Add docs link in sidebar, Dockerfile for VitePress, make Keycloak optional

- Add external "Docs" link in sidebar with configurable DOCS_URL
- Add Dockerfile.docs for VitePress static site (nginx)
- Add DOCS_URL build arg to Dockerfile.dashboard
- Run cargo fmt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -38,9 +38,6 @@ GIT_CLONE_BASE_PATH=/tmp/compliance-scanner/repos
 DASHBOARD_PORT=8080
 AGENT_API_URL=http://localhost:3001
 
-# MCP Server
-MCP_ENDPOINT_URL=http://localhost:8090
-
 # Keycloak (required for authentication)
 KEYCLOAK_URL=http://localhost:8080
 KEYCLOAK_REALM=compliance

.gitea/workflows/ci.yml

@@ -70,8 +70,6 @@ jobs:
         run: cargo clippy -p compliance-dashboard --features server --no-default-features -- -D warnings
       - name: Clippy (dashboard web)
         run: cargo clippy -p compliance-dashboard --features web --no-default-features -- -D warnings
-      - name: Clippy (mcp)
-        run: cargo clippy -p compliance-mcp -- -D warnings
       - name: Show sccache stats
         run: sccache --show-stats
         if: always()
@@ -126,119 +124,3 @@ jobs:
       - name: Show sccache stats
         run: sccache --show-stats
         if: always()
-
-  # ---------------------------------------------------------------------------
-  # Stage 3: Deploy (only on main, after tests pass)
-  # Each service only deploys when its relevant files changed.
-  # ---------------------------------------------------------------------------
-  detect-changes:
-    name: Detect Changes
-    runs-on: docker
-    if: github.ref == 'refs/heads/main'
-    needs: [test]
-    container:
-      image: alpine:latest
-    outputs:
-      agent: ${{ steps.changes.outputs.agent }}
-      dashboard: ${{ steps.changes.outputs.dashboard }}
-      docs: ${{ steps.changes.outputs.docs }}
-      mcp: ${{ steps.changes.outputs.mcp }}
-    steps:
-      - name: Install git
-        run: apk add --no-cache git
-      - name: Checkout
-        run: |
-          git init
-          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=2 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-      - name: Detect changed paths
-        id: changes
-        run: |
-          CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null || echo "")
-          echo "Changed files:"
-          echo "$CHANGED"
-
-          # Agent: core libs, agent code, agent Dockerfile
-          if echo "$CHANGED" | grep -qE '^(compliance-core/|compliance-agent/|compliance-graph/|compliance-dast/|Dockerfile\.agent|Cargo\.(toml|lock))'; then
-            echo "agent=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "agent=false" >> "$GITHUB_OUTPUT"
-          fi
-
-          # Dashboard: core libs, dashboard code, dashboard Dockerfile, assets
-          if echo "$CHANGED" | grep -qE '^(compliance-core/|compliance-dashboard/|Dockerfile\.dashboard|Dioxus\.toml|assets/|bin/|Cargo\.(toml|lock))'; then
-            echo "dashboard=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "dashboard=false" >> "$GITHUB_OUTPUT"
-          fi
-
-          # Docs: docs folder, docs Dockerfile
-          if echo "$CHANGED" | grep -qE '^(docs/|Dockerfile\.docs)'; then
-            echo "docs=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "docs=false" >> "$GITHUB_OUTPUT"
-          fi
-
-          # MCP: core libs, mcp code, mcp Dockerfile
-          if echo "$CHANGED" | grep -qE '^(compliance-core/|compliance-mcp/|Dockerfile\.mcp|Cargo\.(toml|lock))'; then
-            echo "mcp=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "mcp=false" >> "$GITHUB_OUTPUT"
-          fi
-
-  deploy-agent:
-    name: Deploy Agent
-    runs-on: docker
-    needs: [detect-changes]
-    if: needs.detect-changes.outputs.agent == 'true'
-    container:
-      image: alpine:latest
-    steps:
-      - name: Trigger Coolify deploy
-        run: |
-          apk add --no-cache curl
-          curl -sf "${{ secrets.COOLIFY_WEBHOOK_AGENT }}" \
-            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
-
-  deploy-dashboard:
-    name: Deploy Dashboard
-    runs-on: docker
-    needs: [detect-changes]
-    if: needs.detect-changes.outputs.dashboard == 'true'
-    container:
-      image: alpine:latest
-    steps:
-      - name: Trigger Coolify deploy
-        run: |
-          apk add --no-cache curl
-          curl -sf "${{ secrets.COOLIFY_WEBHOOK_DASHBOARD }}" \
-            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
-
-  deploy-docs:
-    name: Deploy Docs
-    runs-on: docker
-    needs: [detect-changes]
-    if: needs.detect-changes.outputs.docs == 'true'
-    container:
-      image: alpine:latest
-    steps:
-      - name: Trigger Coolify deploy
-        run: |
-          apk add --no-cache curl
-          curl -sf "${{ secrets.COOLIFY_WEBHOOK_DOCS }}" \
-            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
-
-  deploy-mcp:
-    name: Deploy MCP
-    runs-on: docker
-    needs: [detect-changes]
-    if: needs.detect-changes.outputs.mcp == 'true'
-    container:
-      image: alpine:latest
-    steps:
-      - name: Trigger Coolify deploy
-        run: |
-          apk add --no-cache curl
-          curl -sf "${{ secrets.COOLIFY_WEBHOOK_MCP }}" \
-            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"

Cargo.lock

@@ -167,7 +167,7 @@ dependencies = [
  "sync_wrapper",
  "tokio",
  "tokio-tungstenite 0.28.0",
- "tower",
+ "tower 0.5.3",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -413,17 +413,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
-[[package]]
-name = "chacha20"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "rand_core 0.10.0",
-]
-
 [[package]]
 name = "charset"
 version = "0.1.5"
@@ -615,7 +604,6 @@ version = "0.1.0"
 dependencies = [
  "axum",
  "base64",
- "bson",
  "chrono",
  "compliance-core",
  "dioxus",
@@ -639,7 +627,6 @@ dependencies = [
  "tower-sessions",
  "tracing",
  "url",
- "uuid",
  "web-sys",
 ]
 
@@ -688,27 +675,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "compliance-mcp"
-version = "0.1.0"
-dependencies = [
- "axum",
- "bson",
- "chrono",
- "compliance-core",
- "dotenvy",
- "mongodb",
- "rmcp",
- "schemars 1.2.1",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
- "tokio",
- "tower-http",
- "tracing",
- "tracing-subscriber",
-]
-
 [[package]]
 name = "console_error_panic_hook"
 version = "0.1.7"
@@ -903,15 +869,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "cpufeatures"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "crc32fast"
 version = "1.5.0"
@@ -1015,18 +972,8 @@ version = "0.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
 dependencies = [
- "darling_core 0.21.3",
+ "darling_core",
- "darling_macro 0.21.3",
+ "darling_macro",
-]
-
-[[package]]
-name = "darling"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
-dependencies = [
- "darling_core 0.23.0",
- "darling_macro 0.23.0",
 ]
 
 [[package]]
@@ -1043,37 +990,13 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "darling_core"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
-dependencies = [
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn",
-]
-
 [[package]]
 name = "darling_macro"
 version = "0.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
 dependencies = [
- "darling_core 0.21.3",
+ "darling_core",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
-dependencies = [
- "darling_core 0.23.0",
  "quote",
  "syn",
 ]
@@ -1412,7 +1335,7 @@ dependencies = [
  "tokio-stream",
  "tokio-tungstenite 0.27.0",
  "tokio-util",
- "tower",
+ "tower 0.5.3",
  "tower-http",
  "tower-layer",
  "tracing",
@@ -1703,7 +1626,7 @@ dependencies = [
  "tokio",
  "tokio-tungstenite 0.27.0",
  "tokio-util",
- "tower",
+ "tower 0.5.3",
  "tower-http",
  "tracing",
  "tracing-futures",
@@ -1904,7 +1827,7 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f43e744e4ea338060faee68ed933e46e722fb7f3617e722a5772d7e856d8b3ce"
 dependencies = [
- "darling 0.21.3",
+ "darling",
  "proc-macro2",
  "quote",
  "syn",
@@ -2181,7 +2104,6 @@ dependencies = [
  "cfg-if",
  "libc",
  "r-efi",
- "rand_core 0.10.0",
  "wasip2",
  "wasip3",
 ]
@@ -3575,7 +3497,7 @@ dependencies = [
  "serde_urlencoded",
  "snafu",
  "tokio",
- "tower",
+ "tower 0.5.3",
  "tower-http",
  "tracing",
  "url",
@@ -3677,6 +3599,8 @@ dependencies = [
  "prost",
  "reqwest",
  "thiserror 2.0.18",
+ "tokio",
+ "tonic",
  "tracing",
 ]
 
@@ -3744,12 +3668,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "pastey"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b867cad97c0791bbd3aaa6472142568c6c9e8f71937e98379f584cfb0cf35bec"
-
 [[package]]
 name = "pbkdf2"
 version = "0.12.2"
@@ -4087,17 +4005,6 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
-[[package]]
-name = "rand"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
-dependencies = [
- "chacha20",
- "getrandom 0.4.1",
- "rand_core 0.10.0",
-]
-
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@@ -4136,12 +4043,6 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
-[[package]]
-name = "rand_core"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c8d0fd677905edcbeedbf2edb6494d676f0e98d54d5cf9bda0b061cb8fb8aba"
-
 [[package]]
 name = "rand_distr"
 version = "0.4.3"
@@ -4262,7 +4163,6 @@ dependencies = [
  "pin-project-lite",
  "quinn",
  "rustls",
- "rustls-native-certs",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -4271,7 +4171,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tokio-util",
- "tower",
+ "tower 0.5.3",
  "tower-http",
  "tower-service",
  "url",
@@ -4302,50 +4202,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "rmcp"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc4c9c94680f75470ee8083a0667988b5d7b5beb70b9f998a8e51de7c682ce60"
-dependencies = [
- "async-trait",
- "base64",
- "bytes",
- "chrono",
- "futures",
- "http",
- "http-body",
- "http-body-util",
- "pastey",
- "pin-project-lite",
- "rand 0.10.0",
- "rmcp-macros",
- "schemars 1.2.1",
- "serde",
- "serde_json",
- "sse-stream",
- "thiserror 2.0.18",
- "tokio",
- "tokio-stream",
- "tokio-util",
- "tower-service",
- "tracing",
- "uuid",
-]
-
-[[package]]
-name = "rmcp-macros"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90c23c8f26cae4da838fbc3eadfaecf2d549d97c04b558e7bd90526a9c28b42a"
-dependencies = [
- "darling 0.23.0",
- "proc-macro2",
- "quote",
- "serde_json",
- "syn",
-]
-
 [[package]]
 name = "rust-stemmers"
 version = "1.2.0"
@@ -4509,26 +4365,12 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
 dependencies = [
- "chrono",
  "dyn-clone",
  "ref-cast",
- "schemars_derive",
  "serde",
  "serde_json",
 ]
 
-[[package]]
-name = "schemars_derive"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f"
-dependencies = [
- "proc-macro2",
- "quote",
- "serde_derive_internals",
- "syn",
-]
-
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -4668,17 +4510,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "serde_derive_internals"
-version = "0.29.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "serde_json"
 version = "1.0.149"
@@ -4763,7 +4594,7 @@ version = "3.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6d4e30573c8cb306ed6ab1dca8423eec9a463ea0e155f45399455e0368b27e0"
 dependencies = [
- "darling 0.21.3",
+ "darling",
  "proc-macro2",
  "quote",
  "syn",
@@ -4785,7 +4616,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
  "digest",
 ]
 
@@ -4796,7 +4627,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
  "digest",
 ]
 
@@ -4950,19 +4781,6 @@ version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
-[[package]]
-name = "sse-stream"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb4dc4d33c68ec1f27d386b5610a351922656e1fdf5c05bbaad930cd1519479a"
-dependencies = [
- "bytes",
- "futures-util",
- "http-body",
- "http-body-util",
- "pin-project-lite",
-]
-
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -5546,10 +5364,35 @@ dependencies = [
  "http",
  "http-body",
  "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
  "percent-encoding",
  "pin-project",
  "prost",
+ "tokio",
  "tokio-stream",
+ "tower 0.4.13",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "indexmap 1.9.3",
+ "pin-project",
+ "pin-project-lite",
+ "rand 0.8.5",
+ "slab",
+ "tokio",
+ "tokio-util",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -5610,7 +5453,7 @@ dependencies = [
  "pin-project-lite",
  "tokio",
  "tokio-util",
- "tower",
+ "tower 0.5.3",
  "tower-layer",
  "tower-service",
  "tracing",

Cargo.toml

@@ -5,7 +5,6 @@ members = [
     "compliance-dashboard",
     "compliance-graph",
     "compliance-dast",
-    "compliance-mcp",
 ]
 resolver = "2"
 

Dockerfile.agent

@@ -5,21 +5,11 @@ COPY . .
 RUN cargo build --release -p compliance-agent
 
 FROM debian:bookworm-slim
-RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl && rm -rf /var/lib/apt/lists/*
 
 # Install syft for SBOM generation
 RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
 
-# Install gitleaks for secret detection
-RUN curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
-    | tar -xz -C /usr/local/bin gitleaks
-
-# Install semgrep for static analysis
-RUN pip3 install --break-system-packages semgrep
-
-# Install ruff for Python linting
-RUN pip3 install --break-system-packages ruff
-
 COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent
 
 EXPOSE 3001 3002

Dockerfile.dashboard

@@ -16,7 +16,6 @@ WORKDIR /app
 COPY --from=builder /app/target/dx/compliance-dashboard/release/web/compliance-dashboard /app/compliance-dashboard
 COPY --from=builder /app/target/dx/compliance-dashboard/release/web/public /app/public
 
-ENV IP=0.0.0.0
 EXPOSE 8080
 
 ENTRYPOINT ["./compliance-dashboard"]

Dockerfile.docs

@@ -8,7 +8,5 @@ COPY docs/ .
 RUN npm run build
 
 FROM nginx:alpine
-RUN rm /etc/nginx/conf.d/default.conf
-COPY docs/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=builder /app/.vitepress/dist /usr/share/nginx/html
 EXPOSE 80

Dockerfile.mcp

@@ -1,16 +0,0 @@
-FROM rust:1.89-bookworm AS builder
-
-WORKDIR /app
-COPY . .
-RUN cargo build --release -p compliance-mcp
-
-FROM debian:bookworm-slim
-RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*
-
-COPY --from=builder /app/target/release/compliance-mcp /usr/local/bin/compliance-mcp
-
-EXPOSE 8090
-
-ENV MCP_PORT=8090
-
-ENTRYPOINT ["compliance-mcp"]

assets/main.css

@@ -300,84 +300,6 @@ tr:hover {
     color: var(--text-secondary);
 }
 
-/* Sidebar User Section */
-.sidebar-user {
-    display: flex;
-    align-items: center;
-    gap: 10px;
-    padding: 12px 14px;
-    margin: 8px;
-    border-top: 1px solid var(--border);
-    padding-top: 16px;
-}
-
-.sidebar-user-collapsed {
-    flex-direction: column;
-    gap: 8px;
-    padding: 12px 4px;
-    margin: 8px 4px;
-}
-
-.user-avatar {
-    width: 34px;
-    height: 34px;
-    border-radius: 10px;
-    background: linear-gradient(135deg, rgba(56, 189, 248, 0.2), rgba(56, 189, 248, 0.08));
-    border: 1px solid rgba(56, 189, 248, 0.15);
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    flex-shrink: 0;
-}
-
-.avatar-initials {
-    font-size: 13px;
-    font-weight: 700;
-    color: var(--accent);
-    line-height: 1;
-}
-
-.avatar-img {
-    width: 100%;
-    height: 100%;
-    border-radius: 10px;
-    object-fit: cover;
-}
-
-.user-name {
-    flex: 1;
-    font-size: 13px;
-    font-weight: 500;
-    color: var(--text-primary);
-    white-space: nowrap;
-    overflow: hidden;
-    text-overflow: ellipsis;
-    min-width: 0;
-}
-
-.logout-btn {
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    width: 32px;
-    height: 32px;
-    border-radius: 8px;
-    color: var(--text-secondary);
-    text-decoration: none;
-    flex-shrink: 0;
-    transition: all 0.15s;
-}
-
-.logout-btn:hover {
-    background: rgba(239, 68, 68, 0.12);
-    color: #fca5a5;
-}
-
-.logout-btn-collapsed {
-    width: 34px;
-    height: 34px;
-}
-
 @media (max-width: 768px) {
     .sidebar {
         transform: translateX(-100%);
@@ -391,216 +313,3 @@ tr:hover {
         padding: 16px;
     }
 }
-
-
-/* ── Utility classes ────────────────────────────────────── */
-
-.mb-3 { margin-bottom: 12px; }
-.mb-4 { margin-bottom: 16px; }
-.text-secondary { color: var(--text-secondary); }
-
-.btn-sm {
-    padding: 4px 10px;
-    font-size: 12px;
-}
-
-.btn-danger {
-    background: var(--danger);
-    color: #fff;
-}
-.btn-danger:hover {
-    background: #dc2626;
-}
-
-.btn-secondary {
-    background: var(--bg-secondary);
-    color: var(--text-primary);
-    border: 1px solid var(--border);
-}
-.btn-secondary:hover {
-    background: var(--bg-primary);
-}
-
-/* ── Modal ──────────────────────────────────────────────── */
-
-.modal-overlay {
-    position: fixed;
-    inset: 0;
-    background: rgba(0, 0, 0, 0.6);
-    backdrop-filter: blur(4px);
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    z-index: 1000;
-}
-
-.modal-dialog {
-    background: var(--bg-secondary);
-    border: 1px solid var(--border);
-    border-radius: 12px;
-    padding: 24px;
-    max-width: 440px;
-    width: 90%;
-}
-
-.modal-dialog h3 {
-    margin-bottom: 12px;
-}
-
-.modal-dialog p {
-    margin-bottom: 8px;
-    font-size: 14px;
-    color: var(--text-secondary);
-}
-
-.modal-warning {
-    color: var(--warning) !important;
-    font-size: 13px !important;
-}
-
-.modal-actions {
-    display: flex;
-    gap: 8px;
-    justify-content: flex-end;
-    margin-top: 16px;
-}
-
-/* ── MCP Servers ────────────────────────────────────────── */
-
-.mcp-server-card {
-    padding: 20px;
-}
-
-.mcp-server-header {
-    display: flex;
-    justify-content: space-between;
-    align-items: flex-start;
-    margin-bottom: 12px;
-}
-
-.mcp-server-title {
-    display: flex;
-    align-items: center;
-    gap: 10px;
-}
-
-.mcp-server-title h3 {
-    font-size: 16px;
-    font-weight: 600;
-    margin: 0;
-}
-
-.mcp-server-actions {
-    display: flex;
-    gap: 6px;
-}
-
-.mcp-status {
-    display: inline-flex;
-    align-items: center;
-    padding: 2px 10px;
-    border-radius: 20px;
-    font-size: 11px;
-    font-weight: 600;
-    text-transform: uppercase;
-    letter-spacing: 0.5px;
-}
-
-.mcp-status-running {
-    background: rgba(34, 197, 94, 0.15);
-    color: var(--success);
-}
-
-.mcp-status-stopped {
-    background: rgba(148, 163, 184, 0.15);
-    color: var(--text-secondary);
-}
-
-.mcp-status-error {
-    background: rgba(239, 68, 68, 0.15);
-    color: var(--danger);
-}
-
-.mcp-config-grid {
-    display: grid;
-    grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
-    gap: 12px;
-    margin-bottom: 16px;
-}
-
-.mcp-config-item {
-    display: flex;
-    flex-direction: column;
-    gap: 4px;
-}
-
-.mcp-config-label {
-    font-size: 11px;
-    font-weight: 600;
-    text-transform: uppercase;
-    letter-spacing: 0.5px;
-    color: var(--text-secondary);
-}
-
-.mcp-config-value {
-    font-size: 13px;
-    color: var(--text-primary);
-    word-break: break-all;
-}
-
-.mcp-form-grid {
-    display: grid;
-    grid-template-columns: 1fr 1fr;
-    gap: 0 16px;
-}
-
-.mcp-tools-section {
-    margin-bottom: 16px;
-}
-
-.mcp-tools-list {
-    display: flex;
-    flex-wrap: wrap;
-    gap: 6px;
-    margin-top: 6px;
-}
-
-.mcp-tool-badge {
-    display: inline-block;
-    padding: 3px 10px;
-    background: rgba(56, 189, 248, 0.1);
-    border: 1px solid rgba(56, 189, 248, 0.2);
-    border-radius: 6px;
-    font-size: 12px;
-    font-family: 'JetBrains Mono', monospace;
-    color: var(--accent);
-}
-
-.mcp-token-section {
-    margin-bottom: 12px;
-}
-
-.mcp-token-row {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-    margin-top: 6px;
-}
-
-.mcp-token-value {
-    flex: 1;
-    padding: 6px 10px;
-    background: var(--bg-primary);
-    border: 1px solid var(--border);
-    border-radius: 6px;
-    font-size: 12px;
-    font-family: 'JetBrains Mono', monospace;
-    color: var(--text-secondary);
-    word-break: break-all;
-}
-
-.mcp-meta {
-    padding-top: 12px;
-    border-top: 1px solid var(--border);
-    font-size: 12px;
-}

compliance-agent/src/api/handlers/chat.rs

@@ -187,13 +187,7 @@ pub async fn build_embeddings(
             }
         };
 
-        let creds = crate::pipeline::git::RepoCredentials {
+        let git_ops = crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path);
-            ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
-            auth_token: repo.auth_token.clone(),
-            auth_username: repo.auth_username.clone(),
-        };
-        let git_ops =
-            crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path, creds);
         let repo_path = match git_ops.clone_or_fetch(&repo.git_url, &repo.name) {
             Ok(p) => p,
             Err(e) => {

compliance-agent/src/api/handlers/graph.rs

@@ -291,13 +291,7 @@ pub async fn trigger_build(
             }
         };
 
-        let creds = crate::pipeline::git::RepoCredentials {
+        let git_ops = crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path);
-            ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
-            auth_token: repo.auth_token.clone(),
-            auth_username: repo.auth_username.clone(),
-        };
-        let git_ops =
-            crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path, creds);
         let repo_path = match git_ops.clone_or_fetch(&repo.git_url, &repo.name) {
             Ok(p) => p,
             Err(e) => {

compliance-agent/src/api/handlers/mod.rs

@@ -41,12 +41,6 @@ pub struct FindingsFilter {
     pub scan_type: Option<String>,
     #[serde(default)]
     pub status: Option<String>,
-    #[serde(default)]
-    pub q: Option<String>,
-    #[serde(default)]
-    pub sort_by: Option<String>,
-    #[serde(default)]
-    pub sort_order: Option<String>,
     #[serde(default = "default_page")]
     pub page: u64,
     #[serde(default = "default_limit")]
@@ -82,8 +76,6 @@ pub struct AddRepositoryRequest {
     pub git_url: String,
     #[serde(default = "default_branch")]
     pub default_branch: String,
-    pub auth_token: Option<String>,
-    pub auth_username: Option<String>,
     pub tracker_type: Option<TrackerType>,
     pub tracker_owner: Option<String>,
     pub tracker_repo: Option<String>,
@@ -99,17 +91,6 @@ pub struct UpdateStatusRequest {
     pub status: String,
 }
 
-#[derive(Deserialize)]
-pub struct BulkUpdateStatusRequest {
-    pub ids: Vec<String>,
-    pub status: String,
-}
-
-#[derive(Deserialize)]
-pub struct UpdateFeedbackRequest {
-    pub feedback: String,
-}
-
 #[derive(Deserialize)]
 pub struct SbomFilter {
     #[serde(default)]
@@ -286,25 +267,9 @@ pub async fn list_repositories(
 pub async fn add_repository(
     Extension(agent): AgentExt,
     Json(req): Json<AddRepositoryRequest>,
-) -> Result<Json<ApiResponse<TrackedRepository>>, (StatusCode, String)> {
+) -> Result<Json<ApiResponse<TrackedRepository>>, StatusCode> {
-    // Validate repository access before saving
-    let creds = crate::pipeline::git::RepoCredentials {
-        ssh_key_path: Some(agent.config.ssh_key_path.clone()),
-        auth_token: req.auth_token.clone(),
-        auth_username: req.auth_username.clone(),
-    };
-
-    if let Err(e) = crate::pipeline::git::GitOps::test_access(&req.git_url, &creds) {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            format!("Cannot access repository: {e}"),
-        ));
-    }
-
     let mut repo = TrackedRepository::new(req.name, req.git_url);
     repo.default_branch = req.default_branch;
-    repo.auth_token = req.auth_token;
-    repo.auth_username = req.auth_username;
     repo.tracker_type = req.tracker_type;
     repo.tracker_owner = req.tracker_owner;
     repo.tracker_repo = req.tracker_repo;
@@ -315,12 +280,7 @@ pub async fn add_repository(
         .repositories()
         .insert_one(&repo)
         .await
-        .map_err(|_| {
+        .map_err(|_| StatusCode::CONFLICT)?;
-            (
-                StatusCode::CONFLICT,
-                "Repository already exists".to_string(),
-            )
-        })?;
 
     Ok(Json(ApiResponse {
         data: repo,
@@ -329,14 +289,6 @@ pub async fn add_repository(
     }))
 }
 
-pub async fn get_ssh_public_key(
-    Extension(agent): AgentExt,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let public_path = format!("{}.pub", agent.config.ssh_key_path);
-    let public_key = std::fs::read_to_string(&public_path).map_err(|_| StatusCode::NOT_FOUND)?;
-    Ok(Json(serde_json::json!({ "public_key": public_key.trim() })))
-}
-
 pub async fn trigger_scan(
     Extension(agent): AgentExt,
     Path(id): Path<String>,
@@ -415,29 +367,6 @@ pub async fn list_findings(
     if let Some(status) = &filter.status {
         query.insert("status", status);
     }
-    // Text search across title, description, file_path, rule_id
-    if let Some(q) = &filter.q {
-        if !q.is_empty() {
-            let regex = doc! { "$regex": q, "$options": "i" };
-            query.insert(
-                "$or",
-                mongodb::bson::bson!([
-                    { "title": regex.clone() },
-                    { "description": regex.clone() },
-                    { "file_path": regex.clone() },
-                    { "rule_id": regex },
-                ]),
-            );
-        }
-    }
-
-    // Dynamic sort
-    let sort_field = filter.sort_by.as_deref().unwrap_or("created_at");
-    let sort_dir: i32 = match filter.sort_order.as_deref() {
-        Some("asc") => 1,
-        _ => -1,
-    };
-    let sort_doc = doc! { sort_field: sort_dir };
 
     let skip = (filter.page.saturating_sub(1)) * filter.limit as u64;
     let total = db
@@ -449,7 +378,7 @@ pub async fn list_findings(
     let findings = match db
         .findings()
         .find(query)
-        .sort(sort_doc)
+        .sort(doc! { "created_at": -1 })
         .skip(skip)
         .limit(filter.limit)
         .await
@@ -505,55 +434,6 @@ pub async fn update_finding_status(
     Ok(Json(serde_json::json!({ "status": "updated" })))
 }
 
-pub async fn bulk_update_finding_status(
-    Extension(agent): AgentExt,
-    Json(req): Json<BulkUpdateStatusRequest>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oids: Vec<mongodb::bson::oid::ObjectId> = req
-        .ids
-        .iter()
-        .filter_map(|id| mongodb::bson::oid::ObjectId::parse_str(id).ok())
-        .collect();
-
-    if oids.is_empty() {
-        return Err(StatusCode::BAD_REQUEST);
-    }
-
-    let result = agent
-        .db
-        .findings()
-        .update_many(
-            doc! { "_id": { "$in": oids } },
-            doc! { "$set": { "status": &req.status, "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    Ok(Json(
-        serde_json::json!({ "status": "updated", "modified_count": result.modified_count }),
-    ))
-}
-
-pub async fn update_finding_feedback(
-    Extension(agent): AgentExt,
-    Path(id): Path<String>,
-    Json(req): Json<UpdateFeedbackRequest>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-
-    agent
-        .db
-        .findings()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$set": { "developer_feedback": &req.feedback, "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    Ok(Json(serde_json::json!({ "status": "updated" })))
-}
-
 pub async fn list_sbom(
     Extension(agent): AgentExt,
     Query(filter): Query<SbomFilter>,

compliance-agent/src/api/routes.rs

@@ -7,10 +7,6 @@ pub fn build_router() -> Router {
     Router::new()
         .route("/api/v1/health", get(handlers::health))
         .route("/api/v1/stats/overview", get(handlers::stats_overview))
-        .route(
-            "/api/v1/settings/ssh-public-key",
-            get(handlers::get_ssh_public_key),
-        )
         .route("/api/v1/repositories", get(handlers::list_repositories))
         .route("/api/v1/repositories", post(handlers::add_repository))
         .route(
@@ -27,14 +23,6 @@ pub fn build_router() -> Router {
             "/api/v1/findings/{id}/status",
             patch(handlers::update_finding_status),
         )
-        .route(
-            "/api/v1/findings/bulk-status",
-            patch(handlers::bulk_update_finding_status),
-        )
-        .route(
-            "/api/v1/findings/{id}/feedback",
-            patch(handlers::update_finding_feedback),
-        )
         .route("/api/v1/sbom", get(handlers::list_sbom))
         .route("/api/v1/sbom/export", get(handlers::export_sbom))
         .route("/api/v1/sbom/licenses", get(handlers::license_summary))

compliance-agent/src/config.rs

@@ -45,8 +45,6 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
             .unwrap_or_else(|| "0 0 0 * * *".to_string()),
         git_clone_base_path: env_var_opt("GIT_CLONE_BASE_PATH")
             .unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
-        ssh_key_path: env_var_opt("SSH_KEY_PATH")
-            .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
         keycloak_url: env_var_opt("KEYCLOAK_URL"),
         keycloak_realm: env_var_opt("KEYCLOAK_REALM"),
     })

compliance-agent/src/llm/mod.rs

@@ -5,7 +5,6 @@ pub mod descriptions;
 pub mod fixes;
 #[allow(dead_code)]
 pub mod pr_review;
-pub mod review_prompts;
 pub mod triage;
 
 pub use client::LlmClient;

compliance-agent/src/llm/review_prompts.rs

@@ -1,77 +0,0 @@
-// System prompts for multi-pass LLM code review.
-// Each pass focuses on a different aspect to avoid overloading a single prompt.
-
-pub const LOGIC_REVIEW_PROMPT: &str = r#"You are a senior software engineer reviewing code changes. Focus ONLY on logic and correctness issues.
-
-Look for:
-- Off-by-one errors, wrong comparisons, missing edge cases
-- Incorrect control flow (unreachable code, missing returns, wrong loop conditions)
-- Race conditions or concurrency bugs
-- Resource leaks (unclosed handles, missing cleanup)
-- Wrong variable used (copy-paste errors)
-- Incorrect error handling (swallowed errors, wrong error type)
-
-Ignore: style, naming, formatting, documentation, minor improvements.
-
-For each issue found, respond with a JSON array:
-[{"title": "...", "description": "...", "severity": "high|medium|low", "file": "...", "line": N, "suggestion": "..."}]
-
-If no issues found, respond with: []"#;
-
-pub const SECURITY_REVIEW_PROMPT: &str = r#"You are a security engineer reviewing code changes. Focus ONLY on security vulnerabilities.
-
-Look for:
-- Injection vulnerabilities (SQL, command, XSS, template injection)
-- Authentication/authorization bypasses
-- Sensitive data exposure (logging secrets, hardcoded credentials)
-- Insecure cryptography (weak algorithms, predictable randomness)
-- Path traversal, SSRF, open redirects
-- Unsafe deserialization
-- Missing input validation at trust boundaries
-
-Ignore: code style, performance, general quality.
-
-For each issue found, respond with a JSON array:
-[{"title": "...", "description": "...", "severity": "critical|high|medium", "file": "...", "line": N, "cwe": "CWE-XXX", "suggestion": "..."}]
-
-If no issues found, respond with: []"#;
-
-pub const CONVENTION_REVIEW_PROMPT: &str = r#"You are a code reviewer checking adherence to project conventions. Focus ONLY on patterns that indicate likely bugs or maintenance problems.
-
-Look for:
-- Inconsistent error handling patterns within the same module
-- Public API that doesn't follow the project's established patterns
-- Missing or incorrect type annotations that could cause runtime issues
-- Anti-patterns specific to the language (e.g. unwrap in Rust library code, any in TypeScript)
-
-Do NOT report: minor style preferences, documentation gaps, formatting.
-Only report issues with HIGH confidence that they deviate from the visible codebase conventions.
-
-For each issue found, respond with a JSON array:
-[{"title": "...", "description": "...", "severity": "medium|low", "file": "...", "line": N, "suggestion": "..."}]
-
-If no issues found, respond with: []"#;
-
-pub const COMPLEXITY_REVIEW_PROMPT: &str = r#"You are reviewing code changes for excessive complexity that could lead to bugs.
-
-Look for:
-- Functions over 50 lines that should be decomposed
-- Deeply nested control flow (4+ levels)
-- Complex boolean expressions that are hard to reason about
-- Functions with 5+ parameters
-- Code duplication within the changed files
-
-Only report complexity issues that are HIGH risk for future bugs. Ignore acceptable complexity in configuration, CLI argument parsing, or generated code.
-
-For each issue found, respond with a JSON array:
-[{"title": "...", "description": "...", "severity": "medium|low", "file": "...", "line": N, "suggestion": "..."}]
-
-If no issues found, respond with: []"#;
-
-/// All review types with their prompts
-pub const REVIEW_PASSES: &[(&str, &str)] = &[
-    ("logic", LOGIC_REVIEW_PROMPT),
-    ("security", SECURITY_REVIEW_PROMPT),
-    ("convention", CONVENTION_REVIEW_PROMPT),
-    ("complexity", COMPLEXITY_REVIEW_PROMPT),
-];

compliance-agent/src/llm/triage.rs

@@ -5,22 +5,13 @@ use compliance_core::models::{Finding, FindingStatus};
 use crate::llm::LlmClient;
 use crate::pipeline::orchestrator::GraphContext;
 
-const TRIAGE_SYSTEM_PROMPT: &str = r#"You are a security finding triage expert. Analyze the following security finding with its code context and determine the appropriate action.
+const TRIAGE_SYSTEM_PROMPT: &str = r#"You are a security finding triage expert. Analyze the following security finding and determine:
-
+1. Is this a true positive? (yes/no)
-Actions:
+2. Confidence score (0-10, where 10 is highest confidence this is a real issue)
-- "confirm": The finding is a true positive at the reported severity. Keep as-is.
+3. Brief remediation suggestion (1-2 sentences)
-- "downgrade": The finding is real but over-reported. Lower severity recommended.
-- "upgrade": The finding is under-reported. Higher severity recommended.
-- "dismiss": The finding is a false positive. Should be removed.
-
-Consider:
-- Is the code in a test, example, or generated file? (lower confidence for test code)
-- Does the surrounding code context confirm or refute the finding?
-- Is the finding actionable by a developer?
-- Would a real attacker be able to exploit this?
 
 Respond in JSON format:
-{"action": "confirm|downgrade|upgrade|dismiss", "confidence": 0-10, "rationale": "brief explanation", "remediation": "optional fix suggestion"}"#;
+{"true_positive": true/false, "confidence": N, "remediation": "..."}"#;
 
 pub async fn triage_findings(
     llm: &Arc<LlmClient>,
@@ -30,10 +21,8 @@ pub async fn triage_findings(
     let mut passed = 0;
 
     for finding in findings.iter_mut() {
-        let file_classification = classify_file_path(finding.file_path.as_deref());
-
         let mut user_prompt = format!(
-            "Scanner: {}\nRule: {}\nSeverity: {}\nTitle: {}\nDescription: {}\nFile: {}\nLine: {}\nCode: {}\nFile classification: {}",
+            "Scanner: {}\nRule: {}\nSeverity: {}\nTitle: {}\nDescription: {}\nFile: {}\nLine: {}\nCode: {}",
             finding.scanner,
             finding.rule_id.as_deref().unwrap_or("N/A"),
             finding.severity,
@@ -42,16 +31,8 @@ pub async fn triage_findings(
             finding.file_path.as_deref().unwrap_or("N/A"),
             finding.line_number.map(|n| n.to_string()).unwrap_or_else(|| "N/A".to_string()),
             finding.code_snippet.as_deref().unwrap_or("N/A"),
-            file_classification,
         );
 
-        // Enrich with surrounding code context if possible
-        if let Some(context) = read_surrounding_context(finding) {
-            user_prompt.push_str(&format!(
-                "\n\n--- Surrounding Code (50 lines) ---\n{context}"
-            ));
-        }
-
         // Enrich with graph context if available
         if let Some(ctx) = graph_context {
             if let Some(impact) = ctx
@@ -88,55 +69,32 @@ pub async fn triage_findings(
             .await
         {
             Ok(response) => {
+                // Strip markdown code fences if present (e.g. ```json ... ```)
                 let cleaned = response.trim();
                 let cleaned = if cleaned.starts_with("```") {
-                    cleaned
+                    let inner = cleaned
                         .trim_start_matches("```json")
                         .trim_start_matches("```")
                         .trim_end_matches("```")
-                        .trim()
+                        .trim();
+                    inner
                 } else {
                     cleaned
                 };
                 if let Ok(result) = serde_json::from_str::<TriageResult>(cleaned) {
-                    // Apply file-path confidence adjustment
+                    finding.confidence = Some(result.confidence);
-                    let adjusted_confidence =
-                        adjust_confidence(result.confidence, &file_classification);
-                    finding.confidence = Some(adjusted_confidence);
-                    finding.triage_action = Some(result.action.clone());
-                    finding.triage_rationale = Some(result.rationale);
-
                     if let Some(remediation) = result.remediation {
                         finding.remediation = Some(remediation);
                     }
 
-                    match result.action.as_str() {
+                    if result.confidence >= 3.0 {
-                        "dismiss" => {
-                            finding.status = FindingStatus::FalsePositive;
-                        }
-                        "downgrade" => {
-                            // Downgrade severity by one level
-                            finding.severity = downgrade_severity(&finding.severity);
-                            finding.status = FindingStatus::Triaged;
-                            passed += 1;
-                        }
-                        "upgrade" => {
-                            finding.severity = upgrade_severity(&finding.severity);
-                            finding.status = FindingStatus::Triaged;
-                            passed += 1;
-                        }
-                        _ => {
-                            // "confirm" or unknown — keep as-is
-                            if adjusted_confidence >= 3.0 {
                         finding.status = FindingStatus::Triaged;
                         passed += 1;
                     } else {
                         finding.status = FindingStatus::FalsePositive;
                     }
-                        }
-                    }
                 } else {
-                    // Parse failure — keep the finding
+                    // If LLM response doesn't parse, keep the finding
                     finding.status = FindingStatus::Triaged;
                     passed += 1;
                     tracing::warn!(
@@ -159,122 +117,12 @@ pub async fn triage_findings(
     passed
 }
 
-/// Read ~50 lines of surrounding code from the file at the finding's location
-fn read_surrounding_context(finding: &Finding) -> Option<String> {
-    let file_path = finding.file_path.as_deref()?;
-    let line = finding.line_number? as usize;
-
-    // Try to read the file — this works because the repo is cloned locally
-    let content = std::fs::read_to_string(file_path).ok()?;
-    let lines: Vec<&str> = content.lines().collect();
-
-    let start = line.saturating_sub(25);
-    let end = (line + 25).min(lines.len());
-
-    Some(
-        lines[start..end]
-            .iter()
-            .enumerate()
-            .map(|(i, l)| format!("{:>4} | {}", start + i + 1, l))
-            .collect::<Vec<_>>()
-            .join("\n"),
-    )
-}
-
-/// Classify a file path to inform triage confidence adjustment
-fn classify_file_path(path: Option<&str>) -> String {
-    let path = match path {
-        Some(p) => p.to_lowercase(),
-        None => return "unknown".to_string(),
-    };
-
-    if path.contains("/test/")
-        || path.contains("/tests/")
-        || path.contains("_test.")
-        || path.contains(".test.")
-        || path.contains(".spec.")
-        || path.contains("/fixtures/")
-        || path.contains("/testdata/")
-    {
-        return "test".to_string();
-    }
-
-    if path.contains("/example")
-        || path.contains("/examples/")
-        || path.contains("/demo/")
-        || path.contains("/sample")
-    {
-        return "example".to_string();
-    }
-
-    if path.contains("/generated/")
-        || path.contains("/gen/")
-        || path.contains(".generated.")
-        || path.contains(".pb.go")
-        || path.contains("_generated.rs")
-    {
-        return "generated".to_string();
-    }
-
-    if path.contains("/vendor/")
-        || path.contains("/node_modules/")
-        || path.contains("/third_party/")
-    {
-        return "vendored".to_string();
-    }
-
-    "production".to_string()
-}
-
-/// Adjust confidence based on file classification
-fn adjust_confidence(raw_confidence: f64, classification: &str) -> f64 {
-    let multiplier = match classification {
-        "test" => 0.5,
-        "example" => 0.6,
-        "generated" => 0.3,
-        "vendored" => 0.4,
-        _ => 1.0,
-    };
-    raw_confidence * multiplier
-}
-
-fn downgrade_severity(
-    severity: &compliance_core::models::Severity,
-) -> compliance_core::models::Severity {
-    use compliance_core::models::Severity;
-    match severity {
-        Severity::Critical => Severity::High,
-        Severity::High => Severity::Medium,
-        Severity::Medium => Severity::Low,
-        Severity::Low => Severity::Info,
-        Severity::Info => Severity::Info,
-    }
-}
-
-fn upgrade_severity(
-    severity: &compliance_core::models::Severity,
-) -> compliance_core::models::Severity {
-    use compliance_core::models::Severity;
-    match severity {
-        Severity::Info => Severity::Low,
-        Severity::Low => Severity::Medium,
-        Severity::Medium => Severity::High,
-        Severity::High => Severity::Critical,
-        Severity::Critical => Severity::Critical,
-    }
-}
-
 #[derive(serde::Deserialize)]
 struct TriageResult {
-    #[serde(default = "default_action")]
+    #[serde(default)]
-    action: String,
+    #[allow(dead_code)]
+    true_positive: bool,
     #[serde(default)]
     confidence: f64,
-    #[serde(default)]
-    rationale: String,
     remediation: Option<String>,
 }
-
-fn default_action() -> String {
-    "confirm".to_string()
-}

compliance-agent/src/main.rs

@@ -7,7 +7,6 @@ mod llm;
 mod pipeline;
 mod rag;
 mod scheduler;
-mod ssh;
 #[allow(dead_code)]
 mod trackers;
 mod webhooks;
@@ -21,12 +20,6 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     tracing::info!("Loading configuration...");
     let config = config::load_config()?;
 
-    // Ensure SSH key pair exists for cloning private repos
-    match ssh::ensure_ssh_key(&config.ssh_key_path) {
-        Ok(pubkey) => tracing::info!("SSH public key: {}", pubkey.trim()),
-        Err(e) => tracing::warn!("SSH key generation skipped: {e}"),
-    }
-
     tracing::info!("Connecting to MongoDB...");
     let db = database::Database::connect(&config.mongodb_uri, &config.mongodb_database).await?;
     db.ensure_indexes().await?;

compliance-agent/src/pipeline/code_review.rs

@@ -1,186 +0,0 @@
-use std::path::Path;
-use std::sync::Arc;
-
-use compliance_core::models::{Finding, ScanType, Severity};
-use compliance_core::traits::ScanOutput;
-
-use crate::llm::review_prompts::REVIEW_PASSES;
-use crate::llm::LlmClient;
-use crate::pipeline::dedup;
-use crate::pipeline::git::{DiffFile, GitOps};
-
-pub struct CodeReviewScanner {
-    llm: Arc<LlmClient>,
-}
-
-impl CodeReviewScanner {
-    pub fn new(llm: Arc<LlmClient>) -> Self {
-        Self { llm }
-    }
-
-    /// Run multi-pass LLM code review on the diff between old and new commits.
-    pub async fn review_diff(
-        &self,
-        repo_path: &Path,
-        repo_id: &str,
-        old_sha: &str,
-        new_sha: &str,
-    ) -> ScanOutput {
-        let diff_files = match GitOps::get_diff_content(repo_path, old_sha, new_sha) {
-            Ok(files) => files,
-            Err(e) => {
-                tracing::warn!("Failed to extract diff for code review: {e}");
-                return ScanOutput::default();
-            }
-        };
-
-        if diff_files.is_empty() {
-            return ScanOutput::default();
-        }
-
-        let mut all_findings = Vec::new();
-
-        // Chunk diff files into groups to avoid exceeding context limits
-        let chunks = chunk_diff_files(&diff_files, 8000);
-
-        for (pass_name, system_prompt) in REVIEW_PASSES {
-            for chunk in &chunks {
-                let user_prompt = format!(
-                    "Review the following code changes:\n\n{}",
-                    chunk
-                        .iter()
-                        .map(|f| format!("--- {} ---\n{}", f.path, f.hunks))
-                        .collect::<Vec<_>>()
-                        .join("\n\n")
-                );
-
-                match self.llm.chat(system_prompt, &user_prompt, Some(0.1)).await {
-                    Ok(response) => {
-                        let parsed = parse_review_response(&response, pass_name, repo_id, chunk);
-                        all_findings.extend(parsed);
-                    }
-                    Err(e) => {
-                        tracing::warn!("Code review pass '{pass_name}' failed: {e}");
-                    }
-                }
-            }
-        }
-
-        ScanOutput {
-            findings: all_findings,
-            sbom_entries: Vec::new(),
-        }
-    }
-}
-
-/// Group diff files into chunks that fit within a token budget (rough char estimate)
-fn chunk_diff_files(files: &[DiffFile], max_chars: usize) -> Vec<Vec<&DiffFile>> {
-    let mut chunks: Vec<Vec<&DiffFile>> = Vec::new();
-    let mut current_chunk: Vec<&DiffFile> = Vec::new();
-    let mut current_size = 0;
-
-    for file in files {
-        if current_size + file.hunks.len() > max_chars && !current_chunk.is_empty() {
-            chunks.push(std::mem::take(&mut current_chunk));
-            current_size = 0;
-        }
-        current_chunk.push(file);
-        current_size += file.hunks.len();
-    }
-
-    if !current_chunk.is_empty() {
-        chunks.push(current_chunk);
-    }
-
-    chunks
-}
-
-fn parse_review_response(
-    response: &str,
-    pass_name: &str,
-    repo_id: &str,
-    chunk: &[&DiffFile],
-) -> Vec<Finding> {
-    let cleaned = response.trim();
-    let cleaned = if cleaned.starts_with("```") {
-        cleaned
-            .trim_start_matches("```json")
-            .trim_start_matches("```")
-            .trim_end_matches("```")
-            .trim()
-    } else {
-        cleaned
-    };
-
-    let issues: Vec<ReviewIssue> = match serde_json::from_str(cleaned) {
-        Ok(v) => v,
-        Err(_) => {
-            if cleaned != "[]" {
-                tracing::debug!("Failed to parse {pass_name} review response: {cleaned}");
-            }
-            return Vec::new();
-        }
-    };
-
-    issues
-        .into_iter()
-        .filter(|issue| {
-            // Verify the file exists in the diff chunk
-            chunk.iter().any(|f| f.path == issue.file)
-        })
-        .map(|issue| {
-            let severity = match issue.severity.as_str() {
-                "critical" => Severity::Critical,
-                "high" => Severity::High,
-                "medium" => Severity::Medium,
-                "low" => Severity::Low,
-                _ => Severity::Info,
-            };
-
-            let fingerprint = dedup::compute_fingerprint(&[
-                repo_id,
-                "code-review",
-                pass_name,
-                &issue.file,
-                &issue.line.to_string(),
-                &issue.title,
-            ]);
-
-            let description = if let Some(suggestion) = &issue.suggestion {
-                format!("{}\n\nSuggested fix: {}", issue.description, suggestion)
-            } else {
-                issue.description.clone()
-            };
-
-            let mut finding = Finding::new(
-                repo_id.to_string(),
-                fingerprint,
-                format!("code-review/{pass_name}"),
-                ScanType::CodeReview,
-                issue.title,
-                description,
-                severity,
-            );
-            finding.rule_id = Some(format!("review/{pass_name}"));
-            finding.file_path = Some(issue.file);
-            finding.line_number = Some(issue.line);
-            finding.cwe = issue.cwe;
-            finding.suggested_fix = issue.suggestion;
-            finding
-        })
-        .collect()
-}
-
-#[derive(serde::Deserialize)]
-struct ReviewIssue {
-    title: String,
-    description: String,
-    severity: String,
-    file: String,
-    #[serde(default)]
-    line: u32,
-    #[serde(default)]
-    cwe: Option<String>,
-    #[serde(default)]
-    suggestion: Option<String>,
-}

compliance-agent/src/pipeline/cve.rs

@@ -64,8 +64,6 @@ impl CveScanner {
     }
 
     async fn query_osv_batch(&self, entries: &[SbomEntry]) -> Result<Vec<Vec<OsvVuln>>, CoreError> {
-        const OSV_BATCH_SIZE: usize = 500;
-
         let queries: Vec<_> = entries
             .iter()
             .filter_map(|e| {
@@ -81,10 +79,7 @@ impl CveScanner {
             return Ok(Vec::new());
         }
 
-        let mut all_vulns: Vec<Vec<OsvVuln>> = Vec::with_capacity(queries.len());
+        let body = serde_json::json!({ "queries": queries });
-
-        for chunk in queries.chunks(OSV_BATCH_SIZE) {
-            let body = serde_json::json!({ "queries": chunk });
 
         let resp = self
             .http
@@ -98,9 +93,7 @@ impl CveScanner {
             let status = resp.status();
             let body = resp.text().await.unwrap_or_default();
             tracing::warn!("OSV.dev returned {status}: {body}");
-                // Push empty results for this chunk so indices stay aligned
+            return Ok(Vec::new());
-                all_vulns.extend(std::iter::repeat_with(Vec::new).take(chunk.len()));
-                continue;
         }
 
         let result: OsvBatchResponse = resp
@@ -108,7 +101,10 @@ impl CveScanner {
             .await
             .map_err(|e| CoreError::Http(format!("Failed to parse OSV.dev response: {e}")))?;
 
-            let chunk_vulns = result.results.into_iter().map(|r| {
+        let vulns = result
+            .results
+            .into_iter()
+            .map(|r| {
                 r.vulns
                     .unwrap_or_default()
                     .into_iter()
@@ -120,12 +116,10 @@ impl CveScanner {
                         }),
                     })
                     .collect()
-            });
+            })
+            .collect();
 
-            all_vulns.extend(chunk_vulns);
+        Ok(vulns)
-        }
-
-        Ok(all_vulns)
     }
 
     async fn query_nvd(&self, cve_id: &str) -> Result<Option<f64>, CoreError> {

compliance-agent/src/pipeline/git.rs

@@ -1,80 +1,17 @@
 use std::path::{Path, PathBuf};
 
-use git2::{Cred, FetchOptions, RemoteCallbacks, Repository};
+use git2::{FetchOptions, Repository};
 
 use crate::error::AgentError;
 
-/// Credentials for accessing a private repository
-#[derive(Debug, Clone, Default)]
-pub struct RepoCredentials {
-    /// Path to the SSH private key (for SSH URLs)
-    pub ssh_key_path: Option<String>,
-    /// Auth token / password (for HTTPS URLs)
-    pub auth_token: Option<String>,
-    /// Username for HTTPS auth (defaults to "x-access-token")
-    pub auth_username: Option<String>,
-}
-
-impl RepoCredentials {
-    pub(crate) fn make_callbacks(&self) -> RemoteCallbacks<'_> {
-        let mut callbacks = RemoteCallbacks::new();
-        let ssh_key = self.ssh_key_path.clone();
-        let token = self.auth_token.clone();
-        let username = self.auth_username.clone();
-
-        callbacks.credentials(move |_url, username_from_url, allowed_types| {
-            // SSH key authentication
-            if allowed_types.contains(git2::CredentialType::SSH_KEY) {
-                if let Some(ref key_path) = ssh_key {
-                    let key = Path::new(key_path);
-                    if key.exists() {
-                        let user = username_from_url.unwrap_or("git");
-                        return Cred::ssh_key(user, None, key, None);
-                    }
-                }
-            }
-
-            // HTTPS userpass authentication
-            if allowed_types.contains(git2::CredentialType::USER_PASS_PLAINTEXT) {
-                if let Some(ref tok) = token {
-                    let user = username.as_deref().unwrap_or("x-access-token");
-                    return Cred::userpass_plaintext(user, tok);
-                }
-            }
-
-            Cred::default()
-        });
-
-        callbacks
-    }
-
-    fn fetch_options(&self) -> FetchOptions<'_> {
-        let mut fetch_opts = FetchOptions::new();
-        if self.has_credentials() {
-            fetch_opts.remote_callbacks(self.make_callbacks());
-        }
-        fetch_opts
-    }
-
-    fn has_credentials(&self) -> bool {
-        self.ssh_key_path
-            .as_ref()
-            .map(|p| Path::new(p).exists())
-            .unwrap_or(false)
-            || self.auth_token.is_some()
-    }
-}
-
 pub struct GitOps {
     base_path: PathBuf,
-    credentials: RepoCredentials,
 }
 
 impl GitOps {
-    pub fn new(base_path: &str, credentials: RepoCredentials) -> Self {
+    pub fn new(base_path: &str) -> Self {
         Self {
             base_path: PathBuf::from(base_path),
-            credentials,
         }
     }
 
@@ -85,25 +22,17 @@ impl GitOps {
             self.fetch(&repo_path)?;
         } else {
             std::fs::create_dir_all(&repo_path)?;
-            self.clone_repo(git_url, &repo_path)?;
+            Repository::clone(git_url, &repo_path)?;
             tracing::info!("Cloned {git_url} to {}", repo_path.display());
         }
 
         Ok(repo_path)
     }
 
-    fn clone_repo(&self, git_url: &str, repo_path: &Path) -> Result<(), AgentError> {
-        let mut builder = git2::build::RepoBuilder::new();
-        let fetch_opts = self.credentials.fetch_options();
-        builder.fetch_options(fetch_opts);
-        builder.clone(git_url, repo_path)?;
-        Ok(())
-    }
-
     fn fetch(&self, repo_path: &Path) -> Result<(), AgentError> {
         let repo = Repository::open(repo_path)?;
         let mut remote = repo.find_remote("origin")?;
-        let mut fetch_opts = self.credentials.fetch_options();
+        let mut fetch_opts = FetchOptions::new();
         remote.fetch(&[] as &[&str], Some(&mut fetch_opts), None)?;
 
         // Fast-forward to origin/HEAD
@@ -119,15 +48,6 @@ impl GitOps {
         Ok(())
     }
 
-    /// Test that we can access a remote repository (used during add validation)
-    pub fn test_access(git_url: &str, credentials: &RepoCredentials) -> Result<(), AgentError> {
-        let mut remote = git2::Remote::create_detached(git_url)?;
-        let callbacks = credentials.make_callbacks();
-        remote.connect_auth(git2::Direction::Fetch, Some(callbacks), None)?;
-        remote.disconnect()?;
-        Ok(())
-    }
-
     pub fn get_head_sha(repo_path: &Path) -> Result<String, AgentError> {
         let repo = Repository::open(repo_path)?;
         let head = repo.head()?;
@@ -143,62 +63,6 @@ impl GitOps {
         }
     }
 
-    /// Extract structured diff content between two commits
-    pub fn get_diff_content(
-        repo_path: &Path,
-        old_sha: &str,
-        new_sha: &str,
-    ) -> Result<Vec<DiffFile>, AgentError> {
-        let repo = Repository::open(repo_path)?;
-        let old_commit = repo.find_commit(git2::Oid::from_str(old_sha)?)?;
-        let new_commit = repo.find_commit(git2::Oid::from_str(new_sha)?)?;
-
-        let old_tree = old_commit.tree()?;
-        let new_tree = new_commit.tree()?;
-
-        let diff = repo.diff_tree_to_tree(Some(&old_tree), Some(&new_tree), None)?;
-
-        let mut diff_files: Vec<DiffFile> = Vec::new();
-
-        diff.print(git2::DiffFormat::Patch, |delta, _hunk, line| {
-            let file_path = delta
-                .new_file()
-                .path()
-                .map(|p| p.to_string_lossy().to_string())
-                .unwrap_or_default();
-
-            // Find or create the DiffFile entry
-            let idx = if let Some(pos) = diff_files.iter().position(|f| f.path == file_path) {
-                pos
-            } else {
-                diff_files.push(DiffFile {
-                    path: file_path,
-                    hunks: String::new(),
-                });
-                diff_files.len() - 1
-            };
-            let diff_file = &mut diff_files[idx];
-
-            let prefix = match line.origin() {
-                '+' => "+",
-                '-' => "-",
-                ' ' => " ",
-                _ => "",
-            };
-
-            let content = std::str::from_utf8(line.content()).unwrap_or("");
-            diff_file.hunks.push_str(prefix);
-            diff_file.hunks.push_str(content);
-
-            true
-        })?;
-
-        // Filter out binary files and very large diffs
-        diff_files.retain(|f| !f.hunks.is_empty() && f.hunks.len() < 50_000);
-
-        Ok(diff_files)
-    }
-
     #[allow(dead_code)]
     pub fn get_changed_files(
         repo_path: &Path,
@@ -230,10 +94,3 @@ impl GitOps {
         Ok(files)
     }
 }
-
-/// A file changed between two commits with its diff content
-#[derive(Debug, Clone)]
-pub struct DiffFile {
-    pub path: String,
-    pub hunks: String,
-}

compliance-agent/src/pipeline/gitleaks.rs

@@ -1,130 +0,0 @@
-use std::path::Path;
-
-use compliance_core::models::{Finding, ScanType, Severity};
-use compliance_core::traits::{ScanOutput, Scanner};
-use compliance_core::CoreError;
-
-use crate::pipeline::dedup;
-
-pub struct GitleaksScanner;
-
-impl Scanner for GitleaksScanner {
-    fn name(&self) -> &str {
-        "gitleaks"
-    }
-
-    fn scan_type(&self) -> ScanType {
-        ScanType::SecretDetection
-    }
-
-    async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
-        let output = tokio::process::Command::new("gitleaks")
-            .args([
-                "detect",
-                "--source",
-                ".",
-                "--report-format",
-                "json",
-                "--report-path",
-                "/dev/stdout",
-                "--no-banner",
-                "--exit-code",
-                "0",
-            ])
-            .current_dir(repo_path)
-            .output()
-            .await
-            .map_err(|e| CoreError::Scanner {
-                scanner: "gitleaks".to_string(),
-                source: Box::new(e),
-            })?;
-
-        if output.stdout.is_empty() {
-            return Ok(ScanOutput::default());
-        }
-
-        let results: Vec<GitleaksResult> =
-            serde_json::from_slice(&output.stdout).unwrap_or_default();
-
-        let findings = results
-            .into_iter()
-            .filter(|r| !is_allowlisted(&r.file))
-            .map(|r| {
-                let severity = match r.rule_id.as_str() {
-                    s if s.contains("private-key") => Severity::Critical,
-                    s if s.contains("token") || s.contains("password") || s.contains("secret") => {
-                        Severity::High
-                    }
-                    s if s.contains("api-key") => Severity::High,
-                    _ => Severity::Medium,
-                };
-
-                let fingerprint = dedup::compute_fingerprint(&[
-                    repo_id,
-                    &r.rule_id,
-                    &r.file,
-                    &r.start_line.to_string(),
-                ]);
-
-                let title = format!("Secret detected: {}", r.description);
-                let description = format!(
-                    "Potential secret ({}) found in {}:{}. Match: {}",
-                    r.rule_id,
-                    r.file,
-                    r.start_line,
-                    r.r#match.chars().take(80).collect::<String>(),
-                );
-
-                let mut finding = Finding::new(
-                    repo_id.to_string(),
-                    fingerprint,
-                    "gitleaks".to_string(),
-                    ScanType::SecretDetection,
-                    title,
-                    description,
-                    severity,
-                );
-                finding.rule_id = Some(r.rule_id);
-                finding.file_path = Some(r.file);
-                finding.line_number = Some(r.start_line);
-                finding.code_snippet = Some(r.r#match);
-                finding
-            })
-            .collect();
-
-        Ok(ScanOutput {
-            findings,
-            sbom_entries: Vec::new(),
-        })
-    }
-}
-
-/// Skip files that commonly contain example/placeholder secrets
-fn is_allowlisted(file_path: &str) -> bool {
-    let lower = file_path.to_lowercase();
-    lower.ends_with(".env.example")
-        || lower.ends_with(".env.sample")
-        || lower.ends_with(".env.template")
-        || lower.contains("/test/")
-        || lower.contains("/tests/")
-        || lower.contains("/fixtures/")
-        || lower.contains("/testdata/")
-        || lower.contains("mock")
-        || lower.ends_with("_test.go")
-        || lower.ends_with(".test.ts")
-        || lower.ends_with(".test.js")
-        || lower.ends_with(".spec.ts")
-        || lower.ends_with(".spec.js")
-}
-
-#[derive(serde::Deserialize)]
-#[serde(rename_all = "PascalCase")]
-struct GitleaksResult {
-    description: String,
-    #[serde(rename = "RuleID")]
-    rule_id: String,
-    file: String,
-    start_line: u32,
-    #[serde(rename = "Match")]
-    r#match: String,
-}

compliance-agent/src/pipeline/lint.rs

@@ -1,364 +0,0 @@
-use std::path::Path;
-use std::time::Duration;
-
-use compliance_core::models::{Finding, ScanType, Severity};
-use compliance_core::traits::{ScanOutput, Scanner};
-use compliance_core::CoreError;
-use tokio::process::Command;
-
-use crate::pipeline::dedup;
-
-/// Timeout for each individual lint command
-const LINT_TIMEOUT: Duration = Duration::from_secs(120);
-
-pub struct LintScanner;
-
-impl Scanner for LintScanner {
-    fn name(&self) -> &str {
-        "lint"
-    }
-
-    fn scan_type(&self) -> ScanType {
-        ScanType::Lint
-    }
-
-    async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
-        let mut all_findings = Vec::new();
-
-        // Detect which languages are present and run appropriate linters
-        if has_rust_project(repo_path) {
-            match run_clippy(repo_path, repo_id).await {
-                Ok(findings) => all_findings.extend(findings),
-                Err(e) => tracing::warn!("Clippy failed: {e}"),
-            }
-        }
-
-        if has_js_project(repo_path) {
-            match run_eslint(repo_path, repo_id).await {
-                Ok(findings) => all_findings.extend(findings),
-                Err(e) => tracing::warn!("ESLint failed: {e}"),
-            }
-        }
-
-        if has_python_project(repo_path) {
-            match run_ruff(repo_path, repo_id).await {
-                Ok(findings) => all_findings.extend(findings),
-                Err(e) => tracing::warn!("Ruff failed: {e}"),
-            }
-        }
-
-        Ok(ScanOutput {
-            findings: all_findings,
-            sbom_entries: Vec::new(),
-        })
-    }
-}
-
-fn has_rust_project(repo_path: &Path) -> bool {
-    repo_path.join("Cargo.toml").exists()
-}
-
-fn has_js_project(repo_path: &Path) -> bool {
-    // Only run if eslint is actually installed in the project
-    repo_path.join("package.json").exists() && repo_path.join("node_modules/.bin/eslint").exists()
-}
-
-fn has_python_project(repo_path: &Path) -> bool {
-    repo_path.join("pyproject.toml").exists()
-        || repo_path.join("setup.py").exists()
-        || repo_path.join("requirements.txt").exists()
-}
-
-/// Run a command with a timeout, returning its output or an error
-async fn run_with_timeout(
-    child: tokio::process::Child,
-    scanner_name: &str,
-) -> Result<std::process::Output, CoreError> {
-    let result = tokio::time::timeout(LINT_TIMEOUT, child.wait_with_output()).await;
-    match result {
-        Ok(Ok(output)) => Ok(output),
-        Ok(Err(e)) => Err(CoreError::Scanner {
-            scanner: scanner_name.to_string(),
-            source: Box::new(e),
-        }),
-        Err(_) => {
-            // Process is dropped here which sends SIGKILL on Unix
-            Err(CoreError::Scanner {
-                scanner: scanner_name.to_string(),
-                source: Box::new(std::io::Error::new(
-                    std::io::ErrorKind::TimedOut,
-                    format!("{scanner_name} timed out after {}s", LINT_TIMEOUT.as_secs()),
-                )),
-            })
-        }
-    }
-}
-
-// ── Clippy ──────────────────────────────────────────────
-
-async fn run_clippy(repo_path: &Path, repo_id: &str) -> Result<Vec<Finding>, CoreError> {
-    let child = Command::new("cargo")
-        .args([
-            "clippy",
-            "--message-format=json",
-            "--quiet",
-            "--",
-            "-W",
-            "clippy::all",
-        ])
-        .current_dir(repo_path)
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped())
-        .spawn()
-        .map_err(|e| CoreError::Scanner {
-            scanner: "clippy".to_string(),
-            source: Box::new(e),
-        })?;
-
-    let output = run_with_timeout(child, "clippy").await?;
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    let mut findings = Vec::new();
-
-    for line in stdout.lines() {
-        let msg: serde_json::Value = match serde_json::from_str(line) {
-            Ok(v) => v,
-            Err(_) => continue,
-        };
-
-        if msg.get("reason").and_then(|v| v.as_str()) != Some("compiler-message") {
-            continue;
-        }
-
-        let message = match msg.get("message") {
-            Some(m) => m,
-            None => continue,
-        };
-
-        let level = message.get("level").and_then(|v| v.as_str()).unwrap_or("");
-
-        if level != "warning" && level != "error" {
-            continue;
-        }
-
-        let text = message
-            .get("message")
-            .and_then(|v| v.as_str())
-            .unwrap_or("")
-            .to_string();
-
-        let code = message
-            .get("code")
-            .and_then(|v| v.get("code"))
-            .and_then(|v| v.as_str())
-            .unwrap_or("")
-            .to_string();
-
-        if text.starts_with("aborting due to") || code.is_empty() {
-            continue;
-        }
-
-        let (file_path, line_number) = extract_primary_span(message);
-
-        let severity = if level == "error" {
-            Severity::High
-        } else {
-            Severity::Low
-        };
-
-        let fingerprint = dedup::compute_fingerprint(&[
-            repo_id,
-            "clippy",
-            &code,
-            &file_path,
-            &line_number.to_string(),
-        ]);
-
-        let mut finding = Finding::new(
-            repo_id.to_string(),
-            fingerprint,
-            "clippy".to_string(),
-            ScanType::Lint,
-            format!("[clippy] {text}"),
-            text,
-            severity,
-        );
-        finding.rule_id = Some(code);
-        if !file_path.is_empty() {
-            finding.file_path = Some(file_path);
-        }
-        if line_number > 0 {
-            finding.line_number = Some(line_number);
-        }
-        findings.push(finding);
-    }
-
-    Ok(findings)
-}
-
-fn extract_primary_span(message: &serde_json::Value) -> (String, u32) {
-    let spans = match message.get("spans").and_then(|v| v.as_array()) {
-        Some(s) => s,
-        None => return (String::new(), 0),
-    };
-
-    for span in spans {
-        if span.get("is_primary").and_then(|v| v.as_bool()) == Some(true) {
-            let file = span
-                .get("file_name")
-                .and_then(|v| v.as_str())
-                .unwrap_or("")
-                .to_string();
-            let line = span.get("line_start").and_then(|v| v.as_u64()).unwrap_or(0) as u32;
-            return (file, line);
-        }
-    }
-
-    (String::new(), 0)
-}
-
-// ── ESLint ──────────────────────────────────────────────
-
-async fn run_eslint(repo_path: &Path, repo_id: &str) -> Result<Vec<Finding>, CoreError> {
-    // Use the project-local eslint binary directly, not npx (which can hang downloading)
-    let eslint_bin = repo_path.join("node_modules/.bin/eslint");
-    let child = Command::new(eslint_bin)
-        .args([".", "--format", "json", "--no-error-on-unmatched-pattern"])
-        .current_dir(repo_path)
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped())
-        .spawn()
-        .map_err(|e| CoreError::Scanner {
-            scanner: "eslint".to_string(),
-            source: Box::new(e),
-        })?;
-
-    let output = run_with_timeout(child, "eslint").await?;
-
-    if output.stdout.is_empty() {
-        return Ok(Vec::new());
-    }
-
-    let results: Vec<EslintFileResult> = serde_json::from_slice(&output.stdout).unwrap_or_default();
-
-    let mut findings = Vec::new();
-    for file_result in results {
-        for msg in file_result.messages {
-            let severity = match msg.severity {
-                2 => Severity::Medium,
-                _ => Severity::Low,
-            };
-
-            let rule_id = msg.rule_id.unwrap_or_default();
-            let fingerprint = dedup::compute_fingerprint(&[
-                repo_id,
-                "eslint",
-                &rule_id,
-                &file_result.file_path,
-                &msg.line.to_string(),
-            ]);
-
-            let mut finding = Finding::new(
-                repo_id.to_string(),
-                fingerprint,
-                "eslint".to_string(),
-                ScanType::Lint,
-                format!("[eslint] {}", msg.message),
-                msg.message,
-                severity,
-            );
-            finding.rule_id = Some(rule_id);
-            finding.file_path = Some(file_result.file_path.clone());
-            finding.line_number = Some(msg.line);
-            findings.push(finding);
-        }
-    }
-
-    Ok(findings)
-}
-
-#[derive(serde::Deserialize)]
-struct EslintFileResult {
-    #[serde(rename = "filePath")]
-    file_path: String,
-    messages: Vec<EslintMessage>,
-}
-
-#[derive(serde::Deserialize)]
-struct EslintMessage {
-    #[serde(rename = "ruleId")]
-    rule_id: Option<String>,
-    severity: u8,
-    message: String,
-    line: u32,
-}
-
-// ── Ruff ────────────────────────────────────────────────
-
-async fn run_ruff(repo_path: &Path, repo_id: &str) -> Result<Vec<Finding>, CoreError> {
-    let child = Command::new("ruff")
-        .args(["check", ".", "--output-format", "json", "--exit-zero"])
-        .current_dir(repo_path)
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped())
-        .spawn()
-        .map_err(|e| CoreError::Scanner {
-            scanner: "ruff".to_string(),
-            source: Box::new(e),
-        })?;
-
-    let output = run_with_timeout(child, "ruff").await?;
-
-    if output.stdout.is_empty() {
-        return Ok(Vec::new());
-    }
-
-    let results: Vec<RuffResult> = serde_json::from_slice(&output.stdout).unwrap_or_default();
-
-    let findings = results
-        .into_iter()
-        .map(|r| {
-            let severity = if r.code.starts_with('E') || r.code.starts_with('F') {
-                Severity::Medium
-            } else {
-                Severity::Low
-            };
-
-            let fingerprint = dedup::compute_fingerprint(&[
-                repo_id,
-                "ruff",
-                &r.code,
-                &r.filename,
-                &r.location.row.to_string(),
-            ]);
-
-            let mut finding = Finding::new(
-                repo_id.to_string(),
-                fingerprint,
-                "ruff".to_string(),
-                ScanType::Lint,
-                format!("[ruff] {}: {}", r.code, r.message),
-                r.message,
-                severity,
-            );
-            finding.rule_id = Some(r.code);
-            finding.file_path = Some(r.filename);
-            finding.line_number = Some(r.location.row);
-            finding
-        })
-        .collect();
-
-    Ok(findings)
-}
-
-#[derive(serde::Deserialize)]
-struct RuffResult {
-    code: String,
-    message: String,
-    filename: String,
-    location: RuffLocation,
-}
-
-#[derive(serde::Deserialize)]
-struct RuffLocation {
-    row: u32,
-}

compliance-agent/src/pipeline/mod.rs

@@ -1,9 +1,6 @@
-pub mod code_review;
 pub mod cve;
 pub mod dedup;
 pub mod git;
-pub mod gitleaks;
-pub mod lint;
 pub mod orchestrator;
 pub mod patterns;
 pub mod sbom;

compliance-agent/src/pipeline/orchestrator.rs

@@ -9,11 +9,8 @@ use compliance_core::AgentConfig;
 use crate::database::Database;
 use crate::error::AgentError;
 use crate::llm::LlmClient;
-use crate::pipeline::code_review::CodeReviewScanner;
 use crate::pipeline::cve::CveScanner;
-use crate::pipeline::git::{GitOps, RepoCredentials};
+use crate::pipeline::git::GitOps;
-use crate::pipeline::gitleaks::GitleaksScanner;
-use crate::pipeline::lint::LintScanner;
 use crate::pipeline::patterns::{GdprPatternScanner, OAuthPatternScanner};
 use crate::pipeline::sbom::SbomScanner;
 use crate::pipeline::semgrep::SemgrepScanner;
@@ -117,12 +114,7 @@ impl PipelineOrchestrator {
 
         // Stage 0: Change detection
         tracing::info!("[{repo_id}] Stage 0: Change detection");
-        let creds = RepoCredentials {
+        let git_ops = GitOps::new(&self.config.git_clone_base_path);
-            ssh_key_path: Some(self.config.ssh_key_path.clone()),
-            auth_token: repo.auth_token.clone(),
-            auth_username: repo.auth_username.clone(),
-        };
-        let git_ops = GitOps::new(&self.config.git_clone_base_path, creds);
         let repo_path = git_ops.clone_or_fetch(&repo.git_url, &repo.name)?;
 
         if !GitOps::has_new_commits(&repo_path, repo.last_scanned_commit.as_deref())? {
@@ -190,35 +182,6 @@ impl PipelineOrchestrator {
             Err(e) => tracing::warn!("[{repo_id}] OAuth pattern scan failed: {e}"),
         }
 
-        // Stage 4a: Secret Detection (Gitleaks)
-        tracing::info!("[{repo_id}] Stage 4a: Secret Detection");
-        self.update_phase(scan_run_id, "secret_detection").await;
-        let gitleaks = GitleaksScanner;
-        match gitleaks.scan(&repo_path, &repo_id).await {
-            Ok(output) => all_findings.extend(output.findings),
-            Err(e) => tracing::warn!("[{repo_id}] Gitleaks failed: {e}"),
-        }
-
-        // Stage 4b: Lint Scanning
-        tracing::info!("[{repo_id}] Stage 4b: Lint Scanning");
-        self.update_phase(scan_run_id, "lint_scanning").await;
-        let lint = LintScanner;
-        match lint.scan(&repo_path, &repo_id).await {
-            Ok(output) => all_findings.extend(output.findings),
-            Err(e) => tracing::warn!("[{repo_id}] Lint scanning failed: {e}"),
-        }
-
-        // Stage 4c: LLM Code Review (only on incremental scans)
-        if let Some(old_sha) = &repo.last_scanned_commit {
-            tracing::info!("[{repo_id}] Stage 4c: LLM Code Review");
-            self.update_phase(scan_run_id, "code_review").await;
-            let reviewer = CodeReviewScanner::new(self.llm.clone());
-            let review_output = reviewer
-                .review_diff(&repo_path, &repo_id, old_sha, &current_sha)
-                .await;
-            all_findings.extend(review_output.findings);
-        }
-
         // Stage 4.5: Graph Building
         tracing::info!("[{repo_id}] Stage 4.5: Graph Building");
         self.update_phase(scan_run_id, "graph_building").await;

compliance-agent/src/ssh.rs

@@ -1,53 +0,0 @@
-use std::path::Path;
-
-use crate::error::AgentError;
-
-/// Ensure the SSH key pair exists at the given path, generating it if missing.
-/// Returns the public key contents.
-pub fn ensure_ssh_key(key_path: &str) -> Result<String, AgentError> {
-    let private_path = Path::new(key_path);
-    let public_path = private_path.with_extension("pub");
-
-    if private_path.exists() && public_path.exists() {
-        return std::fs::read_to_string(&public_path)
-            .map_err(|e| AgentError::Config(format!("Failed to read SSH public key: {e}")));
-    }
-
-    // Create parent directory
-    if let Some(parent) = private_path.parent() {
-        std::fs::create_dir_all(parent)?;
-    }
-
-    // Generate ed25519 key pair using ssh-keygen
-    let output = std::process::Command::new("ssh-keygen")
-        .args([
-            "-t",
-            "ed25519",
-            "-f",
-            key_path,
-            "-N",
-            "", // no passphrase
-            "-C",
-            "compliance-scanner-agent",
-        ])
-        .output()
-        .map_err(|e| AgentError::Config(format!("Failed to run ssh-keygen: {e}")))?;
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        return Err(AgentError::Config(format!("ssh-keygen failed: {stderr}")));
-    }
-
-    // Set correct permissions
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt;
-        std::fs::set_permissions(private_path, std::fs::Permissions::from_mode(0o600))?;
-    }
-
-    let public_key = std::fs::read_to_string(&public_path)
-        .map_err(|e| AgentError::Config(format!("Failed to read generated SSH public key: {e}")))?;
-
-    tracing::info!("Generated new SSH key pair at {key_path}");
-    Ok(public_key)
-}

compliance-core/Cargo.toml

@@ -32,7 +32,7 @@ bson = { version = "2", features = ["chrono-0_4"] }
 mongodb = { workspace = true, optional = true }
 opentelemetry = { version = "0.29", optional = true }
 opentelemetry_sdk = { version = "0.29", features = ["rt-tokio"], optional = true }
-opentelemetry-otlp = { version = "0.29", features = ["http", "reqwest-rustls"], optional = true }
+opentelemetry-otlp = { version = "0.29", features = ["grpc-tonic"], optional = true }
 opentelemetry-appender-tracing = { version = "0.29", optional = true }
 tracing-opentelemetry = { version = "0.30", optional = true }
 tracing-subscriber = { workspace = true, optional = true }

compliance-core/src/config.rs

@@ -24,7 +24,6 @@ pub struct AgentConfig {
     pub scan_schedule: String,
     pub cve_monitor_schedule: String,
     pub git_clone_base_path: String,
-    pub ssh_key_path: String,
     pub keycloak_url: Option<String>,
     pub keycloak_realm: Option<String>,
 }
@@ -35,5 +34,4 @@ pub struct DashboardConfig {
     pub mongodb_database: String,
     pub agent_api_url: String,
     pub dashboard_port: u16,
-    pub mcp_endpoint_url: Option<String>,
 }

compliance-core/src/models/cve.rs

@@ -23,7 +23,6 @@ pub struct CveAlert {
     pub summary: Option<String>,
     pub llm_impact_summary: Option<String>,
     pub references: Vec<String>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
 }
 

compliance-core/src/models/dast.rs

@@ -58,9 +58,7 @@ pub struct DastTarget {
     pub rate_limit: u32,
     /// Whether destructive tests (DELETE, PUT) are allowed
     pub allow_destructive: bool,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub updated_at: DateTime<Utc>,
 }
 
@@ -137,9 +135,7 @@ pub struct DastScanRun {
     pub error_message: Option<String>,
     /// Linked SAST scan run ID (if triggered as part of pipeline)
     pub sast_scan_run_id: Option<String>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub started_at: DateTime<Utc>,
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
     pub completed_at: Option<DateTime<Utc>>,
 }
 
@@ -244,7 +240,6 @@ pub struct DastFinding {
     pub remediation: Option<String>,
     /// Linked SAST finding ID (if correlated)
     pub linked_sast_finding_id: Option<String>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
 }
 

compliance-core/src/models/finding.rs

@@ -71,14 +71,7 @@ pub struct Finding {
     pub status: FindingStatus,
     pub tracker_issue_url: Option<String>,
     pub scan_run_id: Option<String>,
-    /// LLM triage action and reasoning
-    pub triage_action: Option<String>,
-    pub triage_rationale: Option<String>,
-    /// Developer feedback on finding quality
-    pub developer_feedback: Option<String>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub updated_at: DateTime<Utc>,
 }
 
@@ -115,9 +108,6 @@ impl Finding {
             status: FindingStatus::Open,
             tracker_issue_url: None,
             scan_run_id: None,
-            triage_action: None,
-            triage_rationale: None,
-            developer_feedback: None,
             created_at: now,
             updated_at: now,
         }

compliance-core/src/models/graph.rs

@@ -122,9 +122,7 @@ pub struct GraphBuildRun {
     pub community_count: u32,
     pub languages_parsed: Vec<String>,
     pub error_message: Option<String>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub started_at: DateTime<Utc>,
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
     pub completed_at: Option<DateTime<Utc>>,
 }
 
@@ -166,7 +164,6 @@ pub struct ImpactAnalysis {
     pub direct_callers: Vec<String>,
     /// Direct callees of the affected function
     pub direct_callees: Vec<String>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
 }
 

compliance-core/src/models/issue.rs

@@ -49,9 +49,7 @@ pub struct TrackerIssue {
     pub external_url: String,
     pub title: String,
     pub status: IssueStatus,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub updated_at: DateTime<Utc>,
 }
 

compliance-core/src/models/mcp.rs

@@ -1,69 +0,0 @@
-use chrono::{DateTime, Utc};
-use serde::{Deserialize, Serialize};
-
-/// Transport mode for MCP server
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum McpTransport {
-    Stdio,
-    Http,
-}
-
-impl std::fmt::Display for McpTransport {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Stdio => write!(f, "stdio"),
-            Self::Http => write!(f, "http"),
-        }
-    }
-}
-
-/// Status of a running MCP server
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum McpServerStatus {
-    Running,
-    Stopped,
-    Error,
-}
-
-impl std::fmt::Display for McpServerStatus {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Running => write!(f, "running"),
-            Self::Stopped => write!(f, "stopped"),
-            Self::Error => write!(f, "error"),
-        }
-    }
-}
-
-/// Configuration for a registered MCP server instance
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct McpServerConfig {
-    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
-    pub id: Option<bson::oid::ObjectId>,
-    /// Display name for this MCP server
-    pub name: String,
-    /// Endpoint URL (e.g. https://mcp.example.com/mcp)
-    pub endpoint_url: String,
-    /// Transport type
-    pub transport: McpTransport,
-    /// Port number (for HTTP transport)
-    pub port: Option<u16>,
-    /// Current status
-    pub status: McpServerStatus,
-    /// Bearer access token for authentication
-    pub access_token: String,
-    /// Which tools are enabled on this server
-    pub tools_enabled: Vec<String>,
-    /// Optional description / notes
-    pub description: Option<String>,
-    /// MongoDB URI this server connects to
-    pub mongodb_uri: Option<String>,
-    /// Database name
-    pub mongodb_database: Option<String>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
-    pub created_at: DateTime<Utc>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
-    pub updated_at: DateTime<Utc>,
-}

compliance-core/src/models/mod.rs

@@ -6,11 +6,9 @@ pub mod embedding;
 pub mod finding;
 pub mod graph;
 pub mod issue;
-pub mod mcp;
 pub mod repository;
 pub mod sbom;
 pub mod scan;
-pub(crate) mod serde_helpers;
 
 pub use auth::AuthInfo;
 pub use chat::{ChatMessage, ChatRequest, ChatResponse, SourceReference};
@@ -25,7 +23,6 @@ pub use graph::{
     CodeEdge, CodeEdgeKind, CodeNode, CodeNodeKind, GraphBuildRun, GraphBuildStatus, ImpactAnalysis,
 };
 pub use issue::{IssueStatus, TrackerIssue, TrackerType};
-pub use mcp::{McpServerConfig, McpServerStatus, McpTransport};
 pub use repository::{ScanTrigger, TrackedRepository};
 pub use sbom::{SbomEntry, VulnRef};
 pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};

compliance-core/src/models/repository.rs

@@ -28,23 +28,17 @@ pub struct TrackedRepository {
     pub tracker_type: Option<TrackerType>,
     pub tracker_owner: Option<String>,
     pub tracker_repo: Option<String>,
-    /// Optional auth token for HTTPS private repos (PAT or password)
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auth_token: Option<String>,
-    /// Optional username for HTTPS auth (defaults to "x-access-token" for PATs)
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auth_username: Option<String>,
     pub last_scanned_commit: Option<String>,
     #[serde(default, deserialize_with = "deserialize_findings_count")]
     pub findings_count: u32,
     #[serde(
         default = "chrono::Utc::now",
-        with = "super::serde_helpers::bson_datetime"
+        deserialize_with = "deserialize_datetime"
     )]
     pub created_at: DateTime<Utc>,
     #[serde(
         default = "chrono::Utc::now",
-        with = "super::serde_helpers::bson_datetime"
+        deserialize_with = "deserialize_datetime"
     )]
     pub updated_at: DateTime<Utc>,
 }
@@ -53,6 +47,23 @@ fn default_branch() -> String {
     "main".to_string()
 }
 
+/// Handles findings_count stored as either a plain integer or a BSON Int64
+/// which the driver may present as a map `{"low": N, "high": N, "unsigned": bool}`.
+/// Handles datetime stored as either a BSON DateTime or an RFC 3339 string.
+fn deserialize_datetime<'de, D>(deserializer: D) -> Result<DateTime<Utc>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let bson = bson::Bson::deserialize(deserializer)?;
+    match bson {
+        bson::Bson::DateTime(dt) => Ok(dt.into()),
+        bson::Bson::String(s) => s.parse::<DateTime<Utc>>().map_err(serde::de::Error::custom),
+        other => Err(serde::de::Error::custom(format!(
+            "expected DateTime or string, got: {other:?}"
+        ))),
+    }
+}
+
 fn deserialize_findings_count<'de, D>(deserializer: D) -> Result<u32, D::Error>
 where
     D: Deserializer<'de>,
@@ -76,8 +87,6 @@ impl TrackedRepository {
             default_branch: "main".to_string(),
             local_path: None,
             scan_schedule: None,
-            auth_token: None,
-            auth_username: None,
             webhook_enabled: false,
             tracker_type: None,
             tracker_owner: None,

compliance-core/src/models/sbom.rs

@@ -20,9 +20,7 @@ pub struct SbomEntry {
     pub license: Option<String>,
     pub purl: Option<String>,
     pub known_vulnerabilities: Vec<VulnRef>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub updated_at: DateTime<Utc>,
 }
 

compliance-core/src/models/scan.rs

@@ -13,9 +13,6 @@ pub enum ScanType {
     OAuth,
     Graph,
     Dast,
-    SecretDetection,
-    Lint,
-    CodeReview,
 }
 
 impl std::fmt::Display for ScanType {
@@ -28,9 +25,6 @@ impl std::fmt::Display for ScanType {
             Self::OAuth => write!(f, "oauth"),
             Self::Graph => write!(f, "graph"),
             Self::Dast => write!(f, "dast"),
-            Self::SecretDetection => write!(f, "secret_detection"),
-            Self::Lint => write!(f, "lint"),
-            Self::CodeReview => write!(f, "code_review"),
         }
     }
 }
@@ -51,9 +45,6 @@ pub enum ScanPhase {
     SbomGeneration,
     CveScanning,
     PatternScanning,
-    SecretDetection,
-    LintScanning,
-    CodeReview,
     GraphBuilding,
     LlmTriage,
     IssueCreation,
@@ -73,9 +64,7 @@ pub struct ScanRun {
     pub phases_completed: Vec<ScanPhase>,
     pub new_findings_count: u32,
     pub error_message: Option<String>,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
     pub started_at: DateTime<Utc>,
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
     pub completed_at: Option<DateTime<Utc>>,
 }
 

compliance-core/src/models/serde_helpers.rs

@@ -1,68 +0,0 @@
-use chrono::{DateTime, Utc};
-use serde::{Deserialize, Deserializer, Serializer};
-
-/// Serialize/deserialize `DateTime<Utc>` as BSON DateTime.
-/// Handles both BSON DateTime objects and RFC 3339 strings on deserialization.
-pub mod bson_datetime {
-    use super::*;
-    use serde::Serialize as _;
-
-    pub fn serialize<S>(dt: &DateTime<Utc>, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        let bson_dt: bson::DateTime = (*dt).into();
-        bson_dt.serialize(serializer)
-    }
-
-    pub fn deserialize<'de, D>(deserializer: D) -> Result<DateTime<Utc>, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let bson_val = bson::Bson::deserialize(deserializer)?;
-        match bson_val {
-            bson::Bson::DateTime(dt) => Ok(dt.into()),
-            bson::Bson::String(s) => s.parse::<DateTime<Utc>>().map_err(serde::de::Error::custom),
-            other => Err(serde::de::Error::custom(format!(
-                "expected DateTime or string, got: {other:?}"
-            ))),
-        }
-    }
-}
-
-/// Serialize/deserialize `Option<DateTime<Utc>>` as BSON DateTime.
-pub mod opt_bson_datetime {
-    use super::*;
-    use serde::Serialize as _;
-
-    pub fn serialize<S>(dt: &Option<DateTime<Utc>>, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        match dt {
-            Some(dt) => {
-                let bson_dt: bson::DateTime = (*dt).into();
-                bson_dt.serialize(serializer)
-            }
-            None => serializer.serialize_none(),
-        }
-    }
-
-    pub fn deserialize<'de, D>(deserializer: D) -> Result<Option<DateTime<Utc>>, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let bson_val = Option::<bson::Bson>::deserialize(deserializer)?;
-        match bson_val {
-            Some(bson::Bson::DateTime(dt)) => Ok(Some(dt.into())),
-            Some(bson::Bson::String(s)) => s
-                .parse::<DateTime<Utc>>()
-                .map(Some)
-                .map_err(serde::de::Error::custom),
-            Some(bson::Bson::Null) | None => Ok(None),
-            Some(other) => Err(serde::de::Error::custom(format!(
-                "expected DateTime, string, or null, got: {other:?}"
-            ))),
-        }
-    }
-}

compliance-core/src/telemetry.rs

@@ -1,6 +1,6 @@
 //! OpenTelemetry initialization for traces and logs.
 //!
-//! Exports traces and logs via OTLP/HTTP when `OTEL_EXPORTER_OTLP_ENDPOINT`
+//! Exports traces and logs via OTLP (gRPC) when `OTEL_EXPORTER_OTLP_ENDPOINT`
 //! is set. Always includes a `tracing_subscriber::fmt` layer for console output.
 //!
 //! Compatible with SigNoz, Grafana Tempo/Loki, Jaeger, and any OTLP-compatible
@@ -10,7 +10,7 @@
 //!
 //! | Variable | Description | Default |
 //! |---|---|---|
-//! | `OTEL_EXPORTER_OTLP_ENDPOINT` | OTLP collector endpoint (e.g. `https://otel.example.com`) | *(disabled)* |
+//! | `OTEL_EXPORTER_OTLP_ENDPOINT` | OTLP collector endpoint (e.g. `http://localhost:4317`) | *(disabled)* |
 //! | `OTEL_SERVICE_NAME` | Service name for resource | `service_name` param |
 //! | `RUST_LOG` / standard `EnvFilter` | Log level filter | `info` |
 
@@ -58,7 +58,7 @@ fn build_resource(service_name: &str) -> Resource {
 /// Initialize telemetry (tracing + logging).
 ///
 /// If `OTEL_EXPORTER_OTLP_ENDPOINT` is set, traces and logs are exported
-/// via OTLP/HTTP. Console fmt output is always enabled.
+/// via OTLP/gRPC. Console fmt output is always enabled.
 ///
 /// Returns a [`TelemetryGuard`] that must be held alive for the application
 /// lifetime. Dropping it triggers a graceful shutdown of OTel providers.
@@ -76,14 +76,11 @@ pub fn init_telemetry(service_name: &str) -> TelemetryGuard {
         Some(ref endpoint) => {
             let resource = build_resource(service_name);
 
-            let traces_endpoint = format!("{endpoint}/v1/traces");
-            let logs_endpoint = format!("{endpoint}/v1/logs");
-
             // Traces
             #[allow(clippy::expect_used)]
             let span_exporter = SpanExporter::builder()
-                .with_http()
+                .with_tonic()
-                .with_endpoint(&traces_endpoint)
+                .with_endpoint(endpoint)
                 .build()
                 .expect("failed to create OTLP span exporter");
 
@@ -99,8 +96,8 @@ pub fn init_telemetry(service_name: &str) -> TelemetryGuard {
             // Logs
             #[allow(clippy::expect_used)]
             let log_exporter = LogExporter::builder()
-                .with_http()
+                .with_tonic()
-                .with_endpoint(&logs_endpoint)
+                .with_endpoint(endpoint)
                 .build()
                 .expect("failed to create OTLP log exporter");
 
@@ -114,6 +111,7 @@ pub fn init_telemetry(service_name: &str) -> TelemetryGuard {
             // Filter to prevent telemetry-induced-telemetry loops
             let otel_filter = EnvFilter::new("info")
                 .add_directive("hyper=off".parse().unwrap_or_default())
+                .add_directive("tonic=off".parse().unwrap_or_default())
                 .add_directive("h2=off".parse().unwrap_or_default())
                 .add_directive("reqwest=off".parse().unwrap_or_default());
 
@@ -127,7 +125,7 @@ pub fn init_telemetry(service_name: &str) -> TelemetryGuard {
             tracing::info!(
                 endpoint = endpoint.as_str(),
                 service = service_name,
-                "OpenTelemetry OTLP/HTTP export enabled"
+                "OpenTelemetry OTLP export enabled"
             );
 
             TelemetryGuard {

compliance-dashboard/Cargo.toml

@@ -34,8 +34,6 @@ server = [
     "dep:url",
     "dep:sha2",
     "dep:base64",
-    "dep:uuid",
-    "dep:bson",
 ]
 
 [dependencies]
@@ -69,5 +67,3 @@ rand = { version = "0.9", optional = true }
 url = { version = "2", optional = true }
 sha2 = { workspace = true, optional = true }
 base64 = { version = "0.22", optional = true }
-uuid = { workspace = true, optional = true }
-bson = { version = "2", features = ["chrono-0_4"], optional = true }

compliance-dashboard/assets/main.css

@@ -323,25 +323,6 @@ code {
 
 /* ── Page Header ── */
 
-/* ── Back Navigation ── */
-
-.back-nav {
-    margin-bottom: 12px;
-}
-
-.btn-back {
-    display: inline-flex;
-    align-items: center;
-    gap: 6px;
-    font-size: 13px;
-    padding: 6px 12px;
-    color: var(--text-secondary);
-}
-
-.btn-back:hover {
-    color: var(--text-primary);
-}
-
 .page-header {
     margin-bottom: 28px;
     padding-bottom: 20px;
@@ -498,7 +479,7 @@ th {
 }
 
 td {
-    padding: 12px 16px;
+    padding: 11px 16px;
     border-bottom: 1px solid var(--border);
     font-size: 13.5px;
     color: var(--text-primary);
@@ -524,8 +505,7 @@ tbody tr:last-child td {
 .badge {
     display: inline-flex;
     align-items: center;
-    gap: 5px;
+    padding: 3px 10px;
-    padding: 4px 10px;
     border-radius: 6px;
     font-family: var(--font-mono);
     font-size: 11px;
@@ -629,316 +609,6 @@ tbody tr:last-child td {
     background: var(--danger-bg);
 }
 
-.btn-scanning {
-    opacity: 0.7;
-    cursor: not-allowed;
-    display: inline-flex;
-    align-items: center;
-    gap: 6px;
-}
-
-.btn-icon {
-    display: inline-flex;
-    align-items: center;
-    justify-content: center;
-    padding: 6px 8px;
-    min-width: 32px;
-}
-
-/* ── Overview Cards Grid ── */
-
-.overview-section {
-    margin-top: 28px;
-}
-
-.overview-section-header {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    margin-bottom: 16px;
-}
-
-.overview-section-header h3 {
-    font-family: var(--font-display);
-    font-size: 18px;
-    font-weight: 700;
-    color: var(--text-primary);
-}
-
-.overview-grid {
-    display: grid;
-    grid-template-columns: repeat(auto-fill, minmax(240px, 1fr));
-    gap: 14px;
-}
-
-.overview-card {
-    background: var(--bg-card);
-    border: 1px solid var(--border);
-    border-radius: var(--radius);
-    padding: 16px;
-    transition: border-color 0.2s, box-shadow 0.2s;
-    text-decoration: none;
-    color: inherit;
-    display: flex;
-    align-items: center;
-    gap: 12px;
-}
-
-.overview-card:hover {
-    border-color: var(--accent);
-    box-shadow: 0 0 16px rgba(0, 200, 255, 0.06);
-}
-
-.overview-card-icon {
-    color: var(--accent);
-    flex-shrink: 0;
-}
-
-.overview-card-body {
-    min-width: 0;
-}
-
-.overview-card-title {
-    font-weight: 600;
-    font-size: 14px;
-    color: var(--text-primary);
-    white-space: nowrap;
-    overflow: hidden;
-    text-overflow: ellipsis;
-}
-
-.overview-card-sub {
-    font-size: 12px;
-    color: var(--text-secondary);
-    margin-top: 2px;
-    white-space: nowrap;
-    overflow: hidden;
-    text-overflow: ellipsis;
-}
-
-.mcp-status-dot {
-    width: 8px;
-    height: 8px;
-    border-radius: 50%;
-    flex-shrink: 0;
-}
-
-.mcp-status-dot.running { background: var(--success); }
-.mcp-status-dot.stopped { background: var(--text-tertiary); }
-.mcp-status-dot.error { background: var(--danger); }
-
-/* ── MCP Server Cards ── */
-
-.mcp-cards-grid {
-    display: grid;
-    grid-template-columns: repeat(auto-fill, minmax(420px, 1fr));
-    gap: 16px;
-}
-
-.mcp-card {
-    background: var(--bg-card);
-    border: 1px solid var(--border);
-    border-radius: var(--radius-lg);
-    padding: 20px;
-    transition: border-color 0.2s;
-}
-
-.mcp-card:hover {
-    border-color: var(--border-bright);
-}
-
-.mcp-card-header {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    margin-bottom: 12px;
-}
-
-.mcp-card-title {
-    display: flex;
-    align-items: center;
-    gap: 10px;
-}
-
-.mcp-card-title h3 {
-    font-family: var(--font-display);
-    font-size: 16px;
-    font-weight: 600;
-    margin: 0;
-    color: var(--text-primary);
-}
-
-.mcp-card-status {
-    font-size: 11px;
-    font-weight: 500;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    padding: 2px 8px;
-    border-radius: 10px;
-}
-
-.mcp-card-status.running {
-    color: var(--success);
-    background: var(--success-bg);
-}
-
-.mcp-card-status.stopped {
-    color: var(--text-secondary);
-    background: var(--bg-secondary);
-}
-
-.mcp-card-status.error {
-    color: var(--danger);
-    background: var(--danger-bg);
-}
-
-.mcp-card-desc {
-    font-size: 13px;
-    color: var(--text-secondary);
-    margin: 0 0 16px;
-    line-height: 1.4;
-}
-
-.mcp-card-details {
-    display: flex;
-    flex-direction: column;
-    gap: 8px;
-    margin-bottom: 16px;
-    padding: 12px;
-    background: var(--bg-secondary);
-    border-radius: var(--radius-md);
-}
-
-.mcp-detail-row {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-    font-size: 13px;
-    color: var(--text-secondary);
-}
-
-.mcp-detail-label {
-    font-size: 12px;
-    color: var(--text-secondary);
-    display: flex;
-    align-items: center;
-    gap: 6px;
-    min-width: 80px;
-    flex-shrink: 0;
-}
-
-.mcp-detail-value {
-    font-family: var(--font-mono);
-    font-size: 12px;
-    color: var(--text-primary);
-    word-break: break-all;
-}
-
-.mcp-card-tools {
-    margin-bottom: 16px;
-}
-
-.mcp-tools-list {
-    display: flex;
-    flex-wrap: wrap;
-    gap: 6px;
-    margin-top: 8px;
-}
-
-.mcp-tool-chip {
-    font-family: var(--font-mono);
-    font-size: 11px;
-    padding: 3px 10px;
-    background: var(--accent-muted);
-    color: var(--accent);
-    border-radius: 12px;
-    border: 1px solid var(--border-accent);
-}
-
-.mcp-card-token {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    gap: 12px;
-    padding: 10px 12px;
-    background: var(--bg-secondary);
-    border-radius: var(--radius-md);
-    margin-bottom: 12px;
-}
-
-.mcp-token-display {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-    min-width: 0;
-    flex: 1;
-    color: var(--text-secondary);
-}
-
-.mcp-token-code {
-    font-family: var(--font-mono);
-    font-size: 12px;
-    color: var(--text-primary);
-    word-break: break-all;
-}
-
-.mcp-token-actions {
-    display: flex;
-    gap: 4px;
-    flex-shrink: 0;
-}
-
-.mcp-card-footer {
-    font-size: 11px;
-    color: var(--text-tertiary);
-}
-
-/* ── DAST Stat Cards ── */
-
-.stat-card-item {
-    background: var(--bg-card);
-    border: 1px solid var(--border);
-    border-radius: var(--radius-lg);
-    padding: 20px;
-    text-align: center;
-}
-
-.stat-card-value {
-    font-family: var(--font-display);
-    font-size: 28px;
-    font-weight: 700;
-    color: var(--text-primary);
-    margin-bottom: 6px;
-}
-
-.stat-card-label {
-    font-size: 13px;
-    color: var(--text-secondary);
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    gap: 6px;
-}
-
-/* ── Button active state ── */
-
-.btn-active,
-.btn.btn-active {
-    background: var(--accent-muted);
-    border-color: var(--accent);
-    color: var(--accent);
-}
-
-.spinner {
-    display: inline-block;
-    width: 14px;
-    height: 14px;
-    border: 2px solid var(--border-bright);
-    border-top-color: var(--accent);
-    border-radius: 50%;
-    animation: spin 0.8s linear infinite;
-}
-
 .btn-danger {
     background: var(--danger);
     color: #fff;

compliance-dashboard/src/app.rs

@@ -38,8 +38,6 @@ pub enum Route {
         DastFindingsPage {},
         #[route("/dast/findings/:id")]
         DastFindingDetailPage { id: String },
-        #[route("/mcp-servers")]
-        McpServersPage {},
         #[route("/settings")]
         SettingsPage {},
 }

compliance-dashboard/src/components/app_shell.rs

@@ -24,13 +24,12 @@ pub fn AppShell() -> Element {
                 }
             }
         }
-        Some(Ok(_)) | Some(Err(_)) => {
+        Some(Ok(_)) => {
-            // Not authenticated — redirect to Keycloak login
+            rsx! { LoginPage {} }
-            rsx! {
-                document::Script {
-                    dangerous_inner_html: "window.location.href = '/auth';"
-                }
         }
+        Some(Err(e)) => {
+            tracing::error!("Auth check failed: {e}");
+            rsx! { LoginPage {} }
         }
         None => {
             rsx! {
@@ -41,3 +40,20 @@ pub fn AppShell() -> Element {
         }
     }
 }
+
+#[component]
+fn LoginPage() -> Element {
+    rsx! {
+        div { class: "flex items-center justify-center h-screen bg-gray-950",
+            div { class: "text-center",
+                h1 { class: "text-3xl font-bold text-white mb-4", "Compliance Scanner" }
+                p { class: "text-gray-400 mb-8", "Sign in to access the dashboard" }
+                a {
+                    href: "/auth",
+                    class: "px-6 py-3 bg-blue-600 text-white rounded-lg hover:bg-blue-500 transition-colors font-medium",
+                    "Sign in with Keycloak"
+                }
+            }
+        }
+    }
+}

compliance-dashboard/src/components/sidebar.rs

@@ -42,6 +42,16 @@ pub fn Sidebar() -> Element {
             route: Route::IssuesPage {},
             icon: rsx! { Icon { icon: BsListTask, width: 18, height: 18 } },
         },
+        NavItem {
+            label: "Code Graph",
+            route: Route::GraphIndexPage {},
+            icon: rsx! { Icon { icon: BsDiagram3, width: 18, height: 18 } },
+        },
+        NavItem {
+            label: "AI Chat",
+            route: Route::ChatIndexPage {},
+            icon: rsx! { Icon { icon: BsChatDots, width: 18, height: 18 } },
+        },
         NavItem {
             label: "DAST",
             route: Route::DastOverviewPage {},
@@ -75,6 +85,10 @@ pub fn Sidebar() -> Element {
                     {
                         let is_active = match (&current_route, &item.route) {
                             (Route::FindingDetailPage { .. }, Route::FindingsPage {}) => true,
+                            (Route::GraphIndexPage {}, Route::GraphIndexPage {}) => true,
+                            (Route::GraphExplorerPage { .. }, Route::GraphIndexPage {}) => true,
+                            (Route::ImpactAnalysisPage { .. }, Route::GraphIndexPage {}) => true,
+                            (Route::ChatPage { .. }, Route::ChatIndexPage {}) => true,
                             (Route::DastTargetsPage {}, Route::DastOverviewPage {}) => true,
                             (Route::DastFindingsPage {}, Route::DastOverviewPage {}) => true,
                             (Route::DastFindingDetailPage { .. }, Route::DastOverviewPage {}) => true,
@@ -116,9 +130,8 @@ pub fn Sidebar() -> Element {
                 let auth_info = use_context::<Signal<AuthInfo>>();
                 let info = auth_info();
                 let initials = info.name.chars().next().unwrap_or('U').to_uppercase().to_string();
-                let user_class = if collapsed() { "sidebar-user sidebar-user-collapsed" } else { "sidebar-user" };
                 rsx! {
-                    div { class: "{user_class}",
+                    div { class: "sidebar-user",
                         div { class: "user-avatar",
                             if info.avatar_url.is_empty() {
                                 span { class: "avatar-initials", "{initials}" }
@@ -127,13 +140,15 @@ pub fn Sidebar() -> Element {
                             }
                         }
                         if !collapsed() {
+                            div { class: "user-info",
                                 span { class: "user-name", "{info.name}" }
-                        }
                                 a {
                                     href: "/logout",
-                            class: if collapsed() { "logout-btn logout-btn-collapsed" } else { "logout-btn" },
+                                    class: "logout-link",
-                            title: "Sign out",
+                                    Icon { icon: BsBoxArrowRight, width: 14, height: 14 }
-                            Icon { icon: BsBoxArrowRight, width: 16, height: 16 }
+                                    " Logout"
+                                }
+                            }
                         }
                     }
                 }

compliance-dashboard/src/infrastructure/config.rs

@@ -14,8 +14,5 @@ pub fn load_config() -> Result<DashboardConfig, DashboardError> {
             .ok()
             .and_then(|p| p.parse().ok())
             .unwrap_or(8080),
-        mcp_endpoint_url: std::env::var("MCP_ENDPOINT_URL")
-            .ok()
-            .filter(|v| !v.is_empty()),
     })
 }

compliance-dashboard/src/infrastructure/database.rs

@@ -42,8 +42,4 @@ impl Database {
     pub fn tracker_issues(&self) -> Collection<TrackerIssue> {
         self.inner.collection("tracker_issues")
     }
-
-    pub fn mcp_servers(&self) -> Collection<McpServerConfig> {
-        self.inner.collection("mcp_servers")
-    }
 }

compliance-dashboard/src/infrastructure/findings.rs

@@ -10,50 +10,32 @@ pub struct FindingsListResponse {
     pub page: Option<u64>,
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct FindingsQuery {
-    pub page: u64,
-    pub severity: String,
-    pub scan_type: String,
-    pub status: String,
-    pub repo_id: String,
-    pub q: String,
-    pub sort_by: String,
-    pub sort_order: String,
-}
-
 #[server]
-pub async fn fetch_findings(query: FindingsQuery) -> Result<FindingsListResponse, ServerFnError> {
+pub async fn fetch_findings(
+    page: u64,
+    severity: String,
+    scan_type: String,
+    status: String,
+    repo_id: String,
+) -> Result<FindingsListResponse, ServerFnError> {
     let state: super::server_state::ServerState =
         dioxus_fullstack::FullstackContext::extract().await?;
 
     let mut url = format!(
-        "{}/api/v1/findings?page={}&limit=20",
+        "{}/api/v1/findings?page={page}&limit=20",
-        state.agent_api_url, query.page
+        state.agent_api_url
     );
-    if !query.severity.is_empty() {
+    if !severity.is_empty() {
-        url.push_str(&format!("&severity={}", query.severity));
+        url.push_str(&format!("&severity={severity}"));
     }
-    if !query.scan_type.is_empty() {
+    if !scan_type.is_empty() {
-        url.push_str(&format!("&scan_type={}", query.scan_type));
+        url.push_str(&format!("&scan_type={scan_type}"));
     }
-    if !query.status.is_empty() {
+    if !status.is_empty() {
-        url.push_str(&format!("&status={}", query.status));
+        url.push_str(&format!("&status={status}"));
     }
-    if !query.repo_id.is_empty() {
+    if !repo_id.is_empty() {
-        url.push_str(&format!("&repo_id={}", query.repo_id));
+        url.push_str(&format!("&repo_id={repo_id}"));
-    }
-    if !query.q.is_empty() {
-        url.push_str(&format!(
-            "&q={}",
-            url::form_urlencoded::byte_serialize(query.q.as_bytes()).collect::<String>()
-        ));
-    }
-    if !query.sort_by.is_empty() {
-        url.push_str(&format!("&sort_by={}", query.sort_by));
-    }
-    if !query.sort_order.is_empty() {
-        url.push_str(&format!("&sort_order={}", query.sort_order));
     }
 
     let resp = reqwest::get(&url)
@@ -100,40 +82,3 @@ pub async fn update_finding_status(id: String, status: String) -> Result<(), Ser
 
     Ok(())
 }
-
-#[server]
-pub async fn bulk_update_finding_status(
-    ids: Vec<String>,
-    status: String,
-) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-    let url = format!("{}/api/v1/findings/bulk-status", state.agent_api_url);
-
-    let client = reqwest::Client::new();
-    client
-        .patch(&url)
-        .json(&serde_json::json!({ "ids": ids, "status": status }))
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    Ok(())
-}
-
-#[server]
-pub async fn update_finding_feedback(id: String, feedback: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-    let url = format!("{}/api/v1/findings/{id}/feedback", state.agent_api_url);
-
-    let client = reqwest::Client::new();
-    client
-        .patch(&url)
-        .json(&serde_json::json!({ "feedback": feedback }))
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    Ok(())
-}

compliance-dashboard/src/infrastructure/mcp.rs

@@ -1,160 +0,0 @@
-use dioxus::prelude::*;
-use serde::{Deserialize, Serialize};
-
-use compliance_core::models::McpServerConfig;
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct McpServersResponse {
-    pub data: Vec<McpServerConfig>,
-}
-
-#[server]
-pub async fn fetch_mcp_servers() -> Result<McpServersResponse, ServerFnError> {
-    use mongodb::bson::doc;
-
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-
-    let mut cursor = state
-        .db
-        .mcp_servers()
-        .find(doc! {})
-        .sort(doc! { "created_at": -1 })
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    let mut data = Vec::new();
-    while cursor
-        .advance()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?
-    {
-        let server = cursor
-            .deserialize_current()
-            .map_err(|e| ServerFnError::new(e.to_string()))?;
-        data.push(server);
-    }
-
-    Ok(McpServersResponse { data })
-}
-
-#[server]
-pub async fn add_mcp_server(
-    name: String,
-    endpoint_url: String,
-    transport: String,
-    port: String,
-    description: String,
-    mongodb_uri: String,
-    mongodb_database: String,
-) -> Result<(), ServerFnError> {
-    use chrono::Utc;
-    use compliance_core::models::{McpServerStatus, McpTransport};
-
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-
-    let transport = match transport.as_str() {
-        "http" => McpTransport::Http,
-        _ => McpTransport::Stdio,
-    };
-
-    let port_num: Option<u16> = port.parse().ok();
-
-    // Generate a random access token
-    let token = format!("mcp_{}", uuid::Uuid::new_v4().to_string().replace('-', ""));
-
-    let all_tools = vec![
-        "list_findings".to_string(),
-        "get_finding".to_string(),
-        "findings_summary".to_string(),
-        "list_sbom_packages".to_string(),
-        "sbom_vuln_report".to_string(),
-        "list_dast_findings".to_string(),
-        "dast_scan_summary".to_string(),
-    ];
-
-    let now = Utc::now();
-    let server = McpServerConfig {
-        id: None,
-        name,
-        endpoint_url,
-        transport,
-        port: port_num,
-        status: McpServerStatus::Stopped,
-        access_token: token,
-        tools_enabled: all_tools,
-        description: if description.is_empty() {
-            None
-        } else {
-            Some(description)
-        },
-        mongodb_uri: if mongodb_uri.is_empty() {
-            None
-        } else {
-            Some(mongodb_uri)
-        },
-        mongodb_database: if mongodb_database.is_empty() {
-            None
-        } else {
-            Some(mongodb_database)
-        },
-        created_at: now,
-        updated_at: now,
-    };
-
-    state
-        .db
-        .mcp_servers()
-        .insert_one(server)
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    Ok(())
-}
-
-#[server]
-pub async fn delete_mcp_server(server_id: String) -> Result<(), ServerFnError> {
-    use mongodb::bson::doc;
-
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-
-    let oid = bson::oid::ObjectId::parse_str(&server_id)
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    state
-        .db
-        .mcp_servers()
-        .delete_one(doc! { "_id": oid })
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    Ok(())
-}
-
-#[server]
-pub async fn regenerate_mcp_token(server_id: String) -> Result<String, ServerFnError> {
-    use chrono::Utc;
-    use mongodb::bson::doc;
-
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-
-    let oid = bson::oid::ObjectId::parse_str(&server_id)
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    let new_token = format!("mcp_{}", uuid::Uuid::new_v4().to_string().replace('-', ""));
-
-    state
-        .db
-        .mcp_servers()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$set": { "access_token": &new_token, "updated_at": Utc::now().to_rfc3339() } },
-        )
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    Ok(new_token)
-}

compliance-dashboard/src/infrastructure/mod.rs

@@ -6,7 +6,6 @@ pub mod dast;
 pub mod findings;
 pub mod graph;
 pub mod issues;
-pub mod mcp;
 pub mod repositories;
 pub mod sbom;
 pub mod scans;

compliance-dashboard/src/infrastructure/repositories.rs

@@ -34,29 +34,19 @@ pub async fn add_repository(
     name: String,
     git_url: String,
     default_branch: String,
-    auth_token: Option<String>,
-    auth_username: Option<String>,
 ) -> Result<(), ServerFnError> {
     let state: super::server_state::ServerState =
         dioxus_fullstack::FullstackContext::extract().await?;
     let url = format!("{}/api/v1/repositories", state.agent_api_url);
 
-    let mut body = serde_json::json!({
-        "name": name,
-        "git_url": git_url,
-        "default_branch": default_branch,
-    });
-    if let Some(token) = auth_token.filter(|t| !t.is_empty()) {
-        body["auth_token"] = serde_json::Value::String(token);
-    }
-    if let Some(username) = auth_username.filter(|u| !u.is_empty()) {
-        body["auth_username"] = serde_json::Value::String(username);
-    }
-
     let client = reqwest::Client::new();
     let resp = client
         .post(&url)
-        .json(&body)
+        .json(&serde_json::json!({
+            "name": name,
+            "git_url": git_url,
+            "default_branch": default_branch,
+        }))
         .send()
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
@@ -71,32 +61,6 @@ pub async fn add_repository(
     Ok(())
 }
 
-#[server]
-pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-    let url = format!("{}/api/v1/settings/ssh-public-key", state.agent_api_url);
-
-    let resp = reqwest::get(&url)
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    if !resp.status().is_success() {
-        return Err(ServerFnError::new("SSH key not available".to_string()));
-    }
-
-    let body: serde_json::Value = resp
-        .json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    Ok(body
-        .get("public_key")
-        .and_then(|v| v.as_str())
-        .unwrap_or("")
-        .to_string())
-}
-
 #[server]
 pub async fn delete_repository(repo_id: String) -> Result<(), ServerFnError> {
     let state: super::server_state::ServerState =
@@ -135,32 +99,3 @@ pub async fn trigger_repo_scan(repo_id: String) -> Result<(), ServerFnError> {
 
     Ok(())
 }
-
-/// Check if a repository has any running scans
-#[server]
-pub async fn check_repo_scanning(repo_id: String) -> Result<bool, ServerFnError> {
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-    let url = format!("{}/api/v1/scan-runs?page=1&limit=1", state.agent_api_url);
-
-    let resp = reqwest::get(&url)
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    let body: serde_json::Value = resp
-        .json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    // Check if the most recent scan for this repo is still running
-    if let Some(scans) = body.get("data").and_then(|d| d.as_array()) {
-        for scan in scans {
-            let scan_repo = scan.get("repo_id").and_then(|v| v.as_str()).unwrap_or("");
-            let status = scan.get("status").and_then(|v| v.as_str()).unwrap_or("");
-            if scan_repo == repo_id && status == "running" {
-                return Ok(true);
-            }
-        }
-    }
-
-    Ok(false)
-}

compliance-dashboard/src/infrastructure/server.rs

@@ -4,9 +4,6 @@ use dioxus::prelude::*;
 use time::Duration;
 use tower_sessions::{cookie::Key, MemoryStore, SessionManagerLayer};
 
-use compliance_core::models::{McpServerConfig, McpServerStatus, McpTransport};
-use mongodb::bson::doc;
-
 use super::config;
 use super::database::Database;
 use super::error::DashboardError;
@@ -25,9 +22,6 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
                 KeycloakConfig::from_env().map(|kc| &*Box::leak(Box::new(kc)));
             let db = Database::connect(&config.mongodb_uri, &config.mongodb_database).await?;
 
-            // Seed default MCP server configs
-            seed_default_mcp_servers(&db, config.mcp_endpoint_url.as_deref()).await;
-
             if let Some(kc) = keycloak {
                 tracing::info!("Keycloak configured for realm '{}'", kc.realm);
             } else {
@@ -51,8 +45,7 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
                 .with_expiry(tower_sessions::Expiry::OnInactivity(Duration::hours(24)))
                 .with_signed(key);
 
-            let port = dioxus_cli_config::server_port().unwrap_or(8080);
+            let addr = dioxus_cli_config::fullstack_address_or_localhost();
-            let addr = std::net::SocketAddr::from(([0, 0, 0, 0], port));
             let listener = tokio::net::TcpListener::bind(addr)
                 .await
                 .map_err(|e| DashboardError::Other(format!("Failed to bind: {e}")))?;
@@ -76,66 +69,3 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
             Ok(())
         })
 }
-
-/// Seed three default MCP server configs (Findings, SBOM, DAST) if they don't already exist.
-async fn seed_default_mcp_servers(db: &Database, mcp_endpoint_url: Option<&str>) {
-    let endpoint = mcp_endpoint_url.unwrap_or("http://localhost:8090");
-
-    let defaults = [
-        (
-            "Findings MCP",
-            "Exposes security findings, triage data, and finding summaries to LLM agents",
-            vec!["list_findings", "get_finding", "findings_summary"],
-        ),
-        (
-            "SBOM MCP",
-            "Exposes software bill of materials and vulnerability reports to LLM agents",
-            vec!["list_sbom_packages", "sbom_vuln_report"],
-        ),
-        (
-            "DAST MCP",
-            "Exposes DAST scan findings and scan summaries to LLM agents",
-            vec!["list_dast_findings", "dast_scan_summary"],
-        ),
-    ];
-
-    let collection = db.mcp_servers();
-
-    for (name, description, tools) in defaults {
-        // Skip if already exists
-        let exists = collection
-            .find_one(doc! { "name": name })
-            .await
-            .ok()
-            .flatten()
-            .is_some();
-
-        if exists {
-            continue;
-        }
-
-        let now = chrono::Utc::now();
-        let token = format!("mcp_{}", uuid::Uuid::new_v4().to_string().replace('-', ""));
-
-        let server = McpServerConfig {
-            id: None,
-            name: name.to_string(),
-            endpoint_url: format!("{endpoint}/mcp"),
-            transport: McpTransport::Http,
-            port: Some(8090),
-            status: McpServerStatus::Stopped,
-            access_token: token,
-            tools_enabled: tools.into_iter().map(|s| s.to_string()).collect(),
-            description: Some(description.to_string()),
-            mongodb_uri: None,
-            mongodb_database: None,
-            created_at: now,
-            updated_at: now,
-        };
-
-        match collection.insert_one(server).await {
-            Ok(_) => tracing::info!("Seeded default MCP server: {name}"),
-            Err(e) => tracing::warn!("Failed to seed MCP server '{name}': {e}"),
-        }
-    }
-}

compliance-dashboard/src/pages/chat.rs

@@ -1,6 +1,4 @@
 use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
 
 use crate::components::page_header::PageHeader;
 use crate::infrastructure::chat::{
@@ -181,15 +179,6 @@ pub fn ChatPage(repo_id: String) -> Element {
     let mut do_send_click = do_send.clone();
 
     rsx! {
-        div { class: "back-nav",
-            button {
-                class: "btn btn-ghost btn-back",
-                onclick: move |_| { navigator().go_back(); },
-                Icon { icon: BsArrowLeft, width: 16, height: 16 }
-                "Back"
-            }
-        }
-
         PageHeader { title: "AI Chat" }
 
         // Embedding status banner

compliance-dashboard/src/pages/dast_finding_detail.rs

@@ -1,6 +1,4 @@
 use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
 
 use crate::components::page_header::PageHeader;
 use crate::components::severity_badge::SeverityBadge;
@@ -14,15 +12,6 @@ pub fn DastFindingDetailPage(id: String) -> Element {
     });
 
     rsx! {
-        div { class: "back-nav",
-            button {
-                class: "btn btn-ghost btn-back",
-                onclick: move |_| { navigator().go_back(); },
-                Icon { icon: BsArrowLeft, width: 16, height: 16 }
-                "Back"
-            }
-        }
-
         PageHeader {
             title: "DAST Finding Detail",
             description: "Full evidence and details for a dynamic security finding",

compliance-dashboard/src/pages/dast_findings.rs

@@ -1,6 +1,4 @@
 use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
 
 use crate::app::Route;
 use crate::components::page_header::PageHeader;
@@ -12,15 +10,6 @@ pub fn DastFindingsPage() -> Element {
     let findings = use_resource(|| async { fetch_dast_findings().await.ok() });
 
     rsx! {
-        div { class: "back-nav",
-            button {
-                class: "btn btn-ghost btn-back",
-                onclick: move |_| { navigator().go_back(); },
-                Icon { icon: BsArrowLeft, width: 16, height: 16 }
-                "Back"
-            }
-        }
-
         PageHeader {
             title: "DAST Findings",
             description: "Vulnerabilities discovered through dynamic application security testing",

compliance-dashboard/src/pages/dast_overview.rs

@@ -1,6 +1,4 @@
 use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
 
 use crate::app::Route;
 use crate::components::page_header::PageHeader;
@@ -17,9 +15,9 @@ pub fn DastOverviewPage() -> Element {
             description: "Dynamic Application Security Testing — scan running applications for vulnerabilities",
         }
 
-        div { class: "stat-cards", style: "margin-bottom: 24px;",
+        div { class: "grid grid-cols-3 gap-4 mb-6",
-            div { class: "stat-card-item",
+            div { class: "stat-card",
-                div { class: "stat-card-value",
+                div { class: "stat-value",
                     match &*scan_runs.read() {
                         Some(Some(data)) => {
                             let count = data.total.unwrap_or(0);
@@ -28,13 +26,10 @@ pub fn DastOverviewPage() -> Element {
                         _ => rsx! { "—" },
                     }
                 }
-                div { class: "stat-card-label",
+                div { class: "stat-label", "Total Scans" }
-                    Icon { icon: BsPlayCircle, width: 14, height: 14 }
-                    " Total Scans"
             }
-            }
+            div { class: "stat-card",
-            div { class: "stat-card-item",
+                div { class: "stat-value",
-                div { class: "stat-card-value",
                     match &*findings.read() {
                         Some(Some(data)) => {
                             let count = data.total.unwrap_or(0);
@@ -43,37 +38,29 @@ pub fn DastOverviewPage() -> Element {
                         _ => rsx! { "—" },
                     }
                 }
-                div { class: "stat-card-label",
+                div { class: "stat-label", "DAST Findings" }
-                    Icon { icon: BsShieldExclamation, width: 14, height: 14 }
-                    " DAST Findings"
-                }
-            }
-            div { class: "stat-card-item",
-                div { class: "stat-card-value", "—" }
-                div { class: "stat-card-label",
-                    Icon { icon: BsBullseye, width: 14, height: 14 }
-                    " Active Targets"
             }
+            div { class: "stat-card",
+                div { class: "stat-value", "—" }
+                div { class: "stat-label", "Active Targets" }
             }
         }
 
-        div { style: "display: flex; gap: 12px; margin-bottom: 24px;",
+        div { class: "flex gap-4 mb-4",
             Link {
                 to: Route::DastTargetsPage {},
                 class: "btn btn-primary",
-                Icon { icon: BsBullseye, width: 14, height: 14 }
+                "Manage Targets"
-                " Manage Targets"
             }
             Link {
                 to: Route::DastFindingsPage {},
                 class: "btn btn-secondary",
-                Icon { icon: BsShieldExclamation, width: 14, height: 14 }
+                "View Findings"
-                " View Findings"
             }
         }
 
         div { class: "card",
-            div { class: "card-header", "Recent Scan Runs" }
+            h3 { "Recent Scan Runs" }
             match &*scan_runs.read() {
                 Some(Some(data)) => {
                     let runs = &data.data;

compliance-dashboard/src/pages/dast_targets.rs

@@ -1,6 +1,4 @@
 use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
 
 use crate::components::page_header::PageHeader;
 use crate::components::toast::{ToastType, Toasts};
@@ -16,15 +14,6 @@ pub fn DastTargetsPage() -> Element {
     let mut new_url = use_signal(String::new);
 
     rsx! {
-        div { class: "back-nav",
-            button {
-                class: "btn btn-ghost btn-back",
-                onclick: move |_| { navigator().go_back(); },
-                Icon { icon: BsArrowLeft, width: 16, height: 16 }
-                "Back"
-            }
-        }
-
         PageHeader {
             title: "DAST Targets",
             description: "Configure target applications for dynamic security testing",

compliance-dashboard/src/pages/finding_detail.rs

@@ -1,6 +1,4 @@
 use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
 
 use crate::components::code_snippet::CodeSnippet;
 use crate::components::page_header::PageHeader;
@@ -10,7 +8,7 @@ use crate::components::severity_badge::SeverityBadge;
 pub fn FindingDetailPage(id: String) -> Element {
     let finding_id = id.clone();
 
-    let mut finding = use_resource(move || {
+    let finding = use_resource(move || {
         let fid = finding_id.clone();
         async move {
             crate::infrastructure::findings::fetch_finding_detail(fid)
@@ -24,18 +22,7 @@ pub fn FindingDetailPage(id: String) -> Element {
     match snapshot {
         Some(Some(f)) => {
             let finding_id_for_status = id.clone();
-            let finding_id_for_feedback = id.clone();
-            let existing_feedback = f.developer_feedback.clone().unwrap_or_default();
             rsx! {
-                div { class: "back-nav",
-                    button {
-                        class: "btn btn-ghost btn-back",
-                        onclick: move |_| { navigator().go_back(); },
-                        Icon { icon: BsArrowLeft, width: 16, height: 16 }
-                        "Back"
-                    }
-                }
-
                 PageHeader {
                     title: f.title.clone(),
                     description: format!("{} | {} | {}", f.scanner, f.scan_type, f.status),
@@ -52,9 +39,6 @@ pub fn FindingDetailPage(id: String) -> Element {
                     if let Some(score) = f.cvss_score {
                         span { class: "badge badge-medium", "CVSS: {score}" }
                     }
-                    if let Some(confidence) = f.confidence {
-                        span { class: "badge badge-info", "Confidence: {confidence:.1}" }
-                    }
                 }
 
                 div { class: "card",
@@ -62,19 +46,6 @@ pub fn FindingDetailPage(id: String) -> Element {
                     p { "{f.description}" }
                 }
 
-                if let Some(rationale) = &f.triage_rationale {
-                    div { class: "card",
-                        div { class: "card-header", "Triage Rationale" }
-                        div {
-                            style: "display: flex; align-items: center; gap: 8px; margin-bottom: 8px;",
-                            if let Some(action) = &f.triage_action {
-                                span { class: "badge badge-info", "{action}" }
-                            }
-                        }
-                        p { style: "color: var(--text-secondary); font-size: 14px;", "{rationale}" }
-                    }
-                }
-
                 if let Some(code) = &f.code_snippet {
                     div { class: "card",
                         div { class: "card-header", "Code Evidence" }
@@ -119,60 +90,23 @@ pub fn FindingDetailPage(id: String) -> Element {
                             {
                                 let status_str = status.to_string();
                                 let id_clone = finding_id_for_status.clone();
-                                let label = match status {
-                                    "open" => "Open",
-                                    "triaged" => "Triaged",
-                                    "resolved" => "Resolved",
-                                    "false_positive" => "False Positive",
-                                    "ignored" => "Ignored",
-                                    _ => status,
-                                };
                                 rsx! {
                                     button {
                                         class: "btn btn-ghost",
-                                        title: "{label}",
                                         onclick: move |_| {
                                             let s = status_str.clone();
                                             let id = id_clone.clone();
                                             spawn(async move {
                                                 let _ = crate::infrastructure::findings::update_finding_status(id, s).await;
                                             });
-                                            finding.restart();
                                         },
-                                        match status {
+                                        "{status}"
-                                            "open" => rsx! { Icon { icon: BsCircle, width: 14, height: 14 } },
-                                            "triaged" => rsx! { Icon { icon: BsEye, width: 14, height: 14 } },
-                                            "resolved" => rsx! { Icon { icon: BsCheckCircle, width: 14, height: 14 } },
-                                            "false_positive" => rsx! { Icon { icon: BsXCircle, width: 14, height: 14 } },
-                                            "ignored" => rsx! { Icon { icon: BsDashCircle, width: 14, height: 14 } },
-                                            _ => rsx! {},
-                                        }
-                                        " {label}"
                                     }
                                 }
                             }
                         }
                     }
                 }
-
-                div { class: "card",
-                    div { class: "card-header", "Developer Feedback" }
-                    p {
-                        style: "font-size: 13px; color: var(--text-secondary); margin-bottom: 8px;",
-                        "Share your assessment of this finding (e.g. false positive, actionable, needs context)"
-                    }
-                    textarea {
-                        style: "width: 100%; min-height: 80px; background: var(--bg-primary); border: 1px solid var(--border); border-radius: 8px; padding: 10px 14px; color: var(--text-primary); font-size: 14px; resize: vertical;",
-                        value: "{existing_feedback}",
-                        oninput: move |e| {
-                            let feedback = e.value();
-                            let id = finding_id_for_feedback.clone();
-                            spawn(async move {
-                                let _ = crate::infrastructure::findings::update_finding_feedback(id, feedback).await;
-                            });
-                        },
-                    }
-                }
             }
         }
         Some(None) => rsx! {

compliance-dashboard/src/pages/findings.rs

@@ -1,6 +1,4 @@
 use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
 
 use crate::app::Route;
 use crate::components::page_header::PageHeader;
@@ -14,10 +12,6 @@ pub fn FindingsPage() -> Element {
     let mut type_filter = use_signal(String::new);
     let mut status_filter = use_signal(String::new);
     let mut repo_filter = use_signal(String::new);
-    let mut search_query = use_signal(String::new);
-    let mut sort_by = use_signal(|| "created_at".to_string());
-    let mut sort_order = use_signal(|| "desc".to_string());
-    let mut selected_ids = use_signal(Vec::<String>::new);
 
     let repos = use_resource(|| async {
         crate::infrastructure::repositories::fetch_repositories(1)
@@ -25,52 +19,19 @@ pub fn FindingsPage() -> Element {
             .ok()
     });
 
-    let mut findings = use_resource(move || {
+    let findings = use_resource(move || {
-        let query = crate::infrastructure::findings::FindingsQuery {
+        let p = page();
-            page: page(),
+        let sev = severity_filter();
-            severity: severity_filter(),
+        let typ = type_filter();
-            scan_type: type_filter(),
+        let stat = status_filter();
-            status: status_filter(),
+        let repo = repo_filter();
-            repo_id: repo_filter(),
-            q: search_query(),
-            sort_by: sort_by(),
-            sort_order: sort_order(),
-        };
         async move {
-            crate::infrastructure::findings::fetch_findings(query)
+            crate::infrastructure::findings::fetch_findings(p, sev, typ, stat, repo)
                 .await
                 .ok()
         }
     });
 
-    let toggle_sort = move |field: &'static str| {
-        move |_: MouseEvent| {
-            if sort_by() == field {
-                sort_order.set(if sort_order() == "asc" {
-                    "desc".to_string()
-                } else {
-                    "asc".to_string()
-                });
-            } else {
-                sort_by.set(field.to_string());
-                sort_order.set("desc".to_string());
-            }
-            page.set(1);
-        }
-    };
-
-    let sort_indicator = move |field: &str| -> String {
-        if sort_by() == field {
-            if sort_order() == "asc" {
-                " \u{25B2}".to_string()
-            } else {
-                " \u{25BC}".to_string()
-            }
-        } else {
-            String::new()
-        }
-    };
-
     rsx! {
         PageHeader {
             title: "Findings",
@@ -78,12 +39,6 @@ pub fn FindingsPage() -> Element {
         }
 
         div { class: "filter-bar",
-            input {
-                r#type: "text",
-                placeholder: "Search findings...",
-                style: "min-width: 200px;",
-                oninput: move |e| { search_query.set(e.value()); page.set(1); },
-            }
             select {
                 onchange: move |e| { repo_filter.set(e.value()); page.set(1); },
                 option { value: "", "All Repositories" }
@@ -121,9 +76,6 @@ pub fn FindingsPage() -> Element {
                 option { value: "cve", "CVE" }
                 option { value: "gdpr", "GDPR" }
                 option { value: "oauth", "OAuth" }
-                option { value: "secret_detection", "Secrets" }
-                option { value: "lint", "Lint" }
-                option { value: "code_review", "Code Review" }
             }
             select {
                 onchange: move |e| { status_filter.set(e.value()); page.set(1); },
@@ -136,132 +88,29 @@ pub fn FindingsPage() -> Element {
             }
         }
 
-        // Bulk action bar
-        if !selected_ids().is_empty() {
-            div {
-                class: "card",
-                style: "display: flex; align-items: center; gap: 12px; padding: 12px 16px; margin-bottom: 16px; background: rgba(56, 189, 248, 0.08); border-color: rgba(56, 189, 248, 0.2);",
-                span {
-                    style: "font-size: 14px; color: var(--text-secondary);",
-                    "{selected_ids().len()} selected"
-                }
-                for status in ["triaged", "resolved", "false_positive", "ignored"] {
-                    {
-                        let status_str = status.to_string();
-                        let label = match status {
-                            "false_positive" => "False Positive",
-                            other => {
-                                // Capitalize first letter
-                                let mut s = other.to_string();
-                                if let Some(c) = s.get_mut(0..1) { c.make_ascii_uppercase(); }
-                                // Leak to get a &str that lives long enough - this is fine for static-ish UI strings
-                                &*Box::leak(s.into_boxed_str())
-                            }
-                        };
-                        rsx! {
-                            button {
-                                class: "btn btn-sm btn-ghost",
-                                title: "Mark {label}",
-                                onclick: move |_| {
-                                    let ids = selected_ids();
-                                    let s = status_str.clone();
-                                    spawn(async move {
-                                        let _ = crate::infrastructure::findings::bulk_update_finding_status(ids, s).await;
-                                        findings.restart();
-                                    });
-                                    selected_ids.set(Vec::new());
-                                },
-                                match status {
-                                    "triaged" => rsx! { Icon { icon: BsEye, width: 14, height: 14 } },
-                                    "resolved" => rsx! { Icon { icon: BsCheckCircle, width: 14, height: 14 } },
-                                    "false_positive" => rsx! { Icon { icon: BsXCircle, width: 14, height: 14 } },
-                                    "ignored" => rsx! { Icon { icon: BsDashCircle, width: 14, height: 14 } },
-                                    _ => rsx! {},
-                                }
-                                " {label}"
-                            }
-                        }
-                    }
-                }
-                button {
-                    class: "btn btn-sm btn-ghost",
-                    onclick: move |_| { selected_ids.set(Vec::new()); },
-                    "Clear"
-                }
-            }
-        }
-
         match &*findings.read() {
             Some(Some(resp)) => {
                 let total_pages = resp.total.unwrap_or(0).div_ceil(20).max(1);
-                let all_ids: Vec<String> = resp.data.iter().filter_map(|f| f.id.as_ref().map(|id| id.to_hex())).collect();
                 rsx! {
                     div { class: "card",
                         div { class: "table-wrapper",
                             table {
                                 thead {
                                     tr {
-                                        th {
+                                        th { "Severity" }
-                                            style: "width: 40px;",
+                                        th { "Title" }
-                                            input {
+                                        th { "Type" }
-                                                r#type: "checkbox",
-                                                checked: !all_ids.is_empty() && selected_ids().len() == all_ids.len(),
-                                                onchange: move |_| {
-                                                    if selected_ids().len() == all_ids.len() {
-                                                        selected_ids.set(Vec::new());
-                                                    } else {
-                                                        selected_ids.set(all_ids.clone());
-                                                    }
-                                                },
-                                            }
-                                        }
-                                        th {
-                                            style: "cursor: pointer; user-select: none;",
-                                            onclick: toggle_sort("severity"),
-                                            "Severity{sort_indicator(\"severity\")}"
-                                        }
-                                        th {
-                                            style: "cursor: pointer; user-select: none;",
-                                            onclick: toggle_sort("title"),
-                                            "Title{sort_indicator(\"title\")}"
-                                        }
-                                        th {
-                                            style: "cursor: pointer; user-select: none;",
-                                            onclick: toggle_sort("scan_type"),
-                                            "Type{sort_indicator(\"scan_type\")}"
-                                        }
                                         th { "Scanner" }
                                         th { "File" }
-                                        th {
+                                        th { "Status" }
-                                            style: "cursor: pointer; user-select: none;",
-                                            onclick: toggle_sort("status"),
-                                            "Status{sort_indicator(\"status\")}"
-                                        }
                                     }
                                 }
                                 tbody {
                                     for finding in &resp.data {
                                         {
                                             let id = finding.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                            let id_for_check = id.clone();
-                                            let is_selected = selected_ids().contains(&id);
                                             rsx! {
                                                 tr {
-                                                    td {
-                                                        input {
-                                                            r#type: "checkbox",
-                                                            checked: is_selected,
-                                                            onchange: move |_| {
-                                                                let mut ids = selected_ids();
-                                                                if ids.contains(&id_for_check) {
-                                                                    ids.retain(|i| i != &id_for_check);
-                                                                } else {
-                                                                    ids.push(id_for_check.clone());
-                                                                }
-                                                                selected_ids.set(ids);
-                                                            },
-                                                        }
-                                                    }
                                                     td { SeverityBadge { severity: finding.severity.to_string() } }
                                                     td {
                                                         Link {
@@ -271,29 +120,13 @@ pub fn FindingsPage() -> Element {
                                                         }
                                                     }
                                                     td { "{finding.scan_type}" }
-                                                    td {
+                                                    td { "{finding.scanner}" }
-                                                        Icon { icon: BsCpu, width: 14, height: 14 }
-                                                        " {finding.scanner}"
-                                                    }
                                                     td {
                                                         style: "font-family: monospace; font-size: 12px;",
-                                                        Icon { icon: BsFileEarmarkCode, width: 14, height: 14 }
+                                                        "{finding.file_path.as_deref().unwrap_or(\"-\")}"
-                                                        " {finding.file_path.as_deref().unwrap_or(\"-\")}"
                                                     }
                                                     td {
-                                                        span { class: "badge badge-info",
+                                                        span { class: "badge badge-info", "{finding.status}" }
-                                                            {
-                                                                use compliance_core::models::FindingStatus;
-                                                                match &finding.status {
-                                                                    FindingStatus::Open => rsx! { Icon { icon: BsCircle, width: 12, height: 12 } },
-                                                                    FindingStatus::Triaged => rsx! { Icon { icon: BsEye, width: 12, height: 12 } },
-                                                                    FindingStatus::Resolved => rsx! { Icon { icon: BsCheckCircle, width: 12, height: 12 } },
-                                                                    FindingStatus::FalsePositive => rsx! { Icon { icon: BsXCircle, width: 12, height: 12 } },
-                                                                    FindingStatus::Ignored => rsx! { Icon { icon: BsDashCircle, width: 12, height: 12 } },
-                                                                }
-                                                            }
-                                                            " {finding.status}"
-                                                        }
                                                     }
                                                 }
                                             }

compliance-dashboard/src/pages/graph_explorer.rs

@@ -1,6 +1,4 @@
 use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
 
 use crate::components::code_inspector::CodeInspector;
 use crate::components::file_tree::{build_file_tree, FileTree};
@@ -10,36 +8,6 @@ use crate::infrastructure::graph::{fetch_graph, search_nodes, trigger_graph_buil
 
 #[component]
 pub fn GraphExplorerPage(repo_id: String) -> Element {
-    rsx! {
-        div { class: "back-nav",
-            button {
-                class: "btn btn-ghost btn-back",
-                onclick: move |_| { navigator().go_back(); },
-                Icon { icon: BsArrowLeft, width: 16, height: 16 }
-                "Back"
-            }
-        }
-
-        PageHeader {
-            title: "Code Knowledge Graph",
-            description: "Interactive visualization of code structure and relationships",
-        }
-
-        GraphExplorerBody { repo_id: repo_id }
-    }
-}
-
-/// Inline variant without back button and page header — for embedding in other pages.
-#[component]
-pub fn GraphExplorerInline(repo_id: String) -> Element {
-    rsx! {
-        GraphExplorerBody { repo_id: repo_id }
-    }
-}
-
-/// Shared graph explorer body used by both the full page and inline variants.
-#[component]
-fn GraphExplorerBody(repo_id: String) -> Element {
     let repo_id_clone = repo_id.clone();
     let mut graph_data = use_resource(move || {
         let rid = repo_id_clone.clone();
@@ -53,15 +21,22 @@ fn GraphExplorerBody(repo_id: String) -> Element {
 
     let mut building = use_signal(|| false);
     let mut toasts = use_context::<Toasts>();
+
+    // Selected node state
     let mut selected_node = use_signal(|| Option::<serde_json::Value>::None);
     let mut inspector_open = use_signal(|| false);
+
+    // Search state
     let mut search_query = use_signal(String::new);
     let mut search_results = use_signal(Vec::<serde_json::Value>::new);
     let mut file_filter = use_signal(String::new);
+
+    // Store serialized graph JSON in signals so use_effect can react to them
     let mut nodes_json = use_signal(String::new);
     let mut edges_json = use_signal(String::new);
     let mut graph_ready = use_signal(|| false);
 
+    // When resource resolves, serialize the data into signals
     let graph_data_read = graph_data.read();
     if let Some(Some(data)) = &*graph_data_read {
         if !data.data.nodes.is_empty() && !graph_ready() {
@@ -73,6 +48,7 @@ fn GraphExplorerBody(repo_id: String) -> Element {
         }
     }
 
+    // Derive stats and file tree
     let (node_count, edge_count, community_count, languages, file_tree_data) =
         if let Some(Some(data)) = &*graph_data_read {
             let build = data.data.build.clone().unwrap_or_default();
@@ -104,8 +80,11 @@ fn GraphExplorerBody(repo_id: String) -> Element {
         };
 
     let has_graph_data = matches!(&*graph_data_read, Some(Some(d)) if !d.data.nodes.is_empty());
+
+    // Drop the read guard before rendering
     drop(graph_data_read);
 
+    // use_effect runs AFTER DOM commit — this is when #graph-canvas exists
     use_effect(move || {
         let ready = graph_ready();
         if !ready {
@@ -117,6 +96,7 @@ fn GraphExplorerBody(repo_id: String) -> Element {
             return;
         }
         spawn(async move {
+            // Register the click callback + load graph with a small delay for DOM paint
             let js = format!(
                 r#"
                 window.__onNodeClick = function(nodeJson) {{
@@ -129,6 +109,8 @@ fn GraphExplorerBody(repo_id: String) -> Element {
                 setTimeout(function() {{
                     if (window.__loadGraph) {{
                         window.__loadGraph({nj}, {ej});
+                    }} else {{
+                        console.error('[graph-viz] __loadGraph not found — vis-network may not be loaded');
                     }}
                 }}, 300);
                 "#
@@ -137,6 +119,7 @@ fn GraphExplorerBody(repo_id: String) -> Element {
         });
     });
 
+    // Extract selected node fields
     let sel = selected_node();
     let sel_file = sel
         .as_ref()
@@ -163,6 +146,11 @@ fn GraphExplorerBody(repo_id: String) -> Element {
         .unwrap_or(0) as u32;
 
     rsx! {
+        PageHeader {
+            title: "Code Knowledge Graph",
+            description: "Interactive visualization of code structure and relationships",
+        }
+
         if repo_id.is_empty() {
             div { class: "card",
                 p { "Select a repository to view its code graph." }

compliance-dashboard/src/pages/impact_analysis.rs

@@ -1,6 +1,4 @@
 use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
 
 use crate::components::page_header::PageHeader;
 use crate::infrastructure::graph::fetch_impact;
@@ -14,15 +12,6 @@ pub fn ImpactAnalysisPage(repo_id: String, finding_id: String) -> Element {
     });
 
     rsx! {
-        div { class: "back-nav",
-            button {
-                class: "btn btn-ghost btn-back",
-                onclick: move |_| { navigator().go_back(); },
-                Icon { icon: BsArrowLeft, width: 16, height: 16 }
-                "Back"
-            }
-        }
-
         PageHeader {
             title: "Impact Analysis",
             description: "Blast radius and affected entry points for a security finding",

compliance-dashboard/src/pages/mcp_servers.rs

@@ -1,351 +0,0 @@
-use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
-
-use crate::components::page_header::PageHeader;
-use crate::components::toast::{ToastType, Toasts};
-use crate::infrastructure::mcp::{
-    add_mcp_server, delete_mcp_server, fetch_mcp_servers, regenerate_mcp_token,
-};
-
-#[component]
-pub fn McpServersPage() -> Element {
-    let mut servers = use_resource(|| async { fetch_mcp_servers().await.ok() });
-    let mut toasts = use_context::<Toasts>();
-
-    let mut show_form = use_signal(|| false);
-    let mut new_name = use_signal(String::new);
-    let mut new_endpoint = use_signal(String::new);
-    let mut new_transport = use_signal(|| "http".to_string());
-    let mut new_port = use_signal(|| "8090".to_string());
-    let mut new_description = use_signal(String::new);
-    let mut new_mongo_uri = use_signal(String::new);
-    let mut new_mongo_db = use_signal(String::new);
-
-    // Track which server's token is visible
-    let mut visible_token: Signal<Option<String>> = use_signal(|| None);
-    // Track which server is pending delete confirmation
-    let mut confirm_delete: Signal<Option<(String, String)>> = use_signal(|| None);
-
-    rsx! {
-        div { class: "back-nav",
-            button {
-                class: "btn btn-ghost btn-back",
-                onclick: move |_| { navigator().go_back(); },
-                Icon { icon: BsArrowLeft, width: 16, height: 16 }
-                "Back"
-            }
-        }
-
-        PageHeader {
-            title: "MCP Servers",
-            description: "Manage Model Context Protocol servers for LLM integrations",
-        }
-
-        div { class: "mb-4",
-            button {
-                class: "btn btn-primary",
-                onclick: move |_| show_form.set(!show_form()),
-                if show_form() { "Cancel" } else { "Register Server" }
-            }
-        }
-
-        if show_form() {
-            div { class: "card mb-4",
-                div { class: "card-header", "Register MCP Server" }
-                div { class: "mcp-form-grid",
-                    div { class: "form-group",
-                        label { "Name" }
-                        input {
-                            r#type: "text",
-                            placeholder: "Production MCP",
-                            value: "{new_name}",
-                            oninput: move |e| new_name.set(e.value()),
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Endpoint URL" }
-                        input {
-                            r#type: "text",
-                            placeholder: "https://mcp.example.com/mcp",
-                            value: "{new_endpoint}",
-                            oninput: move |e| new_endpoint.set(e.value()),
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Transport" }
-                        select {
-                            value: "{new_transport}",
-                            oninput: move |e| new_transport.set(e.value()),
-                            option { value: "http", "HTTP (Streamable)" }
-                            option { value: "stdio", "Stdio" }
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Port" }
-                        input {
-                            r#type: "text",
-                            placeholder: "8090",
-                            value: "{new_port}",
-                            oninput: move |e| new_port.set(e.value()),
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "MongoDB URI" }
-                        input {
-                            r#type: "text",
-                            placeholder: "mongodb://localhost:27017",
-                            value: "{new_mongo_uri}",
-                            oninput: move |e| new_mongo_uri.set(e.value()),
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Database Name" }
-                        input {
-                            r#type: "text",
-                            placeholder: "compliance_scanner",
-                            value: "{new_mongo_db}",
-                            oninput: move |e| new_mongo_db.set(e.value()),
-                        }
-                    }
-                }
-                div { class: "form-group",
-                    label { "Description" }
-                    input {
-                        r#type: "text",
-                        placeholder: "Optional notes about this server",
-                        value: "{new_description}",
-                        oninput: move |e| new_description.set(e.value()),
-                    }
-                }
-                button {
-                    class: "btn btn-primary",
-                    onclick: move |_| {
-                        let name = new_name();
-                        let endpoint = new_endpoint();
-                        let transport = new_transport();
-                        let port = new_port();
-                        let desc = new_description();
-                        let mongo_uri = new_mongo_uri();
-                        let mongo_db = new_mongo_db();
-                        spawn(async move {
-                            match add_mcp_server(name, endpoint, transport, port, desc, mongo_uri, mongo_db).await {
-                                Ok(_) => {
-                                    toasts.push(ToastType::Success, "MCP server registered");
-                                    servers.restart();
-                                }
-                                Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                            }
-                        });
-                        show_form.set(false);
-                        new_name.set(String::new());
-                        new_endpoint.set(String::new());
-                        new_transport.set("http".to_string());
-                        new_port.set("8090".to_string());
-                        new_description.set(String::new());
-                        new_mongo_uri.set(String::new());
-                        new_mongo_db.set(String::new());
-                    },
-                    "Register"
-                }
-            }
-        }
-
-        // Delete confirmation modal
-        if let Some((ref del_id, ref del_name)) = *confirm_delete.read() {
-            div { class: "modal-overlay",
-                onclick: move |_| confirm_delete.set(None),
-                div { class: "modal-dialog",
-                    onclick: move |e| e.stop_propagation(),
-                    h3 { "Delete MCP Server" }
-                    p { "Are you sure you want to remove " strong { "{del_name}" } "?" }
-                    p { class: "text-secondary", "Connected LLM clients will lose access." }
-                    div { class: "modal-actions",
-                        button {
-                            class: "btn btn-ghost",
-                            onclick: move |_| confirm_delete.set(None),
-                            "Cancel"
-                        }
-                        button {
-                            class: "btn btn-danger",
-                            onclick: {
-                                let id = del_id.clone();
-                                move |_| {
-                                    let id = id.clone();
-                                    spawn(async move {
-                                        match delete_mcp_server(id).await {
-                                            Ok(_) => {
-                                                toasts.push(ToastType::Success, "Server removed");
-                                                servers.restart();
-                                            }
-                                            Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                        }
-                                    });
-                                    confirm_delete.set(None);
-                                }
-                            },
-                            "Delete"
-                        }
-                    }
-                }
-            }
-        }
-
-        match &*servers.read() {
-            Some(Some(resp)) => {
-                if resp.data.is_empty() {
-                    rsx! {
-                        div { class: "card",
-                            p { style: "padding: 1rem; color: var(--text-secondary);", "No MCP servers registered. Add one to get started." }
-                        }
-                    }
-                } else {
-                    rsx! {
-                        div { class: "mcp-cards-grid",
-                            for server in resp.data.iter() {
-                                {
-                                    let sid = server.id.map(|id| id.to_hex()).unwrap_or_default();
-                                    let name = server.name.clone();
-                                    let status_class = match server.status {
-                                        compliance_core::models::McpServerStatus::Running => "running",
-                                        compliance_core::models::McpServerStatus::Stopped => "stopped",
-                                        compliance_core::models::McpServerStatus::Error => "error",
-                                    };
-                                    let status_label = format!("{}", server.status);
-                                    let is_token_visible = visible_token().as_deref() == Some(sid.as_str());
-                                    let created_str = server.created_at.format("%Y-%m-%d %H:%M").to_string();
-                                    let tools_count = server.tools_enabled.len();
-
-                                    rsx! {
-                                        div { class: "mcp-card",
-                                            // Header row: status dot + name + actions
-                                            div { class: "mcp-card-header",
-                                                div { class: "mcp-card-title",
-                                                    span { class: "mcp-status-dot {status_class}" }
-                                                    h3 { "{server.name}" }
-                                                    span { class: "mcp-card-status {status_class}", "{status_label}" }
-                                                }
-                                                button {
-                                                    class: "btn btn-sm btn-ghost btn-ghost-danger",
-                                                    title: "Delete server",
-                                                    onclick: {
-                                                        let id = sid.clone();
-                                                        let name = name.clone();
-                                                        move |_| {
-                                                            confirm_delete.set(Some((id.clone(), name.clone())));
-                                                        }
-                                                    },
-                                                    Icon { icon: BsTrash, width: 14, height: 14 }
-                                                }
-                                            }
-
-                                            if let Some(ref desc) = server.description {
-                                                p { class: "mcp-card-desc", "{desc}" }
-                                            }
-
-                                            // Config details
-                                            div { class: "mcp-card-details",
-                                                div { class: "mcp-detail-row",
-                                                    Icon { icon: BsGlobe, width: 13, height: 13 }
-                                                    span { class: "mcp-detail-label", "Endpoint" }
-                                                    code { class: "mcp-detail-value", "{server.endpoint_url}" }
-                                                }
-                                                div { class: "mcp-detail-row",
-                                                    Icon { icon: BsHddNetwork, width: 13, height: 13 }
-                                                    span { class: "mcp-detail-label", "Transport" }
-                                                    span { class: "mcp-detail-value", "{server.transport}" }
-                                                }
-                                                if let Some(port) = server.port {
-                                                    div { class: "mcp-detail-row",
-                                                        Icon { icon: BsPlug, width: 13, height: 13 }
-                                                        span { class: "mcp-detail-label", "Port" }
-                                                        span { class: "mcp-detail-value", "{port}" }
-                                                    }
-                                                }
-                                            }
-
-                                            // Tools
-                                            div { class: "mcp-card-tools",
-                                                span { class: "mcp-detail-label",
-                                                    Icon { icon: BsTools, width: 13, height: 13 }
-                                                    " {tools_count} tools"
-                                                }
-                                                div { class: "mcp-tools-list",
-                                                    for tool in server.tools_enabled.iter() {
-                                                        span { class: "mcp-tool-chip", "{tool}" }
-                                                    }
-                                                }
-                                            }
-
-                                            // Token section
-                                            div { class: "mcp-card-token",
-                                                div { class: "mcp-token-display",
-                                                    Icon { icon: BsKey, width: 13, height: 13 }
-                                                    code { class: "mcp-token-code",
-                                                        if is_token_visible {
-                                                            "{server.access_token}"
-                                                        } else {
-                                                            "mcp_••••••••••••••••••••"
-                                                        }
-                                                    }
-                                                }
-                                                div { class: "mcp-token-actions",
-                                                    button {
-                                                        class: "btn btn-sm btn-ghost",
-                                                        title: if is_token_visible { "Hide token" } else { "Reveal token" },
-                                                        onclick: {
-                                                            let id = sid.clone();
-                                                            move |_| {
-                                                                if visible_token().as_deref() == Some(id.as_str()) {
-                                                                    visible_token.set(None);
-                                                                } else {
-                                                                    visible_token.set(Some(id.clone()));
-                                                                }
-                                                            }
-                                                        },
-                                                        if is_token_visible {
-                                                            Icon { icon: BsEyeSlash, width: 14, height: 14 }
-                                                        } else {
-                                                            Icon { icon: BsEye, width: 14, height: 14 }
-                                                        }
-                                                    }
-                                                    button {
-                                                        class: "btn btn-sm btn-ghost",
-                                                        title: "Regenerate token",
-                                                        onclick: {
-                                                            let id = sid.clone();
-                                                            move |_| {
-                                                                let id = id.clone();
-                                                                spawn(async move {
-                                                                    match regenerate_mcp_token(id).await {
-                                                                        Ok(_) => {
-                                                                            toasts.push(ToastType::Success, "Token regenerated");
-                                                                            servers.restart();
-                                                                        }
-                                                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                                                    }
-                                                                });
-                                                            }
-                                                        },
-                                                        Icon { icon: BsArrowRepeat, width: 14, height: 14 }
-                                                    }
-                                                }
-                                            }
-
-                                            // Footer
-                                            div { class: "mcp-card-footer",
-                                                span { "Created {created_str}" }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            },
-            Some(None) => rsx! { div { class: "card", p { style: "padding: 1rem;", "Failed to load MCP servers." } } },
-            None => rsx! { div { class: "loading", "Loading..." } },
-        }
-    }
-}

compliance-dashboard/src/pages/mod.rs

@@ -10,7 +10,6 @@ pub mod graph_explorer;
 pub mod graph_index;
 pub mod impact_analysis;
 pub mod issues;
-pub mod mcp_servers;
 pub mod overview;
 pub mod repositories;
 pub mod sbom;
@@ -28,7 +27,6 @@ pub use graph_explorer::GraphExplorerPage;
 pub use graph_index::GraphIndexPage;
 pub use impact_analysis::ImpactAnalysisPage;
 pub use issues::IssuesPage;
-pub use mcp_servers::McpServersPage;
 pub use overview::OverviewPage;
 pub use repositories::RepositoriesPage;
 pub use sbom::SbomPage;

compliance-dashboard/src/pages/overview.rs

@@ -1,12 +1,7 @@
 use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
 
-use crate::app::Route;
 use crate::components::page_header::PageHeader;
 use crate::components::stat_card::StatCard;
-use crate::infrastructure::mcp::fetch_mcp_servers;
-use crate::infrastructure::repositories::fetch_repositories;
 
 #[cfg(feature = "server")]
 use crate::infrastructure::stats::fetch_overview_stats;
@@ -26,9 +21,6 @@ pub fn OverviewPage() -> Element {
         }
     });
 
-    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });
-    let mcp_servers = use_resource(|| async { fetch_mcp_servers().await.ok() });
-
     rsx! {
         PageHeader {
             title: "Overview",
@@ -74,125 +66,6 @@ pub fn OverviewPage() -> Element {
                         SeverityBar { label: "Low", count: s.low_findings, max: s.total_findings, color: "var(--success)" }
                     }
                 }
-
-                // AI Chat section
-                div { class: "card",
-                    div { class: "card-header", "AI Chat" }
-                    match &*repos.read() {
-                        Some(Some(data)) => {
-                            let repo_list = &data.data;
-                            if repo_list.is_empty() {
-                                rsx! {
-                                    p { style: "padding: 1rem; color: var(--text-secondary);",
-                                        "No repositories found. Add a repository to start chatting."
-                                    }
-                                }
-                            } else {
-                                rsx! {
-                                    div {
-                                        class: "grid",
-                                        style: "display: grid; grid-template-columns: repeat(3, 1fr); gap: 1rem; padding: 1rem;",
-                                        for repo in repo_list {
-                                            {
-                                                let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-                                                let name = repo.name.clone();
-                                                rsx! {
-                                                    Link {
-                                                        to: Route::ChatPage { repo_id },
-                                                        class: "graph-repo-card",
-                                                        div { class: "graph-repo-card-header",
-                                                            div { class: "graph-repo-card-icon",
-                                                                Icon { icon: BsChatDots, width: 20, height: 20 }
-                                                            }
-                                                            h3 { class: "graph-repo-card-name", "{name}" }
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        },
-                        Some(None) => rsx! {
-                            p { style: "padding: 1rem; color: var(--text-secondary);",
-                                "Failed to load repositories."
-                            }
-                        },
-                        None => rsx! {
-                            div { class: "loading", "Loading repositories..." }
-                        },
-                    }
-                }
-
-                // MCP Servers section
-                div { class: "card",
-                    div { class: "card-header", "MCP Servers" }
-                    match &*mcp_servers.read() {
-                        Some(Some(resp)) => {
-                            if resp.data.is_empty() {
-                                rsx! {
-                                    p { style: "padding: 1rem; color: var(--text-secondary);",
-                                        "No MCP servers registered."
-                                    }
-                                }
-                            } else {
-                                rsx! {
-                                    div {
-                                        style: "display: grid; grid-template-columns: repeat(3, 1fr); gap: 1rem; padding: 1rem;",
-                                        for server in resp.data.iter() {
-                                            {
-                                                let status_color = match server.status {
-                                                    compliance_core::models::McpServerStatus::Running => "var(--success)",
-                                                    compliance_core::models::McpServerStatus::Stopped => "var(--text-secondary)",
-                                                    compliance_core::models::McpServerStatus::Error => "var(--danger)",
-                                                };
-                                                let status_label = format!("{}", server.status);
-                                                let endpoint = server.endpoint_url.clone();
-                                                let name = server.name.clone();
-                                                rsx! {
-                                                    div { class: "card",
-                                                        style: "padding: 0.75rem;",
-                                                        div {
-                                                            style: "display: flex; align-items: center; gap: 0.5rem; margin-bottom: 0.5rem;",
-                                                            span {
-                                                                style: "width: 8px; height: 8px; border-radius: 50%; background: {status_color}; display: inline-block;",
-                                                            }
-                                                            strong { "{name}" }
-                                                        }
-                                                        p {
-                                                            style: "font-size: 0.8rem; color: var(--text-secondary); margin: 0; word-break: break-all;",
-                                                            "{endpoint}"
-                                                        }
-                                                        p {
-                                                            style: "font-size: 0.75rem; color: var(--text-secondary); margin-top: 0.25rem;",
-                                                            "{status_label}"
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    }
-                                    div { style: "padding: 0 1rem 1rem;",
-                                        Link {
-                                            to: Route::McpServersPage {},
-                                            class: "btn btn-primary btn-sm",
-                                            "Manage"
-                                        }
-                                    }
-                                }
-                            }
-                        },
-                        Some(None) => rsx! {
-                            p { style: "padding: 1rem; color: var(--text-secondary);",
-                                "Failed to load MCP servers."
-                            }
-                        },
-                        None => rsx! {
-                            div { class: "loading", "Loading..." }
-                        },
-                    }
-                }
             },
             Some(None) => rsx! {
                 div { class: "card",

compliance-dashboard/src/pages/repositories.rs

@@ -1,22 +1,9 @@
 use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
 
+use crate::app::Route;
 use crate::components::page_header::PageHeader;
 use crate::components::pagination::Pagination;
 use crate::components::toast::{ToastType, Toasts};
-use crate::pages::graph_explorer::GraphExplorerInline;
-
-async fn async_sleep_5s() {
-    #[cfg(feature = "web")]
-    {
-        gloo_timers::future::TimeoutFuture::new(5_000).await;
-    }
-    #[cfg(not(feature = "web"))]
-    {
-        tokio::time::sleep(std::time::Duration::from_secs(5)).await;
-    }
-}
 
 #[component]
 pub fn RepositoriesPage() -> Element {
@@ -25,16 +12,8 @@ pub fn RepositoriesPage() -> Element {
     let mut name = use_signal(String::new);
     let mut git_url = use_signal(String::new);
     let mut branch = use_signal(|| "main".to_string());
-    let mut auth_token = use_signal(String::new);
-    let mut auth_username = use_signal(String::new);
-    let mut show_auth = use_signal(|| false);
-    let mut show_ssh_key = use_signal(|| false);
-    let mut ssh_public_key = use_signal(String::new);
-    let mut adding = use_signal(|| false);
     let mut toasts = use_context::<Toasts>();
     let mut confirm_delete = use_signal(|| Option::<(String, String)>::None); // (id, name)
-    let mut scanning_ids = use_signal(Vec::<String>::new);
-    let mut graph_repo_id = use_signal(|| Option::<String>::None);
 
     let mut repos = use_resource(move || {
         let p = page();
@@ -75,7 +54,7 @@ pub fn RepositoriesPage() -> Element {
                     label { "Git URL" }
                     input {
                         r#type: "text",
-                        placeholder: "https://github.com/org/repo.git  or  git@github.com:org/repo.git",
+                        placeholder: "https://github.com/org/repo.git",
                         value: "{git_url}",
                         oninput: move |e| git_url.set(e.value()),
                     }
@@ -89,105 +68,26 @@ pub fn RepositoriesPage() -> Element {
                         oninput: move |e| branch.set(e.value()),
                     }
                 }
-
-                // Private repo auth section
-                div { style: "margin-top: 8px;",
-                    button {
-                        class: "btn btn-ghost",
-                        style: "font-size: 12px; padding: 4px 8px;",
-                        onclick: move |_| {
-                            show_auth.toggle();
-                            if !show_ssh_key() {
-                                // Fetch SSH key on first open
-                                show_ssh_key.set(true);
-                                spawn(async move {
-                                    match crate::infrastructure::repositories::fetch_ssh_public_key().await {
-                                        Ok(key) => ssh_public_key.set(key),
-                                        Err(_) => ssh_public_key.set("(not available)".to_string()),
-                                    }
-                                });
-                            }
-                        },
-                        if show_auth() { "Hide auth options" } else { "Private repository?" }
-                    }
-                }
-
-                if show_auth() {
-                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
-                        // SSH deploy key display
-                        div { style: "margin-bottom: 12px;",
-                            label { style: "font-size: 12px; color: var(--text-secondary);",
-                                "For SSH URLs: add this deploy key (read-only) to your repository"
-                            }
-                            div {
-                                style: "margin-top: 4px; padding: 8px; background: var(--bg-secondary); border-radius: 4px; font-family: monospace; font-size: 11px; word-break: break-all; user-select: all;",
-                                if ssh_public_key().is_empty() {
-                                    "Loading..."
-                                } else {
-                                    "{ssh_public_key}"
-                                }
-                            }
-                        }
-
-                        // HTTPS auth fields
-                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
-                            "For HTTPS URLs: provide an access token (PAT) or username/password"
-                        }
-                        div { class: "form-group",
-                            label { "Auth Token / Password" }
-                            input {
-                                r#type: "password",
-                                placeholder: "ghp_xxxx or personal access token",
-                                value: "{auth_token}",
-                                oninput: move |e| auth_token.set(e.value()),
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Username (optional, defaults to x-access-token)" }
-                            input {
-                                r#type: "text",
-                                placeholder: "x-access-token",
-                                value: "{auth_username}",
-                                oninput: move |e| auth_username.set(e.value()),
-                            }
-                        }
-                    }
-                }
-
                 button {
                     class: "btn btn-primary",
-                    disabled: adding(),
                     onclick: move |_| {
                         let n = name();
                         let u = git_url();
                         let b = branch();
-                        let tok = {
-                            let v = auth_token();
-                            if v.is_empty() { None } else { Some(v) }
-                        };
-                        let usr = {
-                            let v = auth_username();
-                            if v.is_empty() { None } else { Some(v) }
-                        };
-                        adding.set(true);
                         spawn(async move {
-                            match crate::infrastructure::repositories::add_repository(n, u, b, tok, usr).await {
+                            match crate::infrastructure::repositories::add_repository(n, u, b).await {
                                 Ok(_) => {
                                     toasts.push(ToastType::Success, "Repository added");
                                     repos.restart();
                                 }
                                 Err(e) => toasts.push(ToastType::Error, e.to_string()),
                             }
-                            adding.set(false);
                         });
                         show_add_form.set(false);
-                        show_auth.set(false);
                         name.set(String::new());
                         git_url.set(String::new());
-                        auth_token.set(String::new());
-                        auth_username.set(String::new());
                     },
-                    if adding() { "Validating..." } else { "Add" }
+                    "Add"
                 }
             }
         }
@@ -258,7 +158,6 @@ pub fn RepositoriesPage() -> Element {
                                             let repo_id_scan = repo_id.clone();
                                             let repo_id_del = repo_id.clone();
                                             let repo_name_del = repo.name.clone();
-                                            let is_scanning = scanning_ids().contains(&repo_id);
                                             rsx! {
                                                 tr {
                                                     td { "{repo.name}" }
@@ -287,68 +186,30 @@ pub fn RepositoriesPage() -> Element {
                                                         }
                                                     }
                                                     td { style: "display: flex; gap: 4px;",
-                                                        button {
+                                                        Link {
-                                                            class: if graph_repo_id().as_deref() == Some(repo_id.as_str()) { "btn btn-ghost btn-active" } else { "btn btn-ghost" },
+                                                            to: Route::GraphExplorerPage { repo_id: repo_id.clone() },
-                                                            title: "View graph",
+                                                            class: "btn btn-ghost",
-                                                            onclick: {
+                                                            "Graph"
-                                                                let rid = repo_id.clone();
-                                                                move |_| {
-                                                                    if graph_repo_id().as_deref() == Some(rid.as_str()) {
-                                                                        graph_repo_id.set(None);
-                                                                    } else {
-                                                                        graph_repo_id.set(Some(rid.clone()));
-                                                                    }
-                                                                }
-                                                            },
-                                                            Icon { icon: BsDiagram3, width: 16, height: 16 }
                                                         }
                                                         button {
-                                                            class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
+                                                            class: "btn btn-ghost",
-                                                            title: "Trigger scan",
-                                                            disabled: is_scanning,
                                                             onclick: move |_| {
                                                                 let id = repo_id_scan.clone();
-                                                                // Add to scanning set
-                                                                let mut ids = scanning_ids();
-                                                                ids.push(id.clone());
-                                                                scanning_ids.set(ids);
                                                                 spawn(async move {
-                                                                    match crate::infrastructure::repositories::trigger_repo_scan(id.clone()).await {
+                                                                    match crate::infrastructure::repositories::trigger_repo_scan(id).await {
-                                                                        Ok(_) => {
+                                                                        Ok(_) => toasts.push(ToastType::Success, "Scan triggered"),
-                                                                            toasts.push(ToastType::Success, "Scan triggered");
-                                                                            // Poll until scan completes
-                                                                            loop {
-                                                                                async_sleep_5s().await;
-                                                                                match crate::infrastructure::repositories::check_repo_scanning(id.clone()).await {
-                                                                                    Ok(false) => break,
-                                                                                    Ok(true) => continue,
-                                                                                    Err(_) => break,
-                                                                                }
-                                                                            }
-                                                                            toasts.push(ToastType::Success, "Scan complete");
-                                                                            repos.restart();
-                                                                        }
                                                                         Err(e) => toasts.push(ToastType::Error, e.to_string()),
                                                                     }
-                                                                    // Remove from scanning set
-                                                                    let mut ids = scanning_ids();
-                                                                    ids.retain(|i| i != &id);
-                                                                    scanning_ids.set(ids);
                                                                 });
                                                             },
-                                                            if is_scanning {
+                                                            "Scan"
-                                                                span { class: "spinner" }
-                                                            } else {
-                                                                Icon { icon: BsPlayCircle, width: 16, height: 16 }
-                                                            }
                                                         }
                                                         button {
                                                             class: "btn btn-ghost btn-ghost-danger",
-                                                            title: "Delete repository",
                                                             onclick: move |_| {
                                                                 confirm_delete.set(Some((repo_id_del.clone(), repo_name_del.clone())));
                                                             },
-                                                            Icon { icon: BsTrash, width: 16, height: 16 }
+                                                            "Delete"
                                                         }
                                                     }
                                                 }
@@ -364,22 +225,6 @@ pub fn RepositoriesPage() -> Element {
                             on_page_change: move |p| page.set(p),
                         }
                     }
-
-                    // Inline graph explorer
-                    if let Some(rid) = graph_repo_id() {
-                        div { class: "card", style: "margin-top: 16px;",
-                            div { class: "card-header", style: "display: flex; justify-content: space-between; align-items: center;",
-                                span { "Code Graph" }
-                                button {
-                                    class: "btn btn-sm btn-ghost",
-                                    title: "Close graph",
-                                    onclick: move |_| { graph_repo_id.set(None); },
-                                    Icon { icon: BsX, width: 18, height: 18 }
-                                }
-                            }
-                            GraphExplorerInline { repo_id: rid }
-                        }
-                    }
                 }
             },
             Some(None) => rsx! {

compliance-mcp/Cargo.toml

@@ -1,21 +0,0 @@
-[package]
-name = "compliance-mcp"
-version = "0.1.0"
-edition = "2021"
-
-[dependencies]
-compliance-core = { workspace = true, features = ["mongodb"] }
-rmcp = { version = "0.16", features = ["server", "macros", "transport-io", "transport-streamable-http-server"] }
-tokio = { workspace = true }
-serde = { workspace = true }
-serde_json = { workspace = true }
-mongodb = { workspace = true }
-tracing = { workspace = true }
-tracing-subscriber = { workspace = true }
-dotenvy = "0.15"
-thiserror = { workspace = true }
-chrono = { workspace = true }
-bson = { version = "2", features = ["chrono-0_4"] }
-schemars = "1.0"
-axum = "0.8"
-tower-http = { version = "0.6", features = ["cors"] }

compliance-mcp/src/database.rs

@@ -1,34 +0,0 @@
-use mongodb::{Client, Collection};
-
-use compliance_core::models::*;
-
-#[derive(Clone, Debug)]
-pub struct Database {
-    inner: mongodb::Database,
-}
-
-impl Database {
-    pub async fn connect(uri: &str, db_name: &str) -> Result<Self, mongodb::error::Error> {
-        let client = Client::with_uri_str(uri).await?;
-        let db = client.database(db_name);
-        db.run_command(mongodb::bson::doc! { "ping": 1 }).await?;
-        tracing::info!("MCP server connected to MongoDB '{db_name}'");
-        Ok(Self { inner: db })
-    }
-
-    pub fn findings(&self) -> Collection<Finding> {
-        self.inner.collection("findings")
-    }
-
-    pub fn sbom_entries(&self) -> Collection<SbomEntry> {
-        self.inner.collection("sbom_entries")
-    }
-
-    pub fn dast_findings(&self) -> Collection<DastFinding> {
-        self.inner.collection("dast_findings")
-    }
-
-    pub fn dast_scan_runs(&self) -> Collection<DastScanRun> {
-        self.inner.collection("dast_scan_runs")
-    }
-}

compliance-mcp/src/main.rs

@@ -1,58 +0,0 @@
-mod database;
-mod server;
-mod tools;
-
-use std::sync::Arc;
-
-use database::Database;
-use rmcp::transport::{
-    streamable_http_server::session::local::LocalSessionManager, StreamableHttpServerConfig,
-    StreamableHttpService,
-};
-use server::ComplianceMcpServer;
-
-#[tokio::main]
-async fn main() -> Result<(), Box<dyn std::error::Error>> {
-    let _ = dotenvy::dotenv();
-
-    tracing_subscriber::fmt()
-        .with_env_filter(
-            tracing_subscriber::EnvFilter::from_default_env()
-                .add_directive("compliance_mcp=info".parse()?),
-        )
-        .init();
-
-    let mongo_uri =
-        std::env::var("MONGODB_URI").unwrap_or_else(|_| "mongodb://localhost:27017".to_string());
-    let db_name =
-        std::env::var("MONGODB_DATABASE").unwrap_or_else(|_| "compliance_scanner".to_string());
-
-    let db = Database::connect(&mongo_uri, &db_name).await?;
-
-    // If MCP_PORT is set, run as Streamable HTTP server; otherwise use stdio.
-    if let Ok(port_str) = std::env::var("MCP_PORT") {
-        let port: u16 = port_str.parse()?;
-        tracing::info!("Starting MCP server on HTTP port {port}");
-
-        let db_clone = db.clone();
-        let service = StreamableHttpService::new(
-            move || Ok(ComplianceMcpServer::new(db_clone.clone())),
-            Arc::new(LocalSessionManager::default()),
-            StreamableHttpServerConfig::default(),
-        );
-
-        let router = axum::Router::new().nest_service("/mcp", service);
-        let listener = tokio::net::TcpListener::bind(("0.0.0.0", port)).await?;
-        tracing::info!("MCP HTTP server listening on 0.0.0.0:{port}");
-        axum::serve(listener, router).await?;
-    } else {
-        tracing::info!("Starting MCP server on stdio");
-        let server = ComplianceMcpServer::new(db);
-        let transport = rmcp::transport::stdio();
-        use rmcp::ServiceExt;
-        let handle = server.serve(transport).await?;
-        handle.waiting().await?;
-    }
-
-    Ok(())
-}

compliance-mcp/src/server.rs

@@ -1,109 +0,0 @@
-use rmcp::{
-    handler::server::wrapper::Parameters, model::*, tool, tool_handler, tool_router, ServerHandler,
-};
-
-use crate::database::Database;
-use crate::tools::{dast, findings, sbom};
-
-pub struct ComplianceMcpServer {
-    db: Database,
-    #[allow(dead_code)]
-    tool_router: rmcp::handler::server::router::tool::ToolRouter<Self>,
-}
-
-#[tool_router]
-impl ComplianceMcpServer {
-    pub fn new(db: Database) -> Self {
-        Self {
-            db,
-            tool_router: Self::tool_router(),
-        }
-    }
-
-    // ── Findings ──────────────────────────────────────────
-
-    #[tool(
-        description = "List security findings with optional filters for repo, severity, status, and scan type"
-    )]
-    async fn list_findings(
-        &self,
-        Parameters(params): Parameters<findings::ListFindingsParams>,
-    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        findings::list_findings(&self.db, params).await
-    }
-
-    #[tool(description = "Get a single finding by its ID")]
-    async fn get_finding(
-        &self,
-        Parameters(params): Parameters<findings::GetFindingParams>,
-    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        findings::get_finding(&self.db, params).await
-    }
-
-    #[tool(description = "Get a summary of findings counts grouped by severity and status")]
-    async fn findings_summary(
-        &self,
-        Parameters(params): Parameters<findings::FindingsSummaryParams>,
-    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        findings::findings_summary(&self.db, params).await
-    }
-
-    // ── SBOM ──────────────────────────────────────────────
-
-    #[tool(
-        description = "List SBOM packages with optional filters for repo, vulnerabilities, package manager, and license"
-    )]
-    async fn list_sbom_packages(
-        &self,
-        Parameters(params): Parameters<sbom::ListSbomPackagesParams>,
-    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        sbom::list_sbom_packages(&self.db, params).await
-    }
-
-    #[tool(
-        description = "Generate a vulnerability report for a repository showing all packages with known CVEs"
-    )]
-    async fn sbom_vuln_report(
-        &self,
-        Parameters(params): Parameters<sbom::SbomVulnReportParams>,
-    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        sbom::sbom_vuln_report(&self.db, params).await
-    }
-
-    // ── DAST ──────────────────────────────────────────────
-
-    #[tool(
-        description = "List DAST findings with optional filters for target, scan run, severity, exploitability, and vulnerability type"
-    )]
-    async fn list_dast_findings(
-        &self,
-        Parameters(params): Parameters<dast::ListDastFindingsParams>,
-    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        dast::list_dast_findings(&self.db, params).await
-    }
-
-    #[tool(description = "Get a summary of recent DAST scan runs and finding counts")]
-    async fn dast_scan_summary(
-        &self,
-        Parameters(params): Parameters<dast::DastScanSummaryParams>,
-    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        dast::dast_scan_summary(&self.db, params).await
-    }
-}
-
-#[tool_handler]
-impl ServerHandler for ComplianceMcpServer {
-    fn get_info(&self) -> ServerInfo {
-        ServerInfo {
-            protocol_version: ProtocolVersion::V_2024_11_05,
-            capabilities: ServerCapabilities::builder()
-                .enable_tools()
-                .build(),
-            server_info: Implementation::from_build_env(),
-            instructions: Some(
-                "Compliance Scanner MCP server. Query security findings, SBOM data, and DAST results."
-                    .to_string(),
-            ),
-        }
-    }
-}

compliance-mcp/src/tools/dast.rs

@@ -1,154 +0,0 @@
-use mongodb::bson::doc;
-use rmcp::{model::*, ErrorData as McpError};
-use schemars::JsonSchema;
-use serde::Deserialize;
-
-use crate::database::Database;
-
-const MAX_LIMIT: i64 = 200;
-const DEFAULT_LIMIT: i64 = 50;
-
-fn cap_limit(limit: Option<i64>) -> i64 {
-    limit.unwrap_or(DEFAULT_LIMIT).clamp(1, MAX_LIMIT)
-}
-
-#[derive(Debug, Deserialize, JsonSchema)]
-pub struct ListDastFindingsParams {
-    /// Filter by DAST target ID
-    pub target_id: Option<String>,
-    /// Filter by scan run ID
-    pub scan_run_id: Option<String>,
-    /// Filter by severity: info, low, medium, high, critical
-    pub severity: Option<String>,
-    /// Only show confirmed exploitable findings
-    pub exploitable: Option<bool>,
-    /// Filter by vulnerability type (e.g. sql_injection, xss, ssrf)
-    pub vuln_type: Option<String>,
-    /// Maximum number of results (default 50, max 200)
-    pub limit: Option<i64>,
-}
-
-pub async fn list_dast_findings(
-    db: &Database,
-    params: ListDastFindingsParams,
-) -> Result<CallToolResult, McpError> {
-    let mut filter = doc! {};
-    if let Some(ref target_id) = params.target_id {
-        filter.insert("target_id", target_id);
-    }
-    if let Some(ref scan_run_id) = params.scan_run_id {
-        filter.insert("scan_run_id", scan_run_id);
-    }
-    if let Some(ref severity) = params.severity {
-        filter.insert("severity", severity);
-    }
-    if let Some(exploitable) = params.exploitable {
-        filter.insert("exploitable", exploitable);
-    }
-    if let Some(ref vuln_type) = params.vuln_type {
-        filter.insert("vuln_type", vuln_type);
-    }
-
-    let limit = cap_limit(params.limit);
-
-    let mut cursor = db
-        .dast_findings()
-        .find(filter)
-        .sort(doc! { "created_at": -1 })
-        .limit(limit)
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-
-    let mut results = Vec::new();
-    while cursor
-        .advance()
-        .await
-        .map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
-    {
-        let finding = cursor
-            .deserialize_current()
-            .map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?;
-        results.push(finding);
-    }
-
-    let json = serde_json::to_string_pretty(&results)
-        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
-
-    Ok(CallToolResult::success(vec![Content::text(json)]))
-}
-
-#[derive(Debug, Deserialize, JsonSchema)]
-pub struct DastScanSummaryParams {
-    /// Filter by DAST target ID
-    pub target_id: Option<String>,
-}
-
-pub async fn dast_scan_summary(
-    db: &Database,
-    params: DastScanSummaryParams,
-) -> Result<CallToolResult, McpError> {
-    let mut filter = doc! {};
-    if let Some(ref target_id) = params.target_id {
-        filter.insert("target_id", target_id);
-    }
-
-    // Get recent scan runs
-    let mut cursor = db
-        .dast_scan_runs()
-        .find(filter.clone())
-        .sort(doc! { "started_at": -1 })
-        .limit(10)
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-
-    let mut scan_runs = Vec::new();
-    while cursor
-        .advance()
-        .await
-        .map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
-    {
-        let run = cursor
-            .deserialize_current()
-            .map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?;
-        scan_runs.push(serde_json::json!({
-            "id": run.id.map(|id| id.to_hex()),
-            "target_id": run.target_id,
-            "status": run.status,
-            "findings_count": run.findings_count,
-            "exploitable_count": run.exploitable_count,
-            "endpoints_discovered": run.endpoints_discovered,
-            "started_at": run.started_at.to_rfc3339(),
-            "completed_at": run.completed_at.map(|t| t.to_rfc3339()),
-        }));
-    }
-
-    // Count findings by severity
-    let mut findings_filter = doc! {};
-    if let Some(ref target_id) = params.target_id {
-        findings_filter.insert("target_id", target_id);
-    }
-    let total_findings = db
-        .dast_findings()
-        .count_documents(findings_filter.clone())
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-
-    let mut exploitable_filter = findings_filter.clone();
-    exploitable_filter.insert("exploitable", true);
-    let exploitable_count = db
-        .dast_findings()
-        .count_documents(exploitable_filter)
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-
-    let summary = serde_json::json!({
-        "total_findings": total_findings,
-        "exploitable_findings": exploitable_count,
-        "recent_scan_runs": scan_runs,
-    });
-
-    let json = serde_json::to_string_pretty(&summary)
-        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
-
-    Ok(CallToolResult::success(vec![Content::text(json)]))
-}

compliance-mcp/src/tools/findings.rs

@@ -1,163 +0,0 @@
-use mongodb::bson::doc;
-use rmcp::{model::*, ErrorData as McpError};
-use schemars::JsonSchema;
-use serde::Deserialize;
-
-use crate::database::Database;
-
-const MAX_LIMIT: i64 = 200;
-const DEFAULT_LIMIT: i64 = 50;
-
-fn cap_limit(limit: Option<i64>) -> i64 {
-    limit.unwrap_or(DEFAULT_LIMIT).clamp(1, MAX_LIMIT)
-}
-
-#[derive(Debug, Deserialize, JsonSchema)]
-pub struct ListFindingsParams {
-    /// Filter by repository ID
-    pub repo_id: Option<String>,
-    /// Filter by severity: info, low, medium, high, critical
-    pub severity: Option<String>,
-    /// Filter by status: open, triaged, false_positive, resolved, ignored
-    pub status: Option<String>,
-    /// Filter by scan type: sast, sbom, cve, gdpr, oauth, secret_detection, lint, code_review
-    pub scan_type: Option<String>,
-    /// Maximum number of results (default 50, max 200)
-    pub limit: Option<i64>,
-}
-
-pub async fn list_findings(
-    db: &Database,
-    params: ListFindingsParams,
-) -> Result<CallToolResult, McpError> {
-    let mut filter = doc! {};
-    if let Some(ref repo_id) = params.repo_id {
-        filter.insert("repo_id", repo_id);
-    }
-    if let Some(ref severity) = params.severity {
-        filter.insert("severity", severity);
-    }
-    if let Some(ref status) = params.status {
-        filter.insert("status", status);
-    }
-    if let Some(ref scan_type) = params.scan_type {
-        filter.insert("scan_type", scan_type);
-    }
-
-    let limit = cap_limit(params.limit);
-
-    let mut cursor = db
-        .findings()
-        .find(filter)
-        .sort(doc! { "created_at": -1 })
-        .limit(limit)
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-
-    let mut results = Vec::new();
-    while cursor
-        .advance()
-        .await
-        .map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
-    {
-        let finding = cursor
-            .deserialize_current()
-            .map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?;
-        results.push(finding);
-    }
-
-    let json = serde_json::to_string_pretty(&results)
-        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
-
-    Ok(CallToolResult::success(vec![Content::text(json)]))
-}
-
-#[derive(Debug, Deserialize, JsonSchema)]
-pub struct GetFindingParams {
-    /// Finding ID (MongoDB ObjectId hex string)
-    pub id: String,
-}
-
-pub async fn get_finding(
-    db: &Database,
-    params: GetFindingParams,
-) -> Result<CallToolResult, McpError> {
-    let oid = bson::oid::ObjectId::parse_str(&params.id)
-        .map_err(|e| McpError::invalid_params(format!("invalid ObjectId: {e}"), None))?;
-
-    let finding = db
-        .findings()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?
-        .ok_or_else(|| McpError::invalid_params("finding not found", None))?;
-
-    let json = serde_json::to_string_pretty(&finding)
-        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
-
-    Ok(CallToolResult::success(vec![Content::text(json)]))
-}
-
-#[derive(Debug, Deserialize, JsonSchema)]
-pub struct FindingsSummaryParams {
-    /// Filter by repository ID
-    pub repo_id: Option<String>,
-}
-
-#[derive(serde::Serialize)]
-struct SeverityCount {
-    severity: String,
-    count: u64,
-}
-
-pub async fn findings_summary(
-    db: &Database,
-    params: FindingsSummaryParams,
-) -> Result<CallToolResult, McpError> {
-    let mut base_filter = doc! {};
-    if let Some(ref repo_id) = params.repo_id {
-        base_filter.insert("repo_id", repo_id);
-    }
-
-    let severities = ["critical", "high", "medium", "low", "info"];
-    let mut counts = Vec::new();
-
-    for sev in &severities {
-        let mut filter = base_filter.clone();
-        filter.insert("severity", sev);
-        let count = db
-            .findings()
-            .count_documents(filter)
-            .await
-            .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-        counts.push(SeverityCount {
-            severity: sev.to_string(),
-            count,
-        });
-    }
-
-    let total: u64 = counts.iter().map(|c| c.count).sum();
-
-    let mut status_counts = Vec::new();
-    for status in &["open", "triaged", "false_positive", "resolved", "ignored"] {
-        let mut filter = base_filter.clone();
-        filter.insert("status", status);
-        let count = db
-            .findings()
-            .count_documents(filter)
-            .await
-            .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-        status_counts.push(serde_json::json!({ "status": status, "count": count }));
-    }
-
-    let summary = serde_json::json!({
-        "total": total,
-        "by_severity": counts,
-        "by_status": status_counts,
-    });
-
-    let json = serde_json::to_string_pretty(&summary)
-        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
-
-    Ok(CallToolResult::success(vec![Content::text(json)]))
-}

compliance-mcp/src/tools/mod.rs

@@ -1,3 +0,0 @@
-pub mod dast;
-pub mod findings;
-pub mod sbom;

compliance-mcp/src/tools/sbom.rs

@@ -1,129 +0,0 @@
-use mongodb::bson::doc;
-use rmcp::{model::*, ErrorData as McpError};
-use schemars::JsonSchema;
-use serde::Deserialize;
-
-use crate::database::Database;
-
-const MAX_LIMIT: i64 = 200;
-const DEFAULT_LIMIT: i64 = 50;
-
-fn cap_limit(limit: Option<i64>) -> i64 {
-    limit.unwrap_or(DEFAULT_LIMIT).clamp(1, MAX_LIMIT)
-}
-
-#[derive(Debug, Deserialize, JsonSchema)]
-pub struct ListSbomPackagesParams {
-    /// Filter by repository ID
-    pub repo_id: Option<String>,
-    /// Only show packages with known vulnerabilities
-    pub has_vulns: Option<bool>,
-    /// Filter by package manager (e.g. npm, cargo, pip)
-    pub package_manager: Option<String>,
-    /// Filter by license (e.g. MIT, Apache-2.0)
-    pub license: Option<String>,
-    /// Maximum number of results (default 50, max 200)
-    pub limit: Option<i64>,
-}
-
-pub async fn list_sbom_packages(
-    db: &Database,
-    params: ListSbomPackagesParams,
-) -> Result<CallToolResult, McpError> {
-    let mut filter = doc! {};
-    if let Some(ref repo_id) = params.repo_id {
-        filter.insert("repo_id", repo_id);
-    }
-    if let Some(ref pm) = params.package_manager {
-        filter.insert("package_manager", pm);
-    }
-    if let Some(ref license) = params.license {
-        filter.insert("license", license);
-    }
-    if params.has_vulns == Some(true) {
-        filter.insert("known_vulnerabilities.0", doc! { "$exists": true });
-    }
-
-    let limit = cap_limit(params.limit);
-
-    let mut cursor = db
-        .sbom_entries()
-        .find(filter)
-        .sort(doc! { "name": 1 })
-        .limit(limit)
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-
-    let mut results = Vec::new();
-    while cursor
-        .advance()
-        .await
-        .map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
-    {
-        let entry = cursor
-            .deserialize_current()
-            .map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?;
-        results.push(entry);
-    }
-
-    let json = serde_json::to_string_pretty(&results)
-        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
-
-    Ok(CallToolResult::success(vec![Content::text(json)]))
-}
-
-#[derive(Debug, Deserialize, JsonSchema)]
-pub struct SbomVulnReportParams {
-    /// Repository ID to generate vulnerability report for
-    pub repo_id: String,
-}
-
-pub async fn sbom_vuln_report(
-    db: &Database,
-    params: SbomVulnReportParams,
-) -> Result<CallToolResult, McpError> {
-    let filter = doc! {
-        "repo_id": &params.repo_id,
-        "known_vulnerabilities.0": { "$exists": true },
-    };
-
-    let mut cursor = db
-        .sbom_entries()
-        .find(filter)
-        .sort(doc! { "name": 1 })
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-
-    let mut vulnerable_packages = Vec::new();
-    let mut total_vulns = 0u64;
-
-    while cursor
-        .advance()
-        .await
-        .map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
-    {
-        let entry = cursor
-            .deserialize_current()
-            .map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?;
-        total_vulns += entry.known_vulnerabilities.len() as u64;
-        vulnerable_packages.push(serde_json::json!({
-            "name": entry.name,
-            "version": entry.version,
-            "package_manager": entry.package_manager,
-            "license": entry.license,
-            "vulnerabilities": entry.known_vulnerabilities,
-        }));
-    }
-
-    let report = serde_json::json!({
-        "repo_id": params.repo_id,
-        "vulnerable_packages_count": vulnerable_packages.len(),
-        "total_vulnerabilities": total_vulns,
-        "packages": vulnerable_packages,
-    });
-
-    let json = serde_json::to_string_pretty(&report)
-        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
-
-    Ok(CallToolResult::success(vec![Content::text(json)]))
-}

docs/.vitepress/config.mts

@@ -33,7 +33,6 @@ export default defineConfig({
           { text: 'DAST Scanning', link: '/features/dast' },
           { text: 'AI Chat (RAG)', link: '/features/ai-chat' },
           { text: 'Issue Tracker Integration', link: '/features/issues' },
-          { text: 'MCP Server', link: '/features/mcp-server' },
         ],
       },
       {

docs/deployment/environment.md

@@ -75,15 +75,6 @@ REDIRECT_URI=http://localhost:8080/auth/callback
 APP_URL=http://localhost:8080
 ```
 
-## MCP Server
-
-```bash
-MONGODB_URI=mongodb://root:example@localhost:27017/compliance_scanner?authSource=admin
-MONGODB_DATABASE=compliance_scanner
-# Set to enable HTTP transport (omit for stdio)
-MCP_PORT=8090
-```
-
 ## Observability
 
 ```bash

docs/features/mcp-server.md

@@ -1,155 +0,0 @@
-# MCP Server
-
-The Model Context Protocol (MCP) server exposes compliance data to external LLMs and AI agents. Any MCP-compatible client — such as Claude, Cursor, or a custom agent — can connect and query findings, SBOM data, and DAST results without direct database access.
-
-## How It Works
-
-The `compliance-mcp` crate runs as a standalone service that connects to the same MongoDB database as the agent and dashboard. It registers a set of **tools** that LLM clients can discover and call through the MCP protocol.
-
-```
-LLM Client  ──MCP──▶  compliance-mcp  ──MongoDB──▶  compliance_scanner DB
-```
-
-The server supports two transport modes:
-
-| Transport | Use Case | How to Enable |
-|-----------|----------|---------------|
-| **Stdio** | Local development, piped to a CLI tool | Default (no `MCP_PORT` set) |
-| **Streamable HTTP** | Remote deployment, multiple clients | Set `MCP_PORT=8090` |
-
-## Available Tools
-
-The MCP server exposes seven tools:
-
-### Findings
-
-| Tool | Description |
-|------|-------------|
-| `list_findings` | Query findings with optional filters for repository, severity, status, and scan type. Returns up to 200 results (default 50). |
-| `get_finding` | Retrieve a single finding by its MongoDB ObjectId. |
-| `findings_summary` | Get finding counts grouped by severity and status, optionally filtered by repository. |
-
-### SBOM
-
-| Tool | Description |
-|------|-------------|
-| `list_sbom_packages` | List SBOM packages with filters for repository, vulnerabilities, package manager, and license. |
-| `sbom_vuln_report` | Generate a vulnerability report for a repository showing all packages with known CVEs. |
-
-### DAST
-
-| Tool | Description |
-|------|-------------|
-| `list_dast_findings` | Query DAST findings with filters for target, scan run, severity, exploitability, and vulnerability type. |
-| `dast_scan_summary` | Get a summary of recent DAST scan runs and finding counts. |
-
-## Running Locally
-
-### Stdio Mode
-
-Run the MCP server directly — it reads from stdin and writes to stdout:
-
-```bash
-cd compliance-mcp
-cargo run
-```
-
-Configure your MCP client to launch it as a subprocess. For example, in a Claude Code `mcp.json`:
-
-```json
-{
-  "mcpServers": {
-    "compliance": {
-      "command": "cargo",
-      "args": ["run", "-p", "compliance-mcp"],
-      "cwd": "/path/to/compliance-scanner"
-    }
-  }
-}
-```
-
-### HTTP Mode
-
-Set `MCP_PORT` to start the Streamable HTTP server:
-
-```bash
-MCP_PORT=8090 cargo run -p compliance-mcp
-```
-
-The server listens on `http://0.0.0.0:8090/mcp`. Point your MCP client to this endpoint.
-
-## Configuration
-
-| Variable | Description | Default |
-|----------|-------------|---------|
-| `MONGODB_URI` | MongoDB connection string | `mongodb://localhost:27017` |
-| `MONGODB_DATABASE` | Database name | `compliance_scanner` |
-| `MCP_PORT` | Port for HTTP transport (omit for stdio) | — |
-| `RUST_LOG` | Log level filter | `compliance_mcp=info` |
-
-Create a `.env` file in the project root or set these as environment variables.
-
-## Deploying with Docker
-
-The `Dockerfile.mcp` builds and runs the MCP server in HTTP mode on port 8090.
-
-```bash
-docker build -f Dockerfile.mcp -t compliance-mcp .
-docker run -p 8090:8090 \
-  -e MONGODB_URI=mongodb://mongo:27017 \
-  -e MONGODB_DATABASE=compliance_scanner \
-  -e MCP_PORT=8090 \
-  compliance-mcp
-```
-
-### Coolify Deployment
-
-1. Create a new service in your Coolify project
-2. Set the **Dockerfile path** to `Dockerfile.mcp`
-3. Set the **exposed port** to `8090`
-4. Add environment variables: `MONGODB_URI`, `MONGODB_DATABASE`, `MCP_PORT=8090`
-5. The MCP endpoint will be available at your configured domain under `/mcp`
-
-The CI pipeline automatically deploys on changes to `compliance-core/`, `compliance-mcp/`, `Dockerfile.mcp`, or `Cargo.toml`/`Cargo.lock`. Add the `COOLIFY_WEBHOOK_MCP` secret to your Gitea repository.
-
-## Managing MCP Servers in the Dashboard
-
-Navigate to **MCP Servers** in the dashboard sidebar to:
-
-- **Register** MCP server instances with their endpoint URL, transport type, port, and database connection
-- **View** server configuration, enabled tools, and status
-- **Manage access tokens** — reveal, copy, or regenerate bearer tokens for authentication
-- **Delete** servers that are no longer needed
-
-Each registered server is assigned a random access token on creation. Use this token in your MCP client configuration for authenticated access.
-
-## Example: Querying Findings from an LLM
-
-Once connected, an LLM can call any of the registered tools. For example:
-
-**"Show me all critical findings"** triggers `list_findings` with `severity: "critical"`:
-
-```json
-{
-  "tool": "list_findings",
-  "arguments": {
-    "severity": "critical",
-    "limit": 10
-  }
-}
-```
-
-**"What vulnerable packages does repo X have?"** triggers `sbom_vuln_report`:
-
-```json
-{
-  "tool": "sbom_vuln_report",
-  "arguments": {
-    "repo_id": "683abc..."
-  }
-}
-```
-
-::: tip
-The MCP server is read-only — it only queries data from MongoDB. It cannot modify findings, trigger scans, or change configuration. This makes it safe to expose to external LLM clients.
-:::

docs/guide/configuration.md

@@ -97,17 +97,6 @@ NVD_API_KEY=your-nvd-api-key
 
 Get a free key at [https://nvd.nist.gov/developers/request-an-api-key](https://nvd.nist.gov/developers/request-an-api-key).
 
-## MCP Server
-
-The MCP server exposes compliance data to external LLMs via the Model Context Protocol. See [MCP Server](/features/mcp-server) for full details.
-
-```bash
-# Set MCP_PORT to enable HTTP transport (omit for stdio mode)
-MCP_PORT=8090
-```
-
-The MCP server shares the `MONGODB_URI` and `MONGODB_DATABASE` variables with the rest of the platform.
-
 ## Clone Path
 
 Where the agent stores cloned repository files:
@@ -150,4 +139,3 @@ GIT_CLONE_BASE_PATH=/tmp/compliance-scanner/repos
 | `APP_URL` | No | — | Application root URL |
 | `OTEL_EXPORTER_OTLP_ENDPOINT` | No | — | OTLP collector endpoint |
 | `OTEL_SERVICE_NAME` | No | — | OpenTelemetry service name |
-| `MCP_PORT` | No | — | MCP HTTP transport port (omit for stdio) |

docs/nginx.conf

@@ -1,15 +0,0 @@
-server {
-    listen 80;
-    server_name _;
-    root /usr/share/nginx/html;
-    index index.html;
-
-    location / {
-        try_files $uri $uri/ $uri.html /index.html;
-    }
-
-    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-    }
-}