Eclipse Legacy Recon MCP

Powered by Cyan Eclipse Technologies — https://cetech.ai

Point an agent at a codebase: narrowed-scope architecture map, dependency/EOL risk list, modernization estimate inputs.

Status — honest labels

v0.1.0, local, read-only. MCP over stdio, Python stdlib only. No certification claimed. The latest bench card (-10, 2026-10-26) is FAILED 22/25 at the former universal JS/TS claim; the owner disposition is to narrow the claims to the observed scope in CLAIM-SCOPE.md, not to stand the product as permanently FAILED and not to run a fourth fix round. A scoped re-bench is still required before any certification claim. Catalog entry: legacy-recon-mcp (spec sketch: mcp-product-slate-20261023.md §5). Free; services-led assessment funnel into CETech's legacy modernization line.

Related MCP server: archiet-xray

Claim scope — narrowed to what was observed

Within CLAIM-SCOPE.md, reported entries cite the file path plus the manifest line, structural fact, or inference basis they rest on. The standing UNKNOWN categories implemented by the engine carry reasons — never a guessed stack. OBSERVED is a scoped positive inventory, not an exhaustive inventory.

Withdrawn by name in the canonical scope note: JS/TS multiline block-comment continuation after a split no-closing-slash span (W1); chained no-closing-slash JS/TS spans (W2); B-LR-14 invalid-line identifier-follow shapes (W3); exhaustive OBSERVED recall (W4); dynamic-import observation or a dedicated dynamic-import UNKNOWN (W5); .mts/.cts OBSERVED extraction (W6); completeness over permission-denied subtrees (W7); report-and-skip treatment of self-referential symlink loops (W8); and hosted/authenticated/multi-tenant operation (W9).

Novel mechanism — evidence-bound recon at the narrowed scope

At the narrowed scope, the dependency inventory distinguishes, in separate lists that are never blended:

• DECLARED — parsed from a manifest, with the manifest line as evidence.

• OBSERVED — positive import reports in code within CLAIM-SCOPE.md, with file + line as evidence (internal imports flagged internal); not an exhaustive inventory.

• INFERRED — labeled inference with its basis stated (e.g. import root PIL → distribution Pillow via a built-in mapping table; an import with no matching declared entry → inferred undeclared dependency).

Tools

recon_scan (combined narrowed-scope report) · architecture_map · dependency_risk_list · modernization_inputs

All take path (required string) and optional max_files (integer, 1–50000, default 5000, via the house coerce_int_param guard pattern).

Modernization outputs are INPUTS, not an estimate: LOC by language, test file presence / test-LOC ratio, manifest filesystem-mtime signals (explicitly not commit age — git history is UNKNOWN in v0.1), and coupling hotspots by fan-in. No effort, cost, or duration figure is produced.

Manifests + EOL rules supported

Manifest parsers: requirements.txt, Pipfile, pyproject.toml, setup.py/setup.cfg (python_requires), package.json, composer.json, Gemfile, pom.xml, go.mod, Cargo.toml; runtime pins from .python-version, .nvmrc, .ruby-version, runtime.txt, engines.node, requires-python, pom java.version.

EOL risk comes only from a small, explicit, versioned-in-code rules table (EOL_RULES_VERSION = 2026-10-25.1 in recon_engine.py): Python 2.7/3.6/3.7/3.8, Node 12/14/16/18, PHP 7.4/8.0, Ruby 2.7/3.0, Django 2.2/3.2/4.0/4.1, AngularJS 1.x, Rails 5.2/6.0, Flask 1.0. Every EOL claim cites its rule_id. No rule match = no claim (absence of a rule is never a claim of support). Unpinned declared versions surface as UNPINNED_VERSION.

Safety

• Target code is never executed, imported, or shelled out to; no network calls.

• Symlinks are never traversed — ordinary resolvable symlinks are reported; one resolving outside the target tree is flagged escape: true. A self-referential symlink loop is the named exception in CLAIM-SCOPE.md W8: it can refuse the scan with TARGET_PATH_INVALID instead of being reported and skipped.

• Binary files are skipped and counted, never parsed as text; files over 1 MB are not text-parsed.

• Caps fail visibly: hitting max_files sets truncated: true + MAX_FILES_REACHED — a truncated scan never presents as complete.

• Named, fail-closed refusals: TARGET_NOT_FOUND, TARGET_NOT_DIRECTORY, TARGET_EMPTY, TARGET_PATH_INVALID, MAX_FILES_INVALID, ARGUMENTS_INVALID. Malformed wire args are -32602 naming the argument, never a raw -32603.

• VCS/cache/vendor dirs (.git, __pycache__, node_modules, vendor, …) are skipped and listed.

Run it

python3 server.py                      # stdio
python3 -m unittest discover -s tests  # acceptance + schema fuzz
python3 smoke.py                       # subprocess stdio smoke

Fixtures: fixtures/legacy-tree/ — synthetic mixed Python+JS legacy tree: Django 3.2 + Python 3.8 + Node 16 + AngularJS EOL pins, unpinned requests, a binary blob, and a symlink escape attempt (escape_link → /etc, recreated by tests/smoke if absent).

Limitations (v0.1)

CLAIM-SCOPE.md is the controlling claim boundary. In particular:

• No lockfile parsing; no Gradle dependency extraction; no git history (manifest age = mtime only); DB/CI/deployment are standing UNKNOWN categories; the EOL table is deliberately small and covers only its listed rules.

• Import scanning is regex-based, not AST. OBSERVED extraction is a scoped positive report and takes at most one regex match per physical line. The bench-derived OBSERVED accuracy scope in CLAIM-SCOPE.md is stated for Python and JS/TS; no separate bench-observed accuracy claim is made for the Go/Ruby/Java/PHP import patterns.

• JS/TS recall can miss split require(/import forms, a second import on a line, and imports after template over-masking shapes named in CLAIM-SCOPE.md W4. Python recall can miss semicolon/statement-followed imports on a line, comma-list second modules, backslash continuations, and relative from-imports.

• Dynamic imports are not guessed into OBSERVED, and there is no dedicated dynamic-import UNKNOWN entry (W5).

• .mts and .cts files do not receive OBSERVED extraction (W6).

• A permission-denied subdirectory can be omitted without a truncation flag, so no completeness claim is made over such a tree (W7).

A Cyan Eclipse Technologies product. The "Powered by Cyan Eclipse Technologies" attribution travels with it.