secufusion-mcp 2.1.4 → 2.1.6

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "secufusion-mcp",
-  "description": "SecuFusion MSSP platform dev agent — project-level spec driven, tenant-isolation enforced, zero-trust guardrails. Slash commands: /sfn:task (classify+plan+init), /sfn:resume (instant context restore), /sfn:build (implement AC), /sfn:checks (pre-PR gates), /sfn:review (adversarial review), /sfn:pr (ADO+PR docs), /sfn:retro (retrospective), /sfn:init (dynamic DNA generation), /sfn:refresh (update stale docs), /sfn:doctor (health check), /sfn:estate (cross-service map), /sfn:impact (blast radius), /sfn:status (dashboard), /sfn:search (past tasks).",
-  "version": "2.0.0",
+  "description": "SecuFusion MSSP platform dev agent — project-level spec driven, tenant-isolation enforced, zero-trust guardrails. 5 Core Slash Commands: /sfn-init (dynamic DNA + architecture diagram + watcher), /sfn-plan (philosophy check + intent WHY + classify + plan), /sfn-code (spec-driven implementation), /sfn-review (zero-tolerance 3-tier PR gate), /sfn-explore (on-demand service graph or blast-radius analysis).",
+  "version": "2.1.6",
   "author": {
     "name": "Motivity Labs"
   },

package/README.md

@@ -36,23 +36,22 @@
 
 The SecuFusion MCP has been refactored to align with the advanced MLMCPS framework principles, bringing massive efficiency and UX improvements:
 
-1. **Persona-Driven Slash Commands**: The monolithic agent prompt has been split. You can now use `/sfn_spec`, `/sfn_code`, and `/sfn_review` in your AI chat to instantly summon the Planner, Coder, or Reviewer persona, ensuring razor-sharp focus per phase.
+1. **5 High-Impact Slash Commands**: The monolithic agent prompt and fragmented utility scripts are consolidated into 5 clean, focused commands: `/sfn-init`, `/sfn-plan`, `/sfn-code`, `/sfn-review`, and `/sfn-explore`.
 2. **Subprocess PR Checks**: Tier 1 mechanical checks (`TENANT_ISOLATION`, `N_PLUS_ONE`, etc.) are now extracted into a standalone CLI script (`scripts/sfn-pr-check.js`), allowing them to be run by the AI *or* natively within your CI/CD pipelines.
 3. **Thin Index Token Discipline**: Context bloat is gone. Tools like `manage_task(read)` and `prime_session` now return lightweight "Thin Indexes"—compact Markdown summaries with absolute file paths—so the AI only reads the full JSON via `view_file` when truly necessary.
 4. **Dynamic Skill Registry**: A new `skill_recommend` tool allows the AI to dynamically discover domain-specific architectural skills without bloating the base prompt.
 5. **Phase -1 Philosophy Engine**: An invisible gate that checks the WHY, WHO, WHAT, and RISK of every task (including bugs and hotfixes) before any planning starts. If the business intent or blast radius is unsafe, it stops the AI from writing a single line of code.
-6. **Poly-Repo DNA Discovery**: Through the standalone `secufusion-dna-plugin`, the AI can dynamically analyze the entire codebase of any poly-repo project at session start. It maps out microservices, API contracts, event topologies, frontend repos, and the `snf-browser-extn` extension on the fly, creating a living knowledge graph.
+6. **Built-in Poly-Repo DNA Discovery**: Built directly into `secufusion-mcp`. The AI dynamically analyzes the entire poly-repo workspace at session start, mapping microservices, API contracts, Kafka topologies, frontend repos, and browser extensions into a living knowledge graph (`.secufusion/dna.json`) with an auto-generated Mermaid architecture diagram.
 
 ---
 
-## 🧬 SecuFusion DNA Discovery Plugin
+## 🧬 Built-In DNA Discovery & Architecture Exploration
 
-A new standalone Claude plugin has been introduced: **SecuFusion DNA Discovery MCP** (`secufusion-dna-plugin`). This plugin empowers agents to autonomously discover, analyze, and build a living knowledge graph of your entire software ecosystem when handed over to a new team member.
+`secufusion-mcp` includes native ecosystem-wide discovery tools:
 
-**Key Features:**
 - **Dynamic Stack Analysis:** Identifies Java/Spring, Node, Docker, and other frameworks on the fly.
-- **Slash Command Agents:** Use `/analyze`, `/map-architecture`, and `/blast-radius` directly in your AI chat to orchestrate complex codebase queries.
 - **Automated Dependency Mapping:** Generates cross-service dependency maps and evaluates the blast radius of potential changes.
+- **Interactive Commands:** Use `/sfn-init` to map your entire workspace and launch the watcher, and `/sfn-explore` on-demand to render Mermaid architecture graphs or analyze component blast radius.
 
 ---
 
@@ -144,13 +143,13 @@ npx secufusion-mcp
 ### Option 2 — Global install
 
 ```bash
-npm install -g secufusion-mcp
+npm install -g secufusion-mcp@2.1.6
 ```
 
 ### Option 3 — Local project install
 
 ```bash
-npm install --save-dev secufusion-mcp
+npm install --save-dev secufusion-mcp@2.1.6
 ```
 
 ---
@@ -715,7 +714,7 @@ Phase 4: run_pre_pr_checks_with_reviewer_agent → APPROVED / DISCUSS
 
 As of version **1.0.13+**, `secufusion-mcp` globally bundles both `.secufusion-project-spec.json` and `AGENTS.md`. You **no longer need to copy these files** into every single repository!
 
-When you install globally (`npm install -g secufusion-mcp@latest`), the AI can automatically read your rules and project spec on the fly from the global installation.
+When you install globally (`npm install -g secufusion-mcp@2.1.4`), the AI can automatically read your rules and project spec on the fly from the global installation.
 
 **How to load the Rules in a new project:**
 Depending on your AI client's capabilities, you can load the rules instantly by telling the AI:
@@ -946,86 +945,45 @@ If any of these are physically missing from your local workspace folder, a `[WAR
 
 ## ⚡ End-to-End Slash Command Workflow
 
-Once installed as a native Claude Plugin, all commands appear natively in the Claude IDE `/` command picker. Here is the complete daily workflow:
-
-### 🔁 Day Start — Setup & Discovery
-
-| Command | When to run | What it does |
-|---|---|---|
-| `/sfn-init` | First thing in the morning, or on a new machine | Scans your entire workspace, validates all mandatory repos are cloned against `.secufusion-project-spec.json`, parses AST across all services (Java, TypeScript, React), and builds `.secufusion/dna.json` — the living knowledge graph |
-| `/watch-dna` | Right after `/sfn-init` | Starts the `chokidar` background file watcher. From this point, every file save automatically re-triggers the relevant AST parser and keeps `dna.json` fresh — no manual re-runs needed |
-
-> **Mono-folder rule:** Keep all microservices, frontend, and extension repos inside one parent folder (e.g., `C:\Users\Yash\Desktop\secufi_full\`). The agent uses the parent folder as the ecosystem root and scans all siblings automatically.
-
----
-
-### 📋 Phase 1 — Plan a Ticket
-
-| Command | When to run | What it does |
-|---|---|---|
-| `/sfn-plan <ticket-id or description>` | When you receive a new Azure DevOps ticket | Agent enters the `planner.md` persona. Silently runs the **Philosophy Engine (Phase -1)** to ensure the task's WHY and RISK are sound (even for bugs). Reads `.secufusion-project-spec.json` for golden rules and `dna.json` to determine blast radius. Outputs a structured `plan.md` with exact files to touch, rollback strategy, and breaking change scan. **Stops and waits for your green light.** |
-
-> **Why it stops:** This enforces the non-negotiable Rule 3 — `STRICT YIELD`. The agent must not start coding until you explicitly say "proceed".
-
-**Example:**
-```
-/sfn-plan TASK-2847: Add MFA enforcement for admin users on login
-```
-
----
-
-### 🛠️ Phase 2 — Build the Feature
-
-| Command | When to run | What it does |
-|---|---|---|
-| `/sfn-code` | After you approve the plan | Agent switches to the `coder.md` persona and begins implementing **strictly according to the approved plan**. Enforces all coding patterns (correct `@Transactional` style, Tenant ID scoping, DTO mapping, Lombok style, exception handling). Every architectural mistake is immediately logged to `.rejected-patterns.json`. |
-
----
-
-### ✅ Phase 3 — Review & Gate
-
-| Command | When to run | What it does |
-|---|---|---|
-| `/sfn-review` | After coding is done, before opening a PR | Agent enters the adversarial `reviewer.md` persona. Triggers `run_pre_pr_checks` — a 3-tier AST-level gate: (1) Mechanical guardrails (tenant isolation, N+1 queries, hardcoded URLs), (2) AI file-by-file code review, (3) Context-aware task evaluation against your spec. **Blocks the PR if Tier 1 violations are found.** |
-
----
-
-### 🔍 Phase 4 — Architecture Discovery
-
-These commands can be run at any time to explore your codebase, independent of any active task.
-
-| Command | When to run | What it does |
-|---|---|---|
-| `/blast-radius <component>` | Before refactoring a shared entity, API, or Kafka topic | Reads `dna.json` and calculates exactly which services, endpoints, and consumers will break if the given component is changed. Prevents accidental breaking changes. |
-| `/map-architecture` | When onboarding a new dev or auditing the ecosystem | Generates a comprehensive bird's-eye view of all your services, domains, inter-service call graph, and Kafka topics sourced directly from the DNA graph. |
-| `/analyze` | When debugging a cross-service issue or doing a deep-dive on a subsystem | Performs a deep-dive AST analysis of a specific area, generating detailed dependency and data-flow maps. |
-
----
-
-### 📊 The Full SDLC Flow at a Glance
-
-```
-Morning
-  ↓
-/sfn-init          ← Validate all repos, build DNA knowledge graph
-  ↓
-/watch-dna         ← Background watcher keeps DNA fresh all day
-  ↓
-New ticket arrives
-  ↓
-/sfn-plan TASK-XXX ← Plan is written + presented → you say "proceed"
-  ↓
-/sfn-code          ← Feature is implemented per plan, zero-trust guardrails active
-  ↓
-/sfn-review        ← 3-tier AST gate → PASS or BLOCK with specific violations
-  ↓
-PR opened ✅
-
-Need to investigate?
-  ↓
-/blast-radius       ← Impact analysis before any structural change
-/map-architecture   ← Full ecosystem overview
-/analyze            ← Deep subsystem inspection
+All commands are natively registered as Claude Plugins and appear directly in the Claude IDE `/` command picker. The workflow is streamlined into **5 core commands** with zero redundancy:
+
+| # | Command | Persona / Role | When to run | What it does |
+|---|---|---|---|---|
+| **1** | `/sfn-init` | Ecosystem Architect | First thing in morning, on new machine, or new clone | Bootstraps workspace, validates mandatory repos against `.secufusion-project-spec.json`, extracts domain models, API endpoints, Kafka topics, generates `.secufusion/dna.json`, builds full Mermaid architecture diagram, and launches continuous background file watcher (`chokidar`). |
+| **2** | `/sfn-plan <ticket-id or desc>` | `planner.md` | When starting any story, chore, feature, bug, or hotfix | Evaluates Phase -1 Philosophy gate (WHY/WHO/WHAT/RISK), creates Markdown business intent (`spec_create_intent`), primes session AST context (`prime_session`), classifies task boundaries (`classify_task`), enforces **Rule 5 STRICT YIELD** for your green light, then generates structured `plan.md`. |
+| **3** | `/sfn-code` | `coder.md` | After you approve the plan | Implements strictly according to the approved plan. Enforces zero-trust standards: mandatory tenant isolation on DB operations, proper `@Transactional` scoping, DTO mapping rules, and logs anti-patterns to `.rejected-patterns.json`. |
+| **4** | `/sfn-review` | `reviewer.md` | After coding is done, before opening a PR | Adversarial PR gate running 3 tiers in a single pass: (1) Mechanical AST guardrails (tenant isolation, N+1 queries, hardcoded endpoints), (2) AI file-by-file code review, (3) Context-aware task evaluation against spec. Blocks PR if Tier 1 violations exist. |
+| **5** | `/sfn-explore [map \| <component>]` | Architecture Explorer | On-demand for cross-service impact & system maps | Dual-mode architecture query: `/sfn-explore map` renders the full cross-service Mermaid architecture diagram; `/sfn-explore <component-or-path>` calculates blast radius and affected downstream consumers before making breaking changes. |
+
+---
+
+### 📊 The 5-Command SDLC Flow at a Glance
+
+```
+Morning / First Setup
+  │
+  ▼
+/sfn-init                    ← Scans workspace, writes dna.json, draws Mermaid diagram, starts watcher
+  │
+  ├─► /sfn-explore map        (Optional on-demand: view ecosystem graph)
+  │
+Ticket Arrives (Feature / Bug / Hotfix)
+  │
+  ▼
+/sfn-plan WI-XXXX            ← Phase -1 Philosophy check → Intent WHY → Prime → Classify → STRICT YIELD
+  │
+  ├─► User Approves Plan ✅
+  │
+  ▼
+/sfn-code                    ← Implement approved plan with zero-trust guardrails
+  │
+  ├─► /sfn-explore <comp>    (Optional: verify blast radius if touching shared interfaces)
+  │
+  ▼
+/sfn-review                  ← 3-Tier PR Gate: mechanical AST checks + AI review + spec matching
+  │
+  ▼
+PR Ready to Merge 🚀
 ```
 
 ---

package/commands/sfn-explore.md

@@ -0,0 +1,74 @@
+---
+description: On-demand architecture exploration — map the full service graph as a Mermaid diagram, or run a blast-radius impact analysis for a specific component.
+argument-hint: [map] or <component-name-or-file-path>  e.g. "map" or "sfn-events-api" or "TenantEntity.java"
+---
+
+You are executing the **sfn-explore** command for the SecuFusion ecosystem.
+
+Argument: **$ARGUMENTS**
+
+---
+
+## Mode Detection
+
+Read `$ARGUMENTS` and decide the mode:
+
+- If `$ARGUMENTS` is empty or equals `map` → **Architecture Map Mode**
+- Otherwise → **Blast Radius Mode** for the given component
+
+---
+
+## Mode A — Architecture Map
+
+> Use this when: you want a bird's-eye view of the entire ecosystem (e.g. onboarding a new dev, auditing dependencies).
+
+1. Call `prime_session` or read `.secufusion/dna.json` to load the current knowledge graph.
+2. Generate a comprehensive **Mermaid diagram** (`graph TD`) that shows:
+   - All microservices grouped by bounded context
+   - REST API call graph (which service calls which)
+   - Kafka topic flow (producer → topic → consumer)
+   - Frontend (`sfn-web-ui`) and extension (`snf-browser-extn`) connections to backend services
+3. Render the Mermaid diagram in the response.
+4. Below the diagram, print a service inventory table:
+
+   | Service | Port | Stack | Owns Tables | Produces Topics | Consumes Topics |
+   |---|---|---|---|---|---|
+
+---
+
+## Mode B — Blast Radius
+
+> Use this when: you are about to refactor a shared entity, change an API contract, or modify a Kafka topic and need to know the full downstream impact.
+
+1. Call `prime_session` or read `.secufusion/dna.json` to load the knowledge graph.
+2. Search for all references to `$ARGUMENTS` across:
+   - Microservice API consumers (who calls this endpoint?)
+   - Database entity consumers (which repos query this table/column?)
+   - Kafka consumers (which services consume this topic?)
+   - Frontend and `snf-browser-extn` (does the UI or extension directly consume this contract?)
+3. Present a **Cross-Repo Blast Radius Report**:
+
+   ```
+   🎯 Component: $ARGUMENTS
+
+   Impacted Microservices:
+     - sfn-X-api  →  [why impacted]
+
+   Impacted APIs:
+     - GET /v1/...  →  [consumers]
+
+   Impacted Events / Consumers:
+     - topic-name  →  [consumer services]
+
+   Impacted Databases:
+     - table_name  →  [services querying this]
+
+   Impacted Frontend / Extension:
+     - sfn-web-ui  →  [pages / components]
+     - snf-browser-extn  →  [content scripts / background workers]
+
+   Risk Level: 🟢 LOW | 🟡 MEDIUM | 🔴 HIGH
+   ```
+
+4. If risk is 🔴 HIGH, add a warning:
+   > ⚠️ High blast radius detected. Consider running `/sfn-plan` with this context before making changes.

package/commands/sfn-init.md

@@ -1,5 +1,5 @@
 ---
-description: Prime the SecuFusion ecosystem — scan the entire codebase, map the architectural DNA, and write it to .secufusion/dna.json. Run this once when you first clone a repo.
+description: Prime the SecuFusion ecosystem — scan the entire codebase, map the architectural DNA, generate the architecture diagram, and write it to .secufusion/dna.json. Run this once when you first clone a repo.
 argument-hint: (no args) — run from the root of the repo
 ---
 
@@ -9,14 +9,12 @@ You are executing the **sfn-init** bootstrap command for the SecuFusion ecosyste
 
 ## Phase 1 — SCAN the Repository
 
-Call the **secufusion-dna-plugin** MCP tools to scan the repository:
+Call the following MCP tools to scan the repository. Run all 4 **concurrently in a single message**:
 
-1. Call `scan_repository_stack` to identify: language, framework, package manager, microservices, database entities, and build/test commands. Flag if this is a monorepo.
-2. Call `extract_domain_models` to map all domain entities, their fields, and relationships.
-3. Call `extract_api_endpoints` to map all REST/GraphQL endpoints, their methods, and owning services.
-4. Call `extract_event_topics` to map all Kafka/event-bus topics, producers, and consumers.
-
-Run all 4 tool calls in a **single message** so they execute concurrently.
+1. `scan_repository_stack` — identify language, framework, package manager, microservices, DB entities, build/test commands. Flag if monorepo.
+2. `extract_domain_models` — map all domain entities, their fields, and relationships.
+3. `extract_api_endpoints` — map all REST/GraphQL endpoints, their methods, and owning services.
+4. `extract_event_topics` — map all Kafka/event-bus topics, producers, and consumers.
 
 ## Phase 2 — WRITE the DNA
 
@@ -43,7 +41,17 @@ Once all scans complete:
 Summarize what was found:
 - Number of services, domain models, API endpoints, and event topics discovered
 - Any gaps or areas marked `(inferred)` that the human should verify
-- **CRITICAL CORE CHECK:** Explicitly verify that the DNA map contains mappings for **frontend**, **backend**, and **snf-browser-extn** (extension). If ANY of these 3 are missing, you MUST print a prominent warning notifying the user what is missing.
+- **CRITICAL CORE CHECK:** Explicitly verify that the DNA map contains mappings for **frontend**, **backend**, and **snf-browser-extn** (extension). If ANY of these 3 are missing, print a prominent warning listing exactly what is missing and what needs to be cloned/added.
 - Confirm that `.secufusion/dna.json` was written successfully
 
+## Phase 4 — ARCHITECTURE DIAGRAM
+
+Using the data now in `dna.json`, generate a comprehensive **Mermaid diagram** (`graph TD`) that visualizes:
+- All microservices and their bounded contexts
+- REST API call graph (which service calls which)
+- Kafka topic flow (producer → topic → consumer)
+- Frontend and `snf-browser-extn` connections to backend services
+
+Render the diagram directly in your response so the user can see the full ecosystem at a glance.
+
 **Next step for the user:** Run `/sfn-plan <ticket-id>` to start your first task.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "2.1.4",
+  "version": "2.1.6",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "mcp/dist/server.js",

package/commands/analyze.md

@@ -1,15 +0,0 @@
----
-description: Analyzes the current project to build its DNA Knowledge Graph
-argument-hint: (no args)
----
-
-You are the SecuFusion DNA Discovery Agent. Your goal is to analyze this ecosystem and build the Poly-Repo DNA Knowledge Graph.
-
-The underlying MCP tools will automatically detect if you are inside a poly-repo structure. If they find sibling repositories, they will scan all of them simultaneously to build a cross-repo DNA file.
-
-1. Call the `secufusion-dna_scan_repository_stack` tool to identify the framework and infrastructure across the ecosystem.
-2. Call the `secufusion-dna_extract_domain_models` tool to find and parse entities and domain models across all repos.
-3. Call the `secufusion-dna_extract_api_endpoints` tool to map out the API layer across all repos.
-4. Call the `secufusion-dna_extract_event_topics` tool to map out event consumers and producers across all repos.
-
-Once you have gathered this information, summarize your findings for the user. Do not delete any existing data in the knowledge graph.

package/commands/blast-radius.md

@@ -1,14 +0,0 @@
----
-description: Determines the impact of changing a specific component or file
-argument-hint: <component-name-or-file-path>
----
-
-You are the SecuFusion DNA Blast Radius Agent. Your goal is to determine the impact of changing the provided component or file across the entire Poly-Repo ecosystem.
-
-1. Call the `secufusion-dna_query_knowledge_graph` tool with the query "Find all components, services, and APIs that depend on or consume {argument}".
-2. Analyze the returned dependency chain, paying special attention to cross-repo dependencies (e.g., changing a DTO in `sfn-events-api` breaking a listener in `sfn-notification-api`).
-3. Present a Cross-Repo Blast Radius Report to the user, categorizing the impact into:
-   - Impacted Microservices
-   - Impacted APIs
-   - Impacted Events/Consumers
-   - Impacted Databases

package/commands/map-architecture.md

@@ -1,10 +0,0 @@
----
-description: Generates a Mermaid architecture diagram from the project DNA
-argument-hint: (no args)
----
-
-You are the SecuFusion DNA Architecture Agent. Your goal is to visualize the cross-service dependencies and architecture of this project.
-
-1. Call the `secufusion-dna_query_knowledge_graph` tool with the query "Get all services, APIs, and event topics with their dependencies".
-2. Based on the returned relationships, generate a comprehensive Mermaid diagram (`graph TD` or `graph LR`).
-3. Render the diagram in your response, grouping components by bounded context or service if possible.

package/commands/map-services.md

@@ -1,3 +0,0 @@
-# /map-services
-
-This command instructs the SecuFusion DNA Discovery MCP to analyze the project based on /map-services.

package/commands/watch-dna.md

@@ -1,9 +0,0 @@
----
-description: Starts the background watcher to continuously update the Poly-Repo DNA.
-argument-hint: (no args)
----
-
-You are the SecuFusion DNA Watcher Agent. Your goal is to start the background file watcher.
-
-1. Call the `start_dna_watcher` tool.
-2. Inform the user that the DNA Knowledge Graph is now actively monitoring the codebase in the background and will dynamically update whenever a developer saves a Java file.