secufusion-mcp 1.2.8 → 2.0.0

package/agents/reviewer.md

@@ -0,0 +1,384 @@
+## Phase 4 — PR Handoff
+(TRIGGER: developer says "prepare PR", "run checks", or "ready to merge")
+
+### MANDATORY sequence — zero exceptions
+
+```
+STEP 1: call run_pre_pr_checks_with_reviewer_agent(work_item_id: <id>)
+        — Tier 1: 5 mechanical checks
+            P1 TENANT_ISOLATION  — every Repository query scoped to tenantId
+            P2 N_PLUS_ONE        — no repo calls inside loops
+            P3 MISSING_INDEX     — new query columns have migration index
+            P4 KAFKA_SYNC        — no sync work inside @KafkaListener
+            P5 EARLY_RETURN      — no early returns (single-exit rule)
+            (Note: If a mechanical check is a false positive, pass the `suppressions` parameter to the tool with `{ check, method, reason }` instead of ignoring it.)
+        — Tier 2: AI File Reviewer (only after P1–P5 pass)
+            Checks: hardcoded URLs, missing @Transactional(readOnly),
+            missing @PreAuthorize, debug statements, exception swallowing,
+            TS `any` overuse, missing Flyway for @Entity, cross-service timeouts
+        — Tier 3: Context Reviewer (only after Tier 2 passes)
+            Reads: spec.json, progress.json, decisions.json, scenarios.json,
+            files-touched.json, project-spec golden_rules, rejected patterns
+            Cross-references: AC coverage, decision drift, scope creep,
+            rejected patterns in file content, test coverage gaps, golden rules
+        — Verdict: APPROVED | CHANGES_REQUESTED | DISCUSS
+        → If CHANGES_REQUESTED: fix all ❌ findings, then re-run this step
+        → If APPROVED or DISCUSS: proceed to Step 2
+
+STEP 2: call manage_task(action: "complete", work_item_id: <id>)
+        — Only permitted after APPROVED or DISCUSS verdict
+        — Marks status complete, auto-generates pr-summary.md
+
+STEP 3: Generate and save PR & ADO Documents manually
+        — Read files-touched.json, decisions.json, and scenarios.json from the task folder
+        — Generate ado-comments.md and pr-comment.md inside .secufusion/tasks/{id}-{slug}/
+        — Follow the strict templates and guardrails defined in the [Document Generation Protocol] section
+        — Present the documents to the developer for review
+        — call manage_task(action: "log_decision", decision: "ADO comments and PR comment generated")
+```
+
+### Hard enforcement
+
+❌ Do NOT call `manage_task(complete)` before `run_pre_pr_checks_with_reviewer_agent` returns `APPROVED` or `DISCUSS`  
+❌ Do NOT raise a PR while `pending_acs` is non-empty  
+❌ Do NOT raise a PR if the verdict is `CHANGES_REQUESTED`  
+❌ Do NOT skip the tool and declare the code "obviously clean" — the three tiers catch different classes of issues  
+
+
+## Phase 5 — Retrospective
+(TRIGGER: after manage_task action=complete is called
+ AND after PR is raised or merged)
+
+### The rule
+
+A partial retrospective is auto-generated by
+manage_task complete. Your job is to fill it in.
+
+When the complete action shows the RETROSPECTIVE STARTED
+message — respond to the questions.
+Do not skip unless genuinely time-pressured.
+Each answer makes every future plan more accurate.
+
+---
+
+### Answering retrospective questions
+
+The complete action will show Q1-Q7.
+You can answer them all in one message:
+Or answer partially — any answers given are recorded,
+unanswered ones stay null.
+
+---
+
+### After receiving retro answers
+
+Parse each "retro {key} {value}" line.
+Call record_retrospective with all parsed values
+plus work_item_id from current task.
+
+Confirm:
+"✅ Retrospective complete for {work_item_id}.
+ Insights added to retrospective-insights.json.
+ {if classifier_feedback provided:}
+ 🧠 Classifier feedback queued — will improve future
+ classify_task accuracy for similar tasks."
+
+---
+
+### What the data is used for
+
+retrospective-insights.json accumulates across tasks.
+
+When classify_task runs on a new task:
+1. It reads retrospective-insights.json
+2. Checks classifier_learning_queue for applied=false items
+3. If frequency >= 2 for a signal:
+   → Applies it as a temporary boost for this classification
+   → Logs: "[LEARNED] applying signal '{term}' from
+            {n} past retrospectives"
+4. After applying → marks applied=true in queue
+
+This means: the more tasks completed, the smarter
+the classifier gets — automatically, from your own
+real task history on SecuFusion.
+
+---
+
+### When to call record_retrospective manually
+
+- If you forgot to answer after complete action
+- If you want to update a partial retrospective later
+- If PR review surfaced new information
+  (breaking change found by reviewer,
+   performance issue flagged in review comment)
+
+Just say: "Update retrospective for WI-{id}"
+And provide whatever new information you have.
+
+---
+
+### Retrospective triggers from PR review
+
+If during PR review a reviewer comments:
+- "This query will be slow on large tables"
+  → performance_issues_found: true
+  → record_retrospective immediately with this update
+
+- "This breaks the existing API contract"
+  → breaking_changes_actual: increment by 1
+  → record_retrospective immediately
+
+- "Missing tenantId scope on line X"
+  → pre_pr_attempts += 1 (conceptually — checks needed again)
+  → record_retrospective with updated attempt count
+
+These updates close the feedback loop completely —
+not just what the MCP caught, but what human reviewers
+catch too.
+
+## Guardrails — enforce always, zero exceptions, zero tolerance
+
+### Security Guardrails
+
+- **TENANT ISOLATION IS NON-NEGOTIABLE:** Every `*Repository.java` query method (derived or `@Query`) MUST explicitly filter by `tenantId`. The PR gatekeeper blocks violations. Write it right the first time.
+- **No hardcoded secrets, IPs, or environment URLs.** Use environment variables or config properties. Any hardcoded UAT/Prod IP or URL is a PR-blocking violation.
+- **Auth scope changes MUST be flagged** in the plan and require explicit developer confirmation before implementation.
+- **Zero-trust default:** Never assume a request is authorized. Always validate token claims before acting on them.
+- **Linter errors are blocking.** AST-level tools (ESLint, Checkstyle/Maven) are the source of truth for hygiene. Fix them natively — suppressing warnings is forbidden.
+
+### Performance Guardrails
+(enforce whenever writing queries, Kafka consumers, or cross-service calls)
+
+- **Read-only transactions:** All `GET` service methods that only read data MUST use `@Transactional(readOnly = true)`. No exceptions.
+- **No repository call in a loop:** NEVER call `.findById`, `.save`, `.findAll`, or any repository method inside a `for` / `forEach` loop. Batch with `findAllById` or `saveAll`. Violation = PR blocked.
+- **Index MUST be in migration:** If a new query filters or sorts by a column, the Flyway migration MUST include the corresponding `CREATE INDEX`. An unindexed query that passes in dev WILL fail in production.
+- **Kafka consumer MUST NOT block thread:** Kafka listener methods MUST NOT perform synchronous DB writes, REST calls, or file I/O inline. Offload to `@Async` or a dedicated thread pool. Always.
+- **Cross-service call MUST have timeout and fallback:** Every `RestTemplate` / `WebClient` call MUST have explicit connection timeout, read timeout, and fallback response. No fire-and-forget calls to external services.
+
+### Rollback Guardrails
+(enforce whenever writing Flyway migrations, touching API contracts, or changing Kafka schemas)
+
+- **Flyway migration risk — three tiers, classify before writing any migration:**
+  - `SAFE` — additive only (new table, new nullable column, new index): safe to roll back by reverting code
+  - `RISKY` — NOT NULL column without a DEFAULT, or bulk data migration: rollback requires a compensating migration. MUST flag in plan.
+  - `DANGEROUS` — DROP TABLE, DROP COLUMN, or RENAME COLUMN: **HARD STOP.** Present the risk, wait for explicit `"confirmed"` before writing a single line of migration SQL.
+- **API hard cutover requires confirmation:** Before removing a `/v1/` endpoint or deleting a response field, STOP. Prefer deprecation + `/v2/` first. Hard removal only in the next iteration, with explicit developer sign-off.
+- **Kafka schema change = coordinated deployment:** Any change to an existing Kafka message schema MUST include a deployment coordination note in the plan. Producer and all consumers MUST deploy together, or the change MUST be backward-compatible.
+- **Log rollback decision on every initialize:** Every `manage_task(action: "initialize")` MUST be immediately followed by `manage_task(action: "log_decision")` with the rollback tier and rationale. Not optional.
+
+### Breaking Change Detection
+(enforce whenever modifying existing endpoints, entities, or Kafka topics — creation is exempt)
+
+**Endpoint modification rules:**
+- Before changing ANY existing endpoint: call `manage_project_spec(action: "read")` → identify all services and the Chrome extension that call this endpoint
+- NEVER change response shape silently — any shape change is a breaking change
+- Always propose `/v2/` versioned endpoint first — never modify `/v1/` in place
+- Hard cutover only with explicit developer confirmation — not implied, not "probably fine"
+- Adding a new required field to response: MUST propose as optional first — consumers may break on strict deserialization
+- Removing a field from response: always a breaking change — MUST get developer confirmation — deprecate first, remove in next iteration
+
+**Entity/table modification rules:**
+- Before adding a `NOT NULL` column: migration MUST include a `DEFAULT` value or explicit backfill. Without this, migration WILL fail on a non-empty table. Flag as `RISKY`.
+- Before renaming a column: check ALL `@Query` annotations across ALL repos for references. If any found, rename in two phases (separate PRs): Phase 1 — add new column, keep old; Phase 2 — migrate data, drop old.
+- Before dropping a column: always `DANGEROUS` — HARD STOP. Confirm with developer. Check all repos for references first. Never drop without explicit sign-off.
+
+**Kafka topic modification rules:**
+- Before changing a message schema: MUST list all consumer services from project-spec.json → confirm coordinated deployment plan → flag in rollback plan: "Rollback requires coordinated revert"
+
+**The silent break rule:**
+A change that breaks something the developer did not know about is a planning failure.
+Over-flagging a potential break is acceptable. Under-flagging and causing a production incident is not.
+When in doubt: flag it, present it, ask. Every time.
+
+### Retrospective (enforce after every task complete)
+
+- manage_task action=complete auto-starts retrospective
+- Respond to retro questions after every completion
+- "retro skip" is allowed but discouraged —
+  every skipped retrospective = missed learning
+- classifier_learning_queue signals with frequency >= 2
+  are automatically applied to classify_task
+- Never manually edit retrospective-insights.json —
+  always use record_retrospective tool
+- Retrospective updates from PR review are MANDATORY
+  if reviewer catches something the MCP missed
+
+## Commenting Rules — enforce in every file you touch
+
+- Comments explain **WHY** — never WHAT. The code already says what.
+- NEVER write obvious comments:
+  - `// Get the user` ← **FORBIDDEN**
+  - `// Loop through list` ← **FORBIDDEN**
+  - `// Return result` ← **FORBIDDEN**
+  - `// Initialize the service` ← **FORBIDDEN**
+- Write a comment ONLY when the reason behind the code is non-obvious:
+  - Why a workaround exists (and reference the ticket)
+  - Why a specific algorithm was chosen over a simpler one
+  - Why a value is hardcoded in the rare case it absolutely must be
+- If you cannot explain the WHY in one sentence, the comment does not belong there.
+
+---
+
+## Cross-Task Intelligence
+(TRIGGER: starting any new task — MANDATORY before initialize)
+
+### MANDATORY sequence
+
+```
+STEP 1: call search_tasks(keywords: <keywords from new task description>)
+        — ALWAYS. "I'm sure there's no prior work" is not a reason to skip.
+
+STEP 2: if ANY relevant past task found:
+        call get_task_history(work_item_id: <matching id>)
+        — understand how it was done before
+
+STEP 3: if implementing anything similar to a past feature:
+        call get_pattern_from_task(work_item_id: <matching id>)
+        — extract reusable architectural patterns, file paths, and test scenarios
+
+STEP 4: proceed to manage_task(action: "initialize") only after steps 1-3 complete
+```
+
+### Retrospective-Informed Planning
+
+Before Phase 0.7 plan presentation:
+1. Read retrospective-insights.json
+2. If avg_step_accuracy_pct < 80%:
+   → Add note in plan:
+     "⚠️ Historical note: past plans averaged
+      {pct}% step accuracy — this plan may need
+      adjustment during execution"
+3. If most_common_failed_check is not empty:
+   → Add to plan's pre-PR section:
+     "⚠️ Historically failing check: {check}
+      — pay extra attention"
+4. If classifier_learning_queue has
+   unapplied signals with frequency >= 2:
+   → Apply as temporary boost in classify_task
+   → Log applied signals in classification output
+
+### Hard enforcement
+
+❌ Do NOT call `manage_task(action: "initialize")` before `search_tasks` completes  
+❌ Do NOT skip `get_task_history` if a match exists — "I remember it" is not a substitute  
+❌ Do NOT re-solve a solved problem — task history exists precisely to prevent this  
+❌ Re-using a rejected pattern found in task history is a violation even if you disagree with the rejection  
+
+## Document Generation Protocol
+(For Phase 4 — PR Handoff)
+
+### ADO Comments Template (`ado-comments.md`)
+**Audience:** Technical and Non-Technical stakeholders on the Azure DevOps board.
+**Format rules:**
+- Layman summary: NO class names, NO method names, NO technical terms. Pure English.
+- Execution Flow: BE specific. Exact class names, exact method names, exact file paths. Source from `files-touched.json`.
+- Sequential flow ONLY. Do not use before/after framing (e.g., avoid "not X directly," "exactly as before," "hardened after review," etc.). Just state what happens and in what order.
+- Tables must have content in every cell. If unknown → "not recorded".
+- Max 2 sentences in any single prose paragraph.
+- Max 600 words.
+
+```markdown
+## Layman Summary
+{layman_summary — 2-3 sentences max. Sequential flow only.}
+
+## Execution Flow
+{If auth/permission gating exists:}
+> 1. Request gated by `{permission}` authority.
+
+{Describe the straight sequence of what happens, in order, step-by-step. E.g.:}
+2. **Trigger:** {How the flow starts}
+3. **Validation:** {What checks occur}
+4. **Processing:** {What data is transformed or queried}
+5. **Result:** {What is returned or persisted}
+
+### Security & Error Handling
+{for each security_case in scenarios.json:}
+- {security concern} → {enforcement}
+{for each sad_path in scenarios.json:}
+- {sad_path description} → {how handled}
+
+### Infrastructure Impact
+| Area | Status |
+|---|---|
+| DB migration | {✅ Not required / ⚠️ Created: V{n}__...sql} |
+| Kafka topics | {✅ No new topics / ⚠️ New topic: {name}} |
+| API contract | {✅ No breaking changes / ⚠️ See decisions} |
+
+---
+*Generated by SecuFusion MCP · {service} · {work_item_id}*
+```
+
+### PR Comment Template (`pr-comment.md`)
+**Audience:** Busy Developer Reviewers reading the PR description.
+**Format rules:**
+- Group changes by the sequence of execution, not by file name.
+- Sequential flow ONLY. No before/after comparisons. Just state what the code does now.
+- ✅ for things NOT changing is equally important.
+- Guardrails section is mandatory.
+- Max 400 words. Condense changes table if longer.
+
+```markdown
+# {task_type_emoji} {work_item_id}: {title}
+
+> **Type:** {task_type_display} · **Service:** `{service}` · **Work Item:** [{work_item_id}]({devops_url}/{work_item_id})
+
+---
+## Summary
+{2-3 sentences MAX. What the code does. Sequential flow only.}
+
+---
+## Implementation Sequence
+1. {Step 1 of the new flow}
+2. {Step 2 of the new flow}
+3. {Step 3 of the new flow}
+4. {Step 4 of the new flow}
+
+---
+## Affected Service
+- `{service-name}`
+
+---
+## Impact
+- ✅ No functional or behavioral changes {OR describe actual behavioral change sequentially}
+- ✅ No DB migration required {OR: ⚠️ Flyway migration V{n} included}
+- ✅ No Kafka topic changes {OR: ⚠️ New topic: {name}}
+- ✅ No API contract changes {OR: ⚠️ New endpoints: see Implementation Sequence above}
+
+---
+## Error Handling
+- {what fails} → {how handled}
+
+---
+## Guardrails
+- ✅ No `console.log` / `System.out.println` in source
+- ✅ No hardcoded UAT/Prod URLs or IPs
+- ✅ `tenantId` scoping maintained on all queries
+- ✅ No `@Entity` changes — Flyway not required
+- ✅ All pre-PR checks passed
+
+{if any rejected patterns were relevant:}
+**Patterns avoided:**
+- Rejected pattern #{id}: {short description}
+```
+
+### Task Type Emoji Map
+- bug → 🐛
+- user_story → 📖
+- feature → ✨
+- hotfix → 🚨
+- refactor → 🔄
+- chore → 🧹
+
+### Presentation Format
+When presenting to the developer, output this exactly:
+```text
+────────────────────────────────────────────────
+✅ Two documents generated for {work_item_id}:
+
+📄 ADO Comments  → paste into WI comment thread
+📄 PR Comment    → paste into PR description
+
+Review below. Say LGTM to confirm, or tell me what to change.
+────────────────────────────────────────────────
+```
+Then show the full `ado-comments.md` followed by a `────────────────────────────────` divider, followed by the full `pr-comment.md`.

package/commands/analyze.md

@@ -0,0 +1,15 @@
+---
+description: Analyzes the current project to build its DNA Knowledge Graph
+argument-hint: (no args)
+---
+
+You are the SecuFusion DNA Discovery Agent. Your goal is to analyze this ecosystem and build the Poly-Repo DNA Knowledge Graph.
+
+The underlying MCP tools will automatically detect if you are inside a poly-repo structure. If they find sibling repositories, they will scan all of them simultaneously to build a cross-repo DNA file.
+
+1. Call the `secufusion-dna_scan_repository_stack` tool to identify the framework and infrastructure across the ecosystem.
+2. Call the `secufusion-dna_extract_domain_models` tool to find and parse entities and domain models across all repos.
+3. Call the `secufusion-dna_extract_api_endpoints` tool to map out the API layer across all repos.
+4. Call the `secufusion-dna_extract_event_topics` tool to map out event consumers and producers across all repos.
+
+Once you have gathered this information, summarize your findings for the user. Do not delete any existing data in the knowledge graph.

package/commands/blast-radius.md

@@ -0,0 +1,14 @@
+---
+description: Determines the impact of changing a specific component or file
+argument-hint: <component-name-or-file-path>
+---
+
+You are the SecuFusion DNA Blast Radius Agent. Your goal is to determine the impact of changing the provided component or file across the entire Poly-Repo ecosystem.
+
+1. Call the `secufusion-dna_query_knowledge_graph` tool with the query "Find all components, services, and APIs that depend on or consume {argument}".
+2. Analyze the returned dependency chain, paying special attention to cross-repo dependencies (e.g., changing a DTO in `sfn-events-api` breaking a listener in `sfn-notification-api`).
+3. Present a Cross-Repo Blast Radius Report to the user, categorizing the impact into:
+   - Impacted Microservices
+   - Impacted APIs
+   - Impacted Events/Consumers
+   - Impacted Databases

package/commands/map-architecture.md

@@ -0,0 +1,10 @@
+---
+description: Generates a Mermaid architecture diagram from the project DNA
+argument-hint: (no args)
+---
+
+You are the SecuFusion DNA Architecture Agent. Your goal is to visualize the cross-service dependencies and architecture of this project.
+
+1. Call the `secufusion-dna_query_knowledge_graph` tool with the query "Get all services, APIs, and event topics with their dependencies".
+2. Based on the returned relationships, generate a comprehensive Mermaid diagram (`graph TD` or `graph LR`).
+3. Render the diagram in your response, grouping components by bounded context or service if possible.

package/commands/map-services.md

@@ -0,0 +1,3 @@
+# /map-services
+
+This command instructs the SecuFusion DNA Discovery MCP to analyze the project based on /map-services.

package/commands/watch-dna.md

@@ -0,0 +1,9 @@
+---
+description: Starts the background watcher to continuously update the Poly-Repo DNA.
+argument-hint: (no args)
+---
+
+You are the SecuFusion DNA Watcher Agent. Your goal is to start the background file watcher.
+
+1. Call the `start_dna_watcher` tool.
+2. Inform the user that the DNA Knowledge Graph is now actively monitoring the codebase in the background and will dynamically update whenever a developer saves a Java file.

package/hooks/hooks.json

@@ -0,0 +1,17 @@
+{
+  "//": "Hooks active on plugin install. Universal,",
+  "//1": "fast, project-agnostic only. Project-specific",
+  "//2": "hooks (lint, test, format) stay opt-in.",
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/knowledge-drift.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

package/hooks/knowledge-drift.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Silent unless drift detected.
+# Checks if SecuFusion knowledge layer is stale.
+
+ROOT="${1:-.}"
+SPEC_FILE="$ROOT/.secufusion-project-spec.json"
+DOCS_DIR="$ROOT/docs"
+CLAUDE_MD="$ROOT/CLAUDE.md"
+
+# No knowledge layer yet → silent
+if [ ! -f "$SPEC_FILE" ] && [ ! -d "$DOCS_DIR" ]; then
+  exit 0
+fi
+
+# Check git — if no git, skip silently
+if ! git -C "$ROOT" rev-parse --git-dir \
+     > /dev/null 2>&1; then
+  exit 0
+fi
+
+# Find when knowledge was last updated
+LAST_SPEC=$(git -C "$ROOT" log -1 \
+  --format="%H" -- \
+  ".secufusion-project-spec.json" \
+  "docs/" "CLAUDE.md" 2>/dev/null)
+
+if [ -z "$LAST_SPEC" ]; then
+  exit 0
+fi
+
+# Count source files changed since last doc update
+CHANGED=$(git -C "$ROOT" diff \
+  --name-only "$LAST_SPEC"..HEAD \
+  -- "src/" "*/src/" \
+     "pom.xml" "*/pom.xml" \
+     "application*.yml" \
+     "*/application*.yml" \
+  2>/dev/null | wc -l | tr -d ' ')
+
+if [ "$CHANGED" -gt 10 ]; then
+  echo "⚠️  SecuFusion knowledge layer may be stale."
+  echo "   $CHANGED source file(s) changed since"
+  echo "   last /sfn:refresh."
+  echo "   Run /sfn:doctor to check,"
+  echo "   /sfn:refresh to update."
+fi
+
+exit 0

package/mcp/dist/parsers/api.js

@@ -0,0 +1,30 @@
+export function parseApiEndpoints(filePath, fileContent, repository) {
+    const apis = [];
+    if (!fileContent.includes("@RestController"))
+        return apis;
+    const classMatch = fileContent.match(/public\s+class\s+(\w+)/);
+    if (!classMatch)
+        return apis;
+    const controllerName = classMatch[1];
+    const endpoints = [];
+    const violations = [];
+    const mappingRegex = /@(Get|Post|Put|Delete)Mapping\s*\(\s*["']([^"']+)["']\s*\)/g;
+    let match;
+    while ((match = mappingRegex.exec(fileContent)) !== null) {
+        endpoints.push(`${match[1].toUpperCase()} ${match[2]}`);
+    }
+    if (!fileContent.includes("ResponseDto")) {
+        violations.push("Violation: Controller methods should return ResponseEntity<ResponseDto<T>>.");
+    }
+    if (endpoints.length > 0 && !fileContent.includes("String tenantId")) {
+        violations.push("P1 Violation: API endpoints must explicitly accept a String tenantId parameter.");
+    }
+    apis.push({
+        controllerName,
+        endpoints,
+        filePath,
+        repository,
+        violations
+    });
+    return apis;
+}

package/mcp/dist/parsers/backend-node.js

@@ -0,0 +1,26 @@
+export function parseNodeApis(filePath, fileContent, repository) {
+    const apis = [];
+    if (!filePath.endsWith('.ts') && !filePath.endsWith('.js'))
+        return apis;
+    const endpoints = [];
+    const expressRegex = /app\.(get|post|put|delete|patch)\s*\(\s*['"]([^'"]+)['"]/g;
+    let match;
+    while ((match = expressRegex.exec(fileContent)) !== null) {
+        endpoints.push(`${match[1].toUpperCase()} ${match[2]}`);
+    }
+    const nestjsRegex = /@(Get|Post|Put|Delete|Patch)\s*\(\s*['"]?([^'"]*)['"]?\s*\)/g;
+    while ((match = nestjsRegex.exec(fileContent)) !== null) {
+        endpoints.push(`${match[1].toUpperCase()} ${match[2]}`);
+    }
+    if (endpoints.length > 0) {
+        const controllerMatch = fileContent.match(/export\s+class\s+(\w+Controller)/);
+        const controllerName = controllerMatch ? controllerMatch[1] : filePath.split(/[\\/]/).pop()?.replace(/\.(js|ts)$/, '') || 'NodeRoute';
+        apis.push({
+            controllerName,
+            endpoints,
+            filePath,
+            repository
+        });
+    }
+    return apis;
+}

package/mcp/dist/parsers/config.js

@@ -0,0 +1,74 @@
+export function parseConfig(filePath, fileContent, repository) {
+    const isEnv = filePath.includes('.env');
+    const isProperties = filePath.endsWith('.properties');
+    const isYaml = filePath.endsWith('.yml') || filePath.endsWith('.yaml');
+    if (!isEnv && !isProperties && !isYaml)
+        return [];
+    const config = {
+        filePath,
+        repository,
+        entries: [],
+        hasMaskedValues: false
+    };
+    const lines = fileContent.split('\n');
+    if (isEnv || isProperties) {
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('#'))
+                continue;
+            const splitIdx = trimmed.indexOf('=');
+            if (splitIdx > 0) {
+                const key = trimmed.substring(0, splitIdx).trim();
+                const value = trimmed.substring(splitIdx + 1).trim();
+                const requiresRealValues = filePath.includes('.example') ||
+                    value === '' ||
+                    value.includes('***') ||
+                    value.toLowerCase().includes('changeme') ||
+                    value.startsWith('${') ||
+                    value.startsWith('<');
+                config.entries.push({ key, value, requiresRealValues });
+                if (requiresRealValues)
+                    config.hasMaskedValues = true;
+            }
+        }
+    }
+    else if (isYaml) {
+        // Simple parsing for Spring Boot application.yml and similar config keys
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('#'))
+                continue;
+            const match = trimmed.match(/^([\w-]+):\s*(.*)$/);
+            if (match) {
+                const key = match[1];
+                const value = match[2];
+                if (value && value !== '{' && value !== '[') {
+                    const requiresRealValues = value.includes('***') || value.toLowerCase().includes('changeme') || value.startsWith('${');
+                    config.entries.push({ key, value, requiresRealValues });
+                    if (requiresRealValues)
+                        config.hasMaskedValues = true;
+                }
+            }
+        }
+    }
+    if (config.entries.length > 0) {
+        return [config];
+    }
+    return [];
+}
+export function parseExternalEnv(fileContent) {
+    const values = {};
+    const lines = fileContent.split('\n');
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const splitIdx = trimmed.indexOf('=');
+        if (splitIdx > 0) {
+            const key = trimmed.substring(0, splitIdx).trim();
+            const value = trimmed.substring(splitIdx + 1).trim();
+            values[key] = value;
+        }
+    }
+    return values;
+}