secufusion-mcp 1.2.6 → 1.2.7

package/.claude-plugin/plugin.json

@@ -0,0 +1,11 @@
+{
+  "name": "sfn",
+  "description": "SecuFusion MCP — a spec-driven, zero-trust SDLC agent for enterprise codebases. Enforces the ReAct reasoning loop, architectural DNA mapping, and zero-tolerance PR gate checks via the 4-command pipeline: /sfn:init, /sfn:plan, /sfn:code, /sfn:review.",
+  "version": "1.2.6",
+  "author": {
+    "name": "SecuFusion"
+  },
+  "homepage": "https://www.npmjs.com/package/secufusion-mcp",
+  "repository": "https://github.com/sutaryash/secufusion-mcp",
+  "license": "ISC"
+}

package/commands/code.md

@@ -0,0 +1,49 @@
+---
+description: Execute the approved implementation plan. Switches to the Coder Persona and writes code precisely as planned, using rejected-pattern memory to avoid past mistakes.
+argument-hint: <ticket-id>  e.g. WI-123
+---
+
+You are executing the **sfn:code** command for the SecuFusion spec-driven SDLC.
+
+Task: **$ARGUMENTS**
+
+**You are now in the IMPLEMENTATION phase.**
+
+## Pre-flight: Plan Check
+
+1. Read `.secufusion/tasks/$ARGUMENTS/plan.md`.
+2. If the plan file does not exist or has no approval record, **ABORT** and tell the user:
+   > ❌ No approved plan found for `$ARGUMENTS`. Please run `/sfn:plan $ARGUMENTS` first.
+3. Read `.agents/coder.md` to load the **Coder Persona** — your behaviour for this phase is governed by those instructions.
+
+## Phase 1 — Load Rejected Patterns Memory
+
+Call `get_pattern_from_task(work_item_id: "$ARGUMENTS")` to retrieve any rejected patterns logged for this task. If patterns exist, internalize them as hard constraints — **do not repeat them under any circumstances.**
+
+## Phase 2 — Implement
+
+Execute the plan file step by step:
+
+- Follow the file list in the plan exactly. Do not create files outside the plan's scope.
+- On every file that touches multi-tenant data: verify tenant isolation is enforced (row-level WHERE clause, header propagation). If it is not, **stop and flag it** before writing.
+- On every new DB query: check for N+1 patterns and missing indexes. Flag before writing.
+- On every Kafka publish: verify it is async / non-blocking. Flag synchronous calls.
+
+After each logical step, call `manage_task(action: "update", work_item_id: "$ARGUMENTS", status: "in_progress", notes: "<what was just completed>")` to track progress.
+
+## Phase 3 — Self-Review
+
+Before handing off, perform a fast self-review against the Acceptance Criteria in `plan.md`. For each criterion, confirm it is met with a `file:line` citation.
+
+If any criterion is unmet, fix it now before reporting.
+
+## Phase 4 — Handoff
+
+Call `manage_task(action: "complete", work_item_id: "$ARGUMENTS")` to mark the task as coded.
+
+Report to the user:
+- Files created/modified
+- ACs met (with file:line)
+- Any open risks or deferred items
+
+> 🚀 Implementation complete. Run `/sfn:review` to run the zero-tolerance PR gate checks.

package/commands/init.md

@@ -0,0 +1,48 @@
+---
+description: Prime the SecuFusion ecosystem — scan the entire codebase, map the architectural DNA, and write it to .secufusion/dna.json. Run this once when you first clone a repo.
+argument-hint: (no args) — run from the root of the repo
+---
+
+You are executing the **sfn:init** bootstrap command for the SecuFusion ecosystem.
+
+**This is a learn-first command.** Your job is to deeply understand THIS project before writing anything. Do not produce generic output — every finding must reflect real `file:line` references from the actual codebase.
+
+## Phase 1 — SCAN the Repository
+
+Call the **secufusion-dna-plugin** MCP tools to scan the repository:
+
+1. Call `scan_repository_stack` to identify: language, framework, package manager, microservices, database entities, and build/test commands. Flag if this is a monorepo.
+2. Call `extract_domain_models` to map all domain entities, their fields, and relationships.
+3. Call `extract_api_endpoints` to map all REST/GraphQL endpoints, their methods, and owning services.
+4. Call `extract_event_topics` to map all Kafka/event-bus topics, producers, and consumers.
+
+Run all 4 tool calls in a **single message** so they execute concurrently.
+
+## Phase 2 — WRITE the DNA
+
+Once all scans complete:
+
+1. Write the combined findings to `.secufusion/dna.json` in the project root. Structure it as:
+   ```json
+   {
+     "scannedAt": "<ISO timestamp>",
+     "services": [],
+     "domainModels": [],
+     "apiEndpoints": [],
+     "eventTopics": [],
+     "architectureSummary": "<2-3 sentence human-readable summary>"
+   }
+   ```
+2. Update the `<MEMORY>` block in `.agents/claude.md`:
+   - Set `DNA_LOADED` to `true`
+   - Set `LAST_INIT` to the current ISO timestamp
+   - Set `ARCHITECTURE_SUMMARY` to the 2-3 sentence summary from above
+
+## Phase 3 — REPORT
+
+Summarize what was found:
+- Number of services, domain models, API endpoints, and event topics discovered
+- Any gaps or areas marked `(inferred)` that the human should verify
+- Confirm that `.secufusion/dna.json` was written successfully
+
+**Next step for the user:** Run `/sfn:plan <ticket-id>` to start your first task.

package/commands/plan.md

@@ -0,0 +1,56 @@
+---
+description: Architect a solution for a task or Jira ticket using the loaded DNA. Creates a dedicated task workspace, classifies the work, and produces a strict implementation plan awaiting your approval.
+argument-hint: <ticket-id or feature description>  e.g. WI-123 or "add user login endpoint"
+---
+
+You are executing the **sfn:plan** command for the SecuFusion spec-driven SDLC.
+
+Task / Ticket: **$ARGUMENTS**
+
+**You are in the PLANNING phase. Do NOT write any implementation code in this phase.**
+
+## Pre-flight: DNA Check
+
+1. Read `.agents/claude.md` and check the `<MEMORY>` block.
+2. If `DNA_LOADED` is `false` or `null`, **ABORT immediately** and tell the user:
+   > ❌ Project DNA is not loaded. Please run `/sfn:init` first.
+
+## Phase 1 — Initialize the Task Workspace
+
+Call `manage_task` with:
+```
+action: "initialize"
+work_item_id: <the ticket ID or a slugified version of the description>
+```
+This creates the dedicated workspace folder at `.secufusion/tasks/<id>/` and begins tracking progress. Do not proceed until this call succeeds.
+
+## Phase 2 — Load Context
+
+1. Call `prime_session(work_item_id: <id>)` to efficiently load the project DNA state and relevant architectural context for this specific task.
+2. Read the `.secufusion-project-spec.json` from the project root to understand the golden rules, constraints, and acceptance criteria boundaries for this project.
+
+## Phase 3 — Classify the Task
+
+Call `classify_task` with the task description: **$ARGUMENTS**
+
+This formally categorizes the work (Feature, Bug, Refactor, Security, Performance, etc.) and locks in the architectural boundaries. **YIELD after this call.** Output the classification result and ask the user:
+
+> ✅ Classification complete. Does this look right? Give me the green signal to proceed with planning.
+
+Wait for explicit approval before continuing.
+
+## Phase 4 — Write the Implementation Plan (After Approval)
+
+Read `.agents/planner.md` for the Planner Persona instructions and produce a strict, step-by-step implementation plan that includes:
+
+- **Acceptance Criteria** (Given/When/Then format, testable)
+- **Scope Boundaries** (what is explicitly OUT of scope)
+- **Files to Create / Modify / Delete**
+- **Architectural Decisions** (with rationale grounded in the DNA)
+- **Risk Flags** (tenant isolation, N+1 risks, missing indexes, Kafka sync calls)
+- **Test Plan**
+
+Save the plan to `.secufusion/tasks/<id>/plan.md`.
+
+Present the plan and ask:
+> 📋 Plan ready. Review `plan.md` and approve to begin coding with `/sfn:code`.

package/commands/review.md

@@ -0,0 +1,48 @@
+---
+description: Run the zero-tolerance PR gate — 5 mechanical checks (Tenant Isolation, N+1, Missing Index, Kafka Sync, Early Returns) followed by a senior Reviewer Persona sign-off. A PR must pass this before it can be opened.
+argument-hint: <ticket-id>  e.g. WI-123
+---
+
+You are executing the **sfn:review** command — the final quality gate before a Pull Request is opened.
+
+Task: **$ARGUMENTS**
+
+**No PR may be opened until this command returns ✅ APPROVED.**
+
+## Phase 1 — Tier 1: Mechanical Checks (Zero Tolerance)
+
+Call `run_pre_pr_checks_with_reviewer_agent` to trigger the `sfn-pr-check` CLI. This runs 5 automated mechanical checks:
+
+| Check | Rule |
+|---|---|
+| **Tenant Isolation** | Every multi-tenant query must have a tenant WHERE clause |
+| **N+1 Detection** | No DB calls inside loops |
+| **Missing Index** | No raw `LIKE '%...'` or unindexed sort columns |
+| **Kafka Sync** | No synchronous/blocking Kafka publishes |
+| **Early Returns** | No deeply nested if/else — use guard clauses |
+
+**If any check FAILS:** Do NOT proceed to Phase 2. Report the exact violation with `file:line` and tell the user:
+> ❌ Tier 1 gate failed. Fix the violations above and re-run `/sfn:review`.
+
+Call `log_rejected_pattern(work_item_id: "$ARGUMENTS", pattern: "<description of the violation>")` to record it in permanent memory so it is never repeated.
+
+## Phase 2 — Tier 2: Reviewer Persona Sign-off
+
+Only proceed here if **all 5 Tier 1 checks passed.**
+
+Read `.agents/reviewer.md` to load the **Reviewer Persona** and perform a deep architectural review covering:
+
+- **Security:** Auth/authz enforcement, input validation, secret handling
+- **Architecture:** Does the change respect bounded context boundaries from the DNA?
+- **Observability:** Adequate logging, tracing, error handling
+- **Contracts:** Are API/event contracts backward-compatible?
+- **Test Coverage:** Are the ACs from the plan actually tested?
+
+## Phase 3 — Verdict
+
+If all checks pass:
+> ✅ APPROVED — This change is ready for a Pull Request. Open your PR and reference ticket `$ARGUMENTS`.
+
+If any Tier 2 issues are found, list them as **BLOCKER** or **SUGGESTION** and require the user to address blockers before approving.
+
+Call `record_retrospective(work_item_id: "$ARGUMENTS", outcome: "<verdict summary>")` to log the review result for future learning.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",
@@ -9,7 +9,9 @@
     "index.d.ts",
     "README.md",
     ".secufusion-project-spec.json",
-    "AGENTS.md"
+    "AGENTS.md",
+    "commands/",
+    ".claude-plugin/"
   ],
   "bin": {
     "secufusion-mcp": "index.js"