Prism

Route-granular backend intelligence: HTTP endpoints, auth posture, data layer, environment variables and background jobs. Use when the question is specifically about the server side. Static heuristics over Express, Nest and Fastify — nothing is executed.

What depends on a file or symbol, and how risky changing it is: direct and transitive dependents, confidence lanes, evidence and a risk band. Results are import/soft-lane based — coverageLimitations lists classes it cannot see (DI containers, string-keyed registries, event buses, template/i18n refs, runtime-loaded config, generated-code consumers). Call this before editing or deleting code you did not write. Use intent 'delete' when removing rather than modifying. affectedFiles and testsLikelyAffected are bounded (default 50).

Deprecated: breaking-change hints are included in blast_radius (and review_changes). Prefer those tools. Heuristic hints about what a change to this target could break for consumers — exported surface, widely imported modules, public entrypoints. Heuristic by design: treat as prompts to check, not as findings.

List every Core analysis capability and consent-gated integration with availability and a reason when unavailable. Use this to tell 'not supported by this build' apart from 'not consented / not exposed via MCP' — never guess why a network or build feature is missing.

List workspace-relative paths changed in the working tree, or against an optional git base ref. Use before review_changes when you need the path list alone, or let review_changes auto-discover by omitting paths. Fails when git is unavailable — that is not the same as an empty change set.

Read or update gitignored Dispatch settings: section order, standup template, Slack tracked channel ids, mention window and caps, max parallel jobs (default 1), hint policy, and whether the tickets slot is Linear or Jira. action=export returns a non-secret template (no tokens) for sharing. Chat only — there is no settings UI in v1.

Import and re-export cycles, each returned as the list of files forming the loop. Use when investigating build order, flaky module initialisation, or before extracting a package.

The import/re-export dependency graph, at file level or aggregated to packages. Includes unresolvedImports { count, sample } for specs that did not resolve into the graph. Bounded by default (limit 50 nodes); use summaryOnly for counts + top-degree nodes. Prefer packageAggregation, or use blast_radius if your question is about one file rather than the whole graph.

Show how one file or symbol reaches another through the dependency graph, with alternative paths. Use to answer 'how is this connected to that?' — an empty result means no path exists, which is itself an answer.

Check whether Dispatch can run local teammates. Speak only the tool message — never mention API keys, mcp.json, host role, or connector counts. If sign-in is missing, call init.

The deep engineering view: hotspots, churn, complexity, ownership concentration, knowledge decay and debt indicators in one report. Use when asked to find what needs attention. Git-derived sections fail soft on repositories without history. For the single headline number use repository_health.

Explain what a module or folder does: domain overlap, dependency in/out degree and local ownership. Use before editing an unfamiliar directory. For a single file target prefer explore_code (richer usages/ownership/timeline). Deterministic — derived from the index and local git, never generated prose.

Everything about one file or symbol in a single call: usages, ownership, related and similar code, and a change timeline. Usages are bounded (default 50) via a nested envelope so large files do not drown the response. Use when asked to understand a specific thing rather than the repository as a whole.

Inferred features and how they depend on each other. Features are heuristic groupings of files, not a declared structure, so treat them as a starting point rather than ground truth. Bounded by default (limit 50 nodes); use summaryOnly for counts + top-degree nodes.

Find resolved references to a symbol — who actually calls or imports it. Pass path (and start when several symbols share a name) to disambiguate. Use before renaming or deleting anything.

Find indexed symbols by exact name, optionally narrowed by file or kind. Use to locate a definition before asking about its impact. For substring or regex search use search_symbols.

Health score over time from stored index snapshots and optional git backfill. Use to answer 'is this getting better or worse?'. Points carry provenance: backfilled points are estimated from history, not measured at the time, and say so.

One-time Cursor sign-in so Prism can run local job workers. Opens the Cursor login page in the browser. Speak only the tool message to the user — never mention API keys, mcp.json, host role, or connector counts. If Cursor shows “Authenticating prism…” with Skip, that is host tool-approval: tell the user to click Skip, then retry init.

Catalogue what Dispatch can connect, start OAuth for GitHub (user), Linear, Jira, Slack (mentions + tracked channels), Notion, or Google Calendar, or disconnect a driver. No connector is on by default. Connect uses Prism Auth (auth.prismhq.in). Cursor shows a native Authenticate control and a short step list; Claude opens the auth page. Never ask the user to create an OAuth app or paste a client id. Aliases like “google calendar” map to google-calendar. Google’s “hasn’t verified this app” warning is expected until Prism Auth finishes Calendar scope verification — tell the user to click Advanced, then continue. Tokens go in the OS keychain. Workers cannot start OAuth. Call when the user asks what we can connect or says connect Slack (or another driver).

Pause, resume, cancel, or add context to a running Dispatch job. Speak only the tool message, using the job title and canonical id. jobId may be a ticket, a slug like audit-issues, or the title.

The symbol-level graph — declarations and the references between them — with summary stats. Requires path (scope to one file) or limit (bound nodes). Very large on a big repository. If you are looking for one symbol use find_symbol or search_symbols, and for its callers use find_references.

Named entrypoints, package roots and feature anchors — the places a human would open first. Use to pick a starting file in an unfamiliar repository.

Inferred features with their member files and a confidence score. Cheaper than feature_graph when you only need the list. Low confidence means the grouping is a guess.

Where are we: every Dispatch job with title, canonical id, live activity, and a result or error when a teammate finishes. Speak only the tool message — titles, what they are doing, and what changed, not worktree paths or job-<hex> ids. Call when the user asks where we are, what's running, how a job is going, or whether a teammate finished.

List the packages in a monorepo with their roots. Call this first in a monorepo so later tools can be scoped with packageId instead of returning the whole workspace.

Save, list, or forget scoped memories that Dispatch injects into the next start_job prompt. Scope is job, repo, or user. Does not auto-save code-changing rules; those need confirm=true. Call when the user says remember this, forget that, or list memories.

Every edit site a rename would touch, plus breaking-change hints for public surface. Use before renaming an exported symbol or moving a file. A report only — Prism never edits.

Identify what a repository *is*: detected languages, frameworks, package manager, architecture hints, test runners and ranked domains, each with the evidence behind it. Start here when you know nothing about a codebase. Local index only; no network.

Score overall repository health from 0-100 with the per-factor breakdown behind the score. Includes graphCoveragePct (share of inventory files in the TS/JS dependency graph) and a 'TS/JS import coupling' factor. Use to judge whether a codebase is in good shape or to find which factor drags it down. For the deeper engineering view (hotspots, churn, ownership, debt) call engineering_health instead.

Return the repository's structural map at a zoom level: nodes, edges and regions. Use to orient yourself or to find where a concern lives. Defaults to 'package' zoom (bounded). 'file' and 'symbol' can be very large on a big repository, so prefer the coarsest zoom that answers your question.

The dashboard summary in one call: totals, coupling density and band, the largest regions with health scores, the most connected nodes (with map kind), and recent commit activity. Use when you want a single orienting snapshot rather than four separate calls. Region scores are null where there is no evidence — that means 'not measured', not 'zero'.

Review changed paths in one call: blast radius, test impact and breaking-change hints per path, rolled up with an overall risk band. Omit paths to auto-discover via git (same as changed_paths); pass base to compare against a ref. Use for 'review my branch' rather than calling the per-file tools repeatedly.

Whether a file or symbol can be deleted safely: blockers that still depend on it, and files that would be orphaned if it went. A report only — Prism never deletes anything. Prefer this over blast_radius when the question is specifically about removal.

Substring or regex search over indexed symbol names (unlike find_symbol, which is exact-match only). Optional kind/path filters. Hard-capped at 50 hits.

Left-shift security posture: which tooling is configured, which fundamental checks are present or missing. A checklist against local configuration, not a vulnerability scan — it will not find CVEs and does not claim to.

Detected stack for the workspace or a single package: frameworks, runtimes, build tooling and the signals each was detected from. Use when you need to know what a package is built with before changing its configuration.

Create a Dispatch job from a ticket or title plus a PRD. Starts a local Cursor teammate in its own worktree (host node_modules linked; no shell; no second Prism MCP) and returns immediately. Speak only the tool message: use the job title and canonical id (ticket like AI-971 or slug like audit-issues), never job-<hex>, worktree paths, or API keys. Tell the user to say where are we for live status and the result when it finishes. Default cap is one job at a time. Do not use this for a repo-wide audit or health scan — call repository_health instead. If sign-in is needed, a Cursor login page opens in the browser. If Cursor shows “Authenticating prism…” with Skip, tell the user to click Skip and retry.

Standup briefing for this repository: leftover Dispatch jobs, teammates that just finished (what changed or why they failed), local git, then any connected drivers (GitHub reviews, Linear or Jira tickets, Slack mentions plus tracked channels, Notion, Google Calendar). Unconnected tools appear as named connect CTAs. Does not index the repo. Call this when the user says start my day, standup, or what's waiting on me.

Which test files transitively cover a change target — the tests worth running after touching it. Prism reports which tests are relevant; it does not run them. The tests list is bounded (default 50).

Test structure and, when coverage artifacts are already on disk, coverage. Use to judge how well tested an area is. Prism reads existing artifacts; it never runs your tests.

Compact workspace readiness: path, whether an index is loaded, indexedAt, freshness, git availability, whether a .prism/cache directory exists, and dependency-graph node/edge counts. Call this when a previous tool failed or to confirm the session is ready before a review.