secufusion-mcp 1.0.0 → 1.0.2

package/README.md

@@ -0,0 +1,167 @@
+# SecuFusion MCP Server
+
+> **Developer workflow tooling for the SecuFusion platform** — enforces zero-trust architecture standards, tracks task specs, and gates PRs with automated guardrail checks.
+
+[![npm version](https://img.shields.io/npm/v/secufusion-mcp)](https://www.npmjs.com/package/secufusion-mcp)
+[![license](https://img.shields.io/npm/l/secufusion-mcp)](./LICENSE)
+[![node](https://img.shields.io/node/v/secufusion-mcp)](https://nodejs.org)
+
+---
+
+## What is this?
+
+`secufusion-mcp` is a [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that plugs into AI coding assistants (Claude Desktop, Cursor, Cline, etc.) and gives them three powerful tools to enforce SecuFusion's engineering standards:
+
+| Tool | Phase | What it does |
+|---|---|---|
+| `manage_feature_spec` | Planning & Execution | Creates/updates a `.current-task-spec.md` blueprint |
+| `log_rejected_pattern` | Course Correction | Records bad patterns to `.rejected-patterns.json` |
+| `run_pre_pr_checks` | PR Handoff | Scans the codebase and gates PRs with guardrail validation |
+
+---
+
+## Installation
+
+### Option 1 — npx (no install required)
+```bash
+npx secufusion-mcp
+```
+
+### Option 2 — Global install
+```bash
+npm install -g secufusion-mcp
+```
+
+---
+
+## Setup: Add to Your MCP Client
+
+### Claude Desktop
+
+Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
+or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
+
+```json
+{
+  "mcpServers": {
+    "secufusion-mcp": {
+      "command": "npx",
+      "args": ["-y", "secufusion-mcp"]
+    }
+  }
+}
+```
+
+### Cursor / Cline
+
+```json
+{
+  "secufusion-mcp": {
+    "command": "npx",
+    "args": ["-y", "secufusion-mcp"]
+  }
+}
+```
+
+---
+
+## Tools Reference
+
+### 1. manage_feature_spec
+
+Creates or updates `.current-task-spec.md` — your single source of truth for every task.
+
+**Parameters:**
+
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `action` | `create` or `update` or `read` | Yes | Operation to perform |
+| `task_description` | string | When action=create | Full feature/task description |
+| `update_content` | string | When action=update | Markdown to merge (tick checkboxes) |
+| `work_item_id` | string | No | Azure DevOps work item ID |
+| `reference_file_path` | string | No | Source file to extract coding patterns from |
+
+**Example:**
+```
+"Start WI-1042: Add tenant-scoped audit log CSV export.
+Reference: src/services/AuditService.java"
+```
+
+---
+
+### 2. log_rejected_pattern
+
+Appends bad patterns to `.rejected-patterns.json` so they are never repeated.
+
+**Parameters:**
+
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `pattern` | string | Yes | The bad pattern or approach |
+| `reason` | string | Yes | Why rejected and what to do instead |
+| `category` | enum | No | architecture, security, database, logging, api-design, testing, other |
+| `file_context` | string | No | File where the pattern was observed |
+
+**Example:**
+```
+"Never use a global @Repository without tenantId scoping — it leaks cross-tenant data."
+```
+
+---
+
+### 3. run_pre_pr_checks
+
+Scans the codebase and produces a pass/fail report. Must pass before raising a PR.
+
+**Parameters:**
+
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `work_item_id` | string | Yes | Azure DevOps work item ID |
+| `root_dir` | string | No | Directory to scan (defaults to cwd) |
+| `skip_checks` | array | No | `spec_boxes`, `console_logs`, `hardcoded_urls`, `flyway_migrations` |
+
+**Checks performed:**
+
+| Check | Fails when |
+|---|---|
+| SPEC | Spec missing or has unchecked boxes |
+| LOGGING | console.log() or System.out.println() found in source |
+| SECURITY | Hardcoded IPs or uat/prod/staging URLs found |
+| FLYWAY | @Entity files exist but no V__*.sql migrations found |
+
+---
+
+## Guardrails
+
+```
+All DB queries and event payloads scoped with tenantId
+No console.log() or System.out.println() in any source file
+No hardcoded UAT/Prod IPs or environment URLs
+Every JPA @Entity change requires a Flyway .sql migration
+Spec must be fully checked before PR is raised
+```
+
+---
+
+## Workflow
+
+```
+Phase 1 — Planning    : manage_feature_spec (create)  → .current-task-spec.md
+Phase 2 — Execution   : manage_feature_spec (update)  → tick off ACs
+Phase 3 — Correction  : log_rejected_pattern           → .rejected-patterns.json
+Phase 4 — PR Handoff  : run_pre_pr_checks              → must pass to ship
+```
+
+---
+
+## Requirements
+
+- Node.js >= 18.0.0
+- An MCP-compatible AI client (Claude Desktop, Cursor, Cline, etc.)
+
+---
+
+## License
+
+ISC

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",
@@ -36,4 +36,4 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.0.0"
   }
-}
+}