# io.github.sergii-ziborov/weavatrix-refactor (npm · weavatrix-refactor)

Transactional refactoring MCP with 11 evidence-backed tools, hash-bound previews, and rollback.

- Trust score: 78/100 (medium)
- Change this week: −9
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `weavatrix-refactor`: 78/100 (this document), [markdown](https://verifymcp.io/servers/sergii-ziborov-weavatrix-refactor/weavatrix-refactor.md), [page](https://verifymcp.io/servers/sergii-ziborov-weavatrix-refactor/weavatrix-refactor)

## Channel facts

- Registry: `npm`
- Package: `weavatrix-refactor`
- Version: `0.1.5`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 0 of 5 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to sergii-ziborov/weavatrix-refactor).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 3 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 60/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 7072 tokens (~157/item across 45 items; 45 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 86/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 59% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add sergii-ziborov-weavatrix-refactor -- npx -y weavatrix-refactor
```

### Codex

```bash
codex mcp add sergii-ziborov-weavatrix-refactor -- npx -y weavatrix-refactor
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sergii-ziborov-weavatrix-refactor": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "weavatrix-refactor"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add sergii-ziborov-weavatrix-refactor --command npx --arg -y --arg weavatrix-refactor
```

### Hermes

```yaml
mcp_servers:
  sergii-ziborov-weavatrix-refactor:
    command: "npx"
    args: ["-y", "weavatrix-refactor"]
```

### Other

```json
{
  "mcpServers": {
    "sergii-ziborov-weavatrix-refactor": {
      "command": "npx",
      "args": [
        "-y",
        "weavatrix-refactor"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 78, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-08-01 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 62, +21)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 41, −46)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] Licence: Apache-2.0 → MIT
- [functional] Package version: 0.1.2 → 0.1.5
- [functional] Package version: 0.1.2 → 0.1.3

### 2026-07-27 (score 87, +28)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 59
- [functional] First check of Schema quality: good

### 2026-07-26 (score 59)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (45)

### `graph_stats` (~71 tokens)

Return summary statistics: node count, edge count, communities, versioned edge-provenance/legacy-confidence breakdowns, and graph build time vs repo HEAD (staleness).

Input parameters:

- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope

### `get_node` (~61 tokens)

Get full details for a specific node by label or ID.

Input parameters:

- `label` (string, required): Node label or ID to look up
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope

### `get_neighbors` (~98 tokens)

Get all direct neighbors of a node with edge details (1 hop, call sites deduped). For transitive impact use get_dependents; for the impact of your current branch changes use change_impact.

Input parameters:

- `label` (string, required)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `relation_filter` (string): Optional: filter by relation type

### `query_graph` (~329 tokens)

Explore a focused production-first graph around a concept or exact symbols (BFS/DFS). Exact seed files/symbols stay pinned; relation_filter and flow_direction support bounded event/data-flow views without a separate tool. Classified paths and unreferenced constant/field leaves stay suppressed unless explicitly requested.

Input parameters:

- `augment_seeds` (boolean): With exact seeds, also add fuzzy question-derived seeds; false keeps traversal strictly pinned
- `context_filter` (array)
- `depth` (integer)
- `flow_direction` (string): Traverse outgoing, incoming, or both directions
- `include_classified` (boolean): Allow traversal through tests/e2e/generated/mocks/stories/docs/benchmarks/temp and explicitly excluded paths. An explicit class term in the question enables only that class.
- `include_low_signal` (boolean): Include unreferenced constant/field leaf symbols that do not match a query term
- `mode` (string)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `question` (string): Optional natural-language question or keyword search when exact seeds are not sufficient
- `relation_filter`: Optional relation allow-list, e.g. calls,references,imports
- `seed_files` (array): Exact repo-relative file paths. Resolved exact seeds remain pinned unless augment_seeds is true
- `seed_symbols` (array): Exact node IDs or unambiguous symbol labels; enables focused flows without fuzzy query seeds
- `token_budget` (integer): Higher budget shows more nodes/edges

### `god_nodes` (~125 tokens)

Rank production-code connectivity hubs by unique call/import/reference neighbors, with class/method ownership reported separately from runtime connectivity. Repeated call sites do not inflate the rank; classified tests, generated/build output and other non-product paths are excluded by default.

Input parameters:

- `include_classified` (boolean): Include tests/e2e/generated/build output/mocks/stories/docs/benchmarks/temp and paths explicitly excluded by repository classification
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `top_n` (integer)

### `shortest_path` (~70 tokens)

Find the shortest path between two concepts in the knowledge graph.

Input parameters:

- `max_hops` (integer)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `source` (string, required)
- `target` (string, required)

### `get_dependents` (~220 tokens)

Transitive blast-radius of ONE node. JavaScript/TypeScript symbols use a cached on-demand EXACT_LSP point query by default, then traverse exact direct callers through the wider graph; incomplete precision is labelled and never silently presented as exact. Set precision=graph to skip LSP or include_container_importers for a conservative module-wide radius.

Input parameters:

- `depth` (integer): Max reverse hops, default 3
- `include_container_importers` (boolean): Also seed importers of the symbol containing file (broader, conservative; default false)
- `label` (string, required): Node label or ID
- `max_nodes` (integer): Max dependents to list, default 40
- `max_references` (integer)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `precision` (string): auto uses exact JS/TS point queries when precision is enabled; graph skips LSP; lsp forces an attempt
- `timeout_ms` (integer)

### `change_impact` (~261 tokens)

Verdict-first, symbol-aware blast radius. Parses a zero-context git diff and uses one bounded EXACT_LSP batch query for direct references to changed JavaScript/TypeScript symbols; transitive hops stay explicitly graph-backed. Additive exports do not inherit legacy file importers. Measured coverage is used when present; otherwise static reachability is labelled, not treated as coverage.

Input parameters:

- `base` (string): Base ref, e.g. origin/main or HEAD~1 (default: first existing of origin/HEAD, origin/main, origin/master, main, master)
- `depth` (integer): Max reverse hops, default 2
- `diff` (string): Optional unified diff (prefer --unified=0) for a PR/change that is not checked out; enables symbol-level classification
- `files` (array): Optional repo-relative changed-file hints. Without diff evidence these are classified conservatively rather than guessed additive
- `max_nodes` (integer): Max impacted nodes to list, default 40
- `max_references` (integer)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `precision` (string)
- `timeout_ms` (integer)

### `git_history` (~116 tokens)

Behavioral architecture evidence from bounded local git history: churn × connectivity hotspots, hidden co-change coupling, and expected test/source coupling. Reads numstat only — never commit messages, authors, or source bodies.

Input parameters:

- `max_commits` (integer)
- `max_pairs` (integer)
- `min_pair_count` (integer)
- `months` (integer)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `top_n` (integer)

### `verified_change` (~252 tokens)

Pre-commit, proof-carrying change safeguard. Given a natural-language task and current diff/files, returns compact edit contexts, bounded call-argument data-flow, blast radius, graph/architecture/duplicate/API ratchets, affected tests, and one PASS/BLOCKED/UNKNOWN verdict. Use this high-level workflow before manually composing lower-level checks. Package tests run only when explicitly requested and WEAVATRIX_ALLOW_TEST_RUNS=1.

Input parameters:

- `api_contract` (object)
- `base_ref` (string)
- `data_flow_depth` (integer)
- `diff` (string)
- `duplicate_ratchet` (boolean)
- `files` (array)
- `impact_depth` (integer)
- `max_data_flow_edges` (integer)
- `max_impact_nodes` (integer)
- `max_symbols` (integer)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `phase` (string)
- `precision` (string)
- `run_tests` (boolean)
- `task` (string, required)
- `test_timeout_ms` (integer)
- `tests` (array)

### `trace_api_contract` (~604 tokens)

Cross-repository HTTP, GraphQL, gRPC and event/topic contract, handler-liveness and blast-radius evidence. Joins static models with optional revision-bound runtime/OTLP evidence; unobserved dynamic URLs/topics/reflection remain explicit UNKNOWN. Medium/high-confidence external matches mark a handler/contract NOT_DEAD_EXTERNAL_USE. Repository paths stay local and runtime report paths are repository-contained.

Input parameters:

- `auto_discover_wrappers` (boolean): Discover only simple unambiguous functions that forward a URL parameter directly to a known object-style HTTP client
- `backend` (string, required): Backend repository UUID or exact unambiguous registry label
- `changed_files` (array): Optional backend repo-relative changed files; only endpoints declared in those files are traced
- `client_names` (array): Extra object-style clients whose .get/.post/... methods perform HTTP requests; persistent per-repo configuration belongs in .weavatrix.json httpContracts.clientNames
- `client_wrappers` (array): Fixed-method wrapper calls. Use call+method for get(url), or object+member+method for transport.send(url). url_argument is zero-based.
- `clients` (array, required): Client repository UUIDs or exact unambiguous registry labels
- `cursor` (string): Opaque nextCursor from the previous page; bound to repository revisions and filters.
- `include_tests` (boolean)
- `max_affected_files` (integer)
- `max_endpoints` (integer)
- `max_impact_depth` (integer)
- `max_matches` (integer)
- `method` (string)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `page_size` (integer): Maximum HTTP/transport/uncertain evidence items returned on this page.
- `path` (string): Optional full route or segment-aligned route fragment; /query matches /edgeAnalytics/query/... and {id}, :id and concrete parameter values are normalized
- `per_item_limit` (integer): Compact-mode sample limit for callsites, affected files, screens and modules per item.
- `response_detail` (string): Compact returns bounded samples and counts. Full is explicit opt-in and still paginated.
- `runtime_config` (object): Optional non-secret static bindings for runtime URL prefixes, e.g. process.env.API_BASE. Values are used locally for this call and are not returned.
- `runtime_evidence_files` (object): Optional repository-label/UUID to repository-relative weavatrix.transport-runtime.v1 JSON path. Defaults to .weavatrix/transport-runtime.json or .weavatrix/reports/transport-runtime.json in each repo…
- `runtime_evidence_max_age_hours` (integer): Maximum accepted age for a revision-matched runtime evidence report
- `top_n` (integer)
- `transport` (string): Contract family to trace; all runs static and revision-bound runtime evidence for every supported transport

### `get_community` (~68 tokens)

Get all nodes in a community by community ID (0-indexed by size).

Input parameters:

- `community_id` (integer, required): Community ID (0-indexed by size)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope

### `search_code` (~126 tokens)

Full-text or regex search across the repo source (ripgrep-backed, Node fallback). The graph only stores structure — use this to find literal text/patterns, then get_node/get_neighbors for structure.

Input parameters:

- `glob` (string): optional path glob, e.g. "*.js" or "src/**"
- `is_regex` (boolean)
- `max_results` (integer)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `query` (string, required): text or regex to search for

### `read_source` (~154 tokens)

Read the actual source of a node (by label/ID) or a repo-relative file path — the symbol's lines with context. The graph stores only locations, not source text. For a path read, pass start_line to anchor the window anywhere in the file (otherwise it shows the head).

Input parameters:

- `after` (integer)
- `before` (integer)
- `label` (string): node label or ID
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `path` (string): or a repo-relative file path
- `start_line` (integer): anchor line: window = start_line-before .. start_line+after

### `inspect_symbol` (~141 tokens)

Inspect one exact symbol with an on-demand TypeScript/JavaScript LSP reference query, grouped occurrence containers, graph blast radius, complexity facts and bounded local source context. Ambiguous labels fail closed; point queries never replace the broad precision overlay.

Input parameters:

- `context_lines` (integer)
- `label` (string, required): Exact node ID or unambiguous symbol label
- `max_containers` (integer)
- `max_references` (integer)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `precision` (string)
- `timeout_ms` (integer)

### `context_bundle` (~189 tokens)

Return one compact, bounded source bundle for an exact symbol: definition, production-first inbound/outbound containers, exact re-export sites, on-demand TS/JS reference evidence and diverse excerpts around call sites. Use before an edit when query_graph would be too broad.

Input parameters:

- `context_lines` (integer)
- `include_classified` (boolean): Include test/e2e/generated/vendored/mock/story/docs/benchmark/temp callers after production callers
- `label` (string, required): Exact node ID or unambiguous symbol label
- `max_reexports` (integer)
- `max_references` (integer)
- `max_related` (integer)
- `max_source_files` (integer)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `precision` (string)
- `timeout_ms` (integer)

### `find_duplicates` (~253 tokens)

Content-based clone detection over production code (MOSS winnowing over method bodies). Supports high-confidence small clones down to 12 tokens when min_tokens is lowered. Tests, classified non-product paths, all-router framework boilerplate and immutable declarative catalogs are excluded by default; opt them in explicitly.

Input parameters:

- `include_boilerplate` (boolean): Include clone groups made entirely of conventional *.router.js/ts router symbols
- `include_classified` (boolean): Include generated/vendored/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests
- `include_declarative` (boolean): Include repeated immutable array/object catalogs that contain no executable control flow
- `include_strings` (boolean): Also clone-check large multi-line string literals
- `include_tests` (boolean)
- `min_similarity` (integer): 50-100, default 80 (ignored in semantic mode)
- `min_tokens` (integer): min fragment size, 12-400; default 50
- `mode` (string)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `top_n` (integer)

### `find_dead_code` (~199 tokens)

Conservative review queue for statically unreferenced files, functions, methods and symbols. Returns confidence, reason, bounded evidence and explicit framework/dynamic/reflection/public-API caveats; never an auto-delete verdict. Tests, generated/vendored code, mocks, stories, docs, benchmarks and temporary roots are excluded by default.

Input parameters:

- `include_classified` (boolean): Include generated/vendored/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests
- `include_tests` (boolean)
- `kinds` (array): Optional candidate kinds; defaults to all
- `min_confidence` (string): Minimum confidence to include. low explicitly includes public/framework/dynamic review candidates
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `path` (string): Optional repo-relative path prefix
- `top_n` (integer)

### `run_audit` (~383 tokens)

Offline production-first repository Health review for structure, dependency declarations and lockfile integrity, bounded runtime-correctness/concurrency patterns, dead code and coverage. Vulnerability advisory matching and installed-dependency malware heuristics are separate explicit weavatrix-online tools. Unsupported Maven/Gradle import verification is NOT_SUPPORTED/PARTIAL, never a clean zero. Findings whose evidence is entirely test/e2e/generated/vendored/mock/story/docs/benchmark/temp or explicitly excluded are suppressed by default; opt them in with include_classified. category=dependencies selects dependency manifest/import, lockfile-drift, and direct dependency name-confusion findings. With base_ref, builds and audits an immutable Git checkout and compares stable deterministic finding IDs; debt defaults to genuinely new findings. changed_files without base_ref is only changed-scope, never a new-debt claim.

Input parameters:

- `base_ref` (string): Optional immutable Git baseline (for example HEAD~1 or origin/main). Enables honest new/existing/fixed debt comparison
- `category` (string): Only findings of this category; dependencies selects dependency manifest/import and dependency-integrity findings
- `changed_files` (array): Optional explicit repo-relative scope. Without base_ref this is changed-scope only; when omitted with base_ref, files are derived from the Git diff
- `debt` (string): Baseline comparison view. Defaults to genuinely new deterministic findings when base_ref is present
- `include_classified` (boolean): Include findings whose evidence is entirely tests/e2e/generated/vendored/mocks/stories/docs/benchmarks/temp or explicitly excluded
- `max_findings` (integer): Max findings to list, default 30
- `min_severity` (string): Minimum severity to include
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope

### `coverage_map` (~119 tokens)

Map a real existing coverage report onto the graph. If no report exists, return clearly labelled static test reachability (a test imports/reaches a source file) with actualCoverage=NOT_AVAILABLE; reachability is never presented as measured coverage.

Input parameters:

- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `path` (string): Optional repo-relative path prefix filter, e.g. src/query
- `top_n` (integer): Max risk hotspots to list, default 15

### `hot_path_review` (~242 tokens)

Rank a focused production-symbol hot-path queue from parser-derived local complexity, inside-loop allocations/copies/scans/sorts/recursion, graph fan-in/fan-out, and measured coverage or clearly labelled static test reachability. The default score gate is 85 with a narrow strong-local fallback; set min_score=0 for the full diagnostic queue. This is not profiler data or interprocedural Big-O.

Input parameters:

- `call_threshold` (integer)
- `cyclomatic_threshold` (integer)
- `include_classified` (boolean): Include generated/vendored/mock/story/docs/benchmark/temp and explicitly excluded paths; tests still require include_tests
- `include_tests` (boolean)
- `loop_depth_threshold` (integer)
- `min_score` (integer): Focused default is 85; lower explicitly to broaden, or use 0 for every threshold-matching diagnostic candidate
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `path` (string): Optional repository-relative path prefix
- `time_rank_threshold` (integer)
- `top_n` (integer)

### `list_communities` (~83 tokens)

List graph communities named by their dominant folder (largest first) with sample files — a readable module overview; feed the list position into get_community.

Input parameters:

- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `top_n` (integer): Max communities to list, default 20

### `module_map` (~122 tokens)

First orientation view for understanding an unfamiliar application with little context: a production-first folder architecture map with file/symbol counts and strongest module dependencies, separating runtime, TypeScript type-only and language compile-only coupling.

Input parameters:

- `include_non_product` (boolean): Include tests, fixtures, benchmarks, generated output, docs and other classified non-product files; false by default
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `top_n` (integer): Max modules to list, default 25

### `list_endpoints` (~164 tokens)

Inventory of HTTP endpoints defined in the repo (Express/Fastify/Nest/Flask/FastAPI/Go mux/Rust axum and actix-web/Spring MVC and WebFlux): declared and reachable composed paths, static mount provenance, confidence, handler, file:line, and Spring conditional/default-active state.

Input parameters:

- `include_classified` (boolean): Include test/e2e/generated/mock/story/docs/benchmark/temp and explicitly excluded targets
- `max_results` (integer): Max endpoints to list, default 100
- `method` (string)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `path` (string): Optional exact composed path or segment-aligned suffix

### `trace_endpoint` (~201 tokens)

Resolve one exact reachable HTTP endpoint, prove its router mount chain, bind its handler symbol, and return a bounded production-only multi-hop call graph with call-site excerpts. This is a focused projection of the repository graph, not text-search inference.

Input parameters:

- `context_lines` (integer)
- `handler_file` (string): Repo-relative file path (or unambiguous path suffix) declaring the handler; use after an AMBIGUOUS_HANDLER result.
- `include_classified` (boolean): Include test/e2e/generated/mock/story/docs/benchmark/temp and explicitly excluded targets
- `max_depth` (integer)
- `max_excerpts` (integer)
- `max_nodes` (integer)
- `method` (string)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `path` (string, required): Exact composed path; a suffix is accepted only when unambiguous

### `rebuild_graph` (~190 tokens)

Rebuild the active full-repository graph and report a structural delta. Omitted mode/precision preserve the active graph; a first build uses full and the startup precision setting (lsp unless WEAVATRIX_PRECISION=off). The local TypeScript/JavaScript LSP overlay validates bounded ambiguous edges; precision:off is an explicit fallback. With scope, build an isolated diagnostic graph without replacing or diffing the full graph.

Input parameters:

- `mode` (string): Build mode; omit to preserve the active mode (or use full for a first build)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `precision` (string): Semantic precision; omit to preserve the active mode (or use the startup setting for a first build)
- `scope` (string): Optional isolated diagnostic path prefix; never replaces the active full graph

### `graph_diff` (~149 tokens)

Structural graph diff: compare the current graph with an immutable Git-ref baseline (base_ref such as HEAD~1 or main), or with graph.prev.json from the last rebuild when base_ref is omitted. Reports architecture drift, cycle changes and symbols that lost their last caller.

Input parameters:

- `base_ref` (string): Optional immutable Git baseline to build in isolation, e.g. HEAD~1, main or origin/main; never checks out or mutates the working tree
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `path` (string): Optional node-id/path prefix to scope the diff, e.g. src/query

### `get_architecture_contract` (~178 tokens)

Read the owner-approved architecture target or safely bootstrap one. With action=preview, returns an adaptive candidate, observed-but-not-enforced dependency directions, verification, exact file content/hash and a short-lived confirmation token. action=approve creates the local contract only after explicit token confirmation and never overwrites an active target.

Input parameters:

- `action` (string): Omit to read; preview is dry-run only; approve requires the preview token
- `baseline_mode` (string): Whether preview should materialize current violations as an explicit ratchet baseline
- `candidate_contract` (object): Optional reviewed candidate to normalize and verify during preview
- `confirm_token` (string): One-time token returned by preview; required for approve
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope

### `prepare_change` (~71 tokens)

Select active target-architecture rules for an intended set of changed files. Run before a non-trivial edit.

Input parameters:

- `files` (array, required)
- `intent` (string)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope

### `verify_architecture` (~60 tokens)

Verify the fresh graph against the active target contract and ratchet; separates new, existing, fixed and excepted debt.

Input parameters:

- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope

### `explain_architecture_violation` (~55 tokens)

Explain one active architecture violation and the governing rule.

Input parameters:

- `fingerprint` (string, required)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope

### `propose_architecture_exception` (~76 tokens)

Prepare, but never apply, a bounded exception proposal for human review.

Input parameters:

- `expires` (string): Optional YYYY-MM-DD
- `fingerprint` (string, required)
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `reason` (string, required)

### `open_repo` (~192 tokens)

OFFLINE RETARGET: switch this server to another local Git repository, building its graph when missing. This explicit tool call changes the active repository boundary; pass build:false to probe without building. Omitted mode/precision preserve an existing graph; a new graph uses full and the startup precision setting (lsp unless WEAVATRIX_PRECISION=off). Omit the retarget capability at registration to pin one repository.

Input parameters:

- `build` (boolean): Build the graph when missing (default true)
- `mode` (string): Optional build mode override; omit to preserve an existing graph
- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope
- `path` (string, required): Absolute path to a Git working tree
- `precision` (string): Optional semantic precision override; omit to preserve an existing graph or use the startup setting for a new graph

### `list_known_repos` (~60 tokens)

OFFLINE RETARGET: list every registered local repository graph from the global per-user registry, regardless of parent folder.

Input parameters:

- `output_format` (string): text returns only the concise TextContent summary; json also returns and mirrors the stable structuredContent envelope

### `apply_edit_plan` (~205 tokens)

Apply a weavatrix.edit-plan.v1 envelope (from a weavatrix-refactor plan producer or weavatrix-online plan_refactor) to the active repository. mode="preview" (default) verifies hashes and before-texts and issues a single-use confirm_token; mode="apply" consumes the token and writes atomically with an automatic rollback bundle. Requires WEAVATRIX_ALLOW_SOURCE_EDITS=1 to write. Only EXACT_LSP/RESOLVED/EXTRACTED/LEXICAL_EXACT edits are ever applied; uncertain references are reported, never guessed.

Input parameters:

- `confirm_token` (string): Required for mode="apply"; issued by the preview step, single-use, 5-minute TTL
- `mode` (string)
- `output_format` (string): text returns concise TextContent; json also returns the stable structuredContent envelope
- `plan` (object, required): The weavatrix.edit-plan.v1 envelope, verbatim as produced by the planning tool

### `rollback_last_apply` (~81 tokens)

Restore the repository files from the most recent apply_edit_plan rollback bundle. All-or-nothing: if any target file changed after the apply, nothing is restored and the drifted files are reported. Requires WEAVATRIX_ALLOW_SOURCE_EDITS=1.

Input parameters:

- `output_format` (string): text returns concise TextContent; json also returns the stable structuredContent envelope

### `rename_symbol` (~201 tokens)

Complete cross-language rename workflow: EXACT LSP backend for JS/TS, SQL schema backend for .sql, graph+lexical backend for Rust/Python/Go/Java/C#/Solidity. Default mode="preview" proves the byte-exact edits and returns a single-use confirm_token; repeat the same call with mode="apply" and that token for an atomic write with rollback. Requires WEAVATRIX_ALLOW_SOURCE_EDITS=1 only for apply.

Input parameters:

- `confirm_token` (string): Required for mode="apply"; single-use and bound to the exact generated plan and working tree
- `mode` (string): preview verifies the generated plan and returns a confirm_token; apply recomputes the same plan and consumes that token
- `new_name` (string, required)
- `output_format` (string): text returns concise TextContent; json also returns the stable structuredContent envelope
- `symbol` (string, required): Exact symbol id (file#name@line)

### `rename_related_symbols` (~155 tokens)

Complete coordinated JS/TS multi-symbol rename as ONE atomic workflow with conflict/chain/swap detection. Default mode="preview" returns a plan-bound confirm_token; repeat with identical renames, mode="apply", and that token to write atomically with rollback. Blocks entirely if any sub-rename fails.

Input parameters:

- `confirm_token` (string): Required for mode="apply"; single-use and bound to the exact generated plan and working tree
- `mode` (string): preview verifies the generated plan and returns a confirm_token; apply recomputes the same plan and consumes that token
- `output_format` (string): text returns concise TextContent; json also returns the stable structuredContent envelope
- `renames` (array, required)

### `move_file` (~103 tokens)

Relocate a JS/TS file: rewrites the moved file own imports and every importer specifier, and reports the architecture dry-run (WOULD_VIOLATE/WOULD_IMPROVE). A review plan the agent applies (it renames a file), not an apply envelope.

Input parameters:

- `from` (string, required)
- `output_format` (string): text returns concise TextContent; json also returns the stable structuredContent envelope
- `to` (string, required)

### `move_symbol` (~91 tokens)

Dry-run for moving a declaration to another file: predicts introduced/removed runtime cycles and architecture violations plus the blast radius. PROJECTED from graph edges — no byte-exact edits; apply the mechanical move yourself and run verified_change.

Input parameters:

- `output_format` (string): text returns concise TextContent; json also returns the stable structuredContent envelope
- `symbol` (string, required)
- `to_file` (string, required)

### `delete_readiness` (~87 tokens)

Per-symbol deletion verdict {safe: true|false|UNPROVEN, knownReferences, unknownDynamicUsages, confidence, reason} plus the deletion span. Exported symbols cap at UNPROVEN; always REVIEW_REQUIRED, never auto-delete.

Input parameters:

- `output_format` (string): text returns concise TextContent; json also returns the stable structuredContent envelope
- `symbol` (string, required)

### `change_signature` (~106 tokens)

Add or remove a function/method parameter (JS/TS) with byte-exact call-site argument surgery. Always PARTIAL (call sites from graph edges); spread/value-add reported UNCERTAIN. operation: {kind:"add_parameter",name,default?} | {kind:"remove_parameter",index}.

Input parameters:

- `operation` (object, required)
- `output_format` (string): text returns concise TextContent; json also returns the stable structuredContent envelope
- `symbol` (string, required)

### `edit_symbol` (~86 tokens)

Symbol-anchored edit over the parser source range (all languages): replace_symbol_body | insert_before_symbol | insert_after_symbol. JS/TS results are parse-gated.

Input parameters:

- `content` (string, required)
- `operation` (string, required)
- `output_format` (string): text returns concise TextContent; json also returns the stable structuredContent envelope
- `symbol` (string, required)

### `bulk_replace` (~119 tokens)

Two-stage occurrence-selective pattern replace over the indexed universe. Preview (no selection) returns stable occurrence ids; then pass occurrence_ids or expected_count to plan. literal:true by default.

Input parameters:

- `expected_count` (integer)
- `flags` (string)
- `literal` (boolean)
- `occurrence_ids` (array)
- `output_format` (string): text returns concise TextContent; json also returns the stable structuredContent envelope
- `path_prefix` (string)
- `pattern` (string, required)
- `replacement` (string, required)

### `organize_imports` (~85 tokens)

Removes provably-unused named imports from a JS/TS file (a binding is removed only when its name occurs once in the file). Default/namespace imports are reported UNCERTAIN, never removed; sorting is left to the formatter.

Input parameters:

- `file` (string, required)
- `output_format` (string): text returns concise TextContent; json also returns the stable structuredContent envelope

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/sergii-ziborov-weavatrix-refactor/weavatrix-refactor#diagnostics

## Score history

- 2026-08-03: 78
- 2026-08-02: 78
- 2026-08-01: 63
- 2026-07-31: 62
- 2026-07-30: 41
- 2026-07-28: 87
- 2026-07-27: 87
- 2026-07-26: 59

## Links

- npm package: https://www.npmjs.com/package/weavatrix-refactor
- Socket report: https://socket.dev/npm/package/weavatrix-refactor
- Repository: https://github.com/sergii-ziborov/weavatrix-refactor
- Website: https://weavatrix.com/
- Changelog RSS feed: https://verifymcp.io/servers/sergii-ziborov-weavatrix-refactor/weavatrix-refactor/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/sergii-ziborov-weavatrix-refactor/weavatrix-refactor/changelog.json
- HTML version of this page: https://verifymcp.io/servers/sergii-ziborov-weavatrix-refactor/weavatrix-refactor