suture-mcp 0.1.0 → 0.1.1

package/README.md

@@ -86,6 +86,7 @@ Suture is in **local-first beta**. It is designed with a defense-in-depth securi
 - **RIR Curation:** Automatic memory tiering (Core, Recall, Archive) based on Recency, Importance, and Relevance.
 - **Value Metrics:** Local-only estimates for cached substrate tokens, avoided rereads, indexed/skipped files, code symbols, substrate search hits, duplicate recall skips, and configurable token cost savings.
 - **CLI Hooks:** Integration points for agent `session-start` and `pre-compact` workflows.
+- **Local Visualization:** Token-protected localhost dashboard for core memory, episodes, search, and graph review.
 - **Terminal UI:** Boxed ASCII setup, keyboard-selectable finding curation, index previews, progress/result panels, and a stats dashboard designed for `npx suture-mcp@beta setup`.
 
 ## Install
@@ -130,6 +131,7 @@ Example MCP client configuration (Note: Use absolute paths; many clients do not
 suture-mcp setup [--project <path>] [--dir <state>] [--yes] [--json]
 suture-mcp init [--dir <path>]
 suture-mcp serve [--dir <path>]
+suture-mcp viz [--dir <state>] [--port <port>]
 suture-mcp doctor [--dir <state>] [--json]
 suture-mcp index <project> [--dir <state>] [--apply-safe] [--json]
 suture-mcp hook session-start --project <path> --session <id> [--client <name>] [--format text|json|claude-json]
@@ -146,6 +148,16 @@ suture-mcp recall [--dir <state>]
 
 Beta indexing is deliberately conservative: manifest/config/script/test/code-symbol indexing is enabled, raw markdown memory generation is disabled, and secrets, `.env`, dependencies, build output, generated files, and local tool state directories are ignored.
 
+### Local Visualization
+
+Run the local dashboard against a Suture state directory:
+
+```bash
+suture-mcp viz --dir /path/to/suture-data
+```
+
+The viz server binds only to `127.0.0.1`. It prints a one-time local URL containing a random token, and all `/api/*` routes require that token. The dashboard uses local assets only, so it does not load graph code from a CDN.
+
 ## Multi-Agent Sharing
 
 Suture memory is shared by state directory, not by model provider. Configure every agent that should share memory with the same `--dir` value:
@@ -191,6 +203,7 @@ Current boundaries:
 - Obvious API keys, private keys, and environment secrets are blocked and redacted.
 - Exports are limited to the Suture state directory or `/tmp`.
 - Discovery ignores common dependency/build/cache directories.
+- Local visualization binds to `127.0.0.1` and requires a random per-process token for API routes.
 - The `import` MCP tool is intentionally disabled until migration-safe restore validation is implemented.
 
 These protections are defense-in-depth, not a replacement for a dedicated secret scanner. Treat team sync and remote storage as product features that require explicit review before enabling.