traceforge-toolkit 0.1.0__py3-none-any.whl

traceforge/classify/data/mcp_profiles.yaml

@@ -0,0 +1,711 @@
+# MCP server profiles — classification rules for known MCP servers.
+# Add profiles here for custom MCP servers your tools use.
+
+mcp_profiles:
+  - id: github
+    namespace_aliases: [github, gh]
+    mechanism: network.http
+    role: [retriever.api_client, persistence.version_control]
+    scope: [state.repository]
+    capability: [network_outbound]
+    tool_overrides:
+      delete_file:
+        effect: destructive
+      discussion_comment_write:
+        effect: mutating
+      label_write:
+        effect: mutating
+      projects_write:
+        effect: mutating
+      get_code_scanning_alert:
+        scope: [state.repository, artifact.source_code]
+      list_code_scanning_alerts:
+        scope: [state.repository, artifact.source_code]
+      get_dependabot_alert:
+        scope: [configuration.dependency]
+      list_dependabot_alerts:
+        scope: [configuration.dependency]
+      actions_run_trigger:
+        role: [orchestrator.ci_cd]
+        scope: [configuration.ci_cd]
+      actions_list:
+        role: [orchestrator.ci_cd]
+        scope: [configuration.ci_cd]
+      actions_get:
+        role: [orchestrator.ci_cd]
+        scope: [configuration.ci_cd]
+      get_job_logs:
+        role: [orchestrator.ci_cd]
+        scope: [configuration.ci_cd]
+      assign_copilot_to_issue:
+        mechanism: delegation.agent
+      request_copilot_review:
+        mechanism: delegation.agent
+      create_pull_request_with_copilot:
+        mechanism: delegation.agent
+
+  - id: gitlab
+    namespace_aliases: [gitlab]
+    mechanism: network.http
+    role: [retriever.api_client, persistence.version_control]
+    scope: [state.repository]
+    capability: [network_outbound]
+
+  - id: git_local
+    namespace_aliases: [git, mcp_server_git]
+    mechanism: process.shell
+    role: [persistence.version_control]
+    scope: [state.repository]
+    capability: [filesystem_write]
+
+  - id: filesystem
+    namespace_aliases: [filesystem, fs, file]
+    mechanism: filesystem
+    role: [retriever.file_browser]
+    scope: [artifact.source_code]
+    capability: [filesystem_read]
+    tool_overrides:
+      write_file:
+        effect: mutating
+        role: [modifier.file_editor]
+        capability: [filesystem_write]
+      edit_file:
+        effect: mutating
+        role: [modifier.file_editor]
+        capability: [filesystem_write]
+      create_directory:
+        effect: mutating
+        capability: [filesystem_write]
+      move_file:
+        effect: mutating
+        role: [modifier.file_editor]
+        capability: [filesystem_write]
+
+  - id: database_generic
+    namespace_aliases: [database, db, sql]
+    mechanism: database.sql
+    role: [persistence.database]
+    capability: [network_outbound]
+
+  - id: postgres
+    namespace_aliases: [postgres, postgresql, pg]
+    mechanism: database.sql
+    role: [persistence.database]
+    default_effect: read_only
+    capability: [network_outbound]
+
+  - id: sqlite
+    namespace_aliases: [sqlite]
+    mechanism: database.sql
+    role: [persistence.database]
+    capability: [filesystem_read]
+    tool_overrides:
+      write_query:
+        effect: mutating
+        capability: [filesystem_write]
+      create_table:
+        effect: mutating
+        capability: [filesystem_write]
+
+  - id: mysql
+    namespace_aliases: [mysql]
+    mechanism: database.sql
+    role: [persistence.database]
+    default_effect: read_only
+    capability: [network_outbound]
+
+  - id: mongodb
+    namespace_aliases: [mongodb, mongo]
+    mechanism: database.nosql
+    role: [persistence.database]
+    capability: [network_outbound]
+    tool_overrides:
+      drop_collection:
+        effect: destructive
+
+  - id: redis
+    namespace_aliases: [redis]
+    mechanism: database.nosql
+    role: [persistence.cache]
+    capability: [network_outbound]
+
+  - id: playwright
+    namespace_aliases: [playwright, browser]
+    mechanism: network.http
+    role: [retriever.web_scraper]
+    capability: [network_outbound]
+    tool_overrides:
+      browser_snapshot:
+        effect: read_only
+      browser_take_screenshot:
+        effect: read_only
+      browser_console_messages:
+        effect: read_only
+      browser_network_requests:
+        effect: read_only
+      browser_network_request:
+        effect: read_only
+      browser_cookie_list:
+        effect: read_only
+      browser_cookie_get:
+        effect: read_only
+      browser_route_list:
+        effect: read_only
+      browser_get_config:
+        effect: read_only
+      browser_evaluate:
+        effect: mutating
+      browser_run_code_unsafe:
+        effect: destructive
+      browser_cookie_delete:
+        effect: destructive
+      browser_cookie_clear:
+        effect: destructive
+      browser_localstorage_clear:
+        effect: destructive
+
+  - id: puppeteer
+    namespace_aliases: [puppeteer]
+    mechanism: network.http
+    role: [retriever.web_scraper]
+    capability: [network_outbound]
+    tool_overrides:
+      puppeteer_screenshot:
+        effect: read_only
+      puppeteer_evaluate:
+        effect: mutating
+
+  - id: brave_search
+    namespace_aliases: [brave, brave_search]
+    mechanism: network.http
+    role: [retriever.search_index]
+    default_effect: read_only
+    action: [retrieve.search]
+    capability: [network_outbound]
+
+  - id: fetch
+    namespace_aliases: [fetch]
+    mechanism: network.http
+    role: [retriever.web_scraper]
+    default_effect: read_only
+    action: [retrieve.read]
+    capability: [network_outbound]
+
+  - id: exa
+    namespace_aliases: [exa]
+    mechanism: network.http
+    role: [retriever.search_index]
+    default_effect: read_only
+    action: [retrieve.search]
+    capability: [network_outbound]
+
+  - id: tavily
+    namespace_aliases: [tavily]
+    mechanism: network.http
+    role: [retriever.search_index]
+    default_effect: read_only
+    action: [retrieve.search]
+    capability: [network_outbound]
+
+  - id: slack
+    namespace_aliases: [slack]
+    mechanism: network.http
+    role: [retriever.api_client]
+    capability: [network_outbound]
+
+  - id: discord
+    namespace_aliases: [discord]
+    mechanism: network.http
+    role: [retriever.api_client]
+    capability: [network_outbound]
+
+  - id: memory
+    namespace_aliases: [memory, knowledge]
+    mechanism: database
+    role: [persistence.database]
+    tool_overrides:
+      delete_entities:
+        effect: destructive
+      delete_relations:
+        effect: destructive
+      delete_observations:
+        effect: destructive
+
+  - id: thinking
+    namespace_aliases: [sequentialthinking, thinking]
+    mechanism: communication.system
+    role: [communicator.system_reporter]
+    default_effect: read_only
+
+  - id: sentry
+    namespace_aliases: [sentry]
+    mechanism: network.http
+    role: [retriever.api_client]
+    default_effect: read_only
+    capability: [network_outbound]
+
+  - id: datadog
+    namespace_aliases: [datadog]
+    mechanism: network.http
+    role: [retriever.api_client]
+    default_effect: read_only
+    capability: [network_outbound]
+
+  - id: aws
+    namespace_aliases: [aws, awslabs]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [configuration.infrastructure]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      # Destructive operations
+      delete_stack:
+        effect: destructive
+      terminate_instances:
+        effect: destructive
+      delete_bucket:
+        effect: destructive
+      delete_function:
+        effect: destructive
+      delete_table:
+        effect: destructive
+      delete_cluster:
+        effect: destructive
+      delete_db_instance:
+        effect: destructive
+      delete_secret:
+        effect: destructive
+      delete_queue:
+        effect: destructive
+      remove_targets:
+        effect: destructive
+      # Mutating operations
+      create_stack:
+        effect: mutating
+        role: [orchestrator.task_runner]
+      update_stack:
+        effect: mutating
+      invoke_function:
+        effect: mutating
+      run_task:
+        effect: mutating
+      start_execution:
+        effect: mutating
+      put_item:
+        effect: mutating
+      # Read-only operations
+      describe_instances:
+        effect: read_only
+      list_buckets:
+        effect: read_only
+      get_caller_identity:
+        effect: read_only
+      describe_stacks:
+        effect: read_only
+      list_functions:
+        effect: read_only
+
+  - id: azure
+    namespace_aliases: [azure]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [configuration.infrastructure]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      # Destructive operations
+      delete_resource_group:
+        effect: destructive
+      delete_vm:
+        effect: destructive
+      delete_webapp:
+        effect: destructive
+      delete_aks_cluster:
+        effect: destructive
+      purge_keyvault:
+        effect: destructive
+      delete_storage_account:
+        effect: destructive
+      delete_sql_server:
+        effect: destructive
+      delete_cosmosdb_account:
+        effect: destructive
+      # Mutating operations
+      create_resource_group:
+        effect: mutating
+      create_vm:
+        effect: mutating
+      deploy_arm_template:
+        effect: mutating
+        role: [orchestrator.task_runner]
+      create_aks_cluster:
+        effect: mutating
+      # Read-only operations
+      list_resource_groups:
+        effect: read_only
+      show_vm:
+        effect: read_only
+      list_storage_accounts:
+        effect: read_only
+
+  - id: gcp
+    namespace_aliases: [gcp, gcloud, google_cloud]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [configuration.infrastructure]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      # Destructive operations
+      delete_instance:
+        effect: destructive
+      delete_cluster:
+        effect: destructive
+      delete_function:
+        effect: destructive
+      delete_service:
+        effect: destructive
+      delete_bucket:
+        effect: destructive
+      delete_topic:
+        effect: destructive
+      delete_subscription:
+        effect: destructive
+      delete_secret:
+        effect: destructive
+      # Mutating operations
+      create_instance:
+        effect: mutating
+      create_cluster:
+        effect: mutating
+      deploy_service:
+        effect: mutating
+        role: [orchestrator.task_runner]
+      set_iam_policy:
+        effect: mutating
+      add_iam_policy_binding:
+        effect: mutating
+      # Read-only operations
+      list_instances:
+        effect: read_only
+      describe_instance:
+        effect: read_only
+      get_iam_policy:
+        effect: read_only
+      list_clusters:
+        effect: read_only
+
+  - id: docker
+    namespace_aliases: [docker]
+    mechanism: process
+    role: [executor.container_runtime]
+    scope: [artifact.container_image]
+    capability: [subprocess]
+    tool_overrides:
+      docker_rm:
+        effect: destructive
+      docker_rmi:
+        effect: destructive
+      docker_volume_rm:
+        effect: destructive
+      docker_compose_down:
+        effect: destructive
+      docker_push:
+        mechanism: network.http
+        capability: [network_outbound]
+
+  - id: kubernetes
+    namespace_aliases: [kubernetes, k8s, kubectl]
+    mechanism: network.http
+    role: [executor.container_runtime]
+    scope: [state.deployment]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      delete_pod:
+        effect: destructive
+      delete_deployment:
+        effect: destructive
+      delete_namespace:
+        effect: destructive
+      exec_in_pod:
+        mechanism: process
+        capability: [subprocess]
+
+  - id: notion
+    namespace_aliases: [notion]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [artifact.documentation]
+    capability: [network_outbound]
+    tool_overrides:
+      notion_delete_block:
+        effect: destructive
+
+  - id: gdrive
+    namespace_aliases: [gdrive, google_drive]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [artifact.documentation]
+    capability: [network_outbound]
+
+  - id: confluence
+    namespace_aliases: [confluence]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [artifact.documentation]
+    capability: [network_outbound]
+
+  - id: circleci
+    namespace_aliases: [circleci]
+    mechanism: network.http
+    role: [orchestrator.ci_cd]
+    scope: [configuration.ci_cd]
+    capability: [network_outbound]
+
+  - id: npm
+    namespace_aliases: [npm, npmjs]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [configuration.dependency]
+    default_effect: read_only
+    action: [retrieve.read]
+    capability: [network_outbound]
+
+  - id: pypi
+    namespace_aliases: [pypi]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [configuration.dependency]
+    default_effect: read_only
+    action: [retrieve.read]
+    capability: [network_outbound]
+
+  - id: semgrep
+    namespace_aliases: [semgrep]
+    mechanism: process
+    role: [validator.security_scanner]
+    default_effect: read_only
+    action: [validate.security_scan]
+    scope: [artifact.source_code]
+    capability: [subprocess]
+
+  - id: maps
+    namespace_aliases: [maps, google_maps]
+    mechanism: network.http
+    role: [retriever.api_client]
+    default_effect: read_only
+    action: [retrieve.read]
+    capability: [network_outbound]
+
+  - id: time
+    namespace_aliases: [time]
+    mechanism: communication.system
+    role: [communicator.system_reporter]
+    default_effect: read_only
+    action: [retrieve.read]
+
+  # ─── Code intelligence / agent supervision ─────────────────────────────
+
+  - id: coderecon
+    namespace_aliases: [coderecon, code_recon]
+    mechanism: process
+    role: [retriever.search_index]
+    default_effect: read_only
+    scope: [artifact.source_code]
+    capability: [subprocess]
+    tool_overrides:
+      refactor_commit:
+        effect: mutating
+        role: [modifier.file_editor]
+        capability: [filesystem_write]
+      checkpoint:
+        effect: mutating
+        role: [persistence.version_control]
+        capability: [filesystem_write, subprocess]
+      refactor_rename:
+        effect: read_only
+      refactor_move:
+        effect: read_only
+      blast_radius:
+        scope: [artifact.test_code]
+      covering_tests:
+        scope: [artifact.test_code]
+      recon_line_coverage:
+        scope: [artifact.test_code]
+
+  - id: codeplane
+    namespace_aliases: [codeplane, cpl]
+    mechanism: network.http
+    role: [orchestrator.task_runner]
+    scope: [artifact.source_code]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      codeplane_job:
+        role: [orchestrator.task_runner]
+      codeplane_approval:
+        effect: mutating
+      codeplane_workspace:
+        effect: read_only
+        role: [retriever.file_browser]
+      codeplane_artifact:
+        effect: read_only
+        role: [retriever.file_browser]
+      codeplane_repo:
+        role: [orchestrator.task_runner]
+      codeplane_settings:
+        effect: mutating
+      codeplane_health:
+        effect: read_only
+
+  # ─── Project management / issue tracking ────────────────────────────────
+
+  - id: linear
+    namespace_aliases: [linear, mcp_server_linear]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [artifact.documentation]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      create_issue:
+        effect: mutating
+      update_issue:
+        effect: mutating
+      delete_issue:
+        effect: destructive
+
+  - id: jira
+    namespace_aliases: [jira, atlassian]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [artifact.documentation]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      create_issue:
+        effect: mutating
+      transition_issue:
+        effect: mutating
+      delete_issue:
+        effect: destructive
+
+  - id: todoist
+    namespace_aliases: [todoist]
+    mechanism: network.http
+    role: [retriever.api_client]
+    default_effect: read_only
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      create_task:
+        effect: mutating
+      complete_task:
+        effect: mutating
+      delete_task:
+        effect: destructive
+
+  # ─── Design tools ──────────────────────────────────────────────────────
+
+  - id: figma
+    namespace_aliases: [figma, cursor_talk_to_figma]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [artifact.documentation]
+    default_effect: read_only
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      modify_layers:
+        effect: mutating
+      delete_node:
+        effect: destructive
+
+  # ─── Payments / SaaS APIs ──────────────────────────────────────────────
+
+  - id: stripe
+    namespace_aliases: [stripe]
+    mechanism: network.http
+    role: [retriever.api_client]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      create_charge:
+        effect: mutating
+      create_refund:
+        effect: mutating
+      delete_customer:
+        effect: destructive
+
+  # ─── Deployment / infrastructure ───────────────────────────────────────
+
+  - id: vercel
+    namespace_aliases: [vercel]
+    mechanism: network.http
+    role: [orchestrator.task_runner]
+    scope: [state.deployment]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      deploy_project:
+        effect: mutating
+      delete_deployment:
+        effect: destructive
+
+  - id: supabase
+    namespace_aliases: [supabase]
+    mechanism: network.http
+    role: [persistence.database]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      query_database:
+        mechanism: database.sql
+      upload_file:
+        effect: mutating
+      delete_record:
+        effect: destructive
+
+  - id: cloudflare
+    namespace_aliases: [cloudflare]
+    mechanism: network.http
+    role: [retriever.api_client]
+    scope: [configuration.infrastructure]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      manage_dns:
+        effect: mutating
+      delete_worker:
+        effect: destructive
+      kv_put:
+        effect: mutating
+      kv_delete:
+        effect: destructive
+
+  # ─── CI/CD ─────────────────────────────────────────────────────────────
+
+  - id: jenkins
+    namespace_aliases: [jenkins]
+    mechanism: network.http
+    role: [orchestrator.ci_cd]
+    scope: [configuration.ci_cd]
+    capability: [network_outbound, uses_credentials]
+
+  - id: github_actions
+    namespace_aliases: [github_actions]
+    mechanism: network.http
+    role: [orchestrator.ci_cd]
+    scope: [configuration.ci_cd]
+    capability: [network_outbound, uses_credentials]
+
+  # ─── Web scraping / search ─────────────────────────────────────────────
+
+  - id: firecrawl
+    namespace_aliases: [firecrawl]
+    mechanism: network.http
+    role: [retriever.web_scraper]
+    default_effect: read_only
+    capability: [network_outbound, uses_credentials]
+
+  # ─── Data warehouses ───────────────────────────────────────────────────
+
+  - id: snowflake
+    namespace_aliases: [snowflake]
+    mechanism: database.sql
+    role: [persistence.database]
+    capability: [network_outbound, uses_credentials]
+    tool_overrides:
+      drop_table:
+        effect: destructive
+      truncate_table:
+        effect: destructive