genexus-mcp 2.56.0 → 3.0.0

package/README.md

@@ -20,7 +20,7 @@ In practice: you point the MCP at your KB, then ask your AI assistant things lik
 
 ## What you can do with it
 
-A quick map of what the agent can do against your real KB through the **49 tools** (details in [Tool Surface](#tool-surface)):
+A quick map of what the agent can do against your real KB through the **50 tools** (details in [Tool Surface](#tool-surface)):
 
 | Area | What the agent can do |
 |---|---|
@@ -199,7 +199,7 @@ Once installed, here's what unlocks. Try these as your first prompts:
 - *"Build the KB and report any errors."*
 - *"Run the unit tests and show me which failed."*
 
-The agent picks the right tool from the **40+ tools** the MCP exposes (read, edit, refactor, analyze, build, data-model authoring, layout automation, DB/DDL, versioning, security, SQL preview, etc.). The full tool list is in [Tool Surface](#tool-surface) below.
+The agent picks the right tool from the **50 tools** the MCP exposes (read, edit, refactor, analyze, build, data-model authoring, layout automation, DB/DDL, versioning, security, SQL preview, etc.). The full tool list is in [Tool Surface](#tool-surface) below.
 
 ---
 
@@ -217,11 +217,26 @@ Auto-detected and auto-configured by the installer:
 | OpenCode (CLI) | ✅ | Reads both direct and nested MCP layouts; restart required |
 | Codex CLI | ✅ | Writes `~/.codex/config.toml` |
 | VS Code / VS Code Insiders | ✅ | Native MCP (`User/mcp.json`); restart required |
-| OpenCode Desktop | Detect-only | Reported as installed; add the server from the app's settings |
+| OpenCode Desktop | Manual setup | Detected and reported with exact local-server fields; add the server from the app's MCP settings |
 | Any MCP client | Manual | Use the JSON snippet printed by `init` |
 
 Run **`npx genexus-mcp clients`** at any time to see which agents are installed, which have `genexus` registered, and whether any point at a stale gateway exe. To (re)register specific ones: `npx genexus-mcp clients add --clients antigravity,vscode`.
 
+### OpenCode Desktop (manual setup)
+
+The CLI detects OpenCode Desktop but does not write its app-managed `mcp.json`.
+After `init` prints the path to `config.json`, open **Settings → MCP → Add server
+→ Local** in OpenCode Desktop and enter:
+
+- Name: `genexus18mcp`
+- Command: `npx.cmd` on Windows, `npx` elsewhere
+- Arguments: `-y genexus-mcp@latest`
+- Environment: `GX_CONFIG_PATH=<the config.json path printed by init>`
+
+Save the server, fully restart OpenCode Desktop, and call `genexus_whoami` to
+verify the GeneXus server and selected KB. The CLI intentionally leaves the
+Desktop-managed configuration file untouched.
+
 ---
 
 ## Troubleshooting
@@ -251,7 +266,7 @@ Still stuck? [Open an issue](https://github.com/lennix1337/Genexus18MCP/issues)
 
 ## Tool Surface
 
-The worker exposes **49 tools** to the MCP router, grouped by capability below. Most are umbrellas with an `action` (e.g. `genexus_db action=sql_ddl`); the detailed schemas live in [`src/GxMcp.Gateway/tool_definitions.json`](src/GxMcp.Gateway/tool_definitions.json).
+The worker exposes **50 tools** to the MCP router, grouped by capability below. Most are umbrellas with an `action` (e.g. `genexus_db action=sql_ddl`); the detailed schemas live in [`src/GxMcp.Gateway/tool_definitions.json`](src/GxMcp.Gateway/tool_definitions.json).
 
 **Orientation & health**
 - `genexus_whoami` — KB context, version, worker/index/database health, self-update check, next-step hints
@@ -304,14 +319,14 @@ produced by `DataSelectorStructurePart.ToString()` on U16.
 
 **Analysis, docs & API**
 - `genexus_analyze` — cross-object semantic analysis (impact, dependencies, complexity, naming, code_metrics, summary, explain, `kb_stats` = KB activity/freshness, `table_relations` = table↔transaction relations + redundant attrs, …)
-- `genexus_doc` — generate wiki / sequence diagrams / health reports
+- `genexus_doc` — generate wiki / dependency graphs / health reports
 - `genexus_api` — introspect REST endpoints exposed by HTTP procedures
 - `genexus_security` — audit KB security: `audit_gam` (env/GAM props), `scan_secrets` (regex over Source), `scan_native` (the SDK's own Security Scanner, `ISecurityScannerService`)
 
 **Lifecycle, build, test & DB**
-- `genexus_lifecycle` — build (incl. `compile_check`), validate, index, reorg, poll status
+- `genexus_lifecycle` — directed `build` (incl. `compile_check`), incremental global `build_all`, forced global `rebuild`, validate, index, reorg, and poll status
 - `genexus_test` — run native GXtest tests
-- `genexus_db` — DB umbrella: schema-drift, `sql_ddl`/`sql_navigation`, static index advisor, `sample_data`, Domain/SDT type introspection, translation import, `reorg_impact`, and non-mutating `reorg_preview` with exact DDL only from a current Impact Analysis artifact
+- `genexus_db` — DB umbrella: schema-drift, `sql_ddl`/`sql_navigation`, static index advisor, `sample_data`, typed Transaction record query/insert/update with dry-run, optimistic versioning, reread and verified rollback, Domain/SDT type introspection, translation import, `reorg_impact`, and non-mutating `reorg_preview` with exact DDL only from a current Impact Analysis artifact
 - `genexus_deploy` — deploy application (`IDeploymentService`): `list_targets` (read) / `deploy` (destructive, `confirm=true`)
 - `genexus_run_object` / `genexus_browser` — resolve runtime URL and headless-browser verification
 
@@ -483,7 +498,7 @@ When the pool is full and no Worker is idle, the server returns `KB_POOL_FULL`
 
 ```mermaid
 graph LR
-    A[AI Client / Nexus-IDE] -->|MCP stdio or HTTP /mcp| B[Gateway .NET 8]
+    A[AI Client / Nexus-IDE] -->|MCP stdio or HTTP /mcp| B[Gateway .NET 10]
     B -->|JSON-RPC over process boundary| C[Worker .NET Framework 4.8]
     C -->|Native SDK| D[GeneXus KB]
 ```

package/cli/commands/axi.js

@@ -1857,6 +1857,9 @@ async function handleClients(subcommand, options, ctx) {
             }
             const help = [];
             if (patch.patched.length > 0) help.push('Restart the affected AI client(s) to load the new MCP config.');
+            if (patch.skipped.some((entry) => entry.registrationMode === 'manual')) {
+                help.push('Some selected clients require manual setup; use meta.skippedClients[].manualSetup for the exact command and environment.');
+            }
             if (patch.failed.some((f) => f.reason && f.reason.includes('third-party or HTTP MCP server'))) {
                 help.push('A collision with an existing MCP server (e.g. official GeneXus MCP) was detected.');
                 help.push('Use --server-name=<customName> (e.g. --server-name Gx18byLennix) or pass --force.');

package/cli/lib/config.js

@@ -655,7 +655,7 @@ function getClientConfigTargets() {
             // and how to wire it up, but never mutate its config blindly.
             format: 'manual',
             writeSupported: false,
-            manualNote: 'OpenCode Desktop: add the genexus MCP server from the app\'s settings (automatic registration not supported yet).',
+            manualNote: 'OpenCode Desktop manual setup: Settings > MCP > Add server > Local; name genexus18mcp; command npx.cmd on Windows (npx elsewhere); args -y genexus-mcp@latest; environment GX_CONFIG_PATH=<config.json path printed by init>; save, fully restart the app, then call genexus_whoami. The CLI does not write the app-managed Desktop mcp.json.',
             path: path.join(appData, 'ai.opencode.desktop', 'mcp.json'),
             installMarkers: [
                 path.join(localAppData, 'Programs', '@opencode-aidesktop'),
@@ -728,6 +728,27 @@ function clientCommandHealth(entry, client = null) {
     return { stale: false, reason: null };
 }
 
+function buildManualClientSetup(client, targetConfigPath = null) {
+    return {
+        mode: 'manual',
+        managedConfigPath: client.path,
+        serverName: DEFAULT_MCP_SERVER_NAME,
+        transport: 'local',
+        command: process.platform === 'win32' ? 'npx.cmd' : 'npx',
+        args: ['-y', 'genexus-mcp@latest'],
+        environment: {
+            GX_CONFIG_PATH: targetConfigPath || '<config.json path printed by genexus-mcp init>'
+        },
+        steps: [
+            'Open OpenCode Desktop settings and select MCP.',
+            'Choose Add server, select Local, and enter the server name genexus18mcp.',
+            'Set the command, arguments, and GX_CONFIG_PATH environment value shown above.',
+            'Save the server and fully restart OpenCode Desktop so it reloads MCP configuration.',
+            'Call genexus_whoami to verify the GeneXus server and selected KB.'
+        ]
+    };
+}
+
 // Read-only report of every supported agent on this platform: is it installed,
 // is genexus registered, where, what launcher command it points at, and whether
 // that command is stale. Backs the `genexus-mcp clients` command.
@@ -747,6 +768,7 @@ function clientsStatus(opts = {}) {
             name: client.name,
             installed: det.installed,
             registered: entry !== null,
+            registrationMode: client.writeSupported === false ? 'manual' : 'automatic',
             serverName,
             isThirdParty: Boolean(isThirdParty),
             writeSupported: client.writeSupported !== false,
@@ -756,7 +778,8 @@ function clientsStatus(opts = {}) {
             commandStale: health.stale,
             commandStaleReason: health.reason || (isThirdParty ? 'configured as third-party / HTTP MCP server (e.g. official GeneXus MCP)' : null),
             detectedAt: det.markerHit || (det.hasConfig ? client.path : null),
-            note: client.writeSupported === false ? (client.manualNote || null) : null
+            note: client.writeSupported === false ? (client.manualNote || null) : null,
+            manualSetup: client.writeSupported === false ? buildManualClientSetup(client) : null
         };
     });
 }
@@ -777,15 +800,6 @@ function patchClientConfig(targetConfigPath, opts = {}) {
     // Validate corporate-install env var before we write it into N client configs.
     // Otherwise we silently propagate a broken path to every AI client and the
     // user only finds out when each one fails with "Failed to connect".
-    if (process.env.GENEXUS_MCP_GATEWAY_EXE && !fs.existsSync(process.env.GENEXUS_MCP_GATEWAY_EXE)) {
-        const err = new Error(
-            `GENEXUS_MCP_GATEWAY_EXE points to a path that does not exist: ${process.env.GENEXUS_MCP_GATEWAY_EXE}. ` +
-            `Refusing to write this into client configs. Unset the env var (to use the npx launcher) or re-run scripts/install.ps1 to materialize the exe.`
-        );
-        err.code = 'GATEWAY_EXE_MISSING';
-        throw err;
-    }
-
     const serverName = opts.serverName || DEFAULT_MCP_SERVER_NAME;
     const force = Boolean(opts.force);
     const onlyExisting = opts.onlyExisting !== false;
@@ -794,6 +808,24 @@ function patchClientConfig(targetConfigPath, opts = {}) {
         platform: process.platform
     });
 
+    // A direct gateway path only matters to clients that can be written. A
+    // detect-only client such as OpenCode Desktop must still receive manual
+    // setup guidance when its app-managed config is not detectable.
+    const writableCandidates = candidates.filter((client) =>
+        client.writeSupported !== false
+        && (!onlyExisting || detectClientInstalled(client).installed)
+    );
+    if (writableCandidates.length > 0
+        && process.env.GENEXUS_MCP_GATEWAY_EXE
+        && !fs.existsSync(process.env.GENEXUS_MCP_GATEWAY_EXE)) {
+        const err = new Error(
+            `GENEXUS_MCP_GATEWAY_EXE points to a path that does not exist: ${process.env.GENEXUS_MCP_GATEWAY_EXE}. ` +
+            `Refusing to write this into client configs. Unset the env var (to use the npx launcher) or re-run scripts/install.ps1 to materialize the exe.`
+        );
+        err.code = 'GATEWAY_EXE_MISSING';
+        throw err;
+    }
+
     const patched = [];
     const failed = [];
     const skipped = [];
@@ -802,9 +834,19 @@ function patchClientConfig(targetConfigPath, opts = {}) {
         // Detect-only agents (e.g. OpenCode Desktop) can't be auto-written; surface
         // the manual step instead of pretending we registered them.
         if (client.writeSupported === false) {
-            if (detectClientInstalled(client).installed) {
-                skipped.push({ client: client.name, reason: client.manualNote || 'manual setup required' });
+            const detection = detectClientInstalled(client);
+            if (onlyExisting && !detection.installed) {
+                skipped.push({ client: client.name, reason: 'not installed' });
+                continue;
             }
+            skipped.push({
+                client: client.name,
+                reason: client.manualNote || 'manual setup required',
+                registrationMode: 'manual',
+                installed: detection.installed,
+                detectedAt: detection.markerHit || (detection.hasConfig ? client.path : null),
+                manualSetup: buildManualClientSetup(client, targetConfigPath)
+            });
             continue;
         }
         // "Installed" keys off install markers (the agent itself is present), not

package/cli/run.test.js

@@ -791,6 +791,112 @@ test('clients list returns structured status with summary', () => {
     assert.equal(typeof row.registered, 'boolean');
 });
 
+test('clients list reports OpenCode Desktop as manual with exact setup fields', () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'genexus-mcp-opencode-desktop-status-'));
+    try {
+        const env = sandboxHomeEnv(tempRoot);
+        fs.mkdirSync(path.join(env.APPDATA, 'ai.opencode.desktop'), { recursive: true });
+
+        const result = runCli(['clients', '--format', 'json'], { env });
+        assert.equal(result.status, 0);
+        const row = JSON.parse(result.stdout).ok.clients.find((client) => client.id === 'opencode-desktop');
+        assert.ok(row, 'OpenCode Desktop should be listed');
+        assert.equal(row.installed, true);
+        assert.equal(row.registered, false);
+        assert.equal(row.writeSupported, false);
+        assert.equal(row.registrationMode, 'manual');
+        assert.equal(row.manualSetup.transport, 'local');
+        assert.deepEqual(row.manualSetup.args, ['-y', 'genexus-mcp@latest']);
+        assert.equal(row.manualSetup.environment.GX_CONFIG_PATH, '<config.json path printed by genexus-mcp init>');
+        assert.ok(row.manualSetup.steps.some((step) => step.includes('genexus_whoami')));
+        assert.match(row.note, /does not write/i);
+    } finally {
+        fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+});
+
+test('clients add reports OpenCode Desktop manual skip without mutating its app-managed file', () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'genexus-mcp-opencode-desktop-add-'));
+    try {
+        const env = sandboxHomeEnv(tempRoot);
+        const cfgPath = path.join(tempRoot, 'config.json');
+        const desktopDir = path.join(env.APPDATA, 'ai.opencode.desktop');
+        const desktopConfig = path.join(desktopDir, 'mcp.json');
+        const original = { unrelated: { keep: true } };
+        fs.writeFileSync(cfgPath, JSON.stringify({ Environment: { KBPath: tempRoot } }));
+        fs.mkdirSync(desktopDir, { recursive: true });
+        fs.writeFileSync(desktopConfig, JSON.stringify(original, null, 2));
+
+        const result = runCli(['clients', 'add', '--clients', 'opencode-desktop', '--format', 'json'], {
+            env: { ...env, GX_CONFIG_PATH: cfgPath }
+        });
+        assert.equal(result.status, 0);
+        const parsed = JSON.parse(result.stdout);
+        assert.deepEqual(parsed.ok.patchedClients, []);
+        const skipped = parsed.meta.skippedClients.find((entry) => entry.client === 'OpenCode Desktop');
+        assert.ok(skipped && /Settings > MCP|manual setup/i.test(skipped.reason));
+        assert.equal(skipped.registrationMode, 'manual');
+        assert.equal(skipped.installed, true);
+        assert.equal(skipped.manualSetup.environment.GX_CONFIG_PATH, cfgPath);
+        assert.ok(parsed.help.some((entry) => /manual setup/i.test(entry)));
+        assert.deepEqual(JSON.parse(fs.readFileSync(desktopConfig, 'utf8')), original);
+    } finally {
+        fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+});
+
+test('clients add always reports undetected OpenCode Desktop manual setup', () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'genexus-mcp-opencode-desktop-undetected-'));
+    try {
+        const env = sandboxHomeEnv(tempRoot);
+        const cfgPath = path.join(tempRoot, 'config.json');
+        fs.writeFileSync(cfgPath, JSON.stringify({ Environment: { KBPath: tempRoot } }));
+
+        const result = runCli(['clients', 'add', '--clients', 'opencode-desktop', '--format', 'json'], {
+            env: {
+                ...env,
+                GX_CONFIG_PATH: cfgPath,
+                GENEXUS_MCP_GATEWAY_EXE: path.join(tempRoot, 'missing', 'GxMcp.Gateway.exe')
+            }
+        });
+        assert.equal(result.status, 0);
+        const parsed = JSON.parse(result.stdout);
+        assert.deepEqual(parsed.ok.patchedClients, []);
+        const skipped = parsed.meta.skippedClients.find((entry) => entry.client === 'OpenCode Desktop');
+        assert.ok(skipped, 'undetected detect-only client should still be actionable');
+        assert.equal(skipped.installed, false);
+        assert.equal(skipped.manualSetup.environment.GX_CONFIG_PATH, cfgPath);
+        assert.equal(skipped.manualSetup.command, process.platform === 'win32' ? 'npx.cmd' : 'npx');
+    } finally {
+        fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+});
+
+test('clients add still refuses a missing gateway for writable clients', () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'genexus-mcp-client-missing-gateway-'));
+    try {
+        const env = sandboxHomeEnv(tempRoot);
+        const cfgPath = path.join(tempRoot, 'config.json');
+        const cursorConfig = path.join(tempRoot, '.cursor', 'mcp.json');
+        fs.writeFileSync(cfgPath, JSON.stringify({ Environment: { KBPath: tempRoot } }));
+
+        const result = runCli(['clients', 'add', '--clients', 'cursor', '--format', 'json'], {
+            env: {
+                ...env,
+                GX_CONFIG_PATH: cfgPath,
+                GENEXUS_MCP_GATEWAY_EXE: path.join(tempRoot, 'missing', 'GxMcp.Gateway.exe')
+            }
+        });
+        assert.equal(result.status, 1);
+        const parsed = JSON.parse(result.stdout);
+        assert.equal(parsed.error.code, 'operation_error');
+        assert.match(parsed.error.message, /GATEWAY_EXE_MISSING|does not exist/i);
+        assert.equal(fs.existsSync(cursorConfig), false, 'failed validation must not create a client config');
+    } finally {
+        fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+});
+
 test('getLauncher prefers the packaged gateway for Antigravity only', () => {
     const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'genexus-mcp-launcher-'));
     const gatewayPath = path.join(tempRoot, 'publish', 'GxMcp.Gateway.exe');

package/docs/llm_cli_mcp_playbook.md

@@ -124,6 +124,13 @@ Follow-up flow:
 
 Do not treat timeout as hard failure when `operationId` is present.
 
+For a complete incremental build of the selected Knowledge Base, use
+`genexus_lifecycle(action='build_all')` without `target`. It runs the native
+`BuildAll` task when available, reports completion evidence, and returns
+`ReorgRequired` instead of applying a schema reorganization implicitly. Use
+`action='build'` for a directed target and `action='rebuild'` for the forced
+Rebuild All contract.
+
 ## Pagination and Token Budgeting
 
 Read/list defaults are intentionally broad for humans, but not for LLMs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genexus-mcp",
-  "version": "2.56.0",
+  "version": "3.0.0",
   "mcpName": "io.github.lennix1337/genexus",
   "description": "GeneXus 18 MCP server — read, edit, and analyze GeneXus knowledge base objects (transactions, web panels, procedures, SDTs) directly from Claude, Cursor, and other AI agents over the Model Context Protocol.",
   "keywords": [
@@ -50,7 +50,7 @@
     "win32"
   ],
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   },
   "author": "lennix1337",
   "license": "MIT",

package/publish/GxMcp.Gateway.deps.json

@@ -1,13 +1,13 @@
 {
   "runtimeTarget": {
-    "name": ".NETCoreApp,Version=v8.0/win-x64",
+    "name": ".NETCoreApp,Version=v10.0/win-x64",
     "signature": ""
   },
   "compilationOptions": {},
   "targets": {
-    ".NETCoreApp,Version=v8.0": {},
-    ".NETCoreApp,Version=v8.0/win-x64": {
-      "GxMcp.Gateway/2.56.0": {
+    ".NETCoreApp,Version=v10.0": {},
+    ".NETCoreApp,Version=v10.0/win-x64": {
+      "GxMcp.Gateway/3.0.0": {
         "dependencies": {
           "Newtonsoft.Json": "13.0.3",
           "System.Management": "10.0.5",
@@ -27,7 +27,7 @@
       },
       "System.CodeDom/10.0.5": {
         "runtime": {
-          "lib/net8.0/System.CodeDom.dll": {
+          "lib/net10.0/System.CodeDom.dll": {
             "assemblyVersion": "10.0.0.0",
             "fileVersion": "10.0.526.15411"
           }
@@ -38,7 +38,7 @@
           "System.CodeDom": "10.0.5"
         },
         "runtime": {
-          "runtimes/win/lib/net8.0/System.Management.dll": {
+          "runtimes/win/lib/net10.0/System.Management.dll": {
             "assemblyVersion": "10.0.0.5",
             "fileVersion": "10.0.526.15411"
           }
@@ -49,7 +49,7 @@
           "System.Windows.Extensions": "10.0.3"
         },
         "runtime": {
-          "lib/net8.0/System.Security.Permissions.dll": {
+          "lib/net10.0/System.Security.Permissions.dll": {
             "assemblyVersion": "10.0.0.0",
             "fileVersion": "10.0.326.7603"
           }
@@ -57,7 +57,7 @@
       },
       "System.Windows.Extensions/10.0.3": {
         "runtime": {
-          "runtimes/win/lib/net8.0/System.Windows.Extensions.dll": {
+          "runtimes/win/lib/net10.0/System.Windows.Extensions.dll": {
             "assemblyVersion": "10.0.0.0",
             "fileVersion": "10.0.326.7603"
           }
@@ -66,7 +66,7 @@
     }
   },
   "libraries": {
-    "GxMcp.Gateway/2.56.0": {
+    "GxMcp.Gateway/3.0.0": {
       "type": "project",
       "serviceable": false,
       "sha512": ""

package/publish/GxMcp.Gateway.runtimeconfig.json

@@ -1,14 +1,14 @@
 {
   "runtimeOptions": {
-    "tfm": "net8.0",
+    "tfm": "net10.0",
     "frameworks": [
       {
         "name": "Microsoft.NETCore.App",
-        "version": "8.0.0"
+        "version": "10.0.0"
       },
       {
         "name": "Microsoft.AspNetCore.App",
-        "version": "8.0.0"
+        "version": "10.0.0"
       }
     ],
     "configProperties": {

package/publish/config.json

@@ -7,11 +7,11 @@
     "KBPath": "C:\\\\KBs\\\\YourKB"
   },
   "Server": {
-    "HttpPort": 5000,
-    "McpStdio": true
+    "McpStdio": true,
+    "HttpPort": 5000
   },
   "GeneXus": {
-    "WorkerExecutable": "worker\\\\GxMcp.Worker.exe",
-    "InstallationPath": "C:\\\\Program Files (x86)\\\\GeneXus\\\\GeneXus18"
+    "InstallationPath": "C:\\\\Program Files (x86)\\\\GeneXus\\\\GeneXus18",
+    "WorkerExecutable": "worker\\\\GxMcp.Worker.exe"
   }
 }

package/publish/gxmcp-manifest.json

@@ -0,0 +1,46 @@
+{
+  "schemaVersion": "gxmcp-release-manifest/1",
+  "version": "3.0.0",
+  "sourceCommit": "6f5c1a27df8447e25b9eca750daef40fa64207bc",
+  "generatedAtUtc": "2026-09-06T23:59:53.6616612Z",
+  "runtime": {
+    "gateway": "net10.0-windows",
+    "worker": "net48-x86",
+    "node": ">=22.0.0",
+    "recommendedNode": "24 LTS"
+  },
+  "protocolVersions": [
+    "2025-11-25",
+    "2026-07-28"
+  ],
+  "schema": "tool_definitions.json",
+  "schemaSha256": "c43e3943a9b8f6fcb650014a31c1a29059e1e946bf03e1e0ae51893869d8c329",
+  "provenance": "gxmcp-sbom.json",
+  "artifacts": [
+    {
+      "path": "gxmcp-sbom.json",
+      "size": 552,
+      "sha256": "484fc2edbd6146b813a93f64559bc84ca519e1426adb48a01c64e865b91c8239"
+    },
+    {
+      "path": "GxMcp.Gateway.exe",
+      "size": 162304,
+      "sha256": "947e70d3cc17075957405f9d6442741b44d13f0212daabf87f77e2df68815606"
+    },
+    {
+      "path": "nexus-ide.vsix",
+      "size": 1318677,
+      "sha256": "e894e2255c5e2c853d64adf4191ada26e6a74ddb51df752c9c53fed2a281d81c"
+    },
+    {
+      "path": "tool_definitions.json",
+      "size": 103566,
+      "sha256": "c43e3943a9b8f6fcb650014a31c1a29059e1e946bf03e1e0ae51893869d8c329"
+    },
+    {
+      "path": "worker/GxMcp.Worker.exe",
+      "size": 2814464,
+      "sha256": "f6f966490c52b1e47fb70dfc3523c120d4a80a99292d8a772e3c7f2a8d77ed0b"
+    }
+  ]
+}

package/publish/gxmcp-sbom.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": "gxmcp-provenance/1",
+  "version": "3.0.0",
+  "sourceCommit": "6f5c1a27df8447e25b9eca750daef40fa64207bc",
+  "components": [
+    {
+      "name": "genexus-mcp",
+      "lockfile": "package-lock.json",
+      "size": 39915,
+      "sha256": "52f510e2c266fe270f40bb5884508377a0922edafc035263dbcd8d8d8902fd2e"
+    },
+    {
+      "name": "nexus-ide",
+      "lockfile": "src/nexus-ide/package-lock.json",
+      "size": 274985,
+      "sha256": "1b4d8ecfb2037951701c50fce38f6db4702a96fd5a3c8a7f4a105b9cce834260"
+    }
+  ]
+}