GlitterKill / sdl-mcp

SDL-MCP **Cards-first code context for AI coding agents** *Stop feeding entire files into the context window. Start giving agents exactly the code intelligence they need.* --- What's the problem? Every time an AI coding agent reads a file to answer a question, it consumes thousands of tokens. Most of those tokens are irrelevant to the task. The agent doesn't need 500 lines of a file to know that takes a and returns a — but it reads them anyway, because that's all it has. **Multiply that across a debugging session touching 20 files and you've burned 40,000+ tokens on context gathering alone.** SDL-MCP fixes this. It indexes your codebase into a searchable **symbol graph** and serves precisely the right amount of context through a controlled escalation path. An agent that uses SDL-MCP understands your code better while consuming a fraction of the tokens. --- How it works — in 30 seconds • **Index once** — SDL-MCP parses every symbol in your repo and stores it as a compact metadata record (a "Symbol Card") in a graph database • **Query efficiently** — Agents use MCP tools to search, slice, and retrieve exactly the context they need • **Escalate only when necessary** — A four-rung ladder controls how much code the agent sees, from a 100-token card to full source (with justification required) --- Quick Start Point your MCP client at the server and the agent gains access to all SDL-MCP tools. That's it. > **npx users:** Replace with in all commands above. Full Getting Started Guide → --- The Iris Gate Ladder The core innovation. Named after the adjustable aperture that controls light flow in optics, the Iris Gate Ladder lets agents dial their context "aperture" from a pinhole to wide-open. > **Most questions are answered at Rungs 1-2** without ever reading raw code. That's where the token savings come from. | Scenario | Reading the file | Using the Ladder | Savings | |:---------|:----------------:|:----------------:|:-------:| | "What does accept?" | ~2,000 tok | ~100 tok | **20x** | | "Show me the shape of " | ~4,000 tok | ~300 tok | **13x** | | "Where is set?" | ~2,000 tok | ~500 tok | **4x** | Iris Gate Ladder Deep Dive → --- Feature Tour Symbol Cards — The Atoms of Understanding Every function, class, interface, type, and variable becomes a **Symbol Card**: a compact metadata record (~100 tokens) containing everything an agent needs to *understand* a symbol without reading its code. Cards include **confidence-scored call resolution** (the pass-2 resolver traces imports, aliases, barrel re-exports, and tagged templates to produce accurate dependency edges), **community detection** (cluster membership), and **call-chain tracing** (process participation with entry/intermediate/exit roles). Indexing & Language Support Deep Dive → --- Graph Slicing — The Right Context for Every Task Instead of reading files in the same directory, SDL-MCP follows the *dependency graph*. Starting from symbols relevant to your task, it traverses weighted edges (call: 1.0, config: 0.8, import: 0.6), scores each symbol by relevance, and returns the N most important within a token budget. Slices have handles, leases, refresh (delta-only updates), and spillover (paged overflow). You can also skip the symbol search entirely — pass a string and SDL-MCP auto-discovers the relevant entry symbols. Graph Slicing Deep Dive → --- Delta Packs & Blast Radius — Semantic Change Intelligence tells you what lines changed. SDL-MCP tells you what that change *means* and who's affected. **PR risk analysis** ( ) wraps this into a scored assessment with findings, evidence, and test recommendations. **Fan-in trend analysis** detects "amplifier" symbols whose growing dependency count means changes ripple further over time. Delta & Blast Radius Deep Dive → --- Live Indexing — Real-Time Code Intelligence SDL-MCP doesn't wait for you to save. As you type in your editor, buffer updates are pushed to an in-memory overlay store, parsed in the background, and merged with the durable database. Search, cards, and slices reflect your *current* code, not your last save. Live Indexing Deep Dive → --- Governance & Policy — Controlled Access Raw code access (Rung 4) is **policy-gated**. Agents must provide: • A **reason** explaining why they need raw code • **Identifiers** they expect to find in the code • An **expected line count** within configured limits Requests that don't meet policy are denied with actionable guidance ("try with these identifiers instead"). Every access is audit-logged. The sandboxed runtime execution tool ( ) has its own governance layer: disabled by default, executable allowlisting, CWD jailing, environment scrubbing, concurrency limits, and timeout enforcement. Governance & Policy Deep Dive → --- Agent Orchestration — Autopilot Mode is an autonomous task engine. Give it a task type ( , , , ), a description, and a budget — it plans the optimal Iris Gate path, executes it, collects evidence, and returns a synthesized answer. The feedback loop ( ) records which symbols were useful and which were missing, improving future slice quality. generates portable, token-bounded context briefings in markdown, JSON, or clipboard format for use outside MCP environments. Agent Orchestration Deep Dive → --- Sandboxed Runtime Execution Run tests, linters, and scripts through SDL-MCP's governance layer instead of uncontrolled shell access. Three runtimes (Node.js, Python, Shell), code-mode or args-mode, smart output summarization with keyword-matched excerpts, and gzip artifact persistence. Runtime Execution Deep Dive → --- Development Memories — Cross-Session Knowledge Persistence Agents forget everything between sessions. SDL-MCP fixes this with a **graph-backed memory system** that lets agents store decisions, bugfix context, and task notes linked directly to the symbols and files they relate to. Memories are stored both in the graph database (for fast querying) and as checked-in m…