get_security_instructions

Instructions

Implementation Reference

• src/handlers/tools.ts:87-117 (handler)

  The main handler function for the 'get_security_instructions' tool. It extracts language, context, and filepath from args, calls matchInstructions() to find matching security rules, formats them as markdown, and returns the result.

  function getSecurityInstructions(
    args: Record<string, unknown>,
    instructions: Instruction[]
  ) {
    const language = args.language as string | undefined;
    const context = args.context as string | undefined;
    const filepath = args.filepath as string | undefined;
    
    // Match instructions
    const result = matchInstructions(
      { language, context, filepath },
      instructions
    );
    
    // Format as markdown
    const content = result.instructions
      .map(i => {
        return `## ${i.frontmatter.description}\n\n${i.content}`;
      })
      .join('\n\n---\n\n');
    
    return {
      content: [
        {
          type: 'text',
          text: content || 'No specific security instructions matched. Follow general security best practices.',
        },
      ],
      isError: false,
    };
  }

• src/handlers/tools.ts:14-34 (registration)

  Registration of the tool in the listTools() function, defining name 'get_security_instructions', description, and inputSchema with optional parameters: language, context, and filepath.

  {
    name: 'get_security_instructions',
    description: 'Get security instructions for code generation. Returns applicable security rules based on language, context, or file path.',
    inputSchema: {
      type: 'object',
      properties: {
        language: {
          type: 'string',
          description: 'Programming language (python, javascript, typescript, java, c, etc.)',
        },
        context: {
          type: 'string',
          description: 'Context keywords (auth, crypto, database, api, password, hash, etc.)',
        },
        filepath: {
          type: 'string',
          description: 'File path for pattern matching (e.g., src/auth/login.ts)',
        },
      },
    },
  },

• src/handlers/tools.ts:65-67 (registration)

  Dispatch in callTool() that routes the 'get_security_instructions' tool name to the getSecurityInstructions handler function.

  if (name === 'get_security_instructions') {
    return getSecurityInstructions(args, instructions);
  }

• src/index.ts:110-114 (registration)

  Server-level registration: the CallToolRequestSchema handler in the MCP server delegates to the callTool() function from handlers/tools.ts, which dispatches to getSecurityInstructions.

  // Call a tool
  server.setRequestHandler(CallToolRequestSchema, async (request) => {
    const { name, arguments: args = {} } = request.params;
    logToFile(`[MCP] CallTool: ${name} with args: ${JSON.stringify(args)}`);
    return callTool(name, args, instructions);

• src/rules/matcher.ts:170-218 (helper)

  The matchInstructions() function called by the handler to score and select applicable security rules based on language, context, and filepath.

  export function matchInstructions(
    context: MatchContext,
    allInstructions: Instruction[]
  ): MatchResult {
    const scoredInstructions: ScoredInstruction[] = [];
    const matchedBy: MatchResult['metadata']['matchedBy'] = {};
    
    // Score all instructions
    for (const instruction of allInstructions) {
      const scored = scoreInstruction(instruction, context);
      if (scored.score > 0) {
        scoredInstructions.push(scored);
      }
    }
    
    // Sort by priority (high to low), then by score
    scoredInstructions.sort((a, b) => {
      if (a.priority !== b.priority) {
        return b.priority - a.priority;
      }
      return b.score - a.score;
    });
    
    // Count matches by type
    matchedBy.critical = scoredInstructions.filter(s => s.priority === Priority.CRITICAL).length;
    matchedBy.language = scoredInstructions.filter(s => s.matchReasons.includes('language')).length;
    matchedBy.filepath = scoredInstructions.filter(s => s.matchReasons.includes('filepath')).length;
    matchedBy.context = scoredInstructions.filter(s => s.matchReasons.includes('context')).length;
    
    // Priority breakdown
    const priorityBreakdown = {
      critical: scoredInstructions.filter(s => s.priority === Priority.CRITICAL).length,
      high: scoredInstructions.filter(s => s.priority === Priority.HIGH).length,
      medium: scoredInstructions.filter(s => s.priority === Priority.MEDIUM).length,
      low: scoredInstructions.filter(s => s.priority === Priority.LOW).length,
    };
    
    // Limit to top 15 rules to keep response size manageable
    const topInstructions = scoredInstructions.slice(0, 15);
    
    return {
      instructions: topInstructions.map(s => s.instruction),
      metadata: {
        totalMatched: scoredInstructions.length,
        matchedBy,
        priorityBreakdown,
      },
    };
  }