weavatrix 1.17.9 → 1.17.13

package/README.md

@@ -12,8 +12,8 @@
 Weavatrix answers the questions agents otherwise invent: what breaks if this
 file changes, who consumes this n8n field, whether an MCP schema still
 accepts yesterday’s request, which viem call sites follow an ABI layout
-change, and whether `.weavatrix/architecture.json` still holds. **65
-read-only operations**, one revision-bound graph, no LSP and no prompt pack.
+change, and whether `.weavatrix/architecture.json` still holds. **66
+operations**, one revision-bound graph, no LSP and no prompt pack.
 
 Codex, Claude Code, Cursor, and Grok get impact, architecture, APIs, Git
 history, duplicates, dead code, search, semantic links,
@@ -60,7 +60,7 @@ weavatrix mcp .
 ```toml
 [mcp_servers.weavatrix]
 command = "npx"
-args = ["-y", "weavatrix@1.17.9", "mcp", "."]
+args = ["-y", "weavatrix@1.17.13", "mcp", "."]
 ```
 
 Pass an absolute repository path when the Codex process cwd is not the project
@@ -69,7 +69,7 @@ you intend to analyze.
 ### Claude Code
 
 ```sh
-claude mcp add weavatrix -- npx -y weavatrix@1.17.9 mcp .
+claude mcp add weavatrix -- npx -y weavatrix@1.17.13 mcp .
 ```
 
 ### Cursor
@@ -82,7 +82,7 @@ the plugin for the same server name:
   "mcpServers": {
     "weavatrix": {
       "command": "npx",
-      "args": ["-y", "weavatrix@1.17.9", "mcp", "${workspaceFolder}", "--output-format=structured"]
+      "args": ["-y", "weavatrix@1.17.13", "mcp", "${workspaceFolder}", "--output-format=structured"]
     }
   }
 }
@@ -91,14 +91,14 @@ the plugin for the same server name:
 Profiles expose bounded views of the same engine:
 
 ```sh
-npx -y weavatrix@1.17.9 mcp . --profile=all
-npx -y weavatrix@1.17.9 mcp . --profile=code
-npx -y weavatrix@1.17.9 mcp . --profile=seo
-npx -y weavatrix@1.17.9 mcp . --profile=n8n
-npx -y weavatrix@1.17.9 mcp . --profile=dify
-npx -y weavatrix@1.17.9 mcp . --profile=agent
-npx -y weavatrix@1.17.9 mcp . --profile=diagram
-npx -y weavatrix@1.17.9 mcp . --profile=web3
+npx -y weavatrix@1.17.13 mcp . --profile=all
+npx -y weavatrix@1.17.13 mcp . --profile=code
+npx -y weavatrix@1.17.13 mcp . --profile=seo
+npx -y weavatrix@1.17.13 mcp . --profile=n8n
+npx -y weavatrix@1.17.13 mcp . --profile=dify
+npx -y weavatrix@1.17.13 mcp . --profile=agent
+npx -y weavatrix@1.17.13 mcp . --profile=diagram
+npx -y weavatrix@1.17.13 mcp . --profile=web3
 ```
 
 The package contains native binaries for Windows x64/arm64, macOS x64/arm64,
@@ -233,7 +233,7 @@ Three commits before `ec8bf30` this package was 1.9.2; the agent reads that
 follow-up to a diff without touching the worktree. Binary blobs fail closed
 instead of being decoded into garbage.
 
-## The 65 read-only operations
+## The 66 operations
 
 | Workflow | Operations |
 | --- | --- |
@@ -244,7 +244,7 @@ instead of being decoded into garbage.
 | APIs and transports | `list_endpoints`, `trace_endpoint`, `trace_api_contract` |
 | Architecture | `architecture_inventory`, `get_architecture_contract`, `verify_architecture`, `verify_capabilities`, `explain_architecture_violation`, `propose_architecture_exception` |
 | Local CI | `ci_restrictions`, `ci_protection`, `explain_restriction` |
-| Git and repositories | `git_history`, `git_read_blob`, `cross_repo_git`, `open_repo`, `list_known_repos`, `rebuild_graph` |
+| Git and repositories | `git_history`, `git_read_blob`, `cross_repo_git`, `git_fetch`, `open_repo`, `list_known_repos`, `rebuild_graph` |
 | Native extensions | `semantic_link` |
 | n8n workflows | `n8n_inventory`, `n8n_trace`, `n8n_context` |
 | Dify apps | `dify_inventory`, `dify_trace`, `dify_context` |
@@ -252,7 +252,9 @@ instead of being decoded into garbage.
 | Mermaid diagrams | `diagram_inventory`, `diagram_trace`, `diagram_context` |
 | Web3 integration | `web3_inventory`, `web3_trace`, `web3_impact`, `web3_context` |
 
-Every operation is read-only with respect to the analyzed repository.
+Every operation leaves the analyzed repository unchanged.
+`git_fetch` writes only its cache: a depth-1 checkout of one URL. The launch
+root stays pinned.
 Pagination and explicit limits bound large neighborhoods, histories, searches,
 and contract inventories.
 
@@ -329,12 +331,12 @@ coding agent
     |
     | MCP over stdio
     v
-weavatrix 1.17.9
+weavatrix 1.17.13
     profile catalog · refresh · watcher · MCP framing
     |
     v
-weavatrix-rust 2.17.9
-    typed graph · analysis · 65 product operations including local CI, n8n, Dify, agent packages, Mermaid, and Web3
+weavatrix-rust 2.17.11
+    typed graph · analysis · 66 product operations including local CI, n8n, Dify, agent packages, Mermaid, and Web3
 ```
 
 This npm product owns MCP transport and native distribution. The

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "weavatrix",
-  "version": "1.17.9",
-  "weavatrixEngineVersion": "2.17.9",
-  "description": "Native repository intelligence for coding agents: 65 read-only MCP operations backed by typed evidence graphs, impact, architecture, local CI restrictions, APIs, Git, search, semantic links, n8n workflows, Dify apps, agent packages, Mermaid diagrams, and Web3 ABIs.",
+  "version": "1.17.13",
+  "weavatrixEngineVersion": "2.17.11",
+  "description": "Native repository intelligence for coding agents: 66 MCP operations backed by typed evidence graphs, impact, architecture, local CI restrictions, APIs, Git, search, semantic links, n8n workflows, Dify apps, agent packages, Mermaid diagrams, and Web3 ABIs.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
   "license": "MIT",
   "homepage": "https://weavatrix.com",

package/server.json

@@ -2,19 +2,19 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.Weavatrix/weavatrix",
   "title": "Weavatrix",
-  "description": "Native Weavatrix MCP: 65 read-only tools for code, local CI, n8n, Dify, agents, Mermaid, Web3.",
+  "description": "Native Weavatrix MCP: 66 tools for code, local CI, n8n, Dify, agents, Mermaid, Web3.",
   "repository": {
     "url": "https://github.com/Weavatrix/weavatrix",
     "source": "github"
   },
-  "version": "1.17.9",
+  "version": "1.17.13",
   "websiteUrl": "https://weavatrix.com",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "weavatrix",
-      "version": "1.17.9",
+      "version": "1.17.13",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/skill/SKILL.md

@@ -95,7 +95,10 @@ tool ran. Read `evidence_completeness` and `stop_reason`. `MAX_NODES` means
 the combined cap omitted nodes.
 
 `git_history` without `path` is repository HEAD history. Pass `path` for the
-commits that touch one file or directory.
+commits that touch one file or directory. `git_fetch` is separate: one `url`
+and an optional `ref`, depth 1, into a cache. It returns `checkout` and does
+not retarget this process. Analyze that path by launching on it, or by
+`open_repo` only when this process was started with `--allow-retarget`.
 
 `find_dead_code` treats every `main.go` and every Go `func main` as an entry.
 Receiver names and function-literal parameters are not symbols.
@@ -118,6 +121,8 @@ audit and coverage results.
   `coverage_map` is an ingest. Quality builds the LCOV file.
 - Preserve exact transport identity; do not merge Kafka, AMQP/RabbitMQ, NATS,
   SNS/SQS, JMS, GraphQL, and gRPC evidence because operation names match.
-- The core is local, offline, and read-only. Use `weavatrix-refactor` only for
-  an explicitly approved write plan and `weavatrix-online` only for explicitly
-  approved network work.
+- The core reads the launch root and leaves that tree unchanged. `git_fetch`
+  is the one call that contacts a remote: it shallow-clones one URL into a
+  cache and returns that path. Use `weavatrix-refactor` only for an explicitly
+  approved write plan and `weavatrix-online` only for explicitly approved
+  network work beyond that clone.

package/skill/references/tool-routing.md

@@ -12,8 +12,8 @@ cannot silently switch to another repository. Pass an explicit
 
 - [`graph_stats`](tools/graph_stats.md) — Graph size, edge evidence and build freshness of the loaded snapshot.
 - [`get_node`](tools/get_node.md) — Resolve one exact graph node.
-- [`get_neighbors`](tools/get_neighbors.md) — Direct typed incoming and outgoing relationships. The seed is compact unless `response_detail` is `full`.
-- [`query_graph`](tools/query_graph.md) — Bounded BFS or DFS around exact or textual seeds.
+- [`get_neighbors`](tools/get_neighbors.md) — Direct typed incoming and outgoing relationships. Compact rows are direction, relation, the other node, and, when present, coupling and the call line.
+- [`query_graph`](tools/query_graph.md) — Bounded BFS or DFS around exact or textual seeds. Edges are source, target, kind, and, when present, coupling and the call line.
 - [`god_nodes`](tools/god_nodes.md) — Rank high-connectivity production nodes.
 - [`shortest_path`](tools/shortest_path.md) — Shortest typed dependency path between two nodes.
 - [`get_community`](tools/get_community.md) — Return one coupling community (containment and package edges excluded).
@@ -25,18 +25,19 @@ cannot silently switch to another repository. Pass an explicit
 - [`inspect_symbol`](tools/inspect_symbol.md) — Definition, direct relationships and source evidence.
 - [`go_to_definition`](tools/go_to_definition.md) — Resolve the symbol at a source position to its definition without guessing by name. An unresolved position omits definition.
 - [`find_references`](tools/find_references.md) — Occurrences of the symbol at a position or label, from the graph and an on-disk SCIP index if present. Test and classified rows stay out unless opted in.
-- [`context_bundle`](tools/context_bundle.md) — Compact graph and source bundle for one symbol.
+- [`context_bundle`](tools/context_bundle.md) — Compact graph and source bundle for one symbol. The subject and relationship rows are compact.
 - [`map_stacktrace`](tools/map_stacktrace.md) — Map stack-trace text onto repository files and symbols.
 
 ## Change impact and Git
 
-- [`get_dependents`](tools/get_dependents.md) — Bounded transitive reverse blast radius.
+- [`get_dependents`](tools/get_dependents.md) — Bounded transitive reverse blast radius. The seed and each dependent are id, label, kind, language, and span.
 - [`change_impact`](tools/change_impact.md) — Read-only Git change impact with graph evidence. Impacted nodes are id, label, kind, language, and span.
 - [`select_tests`](tools/select_tests.md) — Select the test suites a change most plausibly needs to run.
 - [`git_history`](tools/git_history.md) — Bounded direct Git history without launching git.
 - [`git_read_blob`](tools/git_read_blob.md) — Bounded UTF-8 file content at an immutable Git revision or blob OID; binary blobs are refused.
+- [`git_fetch`](tools/git_fetch.md) — Shallow-clone one URL at one ref into a cache and return `checkout`. Depth is 1. The process root stays pinned.
 - [`cross_repo_git`](tools/cross_repo_git.md) — Parallel histories, shared commits, or diffs across named local repositories.
-- [`verified_change`](tools/verified_change.md) — Composite pre-commit evidence and conservative verdict.
+- [`verified_change`](tools/verified_change.md) — Composite pre-commit evidence and conservative verdict. `impact_depth` bounds the embedded blast radius. Selected symbols and data-flow edges are compact.
 - [`graph_diff`](tools/graph_diff.md) — Compare the current snapshot with an immutable Git revision.
 
 ## Quality and architecture
@@ -45,7 +46,7 @@ cannot silently switch to another repository. Pass an explicit
 - [`ci_restrictions`](tools/ci_restrictions.md) — Local GitHub Actions checks and conditional applicability.
 - [`ci_protection`](tools/ci_protection.md) — Candidate checks and declared rule bindings for an explicit file list. Membership ids in the answer are path labels. Not included in change or diff answers.
 - [`explain_restriction`](tools/explain_restriction.md) — One restriction and its evidence limits.
-- [`find_duplicates`](tools/find_duplicates.md) — Deterministic Type-1/2/3 clone families. `.gen.` and `.generated.` files stay out unless `include_boilerplate` is set.
+- [`find_duplicates`](tools/find_duplicates.md) — Deterministic Type-1/2/3 clone families. `.gen.`, `.generated.`, and OpenAPI Generator headers stay out unless `include_boilerplate` is set.
 - [`find_dead_code`](tools/find_dead_code.md) — Conservative unreferenced-symbol review queue. A type-only import does not keep its target live.
 - [`run_audit`](tools/run_audit.md) — Repository structure and evidence completeness audit. A named category collects only that section.
 - [`coverage_map`](tools/coverage_map.md) — Ingest a report Quality already built. Does not run tests. Missing report is unmeasured, not 0%.
@@ -60,7 +61,7 @@ cannot silently switch to another repository. Pass an explicit
 
 ## APIs and transports
 
-- [`list_endpoints`](tools/list_endpoints.md) — Compact HTTP endpoint inventory. `max_results` pages it and reports `endpoints_total`.
+- [`list_endpoints`](tools/list_endpoints.md) — Compact HTTP endpoint inventory. `max_results` pages it and reports `endpoints_total`. App Router `route.*` files contribute one endpoint per exported HTTP method. A Go struct that embeds `Unimplemented*Server` contributes `GRPC Service/Method`. A `"use server"` file contributes `ACTION /path/name`.
 - [`trace_endpoint`](tools/trace_endpoint.md) — Resolve an endpoint and its bounded call neighborhood.
 - [`trace_api_contract`](tools/trace_api_contract.md) — Cross-repository HTTP, GraphQL, gRPC and event-transport contract evidence for named backend and client roots.
 

package/skill/references/tools/context_bundle.md

@@ -4,7 +4,7 @@ Compact graph and source bundle for one symbol.
 
 ## When to use
 
-Assemble a ranked, token-bounded workset around one task or target.
+Assemble a ranked, token-bounded workset around one task or target. The subject is id, label, kind, language, and span. Relationship rows match compact `get_neighbors`.
 
 ## Inputs
 

package/skill/references/tools/find_duplicates.md

@@ -4,7 +4,7 @@ Deterministic Type-1/2/3 clone families.
 
 ## When to use
 
-Review bounded Type-1, Type-2, or Type-3 clone families before confirming candidates in source. Files named `.gen.` or `.generated.` stay out unless `include_boilerplate` is set.
+Review bounded Type-1, Type-2, or Type-3 clone families before confirming candidates in source. Files named `.gen.` or `.generated.`, and files whose header says they were generated by openapi-generator.tech, stay out unless `include_boilerplate` is set.
 
 ## Inputs
 

package/skill/references/tools/get_dependents.md

@@ -4,7 +4,7 @@ Bounded transitive reverse blast radius.
 
 ## When to use
 
-Measure a bounded transitive reverse blast radius from one exact node.
+Measure a bounded transitive reverse blast radius from one exact node. The seed and each dependent are id, label, kind, language, and span. Attributes stay on `get_node`.
 
 ## Inputs
 

package/skill/references/tools/get_neighbors.md

@@ -4,7 +4,7 @@ Direct typed incoming and outgoing relationships.
 
 ## When to use
 
-Inspect only the direct typed incoming and outgoing relationships of one exact node. The seed is id, label, kind, language, and span unless `response_detail` is `full`. Test and classified neighbors stay out unless `include_tests` or `include_classified` is set.
+Inspect only the direct typed incoming and outgoing relationships of one exact node. The seed and each neighbor node are id, label, kind, language, and span unless `response_detail` is `full`. A compact row also carries direction, relation, and, when present, coupling and the call line. Test and classified neighbors stay out unless `include_tests` or `include_classified` is set.
 
 For transitive reverse impact use `get_dependents`; for bounded multi-hop exploration use `query_graph`.
 

package/skill/references/tools/git_fetch.md

@@ -0,0 +1,27 @@
+# `git_fetch`
+
+Shallow-clone one Git URL at one ref into a local cache and return that checkout. Depth is 1. This launches git and writes only the cache. The process root stays pinned. `git_history` still reads the active repository.
+
+## When to use
+
+The repository to analyze is a remote URL, and this process is pinned to another root. Call `git_fetch`, then launch a new process on `checkout`, or call `open_repo` with that path only when this process was started with `--allow-retarget`. A repeated call for the same URL updates the same cache entry. The cache is not a working copy to edit.
+
+## Inputs
+
+- `url` (string, required) — https, http, ssh, git, or file URL, scp-style `git@host:path`, or an absolute local path. A URL that embeds credentials is refused. A trailing `.git` names the same cache entry.
+- `ref` (string) — branch, tag, or commit. Omit it to fetch the remote HEAD. Depth is always 1.
+- `output_format` ("text" | "json" | "structured", default "json") — text returns one JSON text block of the full payload, not a shorter summary; json returns structured output and mirrors that JSON into text, so the answer is about twice as large; structured drops the mirror and is the smaller payload when the client reads structuredContent.
+
+## Minimal call
+
+```json
+{
+  "name": "git_fetch",
+  "arguments": {
+    "url": "https://github.com/org/repo",
+    "ref": "main"
+  }
+}
+```
+
+The answer carries `checkout`, `commit`, `ref`, `depth` 1, and `reused`. `repository_context.root` remains the launch root. The live MCP `tools/list` schema remains authoritative for this installed version.

package/skill/references/tools/list_endpoints.md

@@ -4,7 +4,7 @@ Inventory statically extracted HTTP endpoints.
 
 ## When to use
 
-Inventory statically extracted HTTP endpoints with optional method and path filters. Each row is a compact node: id, label, kind, language, and span. `max_results` pages that list and the answer reports `endpoints_total`; omit it to return every visible endpoint.
+Inventory statically extracted HTTP endpoints with optional method and path filters. Each row is a compact node: id, label, kind, language, and span. `max_results` pages that list and the answer reports `endpoints_total`; omit it to return every visible endpoint. An App Router `route.*` file under `app` contributes one endpoint per exported HTTP method. The URL is the directory path; route groups are omitted. A Go struct that embeds `Unimplemented*Server` contributes `GRPC Service/Method`. A file whose first statement is `"use server"` contributes `ACTION /path/name` for each exported function. Page, layout, and route modules stay on their own rules.
 
 ## Inputs
 

package/skill/references/tools/query_graph.md

@@ -4,7 +4,7 @@ Bounded BFS or DFS around exact or textual seeds.
 
 ## When to use
 
-Traverse a bounded BFS or DFS when a question needs several hops, direction controls, or multiple seeds.
+Traverse a bounded BFS or DFS when a question needs several hops, direction controls, or multiple seeds. Each edge is source, target, kind, and, when present, coupling and the call line.
 
 Start with exact seeds and a small depth, node cap, and `token_budget`.
 

package/skill/references/tools/verified_change.md

@@ -4,7 +4,7 @@ Composite pre-commit evidence and conservative verdict.
 
 ## When to use
 
-Produce one conservative plan or verify envelope combining impact, architecture, duplicate, API, and optional test evidence.
+Produce one conservative plan or verify envelope combining impact, architecture, duplicate, API, and optional test evidence. `impact_depth` and `max_impact_nodes` bound the embedded blast radius. Selected symbols are compact nodes. Data-flow edges are source, target, kind, and, when present, coupling and the call line. Each edit context keeps at most 8 relationship rows.
 
 Use the same `task` and base revision in `phase:"plan"` and `phase:"verify"`.