truss-code-review-mcp 1.0.0

package/dist/tools/detect-antipatterns.d.ts

@@ -0,0 +1,6 @@
+/**
+ * detect_antipatterns — Language-specific anti-pattern detection (Free tier)
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerDetectAntipatterns(server: McpServer): void;
+//# sourceMappingURL=detect-antipatterns.d.ts.map

package/dist/tools/detect-antipatterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-antipatterns.d.ts","sourceRoot":"","sources":["../../src/tools/detect-antipatterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA6ClE"}

package/dist/tools/detect-antipatterns.js

@@ -0,0 +1,44 @@
+/**
+ * detect_antipatterns — Language-specific anti-pattern detection (Free tier)
+ */
+import { z } from 'zod';
+import { detectAntiPatterns, getSupportedLanguages, isLanguageSupported } from '../lib/patterns.js';
+export function registerDetectAntipatterns(server) {
+    server.tool('detect_antipatterns', 'Detect common anti-patterns per language. Includes: JS/TS (var, ==, any, eval, innerHTML, sync I/O), Python (bare except, mutable defaults, wildcard imports), Go (ignored errors, goroutine leaks, mutex without defer). Free tier.', {
+        code: z.string().describe('Source code to analyze'),
+        language: z.string().describe('Programming language (javascript, typescript, python, go)'),
+    }, async ({ code, language }) => {
+        if (!isLanguageSupported(language)) {
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            error: `Language "${language}" is not supported.`,
+                            supported: getSupportedLanguages(),
+                        }, null, 2),
+                    }],
+            };
+        }
+        const matches = detectAntiPatterns(code, language);
+        const output = {
+            language,
+            total_findings: matches.length,
+            by_severity: {
+                error: matches.filter(m => m.severity === 'error').length,
+                warning: matches.filter(m => m.severity === 'warning').length,
+                info: matches.filter(m => m.severity === 'info').length,
+            },
+            findings: matches.map(m => ({
+                pattern: m.pattern,
+                description: m.description,
+                location: m.location,
+                severity: m.severity,
+                fix: m.fix,
+            })),
+        };
+        return {
+            content: [{ type: 'text', text: JSON.stringify(output, null, 2) }],
+        };
+    });
+}
+//# sourceMappingURL=detect-antipatterns.js.map

package/dist/tools/detect-antipatterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-antipatterns.js","sourceRoot":"","sources":["../../src/tools/detect-antipatterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEpG,MAAM,UAAU,0BAA0B,CAAC,MAAiB;IAC1D,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,sOAAsO,EACtO;QACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;KAC3F,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC3B,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,aAAa,QAAQ,qBAAqB;4BACjD,SAAS,EAAE,qBAAqB,EAAE;yBACnC,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG;YACb,QAAQ;YACR,cAAc,EAAE,OAAO,CAAC,MAAM;YAC9B,WAAW,EAAE;gBACX,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM;gBACzD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;gBAC7D,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;aACxD;YACD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,GAAG,EAAE,CAAC,CAAC,GAAG;aACX,CAAC,CAAC;SACJ,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SAC5E,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/explain-code.d.ts

@@ -0,0 +1,6 @@
+/**
+ * explain_code — Generate documentation for complex code (Pro tier)
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerExplainCode(server: McpServer): void;
+//# sourceMappingURL=explain-code.d.ts.map

package/dist/tools/explain-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain-code.d.ts","sourceRoot":"","sources":["../../src/tools/explain-code.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAuD3D"}

package/dist/tools/explain-code.js

@@ -0,0 +1,56 @@
+/**
+ * explain_code — Generate documentation for complex code (Pro tier)
+ */
+import { z } from 'zod';
+import { requirePro, requireAiKey } from '../lib/license.js';
+import { aiReview, EXPLAIN_CODE_SYSTEM } from '../lib/ai-review.js';
+export function registerExplainCode(server) {
+    server.tool('explain_code', 'Generate documentation for complex code. Produces high-level explanation, function docstrings, data flow analysis, and design notes. Pro tier.', {
+        code: z.string().describe('Source code to explain'),
+        language: z.string().describe('Programming language'),
+    }, async ({ code, language }) => {
+        await requirePro();
+        requireAiKey();
+        const userPrompt = [
+            `Language: ${language}`,
+            '',
+            '```',
+            code,
+            '```',
+        ].join('\n');
+        try {
+            const result = await aiReview(EXPLAIN_CODE_SYSTEM, userPrompt);
+            let parsed;
+            try {
+                parsed = JSON.parse(result.content);
+            }
+            catch {
+                parsed = { explanation: result.content };
+            }
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            documentation: parsed,
+                            meta: {
+                                model: result.model,
+                                provider: result.provider,
+                                tokens: result.tokensUsed,
+                            },
+                        }, null, 2),
+                    }],
+            };
+        }
+        catch (err) {
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            error: err instanceof Error ? err.message : String(err),
+                        }),
+                    }],
+            };
+        }
+    });
+}
+//# sourceMappingURL=explain-code.js.map

package/dist/tools/explain-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain-code.js","sourceRoot":"","sources":["../../src/tools/explain-code.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEpE,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,MAAM,CAAC,IAAI,CACT,cAAc,EACd,gJAAgJ,EAChJ;QACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KACtD,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC3B,MAAM,UAAU,EAAE,CAAC;QACnB,YAAY,EAAE,CAAC;QAEf,MAAM,UAAU,GAAG;YACjB,aAAa,QAAQ,EAAE;YACvB,EAAE;YACF,KAAK;YACL,IAAI;YACJ,KAAK;SACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;YAE/D,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAC3C,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,aAAa,EAAE,MAAM;4BACrB,IAAI,EAAE;gCACJ,KAAK,EAAE,MAAM,CAAC,KAAK;gCACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gCACzB,MAAM,EAAE,MAAM,CAAC,UAAU;6BAC1B;yBACF,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;yBACxD,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/optimize-code.d.ts

@@ -0,0 +1,6 @@
+/**
+ * optimize_code — Performance optimization suggestions (Pro tier)
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerOptimizeCode(server: McpServer): void;
+//# sourceMappingURL=optimize-code.d.ts.map

package/dist/tools/optimize-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"optimize-code.d.ts","sourceRoot":"","sources":["../../src/tools/optimize-code.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwD5D"}

package/dist/tools/optimize-code.js

@@ -0,0 +1,57 @@
+/**
+ * optimize_code — Performance optimization suggestions (Pro tier)
+ */
+import { z } from 'zod';
+import { requirePro, requireAiKey } from '../lib/license.js';
+import { aiReview, OPTIMIZE_CODE_SYSTEM } from '../lib/ai-review.js';
+export function registerOptimizeCode(server) {
+    server.tool('optimize_code', 'Performance optimization suggestions with before/after code and expected impact. Covers algorithmic complexity, memory usage, I/O efficiency, caching, and language-specific optimizations. Pro tier.', {
+        code: z.string().describe('Source code to optimize'),
+        language: z.string().describe('Programming language'),
+    }, async ({ code, language }) => {
+        await requirePro();
+        requireAiKey();
+        const userPrompt = [
+            `Language: ${language}`,
+            '',
+            'Analyze this code for performance optimization opportunities:',
+            '```',
+            code,
+            '```',
+        ].join('\n');
+        try {
+            const result = await aiReview(OPTIMIZE_CODE_SYSTEM, userPrompt);
+            let parsed;
+            try {
+                parsed = JSON.parse(result.content);
+            }
+            catch {
+                parsed = { raw_review: result.content };
+            }
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            optimizations: parsed,
+                            meta: {
+                                model: result.model,
+                                provider: result.provider,
+                                tokens: result.tokensUsed,
+                            },
+                        }, null, 2),
+                    }],
+            };
+        }
+        catch (err) {
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            error: err instanceof Error ? err.message : String(err),
+                        }),
+                    }],
+            };
+        }
+    });
+}
+//# sourceMappingURL=optimize-code.js.map

package/dist/tools/optimize-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"optimize-code.js","sourceRoot":"","sources":["../../src/tools/optimize-code.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAErE,MAAM,UAAU,oBAAoB,CAAC,MAAiB;IACpD,MAAM,CAAC,IAAI,CACT,eAAe,EACf,uMAAuM,EACvM;QACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACpD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KACtD,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC3B,MAAM,UAAU,EAAE,CAAC;QACnB,YAAY,EAAE,CAAC;QAEf,MAAM,UAAU,GAAG;YACjB,aAAa,QAAQ,EAAE;YACvB,EAAE;YACF,+DAA+D;YAC/D,KAAK;YACL,IAAI;YACJ,KAAK;SACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;YAEhE,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1C,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,aAAa,EAAE,MAAM;4BACrB,IAAI,EAAE;gCACJ,KAAK,EAAE,MAAM,CAAC,KAAK;gCACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gCACzB,MAAM,EAAE,MAAM,CAAC,UAAU;6BAC1B;yBACF,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;yBACxD,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/review-diff.d.ts

@@ -0,0 +1,8 @@
+/**
+ * review_diff — Rule-based diff analysis (Free tier)
+ * Checks for common issues: large files, debug statements, TODO without tickets,
+ * commented-out code, import ordering, sensitive data, etc.
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerReviewDiff(server: McpServer): void;
+//# sourceMappingURL=review-diff.d.ts.map

package/dist/tools/review-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-diff.d.ts","sourceRoot":"","sources":["../../src/tools/review-diff.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAyUpE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAsC1D"}

package/dist/tools/review-diff.js

@@ -0,0 +1,333 @@
+/**
+ * review_diff — Rule-based diff analysis (Free tier)
+ * Checks for common issues: large files, debug statements, TODO without tickets,
+ * commented-out code, import ordering, sensitive data, etc.
+ */
+import { z } from 'zod';
+import { readFileSync } from 'node:fs';
+import { execSync } from 'node:child_process';
+// ── Rule checks ─────────────────────────────────────────────────────
+function checkLargeFile(lines, filename) {
+    const addedLines = lines.filter(l => l.startsWith('+')).length;
+    const comments = [];
+    if (addedLines > 500) {
+        comments.push({
+            file: filename,
+            line: null,
+            severity: 'warning',
+            message: `Large change: ${addedLines} lines added. Consider breaking into smaller PRs.`,
+            suggestion: 'Split into focused, reviewable chunks of <300 lines each.',
+        });
+    }
+    return comments;
+}
+function checkDebugStatements(lines, filename) {
+    const comments = [];
+    const debugPatterns = [
+        { pattern: /console\.(log|debug|info|warn|error)\s*\(/, message: 'console.log left in code' },
+        { pattern: /\bprint\s*\((?!.*#.*noqa)/, message: 'print() statement (Python debug?)' },
+        { pattern: /\bfmt\.Print(ln|f)?\s*\(/, message: 'fmt.Print statement (Go debug?)' },
+        { pattern: /\bdebugger\b/, message: 'debugger statement' },
+        { pattern: /\bpdb\.set_trace\b/, message: 'pdb breakpoint' },
+        { pattern: /\bbreakpoint\s*\(\)/, message: 'Python breakpoint()' },
+        { pattern: /\bDDLog\b|\bNSLog\s*\(/, message: 'Debug log statement' },
+    ];
+    let lineNum = 0;
+    for (const line of lines) {
+        if (line.startsWith('@@')) {
+            const match = line.match(/@@ -\d+(?:,\d+)? \+(\d+)/);
+            if (match)
+                lineNum = parseInt(match[1], 10) - 1;
+            continue;
+        }
+        if (line.startsWith('+') && !line.startsWith('+++')) {
+            lineNum++;
+            const content = line.slice(1);
+            for (const dp of debugPatterns) {
+                if (dp.pattern.test(content)) {
+                    comments.push({
+                        file: filename,
+                        line: lineNum,
+                        severity: 'warning',
+                        message: dp.message,
+                        suggestion: 'Remove debug statements before merging, or use a proper logger.',
+                    });
+                }
+            }
+        }
+        else if (line.startsWith(' ')) {
+            lineNum++;
+        }
+    }
+    return comments;
+}
+function checkTodoWithoutTicket(lines, filename) {
+    const comments = [];
+    const todoPattern = /\b(TODO|FIXME|HACK|XXX|TEMP)\b(?!.*(?:[A-Z]+-\d+|#\d+|https?:))/i;
+    let lineNum = 0;
+    for (const line of lines) {
+        if (line.startsWith('@@')) {
+            const match = line.match(/@@ -\d+(?:,\d+)? \+(\d+)/);
+            if (match)
+                lineNum = parseInt(match[1], 10) - 1;
+            continue;
+        }
+        if (line.startsWith('+') && !line.startsWith('+++')) {
+            lineNum++;
+            if (todoPattern.test(line.slice(1))) {
+                comments.push({
+                    file: filename,
+                    line: lineNum,
+                    severity: 'info',
+                    message: 'TODO/FIXME without a ticket reference.',
+                    suggestion: 'Add a ticket reference: TODO(PROJ-123) or TODO(#456) to track this work.',
+                });
+            }
+        }
+        else if (line.startsWith(' ')) {
+            lineNum++;
+        }
+    }
+    return comments;
+}
+function checkCommentedOutCode(lines, filename) {
+    const comments = [];
+    // Detect commented-out code (lines that look like code, not natural language comments)
+    const codePatterns = [
+        /^\s*\/\/\s*(if|for|while|return|const|let|var|function|class|import)\b/,
+        /^\s*#\s*(if|for|while|return|def|class|import|from)\b/,
+        /^\s*\/\/\s*\w+\s*[=({[\]]/,
+        /^\s*#\s*\w+\s*[=({[\]]/,
+    ];
+    let lineNum = 0;
+    let consecutiveCommentedCode = 0;
+    let blockStart = 0;
+    for (const line of lines) {
+        if (line.startsWith('@@')) {
+            const match = line.match(/@@ -\d+(?:,\d+)? \+(\d+)/);
+            if (match)
+                lineNum = parseInt(match[1], 10) - 1;
+            consecutiveCommentedCode = 0;
+            continue;
+        }
+        if (line.startsWith('+') && !line.startsWith('+++')) {
+            lineNum++;
+            const content = line.slice(1);
+            const isCommentedCode = codePatterns.some(p => p.test(content));
+            if (isCommentedCode) {
+                if (consecutiveCommentedCode === 0)
+                    blockStart = lineNum;
+                consecutiveCommentedCode++;
+            }
+            else {
+                if (consecutiveCommentedCode >= 3) {
+                    comments.push({
+                        file: filename,
+                        line: blockStart,
+                        severity: 'info',
+                        message: `${consecutiveCommentedCode} lines of commented-out code.`,
+                        suggestion: 'Remove commented-out code. Use version control to recover old code if needed.',
+                    });
+                }
+                consecutiveCommentedCode = 0;
+            }
+        }
+        else if (line.startsWith(' ')) {
+            lineNum++;
+            if (consecutiveCommentedCode >= 3) {
+                comments.push({
+                    file: filename,
+                    line: blockStart,
+                    severity: 'info',
+                    message: `${consecutiveCommentedCode} lines of commented-out code.`,
+                    suggestion: 'Remove commented-out code. Use version control to recover old code if needed.',
+                });
+            }
+            consecutiveCommentedCode = 0;
+        }
+    }
+    // Flush final block
+    if (consecutiveCommentedCode >= 3) {
+        comments.push({
+            file: filename,
+            line: blockStart,
+            severity: 'info',
+            message: `${consecutiveCommentedCode} lines of commented-out code.`,
+            suggestion: 'Remove commented-out code. Use version control to recover old code if needed.',
+        });
+    }
+    return comments;
+}
+function checkSensitiveData(lines, filename) {
+    const comments = [];
+    const sensitivePatterns = [
+        { pattern: /(?:password|passwd|secret|api[_-]?key|apikey|token|auth)\s*[:=]\s*['"]\w{8,}/i, message: 'Possible hardcoded credential' },
+        { pattern: /-----BEGIN (?:RSA |DSA |EC )?PRIVATE KEY-----/, message: 'Private key in code' },
+        { pattern: /\b[A-Za-z0-9+/]{40,}\b(?=\s|$|['"`;])/, message: 'Possible base64-encoded secret (long random string)' },
+        { pattern: /\bsk[-_](?:live|test)[-_]\w{20,}/, message: 'Possible Stripe secret key' },
+        { pattern: /\bghp_\w{36}\b/, message: 'Possible GitHub personal access token' },
+        { pattern: /\bAKIA\w{16}\b/, message: 'Possible AWS access key ID' },
+    ];
+    let lineNum = 0;
+    for (const line of lines) {
+        if (line.startsWith('@@')) {
+            const match = line.match(/@@ -\d+(?:,\d+)? \+(\d+)/);
+            if (match)
+                lineNum = parseInt(match[1], 10) - 1;
+            continue;
+        }
+        if (line.startsWith('+') && !line.startsWith('+++')) {
+            lineNum++;
+            const content = line.slice(1);
+            for (const sp of sensitivePatterns) {
+                if (sp.pattern.test(content)) {
+                    comments.push({
+                        file: filename,
+                        line: lineNum,
+                        severity: 'error',
+                        message: sp.message,
+                        suggestion: 'Move secrets to environment variables or a secrets manager. Never commit credentials.',
+                    });
+                    break; // One finding per line is enough
+                }
+            }
+        }
+        else if (line.startsWith(' ')) {
+            lineNum++;
+        }
+    }
+    return comments;
+}
+function checkImportOrdering(lines, filename) {
+    const comments = [];
+    const importLines = [];
+    let lineNum = 0;
+    for (const line of lines) {
+        if (line.startsWith('@@')) {
+            const match = line.match(/@@ -\d+(?:,\d+)? \+(\d+)/);
+            if (match)
+                lineNum = parseInt(match[1], 10) - 1;
+            continue;
+        }
+        if (line.startsWith('+') && !line.startsWith('+++')) {
+            lineNum++;
+            const content = line.slice(1).trim();
+            // JS/TS imports
+            const jsImport = content.match(/^import\s+.*\s+from\s+['"]([^'"]+)['"]/);
+            if (jsImport) {
+                const pkg = jsImport[1];
+                importLines.push({
+                    line: lineNum,
+                    text: content,
+                    isThirdParty: !pkg.startsWith('.') && !pkg.startsWith('/'),
+                    isRelative: pkg.startsWith('.'),
+                });
+            }
+        }
+        else if (line.startsWith(' ')) {
+            lineNum++;
+        }
+    }
+    // Check if third-party and relative imports are intermixed
+    if (importLines.length >= 2) {
+        let lastWasThirdParty = null;
+        let switchCount = 0;
+        for (const imp of importLines) {
+            if (lastWasThirdParty !== null && imp.isThirdParty !== lastWasThirdParty) {
+                switchCount++;
+            }
+            lastWasThirdParty = imp.isThirdParty;
+        }
+        if (switchCount > 1) {
+            comments.push({
+                file: filename,
+                line: importLines[0].line,
+                severity: 'info',
+                message: 'Import ordering: third-party and relative imports are intermixed.',
+                suggestion: 'Group imports: 1) built-in/node modules, 2) third-party packages, 3) relative imports. Separate groups with a blank line.',
+            });
+        }
+    }
+    return comments;
+}
+function parseDiff(diff) {
+    const files = [];
+    const parts = diff.split(/^diff --git /m);
+    for (const part of parts) {
+        if (!part.trim())
+            continue;
+        const headerMatch = part.match(/a\/(.+?)\s+b\/(.+)/);
+        if (!headerMatch)
+            continue;
+        const filename = headerMatch[2];
+        const lines = part.split('\n');
+        files.push({ filename, lines });
+    }
+    // If no diff headers found, treat the whole thing as a single file diff
+    if (files.length === 0 && diff.trim()) {
+        files.push({ filename: 'unknown', lines: diff.split('\n') });
+    }
+    return files;
+}
+function getDiffContent(input) {
+    if (input.diff)
+        return input.diff;
+    if (input.file_path) {
+        try {
+            // Try to get git diff for the file
+            const diff = execSync(`git diff HEAD -- "${input.file_path}"`, {
+                encoding: 'utf-8',
+                timeout: 10000,
+            });
+            if (diff.trim())
+                return diff;
+            // If no diff, try staged
+            const staged = execSync(`git diff --cached -- "${input.file_path}"`, {
+                encoding: 'utf-8',
+                timeout: 10000,
+            });
+            if (staged.trim())
+                return staged;
+            // Fall back to reading the file and creating a synthetic diff
+            const content = readFileSync(input.file_path, 'utf-8');
+            return `diff --git a/${input.file_path} b/${input.file_path}\n--- a/${input.file_path}\n+++ b/${input.file_path}\n@@ -0,0 +1,${content.split('\n').length} @@\n${content.split('\n').map(l => '+' + l).join('\n')}`;
+        }
+        catch {
+            throw new Error(`Cannot read diff or file at: ${input.file_path}`);
+        }
+    }
+    throw new Error('Provide either "diff" or "file_path".');
+}
+// ── Tool registration ───────────────────────────────────────────────
+export function registerReviewDiff(server) {
+    server.tool('review_diff', 'Analyze a git diff for common issues: large files, debug statements, TODO without tickets, commented-out code, import ordering, sensitive data. Free tier — no API key needed.', {
+        diff: z.string().optional().describe('Raw git diff content'),
+        file_path: z.string().optional().describe('Path to file (will run git diff on it)'),
+    }, async (input) => {
+        const diffContent = getDiffContent(input);
+        const files = parseDiff(diffContent);
+        const allComments = [];
+        for (const file of files) {
+            allComments.push(...checkLargeFile(file.lines, file.filename));
+            allComments.push(...checkDebugStatements(file.lines, file.filename));
+            allComments.push(...checkTodoWithoutTicket(file.lines, file.filename));
+            allComments.push(...checkCommentedOutCode(file.lines, file.filename));
+            allComments.push(...checkSensitiveData(file.lines, file.filename));
+            allComments.push(...checkImportOrdering(file.lines, file.filename));
+        }
+        const summary = {
+            files_reviewed: files.length,
+            total_issues: allComments.length,
+            by_severity: {
+                error: allComments.filter(c => c.severity === 'error').length,
+                warning: allComments.filter(c => c.severity === 'warning').length,
+                info: allComments.filter(c => c.severity === 'info').length,
+            },
+            comments: allComments,
+        };
+        return {
+            content: [{ type: 'text', text: JSON.stringify(summary, null, 2) }],
+        };
+    });
+}
+//# sourceMappingURL=review-diff.js.map

package/dist/tools/review-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-diff.js","sourceRoot":"","sources":["../../src/tools/review-diff.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAU9C,uEAAuE;AAEvE,SAAS,cAAc,CAAC,KAAe,EAAE,QAAgB;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,iBAAiB,UAAU,mDAAmD;YACvF,UAAU,EAAE,2DAA2D;SACxE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAe,EAAE,QAAgB;IAC7D,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG;QACpB,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,0BAA0B,EAAE;QAC7F,EAAE,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,mCAAmC,EAAE;QACtF,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,iCAAiC,EAAE;QACnF,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE;QAC1D,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,gBAAgB,EAAE;QAC5D,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,EAAE;QAClE,EAAE,OAAO,EAAE,wBAAwB,EAAE,OAAO,EAAE,qBAAqB,EAAE;KACtE,CAAC;IAEF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACrD,IAAI,KAAK;gBAAE,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9B,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;gBAC/B,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,EAAE,CAAC,OAAO;wBACnB,UAAU,EAAE,iEAAiE;qBAC9E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAe,EAAE,QAAgB;IAC/D,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,kEAAkE,CAAC;IAEvF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACrD,IAAI,KAAK;gBAAE,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,CAAC;YACV,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,wCAAwC;oBACjD,UAAU,EAAE,0EAA0E;iBACvF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAe,EAAE,QAAgB;IAC9D,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,uFAAuF;IACvF,MAAM,YAAY,GAAG;QACnB,wEAAwE;QACxE,uDAAuD;QACvD,2BAA2B;QAC3B,wBAAwB;KACzB,CAAC;IAEF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,wBAAwB,GAAG,CAAC,CAAC;IACjC,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACrD,IAAI,KAAK;gBAAE,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YAChD,wBAAwB,GAAG,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAEhE,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,wBAAwB,KAAK,CAAC;oBAAE,UAAU,GAAG,OAAO,CAAC;gBACzD,wBAAwB,EAAE,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,IAAI,wBAAwB,IAAI,CAAC,EAAE,CAAC;oBAClC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,GAAG,wBAAwB,+BAA+B;wBACnE,UAAU,EAAE,+EAA+E;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBACD,wBAAwB,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;YACV,IAAI,wBAAwB,IAAI,CAAC,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,GAAG,wBAAwB,+BAA+B;oBACnE,UAAU,EAAE,+EAA+E;iBAC5F,CAAC,CAAC;YACL,CAAC;YACD,wBAAwB,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,IAAI,wBAAwB,IAAI,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,wBAAwB,+BAA+B;YACnE,UAAU,EAAE,+EAA+E;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe,EAAE,QAAgB;IAC3D,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,iBAAiB,GAAG;QACxB,EAAE,OAAO,EAAE,+EAA+E,EAAE,OAAO,EAAE,+BAA+B,EAAE;QACtI,EAAE,OAAO,EAAE,+CAA+C,EAAE,OAAO,EAAE,qBAAqB,EAAE;QAC5F,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,qDAAqD,EAAE;QACpH,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,4BAA4B,EAAE;QACtF,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,uCAAuC,EAAE;QAC/E,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,4BAA4B,EAAE;KACrE,CAAC;IAEF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACrD,IAAI,KAAK;gBAAE,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9B,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;gBACnC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,EAAE,CAAC,OAAO;wBACnB,UAAU,EAAE,uFAAuF;qBACpG,CAAC,CAAC;oBACH,MAAM,CAAC,iCAAiC;gBAC1C,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAe,EAAE,QAAgB;IAC5D,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAsF,EAAE,CAAC;IAC1G,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACrD,IAAI,KAAK;gBAAE,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAErC,gBAAgB;YAChB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACzE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACxB,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,OAAO;oBACb,YAAY,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAC1D,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,iBAAiB,GAAmB,IAAI,CAAC;QAC7C,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,iBAAiB,KAAK,IAAI,IAAI,GAAG,CAAC,YAAY,KAAK,iBAAiB,EAAE,CAAC;gBACzE,WAAW,EAAE,CAAC;YAChB,CAAC;YACD,iBAAiB,GAAG,GAAG,CAAC,YAAY,CAAC;QACvC,CAAC;QACD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;gBACzB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,mEAAmE;gBAC5E,UAAU,EAAE,2HAA2H;aACxI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAE3B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW;YAAE,SAAS;QAE3B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,wEAAwE;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAA4C;IAClE,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAClC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,mCAAmC;YACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,qBAAqB,KAAK,CAAC,SAAS,GAAG,EAAE;gBAC7D,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;YAE7B,yBAAyB;YACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,yBAAyB,KAAK,CAAC,SAAS,GAAG,EAAE;gBACnE,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,EAAE;gBAAE,OAAO,MAAM,CAAC;YAEjC,8DAA8D;YAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACvD,OAAO,gBAAgB,KAAK,CAAC,SAAS,MAAM,KAAK,CAAC,SAAS,WAAW,KAAK,CAAC,SAAS,WAAW,KAAK,CAAC,SAAS,gBAAgB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,QAAQ,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtN,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAC3D,CAAC;AAED,uEAAuE;AAEvE,MAAM,UAAU,kBAAkB,CAAC,MAAiB;IAClD,MAAM,CAAC,IAAI,CACT,aAAa,EACb,gLAAgL,EAChL;QACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;KACpF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,WAAW,GAAoB,EAAE,CAAC;QAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/D,WAAW,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrE,WAAW,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvE,WAAW,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtE,WAAW,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnE,WAAW,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,OAAO,GAAG;YACd,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,YAAY,EAAE,WAAW,CAAC,MAAM;YAChC,WAAW,EAAE;gBACX,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM;gBAC7D,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;gBACjE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;aAC5D;YACD,QAAQ,EAAE,WAAW;SACtB,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/security-review.d.ts

@@ -0,0 +1,6 @@
+/**
+ * security_review — Focused security analysis using OWASP patterns + AI (Pro tier)
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerSecurityReview(server: McpServer): void;
+//# sourceMappingURL=security-review.d.ts.map

package/dist/tools/security-review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-review.d.ts","sourceRoot":"","sources":["../../src/tools/security-review.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwD9D"}

package/dist/tools/security-review.js

@@ -0,0 +1,57 @@
+/**
+ * security_review — Focused security analysis using OWASP patterns + AI (Pro tier)
+ */
+import { z } from 'zod';
+import { requirePro, requireAiKey } from '../lib/license.js';
+import { aiReview, SECURITY_REVIEW_SYSTEM } from '../lib/ai-review.js';
+export function registerSecurityReview(server) {
+    server.tool('security_review', 'Focused security analysis using OWASP Top 10 patterns + AI. Identifies vulnerabilities with CWE references, attack scenarios, and specific remediation. Pro tier.', {
+        code: z.string().describe('Source code to review for security issues'),
+        language: z.string().describe('Programming language'),
+    }, async ({ code, language }) => {
+        await requirePro();
+        requireAiKey();
+        const userPrompt = [
+            `Language: ${language}`,
+            '',
+            'Review this code for security vulnerabilities:',
+            '```',
+            code,
+            '```',
+        ].join('\n');
+        try {
+            const result = await aiReview(SECURITY_REVIEW_SYSTEM, userPrompt);
+            let parsed;
+            try {
+                parsed = JSON.parse(result.content);
+            }
+            catch {
+                parsed = { raw_review: result.content };
+            }
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            security_review: parsed,
+                            meta: {
+                                model: result.model,
+                                provider: result.provider,
+                                tokens: result.tokensUsed,
+                            },
+                        }, null, 2),
+                    }],
+            };
+        }
+        catch (err) {
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            error: err instanceof Error ? err.message : String(err),
+                        }),
+                    }],
+            };
+        }
+    });
+}
+//# sourceMappingURL=security-review.js.map

package/dist/tools/security-review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-review.js","sourceRoot":"","sources":["../../src/tools/security-review.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEvE,MAAM,UAAU,sBAAsB,CAAC,MAAiB;IACtD,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,mKAAmK,EACnK;QACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;QACtE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KACtD,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC3B,MAAM,UAAU,EAAE,CAAC;QACnB,YAAY,EAAE,CAAC;QAEf,MAAM,UAAU,GAAG;YACjB,aAAa,QAAQ,EAAE;YACvB,EAAE;YACF,gDAAgD;YAChD,KAAK;YACL,IAAI;YACJ,KAAK;SACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;YAElE,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1C,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,eAAe,EAAE,MAAM;4BACvB,IAAI,EAAE;gCACJ,KAAK,EAAE,MAAM,CAAC,KAAK;gCACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gCACzB,MAAM,EAAE,MAAM,CAAC,UAAU;6BAC1B;yBACF,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;yBACxD,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}