prism-mcp-server 7.2.0 → 7.3.1

package/dist/verification/runner.js

@@ -0,0 +1,479 @@
+import * as fs from "fs";
+import { getQuickJS } from "quickjs-emscripten";
+import { TestSuiteSchema, } from "./schema.js";
+import { evaluateSeverityGates, resolveEffectiveSeverity } from "./severityPolicy.js";
+// ─── Utilities ──────────────────────────────────────────────
+/** Deeply match objects (expected ⊆ actual) */
+function deepMatch(actual, expected) {
+    if (typeof expected !== 'object' || expected === null) {
+        return actual === expected;
+    }
+    for (const key of Object.keys(expected)) {
+        if (typeof actual[key] === 'object') {
+            if (!deepMatch(actual[key], expected[key]))
+                return false;
+        }
+        else if (actual[key] !== expected[key]) {
+            return false;
+        }
+    }
+    return true;
+}
+/** Race a promise against a timeout */
+function withTimeout(promise, ms) {
+    return Promise.race([
+        promise,
+        new Promise((_, reject) => setTimeout(() => reject(new Error(`Assertion timed out after ${ms}ms`)), ms)),
+    ]);
+}
+/** Sleep utility for retry backoff */
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+const PRIVATE_IPV4_CIDRS = [
+    [ipToInt("10.0.0.0"), ipToInt("10.255.255.255")],
+    [ipToInt("127.0.0.0"), ipToInt("127.255.255.255")],
+    [ipToInt("169.254.0.0"), ipToInt("169.254.255.255")],
+    [ipToInt("172.16.0.0"), ipToInt("172.31.255.255")],
+    [ipToInt("192.168.0.0"), ipToInt("192.168.255.255")],
+    [ipToInt("100.64.0.0"), ipToInt("100.127.255.255")],
+    [ipToInt("0.0.0.0"), ipToInt("0.255.255.255")],
+    [ipToInt("224.0.0.0"), ipToInt("255.255.255.255")],
+];
+function ipToInt(ip) {
+    return ip.split(".").reduce((acc, octet) => (acc << 8) + Number(octet), 0) >>> 0;
+}
+function isPrivateIpv4(hostname) {
+    if (!/^\d+\.\d+\.\d+\.\d+$/.test(hostname))
+        return false;
+    const value = ipToInt(hostname);
+    return PRIVATE_IPV4_CIDRS.some(([start, end]) => value >= start && value <= end);
+}
+function isDisallowedIpv6(hostname) {
+    const normalized = hostname.toLowerCase();
+    return (normalized === "::1" ||
+        normalized.startsWith("fc") || // fc00::/7
+        normalized.startsWith("fd") || // fc00::/7
+        normalized.startsWith("fe8") || // fe80::/10
+        normalized.startsWith("fe9") ||
+        normalized.startsWith("fea") ||
+        normalized.startsWith("feb") ||
+        normalized === "::" ||
+        normalized === "0:0:0:0:0:0:0:0");
+}
+function validateHttpTarget(target) {
+    let parsed;
+    try {
+        parsed = new URL(target);
+    }
+    catch {
+        return { ok: false, reason: `Invalid URL: ${target}` };
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return { ok: false, reason: `Unsupported protocol: ${parsed.protocol}` };
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local")) {
+        return { ok: false, reason: `Blocked host: ${hostname}` };
+    }
+    // Block decimal/hex IP obfuscation (e.g. http://2852039166/ → 169.254.169.254)
+    if (/^0x[0-9a-fA-F]+$/.test(hostname) || /^\d+$/.test(hostname)) {
+        return { ok: false, reason: `Blocked obfuscated IP: ${hostname}` };
+    }
+    if (isPrivateIpv4(hostname) || isDisallowedIpv6(hostname)) {
+        return { ok: false, reason: `Blocked internal IP: ${hostname}` };
+    }
+    return { ok: true };
+}
+function skipResult(test, reason) {
+    return {
+        id: test.id,
+        layer: test.layer,
+        description: test.description,
+        severity: test.severity,
+        passed: false,
+        skipped: true,
+        skip_reason: reason,
+        duration_ms: 0,
+        retries_used: 0,
+    };
+}
+function prepareAssertions(tests, filterLayers, minSeverity, config) {
+    const preparedById = new Map();
+    const orderedIds = [];
+    const precomputed = new Map();
+    for (let index = 0; index < tests.length; index++) {
+        const test = tests[index];
+        orderedIds.push(test.id);
+        if (preparedById.has(test.id)) {
+            precomputed.set(test.id, skipResult(test, `Duplicate assertion id "${test.id}"`));
+            continue;
+        }
+        let skipped;
+        if (!filterLayers.includes(test.layer)) {
+            skipped = skipResult(test, `Layer "${test.layer}" not in active layers [${filterLayers.join(", ")}]`);
+        }
+        if (!skipped && minSeverity) {
+            const effective = resolveEffectiveSeverity(test.severity, config.default_severity);
+            const severityOrder = { warn: 0, gate: 1, abort: 2 };
+            if (severityOrder[effective] < severityOrder[minSeverity]) {
+                skipped = skipResult(test, `Severity "${effective}" below minimum "${minSeverity}"`);
+            }
+        }
+        const prepared = {
+            test,
+            skipped,
+            dependents: [],
+        };
+        preparedById.set(test.id, prepared);
+        if (skipped)
+            precomputed.set(test.id, skipped);
+    }
+    for (const prepared of preparedById.values()) {
+        const dep = prepared.test.depends_on;
+        if (!dep)
+            continue;
+        const depAssertion = preparedById.get(dep);
+        if (!depAssertion) {
+            const depReason = `Dependency "${dep}" not found`;
+            prepared.dependencyReason = depReason;
+            precomputed.set(prepared.test.id, skipResult(prepared.test, depReason));
+            continue;
+        }
+        depAssertion.dependents.push(prepared.test.id);
+    }
+    const indegree = new Map();
+    for (const [id, prepared] of preparedById.entries()) {
+        indegree.set(id, prepared.test.depends_on && !prepared.dependencyReason ? 1 : 0);
+    }
+    const queue = [];
+    for (const [id, count] of indegree.entries()) {
+        if (count === 0)
+            queue.push(id);
+    }
+    let visited = 0;
+    while (queue.length > 0) {
+        const id = queue.shift();
+        visited++;
+        const prepared = preparedById.get(id);
+        if (!prepared)
+            continue;
+        for (const dependentId of prepared.dependents) {
+            const next = (indegree.get(dependentId) || 0) - 1;
+            indegree.set(dependentId, next);
+            if (next === 0)
+                queue.push(dependentId);
+        }
+    }
+    if (visited < preparedById.size) {
+        for (const [id, count] of indegree.entries()) {
+            if (count > 0) {
+                const prepared = preparedById.get(id);
+                if (!prepared)
+                    continue;
+                if (!precomputed.has(id)) {
+                    precomputed.set(id, skipResult(prepared.test, `Cyclic dependency involving "${id}"`));
+                }
+            }
+        }
+    }
+    return { preparedById, orderedIds, precomputed };
+}
+// ─── Default config when none provided ──────────────────────
+const DEFAULT_CONFIG = {
+    enabled: true,
+    layers: ["data", "agent", "pipeline"],
+    default_severity: "warn",
+};
+// ─── v7.2.0: Enhanced Verification Runner ───────────────────
+export class VerificationRunner {
+    /**
+     * v7.2.0 enhanced suite runner.
+     *
+     * - Layer/severity filtering
+     * - Per-assertion timeout
+     * - Retry logic for transient failures
+     * - Dependency chain resolution
+     * - Structured VerificationResult with per-layer breakdown
+     */
+    static async runSuite(jsonContent, options) {
+        const startTime = Date.now();
+        const config = options?.config ?? DEFAULT_CONFIG;
+        const filterLayers = options?.layers ?? config.layers;
+        const minSeverity = options?.minSeverity;
+        let assertionResults = [];
+        try {
+            const parsed = JSON.parse(jsonContent);
+            const suite = TestSuiteSchema.parse(parsed);
+            const { preparedById, orderedIds, precomputed } = prepareAssertions(suite.tests, filterLayers, minSeverity, config);
+            const outcomes = new Map();
+            const resultById = new Map(precomputed);
+            for (const [id] of preparedById.entries()) {
+                if (precomputed.has(id)) {
+                    outcomes.set(id, { passed: false, skipped: true });
+                }
+            }
+            const pending = new Map(preparedById);
+            for (const id of precomputed.keys()) {
+                pending.delete(id);
+            }
+            while (pending.size > 0) {
+                const ready = [];
+                for (const prepared of pending.values()) {
+                    if (prepared.test.depends_on && !outcomes.has(prepared.test.depends_on)) {
+                        continue;
+                    }
+                    ready.push(prepared);
+                }
+                if (ready.length === 0) {
+                    // Safety guard — remaining assertions are unresolved; skip them.
+                    for (const prepared of pending.values()) {
+                        const unresolved = skipResult(prepared.test, `Unresolved dependency state for "${prepared.test.id}"`);
+                        resultById.set(prepared.test.id, unresolved);
+                        outcomes.set(prepared.test.id, { passed: false, skipped: true });
+                    }
+                    pending.clear();
+                    break;
+                }
+                await Promise.all(ready.map(async (prepared) => {
+                    pending.delete(prepared.test.id);
+                    if (prepared.skipped) {
+                        resultById.set(prepared.test.id, prepared.skipped);
+                        outcomes.set(prepared.test.id, { passed: false, skipped: true });
+                        return;
+                    }
+                    if (prepared.dependencyReason) {
+                        const skipped = skipResult(prepared.test, prepared.dependencyReason);
+                        resultById.set(prepared.test.id, skipped);
+                        outcomes.set(prepared.test.id, { passed: false, skipped: true });
+                        return;
+                    }
+                    if (prepared.test.depends_on) {
+                        const depOutcome = outcomes.get(prepared.test.depends_on);
+                        if (!depOutcome || !depOutcome.passed) {
+                            const depStatus = depOutcome?.skipped ? "skipped" : "failed";
+                            const skipped = skipResult(prepared.test, `Dependency "${prepared.test.depends_on}" ${depStatus}`);
+                            resultById.set(prepared.test.id, skipped);
+                            outcomes.set(prepared.test.id, { passed: false, skipped: true });
+                            return;
+                        }
+                    }
+                    const assertionStart = Date.now();
+                    const maxRetries = prepared.test.retry_count ?? 0;
+                    let lastError = "";
+                    let retriesUsed = 0;
+                    let passed = false;
+                    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+                        if (attempt > 0) {
+                            retriesUsed++;
+                            await sleep(Math.min(1000 * attempt, 3000));
+                        }
+                        try {
+                            const runPromise = this.runAssertion(prepared.test);
+                            const result = prepared.test.timeout_ms
+                                ? await withTimeout(runPromise, prepared.test.timeout_ms)
+                                : await runPromise;
+                            if (result.passed) {
+                                passed = true;
+                                break;
+                            }
+                            else {
+                                lastError = result.error || "Assertion returned false";
+                            }
+                        }
+                        catch (e) {
+                            lastError = e.message || String(e);
+                        }
+                    }
+                    const result = {
+                        id: prepared.test.id,
+                        layer: prepared.test.layer,
+                        description: prepared.test.description,
+                        severity: prepared.test.severity,
+                        passed,
+                        error: passed ? undefined : lastError,
+                        duration_ms: Date.now() - assertionStart,
+                        retries_used: retriesUsed,
+                        skipped: false,
+                    };
+                    resultById.set(prepared.test.id, result);
+                    outcomes.set(prepared.test.id, { passed, skipped: false });
+                }));
+            }
+            assertionResults = orderedIds
+                .map((id) => resultById.get(id))
+                .filter((result) => Boolean(result));
+        }
+        catch (e) {
+            // Parse error — return a single synthetic failure
+            assertionResults = [{
+                    id: "__parse_error__",
+                    layer: "pipeline",
+                    description: "Test suite specification parse",
+                    severity: "abort",
+                    passed: false,
+                    error: `Specification Parse Error: ${e.message}`,
+                    duration_ms: Date.now() - startTime,
+                    retries_used: 0,
+                    skipped: false,
+                }];
+        }
+        // ── Build per-layer breakdown ──
+        const byLayer = {};
+        for (const ar of assertionResults) {
+            if (!byLayer[ar.layer]) {
+                byLayer[ar.layer] = { passed: 0, failed: 0, skipped: 0, total: 0, assertions: [] };
+            }
+            const lr = byLayer[ar.layer];
+            lr.total++;
+            if (ar.skipped)
+                lr.skipped++;
+            else if (ar.passed)
+                lr.passed++;
+            else
+                lr.failed++;
+            lr.assertions.push(ar);
+        }
+        // ── Evaluate severity gates ──
+        const severityGate = evaluateSeverityGates(assertionResults, config);
+        const passedCount = assertionResults.filter(a => a.passed).length;
+        const failedCount = assertionResults.filter(a => !a.passed && !a.skipped).length;
+        const skippedCount = assertionResults.filter(a => a.skipped).length;
+        return {
+            passed: failedCount === 0,
+            total: assertionResults.length,
+            passed_count: passedCount,
+            failed_count: failedCount,
+            skipped_count: skippedCount,
+            by_layer: byLayer,
+            duration_ms: Date.now() - startTime,
+            severity_gate: severityGate,
+            assertion_results: assertionResults,
+        };
+    }
+    // ── Legacy API (backward compat with v5.3 callers) ────────
+    static async runSuiteLegacy(jsonContent) {
+        const result = await this.runSuite(jsonContent);
+        return {
+            passed: result.passed,
+            failures: result.assertion_results
+                .filter(a => !a.passed && !a.skipped)
+                .map(a => `[${a.layer}] ${a.description} failed: ${a.error}`),
+        };
+    }
+    static async runAssertion(test) {
+        const a = test.assertion;
+        switch (a.type) {
+            case "file_exists": {
+                const exists = fs.existsSync(a.target);
+                return exists === a.expected
+                    ? { passed: true }
+                    : { passed: false, error: `Expected file_exists=${a.expected} for ${a.target}` };
+            }
+            case "file_contains": {
+                if (!fs.existsSync(a.target)) {
+                    return { passed: false, error: `File not found: ${a.target}` };
+                }
+                const content = fs.readFileSync(a.target, "utf8");
+                const contains = content.includes(a.expected);
+                return contains
+                    ? { passed: true }
+                    : { passed: false, error: `File ${a.target} did not contain expected string` };
+            }
+            case "http_status": {
+                try {
+                    const targetCheck = validateHttpTarget(a.target);
+                    if (!targetCheck.ok) {
+                        return { passed: false, error: `HTTP target blocked: ${targetCheck.reason}` };
+                    }
+                    const res = await fetch(a.target);
+                    return res.status === a.expected
+                        ? { passed: true }
+                        : { passed: false, error: `Expected status ${a.expected}, got ${res.status} for ${a.target}` };
+                }
+                catch (e) {
+                    return { passed: false, error: `HTTP fetch failed: ${e.message}` };
+                }
+            }
+            case "sqlite_query": {
+                try {
+                    const { execFileSync } = await import("child_process");
+                    const dbFile = process.env.DATABASE_URL?.replace("file:", "") || ".prism-mcp/local.db";
+                    if (!fs.existsSync(dbFile))
+                        return { passed: false, error: `DB file not found: ${dbFile}` };
+                    // v7.2.0 FIX: Use execFileSync with -readonly flag for cross-platform read-only.
+                    // The URI ?mode=ro approach requires SQLITE_USE_URI=1 at compile time,
+                    // which isn't guaranteed on all distributions. -readonly is a native CLI flag.
+                    const rawResult = execFileSync("sqlite3", ["-readonly", dbFile, a.target, "--json"], {
+                        encoding: "utf8",
+                        timeout: 10_000, // 10s hard limit for any SQL query
+                    });
+                    const rows = rawResult.trim() ? JSON.parse(rawResult) : [];
+                    return deepMatch(rows, a.expected)
+                        ? { passed: true }
+                        : { passed: false, error: `SQL expected ${JSON.stringify(a.expected)}, got ${JSON.stringify(rows)}` };
+                }
+                catch (e) {
+                    return { passed: false, error: `SQL execution failed: ${e.message}` };
+                }
+            }
+            case "quickjs_eval": {
+                return await this.runQuickJs(a.code, a.inputs || {});
+            }
+            default:
+                return { passed: false, error: `Unknown assertion type` };
+        }
+    }
+    /**
+     * Execute JavaScript safely in WebAssembly sandbox via quickjs-emscripten
+     */
+    static async runQuickJs(code, inputs) {
+        const QuickJS = await getQuickJS();
+        const vm = QuickJS.newContext();
+        try {
+            vm.runtime.setMemoryLimit(10 * 1024 * 1024);
+            vm.runtime.setMaxStackSize(512 * 1024);
+            let ops = 0;
+            vm.runtime.setInterruptHandler(() => {
+                ops++;
+                return ops > 10000;
+            });
+            // v7.2.0 FIX: Properly inject inputs as a JSON string literal,
+            // then JSON.parse inside the VM. The previous approach broke on
+            // object/array inputs due to unquoted interpolation.
+            const inputsJson = JSON.stringify(inputs);
+            const parseResult = vm.evalCode(`JSON.parse('${inputsJson.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}')`);
+            if (parseResult.error) {
+                const err = vm.dump(parseResult.error);
+                parseResult.error.dispose();
+                return { passed: false, error: `QuickJS Input Parse Error: ${err}` };
+            }
+            if (parseResult.value) {
+                vm.setProp(vm.global, "inputs", parseResult.value || vm.undefined);
+                parseResult.value.dispose();
+            }
+            const wrappedCode = `(function() { ${code} })()`;
+            const result = vm.evalCode(wrappedCode);
+            if (result.error) {
+                const errorString = vm.dump(result.error);
+                result.error.dispose();
+                return { passed: false, error: `QuickJS Error: ${errorString}` };
+            }
+            const value = result.value ? vm.dump(result.value) : undefined;
+            if (result.value)
+                result.value.dispose();
+            if (typeof value !== "boolean") {
+                return { passed: false, error: `QuickJS evaluation returned ${typeof value}, expected boolean` };
+            }
+            return value
+                ? { passed: true }
+                : { passed: false, error: `Sandbox evaluation returned false` };
+        }
+        catch (e) {
+            return { passed: false, error: `Sandbox crashed: ${e.message}` };
+        }
+        finally {
+            vm.dispose();
+        }
+    }
+}

package/dist/verification/schema.js

@@ -0,0 +1,46 @@
+import { z } from "zod";
+// ─── v7.2.0: Severity Levels ────────────────────────────────
+//  warn  → log and continue
+//  gate  → block progression until resolved
+//  abort → rollback (fail the pipeline)
+export const SeverityLevel = z.enum(["warn", "gate", "abort"]).default("warn");
+// Base for all assertions
+const BaseAssertion = z.object({
+    target: z.string().describe("The SQL query, URL, or file path"),
+    expected: z.any().describe("The expected outcome to match against"),
+});
+// 1. Declarative Assertions (Split for better type inference)
+export const SqliteAssertionSchema = BaseAssertion.extend({ type: z.literal("sqlite_query") });
+export const HttpStatusAssertionSchema = BaseAssertion.extend({ type: z.literal("http_status") });
+export const FileExistsAssertionSchema = BaseAssertion.extend({ type: z.literal("file_exists") });
+export const FileContainsAssertionSchema = BaseAssertion.extend({ type: z.literal("file_contains") });
+// 2. Sandboxed JS Assertion
+export const SandboxedJsAssertionSchema = z.object({
+    type: z.literal("quickjs_eval"),
+    code: z.string().describe("JS code to run in QuickJS. Must return a boolean."),
+    inputs: z.record(z.string(), z.any()).optional().describe("Data to inject as globals into the sandbox"),
+});
+// 3. Main Schema Wrapper (v7.2.0 enhanced)
+export const TestAssertionSchema = z.object({
+    id: z.string(),
+    layer: z.enum(["data", "agent", "pipeline"]),
+    description: z.string(),
+    severity: SeverityLevel,
+    // v7.2.0: per-assertion timeout in ms
+    timeout_ms: z.number().int().min(50).max(120_000).optional().describe("Per-assertion timeout in milliseconds"),
+    // v7.2.0: retry on transient failures (e.g. http_status)
+    retry_count: z.number().int().min(0).max(5).optional().describe("Number of retries on transient failures"),
+    // v7.2.0: assertion dependency chain
+    depends_on: z.string().optional().describe("ID of assertion that must pass first"),
+    // Discriminated union gives pinpoint accuracy on parsing errors
+    assertion: z.discriminatedUnion("type", [
+        SqliteAssertionSchema,
+        HttpStatusAssertionSchema,
+        FileExistsAssertionSchema,
+        FileContainsAssertionSchema,
+        SandboxedJsAssertionSchema
+    ])
+});
+export const TestSuiteSchema = z.object({
+    tests: z.array(TestAssertionSchema)
+});

package/dist/verification/severityPolicy.js

@@ -0,0 +1,94 @@
+// ─── v7.2.0: Severity Gate Enforcement ──────────────────────
+// Separated from the runner for testability.
+//
+// Rules:
+//  - "warn" failures  → logged, always continue
+//  - "gate" failures  → block. Return "block" action with failed assertions list
+//  - "abort" failures → immediate abort. Return "abort" action
+//
+// When PRISM_VERIFICATION_DEFAULT_SEVERITY is set, it overrides
+// individual assertion severity levels (acts as a floor).
+/**
+ * Map severity string to numeric rank for comparison.
+ * Higher = more severe.
+ */
+function severityRank(s) {
+    switch (s) {
+        case "warn": return 0;
+        case "gate": return 1;
+        case "abort": return 2;
+        default: return 0;
+    }
+}
+/**
+ * Resolve the effective severity for an assertion, considering
+ * the global default severity override (acts as a floor).
+ */
+export function resolveEffectiveSeverity(assertionSeverity, defaultSeverity) {
+    const assertRank = severityRank(assertionSeverity);
+    const defaultRank = severityRank(defaultSeverity);
+    // Use whichever is more severe (floor behavior)
+    return assertRank >= defaultRank ? assertionSeverity : defaultSeverity;
+}
+/**
+ * Evaluate all assertion results against severity gates.
+ *
+ * Returns a SeverityGateResult indicating the overall action:
+ *  - "continue" → all clear, or only "warn"-level failures
+ *  - "block"    → at least one "gate"-level failure (no "abort")
+ *  - "abort"    → at least one "abort"-level failure
+ */
+export function evaluateSeverityGates(results, config) {
+    const failures = results.filter(r => !r.passed && !r.skipped);
+    if (failures.length === 0) {
+        return {
+            action: "continue",
+            failed_assertions: [],
+            summary: "All assertions passed."
+        };
+    }
+    // Resolve effective severities and categorize failures
+    const abortFailures = [];
+    const gateFailures = [];
+    const warnFailures = [];
+    for (const f of failures) {
+        const effective = resolveEffectiveSeverity(f.severity, config.default_severity);
+        switch (effective) {
+            case "abort":
+                abortFailures.push(f);
+                break;
+            case "gate":
+                gateFailures.push(f);
+                break;
+            case "warn":
+            default:
+                warnFailures.push(f);
+                break;
+        }
+    }
+    // Abort takes precedence over gate
+    if (abortFailures.length > 0) {
+        const ids = abortFailures.map(a => a.id).join(", ");
+        return {
+            action: "abort",
+            failed_assertions: [...abortFailures, ...gateFailures, ...warnFailures],
+            summary: `ABORT: ${abortFailures.length} abort-level failure(s) [${ids}]. ` +
+                `${gateFailures.length} gate, ${warnFailures.length} warn failures also present.`
+        };
+    }
+    if (gateFailures.length > 0) {
+        const ids = gateFailures.map(a => a.id).join(", ");
+        return {
+            action: "block",
+            failed_assertions: [...gateFailures, ...warnFailures],
+            summary: `BLOCKED: ${gateFailures.length} gate-level failure(s) [${ids}]. ` +
+                `${warnFailures.length} warn-level failures also present.`
+        };
+    }
+    // Only warn-level failures → continue
+    return {
+        action: "continue",
+        failed_assertions: warnFailures,
+        summary: `CONTINUE: ${warnFailures.length} warn-level failure(s) logged, no blocking issues.`
+    };
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "prism-mcp-server",
-  "version": "7.2.0",
+  "version": "7.3.1",
   "mcpName": "io.github.dcostenco/prism-mcp",
-  "description": "The Mind Palace for AI Agents — persistent memory (SQLite/Supabase), behavioral learning & IDE rules sync, multimodal VLM image captioning, pluggable LLM providers (OpenAI/Anthropic/Gemini/Ollama), OpenTelemetry distributed tracing, GDPR export, multi-agent Hivemind sync, time travel, visual Mind Palace dashboard. Zero-config local mode.",
+  "description": "The Mind Palace for AI Agents — fail-closed Dark Factory autonomous pipelines (3-gate parse→type→scope validation), persistent memory (SQLite/Supabase), ACT-R cognitive retrieval, behavioral learning & IDE rules sync, multi-agent Hivemind, time travel, visual dashboard. Zero-config local mode.",
   "module": "index.ts",
   "type": "module",
   "main": "dist/server.js",
@@ -68,7 +68,11 @@
     "dashboard",
     "actr",
     "cognitive-memory",
-    "activation-memory"
+    "activation-memory",
+    "dark-factory",
+    "autonomous-pipeline",
+    "fail-closed",
+    "path-traversal-prevention"
   ],
   "homepage": "https://github.com/dcostenco/prism-mcp",
   "repository": {
@@ -90,7 +94,6 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.80.0",
-    "@tavily/core": "^0.6.0",
     "@google-cloud/discoveryengine": "^2.5.3",
     "@google/generative-ai": "^0.24.1",
     "@libsql/client": "^0.17.2",
@@ -102,6 +105,7 @@
     "@opentelemetry/sdk-trace-node": "^2.6.1",
     "@opentelemetry/semantic-conventions": "^1.40.0",
     "@supabase/supabase-js": "^2.99.3",
+    "@tavily/core": "^0.6.0",
     "cheerio": "^1.2.0",
     "dotenv": "^16.5.0",
     "fflate": "^0.8.2",
@@ -110,6 +114,7 @@
     "p-limit": "^7.3.0",
     "quickjs-emscripten": "^0.32.0",
     "stream-json": "^2.0.0",
-    "turndown": "^7.2.2"
+    "turndown": "^7.2.2",
+    "zod": "^4.3.6"
   }
 }