secufusion-mcp 1.0.0

package/index.js

@@ -0,0 +1,519 @@
+#!/usr/bin/env node
+/**
+ * SecuFusion MCP Server
+ *
+ * Provides developer-workflow tooling for the SecuFusion platform:
+ *   - manage_feature_spec  : create / update task blueprints (.current-task-spec.md)
+ *   - log_rejected_pattern : record bad patterns so they are never repeated (.rejected-patterns.json)
+ *   - run_pre_pr_checks    : gate PRs with automated guardrail validation
+ *
+ * Guardrails enforced:
+ *   1. All DB queries and event payloads must carry tenantId.
+ *   2. No console.log (TS/JS) or System.out.println (Java) in source files.
+ *   3. No hardcoded UAT/Prod IPs or environment URLs.
+ *   4. Every modified JPA @Entity must have a matching Flyway SQL migration.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import fs from "fs";
+import path from "path";
+// ─────────────────────────────────────────────
+//  Constants / helpers
+// ─────────────────────────────────────────────
+const SPEC_FILE = ".current-task-spec.md";
+const REJECTED_FILE = ".rejected-patterns.json";
+/** Resolve a path relative to cwd (where the MCP server is invoked). */
+function resolve(file) {
+    return path.resolve(process.cwd(), file);
+}
+function readFileSafe(filePath) {
+    try {
+        return fs.readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return null;
+    }
+}
+function writeFile(filePath, content) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content, "utf-8");
+}
+// ─────────────────────────────────────────────
+//  manage_feature_spec helpers
+// ─────────────────────────────────────────────
+function buildInitialSpec(taskDescription, workItemId, referenceSnippet) {
+    const now = new Date().toISOString();
+    const wiLine = workItemId
+        ? `**Azure DevOps Work Item:** [${workItemId}](https://dev.azure.com/secufusion/_workitems/edit/${workItemId})\n`
+        : "";
+    const refSection = referenceSnippet
+        ? `\n## Reference Code Pattern\n\n> Extracted from the provided reference file to guide implementation style.\n\n\`\`\`\n${referenceSnippet.slice(0, 800)}\n\`\`\`\n`
+        : "";
+    return `# SecuFusion Feature Spec
+<!-- AUTO-GENERATED — do not remove the checkboxes; they are used by run_pre_pr_checks -->
+
+**Generated:** ${now}
+${wiLine}
+## Task Description
+
+${taskDescription}
+${refSection}
+## Guardrails Checklist
+
+- [ ] All DB queries / event payloads are scoped with \`tenantId\`
+- [ ] No \`console.log\` / \`System.out.println\` left in source files
+- [ ] No hardcoded UAT/Prod IPs or environment URLs
+- [ ] Flyway SQL migration created for every modified JPA \`@Entity\`
+- [ ] Unit tests written / updated for new business logic
+- [ ] API contract (OpenAPI / TS types) updated if endpoints changed
+
+## Acceptance Criteria
+
+- [ ] AC-1: (fill in from ticket)
+- [ ] AC-2: (fill in from ticket)
+- [ ] AC-3: (fill in from ticket)
+
+## Implementation Notes
+
+> Add architecture decisions, edge-cases, and external dependency notes here.
+
+## Session Log
+
+| Timestamp | Update |
+|-----------|--------|
+| ${now} | Spec created |
+`;
+}
+function appendSessionLog(existing, update) {
+    const ts = new Date().toISOString();
+    const logRow = `| ${ts} | ${update} |`;
+    return existing.replace(/(\| [^\n]+ \|)\s*$/, `$1\n${logRow}`);
+}
+// ─────────────────────────────────────────────
+//  run_pre_pr_checks helpers
+// ─────────────────────────────────────────────
+const CONSOLE_LOG_PATTERNS = [
+    { regex: /console\.log\s*\(/g, label: "console.log()", ext: [".ts", ".tsx", ".js", ".jsx"] },
+    { regex: /System\.out\.println\s*\(/g, label: "System.out.println()", ext: [".java"] },
+];
+const HARDCODED_URL_PATTERN = /(?:https?:\/\/)?(?:\d{1,3}\.){3}\d{1,3}(?::\d+)?|(?:uat|prod|staging|preprod)\.[a-z0-9.-]+\.[a-z]{2,}/gi;
+function walkDir(dir, exts) {
+    const results = [];
+    if (!fs.existsSync(dir))
+        return results;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (["node_modules", ".git", "dist", "build", "target", ".idea"].includes(entry.name))
+                continue;
+            results.push(...walkDir(full, exts));
+        }
+        else if (exts.some((e) => entry.name.endsWith(e))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function checkSpecFile() {
+    const content = readFileSafe(resolve(SPEC_FILE));
+    if (!content)
+        return { unchecked: [], missing: true };
+    const unchecked = [];
+    for (const line of content.split("\n")) {
+        const match = line.match(/^- \[ \] (.+)/);
+        if (match)
+            unchecked.push(match[1].trim());
+    }
+    return { unchecked, missing: false };
+}
+function checkConsoleLogs(rootDir) {
+    const violations = [];
+    for (const { regex, label, ext } of CONSOLE_LOG_PATTERNS) {
+        const files = walkDir(rootDir, ext);
+        for (const file of files) {
+            const content = readFileSafe(file);
+            if (!content)
+                continue;
+            const lines = content.split("\n");
+            lines.forEach((line, idx) => {
+                if (regex.test(line)) {
+                    violations.push(`${label} found at ${path.relative(rootDir, file)}:${idx + 1}`);
+                }
+                regex.lastIndex = 0;
+            });
+        }
+    }
+    return violations;
+}
+function checkHardcodedUrls(rootDir) {
+    const violations = [];
+    const exts = [".ts", ".tsx", ".js", ".jsx", ".java", ".properties", ".yml", ".yaml"];
+    const files = walkDir(rootDir, exts);
+    for (const file of files) {
+        const content = readFileSafe(file);
+        if (!content)
+            continue;
+        const matches = content.match(HARDCODED_URL_PATTERN);
+        if (matches) {
+            violations.push(`Hardcoded URL/IP in ${path.relative(rootDir, file)}: ${[...new Set(matches)].join(", ")}`);
+        }
+    }
+    return violations;
+}
+function checkFlywayMigrations(rootDir) {
+    const warnings = [];
+    const javaFiles = walkDir(rootDir, [".java"]);
+    const entityFiles = javaFiles.filter((f) => {
+        const content = readFileSafe(f);
+        return content && /@Entity\b/.test(content);
+    });
+    if (entityFiles.length === 0)
+        return warnings;
+    const flywayDirs = [
+        path.join(rootDir, "src", "main", "resources", "db", "migration"),
+        path.join(rootDir, "src", "main", "resources", "db", "migrations"),
+        path.join(rootDir, "resources", "db", "migration"),
+    ];
+    const flywayDir = flywayDirs.find((d) => fs.existsSync(d));
+    if (!flywayDir) {
+        warnings.push(`Found ${entityFiles.length} JPA @Entity file(s) but no Flyway migration directory detected. ` +
+            `Expected at: src/main/resources/db/migration/`);
+        return warnings;
+    }
+    const migrationFiles = fs.readdirSync(flywayDir).filter((f) => /^V\d+__.*\.sql$/i.test(f));
+    if (migrationFiles.length === 0) {
+        warnings.push(`Found ${entityFiles.length} JPA @Entity file(s) but no Flyway SQL migrations exist in ${flywayDir}`);
+    }
+    return warnings;
+}
+// ─────────────────────────────────────────────
+//  MCP Server bootstrap
+// ─────────────────────────────────────────────
+const server = new McpServer({
+    name: "secufusion-mcp",
+    version: "1.0.0",
+});
+// ─── Tool 1: manage_feature_spec ─────────────────────────────────────────────
+server.tool("manage_feature_spec", "Create or update the .current-task-spec.md task blueprint. " +
+    "Pass `task_description` to create a new spec, or `update_content` to patch the existing one " +
+    "(e.g., checking off completed acceptance criteria). Optionally provide `reference_file_path` " +
+    "so the spec generator can observe existing coding patterns.", {
+    task_description: z
+        .string()
+        .optional()
+        .describe("Full description of the new feature/task (used when creating a spec from scratch)."),
+    update_content: z
+        .string()
+        .optional()
+        .describe("Partial markdown update / session-log entry to merge into the existing spec. " +
+        "Use to tick checkboxes: replace '- [ ] AC-1' with '- [x] AC-1'."),
+    work_item_id: z
+        .string()
+        .optional()
+        .describe("Azure DevOps work item ID to embed in the spec header."),
+    reference_file_path: z
+        .string()
+        .optional()
+        .describe("Absolute or cwd-relative path to an existing source file whose coding patterns should " +
+        "be embedded as a reference snippet in the new spec."),
+    action: z
+        .enum(["create", "update", "read"])
+        .default("create")
+        .describe("'create' generates a new spec (overwrites if one exists), " +
+        "'update' patches the existing spec, " +
+        "'read' returns the current spec content without modification."),
+}, async ({ task_description, update_content, work_item_id, reference_file_path, action }) => {
+    const specPath = resolve(SPEC_FILE);
+    if (action === "read") {
+        const content = readFileSafe(specPath);
+        if (!content) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `No spec file found at ${SPEC_FILE}. Run with action='create' to generate one.`,
+                    },
+                ],
+            };
+        }
+        return { content: [{ type: "text", text: content }] };
+    }
+    if (action === "create") {
+        if (!task_description) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: "ERROR: `task_description` is required when action='create'.",
+                    },
+                ],
+                isError: true,
+            };
+        }
+        let refSnippet = null;
+        if (reference_file_path) {
+            refSnippet = readFileSafe(path.isAbsolute(reference_file_path)
+                ? reference_file_path
+                : resolve(reference_file_path));
+        }
+        const spec = buildInitialSpec(task_description, work_item_id, refSnippet);
+        writeFile(specPath, spec);
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `✅ Spec created at \`${SPEC_FILE}\`.\n\n` +
+                        `Review and fill in the Acceptance Criteria before starting implementation.\n\n` +
+                        `---\n\n${spec}`,
+                },
+            ],
+        };
+    }
+    if (action === "update") {
+        if (!update_content) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: "ERROR: `update_content` is required when action='update'.",
+                    },
+                ],
+                isError: true,
+            };
+        }
+        const existing = readFileSafe(specPath);
+        if (!existing) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `ERROR: No spec file found at ${SPEC_FILE}. Create one first with action='create'.`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+        let updated = existing;
+        for (const line of update_content.split("\n")) {
+            const checkedMatch = line.match(/^- \[x\] (.+)/);
+            if (checkedMatch) {
+                const label = checkedMatch[1].trim().replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+                updated = updated.replace(new RegExp(`- \\[ \\] ${label}`, "g"), `- [x] ${checkedMatch[1].trim()}`);
+            }
+        }
+        updated = appendSessionLog(updated, update_content.replace(/\n/g, " ").slice(0, 120));
+        writeFile(specPath, updated);
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `✅ Spec updated at \`${SPEC_FILE}\`.\n\n---\n\n${updated}`,
+                },
+            ],
+        };
+    }
+    return {
+        content: [{ type: "text", text: "Unknown action." }],
+        isError: true,
+    };
+});
+// ─── Tool 2: log_rejected_pattern ────────────────────────────────────────────
+server.tool("log_rejected_pattern", "Record a coding pattern that was rejected by the team so it is never repeated. " +
+    "Appends to .rejected-patterns.json which is checked implicitly before every architectural suggestion.", {
+    pattern: z
+        .string()
+        .describe("The exact bad pattern, approach, or code construct that was rejected."),
+    reason: z
+        .string()
+        .describe("Why it was rejected and what the correct alternative is."),
+    category: z
+        .enum([
+        "architecture",
+        "security",
+        "database",
+        "logging",
+        "api-design",
+        "testing",
+        "other",
+    ])
+        .default("other")
+        .describe("Classification to make future lookup easier."),
+    file_context: z
+        .string()
+        .optional()
+        .describe("Optional: the file or code area where this was observed."),
+}, async ({ pattern, reason, category, file_context }) => {
+    const rejectedPath = resolve(REJECTED_FILE);
+    let records = [];
+    const existing = readFileSafe(rejectedPath);
+    if (existing) {
+        try {
+            records = JSON.parse(existing);
+        }
+        catch {
+            records = [];
+        }
+    }
+    const newEntry = {
+        id: records.length + 1,
+        timestamp: new Date().toISOString(),
+        category,
+        pattern,
+        reason,
+        ...(file_context ? { file_context } : {}),
+    };
+    records.push(newEntry);
+    writeFile(rejectedPath, JSON.stringify(records, null, 2));
+    return {
+        content: [
+            {
+                type: "text",
+                text: `✅ Rejected pattern #${newEntry.id} logged to \`${REJECTED_FILE}\`.\n\n` +
+                    `**Category:** ${category}\n` +
+                    `**Pattern:** ${pattern}\n` +
+                    `**Reason:** ${reason}\n\n` +
+                    `This will be checked automatically in all future architectural suggestions.`,
+            },
+        ],
+    };
+});
+// ─── Tool 3: run_pre_pr_checks ───────────────────────────────────────────────
+server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks against the current working directory. " +
+    "Validates: spec checkboxes, console.log/System.out.println usage, hardcoded IPs/URLs, " +
+    "and Flyway migration coverage for JPA entities. " +
+    "MUST pass (exit with no errors) before a PR is raised.", {
+    work_item_id: z
+        .string()
+        .describe("Azure DevOps work item ID to include in the PR summary."),
+    root_dir: z
+        .string()
+        .optional()
+        .describe("Root directory to scan (defaults to cwd). Use when the source repo is in a sub-folder."),
+    skip_checks: z
+        .array(z.enum([
+        "spec_boxes",
+        "console_logs",
+        "hardcoded_urls",
+        "flyway_migrations",
+    ]))
+        .optional()
+        .describe("Explicitly skip specific checks. Use sparingly — document the reason in your PR description."),
+}, async ({ work_item_id, root_dir, skip_checks = [] }) => {
+    const scanRoot = root_dir ? path.resolve(root_dir) : process.cwd();
+    const errors = [];
+    const warnings = [];
+    const passed = [];
+    // ── 1. Spec checkbox check ─────────────────────────────────────────────
+    if (!skip_checks.includes("spec_boxes")) {
+        const { unchecked, missing } = checkSpecFile();
+        if (missing) {
+            errors.push(`❌ [SPEC] No \`.current-task-spec.md\` found. ` +
+                `Call \`manage_feature_spec\` with action='create' before raising a PR.`);
+        }
+        else if (unchecked.length > 0) {
+            errors.push(`❌ [SPEC] ${unchecked.length} unchecked item(s) in the spec:\n` +
+                unchecked.map((u) => `   • ${u}`).join("\n"));
+        }
+        else {
+            passed.push("✅ [SPEC] All spec checkboxes are checked.");
+        }
+    }
+    else {
+        warnings.push("⚠️  [SPEC] Spec checkbox check SKIPPED (manually bypassed).");
+    }
+    // ── 2. Console log check ───────────────────────────────────────────────
+    if (!skip_checks.includes("console_logs")) {
+        const logViolations = checkConsoleLogs(scanRoot);
+        if (logViolations.length > 0) {
+            errors.push(`❌ [LOGGING] Found ${logViolations.length} prohibited log statement(s):\n` +
+                logViolations.map((v) => `   • ${v}`).join("\n"));
+        }
+        else {
+            passed.push("✅ [LOGGING] No console.log / System.out.println found.");
+        }
+    }
+    else {
+        warnings.push("⚠️  [LOGGING] Console log check SKIPPED (manually bypassed).");
+    }
+    // ── 3. Hardcoded URL check ─────────────────────────────────────────────
+    if (!skip_checks.includes("hardcoded_urls")) {
+        const urlViolations = checkHardcodedUrls(scanRoot);
+        if (urlViolations.length > 0) {
+            errors.push(`❌ [SECURITY] Found ${urlViolations.length} hardcoded URL/IP(s):\n` +
+                urlViolations.map((v) => `   • ${v}`).join("\n"));
+        }
+        else {
+            passed.push("✅ [SECURITY] No hardcoded UAT/Prod IPs or environment URLs found.");
+        }
+    }
+    else {
+        warnings.push("⚠️  [SECURITY] Hardcoded URL check SKIPPED (manually bypassed).");
+    }
+    // ── 4. Flyway migration check ──────────────────────────────────────────
+    if (!skip_checks.includes("flyway_migrations")) {
+        const flywayWarnings = checkFlywayMigrations(scanRoot);
+        if (flywayWarnings.length > 0) {
+            errors.push(...flywayWarnings.map((w) => `❌ [FLYWAY] ${w}`));
+        }
+        else {
+            passed.push("✅ [FLYWAY] Flyway migration coverage looks good.");
+        }
+    }
+    else {
+        warnings.push("⚠️  [FLYWAY] Flyway migration check SKIPPED (manually bypassed).");
+    }
+    // ── Surface rejected patterns as a reminder ───────────────────────────
+    const rejectedContent = readFileSafe(resolve(REJECTED_FILE));
+    let rejectedReminder = "";
+    if (rejectedContent) {
+        try {
+            const rejected = JSON.parse(rejectedContent);
+            if (rejected.length > 0) {
+                rejectedReminder =
+                    `\n\n---\n### 🚫 Rejected Patterns Reminder (${rejected.length} on record)\n` +
+                        rejected.map((r) => `- [${r.category}] ${r.pattern}`).join("\n");
+            }
+        }
+        catch {
+            /* ignore parse errors */
+        }
+    }
+    // ── Build final report ─────────────────────────────────────────────────
+    const hasErrors = errors.length > 0;
+    const timestamp = new Date().toISOString();
+    let report;
+    if (hasErrors) {
+        report =
+            `# ❌ Pre-PR Checks FAILED — Work Item #${work_item_id}\n\n` +
+                `**Scanned directory:** \`${scanRoot}\`\n` +
+                `**Timestamp:** ${timestamp}\n\n` +
+                `## Errors (must fix before PR)\n\n${errors.join("\n\n")}\n\n` +
+                (warnings.length > 0 ? `## Warnings\n\n${warnings.join("\n")}\n\n` : "") +
+                (passed.length > 0 ? `## Passed\n\n${passed.join("\n")}\n` : "") +
+                rejectedReminder;
+    }
+    else {
+        report =
+            `# ✅ Pre-PR Checks PASSED — Work Item #${work_item_id}\n\n` +
+                `**Scanned directory:** \`${scanRoot}\`\n` +
+                `**Timestamp:** ${timestamp}\n\n` +
+                `## All Checks Passed\n\n${passed.join("\n")}\n\n` +
+                (warnings.length > 0 ? `## Warnings\n\n${warnings.join("\n")}\n\n` : "") +
+                `## PR Summary\n\n` +
+                `- **Work Item:** [#${work_item_id}](https://dev.azure.com/secufusion/_workitems/edit/${work_item_id})\n` +
+                `- **Spec:** All acceptance criteria verified ✅\n` +
+                `- **Guardrails:** tenantId scoping, no debug logs, no hardcoded URLs, Flyway covered ✅\n` +
+                `- **Ready to raise PR** 🚀\n` +
+                rejectedReminder;
+    }
+    return {
+        content: [{ type: "text", text: report }],
+        isError: hasErrors,
+    };
+});
+// ─────────────────────────────────────────────
+//  Start transport
+// ─────────────────────────────────────────────
+const transport = new StdioServerTransport();
+await server.connect(transport);

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "secufusion-mcp",
+  "version": "1.0.0",
+  "type": "module",
+  "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "README.md"
+  ],
+  "bin": {
+    "secufusion-mcp": "index.js"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm run build",
+    "start": "node index.js",
+    "dev": "tsc && node index.js"
+  },
+  "keywords": [
+    "mcp",
+    "secufusion",
+    "developer-tools"
+  ],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.0.0"
+  }
+}