Scan TODO/FIXME/XXX/HACK, prioritize by current work. Pure regex, no index. Pass current_files to boost.

MUST USE for all file edits. PREFERRED single-file edit path. Read first, then edit. Multiple edits, atomic, dry_run previews diff. Rollback/multi-file? edit_transaction.

Callers/callees at a line; use when you know line, not symbol name. Symbol-level? impact_analysis.

5-dim shape-level quality probe (techDebt/arch/blast): scores, not findings.

Shape-level code check (deterministic regex, zero LLM): naming, comment coverage, long functions, duplicated blocks, diff review (SEARCH/REPLACE). Clears shallow noise before deep review — not a correctness verdict.

NL intent search when symbol name unknown (known name? symbol_search). DETERMINISTIC token+intent matching, NOT semantic/embedding search — long natural-language sentences degrade to loose file-level hits (0.5); prefer precise symbol/file names.

Detect env vars/DB tables/services in code missing from .env.example/docker-compose. Pairs with exception_guard.

Detect dead code: unused imports/functions, orphan files, unused_guard signal. Text-reference fallback counts CLI-string refs as alive (miss-over-delete bias). Remove via edit_transaction. Out of scope: dynamic/reflection wiring.

Run command/script/test and analyze failures: 14 error types, 4-language stack traces, suggested actions. script mode auto-picks runtime (js/py/go/rs/sh). Deterministic, zero LLM.

Import dependency graph of a file (transitive N levels) or the whole project (scope=project → nodes/edges/cycles). Circular deps? fix_imports. Changing a dep? impact_analysis first.

Imports vs manifests: undeclared deps + install hints (Py/JS/Go/Rust). Pairs with guard_patterns.

After edit_transaction: AST symbol changes + caller/test sync. Stale tests? test_bridge.

Two-step guard: record_read (snapshot) after reading, check before editing. Detects external edits. Pairs edit_transaction.

Pre-validate edits: pass file + new_content (full new text), dry-run syntax check. Then edit_transaction.

DEFAULT multi-file edit path with rollback/preview/undo (begin→edit→commit). Use when unsure about changes. Single-file? edit_batch. For string params containing double quotes/backslashes, keep JSON escaping consistent across the whole string (escape uniformly or prefer full-width quotes), otherwise client-side parameter parsing fails.

Check raise/throw uses project exceptions vs builtins, module-scoped (falls back to project scope). Fix → verify test_bridge. Pairs config_drift.

Report malong tool issues/errors/ideas; collected locally.

Find test files for a source file (naming + import reverse lookup). Run them? test_bridge. AUTO-FRESH: files modified after last index are re-indexed automatically on read — explicit reindex only needed for brand-new workspaces/files.

Detect unused imports, undefined symbols, circular deps. auto_fix applies.

Trigger manual GC (needs --expose-gc). Use when memory is high.

Multi-file changes on isolated git branch: zero working-tree pollution, auto commit + ff-merge, verify_cmd. Rollback on failure.

AST rules: no bare-except/debugger/eval. Custom via .ai-patterns.json. Pre-commit gate with dependency_gatekeeper.

System check + self-healing: DB integrity, tools, memory, semaphore. actions: check/restart/cleanup.

BEFORE modifying/renaming: callers (blast radius), callees, risk (caller-count blast). Line-level? call_chain. Simple edit? read_symbol+write_symbol. AUTO-FRESH: files modified after last index are re-indexed automatically on read — explicit reindex only needed for brand-new workspaces/files.

Outline + references + call chain in one call (replaces read_outline/references/call_chain).

Detect mock/patch mismatches after signature changes. Pairs rename_symbol.

New symbol names vs project style (snake/camel/Pascal) + verb consistency. Index required.

File structure: functions/classes/signatures, no full read. depth=hierarchy nesting, NOT call depth. Known symbol? read_symbol.

Parse SEARCH/REPLACE patch text (text=...), dry-run apply. For external patch blocks.

MUST READ BEFORE WRITE. Symbol body + version (base_version for writes). Resolves by symbol_id or name+file. Full file? read_outline. AUTO-FRESH: files modified after last index are re-indexed automatically on read — explicit reindex only needed for brand-new workspaces/files.

Cross-file usages of a symbol, incl. usage counts. Use full member path (obj.method). Prefer over grep. AUTO-FRESH: files modified after last index are re-indexed automatically on read — explicit reindex only needed for brand-new workspaces/files.

MUST run FIRST: index workspace before ALL other malong tools. Over-threshold workspaces require two-step confirm (call → get token → confirm). blocking/force options. malong = LLM-native toolset.

Execute a cross-file symbol rename (edit_transaction-based). Word-boundary, string/comment-aware. dry_run previews. To see what a rename would affect FIRST, use impact_analysis.

Project code map: files ↔ symbols. For 100+ file codebases. focused+relevantEntities for token efficiency.

Scan for security patterns: injection (eval/exec/spawn/SQL/template), XSS, secrets, CORS*, insecure compare. Severity-graded, zero LLM. Suppress via malong-ignore or .ai-patterns.json. Out of scope: SSRF/XXE/deserialization/auth.

Generate module/API spec from a source file's symbols.

Sniff project code style from samples → PROJECT_RULES.md content (returns text; output dir optional).

Find symbol definitions by name (substring). Usages? references. Before edit? impact_analysis. AUTO-FRESH: files modified after last index are re-indexed automatically on read — explicit reindex only needed for brand-new workspaces/files.

Run tests, parse output, enrich failures with context. actions: run/suggest/discover. Find tests? find_tests.

Trace constant values + hardcoded copies (magic numbers). Function impact? impact_analysis. Rename? rename_symbol.

TS type-check via tsc --noEmit.

Run lint/test/typecheck from package.json. WARNING: MCP requests have a 120s hard timeout; default is 30s per stage (3 stages = 90s). Large test suites will time out — prefer stages=lint or test_bridge(action=run) for full test runs.

Guarded write path (one symbol) — vs edit_batch: index-aware with version/lock/undo, for symbol-level refactors. Read first (read_symbol) for base_version. For string params containing double quotes/backslashes, keep JSON escaping consistent across the whole string (escape uniformly or prefer full-width quotes), otherwise client-side parameter parsing fails.

Guarded write path (batch). All-or-nothing across files, deadlock-safe. Multi-file refactor? Use instead of N×write_symbol. New symbols: reindex first. For string params containing double quotes/backslashes, keep JSON escaping consistent across the whole string (escape uniformly or prefer full-width quotes), otherwise client-side parameter parsing fails.