midnight-mcp 0.1.21 → 0.1.23

package/dist/tools/analyze.js

@@ -377,7 +377,11 @@ const explainCircuitOutputSchema = {
 export const analyzeTools = [
     {
         name: "midnight-analyze-contract",
-        description: "Analyze a Compact smart contract for structure, patterns, and potential security issues. Returns detailed breakdown of circuits, witnesses, ledger state, and recommendations.",
+        description: "⚠️ STATIC ANALYSIS ONLY - Analyze contract structure and patterns. " +
+            "🚫 THIS DOES NOT COMPILE THE CONTRACT. Cannot catch: sealed field rules, disclose() requirements, semantic errors. " +
+            "👉 ALWAYS call 'midnight-validate-contract' FIRST to verify the code actually compiles. " +
+            "Use this for: understanding structure, security pattern analysis, recommendations. " +
+            "NEVER claim a contract 'works' or 'compiles' based on this tool alone.",
         inputSchema: {
             type: "object",
             properties: {

package/dist/tools/repository/tools.js

@@ -358,7 +358,13 @@ export const repositoryTools = [
     // ============================================================================
     {
         name: "midnight-validate-contract",
-        description: "🔍 PRIMARY VERIFICATION: Compile and validate a Compact contract using the ACTUAL Compact compiler. **ALWAYS use this tool first** when verifying contract code - it catches real compilation errors that static analysis cannot detect. Returns detailed error messages with line numbers, suggested fixes, and actionable guidance. If the compiler is not installed, it will provide installation instructions. Accepts either source code directly OR a file path to a .compact file. For contracts you generate, ALWAYS validate with this tool before presenting to the user.",
+        description: "� REQUIRED - ALWAYS CALL THIS FIRST: Compile a Compact contract using the REAL compiler. " +
+            "⚠️ CRITICAL: You MUST call this tool BEFORE telling the user a contract works or is correct. " +
+            "Static analysis tools like 'extract-contract-structure' or 'analyze-contract' CANNOT verify compilation - they miss semantic errors like: " +
+            "(1) sealed fields require constructor, (2) constructor params need disclose(), (3) export circuits cannot modify sealed fields. " +
+            "This tool runs the ACTUAL Compact compiler and returns real errors with line numbers. " +
+            "If compiler not installed, it provides installation instructions. " +
+            "WORKFLOW: Generate code → Call this tool → Fix errors → Repeat until success → THEN present to user.",
         inputSchema: {
             type: "object",
             properties: {
@@ -454,7 +460,12 @@ export const repositoryTools = [
     },
     {
         name: "midnight-extract-contract-structure",
-        description: "📋 STATIC ANALYSIS (not verification): Extract the structure of a Compact contract and detect common issues. Returns circuits, witnesses, ledger items, types, structs, enums, and **potentialIssues** (module-level const, stdlib collisions, sealed+export conflicts). **WARNING: This does NOT verify compilation** - use 'midnight-validate-contract' for actual compiler verification. Use this tool for: (1) understanding contract structure, (2) quick pre-checks before compilation, (3) fallback analysis when compiler unavailable. Do NOT claim a contract 'compiles correctly' based only on this tool.",
+        description: "⚠️ STATIC ANALYSIS ONLY - NOT A COMPILER: Extracts contract structure (circuits, witnesses, ledger) and detects common patterns. " +
+            "🚫 THIS TOOL CANNOT VERIFY COMPILATION. It will NOT catch: sealed field rules, disclose() requirements, type mismatches, or semantic errors. " +
+            "✅ USE FOR: Understanding structure, quick pattern checks, fallback when compiler unavailable. " +
+            "❌ NEVER USE TO: Verify a contract works, claim code 'compiles correctly', or validate before presenting to user. " +
+            "👉 ALWAYS call 'midnight-validate-contract' FIRST to actually compile the code. " +
+            "Detects: module-level const, stdlib collisions, sealed+export conflicts, missing disclose(), Counter.value access, division operator.",
         inputSchema: {
             type: "object",
             properties: {

package/dist/tools/repository/validation.js

@@ -1379,6 +1379,44 @@ export async function extractContractStructure(input) {
             }
         }
     }
+    // 10. Detect constructor parameters assigned to ledger without disclose()
+    // Constructor parameters are treated as witness values and need disclose() when written to ledger
+    const constructorMatch = code.match(/constructor\s*\(([^)]*)\)\s*\{([\s\S]*?)(?=\n\s*(?:export|circuit|witness|ledger|constructor|\}|$))/);
+    if (constructorMatch) {
+        const paramsStr = constructorMatch[1];
+        const constructorBody = constructorMatch[2];
+        // Extract constructor parameter names
+        const paramPattern = /(\w+)\s*:\s*[^,)]+/g;
+        const constructorParams = [];
+        let paramMatch;
+        while ((paramMatch = paramPattern.exec(paramsStr)) !== null) {
+            constructorParams.push(paramMatch[1]);
+        }
+        // Check each parameter for direct assignment to ledger without disclose
+        for (const param of constructorParams) {
+            // Look for direct assignment: ledgerField = param (without disclose)
+            const assignmentPattern = new RegExp(`(\\w+)\\s*=\\s*(?!disclose\\s*\\()${param}\\b`, "g");
+            let assignMatch;
+            while ((assignMatch = assignmentPattern.exec(constructorBody)) !== null) {
+                const fieldName = assignMatch[1];
+                // Check if the field is a ledger item
+                const isLedgerField = ledgerItems.some((l) => l.name === fieldName);
+                if (isLedgerField) {
+                    // Find the line number
+                    const beforeAssign = code.substring(0, constructorMatch.index +
+                        constructorMatch[0].indexOf(assignMatch[0]));
+                    const lineNum = (beforeAssign.match(/\n/g) || []).length + 1;
+                    potentialIssues.push({
+                        type: "undisclosed_constructor_param",
+                        line: lineNum,
+                        message: `Constructor parameter '${param}' assigned to ledger field '${fieldName}' without disclose()`,
+                        suggestion: `Wrap in disclose(): '${fieldName} = disclose(${param});'`,
+                        severity: "error",
+                    });
+                }
+            }
+        }
+    }
     const summary = [];
     if (circuits.length > 0) {
         summary.push(`${circuits.length} circuit(s)`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "midnight-mcp",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "Model Context Protocol Server for Midnight Blockchain Development",
   "type": "module",
   "main": "dist/index.js",