
+                }
+                if (func.dataAccess.length > 0) {
+                    output += '## Data Access\n\n';
+                    for (const d of func.dataAccess) {
+                        output += `- **${d.operation}** ${d.table}.${d.fields.join(', ')}\n`;
+                    }
+                }
+                return { content: [{ type: 'text', text: output }] };
+            }
+            catch (error) {
+                return {
+                    content: [{ type: 'text', text: `Error: ${error}` }],
+                    isError: true,
+                };
+            }
+        }
+        case 'security': {
+            try {
+                // Import security prioritizer dynamically to avoid circular deps
+                const { createSecurityPrioritizer } = await import('driftdetect-core');
+                // Run boundary scan
+                const boundaryScanner = createBoundaryScanner({ rootDir: projectRoot });
+                await boundaryScanner.initialize();
+                const filePatterns = ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx', '**/*.py'];
+                const boundaryResult = await boundaryScanner.scanDirectory({ patterns: filePatterns });
+                // Prioritize by security
+                const prioritizer = createSecurityPrioritizer();
+                const prioritized = prioritizer.prioritize(boundaryResult.accessMap);
+                const { summary } = prioritized;
+                let output = '# 🔒 Security-Prioritized Data Access\n\n';
+                output += '## Summary\n\n';
+                output += `- **Total Access Points:** ${summary.totalAccessPoints}\n`;
+                output += `- **🔴 Critical (P0/P1):** ${summary.criticalCount}\n`;
+                output += `- **🟡 High (P2):** ${summary.highCount}\n`;
+                output += `- **⚪ Low (P3/P4):** ${summary.lowCount}\n`;
+                output += `- **📦 Noise (filtered):** ${summary.noiseCount}\n\n`;
+                // Regulations
+                if (summary.regulations.length > 0) {
+                    output += '## Regulatory Implications\n\n';
+                    output += summary.regulations.map(r => `**${r.toUpperCase()}**`).join(', ') + '\n\n';
+                }
+                // Critical items - use limit parameter
+                if (prioritized.critical.length > 0) {
+                    const limitedCritical = prioritized.critical.slice(0, limit);
+                    output += '## 🚨 Critical Security Items (P0/P1)\n\n';
+                    output += 'These require immediate attention:\n\n';
+                    for (const p of limitedCritical) {
+                        const sensitivityIcon = p.security.maxSensitivity === 'credentials' ? '🔑' :
+                            p.security.maxSensitivity === 'financial' ? '💰' :
+                                p.security.maxSensitivity === 'health' ? '🏥' :
+                                    p.security.maxSensitivity === 'pii' ? '👤' : '❓';
+                        output += `### ${p.security.tier} ${sensitivityIcon} ${p.accessPoint.table}\n`;
+                        output += `- **Operation:** ${p.accessPoint.operation}\n`;
+                        output += `- **Fields:** ${p.accessPoint.fields.join(', ') || '*'}\n`;
+                        output += `- **Location:** ${p.accessPoint.file}:${p.accessPoint.line}\n`;
+                        output += `- **Risk Score:** ${p.security.riskScore}/100\n`;
+                        output += `- **Rationale:** ${p.security.rationale}\n`;
+                        if (p.security.regulations.length > 0) {
+                            output += `- **Regulations:** ${p.security.regulations.join(', ')}\n`;
+                        }
+                        output += '\n';
+                    }
+                    if (prioritized.critical.length > limit) {
+                        output += `*... and ${prioritized.critical.length - limit} more critical items. Use \`limit=${limit + 10}\` to see more.*\n\n`;
+                    }
+                }
+                // High priority items - use limit parameter
+                if (prioritized.high.length > 0) {
+                    const highLimit = Math.max(5, Math.floor(limit / 2));
+                    const limitedHigh = prioritized.high.slice(0, highLimit);
+                    output += '## ⚠️ High Priority Items (P2)\n\n';
+                    for (const p of limitedHigh) {
+                        output += `- **${p.accessPoint.table}**.${p.accessPoint.fields.join(', ') || '*'} (${p.accessPoint.operation})\n`;
+                        output += `  - ${p.accessPoint.file}:${p.accessPoint.line}\n`;
+                    }
+                    if (prioritized.high.length > highLimit) {
+                        output += `\n*... and ${prioritized.high.length - highLimit} more high priority items*\n`;
+                    }
+                    output += '\n';
+                }
+                // Sensitivity breakdown
+                output += '## By Sensitivity Type\n\n';
+                if (summary.bySensitivity.credentials > 0) {
+                    output += `- **🔑 Credentials:** ${summary.bySensitivity.credentials}\n`;
+                }
+                if (summary.bySensitivity.financial > 0) {
+                    output += `- **💰 Financial:** ${summary.bySensitivity.financial}\n`;
+                }
+                if (summary.bySensitivity.health > 0) {
+                    output += `- **🏥 Health:** ${summary.bySensitivity.health}\n`;
+                }
+                if (summary.bySensitivity.pii > 0) {
+                    output += `- **👤 PII:** ${summary.bySensitivity.pii}\n`;
+                }
+                output += `- **❓ Unknown:** ${summary.bySensitivity.unknown}\n`;
+                return { content: [{ type: 'text', text: output }] };
+            }
+            catch (error) {
+                return {
+                    content: [{ type: 'text', text: `Error: ${error}` }],
+                    isError: true,
+                };
+            }
+        }
+        case 'impact': {
+            if (!args.target) {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: 'Error: target parameter required for "impact" action.\n\n' +
+                                'Examples:\n' +
+                                '- `drift_callgraph action="impact" target="src/auth.py"` (analyze file)\n' +
+                                '- `drift_callgraph action="impact" target="login_user"` (analyze function)',
+                        }],
+                    isError: true,
+                };
+            }
+            try {
+                await analyzer.initialize();
+                const graph = analyzer.getGraph();
+                if (!graph) {
+                    return {
+                        content: [{ type: 'text', text: 'No call graph found. Run build first.' }],
+                        isError: true,
+                    };
+                }
+                const impactAnalyzer = createImpactAnalyzer(graph);
+                let result;
+                // Determine if target is a file or function
+                if (args.target.includes('/') || args.target.includes('.py') || args.target.includes('.ts') || args.target.includes('.js')) {
+                    result = impactAnalyzer.analyzeFile(args.target);
+                }
+                else {
+                    result = impactAnalyzer.analyzeFunctionByName(args.target);
+                }
+                let output = '# 💥 Impact Analysis\n\n';
+                // Target info
+                if (result.target.type === 'file') {
+                    output += `**Target:** ${result.target.file} (${result.changedFunctions.length} functions)\n\n`;
+                }
+                else {
+                    output += `**Target:** ${result.target.functionName ?? result.target.functionId ?? 'unknown'}\n\n`;
+                }
+                // Risk assessment
+                const riskEmoji = result.risk === 'critical' ? '🔴' :
+                    result.risk === 'high' ? '🟠' :
+                        result.risk === 'medium' ? '🟡' : '🟢';
+                output += `**Risk Level:** ${riskEmoji} **${result.risk.toUpperCase()}** (score: ${result.riskScore}/100)\n\n`;
+                // Summary
+                output += '## Summary\n\n';
+                output += `- **Direct Callers:** ${result.summary.directCallers}\n`;
+                output += `- **Transitive Callers:** ${result.summary.transitiveCallers}\n`;
+                output += `- **Affected Entry Points:** ${result.summary.affectedEntryPoints}\n`;
+                output += `- **Sensitive Data Paths:** ${result.summary.affectedDataPaths}\n`;
+                output += `- **Max Call Depth:** ${result.summary.maxDepth}\n\n`;
+                // Entry points affected - use limit
+                if (result.entryPoints.length > 0) {
+                    const limitedEntryPoints = result.entryPoints.slice(0, limit);
+                    output += '## 🚪 Affected Entry Points (User-Facing Impact)\n\n';
+                    for (const ep of limitedEntryPoints) {
+                        output += `### ${ep.qualifiedName}\n`;
+                        output += `- **Location:** ${ep.file}:${ep.line}\n`;
+                        output += `- **Path:** ${ep.pathToChange.map(p => p.functionName).join(' → ')}\n\n`;
+                    }
+                    if (result.entryPoints.length > limit) {
+                        output += `*... and ${result.entryPoints.length - limit} more entry points. Use \`limit=${limit + 10}\` to see more.*\n\n`;
+                    }
+                }
+                // Sensitive data paths - use limit
+                if (result.sensitiveDataPaths.length > 0) {
+                    const limitedPaths = result.sensitiveDataPaths.slice(0, limit);
+                    output += '## 🔒 Sensitive Data Paths Affected\n\n';
+                    for (const dp of limitedPaths) {
+                        const sensitivityIcon = dp.sensitivity === 'credentials' ? '🔑' :
+                            dp.sensitivity === 'financial' ? '💰' :
+                                dp.sensitivity === 'health' ? '🏥' : '👤';
+                        output += `### ${sensitivityIcon} ${dp.sensitivity}: ${dp.table}.${dp.fields.join(', ')}\n`;
+                        output += `- **Operation:** ${dp.operation}\n`;
+                        output += `- **Entry Point:** ${dp.entryPoint}\n`;
+                        output += `- **Path:** ${dp.fullPath.map(n => n.functionName).join(' → ')}\n\n`;
+                    }
+                    if (result.sensitiveDataPaths.length > limit) {
+                        output += `*... and ${result.sensitiveDataPaths.length - limit} more sensitive paths*\n\n`;
+                    }
+                }
+                // Direct callers - use limit
+                const directCallers = result.affected.filter(a => a.depth === 1);
+                if (directCallers.length > 0) {
+                    const limitedDirect = directCallers.slice(0, limit);
+                    output += '## 📞 Direct Callers (Immediate Impact)\n\n';
+                    for (const caller of limitedDirect) {
+                        const icon = caller.accessesSensitiveData ? '🔴' : '⚪';
+                        output += `- ${icon} **${caller.qualifiedName}** @ ${caller.file}:${caller.line}\n`;
+                    }
+                    if (directCallers.length > limit) {
+                        output += `\n*... and ${directCallers.length - limit} more direct callers*\n`;
+                    }
+                    output += '\n';
+                }
+                // Transitive callers - use smaller limit
+                const transitiveCallers = result.affected.filter(a => a.depth > 1);
+                if (transitiveCallers.length > 0) {
+                    const transitiveLimit = Math.max(5, Math.floor(limit / 2));
+                    const limitedTransitive = transitiveCallers.slice(0, transitiveLimit);
+                    output += '## 🔗 Transitive Callers (Ripple Effect)\n\n';
+                    for (const caller of limitedTransitive) {
+                        output += `- [depth ${caller.depth}] **${caller.qualifiedName}**\n`;
+                    }
+                    if (transitiveCallers.length > transitiveLimit) {
+                        output += `\n*... and ${transitiveCallers.length - transitiveLimit} more transitive callers*\n`;
+                    }
+                    output += '\n';
+                }
+                // Recommendations
+                if (result.risk === 'critical' || result.risk === 'high') {
+                    output += '## ⚠️ Recommendations\n\n';
+                    if (result.sensitiveDataPaths.length > 0) {
+                        output += '- Review all sensitive data paths before merging\n';
+                    }
+                    if (result.entryPoints.length > 5) {
+                        output += '- Consider incremental rollout - many entry points affected\n';
+                    }
+                    if (result.summary.maxDepth > 5) {
+                        output += '- Deep call chain - test thoroughly for regressions\n';
+                    }
+                }
+                return { content: [{ type: 'text', text: output }] };
+            }
+            catch (error) {
+                return {
+                    content: [{ type: 'text', text: `Error: ${error}` }],
+                    isError: true,
+                };
+            }
+        }
+        case 'dead': {
+            try {
+                await analyzer.initialize();
+                const graph = analyzer.getGraph();
+                if (!graph) {
+                    return {
+                        content: [{ type: 'text', text: 'No call graph found. Run build first.' }],
+                        isError: true,
+                    };
+                }
+                const detector = createDeadCodeDetector(graph);
+                const minConfidence = args.confidence ?? 'low';
+                const result = detector.detect({ minConfidence });
+                let output = '# 💀 Dead Code Analysis\n\n';
+                // Summary
+                output += '## Summary\n\n';
+                output += `- **Total Functions:** ${result.summary.totalFunctions}\n`;
+                output += `- **Dead Candidates:** ${result.summary.deadCandidates}\n`;
+                output += `- **High Confidence:** ${result.summary.highConfidence}\n`;
+                output += `- **Medium Confidence:** ${result.summary.mediumConfidence}\n`;
+                output += `- **Low Confidence:** ${result.summary.lowConfidence}\n`;
+                output += `- **Estimated Dead Lines:** ~${result.summary.estimatedDeadLines.toLocaleString()}\n\n`;
+                // Excluded
+                output += '## Excluded from Analysis\n\n';
+                output += `- Entry Points: ${result.excluded.entryPoints}\n`;
+                output += `- Functions with Callers: ${result.excluded.withCallers}\n`;
+                output += `- Framework Hooks: ${result.excluded.frameworkHooks}\n\n`;
+                // By language
+                if (Object.keys(result.summary.byLanguage).length > 0) {
+                    output += '## By Language\n\n';
+                    for (const [lang, count] of Object.entries(result.summary.byLanguage)) {
+                        output += `- **${lang}:** ${count}\n`;
+                    }
+                    output += '\n';
+                }
+                // High confidence candidates - use limit
+                const highConf = result.candidates.filter(c => c.confidence === 'high');
+                if (highConf.length > 0) {
+                    const limitedHigh = highConf.slice(0, limit);
+                    output += '## 🔴 High Confidence Dead Code\n\n';
+                    output += 'These functions are very likely unused:\n\n';
+                    for (const c of limitedHigh) {
+                        output += `### ${c.qualifiedName}\n`;
+                        output += `- **File:** ${c.file}:${c.line}\n`;
+                        output += `- **Lines:** ${c.linesOfCode}\n`;
+                        if (c.hasDataAccess) {
+                            output += `- ⚠️ Has data access\n`;
+                        }
+                        output += '\n';
+                    }
+                    if (highConf.length > limit) {
+                        output += `*... and ${highConf.length - limit} more high-confidence candidates. Use \`limit=${limit + 10}\` to see more.*\n\n`;
+                    }
+                }
+                // Medium confidence candidates - use smaller limit
+                const medConf = result.candidates.filter(c => c.confidence === 'medium');
+                if (medConf.length > 0) {
+                    const medLimit = Math.max(5, Math.floor(limit / 2));
+                    const limitedMed = medConf.slice(0, medLimit);
+                    output += '## 🟡 Medium Confidence Dead Code\n\n';
+                    output += 'These might be unused but have some indicators they could be called:\n\n';
+                    for (const c of limitedMed) {
+                        output += `- **${c.qualifiedName}** @ ${c.file}:${c.line}`;
+                        if (c.possibleFalsePositives.length > 0) {
+                            output += ` (${c.possibleFalsePositives.join(', ')})`;
+                        }
+                        output += '\n';
+                    }
+                    if (medConf.length > medLimit) {
+                        output += `\n*... and ${medConf.length - medLimit} more medium-confidence candidates*\n`;
+                    }
+                    output += '\n';
+                }
+                // Files with most dead code - use limit
+                if (result.summary.byFile.length > 0) {
+                    const limitedFiles = result.summary.byFile.slice(0, limit);
+                    output += '## Files with Most Dead Code\n\n';
+                    for (const f of limitedFiles) {
+                        output += `- **${f.file}**: ${f.count} functions (~${f.lines} lines)\n`;
+                    }
+                    if (result.summary.byFile.length > limit) {
+                        output += `\n*... and ${result.summary.byFile.length - limit} more files*\n`;
+                    }
+                    output += '\n';
+                }
+                // Recommendations
+                if (result.summary.highConfidence > 0) {
+                    output += '## 💡 Recommendations\n\n';
+                    output += '1. Start with high-confidence candidates - they\'re safest to remove\n';
+                    output += '2. Search for dynamic calls (getattr, reflection) before removing\n';
+                    output += '3. Check if functions are called from tests\n';
+                    output += '4. Consider adding `# pragma: no cover` for intentionally unused code\n';
+                }
+                return { content: [{ type: 'text', text: output }] };
+            }
+            catch (error) {
+                return {
+                    content: [{ type: 'text', text: `Error: ${error}` }],
+                    isError: true,
+                };
+            }
+        }
+        case 'coverage': {
+            try {
+                await analyzer.initialize();
+                const graph = analyzer.getGraph();
+                if (!graph) {
+                    return {
+                        content: [{ type: 'text', text: 'No call graph found. Run build first.' }],
+                        isError: true,
+                    };
+                }
+                const coverageAnalyzer = createCoverageAnalyzer(graph);
+                const result = coverageAnalyzer.analyze();
+                let output = '# 🧪 Sensitive Data Test Coverage\n\n';
+                // Summary
+                output += '## Summary\n\n';
+                output += `- **Sensitive Fields:** ${result.summary.totalSensitiveFields}\n`;
+                output += `- **Access Paths:** ${result.summary.totalAccessPaths}\n`;
+                output += `- **Tested Paths:** ${result.summary.testedAccessPaths}\n`;
+                output += `- **Coverage:** ${result.summary.coveragePercent}%\n`;
+                output += `- **Test Files:** ${result.testFiles.length}\n`;
+                output += `- **Test Functions:** ${result.testFunctions}\n\n`;
+                // By sensitivity
+                output += '## Coverage by Sensitivity\n\n';
+                const sensOrder = ['credentials', 'financial', 'health', 'pii'];
+                for (const sens of sensOrder) {
+                    const s = result.summary.bySensitivity[sens];
+                    if (s.fields > 0) {
+                        const icon = sens === 'credentials' ? '🔑' :
+                            sens === 'financial' ? '💰' :
+                                sens === 'health' ? '🏥' : '👤';
+                        const status = s.coveragePercent >= 80 ? '✓' : s.coveragePercent >= 50 ? '◐' : '✗';
+                        output += `- ${icon} **${sens}**: ${status} ${s.coveragePercent}% (${s.testedPaths}/${s.paths} paths)\n`;
+                    }
+                }
+                output += '\n';
+                // Field coverage - use limit
+                if (result.fields.length > 0) {
+                    const limitedFields = result.fields.slice(0, limit);
+                    output += '## Field Coverage\n\n';
+                    for (const f of limitedFields) {
+                        const statusIcon = f.status === 'covered' ? '✓' :
+                            f.status === 'partial' ? '◐' : '✗';
+                        const sensIcon = f.sensitivity === 'credentials' ? '🔑' :
+                            f.sensitivity === 'financial' ? '💰' :
+                                f.sensitivity === 'health' ? '🏥' : '👤';
+                        output += `- ${statusIcon} ${sensIcon} **${f.fullName}**: ${f.testedPaths}/${f.totalPaths} paths tested (${f.coveragePercent}%)\n`;
+                    }
+                    if (result.fields.length > limit) {
+                        output += `\n*... and ${result.fields.length - limit} more fields. Use \`limit=${limit + 10}\` to see more.*\n`;
+                    }
+                    output += '\n';
+                }
+                // Uncovered paths by priority - use smaller limits for each sensitivity type
+                const pathLimit = Math.max(3, Math.floor(limit / 3));
+                const uncoveredByCredentials = result.uncoveredPaths.filter((p) => p.sensitivity === 'credentials');
+                const uncoveredByFinancial = result.uncoveredPaths.filter((p) => p.sensitivity === 'financial');
+                const uncoveredByHealth = result.uncoveredPaths.filter((p) => p.sensitivity === 'health');
+                const uncoveredByPii = result.uncoveredPaths.filter((p) => p.sensitivity === 'pii');
+                if (uncoveredByCredentials.length > 0) {
+                    const limitedCreds = uncoveredByCredentials.slice(0, pathLimit);
+                    output += '## 🔑 Untested Credential Access Paths\n\n';
+                    output += '**CRITICAL: These paths access credentials without test coverage**\n\n';
+                    for (const p of limitedCreds) {
+                        output += `### ${p.table}.${p.field}\n`;
+                        output += `- **Entry Point:** ${p.entryPoint.name} @ ${p.entryPoint.file}:${p.entryPoint.line}\n`;
+                        output += `- **Accessor:** ${p.accessor.name} @ ${p.accessor.file}:${p.accessor.line}\n`;
+                        output += `- **Depth:** ${p.depth}\n\n`;
+                    }
+                    if (uncoveredByCredentials.length > pathLimit) {
+                        output += `*... and ${uncoveredByCredentials.length - pathLimit} more credential paths*\n\n`;
+                    }
+                }
+                if (uncoveredByFinancial.length > 0) {
+                    const limitedFinancial = uncoveredByFinancial.slice(0, pathLimit);
+                    output += '## 💰 Untested Financial Data Paths\n\n';
+                    for (const p of limitedFinancial) {
+                        output += `- **${p.table}.${p.field}**: ${p.entryPoint.name} → ${p.accessor.name}\n`;
+                    }
+                    if (uncoveredByFinancial.length > pathLimit) {
+                        output += `\n*... and ${uncoveredByFinancial.length - pathLimit} more*\n`;
+                    }
+                    output += '\n';
+                }
+                if (uncoveredByHealth.length > 0) {
+                    const limitedHealth = uncoveredByHealth.slice(0, pathLimit);
+                    output += '## 🏥 Untested Health Data Paths\n\n';
+                    for (const p of limitedHealth) {
+                        output += `- **${p.table}.${p.field}**: ${p.entryPoint.name} → ${p.accessor.name}\n`;
+                    }
+                    if (uncoveredByHealth.length > pathLimit) {
+                        output += `\n*... and ${uncoveredByHealth.length - pathLimit} more*\n`;
+                    }
+                    output += '\n';
+                }
+                if (uncoveredByPii.length > 0) {
+                    const limitedPii = uncoveredByPii.slice(0, pathLimit);
+                    output += '## 👤 Untested PII Access Paths\n\n';
+                    for (const p of limitedPii) {
+                        output += `- **${p.table}.${p.field}**: ${p.entryPoint.name} → ${p.accessor.name}\n`;
+                    }
+                    if (uncoveredByPii.length > pathLimit) {
+                        output += `\n*... and ${uncoveredByPii.length - pathLimit} more*\n`;
+                    }
+                    output += '\n';
+                }
+                // Recommendations
+                if (result.uncoveredPaths.length > 0) {
+                    output += '## 💡 Recommendations\n\n';
+                    if (uncoveredByCredentials.length > 0) {
+                        output += `1. **CRITICAL:** ${uncoveredByCredentials.length} credential access paths need tests\n`;
+                    }
+                    if (uncoveredByFinancial.length > 0) {
+                        output += `2. ${uncoveredByFinancial.length} financial data paths need tests\n`;
+                    }
+                    if (result.summary.coveragePercent < 50) {
+                        output += `3. Overall coverage is ${result.summary.coveragePercent}% - consider adding integration tests\n`;
+                    }
+                }
+                else {
+                    output += '## ✓ All Sensitive Data Paths Tested\n\n';
+                    output += 'Great job! All sensitive data access paths are covered by tests.\n';
+                }
+                return { content: [{ type: 'text', text: output }] };
+            }
+            catch (error) {
+                return {
+                    content: [{ type: 'text', text: `Error: ${error}` }],
+                    isError: true,
+                };
+            }
+        }
+        default:
+            return {
+                content: [{ type: 'text', text: `Unknown action: ${action}` }],
+                isError: true,
+            };
+    }
+}
 //# sourceMappingURL=server.js.map