secufusion-mcp 1.0.4 → 1.0.6

package/README.md

@@ -14,9 +14,9 @@
 
 | Tool | Phase | What it does |
 |---|---|---|
-| `manage_feature_spec` | Planning & Execution | Creates/updates a `.current-task-spec.md` blueprint for every feature |
-| `log_rejected_pattern` | Course Correction | Records bad patterns to `.rejected-patterns.json` so they're never repeated |
-| `run_pre_pr_checks` | PR Handoff | Scans the codebase and gates PRs with automated guardrail validation |
+| `manage_feature_spec` | Planning & Execution | Creates/updates a `.current-task-spec.md` blueprint (works for single-repo or cross-repo tasks) |
+| `log_rejected_pattern` | Course Correction | Records bad patterns to `.rejected-patterns.json` so they are never repeated |
+| `run_pre_pr_checks` | PR Handoff | Discovers modified microservices across the workspace and gates PRs via AST-level linters + structural checks |
 
 ---
 
@@ -213,26 +213,23 @@ This writes to `.rejected-patterns.json`:
 
 ---
 
-### 3. `run_pre_pr_checks`
-
-Scans your entire codebase and produces a pass/fail report. **Must pass before raising a PR.**
-
-**Parameters:**
+### 3. run_pre_pr_checks
 
 | Parameter | Type | Required | Description |
 |---|---|---|---|
-| `work_item_id` | string | Yes | Azure DevOps work item ID for the PR summary |
+| `work_item_id` | string | Yes | Azure DevOps work item ID |
 | `root_dir` | string | No | Directory to scan (defaults to cwd) |
-| `skip_checks` | array | No | Checks to bypass: `spec_boxes`, `console_logs`, `hardcoded_urls`, `flyway_migrations` |
+| `skip_checks` | array | No | `spec_boxes`, `console_logs`, `hardcoded_urls`, `flyway_migrations` |
 
-**Checks performed:**
+**Guardrail checks:**
 
-| Check | What fails it |
+| Check | Fails when |
 |---|---|
-| **SPEC** | `.current-task-spec.md` is missing, or has any unchecked `- [ ]` boxes |
-| **LOGGING** | Any `console.log()` in `.ts/.tsx/.js/.jsx` files, or `System.out.println()` in `.java` files |
-| **SECURITY** | Hardcoded IP addresses or `uat.*` / `prod.*` / `staging.*` URLs in source or config files |
-| **FLYWAY** | `@Entity`-annotated Java files exist but no `V*__.sql` Flyway migration files are found |
+| **SPEC** | `.current-task-spec.md` is missing or has unchecked `- [ ]` boxes |
+| **LINTING** | AST linters (ESLint, Checkstyle) fail in any discovered microservice. Fix natively, do not suppress! (Falls back to regex if no linters exist) |
+| **SECURITY** | Hardcoded IPs or `uat.*` / `prod.*` / `staging.*` URLs in source or config files |
+| **TENANT ISOLATION** | `*Repository.java` files contain query methods or `@Query` annotations that do NOT include `tenant` filtering |
+| **FLYWAY** | `@Entity`-annotated Java files exist but no `V*__.sql` Flyway migrations found |
 
 **Example — Run checks before PR:**
 
@@ -521,7 +518,7 @@ Timestamp: 2026-08-26T16:00:00.000Z
 ## PR Summary
 - Work Item: #2847
 - Spec: All acceptance criteria verified ✅
-- Guardrails: tenantId scoping, no debug logs, no hardcoded URLs, Flyway covered ✅
+- Guardrails: tenant isolation secured, no debug logs, no hardcoded URLs, Flyway covered ✅
 - Ready to raise PR 🚀
 
 🚫 Rejected Patterns Reminder (1 on record)
@@ -538,9 +535,9 @@ Timestamp: 2026-08-26T16:00:00.000Z
    • Flyway SQL migration created for every modified JPA @Entity
    • API contract (OpenAPI / TS types) updated if endpoints changed
 
-❌ [LOGGING] Found 2 prohibited log statement(s):
-   • console.log() found at src/components/MfaSetup.tsx:47
-   • System.out.println() found at src/main/java/MfaService.java:112
+❌ [LINTING] 2 linter error(s) across workspace — fix natively in their respective microservices:
+   • [ESLint] apps/admin-dashboard/src/components/MfaSetup.tsx:47 — Unexpected console statement (no-console)
+   • [Checkstyle/Maven] Build failed: [ERROR] AuditService.java:[112] Line contains System.out.println
 
 ## Passed
 ✅ [SECURITY] No hardcoded UAT/Prod IPs or environment URLs found.
@@ -585,32 +582,33 @@ Create `.agents/AGENTS.md` in your project root:
 ```markdown
 # SecuFusion MCP Workflow Rules
 
-You are an elite Senior Developer working on the SecuFusion platform.
-You have access to the `secufusion-mcp` MCP server. Follow these rules strictly.
+You are an elite Senior Developer and Architect working on the SecuFusion workspace (containing multiple microservice repositories). You prioritize robust cross-service architecture, zero-trust security (tenant isolation), and flawless state management. You rely on standard AST-aware build tools (ESLint/Checkstyle) for code hygiene. You strictly follow project standards and always use the custom MCP tools provided.
 
 ## Phase 1 — Planning (TRIGGER: user assigns a task or work item)
-- Do NOT write code immediately.
-- Call `manage_feature_spec` with `action=create`, passing the task description and `work_item_id`.
+- Do NOT write code immediately. First, call `manage_feature_spec`.
+- Determine which microservices are likely affected. Pass a `reference_file_path` from each to observe exact coding patterns.
+- Pass the user's requirements into `task_description` to generate the workspace-level `.current-task-spec.md` blueprint.
 - Wait for the spec to be generated before writing any code.
 
 ## Phase 2 — Execution (TRIGGER: as you complete work)
-- Keep `.current-task-spec.md` updated as your source of truth.
-- When you finish a logical chunk, call `manage_feature_spec` with `action=update`.
-- If resuming a session, always call `manage_feature_spec` with `action=read` first.
+- Keep the `.current-task-spec.md` file updated as your source of truth.
+- Whenever you finish a logical chunk, call `manage_feature_spec` with `update_content` to check off the `[ ]` boxes to `[x]`.
+- If you are resuming a session, always call `manage_feature_spec` with `action=read` first to know exactly where you left off.
 
 ## Phase 3 — Course Correction (TRIGGER: user corrects you or rejects an approach)
 - Immediately call `log_rejected_pattern`.
-- Pass the bad `pattern` and the `reason` the user provided.
-
-## Phase 4 — PR Handoff (TRIGGER: user says "prepare PR", "run checks", "ready to ship")
-- Call `run_pre_pr_checks` with the `work_item_id`.
-- Fix any errors and run again until all checks are green.
-
-## Guardrails (enforce always)
-- Always scope DB queries and event payloads with `tenantId`.
-- Never use `console.log` (JS/TS) or `System.out.println` (Java).
-- Never hardcode UAT/Prod IPs or environment URLs.
-- If you modify a JPA `@Entity`, create the corresponding Flyway `.sql` migration.
+- Pass the bad `pattern` you used and the `reason`/correction the user provided.
+- Always check `.rejected-patterns.json` implicitly before suggesting architectural choices to ensure you never repeat past mistakes.
+
+## Phase 4 — PR Handoff (TRIGGER: user says "prepare PR", "finish up", or "run checks")
+- Call `run_pre_pr_checks` with the Azure DevOps `work_item_id`. The tool will automatically discover all modified microservices in the workspace and run native linters, database script checks, and strict tenant-isolation scanners.
+- If the tool throws an error for a specific repository (e.g., missing Flyway SQL migration, missing `tenantId` in a query, or a linter failing), YOU MUST navigate to that specific microservice, FIX THE ERROR in the codebase natively, and run the tool again until the entire workspace passes. Do not suppress warnings.
+
+## Guardrails (enforce always, no exceptions)
+- TENANT SAFETY IS AUTOMATED: The PR Gatekeeper actively scans all `*Repository.java` files. If you write a database query (derived method or `@Query`) that does not explicitly filter by `tenantId` or contain the word `tenant`, the PR will be blocked. Write secure, tenant-isolated queries on your first attempt.
+- Do not ignore linter errors. AST-level tools (ESLint, Checkstyle/Maven) are the source of truth for hygiene. Fix them natively.
+- Never hardcode UAT/Prod IPs or URLs. Use environment variables or configuration properties.
+- If you modify a JPA `@Entity` in any backend repo, you MUST create the corresponding Flyway `.sql` migration script before running PR checks.
 ```
 
 ### How it all wires together

package/index.js

@@ -5,11 +5,11 @@
  * Provides developer-workflow tooling for the SecuFusion platform:
  *   - manage_feature_spec  : create / update task blueprints (.current-task-spec.md)
  *   - log_rejected_pattern : record bad patterns so they are never repeated (.rejected-patterns.json)
- *   - run_pre_pr_checks    : gate PRs with automated guardrail validation
+ *   - run_pre_pr_checks    : gate PRs via AST-level linters (ESLint / Maven Checkstyle) + structural checks
  *
  * Guardrails enforced:
- *   1. All DB queries and event payloads must carry tenantId.
- *   2. No console.log (TS/JS) or System.out.println (Java) in source files.
+ *   1. TENANT SAFETY AUTOMATED: Active scanning of *Repository.java for tenantId scoping.
+ *   2. Code hygiene (console.log, unused vars, formatting) enforced via ESLint / Checkstyle — not regex.
  *   3. No hardcoded UAT/Prod IPs or environment URLs.
  *   4. Every modified JPA @Entity must have a matching Flyway SQL migration.
  */
@@ -18,6 +18,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import fs from "fs";
 import path from "path";
+import { execSync } from "child_process";
 // ─────────────────────────────────────────────
 //  Constants / helpers
 // ─────────────────────────────────────────────
@@ -93,7 +94,7 @@ function appendSessionLog(existing, update) {
 // ─────────────────────────────────────────────
 //  run_pre_pr_checks helpers
 // ─────────────────────────────────────────────
-const CONSOLE_LOG_PATTERNS = [
+const CONSOLE_LOG_REGEX = [
     { regex: /console\.log\s*\(/g, label: "console.log()", ext: [".ts", ".tsx", ".js", ".jsx"] },
     { regex: /System\.out\.println\s*\(/g, label: "System.out.println()", ext: [".java"] },
 ];
@@ -127,9 +128,71 @@ function checkSpecFile() {
     }
     return { unchecked, missing: false };
 }
-function checkConsoleLogs(rootDir) {
+// ── AST-level linting via ESLint (preferred over regex for JS/TS) ─────────────
+function runEslint(rootDir) {
+    // Check if ESLint is configured in the project
+    const eslintConfigs = [".eslintrc", ".eslintrc.js", ".eslintrc.json", ".eslintrc.yml",
+        ".eslintrc.yaml", "eslint.config.js", "eslint.config.mjs"];
+    const hasEslintConfig = eslintConfigs.some((f) => fs.existsSync(path.join(rootDir, f)));
+    const hasPkgEslint = (() => {
+        const pkg = readFileSafe(path.join(rootDir, "package.json"));
+        if (!pkg)
+            return false;
+        try {
+            return !!(JSON.parse(pkg).eslintConfig);
+        }
+        catch {
+            return false;
+        }
+    })();
+    if (!hasEslintConfig && !hasPkgEslint)
+        return { violations: [], available: false };
+    try {
+        execSync("npx eslint . --format json --max-warnings=0 --no-error-on-unmatched-pattern", { cwd: rootDir, stdio: "pipe" });
+        return { violations: [], available: true };
+    }
+    catch (e) {
+        const raw = e.stdout?.toString() ?? "";
+        try {
+            const results = JSON.parse(raw);
+            const violations = [];
+            for (const file of results) {
+                for (const msg of file.messages) {
+                    if (msg.severity > 0) {
+                        violations.push(`[ESLint] ${path.relative(rootDir, file.filePath)}:${msg.line} — ${msg.message}${msg.ruleId ? ` (${msg.ruleId})` : ""}`);
+                    }
+                }
+            }
+            return { violations, available: true };
+        }
+        catch {
+            // ESLint output not JSON — return raw stderr summary
+            const stderr = e.stderr?.toString() ?? "";
+            return { violations: stderr ? [`[ESLint] ${stderr.slice(0, 400)}`] : [], available: true };
+        }
+    }
+}
+// ── Maven + Checkstyle for Java/Spring projects ───────────────────────────────
+function runCheckstyle(rootDir) {
+    const hasPom = fs.existsSync(path.join(rootDir, "pom.xml"));
+    if (!hasPom)
+        return { violations: [], available: false };
+    try {
+        execSync("mvn checkstyle:check -q --no-transfer-progress", { cwd: rootDir, stdio: "pipe" });
+        return { violations: [], available: true };
+    }
+    catch (e) {
+        const output = ((e.stdout?.toString() ?? "") + (e.stderr?.toString() ?? "")).slice(0, 1200);
+        return {
+            violations: [`[Checkstyle/Maven] Build failed:\n${output}`],
+            available: true,
+        };
+    }
+}
+// ── Regex fallback — used only when no linter is configured ──────────────────
+function checkConsoleLogsRegex(rootDir) {
     const violations = [];
-    for (const { regex, label, ext } of CONSOLE_LOG_PATTERNS) {
+    for (const { regex, label, ext } of CONSOLE_LOG_REGEX) {
         const files = walkDir(rootDir, ext);
         for (const file of files) {
             const content = readFileSafe(file);
@@ -161,6 +224,53 @@ function checkHardcodedUrls(rootDir) {
     }
     return violations;
 }
+// ── Workspace / Microservice Discovery ───────────────────────────────────────
+function findProjectRoots(dir, depth = 0) {
+    if (depth > 3)
+        return []; // Limit depth to avoid scanning massive trees
+    if (!fs.existsSync(dir))
+        return [];
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    const hasPackageJson = entries.some(e => e.name === "package.json");
+    const hasPomXml = entries.some(e => e.name === "pom.xml");
+    const roots = [];
+    if (hasPackageJson || hasPomXml) {
+        roots.push(dir);
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (["node_modules", ".git", "dist", "build", "target", ".idea"].includes(entry.name))
+                continue;
+            roots.push(...findProjectRoots(path.join(dir, entry.name), depth + 1));
+        }
+    }
+    return [...new Set(roots)];
+}
+// ── Automated Tenant Isolation Scanner ────────────────────────────────────────
+function checkTenantIsolation(rootDir) {
+    const violations = [];
+    const files = walkDir(rootDir, [".java"]).filter(f => f.endsWith("Repository.java"));
+    const queryMethodRegex = /\b(?:find|get|read|query|search|stream|count|exists|delete|remove)(?:All)?By[A-Z0-9]/;
+    const atQueryRegex = /@Query\s*\(/;
+    for (const file of files) {
+        const content = readFileSafe(file);
+        if (!content)
+            continue;
+        const lines = content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (queryMethodRegex.test(line) || atQueryRegex.test(line)) {
+                // Look at current line and the next to handle simple wrapping
+                const combinedContext = line + (lines[i + 1] || "");
+                if (!/tenant/i.test(combinedContext)) {
+                    violations.push(`Missing tenant isolation in ${path.relative(rootDir, file)}:${i + 1} — query lacks 'tenantId':\n` +
+                        `      ${line.trim()}`);
+                }
+            }
+        }
+    }
+    return violations;
+}
 function checkFlywayMigrations(rootDir) {
     const warnings = [];
     const javaFiles = walkDir(rootDir, [".java"]);
@@ -195,10 +305,9 @@ const server = new McpServer({
     version: "1.0.0",
 });
 // ─── Tool 1: manage_feature_spec ─────────────────────────────────────────────
-server.tool("manage_feature_spec", "Create or update the .current-task-spec.md task blueprint. " +
-    "Pass `task_description` to create a new spec, or `update_content` to patch the existing one " +
-    "(e.g., checking off completed acceptance criteria). Optionally provide `reference_file_path` " +
-    "so the spec generator can observe existing coding patterns.", {
+server.tool("manage_feature_spec", "Create or update the .current-task-spec.md blueprint for the current feature. " +
+    "Use this during the Planning and Execution phases. " +
+    "Works for both single-repo and cross-repo workspace tasks.", {
     task_description: z
         .string()
         .optional()
@@ -379,10 +488,11 @@ server.tool("log_rejected_pattern", "Record a coding pattern that was rejected b
     };
 });
 // ─── Tool 3: run_pre_pr_checks ───────────────────────────────────────────────
-server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks against the current working directory. " +
-    "Validates: spec checkboxes, console.log/System.out.println usage, hardcoded IPs/URLs, " +
-    "and Flyway migration coverage for JPA entities. " +
-    "MUST pass (exit with no errors) before a PR is raised.", {
+server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks across the workspace. " +
+    "Automatically discovers modified microservices and runs native linters, database script checks, and strict tenant-isolation scanners. " +
+    "Validates: spec checkboxes, hardcoded IPs/URLs, tenantId in Repositories, and Flyway migration coverage for JPA entities. " +
+    "Linter/isolation errors must be fixed natively — do not suppress warnings to pass the gate. " +
+    "MUST pass with zero errors before a PR is raised.", {
     work_item_id: z
         .string()
         .describe("Azure DevOps work item ID to include in the PR summary."),
@@ -394,6 +504,7 @@ server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks aga
         .array(z.enum([
         "spec_boxes",
         "console_logs",
+        "tenant_isolation",
         "hardcoded_urls",
         "flyway_migrations",
     ]))
@@ -422,21 +533,70 @@ server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks aga
     else {
         warnings.push("⚠️  [SPEC] Spec checkbox check SKIPPED (manually bypassed).");
     }
-    // ── 2. Console log check ───────────────────────────────────────────────
+    // ── 2. AST-level linting (Workspace Discovery → ESLint/Checkstyle → regex fallback)
     if (!skip_checks.includes("console_logs")) {
-        const logViolations = checkConsoleLogs(scanRoot);
-        if (logViolations.length > 0) {
-            errors.push(`❌ [LOGGING] Found ${logViolations.length} prohibited log statement(s):\n` +
-                logViolations.map((v) => `   • ${v}`).join("\n"));
+        let projectRoots = findProjectRoots(scanRoot);
+        if (projectRoots.length === 0)
+            projectRoots.push(scanRoot);
+        let anyLinterAvailable = false;
+        const allLintViolations = [];
+        const usedLinters = new Set();
+        for (const pRoot of projectRoots) {
+            const eslint = runEslint(pRoot);
+            const checkstyle = runCheckstyle(pRoot);
+            if (eslint.available) {
+                anyLinterAvailable = true;
+                usedLinters.add("ESLint");
+                allLintViolations.push(...eslint.violations);
+            }
+            if (checkstyle.available) {
+                anyLinterAvailable = true;
+                usedLinters.add("Checkstyle");
+                allLintViolations.push(...checkstyle.violations);
+            }
+        }
+        if (anyLinterAvailable) {
+            // AST linters found and ran — they are the source of truth
+            if (allLintViolations.length > 0) {
+                errors.push(`❌ [LINTING] ${allLintViolations.length} linter error(s) across workspace — fix natively in their respective microservices:\n` +
+                    allLintViolations.map((v) => `   • ${v}`).join("\n"));
+            }
+            else {
+                passed.push(`✅ [LINTING] AST-level linting passed across workspace (${Array.from(usedLinters).join(" + ")}).`);
+            }
+        }
+        else {
+            // No linters configured — fall back to regex scan with a warning
+            const regexViolations = checkConsoleLogsRegex(scanRoot);
+            if (regexViolations.length > 0) {
+                errors.push(`❌ [LOGGING] ${regexViolations.length} prohibited log statement(s) found via regex fallback\n` +
+                    `   (No ESLint/Checkstyle config detected in any workspace project — configure a linter for AST-level accuracy):\n` +
+                    regexViolations.map((v) => `   • ${v}`).join("\n"));
+            }
+            else {
+                warnings.push("⚠️  [LOGGING] No ESLint/Checkstyle config found in workspace — used regex fallback. " +
+                    "Consider adding a linter for AST-level hygiene.");
+            }
+        }
+    }
+    else {
+        warnings.push("⚠️  [LINTING] Linter check SKIPPED (manually bypassed).");
+    }
+    // ── 3. Tenant Isolation Scanner ──────────────────────────────────────────
+    if (!skip_checks.includes("tenant_isolation")) {
+        const tenantViolations = checkTenantIsolation(scanRoot);
+        if (tenantViolations.length > 0) {
+            errors.push(`❌ [SECURITY] Tenant Isolation Failed: Found ${tenantViolations.length} query method(s) in *Repository.java without tenant scoping:\n` +
+                tenantViolations.map((v) => `   • ${v}`).join("\n"));
         }
         else {
-            passed.push("✅ [LOGGING] No console.log / System.out.println found.");
+            passed.push("✅ [SECURITY] Tenant isolation active: All database queries correctly scoped with tenantId.");
         }
     }
     else {
-        warnings.push("⚠️  [LOGGING] Console log check SKIPPED (manually bypassed).");
+        warnings.push("⚠️  [SECURITY] Tenant isolation check SKIPPED (manually bypassed).");
     }
-    // ── 3. Hardcoded URL check ─────────────────────────────────────────────
+    // ── 4. Hardcoded URL check (regex) ───────────────────────────────────────
     if (!skip_checks.includes("hardcoded_urls")) {
         const urlViolations = checkHardcodedUrls(scanRoot);
         if (urlViolations.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",