MCP tools

Every tool the Prism MCP server exposes, generated from the tool registry the server is built from.

All of them are read-only. No consent-gated path is reachable from an agent: an agent cannot give informed consent on your behalf, so those capabilities are simply absent rather than guarded. See Consent and privacy.

Tools that return a list accept limit and answer with totalCount and truncated, so an agent can tell the first 20 of 340 from all 20 there are.

backend_report

Route-granular backend intelligence: HTTP endpoints, auth posture, data layer, environment variables and background jobs. Use when the question is specifically about the server side. Static heuristics over Express, Nest and Fastify — nothing is executed.

Arguments: packageId.

blast_radius

What depends on a file or symbol, and how risky changing it is: direct and transitive dependents, confidence lanes, evidence and a risk band. Call this before editing or deleting code you did not write. Use intent 'delete' when removing rather than modifying.

Arguments: kind, id, path, intent.

breaking_change_hints

Heuristic hints about what a change to this target could break for consumers — exported surface, widely imported modules, public entrypoints. Heuristic by design: treat as prompts to check, not as findings.

Arguments: kind, id, path.

dependency_cycles

Import and re-export cycles, each returned as the list of files forming the loop. Use when investigating build order, flaky module initialisation, or before extracting a package.

Arguments: packageAggregation, limit.

dependency_graph

The import/re-export dependency graph, at file level or aggregated to packages. Large on any real repository — prefer packageAggregation, or use blast_radius if your question is about one file rather than the whole graph.

Arguments: packageAggregation, resolveAliases.

dependency_route

Show how one file or symbol reaches another through the dependency graph, with alternative paths. Use to answer 'how is this connected to that?' — an empty result means no path exists, which is itself an answer.

Arguments: from, to, maxAlternatives, maxHops.

engineering_health

The deep engineering view: hotspots, churn, complexity, ownership concentration, knowledge decay and debt indicators in one report. Use when asked to find what needs attention. Git-derived sections fail soft on repositories without history. For the single headline number use repository_health.

Takes no arguments.

explain_area

Explain what a module or folder does: domain overlap, dependency in/out degree and local ownership. Use before editing an unfamiliar directory. Deterministic — derived from the index and local git, never generated prose.

Arguments: path.

explore_code

Everything about one file or symbol in a single call: usages, ownership, related and similar code, and a change timeline. Use when asked to understand a specific thing rather than the repository as a whole.

Arguments: kind, path, name, start.

feature_graph

Inferred features and how they depend on each other. Features are heuristic groupings of files, not a declared structure, so treat them as a starting point rather than ground truth.

Takes no arguments.

find_references

Find resolved references to a symbol — who actually calls or imports it. Pass path (and start when several symbols share a name) to disambiguate. Use before renaming or deleting anything.

Arguments: name, path, start, limit.

find_symbol

Find indexed symbols by name, optionally narrowed by file or kind. Use to locate a definition before asking about its impact.

Arguments: name, path, kind, limit.

health_history

Health score over time from stored index snapshots and optional git backfill. Use to answer 'is this getting better or worse?'. Points carry provenance: backfilled points are estimated from history, not measured at the time, and say so.

Arguments: maxPoints.

knowledge_graph

The symbol-level graph — declarations and the references between them — with summary stats. Very large on a big repository. If you are looking for one symbol use find_symbol, and for its callers use find_references.

Takes no arguments.

landmarks

Named entrypoints, package roots and feature anchors — the places a human would open first. Use to pick a starting file in an unfamiliar repository.

Arguments: limit.

list_features

Inferred features with their member files and a confidence score. Cheaper than feature_graph when you only need the list. Low confidence means the grouping is a guess.

Arguments: limit.

list_packages

List the packages in a monorepo with their roots. Call this first in a monorepo so later tools can be scoped with packageId instead of returning the whole workspace.

Arguments: limit.

rename_impact

Every edit site a rename would touch, plus breaking-change hints for public surface. Use before renaming an exported symbol or moving a file. A report only — Prism never edits.

Arguments: kind, id, path, newName.

repository_dna

Identify what a repository is: detected languages, frameworks, package manager, architecture hints, test runners and ranked domains, each with the evidence behind it. Start here when you know nothing about a codebase. Local index only; no network.

Takes no arguments.

repository_health

Score overall repository health from 0-100 with the per-factor breakdown behind the score. Use to judge whether a codebase is in good shape or to find which factor drags it down. For the deeper engineering view (hotspots, churn, ownership, debt) call engineering_health instead.

Takes no arguments.

repository_map

Return the repository's structural map at a zoom level: nodes, edges and regions. Use to orient yourself or to find where a concern lives. 'repo' and 'package' are small; 'file' and 'symbol' can be very large on a big repository, so prefer the coarsest zoom that answers your question.

Arguments: zoom, layers.

repository_overview

The dashboard summary in one call: totals, coupling density and band, the largest regions with health scores, the most connected files, and recent commit activity. Use when you want a single orienting snapshot rather than four separate calls. Region scores are null where there is no evidence — that means 'not measured', not 'zero'.

Arguments: activityDays.

review_changes

Review a set of changed paths in one call: blast radius, test impact and breaking-change hints per path, rolled up with an overall risk band. Use for 'review my branch' rather than calling the per-file tools repeatedly.

Arguments: paths, base.

safe_delete

Whether a file or symbol can be deleted safely: blockers that still depend on it, and files that would be orphaned if it went. A report only — Prism never deletes anything. Prefer this over blast_radius when the question is specifically about removal.

Arguments: kind, id, path.

security_report

Left-shift security posture: which tooling is configured, which fundamental checks are present or missing. A checklist against local configuration, not a vulnerability scan — it will not find CVEs and does not claim to.

Takes no arguments.

stack_profile

Detected stack for the workspace or a single package: frameworks, runtimes, build tooling and the signals each was detected from. Use when you need to know what a package is built with before changing its configuration.

Arguments: packageId.

test_impact

Which test files transitively cover a change target — the tests worth running after touching it. Prism reports which tests are relevant; it does not run them.

Arguments: kind, id, path.

testing_report

Test structure and, when coverage artifacts are already on disk, coverage. Use to judge how well tested an area is. Prism reads existing artifacts; it never runs your tests.

Takes no arguments.