mcp

type ConfirmSurfaceRequest ¶

type ConfirmSurfaceRequest struct {
	Confirmations []surface.Confirmation `json:"confirmations"`
}

ConfirmSurfaceRequest carries the agent's verdicts back to codefit.

type ConfirmSurfaceResponse ¶

type ConfirmSurfaceResponse struct {
	Findings  []findings.Finding     `json:"findings"`
	Dismissed []surface.Confirmation `json:"dismissed"`
	Uncertain []surface.Confirmation `json:"uncertain"`
	Invalid   []surface.Confirmation `json:"invalid"`
}

ConfirmSurfaceResponse is the integration result: probabilistic findings plus the traceability buckets. Stateless — built purely from the verdicts sent.

func HandleConfirmSurface(req ConfirmSurfaceRequest) ConfirmSurfaceResponse

type CoverageRequest ¶

type CoverageRequest struct {
	Language string `json:"language"`
}

CoverageRequest is the input to codefit-coverage.

type CoverageResponse ¶

type CoverageResponse struct {
	Manifest coverage.Manifest `json:"manifest"`
}

CoverageResponse carries the coverage manifest: what is audited deterministically vs reasoned over surface vs not covered.

func HandleCoverage(req CoverageRequest) (CoverageResponse, error)

type FileInput ¶

type FileInput struct {
	Path    string `json:"path"`
	Content string `json:"content"`
}

FileInput is one source file a surface tool reasons over (path + content), so the tool stays stateless — the caller passes the bytes, codefit reads nothing.

type FrontierPending ¶

type FrontierPending struct {
	Count     int                       `json:"count"`
	Note      string                    `json:"note,omitempty"`
	Endpoints []report.FrontierEndpoint `json:"endpoints,omitempty"`
}

FrontierPending declares the endpoints codefit did NOT resolve locally: the data left the handler body, so codefit concluded nothing and the agent must follow it in the code. They are named (not detailed) with a Note explaining why they are not detailed and how to fetch any of them. This is not hiding — it is prioritising while declaring the rest.

type ResolvedClean ¶

type ResolvedClean struct {
	Count     int                            `json:"count"`
	Note      string                         `json:"note,omitempty"`
	Endpoints []report.ResolvedCleanEndpoint `json:"endpoints,omitempty"`
}

ResolvedClean declares the endpoints codefit resolved locally and found clean (controls present, no gap). They are NAMED with a verification fact, not detailed. This is an affirmation — codefit looked and it is clean — not a generic "not detailed" bucket; that is why it is separate from FrontierPending.

type ScanAllRequest ¶

type ScanAllRequest struct {
	Root     string `json:"root"`
	Language string `json:"language"`
}

ScanAllRequest is the input to codefit-scan-all: a project root and language. codefit walks the project, runs the deterministic sensor and the surface queries, and returns the complete per-endpoint picture.

type ScanAllResponse ¶

type ScanAllResponse struct {
	Summary         ScanAllSummary          `json:"summary"`
	Actionable      []report.EndpointReport `json:"actionable"`
	ResolvedClean   ResolvedClean           `json:"resolved_clean"`
	FrontierPending FrontierPending         `json:"frontier_pending"`
}

ScanAllResponse is the agent-first synthesis as an ACTIONABLE summary, not the raw item dump. It has three buckets, one per resolution level, all decided by facts codefit already computes (ADR 0008):

• Actionable — resolved locally AND has a gap: full detail, the agent acts.
• ResolvedClean — resolved locally, NO gap: named + a verification fact; codefit checked and the controls are present.
• FrontierPending — not resolved locally (the data left the handler body): named; the agent follows it in the code.

ResolvedClean and FrontierPending are kept DISTINCT on purpose: one affirms codefit verified the controls, the other states codefit could not conclude — epistemological opposites the agent must distinguish (flattening them would be the old frontier-wording error). Full detail of any named endpoint is always one codefit-scan-endpoint call away.

func HandleScanAll(req ScanAllRequest) (ScanAllResponse, error)

type ScanAllSummary ¶

type ScanAllSummary struct {
	Endpoints             int `json:"endpoints"`
	DeterministicFindings int `json:"deterministic_findings"`
	SurfaceItems          int `json:"surface_items"`
	CertainConcerns       int `json:"certain_concerns"`
}

ScanAllSummary is the at-a-glance count, not a judgment.

type ScanEndpointRequest ¶

type ScanEndpointRequest struct {
	Root     string `json:"root"`
	Language string `json:"language"`
	File     string `json:"file"`
}

ScanEndpointRequest is the input to codefit-scan-endpoint: a project root, language, and the file (relative to root, as it appears in scan-all's File fields) to re-analyse on demand.

type ScanEndpointResponse ¶

type ScanEndpointResponse struct {
	File      string                  `json:"file"`
	Found     bool                    `json:"found"`
	Endpoints []report.EndpointReport `json:"endpoints,omitempty"`
	Note      string                  `json:"note,omitempty"`
}

ScanEndpointResponse carries the full per-endpoint detail for one file: every handler in it with all its concerns (signals, reason_to_review, certainty, fact fields) — the same concern contract as scan-all. Found is false when the file has no auditable concerns (not a route handler, or nothing to enumerate).

func HandleScanEndpoint(req ScanEndpointRequest) (ScanEndpointResponse, error)

type ScanRequest ¶

type ScanRequest struct {
	Root     string `json:"root"`
	Language string `json:"language"`
}

ScanRequest is the input to codefit-scan-security: a project root and language.

type ScanResponse ¶

type ScanResponse struct {
	Findings []findings.Finding     `json:"findings"`
	Surface  []findings.SurfaceItem `json:"surface"`
	Score    int                    `json:"score"`
	Blocked  bool                   `json:"blocked"`
}

ScanResponse is the deterministic + surface result over the project (the §11 contract): flat findings and surface, the dimension score, and whether the project is blocked (an unconsented critical security finding).

func HandleScanSecurity(req ScanRequest) (ScanResponse, error)

type SurfaceIDORRequest ¶

type SurfaceIDORRequest struct {
	Files []FileInput `json:"files"`
}

SurfaceIDORRequest is the input to codefit-surface-idor.

type SurfaceResponse ¶

type SurfaceResponse struct {
	Surface []findings.SurfaceItem `json:"surface"`
}

SurfaceResponse is the §11 surface contract: the items the agent must reason.

func HandleSurfaceAuthz(req SurfaceIDORRequest) (SurfaceResponse, error)

func HandleSurfaceIDOR(req SurfaceIDORRequest) (SurfaceResponse, error)

func HandleSurfaceOverfetch(req SurfaceIDORRequest) (SurfaceResponse, error)

1st  local find, no select   (structurally confirmed over-fetch — actionable)
2nd  local find, with select (limited)
3rd  frontier (service — codefit cannot see the find; kept last, honest)

type Tool ¶

type Tool string

Tool is the name of an MCP tool codefit exposes. All tools use the codefit- prefix; the codefit-surface-* family enumerates surface for the agent to reason about rather than detecting (PRD section 11).

const (
	ToolScanSecurity     Tool = "codefit-scan-security"
	ToolScanDB           Tool = "codefit-scan-db"
	ToolCheckCVEs        Tool = "codefit-check-cves"
	ToolCheckPractices   Tool = "codefit-check-practices"
	ToolScanTests        Tool = "codefit-scan-tests"
	ToolSurfaceIDOR      Tool = "codefit-surface-idor"
	ToolSurfaceAuthz     Tool = "codefit-surface-authz"
	ToolSurfaceOverfetch Tool = "codefit-surface-overfetch"
	ToolConfirmSurface   Tool = "codefit-confirm-surface"
	ToolReviewCode       Tool = "codefit-review-code"
	ToolScanAll          Tool = "codefit-scan-all"
	ToolScanEndpoint     Tool = "codefit-scan-endpoint"
	ToolBaseline         Tool = "codefit-baseline"
	ToolCoverage         Tool = "codefit-coverage"
)