trace-sec 2.1.4 → 2.1.6

package/bin/trace.js

@@ -5,7 +5,7 @@
  * Node.js & NPX launcher for TRACE Python engine.
  */
 
-import { spawn } from 'child_process';
+import { spawn, execSync } from 'child_process';
 import { existsSync, mkdirSync, cpSync, writeFileSync } from 'fs';
 import { resolve, join, dirname } from 'path';
 import { fileURLToPath } from 'url';
@@ -102,6 +102,48 @@ for (const cand of candidatePythons) {
   }
 }
 
+// Verify that the resolved Python environment has required TRACE dependencies
+let depsOk = false;
+try {
+  execSync(`"${pythonBin}" -c "import typer, rich, pydantic"`, { stdio: 'ignore' });
+  depsOk = true;
+} catch (e) {
+  depsOk = false;
+}
+
+if (!depsOk) {
+  const dedicatedVenv = join(userHome, '.trace', 'venv');
+  const venvPython = join(dedicatedVenv, isWin ? 'Scripts' : 'bin', isWin ? 'python.exe' : 'python');
+
+  if (existsSync(venvPython)) {
+    try {
+      execSync(`"${venvPython}" -c "import typer, rich, pydantic"`, { stdio: 'ignore' });
+      pythonBin = venvPython;
+      depsOk = true;
+    } catch (e) {
+      depsOk = false;
+    }
+  }
+
+  if (!depsOk) {
+    console.log('\n\x1b[32m\x1b[1m[TRACE]\x1b[0m Initializing TRACE runtime dependencies in dedicated environment (~/.trace/venv)...');
+    try {
+      mkdirSync(join(userHome, '.trace'), { recursive: true });
+      if (!existsSync(venvPython)) {
+        console.log('  \x1b[38;2;255;158;59m›\x1b[0m Creating Python virtual environment in ~/.trace/venv...');
+        execSync(`"${pythonBin}" -m venv "${dedicatedVenv}"`, { stdio: 'inherit' });
+      }
+      console.log('  \x1b[38;2;255;158;59m›\x1b[0m Installing core dependencies (typer, rich, pydantic, tree-sitter, torch, transformers)...');
+      execSync(`"${venvPython}" -m pip install typer rich pydantic pydantic-settings networkx httpx orjson tomli-w tree-sitter tree-sitter-language-pack torch transformers safetensors onnxruntime numpy`, { stdio: 'inherit' });
+      pythonBin = venvPython;
+      console.log('\x1b[32m✓ Runtime dependencies provisioned successfully.\x1b[0m\n');
+    } catch (e) {
+      console.warn(`[TRACE] Automatic environment setup warning: ${e.message}`);
+      console.warn(`If command fails, install directly via: pip install git+https://github.com/VK-Amogh/TRACE.git\n`);
+    }
+  }
+}
+
 const cliArgs = ['-m', 'trace_engine.cli', ...args];
 
 const proc = spawn(pythonBin, cliArgs, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trace-sec",
-  "version": "2.1.4",
+  "version": "2.1.6",
   "description": "Threat Reconnaissance & Attack-path Correlation Engine — Security Verification Layer for Coding Agents with Fine-Tuned SecureBERT 2.0 & Laya AI",
   "type": "module",
   "main": "bin/trace.js",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "trace-sec"
-version = "2.1.4"
+version = "2.1.5"
 description = "Threat Reconnaissance & Attack-path Correlation Engine"
 readme = "README.md"
 requires-python = ">=3.11"

package/src/trace_engine/cli.py

@@ -320,6 +320,10 @@ def scan(
 ):
     """Execute end-to-end scan: Ingestion -> APM -> Signals -> Runtime Tests -> Correlated Findings."""
     project_dir = path.resolve()
+    from trace_engine.intelligence.downloader import prompt_and_bootstrap_models
+    if not prompt_and_bootstrap_models(interactive=True):
+        raise typer.Exit(code=1)
+
     config = load_config(project_dir)
 
     console.print(f"\n[bold green]Starting TRACE Full Scan[/bold green] on [white]{project_dir.name}[/white]")
@@ -438,6 +442,11 @@ def test_all(
     from trace_engine.intelligence.orchestrator import IntelligenceOrchestrator
 
     project_dir = path.resolve()
+    if models:
+        from trace_engine.intelligence.downloader import prompt_and_bootstrap_models
+        if not prompt_and_bootstrap_models(interactive=True):
+            raise typer.Exit(code=1)
+
     config = load_config(project_dir)
 
     resolved_target = target if target else (config.target.url or "http://127.0.0.1:18080")
@@ -824,29 +833,53 @@ def verify(
 
 
 @app.command()
-def mcp():
-    """Start the TRACE Model Context Protocol (MCP) server over stdio for Claude Code / Codex."""
+def mcp(
+    server: bool = typer.Option(False, "--server", "-s", help="Run local HTTP/SSE server instead of stdio"),
+    host: str = typer.Option("127.0.0.1", "--host", "-h", help="Host interface to bind HTTP/SSE server"),
+    port: int = typer.Option(8765, "--port", "-p", help="Port to bind HTTP/SSE server"),
+):
+    """Start TRACE Model Context Protocol (MCP) server for Claude Code and coding agents."""
+    from trace_engine.mcp.server import TraceMCPServer
+
+    mcp_obj = TraceMCPServer()
+    if server:
+        mcp_obj.run_sse_server(host=host, port=port)
+    else:
+        mcp_obj.run_stdio()
+
+
+@app.command(name="mcp-server")
+@app.command(name="serve-mcp")
+def mcp_server_cmd(
+    host: str = typer.Option("127.0.0.1", "--host", "-h", help="Host interface to bind HTTP/SSE server"),
+    port: int = typer.Option(8765, "--port", "-p", help="Port to bind HTTP/SSE server"),
+):
+    """Start local HTTP/SSE TRACE MCP server and display connection link for Claude Code."""
     from trace_engine.mcp.server import TraceMCPServer
 
-    server = TraceMCPServer()
-    server.run_stdio()
+    mcp_obj = TraceMCPServer()
+    mcp_obj.run_sse_server(host=host, port=port)
 
 
 @app.command("setup-mcp")
 def setup_mcp(
     path: Path = typer.Argument(Path("."), help="Path to project repository")
 ):
-    """Generate .mcp.json and configure MCP coding agent integration (Section 64)."""
+    """Generate .mcp.json and configure MCP coding agent integration."""
     from trace_engine.mcp.config import generate_mcp_json
 
     project_dir = path.resolve()
     mcp_file = generate_mcp_json(project_dir)
 
     console.print(f"\n[bold green]Configured TRACE MCP[/bold green] in [white]{mcp_file}[/white]")
-    console.print("\n[bold white]Connect to Claude Code:[/bold white]")
-    console.print("  [green]claude mcp add trace -- cmd /c npx -y @trace-security/trace mcp[/green]")
-    console.print("\n[bold white]Connect to Codex / Cursor / Antigravity:[/bold white]")
-    console.print("  [dim]The generated .mcp.json is already recognized by compatible IDEs and CLI agents.[/dim]\n")
+    console.print("\n[bold white]Option A: Direct Stdio Integration in Claude Code:[/bold white]")
+    console.print("  [green]claude mcp add trace -- npx -y trace-sec mcp[/green]")
+    console.print("\n[bold white]Option B: Local HTTP/SSE Server Link (Real-Time Bridge):[/bold white]")
+    console.print("  1. Launch server: [bold green]trace mcp-server[/bold green]")
+    console.print("  2. Connect via CLI: [green]claude mcp add --transport sse trace http://127.0.0.1:8765/sse[/green]")
+    console.print("  3. Or paste [cyan]http://127.0.0.1:8765/sse[/cyan] directly in your Claude Code chat!")
+    console.print("\n[bold white]Option C: Cursor IDE / Antigravity / Claude Code:[/bold white]")
+    console.print("  [dim]The created .mcp.json is already active in your workspace.[/dim]\n")
 
 
 @app.command()
@@ -885,6 +918,10 @@ def remediate(
     """Execute autonomous Agent Harness self-healing and remediation loop: patch vulnerabilities and verify fixes."""
     from trace_engine.harness.engine import AgentHarness
 
+    from trace_engine.intelligence.downloader import prompt_and_bootstrap_models
+    if not prompt_and_bootstrap_models(interactive=True):
+        raise typer.Exit(code=1)
+
     target_path = repo or path
     _, resolved_dir = resolve_finding_store(target_path.resolve())
     resolved_target = target or "http://127.0.0.1:18082"

package/src/trace_engine/intelligence/downloader.py

@@ -1,4 +1,4 @@
-"""Automated model downloader and provisioner for TRACE fine-tuned weights."""
+"""Automated model downloader, verification gate, and provisioner for TRACE fine-tuned weights."""
 
 import os
 import sys
@@ -17,19 +17,31 @@ MODEL_REGISTRY: Dict[str, Dict[str, Any]] = {
     "securebert-finetuned": {
         "files": {
             "config.json": {
-                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/config.json",
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/securebert-finetuned/config.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/config.json",
+                ],
                 "min_size": 500,
             },
             "tokenizer.json": {
-                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/tokenizer.json",
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/securebert-finetuned/tokenizer.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/tokenizer.json",
+                ],
                 "min_size": 1000000,
             },
             "tokenizer_config.json": {
-                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/tokenizer_config.json",
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/securebert-finetuned/tokenizer_config.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/tokenizer_config.json",
+                ],
                 "min_size": 200,
             },
             "model.safetensors": {
-                "url": f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/model.safetensors",
+                "urls": [
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/securebert-finetuned/model.safetensors",
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/model.safetensors",
+                ],
                 "min_size": 100000000,  # ~498 MB
             },
         },
@@ -37,23 +49,38 @@ MODEL_REGISTRY: Dict[str, Dict[str, Any]] = {
     "laya-finetuned": {
         "files": {
             "laya_metadata.json": {
-                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_metadata.json",
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/laya-finetuned/laya_metadata.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_metadata.json",
+                ],
                 "min_size": 300,
             },
             "tokenizer.json": {
-                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/tokenizer.json",
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/laya-finetuned/tokenizer.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/tokenizer.json",
+                ],
                 "min_size": 500000,
             },
             "tokenizer_config.json": {
-                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/tokenizer_config.json",
+                "urls": [
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/laya-finetuned/tokenizer_config.json",
+                    f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/tokenizer_config.json",
+                ],
                 "min_size": 200,
             },
             "laya_dual_head.onnx": {
-                "url": f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_dual_head.onnx",
+                "urls": [
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/laya-finetuned/laya_dual_head.onnx",
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_dual_head.onnx",
+                ],
                 "min_size": 50000000,  # ~267 MB
             },
             "laya_dual_head.pt": {
-                "url": f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_dual_head.pt",
+                "urls": [
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/models/laya-finetuned/laya_dual_head.pt",
+                    f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_dual_head.pt",
+                ],
                 "min_size": 50000000,  # ~267 MB
             },
         },
@@ -88,6 +115,33 @@ def is_model_installed(model_name: str, candidate_dir: Optional[Path] = None) ->
     return True
 
 
+def is_environment_ready() -> bool:
+    """Checks if both fine-tuned SecureBERT 2.0 and Laya System 1 models are installed and valid."""
+    repo_root = Path(__file__).resolve().parents[4]
+    candidate_roots = [
+        Path.home() / ".trace" / "models",
+        Path("models"),
+        Path(".trace/models"),
+        repo_root / "models",
+        repo_root / ".trace/models",
+        Path("D:/Startup/TRACE/models"),
+        Path("D:/Startup/TRACE/.trace/models"),
+    ]
+
+    sb_ok = False
+    laya_ok = False
+
+    for r in candidate_roots:
+        if not sb_ok and is_model_installed("securebert-finetuned", r / "securebert-finetuned"):
+            sb_ok = True
+        if not laya_ok and is_model_installed("laya-finetuned", r / "laya-finetuned"):
+            laya_ok = True
+        if sb_ok and laya_ok:
+            return True
+
+    return False
+
+
 def ensure_model(model_name: str) -> Path:
     """Ensures model is installed locally; downloads missing files from GitHub LFS/Repo if needed."""
     models_dir = get_default_models_dir()
@@ -109,42 +163,54 @@ def ensure_model(model_name: str) -> Path:
             continue
 
         temp_path = target_dir / f"{filename}.tmp"
-        url = meta["url"]
+        urls = meta.get("urls", [])
         print(f"  \033[38;2;255;158;59m›\033[0m Fetching {filename}...")
 
-        try:
-            req = urllib.request.Request(
-                url,
-                headers={"User-Agent": "TRACE-Security-Engine/2.1 (github:VK-Amogh/TRACE)"},
-            )
-            with urllib.request.urlopen(req, timeout=120) as resp:
-                total_size = int(resp.headers.get("Content-Length", 0))
-                downloaded = 0
-                block_size = 1024 * 1024  # 1 MB chunk
-
-                with open(temp_path, "wb") as f:
-                    while True:
-                        chunk = resp.read(block_size)
-                        if not chunk:
-                            break
-                        f.write(chunk)
-                        downloaded += len(chunk)
-                        if total_size > 0:
-                            percent = (downloaded / total_size) * 100
-                            mb_down = downloaded / (1024 * 1024)
-                            mb_tot = total_size / (1024 * 1024)
-                            sys.stdout.write(f"\r    [{percent:.1f}%] {mb_down:.1f} MB / {mb_tot:.1f} MB")
-                            sys.stdout.flush()
-
-            print()
-            if temp_path.exists():
-                temp_path.replace(file_path)
-
-        except Exception as e:
-            if temp_path.exists():
-                temp_path.unlink()
-            logger.warning(f"Failed to download {filename} from {url}: {e}")
-            raise RuntimeError(f"Could not download {filename} for {model_name}: {e}")
+        success = False
+        last_error = None
+        for url in urls:
+            try:
+                req = urllib.request.Request(
+                    url,
+                    headers={"User-Agent": "TRACE-Security-Engine/2.1 (github:VK-Amogh/TRACE)"},
+                )
+                with urllib.request.urlopen(req, timeout=120) as resp:
+                    total_size = int(resp.headers.get("Content-Length", 0))
+                    downloaded = 0
+                    block_size = 1024 * 1024  # 1 MB chunk
+
+                    with open(temp_path, "wb") as f:
+                        while True:
+                            chunk = resp.read(block_size)
+                            if not chunk:
+                                break
+                            f.write(chunk)
+                            downloaded += len(chunk)
+                            if total_size > 0:
+                                percent = (downloaded / total_size) * 100
+                                mb_down = downloaded / (1024 * 1024)
+                                mb_tot = total_size / (1024 * 1024)
+                                sys.stdout.write(f"\r    [{percent:.1f}%] {mb_down:.1f} MB / {mb_tot:.1f} MB")
+                                sys.stdout.flush()
+
+                print()
+                if temp_path.exists():
+                    temp_path.replace(file_path)
+                success = True
+                break
+
+            except Exception as e:
+                last_error = e
+                if temp_path.exists():
+                    try:
+                        temp_path.unlink()
+                    except Exception:
+                        pass
+                continue
+
+        if not success:
+            logger.warning(f"Failed to download {filename}: {last_error}")
+            raise RuntimeError(f"Could not download {filename} for {model_name}: {last_error}")
 
     print(f"\033[38;2;16;185;129m✓ Successfully provisioned {model_name}\033[0m\n")
     return target_dir
@@ -154,3 +220,48 @@ def ensure_all_models() -> None:
     """Proactively ensures all fine-tuned models are downloaded and verified."""
     for model_name in MODEL_REGISTRY:
         ensure_model(model_name)
+
+
+def prompt_and_bootstrap_models(interactive: bool = True) -> bool:
+    """Interactive gate: checks if models are installed, prompts user to agree and downloads them."""
+    if is_environment_ready():
+        return True
+
+    CYAN = "\033[38;2;56;189;248m"
+    GREEN = "\033[38;2;16;185;129m"
+    ORANGE = "\033[38;2;255;158;59m"
+    BOLD = "\033[1m"
+    DIM = "\033[2m"
+    RESET = "\033[0m"
+
+    print(f"\n  {GREEN}┌{'─' * 74}┐{RESET}")
+  
+    print(f"  {GREEN}│{RESET}  {BOLD}TRACE Neural Intelligence Engine — First-Time Environment Setup{RESET}        {GREEN}│{RESET}")
+    print(f"  {GREEN}├{'─' * 74}┤{RESET}")
+    print(f"  {GREEN}│{RESET}  TRACE requires fine-tuned neural models for autonomous AST attack-path      {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}  correlation and vulnerability verification:                                {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}   • {CYAN}SecureBERT 2.0{RESET}  (Fine-Tuned OWASP API Vulnerability Classifier)          {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}   • {CYAN}Laya System 1{RESET}   (Non-Autoregressive Fast Decision & Priority Router)     {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}                                                                          {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}  {DIM}Dedicated Location : ~/.trace/models/{RESET}                                     {GREEN}│{RESET}")
+    print(f"  {GREEN}│{RESET}  {DIM}Source             : Official TRACE Git LFS Hub (github:VK-Amogh/TRACE){RESET}   {GREEN}│{RESET}")
+    print(f"  {GREEN}└{'─' * 74}┘{RESET}\n")
+
+    if not interactive or not sys.stdin.isatty():
+        print(f"  {ORANGE}[!] Non-interactive environment detected. Run 'trace setup-models' to install.{RESET}\n")
+        return False
+
+    try:
+        ans = input(f"  {ORANGE}›{RESET} {BOLD}Download and configure fine-tuned neural models now? (y/n) [y]:{RESET} ").strip().lower()
+        if ans in ("", "y", "yes"):
+            ensure_all_models()
+            print(f"  {GREEN}✓ TRACE Neural Intelligence Engine initialized successfully.{RESET}\n")
+            return True
+        else:
+            print(f"\n  {ORANGE}[!] TRACE setup cancelled.{RESET}")
+            print(f"  {DIM}Fine-tuned neural intelligence models are required to perform security audits.{RESET}")
+            print(f"  {DIM}Run 'trace setup-models' at any time to configure the engine.{RESET}\n")
+            return False
+    except (KeyboardInterrupt, EOFError):
+        print(f"\n  {ORANGE}[!] Cancelled.{RESET}\n")
+        return False

package/src/trace_engine/intelligence/laya/router.py

@@ -58,9 +58,12 @@ class LayaDecisionEngine:
         """Resolves Laya model directory across project root, package dir, and home."""
         candidates = [
             Path.home() / ".trace/models/laya-finetuned",
+            Path("models/laya-finetuned"),
             Path(".trace/models/laya-finetuned"),
+            Path(__file__).resolve().parents[4] / "models/laya-finetuned",
             Path(__file__).resolve().parents[4] / ".trace/models/laya-finetuned",
             Path(__file__).resolve().parents[2] / "models/laya-finetuned",
+            Path("D:/Startup/TRACE/models/laya-finetuned"),
             Path("D:/Startup/TRACE/.trace/models/laya-finetuned"),
         ]
         repo_root = Path(__file__).resolve().parents[4]

package/src/trace_engine/intelligence/securebert/classifier.py

@@ -35,9 +35,12 @@ class SecureBERTClassifier:
     ):
         candidates = [
             Path.home() / ".trace/models/securebert-finetuned",
+            Path("models/securebert-finetuned"),
             Path(".trace/models/securebert-finetuned"),
+            Path(__file__).resolve().parents[4] / "models/securebert-finetuned",
             Path(__file__).resolve().parents[4] / ".trace/models/securebert-finetuned",
             Path(__file__).resolve().parents[2] / "models/securebert-finetuned",
+            Path("D:/Startup/TRACE/models/securebert-finetuned"),
             Path("D:/Startup/TRACE/.trace/models/securebert-finetuned"),
         ]
         default_model = None

package/src/trace_engine/interactive.py

@@ -278,6 +278,10 @@ def run_interactive_story() -> None:
     """Executes the complete interactive, step-by-step security audit story."""
     render_big_banner(animated=True)
 
+    from trace_engine.intelligence.downloader import prompt_and_bootstrap_models
+    if not prompt_and_bootstrap_models(interactive=True):
+        return
+
     console.print(f"  [{WHITE}]Welcome, Security Operator. TRACE stands ready to audit, verify, and heal codebases.[/{WHITE}]")
     console.print(f"  [{DIM_WHITE}]Navigate using the options below (type 'exit' or 'q' at any prompt to quit).[/{DIM_WHITE}]\n")
 
@@ -288,26 +292,33 @@ def run_interactive_story() -> None:
     console.print(f"    [{ORANGE}][1][/{ORANGE}] [{BOLD_WHITE}]Full Security Audit[/{BOLD_WHITE}] [{GREEN}]★ RECOMMENDED[/{GREEN}] [{DIM_WHITE}]─ Multi-language AST, APM graph, & Neural AI[/{DIM_WHITE}]")
     console.print(f"    [{ORANGE}][2][/{ORANGE}] [{BOLD_WHITE}]Targeted Vulnerability Probes[/{BOLD_WHITE}] [{DIM_WHITE}]─ Select specific testpacks (BOLA, SQLi, SSRF, BFLA)[/{DIM_WHITE}]")
     console.print(f"    [{ORANGE}][3][/{ORANGE}] [{BOLD_WHITE}]Autonomous AST Self-Healing[/{BOLD_WHITE}] [{DIM_WHITE}]─ Surgical refactoring with live rollback verification[/{DIM_WHITE}]")
-    console.print(f"    [{ORANGE}][4][/{ORANGE}] [{BOLD_WHITE}]How TRACE Works & Architecture Guide[/{BOLD_WHITE}] [{GREEN}]★ 5 Q&A[/{GREEN}] [{DIM_WHITE}]─ Interactive architectural diagram & neural models[/{DIM_WHITE}]")
-    console.print(f"    [{ORANGE}][5][/{ORANGE}] [{BOLD_WHITE}]Environment Diagnostics (Doctor)[/{BOLD_WHITE}] [{DIM_WHITE}]─ Inspect local security tools and dependencies[/{DIM_WHITE}]")
-    console.print(f"    [{ORANGE}][6][/{ORANGE}] [{BOLD_WHITE}]Exit[/{BOLD_WHITE}]\n")
+    console.print(f"    [{ORANGE}][4][/{ORANGE}] [{BOLD_WHITE}]Start Claude Code Local MCP Server[/{BOLD_WHITE}] [{GREEN}]★ LOCAL MCP[/{GREEN}] [{DIM_WHITE}]─ Run HTTP/SSE bridge for Claude Code chat[/{DIM_WHITE}]")
+    console.print(f"    [{ORANGE}][5][/{ORANGE}] [{BOLD_WHITE}]How TRACE Works & Architecture Guide[/{BOLD_WHITE}] [{DIM_WHITE}]─ Interactive architectural diagram & neural models[/{DIM_WHITE}]")
+    console.print(f"    [{ORANGE}][6][/{ORANGE}] [{BOLD_WHITE}]Environment Diagnostics (Doctor)[/{BOLD_WHITE}] [{DIM_WHITE}]─ Inspect local security tools and dependencies[/{DIM_WHITE}]")
+    console.print(f"    [{ORANGE}][7][/{ORANGE}] [{BOLD_WHITE}]Exit[/{BOLD_WHITE}]\n")
 
     choice = ask_input(
         f"  [{ORANGE}]›[/{ORANGE}] [{BOLD_WHITE}]Choose option[/{BOLD_WHITE}]",
-        choices=["1", "2", "3", "4", "5", "6"],
+        choices=["1", "2", "3", "4", "5", "6", "7"],
         default="1",
         show_default=True,
     )
 
-    if choice == "6":
+    if choice == "7":
         console.print(f"\n  [{GREEN}]✓ TRACE session closed. Happy hacking![/{GREEN}]\n")
         return
 
     if choice == "4":
-        run_architecture_guide()
+        from trace_engine.mcp.server import TraceMCPServer
+        mcp_obj = TraceMCPServer()
+        mcp_obj.run_sse_server(host="127.0.0.1", port=8765)
         return
 
     if choice == "5":
+        run_architecture_guide()
+        return
+
+    if choice == "6":
         display_story_header(2, 2, "Environment Diagnostics", "Auditing local dependencies and runtime requirements")
         from trace_engine.doctor import run_doctor
         report = run_doctor(Path("."))

package/src/trace_engine/mcp/server.py

@@ -396,3 +396,174 @@ class TraceMCPServer:
                 }
                 sys.stdout.write(json.dumps(err_resp) + "\n")
                 sys.stdout.flush()
+
+    def run_sse_server(self, host: str = "127.0.0.1", port: int = 8765):
+        """Run an MCP HTTP/SSE transport server for Claude Code and local AI coding agents."""
+        import uuid
+        import queue
+        import urllib.parse
+        from http.server import ThreadingHTTPServer, BaseHTTPRequestHandler
+
+        sessions: Dict[str, queue.Queue] = {}
+        server_instance = self
+
+        class MCPHandler(BaseHTTPRequestHandler):
+            def log_message(self, format, *args):
+                pass  # Suppress request clutter in terminal
+
+            def do_OPTIONS(self):
+                self.send_response(200)
+                self.send_header("Access-Control-Allow-Origin", "*")
+                self.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+                self.send_header("Access-Control-Allow-Headers", "Content-Type, Authorization")
+                self.end_headers()
+
+            def do_GET(self):
+                parsed = urllib.parse.urlparse(self.path)
+                if parsed.path == "/sse":
+                    session_id = uuid.uuid4().hex
+                    msg_queue: queue.Queue = queue.Queue()
+                    sessions[session_id] = msg_queue
+
+                    self.send_response(200)
+                    self.send_header("Content-Type", "text/event-stream")
+                    self.send_header("Cache-Control", "no-cache")
+                    self.send_header("Connection", "keep-alive")
+                    self.send_header("Access-Control-Allow-Origin", "*")
+                    self.end_headers()
+
+                    # Emit endpoint event as defined in MCP SSE transport specification
+                    endpoint_msg = f"event: endpoint\r\ndata: /message?sessionId={session_id}\r\n\r\n"
+                    self.wfile.write(endpoint_msg.encode("utf-8"))
+                    self.wfile.flush()
+
+                    try:
+                        while server_instance.running:
+                            try:
+                                msg = msg_queue.get(timeout=1.0)
+                                if msg is None:
+                                    break
+                                event_str = f"event: message\r\ndata: {json.dumps(msg)}\r\n\r\n"
+                                self.wfile.write(event_str.encode("utf-8"))
+                                self.wfile.flush()
+                            except queue.Empty:
+                                self.wfile.write(b": keepalive\r\n\r\n")
+                                self.wfile.flush()
+                    except (BrokenPipeError, ConnectionResetError):
+                        pass
+                    finally:
+                        sessions.pop(session_id, None)
+
+                elif parsed.path in ("/health", "/status"):
+                    self.send_response(200)
+                    self.send_header("Content-Type", "application/json")
+                    self.send_header("Access-Control-Allow-Origin", "*")
+                    self.end_headers()
+                    status_info = {
+                        "status": "online",
+                        "server": "TRACE MCP Server v2.1",
+                        "transport": "sse",
+                        "sse_url": f"http://{host}:{port}/sse",
+                        "active_sessions": len(sessions),
+                        "tools": [t["name"] for t in TRACE_TOOLS],
+                    }
+                    self.wfile.write(json.dumps(status_info, indent=2).encode("utf-8"))
+
+                else:
+                    self.send_response(200)
+                    self.send_header("Content-Type", "text/html; charset=utf-8")
+                    self.send_header("Access-Control-Allow-Origin", "*")
+                    self.end_headers()
+                    html = f"""<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>TRACE Local MCP Server</title>
+  <style>
+    body {{ font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background: #0b0f17; color: #f8fafc; padding: 40px; margin: 0; }}
+    .container {{ max-width: 680px; margin: 0 auto; background: #131b2e; border: 1px solid #10b981; border-radius: 12px; padding: 32px; box-shadow: 0 10px 25px rgba(0,0,0,0.5); }}
+    h1 {{ color: #10b981; margin-top: 0; display: flex; align-items: center; gap: 10px; font-size: 24px; }}
+    .badge {{ background: #10b981; color: #0b0f17; padding: 3px 8px; border-radius: 4px; font-size: 12px; font-weight: bold; }}
+    p {{ color: #94a3b8; font-size: 14px; line-height: 1.6; }}
+    .cmd-box {{ background: #070a12; border: 1px solid #1e293b; border-radius: 6px; padding: 12px 16px; margin: 12px 0; font-family: monospace; color: #38bdf8; font-size: 13px; word-break: break-all; }}
+    .section-title {{ color: #ffffff; font-size: 14px; font-weight: bold; margin-top: 20px; }}
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>TRACE MCP Server <span class="badge">ONLINE</span></h1>
+    <p>Local Model Context Protocol (MCP) server listening for Claude Code and AI coding agents.</p>
+    
+    <div class="section-title">Local MCP Endpoint Link:</div>
+    <div class="cmd-box">http://{host}:{port}/sse</div>
+
+    <div class="section-title">Connect via Claude Code CLI:</div>
+    <div class="cmd-box">claude mcp add --transport sse trace http://{host}:{port}/sse</div>
+
+    <div class="section-title">Connect in Claude Chat:</div>
+    <p>Paste the local MCP link into your Claude chat to grant autonomous AST scanning and verification powers:</p>
+    <div class="cmd-box">http://{host}:{port}/sse</div>
+  </div>
+</body>
+</html>"""
+                    self.wfile.write(html.encode("utf-8"))
+
+            def do_POST(self):
+                parsed = urllib.parse.urlparse(self.path)
+                if parsed.path.startswith("/message"):
+                    query = urllib.parse.parse_qs(parsed.query)
+                    session_id = query.get("sessionId", [None])[0]
+
+                    content_len = int(self.headers.get("Content-Length", 0))
+                    body = self.rfile.read(content_len).decode("utf-8")
+                    try:
+                        req = json.loads(body)
+                        resp = server_instance.handle_request(req)
+                    except Exception as e:
+                        resp = {
+                            "jsonrpc": "2.0",
+                            "id": None,
+                            "error": {"code": -32603, "message": str(e)},
+                        }
+
+                    if session_id and session_id in sessions and resp:
+                        sessions[session_id].put(resp)
+
+                    self.send_response(200)
+                    self.send_header("Content-Type", "application/json")
+                    self.send_header("Access-Control-Allow-Origin", "*")
+                    self.end_headers()
+                    self.wfile.write(json.dumps(resp or {"jsonrpc": "2.0", "result": None}).encode("utf-8"))
+                else:
+                    self.send_response(404)
+                    self.end_headers()
+
+        GREEN = "\033[38;2;16;185;129m"
+        CYAN = "\033[38;2;56;189;248m"
+        ORANGE = "\033[38;2;255;158;59m"
+        BOLD = "\033[1m"
+        DIM = "\033[2m"
+        RESET = "\033[0m"
+
+        print(f"\n  {GREEN}┌{'─' * 74}┐{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}TRACE Local MCP Server (Model Context Protocol){RESET}                     {GREEN}│{RESET}")
+        print(f"  {GREEN}├{'─' * 74}┤{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}Local MCP Link   :{RESET} {CYAN}http://{host}:{port}/sse{RESET}{' ' * max(0, 39 - len(f'http://{host}:{port}/sse'))}{GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}Web Dashboard    :{RESET} {CYAN}http://{host}:{port}/{RESET}{' ' * max(0, 42 - len(f'http://{host}:{port}/'))}{GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}Status           :{RESET} {GREEN}ONLINE{RESET} (Listening for Claude Code & AI Coding Agents)  {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}                                                                          {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}Connect in Claude Code CLI:{RESET}                                             {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}   {ORANGE}›{RESET} {BOLD}claude mcp add --transport sse trace http://{host}:{port}/sse{RESET}          {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}                                                                          {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}  {BOLD}Or paste this link directly in your Claude Code chat:{RESET}                   {GREEN}│{RESET}")
+        print(f"  {GREEN}│{RESET}   {CYAN}http://{host}:{port}/sse{RESET}{' ' * max(0, 49 - len(f'http://{host}:{port}/sse'))}{GREEN}│{RESET}")
+        print(f"  {GREEN}└{'─' * 74}┘{RESET}\n")
+        print(f"  {DIM}Press Ctrl+C to terminate the local MCP server.{RESET}\n")
+
+        httpd = ThreadingHTTPServer((host, port), MCPHandler)
+        try:
+            httpd.serve_forever()
+        except KeyboardInterrupt:
+            print(f"\n  {ORANGE}[TRACE] MCP Server stopped.{RESET}\n")
+        finally:
+            httpd.server_close()