sigmap 8.1.0 → 8.2.0

package/CHANGELOG.md

@@ -10,6 +10,13 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.2.0] — 2026-07-04
+
+Minor release — **`verify_suggestion` MCP tool: the grounding moat, made consumable by agents.** v8.1.0 built local-library grounding inside the `verify-ai-output` CLI; this exposes it as the **18th MCP tool**, so a coding agent can verify its own generated code against the repo **and the libraries actually installed** in `node_modules` — *before it writes* — and get back the flagged issues plus the pinned versions it verified against (D8).
+
+### Added
+- **`verify_suggestion` MCP tool (#409, PR #410):** ground an AI code suggestion before writing it. `verify_suggestion({ code })` runs the Hallucination Guard against the repo signature index **and** the installed-library symbol index (the G5/D5 moat), returning a clean/✗ verdict, one line per issue (fake file / import / symbol / npm-script, with closest-match suggestions), and a **D8** line listing the installed libraries it verified against with pinned versions (`name@version`). Deterministic, offline, zero-dependency. Reuses the shipped `verify()` core; graceful on missing/empty `code`. MCP surface **17 → 18 tools**.
+
 ## [8.1.0] — 2026-07-04
 
 Minor release — **v9.0 G5/D5: the local-library signature index (the private-API grounding moat, v1).** SigMap's hallucination guard can now verify AI suggestions against the libraries **actually installed** in `node_modules`, not just declared dependency *names*. This is a capability no competitor offers — Context7 knows only *public* library docs; SigMap grounds against the real installed tree. Local, zero-dependency, deterministic (byte-stable given a fixed installed tree).

package/README.md

@@ -98,7 +98,7 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v8.1-main (21 repositories, including R language)
+Benchmark : sigmap-v8.2-main (21 repositories, including R language)
 Date      : 2026-07-04
 
 Hit@5          : 86.7%   (baseline 13.6%  — 6.4× lift)
@@ -198,7 +198,7 @@ Use SigMap with open-source tools and fully self-hosted setups:
 | **JetBrains** | [Marketplace](https://plugins.jetbrains.com/plugin/31109-sigmap--ai-context-engine/) | [github.com/manojmallick/sigmap-jetbrains](https://github.com/manojmallick/sigmap-jetbrains) | IntelliJ IDEA, WebStorm, PyCharm, GoLand — tool window + actions |
 | **Neovim** | lazy.nvim / packer / vim-plug | [github.com/manojmallick/sigmap.nvim](https://github.com/manojmallick/sigmap.nvim) | `:SigMap`, `:SigMapQuery` float window, statusline widget |
 
-**MCP server** — 17 on-demand tools for Claude Code and Cursor:
+**MCP server** — 18 on-demand tools for Claude Code and Cursor:
 
 ```bash
 sigmap --mcp

package/gen-context.js

@@ -12892,7 +12892,52 @@ __factories["./src/mcp/handlers"] = function(module, exports) {
     }
   }
 
-  module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview };
+  /**
+   * verify_suggestion({ code }) → string
+   *
+   * Ground an AI code suggestion before it is written: run the Hallucination
+   * Guard against the repo AND the installed-library symbol index (the moat), and
+   * render a verdict + issues + the installed libraries verified against (pinned
+   * versions, D8). Deterministic, offline.
+   */
+  function verifySuggestion(args, cwd) {
+    const code = args && typeof args.code === 'string' ? args.code : '';
+    if (!code.trim()) {
+      return 'Usage: verify_suggestion({ code: "<AI-suggested code or answer>" }) — provide the snippet to verify against the repo + installed libraries.';
+    }
+
+    let result;
+    try {
+      const { verify } = __require('./src/verify/hallucination-guard');
+      result = verify(code, cwd);
+    } catch (err) {
+      return `_verify_suggestion failed: ${err.message}_`;
+    }
+
+    const { issues, summary } = result;
+    const out = [];
+    if (summary.clean) {
+      out.push('✓ Grounded — no fake files, imports, symbols, or scripts detected.');
+    } else {
+      out.push(`✗ ${summary.total} issue(s) found:`);
+      for (const i of issues) {
+        out.push(`  L${i.line}  [${i.type}]  ${i.message}`);
+        if (i.suggestion) out.push(`         ↳ ${i.suggestion}`);
+      }
+    }
+
+    // D8: report the installed libraries the suggestion was verified against.
+    const pins = (summary.libraries || []).filter((l) => l.version).map((l) => `${l.name}@${l.version}`);
+    const n = summary.librariesIndexed || 0;
+    out.push('');
+    out.push(
+      `Grounded against ${summary.symbolsIndexed} repo + library symbol(s)` +
+      (n ? ` · ${n} installed librar${n === 1 ? 'y' : 'ies'}${pins.length ? ': ' + pins.join(', ') : ''}` : '')
+    );
+    return out.join('\n');
+  }
+
+  module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion };
   
 };
 
@@ -13053,17 +13098,17 @@ __factories["./src/mcp/server"] = function(module, exports) {
    *
    * Supported methods:
    *   initialize        → serverInfo + capabilities
-   *   tools/list        → 17 tool definitions
+   *   tools/list        → 18 tool definitions
    *   tools/call        → dispatch to handler, return result
    */
 
   const readline = require('readline');
   const { TOOLS } = __require('./src/mcp/tools');
-  const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview } = __require('./src/mcp/handlers');
+  const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion } = __require('./src/mcp/handlers');
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.1.0',
+    version: '8.2.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -13128,6 +13173,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
         else if (name === 'sigmap_notify_file_deleted') text = notifyFileDeleted(args, cwd);
         else if (name === 'get_diff_context') text = getDiffContext(args, cwd);
         else if (name === 'get_architecture_overview') text = getArchitectureOverview(args, cwd);
+        else if (name === 'verify_suggestion') text = verifySuggestion(args, cwd);
         else {
           respondError(id, -32601, `Unknown tool: ${name}`);
           return;
@@ -13503,6 +13549,26 @@ __factories["./src/mcp/tools"] = function(module, exports) {
         required: [],
       },
     },
+    {
+      name: 'verify_suggestion',
+      description:
+        'Ground an AI code suggestion before writing it: verify a snippet or answer against the ' +
+        'repository AND the libraries actually installed in node_modules (the grounding moat). ' +
+        'Flags fake file paths, unresolvable imports, symbols absent from both the repo index and ' +
+        'the installed libraries, and non-existent npm scripts — deterministic, offline, no LLM. ' +
+        'Reports the installed libraries it verified against with pinned versions.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          code: {
+            type: 'string',
+            description:
+              'The AI-suggested code snippet or answer text to verify against the repo + installed libraries.',
+          },
+        },
+        required: ['code'],
+      },
+    },
   ];
 
   module.exports = { TOOLS };
@@ -17225,7 +17291,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.1.0';
+const VERSION = '8.2.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.1.0 | Benchmark: sigmap-v8.1-main (2026-07-04)
+# Version: 8.2.0 | Benchmark: sigmap-v8.2-main (2026-07-04)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.1-main, 2026-07-04)
+## Core metrics (benchmark: sigmap-v8.2-main, 2026-07-04)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
@@ -26,7 +26,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 | Task success proxy | 10% | 67.8% |
 | Prompts per task | 2.84 | 1.46 (48.8% fewer) |
 | Supported languages | — | 33 |
-| MCP tools | — | 17 |
+| MCP tools | — | 18 |
 | npm runtime dependencies | — | 0 |
 
 ---
@@ -127,7 +127,7 @@ sigmap --version                         Show version
 
 ---
 
-## MCP server — 17 tools
+## MCP server — 18 tools
 
 Start with `sigmap --mcp` (stdio JSON-RPC). Configure once:
 
@@ -271,6 +271,14 @@ A high-level map of the codebase in one call: module breakdown (files/tokens), t
 Input:  { } (no arguments)
 ```
 
+### verify_suggestion
+
+Ground an AI code suggestion before writing it: verify a snippet or answer against the repository AND the libraries actually installed in node_modules (the grounding moat). Flags fake file paths, unresolvable imports, symbols absent from both the repo index and the installed libraries, and non-existent npm scripts — deterministic, offline, no LLM. Reports the installed libraries it verified against with pinned versions.
+
+```
+Input:  { code: string }
+```
+
 ---
 
 ## Configuration (gen-context.config.json)

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.1.0 | Benchmark: sigmap-v8.1-main (2026-07-04)
+# Version: 8.2.0 | Benchmark: sigmap-v8.2-main (2026-07-04)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,13 +23,13 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.1-main, 2026-07-04)
+## Core metrics (benchmark: sigmap-v8.2-main, 2026-07-04)
 
 - hit@5 retrieval: 86.7% vs 13.6% random baseline (6.4× lift)
 - Token reduction: 97.0% average across benchmark repos
 - Task success: 67.8% vs 10% without SigMap
 - Prompts per task: 1.46 vs 2.84 baseline (48.8% fewer)
-- Languages: 33 supported · MCP tools: 17
+- Languages: 33 supported · MCP tools: 18
 - Dependencies: zero npm runtime dependencies · fully offline
 
 ## Quick start

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.1.0",
+  "version": "8.2.0",
   "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.1.0",
+  "version": "8.2.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.1.0",
+  "version": "8.2.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/mcp/handlers.js

@@ -853,4 +853,49 @@ function getArchitectureOverview(args, cwd) {
   }
 }
 
-module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview };
+/**
+ * verify_suggestion({ code }) → string
+ *
+ * Ground an AI code suggestion before it is written: run the Hallucination
+ * Guard against the repo AND the installed-library symbol index (the moat), and
+ * render a verdict + issues + the installed libraries verified against (pinned
+ * versions, D8). Deterministic, offline.
+ */
+function verifySuggestion(args, cwd) {
+  const code = args && typeof args.code === 'string' ? args.code : '';
+  if (!code.trim()) {
+    return 'Usage: verify_suggestion({ code: "<AI-suggested code or answer>" }) — provide the snippet to verify against the repo + installed libraries.';
+  }
+
+  let result;
+  try {
+    const { verify } = require('../verify/hallucination-guard');
+    result = verify(code, cwd);
+  } catch (err) {
+    return `_verify_suggestion failed: ${err.message}_`;
+  }
+
+  const { issues, summary } = result;
+  const out = [];
+  if (summary.clean) {
+    out.push('✓ Grounded — no fake files, imports, symbols, or scripts detected.');
+  } else {
+    out.push(`✗ ${summary.total} issue(s) found:`);
+    for (const i of issues) {
+      out.push(`  L${i.line}  [${i.type}]  ${i.message}`);
+      if (i.suggestion) out.push(`         ↳ ${i.suggestion}`);
+    }
+  }
+
+  // D8: report the installed libraries the suggestion was verified against.
+  const pins = (summary.libraries || []).filter((l) => l.version).map((l) => `${l.name}@${l.version}`);
+  const n = summary.librariesIndexed || 0;
+  out.push('');
+  out.push(
+    `Grounded against ${summary.symbolsIndexed} repo + library symbol(s)` +
+    (n ? ` · ${n} installed librar${n === 1 ? 'y' : 'ies'}${pins.length ? ': ' + pins.join(', ') : ''}` : '')
+  );
+  return out.join('\n');
+}
+
+module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion };

package/src/mcp/server.js

@@ -8,17 +8,17 @@
  *
  * Supported methods:
  *   initialize        → serverInfo + capabilities
- *   tools/list        → 17 tool definitions
+ *   tools/list        → 18 tool definitions
  *   tools/call        → dispatch to handler, return result
  */
 
 const readline = require('readline');
 const { TOOLS } = require('./tools');
-const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview } = require('./handlers');
+const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory, getCalleeSignatures, notifyFileCreated, notifySymbolAdded, notifyFileDeleted, getDiffContext, getArchitectureOverview, verifySuggestion } = require('./handlers');
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.1.0',
+  version: '8.2.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 
@@ -83,6 +83,7 @@ function dispatch(msg, cwd) {
       else if (name === 'sigmap_notify_file_deleted') text = notifyFileDeleted(args, cwd);
       else if (name === 'get_diff_context') text = getDiffContext(args, cwd);
       else if (name === 'get_architecture_overview') text = getArchitectureOverview(args, cwd);
+      else if (name === 'verify_suggestion') text = verifySuggestion(args, cwd);
       else {
         respondError(id, -32601, `Unknown tool: ${name}`);
         return;

package/src/mcp/tools.js

@@ -316,6 +316,26 @@ const TOOLS = [
       required: [],
     },
   },
+  {
+    name: 'verify_suggestion',
+    description:
+      'Ground an AI code suggestion before writing it: verify a snippet or answer against the ' +
+      'repository AND the libraries actually installed in node_modules (the grounding moat). ' +
+      'Flags fake file paths, unresolvable imports, symbols absent from both the repo index and ' +
+      'the installed libraries, and non-existent npm scripts — deterministic, offline, no LLM. ' +
+      'Reports the installed libraries it verified against with pinned versions.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        code: {
+          type: 'string',
+          description:
+            'The AI-suggested code snippet or answer text to verify against the repo + installed libraries.',
+        },
+      },
+      required: ['code'],
+    },
+  },
 ];
 
 module.exports = { TOOLS };