secufusion-mcp 1.0.13 → 1.0.15

package/README.md

@@ -10,7 +10,7 @@
 
 ## What is this?
 
-`secufusion-mcp` is a [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that plugs into AI coding assistants (Claude Desktop, Cursor, Cline, etc.) and gives them **eight powerful tools** to enforce SecuFusion's engineering standards throughout the development lifecycle:
+`secufusion-mcp` is a [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that plugs into AI coding assistants (Claude Desktop, Cursor, Cline, etc.) and gives them **nine powerful tools** to enforce SecuFusion's engineering standards throughout the development lifecycle:
 
 | Tool | Phase | What it does |
 |---|---|---|
@@ -22,6 +22,7 @@
 | `manage_branch_state` | Legacy — Branch State | Backward-compatible branch-scoped JSON state tracker (for tasks before `manage_task`) |
 | `log_rejected_pattern` | **Phase 3** — Course Correction | Records bad patterns to `.rejected-patterns.json` so they are never repeated |
 | `run_pre_pr_checks` | **Phase 4** — PR Handoff | Discovers modified microservices and gates PRs via AST-level linters + structural checks |
+| `get_secufusion_rules` | **Setup** | Returns the `AGENTS.md` rules for AI clients that don't natively support MCP Resources |
 
 ---
 
@@ -342,6 +343,19 @@ Loads and manages `.secufusion-project-spec.json` — the permanent project memo
 1. Same directory as `index.js`
 2. `process.cwd()`
 3. Walk up from `cwd` (up to 5 levels)
+4. The global MCP package installation directory (bundled spec fallback)
+
+---
+
+### 5. `get_secufusion_rules`
+
+A simple utility tool that returns the raw text of the `AGENTS.md` workflow rules. This is designed as a workaround for AI clients (like older versions of Cline or Claude Code) that do not support the MCP **Resources** capability.
+
+By calling this tool, the AI can read the globally bundled rules without you needing to copy the `.agents` folder into your local repository.
+
+**Example:**
+> "Call the get_secufusion_rules tool and read the rules before we begin."
+
 
 ---
 
@@ -623,7 +637,7 @@ The SecuFusion MCP operates across three complementary layers to prevent AI amne
 ### How it all wires together
 
 ```
-mcp_config.json                →  starts the server (8 tools available)
+mcp_config.json                →  starts the server (9 tools available)
       +
 .agents/AGENTS.md              →  tells AI when to invoke each tool
       ↓
@@ -648,19 +662,19 @@ Phase 4: manage_task complete  →  pr-summary.md generated
        + run_pre_pr_checks     →  must pass before raising PR
 ```
 
-### Reusing across projects
+### Reusing across projects (Global Bundling)
 
-Copy `.agents/AGENTS.md` into any project's root — the invoker follows you everywhere.
+As of version **1.0.13+**, `secufusion-mcp` globally bundles both `.secufusion-project-spec.json` and `AGENTS.md`. You **no longer need to copy these files** into every single repository!
 
-```
-ProjectA/
-  .agents/AGENTS.md   ← same file, copy it here
+When you install globally (`npm install -g secufusion-mcp@latest`), the AI can automatically read your rules and project spec on the fly from the global installation.
 
-ProjectB/
-  .agents/AGENTS.md   ← and here
+**How to load the Rules in a new project:**
+Depending on your AI client's capabilities, you can load the rules instantly by telling the AI:
+- **"Use the `secufusion_developer` prompt"** (if Prompts are supported)
+- **"Read the `secufusion://rules` resource"** (if Resources are supported)
+- **"Call the `get_secufusion_rules` tool"** (if only Tools are supported)
 
-mcp_config.json       ← global, never changes
-```
+*(If you prefer the legacy method, you can still copy `.agents/AGENTS.md` and `.secufusion-project-spec.json` into your project root).*
 
 ---
 

package/index.js

@@ -25,9 +25,26 @@ import { execSync } from "child_process";
 const STATE_FILE = ".secufusion-state.json";
 const REJECTED_FILE = ".rejected-patterns.json";
 const TOKEN_FILE = ".secufusion-tokens.json";
-/** Resolve a path relative to cwd (where the MCP server is invoked). */
+/** Find the workspace root by walking up from cwd to find a project marker. */
+function getWorkspaceRoot() {
+    let currentDir = process.cwd();
+    const rootMarkers = [".git", "package.json", "pom.xml", ".secufusion-project-spec.json", ".agents"];
+    for (let i = 0; i < 10; i++) {
+        for (const marker of rootMarkers) {
+            if (fs.existsSync(path.join(currentDir, marker))) {
+                return currentDir;
+            }
+        }
+        const parent = path.dirname(currentDir);
+        if (parent === currentDir)
+            break; // Reached filesystem root
+        currentDir = parent;
+    }
+    return process.cwd(); // Fallback to current directory
+}
+/** Resolve a path relative to workspace root (where the MCP server is invoked). */
 function resolve(file) {
-    return path.resolve(process.cwd(), file);
+    return path.resolve(getWorkspaceRoot(), file);
 }
 function readFileSafe(filePath) {
     try {
@@ -328,9 +345,9 @@ server.tool("manage_branch_state", "Manage the structured JSON state for the cur
         .describe("Explicit actionable instruction for resuming. Required for 'update'."),
 }, async ({ action, task_description, reference_file_path, pending_acs, completed_acs, next_step }) => {
     const inputChars = JSON.stringify({ action, task_description, reference_file_path, pending_acs, completed_acs, next_step }).length;
-    const cwd = process.cwd();
+    const cwd = getWorkspaceRoot();
     const branch = getCurrentBranch(cwd);
-    const statePath = path.resolve(STATE_FILE);
+    const statePath = resolve(STATE_FILE);
     let state = {};
     if (fs.existsSync(statePath)) {
         try {
@@ -507,7 +524,7 @@ server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks acr
         .describe("Explicitly skip specific checks. Use sparingly — document the reason in your PR description."),
 }, async ({ work_item_id, root_dir, skip_checks = [] }) => {
     const inputChars = JSON.stringify({ work_item_id, root_dir, skip_checks }).length;
-    const scanRoot = root_dir ? path.resolve(root_dir) : process.cwd();
+    const scanRoot = root_dir ? path.resolve(root_dir) : getWorkspaceRoot();
     const errors = [];
     const warnings = [];
     const passed = [];
@@ -701,10 +718,10 @@ server.tool("manage_project_spec", "Manages the .secufusion-project-spec.json fi
     const candidates = [];
     // 1. Same directory as index.ts/index.js
     candidates.push(path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), SPEC_FILE));
-    // 2. process.cwd()
-    candidates.push(path.resolve(process.cwd(), SPEC_FILE));
-    // 3. Walk up from cwd until found (up to 5 levels)
-    let walkDir = process.cwd();
+    // 2. getWorkspaceRoot()
+    candidates.push(path.resolve(getWorkspaceRoot(), SPEC_FILE));
+    // 3. Walk up from getWorkspaceRoot() until found (up to 5 levels)
+    let walkDir = getWorkspaceRoot();
     for (let i = 0; i < 5; i++) {
         const parent = path.dirname(walkDir);
         if (parent === walkDir)
@@ -1097,5 +1114,14 @@ server.prompt("secufusion_developer", "Starts a conversation with the SecuFusion
 // ─────────────────────────────────────────────
 //  Start transport
 // ─────────────────────────────────────────────
+server.tool("get_secufusion_rules", "Fetches the mandatory AGENTS.md workflow rules for the SecuFusion project. Call this before starting any work.", {}, async () => {
+    const content = readFileSafe(AGENTS_MD_PATH);
+    if (!content) {
+        throw new Error(`Rules file not found at ${AGENTS_MD_PATH}`);
+    }
+    return appendTelemetry({
+        content: [{ type: "text", text: content }]
+    }, 0);
+});
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",