secufusion-mcp 2.1.5 → 2.1.6

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "secufusion-mcp",
-  "description": "SecuFusion MSSP platform dev agent — project-level spec driven, tenant-isolation enforced, zero-trust guardrails. Slash commands: /sfn:task (classify+plan+init), /sfn:resume (instant context restore), /sfn:build (implement AC), /sfn:checks (pre-PR gates), /sfn:review (adversarial review), /sfn:pr (ADO+PR docs), /sfn:retro (retrospective), /sfn:init (dynamic DNA generation), /sfn:refresh (update stale docs), /sfn:doctor (health check), /sfn:estate (cross-service map), /sfn:impact (blast radius), /sfn:status (dashboard), /sfn:search (past tasks).",
-  "version": "2.0.0",
+  "description": "SecuFusion MSSP platform dev agent — project-level spec driven, tenant-isolation enforced, zero-trust guardrails. 5 Core Slash Commands: /sfn-init (dynamic DNA + architecture diagram + watcher), /sfn-plan (philosophy check + intent WHY + classify + plan), /sfn-code (spec-driven implementation), /sfn-review (zero-tolerance 3-tier PR gate), /sfn-explore (on-demand service graph or blast-radius analysis).",
+  "version": "2.1.6",
   "author": {
     "name": "Motivity Labs"
   },

package/README.md

@@ -36,23 +36,22 @@
 
 The SecuFusion MCP has been refactored to align with the advanced MLMCPS framework principles, bringing massive efficiency and UX improvements:
 
-1. **Persona-Driven Slash Commands**: The monolithic agent prompt has been split. You can now use `/sfn_spec`, `/sfn_code`, and `/sfn_review` in your AI chat to instantly summon the Planner, Coder, or Reviewer persona, ensuring razor-sharp focus per phase.
+1. **5 High-Impact Slash Commands**: The monolithic agent prompt and fragmented utility scripts are consolidated into 5 clean, focused commands: `/sfn-init`, `/sfn-plan`, `/sfn-code`, `/sfn-review`, and `/sfn-explore`.
 2. **Subprocess PR Checks**: Tier 1 mechanical checks (`TENANT_ISOLATION`, `N_PLUS_ONE`, etc.) are now extracted into a standalone CLI script (`scripts/sfn-pr-check.js`), allowing them to be run by the AI *or* natively within your CI/CD pipelines.
 3. **Thin Index Token Discipline**: Context bloat is gone. Tools like `manage_task(read)` and `prime_session` now return lightweight "Thin Indexes"—compact Markdown summaries with absolute file paths—so the AI only reads the full JSON via `view_file` when truly necessary.
 4. **Dynamic Skill Registry**: A new `skill_recommend` tool allows the AI to dynamically discover domain-specific architectural skills without bloating the base prompt.
 5. **Phase -1 Philosophy Engine**: An invisible gate that checks the WHY, WHO, WHAT, and RISK of every task (including bugs and hotfixes) before any planning starts. If the business intent or blast radius is unsafe, it stops the AI from writing a single line of code.
-6. **Poly-Repo DNA Discovery**: Through the standalone `secufusion-dna-plugin`, the AI can dynamically analyze the entire codebase of any poly-repo project at session start. It maps out microservices, API contracts, event topologies, frontend repos, and the `snf-browser-extn` extension on the fly, creating a living knowledge graph.
+6. **Built-in Poly-Repo DNA Discovery**: Built directly into `secufusion-mcp`. The AI dynamically analyzes the entire poly-repo workspace at session start, mapping microservices, API contracts, Kafka topologies, frontend repos, and browser extensions into a living knowledge graph (`.secufusion/dna.json`) with an auto-generated Mermaid architecture diagram.
 
 ---
 
-## 🧬 SecuFusion DNA Discovery Plugin
+## 🧬 Built-In DNA Discovery & Architecture Exploration
 
-A new standalone Claude plugin has been introduced: **SecuFusion DNA Discovery MCP** (`secufusion-dna-plugin`). This plugin empowers agents to autonomously discover, analyze, and build a living knowledge graph of your entire software ecosystem when handed over to a new team member.
+`secufusion-mcp` includes native ecosystem-wide discovery tools:
 
-**Key Features:**
 - **Dynamic Stack Analysis:** Identifies Java/Spring, Node, Docker, and other frameworks on the fly.
-- **Slash Command Agents:** Use `/analyze`, `/map-architecture`, and `/blast-radius` directly in your AI chat to orchestrate complex codebase queries.
 - **Automated Dependency Mapping:** Generates cross-service dependency maps and evaluates the blast radius of potential changes.
+- **Interactive Commands:** Use `/sfn-init` to map your entire workspace and launch the watcher, and `/sfn-explore` on-demand to render Mermaid architecture graphs or analyze component blast radius.
 
 ---
 
@@ -144,13 +143,13 @@ npx secufusion-mcp
 ### Option 2 — Global install
 
 ```bash
-npm install -g secufusion-mcp@2.1.4
+npm install -g secufusion-mcp@2.1.6
 ```
 
 ### Option 3 — Local project install
 
 ```bash
-npm install --save-dev secufusion-mcp@2.1.4
+npm install --save-dev secufusion-mcp@2.1.6
 ```
 
 ---
@@ -946,86 +945,45 @@ If any of these are physically missing from your local workspace folder, a `[WAR
 
 ## ⚡ End-to-End Slash Command Workflow
 
-Once installed as a native Claude Plugin, all commands appear natively in the Claude IDE `/` command picker. Here is the complete daily workflow:
-
-### 🔁 Day Start — Setup & Discovery
-
-| Command | When to run | What it does |
-|---|---|---|
-| `/sfn-init` | First thing in the morning, or on a new machine | Scans your entire workspace, validates all mandatory repos are cloned against `.secufusion-project-spec.json`, parses AST across all services (Java, TypeScript, React), and builds `.secufusion/dna.json` — the living knowledge graph |
-| `/watch-dna` | Right after `/sfn-init` | Starts the `chokidar` background file watcher. From this point, every file save automatically re-triggers the relevant AST parser and keeps `dna.json` fresh — no manual re-runs needed |
-
-> **Mono-folder rule:** Keep all microservices, frontend, and extension repos inside one parent folder (e.g., `C:\Users\Yash\Desktop\secufi_full\`). The agent uses the parent folder as the ecosystem root and scans all siblings automatically.
-
----
-
-### 📋 Phase 1 — Plan a Ticket
-
-| Command | When to run | What it does |
-|---|---|---|
-| `/sfn-plan <ticket-id or description>` | When you receive a new Azure DevOps ticket | Agent enters the `planner.md` persona. Silently runs the **Philosophy Engine (Phase -1)** to ensure the task's WHY and RISK are sound (even for bugs). Reads `.secufusion-project-spec.json` for golden rules and `dna.json` to determine blast radius. Outputs a structured `plan.md` with exact files to touch, rollback strategy, and breaking change scan. **Stops and waits for your green light.** |
-
-> **Why it stops:** This enforces the non-negotiable Rule 3 — `STRICT YIELD`. The agent must not start coding until you explicitly say "proceed".
-
-**Example:**
-```
-/sfn-plan TASK-2847: Add MFA enforcement for admin users on login
-```
-
----
-
-### 🛠️ Phase 2 — Build the Feature
-
-| Command | When to run | What it does |
-|---|---|---|
-| `/sfn-code` | After you approve the plan | Agent switches to the `coder.md` persona and begins implementing **strictly according to the approved plan**. Enforces all coding patterns (correct `@Transactional` style, Tenant ID scoping, DTO mapping, Lombok style, exception handling). Every architectural mistake is immediately logged to `.rejected-patterns.json`. |
-
----
-
-### ✅ Phase 3 — Review & Gate
-
-| Command | When to run | What it does |
-|---|---|---|
-| `/sfn-review` | After coding is done, before opening a PR | Agent enters the adversarial `reviewer.md` persona. Triggers `run_pre_pr_checks` — a 3-tier AST-level gate: (1) Mechanical guardrails (tenant isolation, N+1 queries, hardcoded URLs), (2) AI file-by-file code review, (3) Context-aware task evaluation against your spec. **Blocks the PR if Tier 1 violations are found.** |
-
----
-
-### 🔍 Phase 4 — Architecture Discovery
-
-These commands can be run at any time to explore your codebase, independent of any active task.
-
-| Command | When to run | What it does |
-|---|---|---|
-| `/blast-radius <component>` | Before refactoring a shared entity, API, or Kafka topic | Reads `dna.json` and calculates exactly which services, endpoints, and consumers will break if the given component is changed. Prevents accidental breaking changes. |
-| `/map-architecture` | When onboarding a new dev or auditing the ecosystem | Generates a comprehensive bird's-eye view of all your services, domains, inter-service call graph, and Kafka topics sourced directly from the DNA graph. |
-| `/analyze` | When debugging a cross-service issue or doing a deep-dive on a subsystem | Performs a deep-dive AST analysis of a specific area, generating detailed dependency and data-flow maps. |
-
----
-
-### 📊 The Full SDLC Flow at a Glance
-
-```
-Morning
-  ↓
-/sfn-init          ← Validate all repos, build DNA knowledge graph
-  ↓
-/watch-dna         ← Background watcher keeps DNA fresh all day
-  ↓
-New ticket arrives
-  ↓
-/sfn-plan TASK-XXX ← Plan is written + presented → you say "proceed"
-  ↓
-/sfn-code          ← Feature is implemented per plan, zero-trust guardrails active
-  ↓
-/sfn-review        ← 3-tier AST gate → PASS or BLOCK with specific violations
-  ↓
-PR opened ✅
-
-Need to investigate?
-  ↓
-/blast-radius       ← Impact analysis before any structural change
-/map-architecture   ← Full ecosystem overview
-/analyze            ← Deep subsystem inspection
+All commands are natively registered as Claude Plugins and appear directly in the Claude IDE `/` command picker. The workflow is streamlined into **5 core commands** with zero redundancy:
+
+| # | Command | Persona / Role | When to run | What it does |
+|---|---|---|---|---|
+| **1** | `/sfn-init` | Ecosystem Architect | First thing in morning, on new machine, or new clone | Bootstraps workspace, validates mandatory repos against `.secufusion-project-spec.json`, extracts domain models, API endpoints, Kafka topics, generates `.secufusion/dna.json`, builds full Mermaid architecture diagram, and launches continuous background file watcher (`chokidar`). |
+| **2** | `/sfn-plan <ticket-id or desc>` | `planner.md` | When starting any story, chore, feature, bug, or hotfix | Evaluates Phase -1 Philosophy gate (WHY/WHO/WHAT/RISK), creates Markdown business intent (`spec_create_intent`), primes session AST context (`prime_session`), classifies task boundaries (`classify_task`), enforces **Rule 5 STRICT YIELD** for your green light, then generates structured `plan.md`. |
+| **3** | `/sfn-code` | `coder.md` | After you approve the plan | Implements strictly according to the approved plan. Enforces zero-trust standards: mandatory tenant isolation on DB operations, proper `@Transactional` scoping, DTO mapping rules, and logs anti-patterns to `.rejected-patterns.json`. |
+| **4** | `/sfn-review` | `reviewer.md` | After coding is done, before opening a PR | Adversarial PR gate running 3 tiers in a single pass: (1) Mechanical AST guardrails (tenant isolation, N+1 queries, hardcoded endpoints), (2) AI file-by-file code review, (3) Context-aware task evaluation against spec. Blocks PR if Tier 1 violations exist. |
+| **5** | `/sfn-explore [map \| <component>]` | Architecture Explorer | On-demand for cross-service impact & system maps | Dual-mode architecture query: `/sfn-explore map` renders the full cross-service Mermaid architecture diagram; `/sfn-explore <component-or-path>` calculates blast radius and affected downstream consumers before making breaking changes. |
+
+---
+
+### 📊 The 5-Command SDLC Flow at a Glance
+
+```
+Morning / First Setup
+  │
+  ▼
+/sfn-init                    ← Scans workspace, writes dna.json, draws Mermaid diagram, starts watcher
+  │
+  ├─► /sfn-explore map        (Optional on-demand: view ecosystem graph)
+  │
+Ticket Arrives (Feature / Bug / Hotfix)
+  │
+  ▼
+/sfn-plan WI-XXXX            ← Phase -1 Philosophy check → Intent WHY → Prime → Classify → STRICT YIELD
+  │
+  ├─► User Approves Plan ✅
+  │
+  ▼
+/sfn-code                    ← Implement approved plan with zero-trust guardrails
+  │
+  ├─► /sfn-explore <comp>    (Optional: verify blast radius if touching shared interfaces)
+  │
+  ▼
+/sfn-review                  ← 3-Tier PR Gate: mechanical AST checks + AI review + spec matching
+  │
+  ▼
+PR Ready to Merge 🚀
 ```
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "2.1.5",
+  "version": "2.1.6",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "mcp/dist/server.js",