mcp-nervous-system 1.4.0 → 1.5.1

package/README.md

@@ -4,7 +4,7 @@
 
 7 mechanically enforced rules that prevent the most common failure modes when LLMs have access to real infrastructure: context loss, silent failures, file damage, goal drift, and overreach.
 
-Built by [Arthur Palyan](https://www.levelsofself.com) at Palyan Family AI System. 12 tools including configuration drift detection and emergency kill switch. Battle-tested on an 11-member AI family running 28 processes 24/7 on a single VPS. 58+ violations logged, 0 bypassed.
+Built by [Arthur Palyan](https://www.levelsofself.com) at Palyan Family AI System. 15 tools including configuration drift detection and emergency kill switch. Battle-tested on an 11-member AI family running 28 processes 24/7 on a single VPS. 58+ violations logged, 0 bypassed.
 
 ## The Problem
 
@@ -60,7 +60,7 @@ Protocol: MCP 2024-11-05 (Streamable HTTP + SSE)
 Authentication: None required
 ```
 
-## NEW in v1.4.0
+## NEW in v1.5.0
 
 **drift_audit** (free tier)
 Configuration drift detection across 5 scopes: roles, versions, files, processes, and website. Scans source-of-truth files (family-roles.json, package.json, UNTOUCHABLE_FILES.txt) against all downstream references - HTML pages, JSON configs, markdown docs, and running PM2 processes. Change one file, drift_audit tells you everywhere else that needs updating. The closed loop that keeps your entire system consistent.

package/README.md.bak.1772777593

@@ -0,0 +1,172 @@
+# The Nervous System
+
+**LLM Behavioral Enforcement Framework**
+
+7 mechanically enforced rules that prevent the most common failure modes when LLMs have access to real infrastructure: context loss, silent failures, file damage, goal drift, and overreach.
+
+Built by [Arthur Palyan](https://www.levelsofself.com) at Palyan Family AI System. 12 tools including configuration drift detection and emergency kill switch. Battle-tested on an 11-member AI family running 28 processes 24/7 on a single VPS. 58+ violations logged, 0 bypassed.
+
+## The Problem
+
+When you give an LLM access to your file system, bash, and production infrastructure, it will eventually:
+
+- Edit a file it shouldn't touch
+- Lose context between sessions and start over
+- Drift from the original objective during long tasks
+- Fail silently when a session times out
+- Make logic changes without asking
+- Disappear into debug loops
+
+The Nervous System solves all of these with rules enforced by external mechanisms the LLM cannot override.
+
+## Install
+
+### Claude Desktop
+
+Add to your `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "nervous-system": {
+      "command": "npx",
+      "args": ["-y", "mcp-nervous-system"]
+    }
+  }
+}
+```
+
+### Claude Code
+
+```bash
+claude mcp add nervous-system npx mcp-nervous-system
+```
+
+### Direct
+
+```bash
+npx mcp-nervous-system
+```
+
+Server starts on port 3475 with SSE, HTTP, and health endpoints.
+
+### Hosted (No Install)
+
+The server is live and ready to use:
+
+```
+URL: https://api.100levelup.com/mcp-ns/
+Protocol: MCP 2024-11-05 (Streamable HTTP + SSE)
+Authentication: None required
+```
+
+## NEW in v1.4.0
+
+**drift_audit** (free tier)
+Configuration drift detection across 5 scopes: roles, versions, files, processes, and website. Scans source-of-truth files (family-roles.json, package.json, UNTOUCHABLE_FILES.txt) against all downstream references - HTML pages, JSON configs, markdown docs, and running PM2 processes. Change one file, drift_audit tells you everywhere else that needs updating. The closed loop that keeps your entire system consistent.
+
+**Positioning: Auto mode decides what Claude CAN do. The Nervous System governs HOW it behaves while doing it.**
+
+## The 7 Rules
+
+| # | Rule | What It Prevents |
+|---|------|-----------------|
+| 1 | **Dispatch Don't Do** | Debug loops, rabbit holes. Tasks > 2 messages get dispatched. |
+| 2 | **Untouchable** | File damage. Protected files mechanically blocked from editing. |
+| 3 | **Write Progress** | Silent failures. Progress noted before each action. |
+| 4 | **Step Back Every 4** | Goal drift. Forced reflection every 4 messages. |
+| 5 | **Delegate and Return** | Invisible work. Background tasks reported immediately. |
+| 6 | **Ask Before Touching** | Unauthorized changes. Logic changes need human approval. |
+| 7 | **Hand Off** | Context loss. Written handoffs every 3-4 exchanges. |
+
+## MCP Tools (12)
+
+| Tool | Description |
+|------|------------|
+| `get_framework` | Complete framework: all rules, permission protocol, enforcement patterns |
+| `guardrail_rules` | The 7 core rules with triggers, enforcement, and failure modes |
+| `preflight_check` | File protection system: shell script blocks edits to protected files |
+| `session_handoff` | Context preservation: templates for handoff documents |
+| `worklog` | Progress documentation pattern |
+| `violation_logging` | Audit trail: timestamp, type, context for every violation |
+| `step_back_check` | Forced reflection system |
+| `get_nervous_system_info` | System overview and operational stats |
+| `emergency_kill_switch` | Emergency shutdown of all PM2 processes. Requires kill switch secret. Logs to tamper-evident audit trail |
+| `verify_audit_chain` | Walks the SHA-256 hash-chained audit log and verifies every entry. Returns chain integrity status |
+| `dispatch_to_llm` | Spawns a background LLM agent to handle a task. Checks RAM, enforces max 2 concurrent dispatches |
+| `drift_audit` | Configuration drift detection across roles, versions, files, processes, and website. Finds stale values everywhere. |
+
+## Kill Switch
+
+The `emergency_kill_switch` tool provides an emergency shutdown capability. Send a POST request to `/kill` with the kill switch secret to immediately stop all PM2 processes. Every activation is logged to the tamper-evident audit trail with SHA-256 hash chaining, so kill switch events cannot be hidden or altered after the fact.
+
+- Requires authentication (kill switch secret)
+- Logs to hash-chained audit trail
+- Returns confirmation with affected process count
+
+## Tamper-Evident Audit Trail
+
+Every guardrail violation, kill switch activation, and dispatch event is recorded in a SHA-256 hash-chained audit log. Each entry includes the hash of the previous entry, making it cryptographically impossible to alter or delete past records without breaking the chain.
+
+- Use `verify_audit_chain` to walk the entire chain and verify integrity
+- Returns: valid/invalid status, entry count, and break point if tampered
+- 58+ violations logged, 0 bypassed, 0 chain breaks
+
+## Dispatch to LLM
+
+The `dispatch_to_llm` tool enables a brain + agents architecture. Instead of one LLM session doing everything, complex tasks get dispatched to background agents that run independently under the same 7 rules.
+
+- Checks available RAM (requires 500MB+)
+- Enforces max 2 concurrent dispatches
+- Returns PID and log file path for monitoring
+- Every dispatched agent runs under the same nervous system guardrails
+
+## EU AI Act Compliance
+
+The Nervous System provides practical compliance tools for the EU AI Act. See the full compliance page at:
+
+https://api.100levelup.com/family/eu-ai-act.html
+
+## Resources (5)
+
+- `nervous-system://framework` - The complete framework
+- `nervous-system://quick-start` - Quick start guide
+- `nervous-system://rules` - The 7 core rules
+- `nervous-system://templates` - Templates for handoffs, worklogs, preflight
+- `nervous-system://drift-audit` - Configuration drift detection
+
+## Production Stats
+
+From the live Palyan Family AI System deployment (Feb 28 - Mar 5, 2026):
+
+- **58+** violations caught
+- **29** edits blocked by preflight
+- **13** unique files protected
+- **0** rules bypassed
+- **28** processes monitored
+- **7** days continuous operation
+
+## Live Demo
+
+Try it yourself (no login required):
+
+- **[Interactive Demo](https://api.100levelup.com/family/arthur.html?guest=1)** - Talk to a governed LLM and try to break the rules
+- **[Audit Dashboard](https://api.100levelup.com/family/audit.html)** - See real violation history with timeline
+- **[System Status](https://api.100levelup.com/family/status.html)** - Live health checks
+- **[API Documentation](https://api.100levelup.com/family/api-docs.html)** - Full tool and resource reference
+- **[Case Study](https://api.100levelup.com/family/case-study.html)** - Production deployment data
+- **[Plain English Rules](https://api.100levelup.com/family/rules-plain.html)** - For non-technical stakeholders
+- **[Incident Response](https://api.100levelup.com/family/incident-response.html)** - Detection, containment, resolution
+- **[EU AI Act Compliance](https://api.100levelup.com/family/eu-ai-act.html)** - Practical EU AI Act compliance tools
+
+## Philosophy
+
+> "LLMs can't reliably self-enforce promises. Guardrails work via preflight.sh, violation logs, and catching drift. Build enforcement systems, don't make promises."
+
+If a guardrail can be violated by the thing it guards, it is not a guardrail. It is a suggestion.
+
+Every rule in the Nervous System is enforced by an external mechanism: a shell script, a timer, a separate monitoring process. The LLM cannot override, circumvent, or ignore them.
+
+## License
+
+MIT

package/index.js

@@ -129,7 +129,7 @@ const MCP_VERSION = '2024-11-05';
 // Server info
 const SERVER_INFO = {
   name: 'nervous-system',
-  version: '1.4.0'
+  version: '1.5.1'
 };
 
 // ============================================================
@@ -138,7 +138,7 @@ const SERVER_INFO = {
 
 const FRAMEWORK = {
   name: 'The Nervous System',
-  version: '1.4.0',
+  version: '1.5.1',
   author: 'Arthur Palyan',
   tagline: 'Anthropic built the brain. Arthur built the nervous system that keeps it from hurting itself.',
   problem: 'LLMs lose context between sessions, loop on problems instead of dispatching, silently fail without progress notes, edit protected files, drift from the real problem, and solve instead of asking.',
@@ -616,6 +616,39 @@ const TOOLS = [
         }
       }
     }
+  },
+  // NEW: Security Audit
+  {
+    name: 'security_audit',
+    annotations: { title: 'Security Audit', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    description: 'Scans for security vulnerabilities - hardcoded passwords in HTML, exposed API keys, missing TLS, missing rate limiting, exposed bot tokens, and insecure file permissions.',
+    inputSchema: { type: 'object', properties: {} }
+  },
+  // NEW: Auto Propagate
+  {
+    name: 'auto_propagate',
+    annotations: { title: 'Auto Propagate', readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    description: 'Runs all 3 propagators (role, version, content) and reports what changed vs what was already current. Ensures all downstream files match source-of-truth values.',
+    inputSchema: { type: 'object', properties: {} }
+  },
+  // NEW: Session Close
+  {
+    name: 'session_close',
+    annotations: { title: 'Session Close', readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    description: 'One-call session close. Runs drift_audit scope=full, then all 3 propagators. Returns combined results. The end-of-session button.',
+    inputSchema: { type: 'object', properties: {} }
+  },
+  // NEW: Page Health
+  {
+    name: 'page_health',
+    annotations: { title: 'Page Health Check', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    description: 'Checks HTML pages in /root/family-home/ for broken links, broken fetches, missing mobile nav, placeholder text, missing images, stale links, missing OG tags, missing favicon, JS syntax issues, and empty sections. Catches what drift_audit does not - actual page functionality and UX issues.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        page: { type: 'string', description: "Specific page to check (e.g. 'gateway.html'), or 'all' for everything" }
+      }
+    }
   }
 ];
 
@@ -976,7 +1009,7 @@ function auditWebsite() {
   // Source of truth values
   const pkgFile = '/root/github-repos/mcp-nervous-system/package.json';
   const pkg = safeReadJSON(pkgFile);
-  const expectedVersion = pkg ? pkg.version : '1.4.0';
+  const expectedVersion = pkg ? pkg.version : '1.5.0';
   const actualToolCount = TOOLS.length;
   const actualResourceCount = RESOURCES.length;
 
@@ -1184,6 +1217,336 @@ function runDriftAudit(scope) {
   };
 }
 
+// ============================================================
+// SECURITY AUDIT ENGINE
+// ============================================================
+
+function runSecurityAudit() {
+  const vulnerabilities = [];
+  let checksPassed = 0;
+
+  // 1. Scan HTML files for hardcoded passwords/secrets
+  const htmlDir = '/root/family-home/';
+  const secretPatterns = [
+    /Liarzhek1\$/g,
+    /Levelsofself1\$/g,
+    /\d{10}:AA[A-Za-z0-9_-]{30,}/g,
+    /sk-ant-[a-zA-Z0-9_-]+/g,
+    /npm_[A-Za-z0-9]{20,}/g,
+    /ghp_[A-Za-z0-9]{20,}/g,
+    /BOT_TOKEN\s*[:=]\s*['"][^'"]+['"]/gi,
+    /PAPA_FULL\s*[:=]\s*['"][^'"]+['"]/gi,
+    /PAPA_READ\s*[:=]\s*['"][^'"]+['"]/gi
+  ];
+  try {
+    const htmlFiles = fs.readdirSync(htmlDir).filter(f => f.endsWith('.html'));
+    for (const hf of htmlFiles) {
+      const content = safeReadFile(htmlDir + hf);
+      if (!content) continue;
+      let fileClean = true;
+      for (const pat of secretPatterns) {
+        pat.lastIndex = 0;
+        const matches = content.match(pat);
+        if (matches && matches.length > 0) {
+          vulnerabilities.push({ type: 'hardcoded_secret', file: hf, pattern: pat.source, count: matches.length });
+          fileClean = false;
+        }
+      }
+      if (fileClean) checksPassed++;
+    }
+  } catch (e) {
+    vulnerabilities.push({ type: 'scan_error', file: 'html_scan', detail: e.message });
+  }
+
+  // 2. Check auth endpoints use server-side validation
+  const serverContent = safeReadFile('/root/family-home/server.js');
+  if (serverContent) {
+    if (serverContent.includes('getSessionFromReq') || serverContent.includes('getAccessLevel')) {
+      checksPassed++;
+    } else {
+      vulnerabilities.push({ type: 'missing_server_auth', file: 'server.js', detail: 'No server-side auth validation found' });
+    }
+  }
+
+  // 3. Verify GUEST_HIDDEN_FILES covers sensitive files
+  if (serverContent) {
+    const sensitiveFiles = ['api-credentials.json', 'family-roles.json', 'system-config.json', 'llm-providers.json'];
+    for (const sf of sensitiveFiles) {
+      if (serverContent.includes('"' + sf + '"') || serverContent.includes("'" + sf + "'")) {
+        checksPassed++;
+      } else {
+        vulnerabilities.push({ type: 'unhidden_sensitive_file', file: sf, detail: 'Not in GUEST_HIDDEN_FILES' });
+      }
+    }
+  }
+
+  // 4. Check Caddy TLS
+  const caddyContent = safeReadFile('/etc/caddy/Caddyfile');
+  if (caddyContent) {
+    if (caddyContent.includes('tls') || caddyContent.includes('https://') || caddyContent.includes('100levelup.com')) {
+      checksPassed++;
+    } else {
+      vulnerabilities.push({ type: 'missing_tls', file: 'Caddyfile', detail: 'No TLS configuration found' });
+    }
+  }
+
+  // 5. Check bridge rate limiting
+  if (serverContent && serverContent.includes('rate') || fs.existsSync('/root/rate-limit.js') || fs.existsSync('/root/bridge-ratelimit.js')) {
+    checksPassed++;
+  } else {
+    vulnerabilities.push({ type: 'missing_rate_limit', file: 'bridge', detail: 'No rate limiting found for bridge' });
+  }
+
+  // 6. Check bot tokens not in public HTML
+  try {
+    const htmlFiles = fs.readdirSync(htmlDir).filter(f => f.endsWith('.html'));
+    let tokenFound = false;
+    for (const hf of htmlFiles) {
+      const content = safeReadFile(htmlDir + hf);
+      if (!content) continue;
+      const tokenMatch = content.match(/\d{10}:AA[A-Za-z0-9_-]{30,}/g);
+      if (tokenMatch) {
+        vulnerabilities.push({ type: 'exposed_bot_token', file: hf, count: tokenMatch.length });
+        tokenFound = true;
+      }
+    }
+    if (!tokenFound) checksPassed++;
+  } catch (e) {}
+
+  // 7. Check api-credentials.json permissions
+  try {
+    const credFile = '/root/family-data/api-credentials.json';
+    if (fs.existsSync(credFile)) {
+      const stats = fs.statSync(credFile);
+      const mode = (stats.mode & 0o777).toString(8);
+      if (mode === '600') {
+        checksPassed++;
+      } else {
+        vulnerabilities.push({ type: 'insecure_permissions', file: 'api-credentials.json', detail: 'Mode is ' + mode + ', should be 600' });
+      }
+    } else {
+      checksPassed++; // No creds file = no risk
+    }
+  } catch (e) {}
+
+  // 8. Check for Telegram tokens, API keys, npm tokens in family-home
+  try {
+    const allFiles = fs.readdirSync(htmlDir);
+    const dangerPatterns = [
+      { name: 'telegram_token', pat: /\d{10}:AA[A-Za-z0-9_-]{30,}/g },
+      { name: 'anthropic_key', pat: /sk-ant-[a-zA-Z0-9_-]{20,}/g },
+      { name: 'npm_token', pat: /npm_[A-Za-z0-9]{20,}/g }
+    ];
+    for (const f of allFiles) {
+      if (f.endsWith('.html') || f.endsWith('.js') || f.endsWith('.json')) {
+        const content = safeReadFile(htmlDir + f);
+        if (!content) continue;
+        for (const dp of dangerPatterns) {
+          dp.pat.lastIndex = 0;
+          const m = content.match(dp.pat);
+          if (m) {
+            vulnerabilities.push({ type: 'exposed_' + dp.name, file: f, count: m.length });
+          }
+        }
+      }
+    }
+    checksPassed++;
+  } catch (e) {}
+
+  return {
+    status: vulnerabilities.length === 0 ? 'secure' : 'vulnerabilities_found',
+    vulnerability_count: vulnerabilities.length,
+    checks_passed: checksPassed,
+    vulnerabilities
+  };
+}
+
+// ============================================================
+// AUTO PROPAGATE ENGINE
+// ============================================================
+
+function runAutoPropagators() {
+  const results = [];
+  const scripts = [
+    { name: 'role', path: '/root/family-workers/role-propagator.js' },
+    { name: 'version', path: '/root/family-workers/version-propagator.js' },
+    { name: 'content', path: '/root/family-workers/content-propagator.js' }
+  ];
+  for (const script of scripts) {
+    try {
+      const out = execSync('node ' + script.path + ' 2>&1', { timeout: 15000 }).toString();
+      const current = out.indexOf('Already current') !== -1;
+      results.push({ propagator: script.name, status: current ? 'current' : 'updated', output: out.trim().substring(0, 500) });
+    } catch (e) {
+      results.push({ propagator: script.name, status: 'error', error: e.message.substring(0, 200) });
+    }
+  }
+  return {
+    timestamp: new Date().toISOString(),
+    propagators_run: results.length,
+    results
+  };
+}
+
+// ============================================================
+// PAGE HEALTH ENGINE
+// ============================================================
+
+function runPageHealth(page) {
+  const FAMILY_HOME = '/root/family-home';
+  const issues = [];
+
+  let htmlFiles;
+  if (page && page !== 'all') {
+    const target = page.endsWith('.html') ? page : page + '.html';
+    const fullPath = `${FAMILY_HOME}/${target}`;
+    if (!fs.existsSync(fullPath)) return { status: 'error', error: `File not found: ${target}` };
+    htmlFiles = [target];
+  } else {
+    try {
+      htmlFiles = fs.readdirSync(FAMILY_HOME).filter(f => f.endsWith('.html'));
+    } catch (e) {
+      return { status: 'error', error: `Cannot read ${FAMILY_HOME}: ${e.message}` };
+    }
+  }
+
+  for (const file of htmlFiles) {
+    const filePath = `${FAMILY_HOME}/${file}`;
+    let content;
+    try { content = fs.readFileSync(filePath, 'utf8'); } catch (e) { continue; }
+
+    // 1. BROKEN LINKS - local href/src that don't exist
+    const localRefs = [];
+    const hrefMatches = content.matchAll(/(?:href|src)=["'](?!https?:\/\/|mailto:|tel:|#|javascript:|data:)([^"'#?]+)/gi);
+    for (const m of hrefMatches) {
+      const ref = m[1].trim();
+      if (!ref || ref.startsWith('//') || ref.startsWith('{')) continue;
+      localRefs.push(ref);
+    }
+    for (const ref of localRefs) {
+      const resolved = ref.startsWith('/') ? ref : `${FAMILY_HOME}/${ref}`;
+      if (!fs.existsSync(resolved)) {
+        issues.push({ page: file, type: 'broken_link', detail: `Local reference "${ref}" - file not found` });
+      }
+    }
+
+    // 2. BROKEN FETCHES - check fetch() endpoints respond on localhost
+    const fetchMatches = content.matchAll(/fetch\s*\(\s*['"`]([^'"`]+)['"`]/g);
+    for (const m of fetchMatches) {
+      const url = m[1];
+      if (url.includes('${')) continue; // skip template literals with variables
+      if (url.startsWith('http://localhost') || url.startsWith('http://127.0.0.1') || url.startsWith('/')) {
+        let testUrl = url;
+        if (url.startsWith('/')) {
+          // Try to figure out port from context, default to common ports
+          testUrl = `http://localhost:3000${url}`;
+        }
+        try {
+          execSync(`curl -s -o /dev/null -w "%{http_code}" --max-time 2 "${testUrl}"`, { encoding: 'utf8', timeout: 3000 });
+        } catch (e) {
+          issues.push({ page: file, type: 'broken_fetch', detail: `fetch("${url}") - endpoint not responding` });
+        }
+      }
+    }
+
+    // 3. MOBILE NAV - has nav-links but no hamburger/mobile menu
+    const hasNavLinks = /class=["'][^"']*nav-links/i.test(content) || /<nav[\s>]/i.test(content);
+    const hasHamburger = /hamburger|mobile-menu|menu-toggle|nav-toggle|burger/i.test(content) || /class=["'][^"']*toggle/i.test(content);
+    if (hasNavLinks && !hasHamburger) {
+      issues.push({ page: file, type: 'no_mobile_menu', detail: 'nav-links found but no hamburger toggle for mobile' });
+    }
+
+    // 4. PLACEHOLDER TEXT - "--" as default in stat/value elements
+    const placeholderMatches = content.matchAll(/id=["']([^"']+)["'][^>]*>\s*--\s*</g);
+    for (const m of placeholderMatches) {
+      issues.push({ page: file, type: 'placeholder_text', detail: `Element "${m[1]}" shows "--" (live data not loading)` });
+    }
+    // Also check spans/divs with class containing stat/value/count
+    const statPlaceholders = content.matchAll(/class=["'][^"']*(?:stat|value|count|metric)[^"']*["'][^>]*>\s*--\s*</gi);
+    for (const m of statPlaceholders) {
+      issues.push({ page: file, type: 'placeholder_text', detail: 'Stat/value element shows "--" (live data not loading)' });
+    }
+
+    // 5. MISSING IMAGES - img src referencing local files that don't exist
+    const imgMatches = content.matchAll(/<img[^>]+src=["'](?!https?:\/\/|data:)([^"']+)["']/gi);
+    for (const m of imgMatches) {
+      const src = m[1].trim();
+      if (!src || src.startsWith('{')) continue;
+      const resolved = src.startsWith('/') ? src : `${FAMILY_HOME}/${src}`;
+      if (!fs.existsSync(resolved)) {
+        issues.push({ page: file, type: 'missing_image', detail: `Image "${src}" not found` });
+      }
+    }
+
+    // 6. STALE LINKS - external links to app stores, npm, github format check
+    const extLinkMatches = content.matchAll(/href=["'](https?:\/\/[^"']+)["']/gi);
+    for (const m of extLinkMatches) {
+      const url = m[1];
+      if (/play\.google\.com/.test(url) && !/play\.google\.com\/store\/apps\/details\?id=/.test(url)) {
+        issues.push({ page: file, type: 'stale_link', detail: `Malformed Play Store link: ${url}` });
+      }
+      if (/apps\.apple\.com/.test(url) && !/apps\.apple\.com\/.*\/app\//.test(url)) {
+        issues.push({ page: file, type: 'stale_link', detail: `Malformed App Store link: ${url}` });
+      }
+      if (/npmjs\.com/.test(url) && !/npmjs\.com\/package\//.test(url)) {
+        issues.push({ page: file, type: 'stale_link', detail: `Malformed npm link: ${url}` });
+      }
+      if (/github\.com/.test(url) && /github\.com\/?["']/.test(url)) {
+        issues.push({ page: file, type: 'stale_link', detail: `Generic GitHub link (no repo): ${url}` });
+      }
+    }
+
+    // 7. MISSING OG TAGS
+    const ogTags = ['og:title', 'og:description', 'og:image'];
+    for (const tag of ogTags) {
+      if (!content.includes(`property="${tag}"`) && !content.includes(`property='${tag}'`)) {
+        issues.push({ page: file, type: 'missing_og_tag', detail: `Missing ${tag} meta tag` });
+      }
+    }
+
+    // 8. MISSING FAVICON
+    if (!/rel=["'](?:icon|shortcut icon)["']/i.test(content)) {
+      issues.push({ page: file, type: 'missing_favicon', detail: 'No favicon link tag found' });
+    }
+
+    // 9. CONSOLE ERRORS - JS syntax issues (unclosed tags, mismatched brackets)
+    const scriptBlocks = content.matchAll(/<script[^>]*>([\s\S]*?)<\/script>/gi);
+    for (const m of scriptBlocks) {
+      const js = m[1].trim();
+      if (!js) continue;
+      // Check bracket balance
+      let parens = 0, braces = 0, brackets = 0;
+      for (const ch of js) {
+        if (ch === '(') parens++;
+        else if (ch === ')') parens--;
+        else if (ch === '{') braces++;
+        else if (ch === '}') braces--;
+        else if (ch === '[') brackets++;
+        else if (ch === ']') brackets--;
+      }
+      if (parens !== 0) issues.push({ page: file, type: 'js_syntax', detail: `Mismatched parentheses in script block (balance: ${parens})` });
+      if (braces !== 0) issues.push({ page: file, type: 'js_syntax', detail: `Mismatched braces in script block (balance: ${braces})` });
+      if (brackets !== 0) issues.push({ page: file, type: 'js_syntax', detail: `Mismatched brackets in script block (balance: ${brackets})` });
+    }
+
+    // 10. EMPTY SECTIONS
+    const sectionMatches = content.matchAll(/<section[^>]*>([\s\S]*?)<\/section>/gi);
+    for (const m of sectionMatches) {
+      const inner = m[1].replace(/<!--[\s\S]*?-->/g, '').replace(/<[^>]+>/g, '').trim();
+      if (!inner) {
+        issues.push({ page: file, type: 'empty_section', detail: 'Section tag with no visible content' });
+      }
+    }
+  }
+
+  return {
+    status: issues.length === 0 ? 'healthy' : 'issues_found',
+    pages_checked: htmlFiles.length,
+    issue_count: issues.length,
+    issues
+  };
+}
+
 // ============================================================
 // Handle tool calls
 // ============================================================
@@ -1286,6 +1649,29 @@ function handleToolCall(name, args) {
       return runDriftAudit(scope);
     }
 
+    case 'security_audit': {
+      return runSecurityAudit();
+    }
+
+    case 'auto_propagate': {
+      return runAutoPropagators();
+    }
+
+    case 'session_close': {
+      const driftResult = runDriftAudit('full');
+      const propagateResult = runAutoPropagators();
+      return {
+        timestamp: new Date().toISOString(),
+        drift_audit: driftResult,
+        propagation: propagateResult,
+        summary: driftResult.drift_count === 0 ? 'Session clean - no drifts, propagators run' : `${driftResult.drift_count} drifts found - review before closing`
+      };
+    }
+
+    case 'page_health': {
+      return runPageHealth(args.page || 'all');
+    }
+
     default:
       return { error: 'Unknown tool' };
   }
@@ -1407,7 +1793,7 @@ const server = http.createServer((req, res) => {
   // Health check
   if (req.method === 'GET' && url.pathname === '/health') {
     res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ status: 'ok', service: 'nervous-system-mcp', version: '1.4.0', protocol: MCP_VERSION }));
+    res.end(JSON.stringify({ status: 'ok', service: 'nervous-system-mcp', version: '1.5.0', protocol: MCP_VERSION }));
     return;
   }
 
@@ -1524,7 +1910,7 @@ const server = http.createServer((req, res) => {
     res.writeHead(200, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({
       name: 'The Nervous System MCP Server',
-      version: '1.4.0',
+      version: '1.5.1',
       protocol: MCP_VERSION,
       description: 'LLM behavioral enforcement framework. 7 core rules, preflight checks, session handoffs, worklogs, violation logging, kill switch, hash-chained audit, and forced reflection cycles. Built by Arthur Palyan.',
       endpoints: {
@@ -1546,8 +1932,8 @@ const server = http.createServer((req, res) => {
 migrateExistingViolations();
 
 server.listen(PORT, '127.0.0.1', () => {
-  console.error(`[MCP Server] Nervous System v1.4.0 running on port ${PORT}`);
+  console.error(`[MCP Server] Nervous System v1.5.1 running on port ${PORT}`);
   console.error(`[MCP Server] SSE: /sse | HTTP: /mcp | Health: /health | Kill: POST /kill | Audit: GET /audit/verify | Dispatches: GET /dispatches`);
   console.error(`[MCP Server] Protocol: ${MCP_VERSION}`);
-  console.error(`[MCP Server] Tools: ${TOOLS.length} (including kill switch, audit chain, dispatch, drift audit)`);
+  console.error(`[MCP Server] Tools: ${TOOLS.length} (including kill switch, audit chain, dispatch, drift audit, page health)`);
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-nervous-system",
-  "version": "1.4.0",
-  "description": "The Nervous System - LLM Behavioral Enforcement Framework. 7 mechanically enforced rules, 12 tools including kill switch, audit chain, dispatch, and drift audit. MCP server for Claude Desktop, Claude Code, and any MCP-compatible client.",
+  "version": "1.5.1",
+  "description": "The Nervous System - LLM Behavioral Enforcement Framework. 7 mechanically enforced rules, 16 tools including kill switch, audit chain, dispatch, drift audit, security audit, page health, and session close. MCP server for Claude Desktop, Claude Code, and any MCP-compatible client.",
   "main": "server.js",
   "bin": {
     "mcp-nervous-system": "./stdio.js"