pmat 3.32.0 — MCP mode first-class, and three gates that could not fail

MCP mode is first-class

One binary serves CLI, MCP over stdio, and MCP over streamable HTTP. mcp-http moved into the default feature set — cargo install pmat now gives you the HTTP transport with no --features dance (binary ~1 MB bigger). The HTTP tool surface is byte-identical to stdio, asserted by a test rather than implied by a doc comment.

PMAT_MCP_HTTP_TOKEN='at-least-16-chars-long' pmat serve --transport http --port 8765 &
claude mcp add --scope user --transport http pmat http://127.0.0.1:8765/ \
  --header "Authorization: Bearer at-least-16-chars-long"

With no token set, pmat serve --transport http now mints one, starts, and prints that exact line for the port it bound. Two properties were deliberately not relaxed to buy the convenience: a token under 16 characters is still refused, and a non-loopback bind still refuses without an explicit token — a generated token changes each restart and would silently 401 every client of a shared endpoint.

Four things that were previously written down nowhere are now in --help, the README, and a new book chapter: MCP is served at the root path (/mcp and /health are 404), the 16-character token minimum, the required Accept: application/json, text/event-stream, and 401 on unauthenticated.

⚠️ TDG grades get WORSE, not better

Grades are now computed from a token walk instead of a line scan, so rustfmt.toml no longer decides them. Measured over this repository's own index: definitions below the A floor go 1,905 → 3,333 (+75%), A+ falls from 80.17% to 63.99% by count. The bands and cut points are unchanged — the measurement was wrong. Read the CHANGELOG before upgrading a CI gate keyed on a TDG number.

Eight defects fixed

Each with a RED proof and a counter-test bounding the over-correction: #1008 #1023 #1029 #1035 #1059 #1064 #1070 #1075.

Highlights: analyze duplicates was heading to cubic (exponent 1.61→2.87) — 151.8s → 19.5s on the reporting corpus, RSS 4.0 GB → 2.0 GB, nothing capped. #1029 was reported as 3 missing MCP tools; measured against a running server it was 29, none of them declared, now enforced by an exhaustive match so a new analyzer cannot compile until someone decides. #1023 revived 154 quarantined tests after untangling three stacked faults, each hiding the next.

thrift (GHSA-2f9f-gq7v-9h6m) is eliminated, not disclosed — aprender-db 0.64 brought arrow/parquet 59, which dropped the dependency. cargo tree -i thrift --features full finds no packages.

Three gates that structurally could not fail

The transport-parity gate had never once spoken HTTP: the harness honestly logged SKIPPED and the gate's exit code ignored notes. Fixing that exposed three more independent causes — a 13-character token against a 16-character minimum, a readiness probe on a /health that 404s, and RPC posted to /mcp when pmat serves the root.

The dogfood earned its place twice, on trees that had already passed CI and 21,000 tests: it caught a regression in this release's own #1064 fix (not_measured true on 8 of 11 real repositories), and a #1076 fix that silently disabled the compiler scan — 80 dead functions → 0 — on any repo with an absent or stale lockfile.

Known issues, disclosed rather than omitted

• #1076 — analyze dead-code still writes a Cargo.lock into the analysed repo. The --locked fix was reverted because it traded that for silently reporting no dead code. Its 7 spec tests are kept and #[ignore]d with reasons, and must go green when a real fix lands.
• #1053 — ring and aws-lc-rs are both linked (~1.3 MiB duplicated). rustls provider selection is a process global that fails at runtime, not compile time.

Verified on 1474209

lib tests       21,033 passed, 0 failed
clippy          0 errors (-D warnings, --all-targets)
fleet dogfood   11/11 repos, ~88 probes, 0 defects
transport       3/3 HTTP legs, 0 disagreements
MCP surface     19 = 19 tools, 38/38 invocations
differential    0 constant leaves
flag-efficacy   446 effective, 0 no-op

🤖 Generated with Claude Code