trace-sec 2.1.3 → 2.1.5

package/bin/trace.js

@@ -51,8 +51,8 @@ if (args[0] === 'install-skill' || args[0] === 'setup-agent' || args[0] === 'ins
         trace: {
           command: isWin ? 'cmd.exe' : 'npx',
           args: isWin
-            ? ['/c', 'npx', '-y', 'github:VK-Amogh/TRACE', 'mcp']
-            : ['-y', 'github:VK-Amogh/TRACE', 'mcp'],
+            ? ['/c', 'npx', '-y', 'trace-sec', 'mcp']
+            : ['-y', 'trace-sec', 'mcp'],
           env: {
             PYTHONUNBUFFERED: '1',
           },
@@ -73,7 +73,7 @@ if (args[0] === 'install-skill' || args[0] === 'setup-agent' || args[0] === 'ins
     console.log('  • \x1b[32mAntigravity & Agentic IDEs:\x1b[0m .agents/plugins/trace-security active');
     console.log('  • \x1b[32mVerification Tools:\x1b[0m trace_scan, trace_findings, trace_verify, trace_harness_task');
     console.log('\n\x1b[90mTo register in Claude Code CLI directly:\x1b[0m');
-    console.log('  \x1b[37mclaude mcp add trace -- npx github:VK-Amogh/TRACE mcp\x1b[0m\n');
+    console.log('  \x1b[37mclaude mcp add trace -- npx trace-sec mcp\x1b[0m\n');
     process.exit(0);
   } else {
     console.error(`[TRACE] Bundle directory not found at ${bundleDir}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trace-sec",
-  "version": "2.1.3",
+  "version": "2.1.5",
   "description": "Threat Reconnaissance & Attack-path Correlation Engine — Security Verification Layer for Coding Agents with Fine-Tuned SecureBERT 2.0 & Laya AI",
   "type": "module",
   "main": "bin/trace.js",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "trace-sec"
-version = "1.0.0"
+version = "2.1.5"
 description = "Threat Reconnaissance & Attack-path Correlation Engine"
 readme = "README.md"
 requires-python = ">=3.11"

package/src/trace_engine/cli.py

@@ -320,6 +320,10 @@ def scan(
 ):
     """Execute end-to-end scan: Ingestion -> APM -> Signals -> Runtime Tests -> Correlated Findings."""
     project_dir = path.resolve()
+    from trace_engine.intelligence.downloader import prompt_and_bootstrap_models
+    if not prompt_and_bootstrap_models(interactive=True):
+        raise typer.Exit(code=1)
+
     config = load_config(project_dir)
 
     console.print(f"\n[bold green]Starting TRACE Full Scan[/bold green] on [white]{project_dir.name}[/white]")
@@ -438,6 +442,11 @@ def test_all(
     from trace_engine.intelligence.orchestrator import IntelligenceOrchestrator
 
     project_dir = path.resolve()
+    if models:
+        from trace_engine.intelligence.downloader import prompt_and_bootstrap_models
+        if not prompt_and_bootstrap_models(interactive=True):
+            raise typer.Exit(code=1)
+
     config = load_config(project_dir)
 
     resolved_target = target if target else (config.target.url or "http://127.0.0.1:18080")
@@ -824,29 +833,53 @@ def verify(
 
 
 @app.command()
-def mcp():
-    """Start the TRACE Model Context Protocol (MCP) server over stdio for Claude Code / Codex."""
+def mcp(
+    server: bool = typer.Option(False, "--server", "-s", help="Run local HTTP/SSE server instead of stdio"),
+    host: str = typer.Option("127.0.0.1", "--host", "-h", help="Host interface to bind HTTP/SSE server"),
+    port: int = typer.Option(8765, "--port", "-p", help="Port to bind HTTP/SSE server"),
+):
+    """Start TRACE Model Context Protocol (MCP) server for Claude Code and coding agents."""
+    from trace_engine.mcp.server import TraceMCPServer
+
+    mcp_obj = TraceMCPServer()
+    if server:
+        mcp_obj.run_sse_server(host=host, port=port)
+    else:
+        mcp_obj.run_stdio()
+
+
+@app.command(name="mcp-server")
+@app.command(name="serve-mcp")
+def mcp_server_cmd(
+    host: str = typer.Option("127.0.0.1", "--host", "-h", help="Host interface to bind HTTP/SSE server"),
+    port: int = typer.Option(8765, "--port", "-p", help="Port to bind HTTP/SSE server"),
+):
+    """Start local HTTP/SSE TRACE MCP server and display connection link for Claude Code."""
     from trace_engine.mcp.server import TraceMCPServer
 
-    server = TraceMCPServer()
-    server.run_stdio()
+    mcp_obj = TraceMCPServer()
+    mcp_obj.run_sse_server(host=host, port=port)
 
 
 @app.command("setup-mcp")
 def setup_mcp(
     path: Path = typer.Argument(Path("."), help="Path to project repository")
 ):
-    """Generate .mcp.json and configure MCP coding agent integration (Section 64)."""
+    """Generate .mcp.json and configure MCP coding agent integration."""
     from trace_engine.mcp.config import generate_mcp_json
 
     project_dir = path.resolve()
     mcp_file = generate_mcp_json(project_dir)
 
     console.print(f"\n[bold green]Configured TRACE MCP[/bold green] in [white]{mcp_file}[/white]")
-    console.print("\n[bold white]Connect to Claude Code:[/bold white]")
-    console.print("  [green]claude mcp add trace -- cmd /c npx -y @trace-security/trace mcp[/green]")
-    console.print("\n[bold white]Connect to Codex / Cursor / Antigravity:[/bold white]")
-    console.print("  [dim]The generated .mcp.json is already recognized by compatible IDEs and CLI agents.[/dim]\n")
+    console.print("\n[bold white]Option A: Direct Stdio Integration in Claude Code:[/bold white]")
+    console.print("  [green]claude mcp add trace -- npx -y trace-sec mcp[/green]")
+    console.print("\n[bold white]Option B: Local HTTP/SSE Server Link (Real-Time Bridge):[/bold white]")
+    console.print("  1. Launch server: [bold green]trace mcp-server[/bold green]")
+    console.print("  2. Connect via CLI: [green]claude mcp add --transport sse trace http://127.0.0.1:8765/sse[/green]")
+    console.print("  3. Or paste [cyan]http://127.0.0.1:8765/sse[/cyan] directly in your Claude Code chat!")
+    console.print("\n[bold white]Option C: Cursor IDE / Antigravity / Claude Code:[/bold white]")
+    console.print("  [dim]The created .mcp.json is already active in your workspace.[/dim]\n")
 
 
 @app.command()
@@ -885,6 +918,10 @@ def remediate(
     """Execute autonomous Agent Harness self-healing and remediation loop: patch vulnerabilities and verify fixes."""
     from trace_engine.harness.engine import AgentHarness
 
+    from trace_engine.intelligence.downloader import prompt_and_bootstrap_models
+    if not prompt_and_bootstrap_models(interactive=True):
+        raise typer.Exit(code=1)
+
     target_path = repo or path
     _, resolved_dir = resolve_finding_store(target_path.resolve())
     resolved_target = target or "http://127.0.0.1:18082"
@@ -1178,6 +1215,82 @@ def bench_intelligence():
     run_intelligence_benchmark()
 
 
+@app.command(name="setup-models")
+@app.command(name="download-models")
+def setup_models():
+    """Download and provision fine-tuned SecureBERT 2.0 and Laya System 1 weights into ~/.trace/models."""
+    from trace_engine.intelligence.downloader import ensure_all_models
+    console.print("\n[bold green]TRACE Neural Model Provisioner[/bold green]")
+    console.print("[dim]Fetching fine-tuned weights from TRACE Git LFS Hub into ~/.trace/models...[/dim]\n")
+    ensure_all_models()
+    console.print("[bold green]✓ All fine-tuned models are installed, verified, and ready.[/bold green]\n")
+
+
+@app.command(name="install-skill")
+@app.command(name="setup-agent")
+def install_skill(
+    target_dir: Path = typer.Option(Path("."), "--target", "-t", help="Target repository directory to install skills and MCP"),
+):
+    """Install TRACE autonomous agent skill & MCP configurations for Claude Code, Antigravity, and Cursor."""
+    import shutil
+    project_root = Path(__file__).resolve().parents[2]
+    bundle_dir = project_root / "src" / "trace_engine" / "plugin" / "bundle"
+    target = target_dir.resolve()
+
+    console.print("\n[bold green]Installing TRACE Autonomous Security Agent Skill & MCP Tools...[/bold green]")
+
+    if bundle_dir.exists():
+        # 1. Antigravity plugin (.agents/plugins/trace-security)
+        agent_plugin_dir = target / ".agents" / "plugins" / "trace-security"
+        agent_plugin_dir.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copytree(bundle_dir, agent_plugin_dir, dirs_exist_ok=True)
+        console.print(f"  [bold green]✓[/bold green] Antigravity Plugin : [white]{agent_plugin_dir}[/white]")
+
+        # 2. Agent Skill & Claude Code Skill
+        skill_src = bundle_dir / "skills" / "trace-security-harness"
+        if skill_src.exists():
+            agent_skill_dir = target / ".agents" / "skills" / "trace-security-harness"
+            agent_skill_dir.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copytree(skill_src, agent_skill_dir, dirs_exist_ok=True)
+            console.print(f"  [bold green]✓[/bold green] Agent Skill        : [white]{agent_skill_dir}[/white]")
+
+            claude_skill_dir = target / ".claude" / "skills" / "trace-security"
+            claude_skill_dir.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copytree(skill_src, claude_skill_dir, dirs_exist_ok=True)
+            console.print(f"  [bold green]✓[/bold green] Claude Code Skill  : [white]{claude_skill_dir}[/white]")
+
+        # 3. MCP Configuration
+        import json
+        is_win = sys.platform == "win32"
+        mcp_config = {
+            "mcpServers": {
+                "trace": {
+                    "command": "cmd.exe" if is_win else "npx",
+                    "args": ["/c", "npx", "-y", "trace-sec", "mcp"] if is_win else ["-y", "trace-sec", "mcp"],
+                    "env": {
+                        "PYTHONUNBUFFERED": "1"
+                    }
+                }
+            }
+        }
+        mcp_json = target / ".mcp.json"
+        mcp_json.write_text(json.dumps(mcp_config, indent=2), encoding="utf-8")
+        console.print(f"  [bold green]✓[/bold green] Claude Code MCP    : [white]{mcp_json}[/white]")
+
+        cursor_dir = target / ".cursor"
+        cursor_dir.mkdir(parents=True, exist_ok=True)
+        (cursor_dir / "mcp.json").write_text(json.dumps(mcp_config, indent=2), encoding="utf-8")
+        console.print(f"  [bold green]✓[/bold green] Cursor IDE MCP     : [white]{cursor_dir / 'mcp.json'}[/white]")
+
+        console.print("\n[bold]Capabilities Enabled for AI Coding Agents:[/bold]")
+        console.print("  • [bold green]Claude Code Integration:[/bold green] Skills + MCP server configured")
+        console.print("  • [bold green]Antigravity & Agentic IDEs:[/bold green] .agents/plugins/trace-security active")
+        console.print("  • [bold green]Verification Tools:[/bold green] trace_scan, trace_findings, trace_verify, trace_harness_task\n")
+    else:
+        console.print(f"[bold red]Error:[/bold red] Plugin bundle not found at {bundle_dir}")
+        raise typer.Exit(code=1)
+
+
 if __name__ == "__main__":
     app()
 

package/src/trace_engine/intelligence/downloader.py

@@ -0,0 +1,267 @@
+"""Automated model downloader, verification gate, and provisioner for TRACE fine-tuned weights."""
+
+import os
+import sys
+import logging
+import urllib.request
+from pathlib import Path
+from typing import Optional, Dict, List, Any
+
+logger = logging.getLogger(__name__)
+
+REPO_OWNER = "VK-Amogh"
+REPO_NAME = "TRACE"
+BRANCH = "main"
+
+MODEL_REGISTRY: Dict[str, Dict[str, Any]] = {
+    "securebert-finetuned": {
+        "files": {
+            "config.json": {
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/securebert-finetuned/config.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/config.json",
+                ],
+                "min_size": 500,
+            },
+            "tokenizer.json": {
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/securebert-finetuned/tokenizer.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/tokenizer.json",
+                ],
+                "min_size": 1000000,
+            },
+            "tokenizer_config.json": {
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/securebert-finetuned/tokenizer_config.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/tokenizer_config.json",
+                ],
+                "min_size": 200,
+            },
+            "model.safetensors": {
+                "urls": [
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/securebert-finetuned/model.safetensors",
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/model.safetensors",
+                ],
+                "min_size": 100000000,  # ~498 MB
+            },
+        },
+    },
+    "laya-finetuned": {
+        "files": {
+            "laya_metadata.json": {
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/laya-finetuned/laya_metadata.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_metadata.json",
+                ],
+                "min_size": 300,
+            },
+            "tokenizer.json": {
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/laya-finetuned/tokenizer.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/tokenizer.json",
+                ],
+                "min_size": 500000,
+            },
+            "tokenizer_config.json": {
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/laya-finetuned/tokenizer_config.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/tokenizer_config.json",
+                ],
+                "min_size": 200,
+            },
+            "laya_dual_head.onnx": {
+                "urls": [
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/laya-finetuned/laya_dual_head.onnx",
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_dual_head.onnx",
+                ],
+                "min_size": 50000000,  # ~267 MB
+            },
+            "laya_dual_head.pt": {
+                "urls": [
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/laya-finetuned/laya_dual_head.pt",
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_dual_head.pt",
+                ],
+                "min_size": 50000000,  # ~267 MB
+            },
+        },
+    },
+}
+
+
+def get_default_models_dir() -> Path:
+    """Returns the default persistent directory for TRACE models (~/.trace/models)."""
+    target = Path.home() / ".trace" / "models"
+    target.mkdir(parents=True, exist_ok=True)
+    return target
+
+
+def is_model_installed(model_name: str, candidate_dir: Optional[Path] = None) -> bool:
+    """Checks if all required model files are present and valid (not empty or git lfs pointer stubs)."""
+    if model_name not in MODEL_REGISTRY:
+        return False
+
+    spec = MODEL_REGISTRY[model_name]
+    target_dir = candidate_dir or (get_default_models_dir() / model_name)
+    if not target_dir.exists():
+        return False
+
+    for filename, meta in spec["files"].items():
+        file_path = target_dir / filename
+        if not file_path.exists():
+            return False
+        if file_path.stat().st_size < meta["min_size"]:
+            return False
+
+    return True
+
+
+def is_environment_ready() -> bool:
+    """Checks if both fine-tuned SecureBERT 2.0 and Laya System 1 models are installed and valid."""
+    repo_root = Path(__file__).resolve().parents[4]
+    candidate_roots = [
+        Path.home() / ".trace" / "models",
+        Path("models"),
+        Path(".trace/models"),
+        repo_root / "models",
+        repo_root / ".trace/models",
+        Path("D:/Startup/TRACE/models"),
+        Path("D:/Startup/TRACE/.trace/models"),
+    ]
+
+    sb_ok = False
+    laya_ok = False
+
+    for r in candidate_roots:
+        if not sb_ok and is_model_installed("securebert-finetuned", r / "securebert-finetuned"):
+            sb_ok = True
+        if not laya_ok and is_model_installed("laya-finetuned", r / "laya-finetuned"):
+            laya_ok = True
+        if sb_ok and laya_ok:
+            return True
+
+    return False
+
+
+def ensure_model(model_name: str) -> Path:
+    """Ensures model is installed locally; downloads missing files from GitHub LFS/Repo if needed."""
+    models_dir = get_default_models_dir()
+    target_dir = models_dir / model_name
+    target_dir.mkdir(parents=True, exist_ok=True)
+
+    if is_model_installed(model_name, target_dir):
+        return target_dir
+
+    if model_name not in MODEL_REGISTRY:
+        raise ValueError(f"Unknown model: {model_name}")
+
+    spec = MODEL_REGISTRY[model_name]
+    print(f"\n\033[38;2;16;185;129m[TRACE Model Hub]\033[0m Downloading fine-tuned {model_name} neural weights...")
+
+    for filename, meta in spec["files"].items():
+        file_path = target_dir / filename
+        if file_path.exists() and file_path.stat().st_size >= meta["min_size"]:
+            continue
+
+        temp_path = target_dir / f"{filename}.tmp"
+        urls = meta.get("urls", [])
+        print(f"  \033[38;2;255;158;59m›\033[0m Fetching {filename}...")
+
+        success = False
+        last_error = None
+        for url in urls:
+            try:
+                req = urllib.request.Request(
+                    url,
+                    headers={"User-Agent": "TRACE-Security-Engine/2.1 (github:VK-Amogh/TRACE)"},
+                )
+                with urllib.request.urlopen(req, timeout=120) as resp:
+                    total_size = int(resp.headers.get("Content-Length", 0))
+                    downloaded = 0
+                    block_size = 1024 * 1024  # 1 MB chunk
+
+                    with open(temp_path, "wb") as f:
+                        while True:
+                            chunk = resp.read(block_size)
+                            if not chunk:
+                                break
+                            f.write(chunk)
+                            downloaded += len(chunk)
+                            if total_size > 0:
+                                percent = (downloaded / total_size) * 100
+                                mb_down = downloaded / (1024 * 1024)
+                                mb_tot = total_size / (1024 * 1024)
+                                sys.stdout.write(f"\r    [{percent:.1f}%] {mb_down:.1f} MB / {mb_tot:.1f} MB")
+                                sys.stdout.flush()
+
+                print()
+                if temp_path.exists():
+                    temp_path.replace(file_path)
+                success = True
+                break
+
+            except Exception as e:
+                last_error = e
+                if temp_path.exists():
+                    try:
+                        temp_path.unlink()
+                    except Exception:
+                        pass
+                continue
+
+        if not success:
+            logger.warning(f"Failed to download {filename}: {last_error}")
+            raise RuntimeError(f"Could not download {filename} for {model_name}: {last_error}")
+
+    print(f"\033[38;2;16;185;129m✓ Successfully provisioned {model_name}\033[0m\n")
+    return target_dir
+
+
+def ensure_all_models() -> None:
+    """Proactively ensures all fine-tuned models are downloaded and verified."""
+    for model_name in MODEL_REGISTRY:
+        ensure_model(model_name)
+
+
+def prompt_and_bootstrap_models(interactive: bool = True) -> bool:
+    """Interactive gate: checks if models are installed, prompts user to agree and downloads them."""
+    if is_environment_ready():
+        return True
+
+    CYAN = "\033[38;2;56;189;248m"
+    GREEN = "\033[38;2;16;185;129m"
+    ORANGE = "\033[38;2;255;158;59m"
+    BOLD = "\033[1m"
+    DIM = "\033[2m"
+    RESET = "\033[0m"
+
+    print(f"\n  {GREEN}┌{'─' * 74}┐{RESET}")
+  
+    print(f"  {GREEN}│{RESET}  {BOLD}TRACE Neural Intelligence Engine — First-Time Environment Setup{RESET}        {GREEN}│{RESET}")
+    print(f"  {GREEN}├{'─' * 74}┤{RESET}")
+    print(f"  {GREEN}│{RESET}  TRACE requires fine-tuned neural models for autonomous AST attack-path      {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}  correlation and vulnerability verification:                                {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}   • {CYAN}SecureBERT 2.0{RESET}  (Fine-Tuned OWASP API Vulnerability Classifier)          {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}   • {CYAN}Laya System 1{RESET}   (Non-Autoregressive Fast Decision & Priority Router)     {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}                                                                          {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}  {DIM}Dedicated Location : ~/.trace/models/{RESET}                                     {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}  {DIM}Source             : Official TRACE Git LFS Hub (github:VK-Amogh/TRACE){RESET}   {GREEN}│{RESET}")
+    print(f"  {GREEN}└{'─' * 74}┘{RESET}\n")
+
+    if not interactive or not sys.stdin.isatty():
+        print(f"  {ORANGE}[!] Non-interactive environment detected. Run 'trace setup-models' to install.{RESET}\n")
+        return False
+
+    try:
+        ans = input(f"  {ORANGE}›{RESET} {BOLD}Download and configure fine-tuned neural models now? (y/n) [y]:{RESET} ").strip().lower()
+        if ans in ("", "y", "yes"):
+            ensure_all_models()
+            print(f"  {GREEN}✓ TRACE Neural Intelligence Engine initialized successfully.{RESET}\n")
+            return True
+        else:
+            print(f"\n  {ORANGE}[!] TRACE setup cancelled.{RESET}")
+            print(f"  {DIM}Fine-tuned neural intelligence models are required to perform security audits.{RESET}")
+            print(f"  {DIM}Run 'trace setup-models' at any time to configure the engine.{RESET}\n")
+            return False
+    except (KeyboardInterrupt, EOFError):
+        print(f"\n  {ORANGE}[!] Cancelled.{RESET}\n")
+        return False

package/src/trace_engine/intelligence/laya/router.py

@@ -57,10 +57,14 @@ class LayaDecisionEngine:
     def _resolve_laya_dir(self) -> Optional[Path]:
         """Resolves Laya model directory across project root, package dir, and home."""
         candidates = [
+            Path.home() / ".trace/models/laya-finetuned",
+            Path("models/laya-finetuned"),
             Path(".trace/models/laya-finetuned"),
+            Path(__file__).resolve().parents[4] / "models/laya-finetuned",
             Path(__file__).resolve().parents[4] / ".trace/models/laya-finetuned",
             Path(__file__).resolve().parents[2] / "models/laya-finetuned",
-            Path.home() / ".trace/models/laya-finetuned",
+            Path("D:/Startup/TRACE/models/laya-finetuned"),
+            Path("D:/Startup/TRACE/.trace/models/laya-finetuned"),
         ]
         repo_root = Path(__file__).resolve().parents[4]
         for p in candidates:
@@ -76,6 +80,13 @@ class LayaDecisionEngine:
                 return p.resolve()
             if onnx_file.exists() and onnx_file.stat().st_size >= 10000:
                 return p.resolve()
+
+        try:
+            from trace_engine.intelligence.downloader import ensure_model
+            return ensure_model("laya-finetuned")
+        except Exception as e:
+            logger.debug(f"Automatic Laya download deferred: {e}")
+
         return None
 
     def _load_onnx_model(self) -> None:
@@ -125,8 +136,11 @@ class LayaDecisionEngine:
     def _load_agent(self) -> None:
         """Attempt to load Laya in-process model."""
         try:
-            import laya
-            self._agent = laya.load(self.model_id)
+            import warnings
+            with warnings.catch_warnings():
+                warnings.filterwarnings("ignore", category=RuntimeWarning)
+                import laya
+                self._agent = laya.load(self.model_id)
             logger.info(f"Laya agent loaded: {self.model_id}")
         except Exception as e:
             logger.debug(f"Laya in-process loading: {e}. Using calibrated fallback.")

package/src/trace_engine/intelligence/securebert/classifier.py

@@ -34,12 +34,17 @@ class SecureBERTClassifier:
         cache_path: Optional[Path] = None,
     ):
         candidates = [
+            Path.home() / ".trace/models/securebert-finetuned",
+            Path("models/securebert-finetuned"),
             Path(".trace/models/securebert-finetuned"),
+            Path(__file__).resolve().parents[4] / "models/securebert-finetuned",
             Path(__file__).resolve().parents[4] / ".trace/models/securebert-finetuned",
             Path(__file__).resolve().parents[2] / "models/securebert-finetuned",
-            Path.home() / ".trace/models/securebert-finetuned",
+            Path("D:/Startup/TRACE/models/securebert-finetuned"),
+            Path("D:/Startup/TRACE/.trace/models/securebert-finetuned"),
         ]
-        default_model = "ehsanaghaei/SecureBERT"
+        default_model = None
+        repo_root = Path(__file__).resolve().parents[4]
         for cand in candidates:
             weight_file = cand / "model.safetensors"
             if weight_file.exists():
@@ -53,6 +58,15 @@ class SecureBERTClassifier:
                     default_model = str(cand.resolve())
                     break
 
+        if not default_model:
+            try:
+                from trace_engine.intelligence.downloader import ensure_model
+                model_dir = ensure_model("securebert-finetuned")
+                default_model = str(model_dir.resolve())
+            except Exception as e:
+                logger.debug(f"Automatic model download deferred: {e}")
+                default_model = "ehsanaghaei/SecureBERT"
+
         self.model_name = model_name or default_model
         cache_file = cache_path or Path(".trace/cache/securebert_cache.json")
         self.cache = SecureBERTCache(cache_file)
@@ -68,6 +82,8 @@ class SecureBERTClassifier:
         self._initialized = True
         try:
             import torch
+            import transformers
+            transformers.logging.set_verbosity_error()
             from transformers import AutoTokenizer, AutoModelForSequenceClassification
 
             self._device = "cuda" if torch.cuda.is_available() else "cpu"

package/src/trace_engine/interactive.py

@@ -278,6 +278,10 @@ def run_interactive_story() -> None:
     """Executes the complete interactive, step-by-step security audit story."""
     render_big_banner(animated=True)
 
+    from trace_engine.intelligence.downloader import prompt_and_bootstrap_models
+    if not prompt_and_bootstrap_models(interactive=True):
+        return
+
     console.print(f"  [{WHITE}]Welcome, Security Operator. TRACE stands ready to audit, verify, and heal codebases.[/{WHITE}]")
     console.print(f"  [{DIM_WHITE}]Navigate using the options below (type 'exit' or 'q' at any prompt to quit).[/{DIM_WHITE}]\n")
 
@@ -288,26 +292,33 @@ def run_interactive_story() -> None:
     console.print(f"    [{ORANGE}][1][/{ORANGE}] [{BOLD_WHITE}]Full Security Audit[/{BOLD_WHITE}] [{GREEN}]★ RECOMMENDED[/{GREEN}] [{DIM_WHITE}]─ Multi-language AST, APM graph, & Neural AI[/{DIM_WHITE}]")
     console.print(f"    [{ORANGE}][2][/{ORANGE}] [{BOLD_WHITE}]Targeted Vulnerability Probes[/{BOLD_WHITE}] [{DIM_WHITE}]─ Select specific testpacks (BOLA, SQLi, SSRF, BFLA)[/{DIM_WHITE}]")
     console.print(f"    [{ORANGE}][3][/{ORANGE}] [{BOLD_WHITE}]Autonomous AST Self-Healing[/{BOLD_WHITE}] [{DIM_WHITE}]─ Surgical refactoring with live rollback verification[/{DIM_WHITE}]")
-    console.print(f"    [{ORANGE}][4][/{ORANGE}] [{BOLD_WHITE}]How TRACE Works & Architecture Guide[/{BOLD_WHITE}] [{GREEN}]★ 5 Q&A[/{GREEN}] [{DIM_WHITE}]─ Interactive architectural diagram & neural models[/{DIM_WHITE}]")
-    console.print(f"    [{ORANGE}][5][/{ORANGE}] [{BOLD_WHITE}]Environment Diagnostics (Doctor)[/{BOLD_WHITE}] [{DIM_WHITE}]─ Inspect local security tools and dependencies[/{DIM_WHITE}]")
-    console.print(f"    [{ORANGE}][6][/{ORANGE}] [{BOLD_WHITE}]Exit[/{BOLD_WHITE}]\n")
+    console.print(f"    [{ORANGE}][4][/{ORANGE}] [{BOLD_WHITE}]Start Claude Code Local MCP Server[/{BOLD_WHITE}] [{GREEN}]★ LOCAL MCP[/{GREEN}] [{DIM_WHITE}]─ Run HTTP/SSE bridge for Claude Code chat[/{DIM_WHITE}]")
+    console.print(f"    [{ORANGE}][5][/{ORANGE}] [{BOLD_WHITE}]How TRACE Works & Architecture Guide[/{BOLD_WHITE}] [{DIM_WHITE}]─ Interactive architectural diagram & neural models[/{DIM_WHITE}]")
+    console.print(f"    [{ORANGE}][6][/{ORANGE}] [{BOLD_WHITE}]Environment Diagnostics (Doctor)[/{BOLD_WHITE}] [{DIM_WHITE}]─ Inspect local security tools and dependencies[/{DIM_WHITE}]")
+    console.print(f"    [{ORANGE}][7][/{ORANGE}] [{BOLD_WHITE}]Exit[/{BOLD_WHITE}]\n")
 
     choice = ask_input(
         f"  [{ORANGE}]›[/{ORANGE}] [{BOLD_WHITE}]Choose option[/{BOLD_WHITE}]",
-        choices=["1", "2", "3", "4", "5", "6"],
+        choices=["1", "2", "3", "4", "5", "6", "7"],
         default="1",
         show_default=True,
     )
 
-    if choice == "6":
+    if choice == "7":
         console.print(f"\n  [{GREEN}]✓ TRACE session closed. Happy hacking![/{GREEN}]\n")
         return
 
     if choice == "4":
-        run_architecture_guide()
+        from trace_engine.mcp.server import TraceMCPServer
+        mcp_obj = TraceMCPServer()
+        mcp_obj.run_sse_server(host="127.0.0.1", port=8765)
         return
 
     if choice == "5":
+        run_architecture_guide()
+        return
+
+    if choice == "6":
         display_story_header(2, 2, "Environment Diagnostics", "Auditing local dependencies and runtime requirements")
         from trace_engine.doctor import run_doctor
         report = run_doctor(Path("."))

package/src/trace_engine/mcp/server.py

@@ -396,3 +396,174 @@ class TraceMCPServer:
                 }
                 sys.stdout.write(json.dumps(err_resp) + "\n")
                 sys.stdout.flush()
+
+    def run_sse_server(self, host: str = "127.0.0.1", port: int = 8765):
+        """Run an MCP HTTP/SSE transport server for Claude Code and local AI coding agents."""
+        import uuid
+        import queue
+        import urllib.parse
+        from http.server import ThreadingHTTPServer, BaseHTTPRequestHandler
+
+        sessions: Dict[str, queue.Queue] = {}
+        server_instance = self
+
+        class MCPHandler(BaseHTTPRequestHandler):
+            def log_message(self, format, *args):
+                pass  # Suppress request clutter in terminal
+
+            def do_OPTIONS(self):
+                self.send_response(200)
+                self.send_header("Access-Control-Allow-Origin", "*")
+                self.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+                self.send_header("Access-Control-Allow-Headers", "Content-Type, Authorization")
+                self.end_headers()
+
+            def do_GET(self):
+                parsed = urllib.parse.urlparse(self.path)
+                if parsed.path == "/sse":
+                    session_id = uuid.uuid4().hex
+                    msg_queue: queue.Queue = queue.Queue()
+                    sessions[session_id] = msg_queue
+
+                    self.send_response(200)
+                    self.send_header("Content-Type", "text/event-stream")
+                    self.send_header("Cache-Control", "no-cache")
+                    self.send_header("Connection", "keep-alive")
+                    self.send_header("Access-Control-Allow-Origin", "*")
+                    self.end_headers()
+
+                    # Emit endpoint event as defined in MCP SSE transport specification
+                    endpoint_msg = f"event: endpoint\r\ndata: /message?sessionId={session_id}\r\n\r\n"
+                    self.wfile.write(endpoint_msg.encode("utf-8"))
+                    self.wfile.flush()
+
+                    try:
+                        while server_instance.running:
+                            try:
+                                msg = msg_queue.get(timeout=1.0)
+                                if msg is None:
+                                    break
+                                event_str = f"event: message\r\ndata: {json.dumps(msg)}\r\n\r\n"
+                                self.wfile.write(event_str.encode("utf-8"))
+                                self.wfile.flush()
+                            except queue.Empty:
+                                self.wfile.write(b": keepalive\r\n\r\n")
+                                self.wfile.flush()
+                    except (BrokenPipeError, ConnectionResetError):
+                        pass
+                    finally:
+                        sessions.pop(session_id, None)
+
+                elif parsed.path in ("/health", "/status"):
+                    self.send_response(200)
+                    self.send_header("Content-Type", "application/json")
+                    self.send_header("Access-Control-Allow-Origin", "*")
+                    self.end_headers()
+                    status_info = {
+                        "status": "online",
+                        "server": "TRACE MCP Server v2.1",
+                        "transport": "sse",
+                        "sse_url": f"http://{host}:{port}/sse",
+                        "active_sessions": len(sessions),
+                        "tools": [t["name"] for t in TRACE_TOOLS],
+                    }
+                    self.wfile.write(json.dumps(status_info, indent=2).encode("utf-8"))
+
+                else:
+                    self.send_response(200)
+                    self.send_header("Content-Type", "text/html; charset=utf-8")
+                    self.send_header("Access-Control-Allow-Origin", "*")
+                    self.end_headers()
+                    html = f"""<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>TRACE Local MCP Server</title>
+  <style>
+    body {{ font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background: #0b0f17; color: #f8fafc; padding: 40px; margin: 0; }}
+    .container {{ max-width: 680px; margin: 0 auto; background: #131b2e; border: 1px solid #10b981; border-radius: 12px; padding: 32px; box-shadow: 0 10px 25px rgba(0,0,0,0.5); }}
+    h1 {{ color: #10b981; margin-top: 0; display: flex; align-items: center; gap: 10px; font-size: 24px; }}
+    .badge {{ background: #10b981; color: #0b0f17; padding: 3px 8px; border-radius: 4px; font-size: 12px; font-weight: bold; }}
+    p {{ color: #94a3b8; font-size: 14px; line-height: 1.6; }}
+    .cmd-box {{ background: #070a12; border: 1px solid #1e293b; border-radius: 6px; padding: 12px 16px; margin: 12px 0; font-family: monospace; color: #38bdf8; font-size: 13px; word-break: break-all; }}
+    .section-title {{ color: #ffffff; font-size: 14px; font-weight: bold; margin-top: 20px; }}
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>TRACE MCP Server <span class="badge">ONLINE</span></h1>
+    <p>Local Model Context Protocol (MCP) server listening for Claude Code and AI coding agents.</p>
+    
+    <div class="section-title">Local MCP Endpoint Link:</div>
+    <div class="cmd-box">http://{host}:{port}/sse</div>
+
+    <div class="section-title">Connect via Claude Code CLI:</div>
+    <div class="cmd-box">claude mcp add --transport sse trace http://{host}:{port}/sse</div>
+
+    <div class="section-title">Connect in Claude Chat:</div>
+    <p>Paste the local MCP link into your Claude chat to grant autonomous AST scanning and verification powers:</p>
+    <div class="cmd-box">http://{host}:{port}/sse</div>
+  </div>
+</body>
+</html>"""
+                    self.wfile.write(html.encode("utf-8"))
+
+            def do_POST(self):
+                parsed = urllib.parse.urlparse(self.path)
+                if parsed.path.startswith("/message"):
+                    query = urllib.parse.parse_qs(parsed.query)
+                    session_id = query.get("sessionId", [None])[0]
+
+                    content_len = int(self.headers.get("Content-Length", 0))
+                    body = self.rfile.read(content_len).decode("utf-8")
+                    try:
+                        req = json.loads(body)
+                        resp = server_instance.handle_request(req)
+                    except Exception as e:
+                        resp = {
+                            "jsonrpc": "2.0",
+                            "id": None,
+                            "error": {"code": -32603, "message": str(e)},
+                        }
+
+                    if session_id and session_id in sessions and resp:
+                        sessions[session_id].put(resp)
+
+                    self.send_response(200)
+                    self.send_header("Content-Type", "application/json")
+                    self.send_header("Access-Control-Allow-Origin", "*")
+                    self.end_headers()
+                    self.wfile.write(json.dumps(resp or {"jsonrpc": "2.0", "result": None}).encode("utf-8"))
+                else:
+                    self.send_response(404)
+                    self.end_headers()
+
+        GREEN = "\033[38;2;16;185;129m"
+        CYAN = "\033[38;2;56;189;248m"
+        ORANGE = "\033[38;2;255;158;59m"
+        BOLD = "\033[1m"
+        DIM = "\033[2m"
+        RESET = "\033[0m"
+
+        print(f"\n  {GREEN}┌{'─' * 74}┐{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}TRACE Local MCP Server (Model Context Protocol){RESET}                     {GREEN}│{RESET}")
+        print(f"  {GREEN}├{'─' * 74}┤{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}Local MCP Link   :{RESET} {CYAN}http://{host}:{port}/sse{RESET}{' ' * max(0, 39 - len(f'http://{host}:{port}/sse'))}{GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}Web Dashboard    :{RESET} {CYAN}http://{host}:{port}/{RESET}{' ' * max(0, 42 - len(f'http://{host}:{port}/'))}{GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}Status           :{RESET} {GREEN}ONLINE{RESET} (Listening for Claude Code & AI Coding Agents)  {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}                                                                          {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}Connect in Claude Code CLI:{RESET}                                             {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}   {ORANGE}›{RESET} {BOLD}claude mcp add --transport sse trace http://{host}:{port}/sse{RESET}          {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}                                                                          {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}Or paste this link directly in your Claude Code chat:{RESET}                   {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}   {CYAN}http://{host}:{port}/sse{RESET}{' ' * max(0, 49 - len(f'http://{host}:{port}/sse'))}{GREEN}│{RESET}")
+        print(f"  {GREEN}└{'─' * 74}┘{RESET}\n")
+        print(f"  {DIM}Press Ctrl+C to terminate the local MCP server.{RESET}\n")
+
+        httpd = ThreadingHTTPServer((host, port), MCPHandler)
+        try:
+            httpd.serve_forever()
+        except KeyboardInterrupt:
+            print(f"\n  {ORANGE}[TRACE] MCP Server stopped.{RESET}\n")
+        finally:
+            httpd.server_close()