secufusion-mcp 2.0.0 → 2.0.1

package/README.md

@@ -838,12 +838,159 @@ Proceeding to plan presentation. No developer confirmation needed.
 | **Guardrails** | Mixed soft/hard language | All `should` → `MUST`, all `avoid` → `FORBIDDEN`, linter errors explicitly blocking |
 | **Cross-Task Intelligence** | Prose bullets | MANDATORY STEP 1-4 sequence + ❌ list |
 
+
+---
+
+## 🏗️ v2.0.0 — Native Claude Plugin Architecture
+
+`secufusion-mcp@2.0.0` is a **complete architectural rebuild** of the MCP server into a native Claude Plugin. It unifies the MCP server, slash commands, personas, and hooks into a single self-contained, portable package following the enterprise-grade `ml-specs` plugin standard.
+
+### What Changed
+
+| Area | Before (≤ 1.2.8) | After (2.0.0) |
+|---|---|---|
+| **Plugin type** | Standalone MCP server only | Native Claude Plugin (`.claude-plugin/plugin.json` + `.mcp.json`) |
+| **Slash commands** | Disconnected — no wiring to server | Natively registered — appear in Claude IDE `/` command menu |
+| **Agent personas** | Scattered globally in `.agents/` | Self-contained inside `agents/` within the plugin package |
+| **Path portability** | Hardcoded absolute paths | Fully portable via `${CLAUDE_PLUGIN_ROOT}` |
+| **DNA plugin** | Separate `secufusion-dna-plugin` package | Fully merged into `secufusion-mcp` |
+| **TypeScript build** | Root-level compile | Isolated in `mcp/src/` → compiles to `mcp/dist/` |
+| **Repo validation** | Not present | Reads `.secufusion-project-spec.json` to verify all mandatory repos are cloned |
+| **Frontend/ext validation** | Not present | Checks `frontend.repo` and `chrome_extension.repo` from project spec |
+
+### New Package Structure
+
+```
+secufusion-mcp/
+├── .claude-plugin/
+│   └── plugin.json          ← Claude registers this as a native plugin
+├── .mcp.json                ← MCP server wired into the plugin (${CLAUDE_PLUGIN_ROOT} relative)
+├── agents/                  ← All agent personas (planner, coder, reviewer, claude, AGENTS.md)
+├── commands/                ← All slash command definitions (markdown)
+├── hooks/                   ← Lifecycle hooks (knowledge-drift.sh)
+├── mcp/
+│   ├── src/
+│   │   ├── server.ts        ← Main MCP server logic
+│   │   └── parsers/         ← Polyglot AST parsers (Java, TS, React, Config, Infra...)
+│   ├── dist/                ← Compiled output (what npm ships)
+│   └── tsconfig.json        ← Isolated TypeScript config
+├── scripts/
+│   ├── sfn-pr-check.js      ← Pre-PR mechanical guardrail runner
+│   └── utils.js
+└── package.json
+```
+
+### Merged: SecuFusion DNA Plugin
+
+The previously separate `secufusion-dna-plugin` is now fully merged into `secufusion-mcp`. There is no longer a need to install or configure it separately. All DNA discovery tools are available natively:
+
+- `scan_repository_stack` — discovers framework/stack and validates repos vs project spec
+- `extract_domain_models` — maps JPA entities and domain objects via AST
+- `extract_api_endpoints` — maps REST/GraphQL endpoints across all services
+- `extract_event_topics` — maps Kafka producers and consumers
+- `start_dna_watcher` — starts continuous background file watcher
+
+### Mandatory Repository Validation
+
+During `scan_repository_stack`, the server reads `.secufusion-project-spec.json` and cross-references:
+- All keys under `"microservices"` (e.g., `sfn-auth-api`, `sfn-events-api`)
+- The `"frontend.repo"` value (e.g., `sfn-web-ui`)
+- The `"chrome_extension.repo"` value (e.g., `snf-browser-extn`)
+
+If any of these are physically missing from your local workspace folder, a `[WARNING]` is emitted listing exactly which repositories need to be cloned before a complete DNA map can be built.
+
+---
+
+## ⚡ End-to-End Slash Command Workflow
+
+Once installed as a native Claude Plugin, all commands appear natively in the Claude IDE `/` command picker. Here is the complete daily workflow:
+
+### 🔁 Day Start — Setup & Discovery
+
+| Command | When to run | What it does |
+|---|---|---|
+| `/sfn-init` | First thing in the morning, or on a new machine | Scans your entire workspace, validates all mandatory repos are cloned against `.secufusion-project-spec.json`, parses AST across all services (Java, TypeScript, React), and builds `.secufusion/dna.json` — the living knowledge graph |
+| `/watch-dna` | Right after `/sfn-init` | Starts the `chokidar` background file watcher. From this point, every file save automatically re-triggers the relevant AST parser and keeps `dna.json` fresh — no manual re-runs needed |
+
+> **Mono-folder rule:** Keep all microservices, frontend, and extension repos inside one parent folder (e.g., `C:\Users\Yash\Desktop\secufi_full\`). The agent uses the parent folder as the ecosystem root and scans all siblings automatically.
+
+---
+
+### 📋 Phase 1 — Plan a Ticket
+
+| Command | When to run | What it does |
+|---|---|---|
+| `/sfn-plan <ticket-id or description>` | When you receive a new Azure DevOps ticket | Agent enters the `planner.md` persona. Reads `.secufusion-project-spec.json` for golden rules and coding patterns. Reads `dna.json` to determine which microservice owns the change. Outputs a structured `plan.md` with exact files to touch, rollback strategy, and breaking change scan. **Stops and waits for your green light.** |
+
+> **Why it stops:** This enforces the non-negotiable Rule 3 — `STRICT YIELD`. The agent must not start coding until you explicitly say "proceed".
+
+**Example:**
+```
+/sfn-plan TASK-2847: Add MFA enforcement for admin users on login
+```
+
+---
+
+### 🛠️ Phase 2 — Build the Feature
+
+| Command | When to run | What it does |
+|---|---|---|
+| `/sfn-code` | After you approve the plan | Agent switches to the `coder.md` persona and begins implementing **strictly according to the approved plan**. Enforces all coding patterns (correct `@Transactional` style, Tenant ID scoping, DTO mapping, Lombok style, exception handling). Every architectural mistake is immediately logged to `.rejected-patterns.json`. |
+
+---
+
+### ✅ Phase 3 — Review & Gate
+
+| Command | When to run | What it does |
+|---|---|---|
+| `/sfn-review` | After coding is done, before opening a PR | Agent enters the adversarial `reviewer.md` persona. Triggers `run_pre_pr_checks` — a 3-tier AST-level gate: (1) Mechanical guardrails (tenant isolation, N+1 queries, hardcoded URLs), (2) AI file-by-file code review, (3) Context-aware task evaluation against your spec. **Blocks the PR if Tier 1 violations are found.** |
+
+---
+
+### 🔍 Phase 4 — Architecture Discovery
+
+These commands can be run at any time to explore your codebase, independent of any active task.
+
+| Command | When to run | What it does |
+|---|---|---|
+| `/blast-radius <component>` | Before refactoring a shared entity, API, or Kafka topic | Reads `dna.json` and calculates exactly which services, endpoints, and consumers will break if the given component is changed. Prevents accidental breaking changes. |
+| `/map-architecture` | When onboarding a new dev or auditing the ecosystem | Generates a comprehensive bird's-eye view of all your services, domains, inter-service call graph, and Kafka topics sourced directly from the DNA graph. |
+| `/analyze` | When debugging a cross-service issue or doing a deep-dive on a subsystem | Performs a deep-dive AST analysis of a specific area, generating detailed dependency and data-flow maps. |
+
+---
+
+### 📊 The Full SDLC Flow at a Glance
+
+```
+Morning
+  ↓
+/sfn-init          ← Validate all repos, build DNA knowledge graph
+  ↓
+/watch-dna         ← Background watcher keeps DNA fresh all day
+  ↓
+New ticket arrives
+  ↓
+/sfn-plan TASK-XXX ← Plan is written + presented → you say "proceed"
+  ↓
+/sfn-code          ← Feature is implemented per plan, zero-trust guardrails active
+  ↓
+/sfn-review        ← 3-tier AST gate → PASS or BLOCK with specific violations
+  ↓
+PR opened ✅
+
+Need to investigate?
+  ↓
+/blast-radius       ← Impact analysis before any structural change
+/map-architecture   ← Full ecosystem overview
+/analyze            ← Deep subsystem inspection
+```
+
 ---
 
 ## Requirements
 
 - **Node.js** >= 18.0.0
-- An MCP-compatible AI client (Antigravity, Claude Desktop, Cursor, Cline, etc.)
+- An MCP-compatible AI client (Antigravity IDE, Claude Desktop, Cursor, Cline, etc.)
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "mcp/dist/server.js",