feat: add static analysis pipeline with Semgrep and Qlty integration

.gitignore

@@ -6,13 +6,22 @@ dist/
 
 # Evaluation results
 .evaluated-commits/
+
+# Test temp files
+.test-temp/
 results.json
 report.html
 index.html
 
 # Claude Code configuration
 .claude/
 
+#Cursor
+.Cursor
+
+#Tests
+coverage
+
 # IDE configuration
 .vscode/*
 !.vscode/extensions.json
@@ -28,3 +37,15 @@ index.html
 .archdoc.config.json
 
 .idea
+
+
+# Using only for testing for now
+.venv-semgrep
+.qlty
+!.qlty/
+.qlty/*
+!.qlty/qlty.toml
+!.qlty/.gitignore
+
+#Serena - MCP
+.serena/

.qlty/.gitignore

@@ -0,0 +1,7 @@
+*
+!configs
+!configs/**
+!hooks
+!hooks/**
+!qlty.toml
+!.gitignore

.qlty/qlty.toml

@@ -0,0 +1,97 @@
+# This file was automatically generated by `qlty init`.
+# You can modify it to suit your needs.
+# We recommend you to commit this file to your repository.
+#
+# This configuration is used by both Qlty CLI and Qlty Cloud.
+#
+#     Qlty CLI -- Code quality toolkit for developers
+#     Qlty Cloud -- Fully automated Code Health Platform
+#
+# Try Qlty Cloud: https://qlty.sh
+#
+# For a guide to configuration, visit https://qlty.sh/d/config
+# Or for a full reference, visit https://qlty.sh/d/qlty-toml
+config_version = "0"
+
+exclude_patterns = [
+  "*_min.*",
+  "*-min.*",
+  "*.min.*",
+  "**/.yarn/**",
+  "**/*.d.ts",
+  "**/assets/**",
+  "**/bower_components/**",
+  "**/build/**",
+  "**/cache/**",
+  "**/config/**",
+  "**/db/**",
+  "**/deps/**",
+  "**/dist/**",
+  "**/extern/**",
+  "**/external/**",
+  "**/generated/**",
+  "**/Godeps/**",
+  "**/gradlew/**",
+  "**/mvnw/**",
+  "**/node_modules/**",
+  "**/protos/**",
+  "**/seed/**",
+  "**/target/**",
+  "**/templates/**",
+  "**/testdata/**",
+  "**/vendor/**",
+]
+
+test_patterns = [
+  "**/test/**",
+  "**/spec/**",
+  "**/*.test.*",
+  "**/*.spec.*",
+  "**/*_test.*",
+  "**/*_spec.*",
+  "**/test_*.*",
+  "**/spec_*.*",
+]
+
+[smells]
+mode = "comment"
+
+[[source]]
+name = "default"
+default = true
+
+
+[[plugin]]
+name = "actionlint"
+
+[[plugin]]
+name = "eslint"
+version = "8.57.1"
+package_file = "package.json"
+package_filters = ["eslint", "prettier"]
+
+[[plugin]]
+name = "osv-scanner"
+
+[[plugin]]
+name = "prettier"
+version = "3.7.3"
+package_file = "package.json"
+package_filters = ["prettier"]
+
+[[plugin]]
+name = "ripgrep"
+mode = "comment"
+
+[[plugin]]
+name = "trivy"
+drivers = [
+  "config",
+  "fs-vuln",
+]
+
+[[plugin]]
+name = "trufflehog"
+
+[[plugin]]
+name = "zizmor"

README.md

@@ -53,6 +53,7 @@ CodeWave is a sophisticated Node.js CLI tool that leverages multiple AI agents i
 - **🧠 RAG (Retrieval-Augmented Generation)**: Automatic handling of large diffs (>100KB) using vector storage and semantic search
 - **🔌 Multi-LLM Support**: Works with Anthropic Claude, OpenAI GPT, and Google Gemini
 - **🖥️ Local LLM Support (Ollama)**: Run free, local models like **Llama 3**, **Mistral**, or **Gemma 2** via Ollama — no API key or internet required
+- **🔬 Static Analysis**: Semgrep + Qlty scan changed lines, route findings by category to the right agents, and degrade gracefully when tools aren't installed
 - **⚡ Production-Ready**: LangGraph-based state machines with comprehensive error handling
 - **💾 JSON Output**: Structured results for programmatic access and CI/CD integration
 - **🎯 Zero Configuration**: Interactive setup wizard with sensible defaults
@@ -92,6 +93,7 @@ This launches an interactive wizard to configure:
 - **LLM Provider**: Choose Anthropic Claude, OpenAI, Google Gemini, Groq or Ollama/LM Studio(local free models)
 - **API Keys**: Set your LLM provider credentials
 - **Model Selection**: Pick your preferred model (defaults recommended)
+- **Static Analyzers**: Optionally install Semgrep + Qlty during setup (findings are scoped to changed lines and routed to agents by category)
 - **Default Settings**: Configure batch size, output directory, and reporting preferences
 
 Configuration is stored securely and only needs to be done once.
@@ -447,7 +449,7 @@ CodeWave uses a 3-tier configuration system with priority order:
 
 ### Quick Setup
 
-On first run, use `codewave config --init` to set up your LLM provider:
+On first run, use `codewave config --init` to set up your LLM provider and optional static analyzer installation:
 
 ```bash
 codewave config --init
@@ -1062,6 +1064,152 @@ codewave evaluate --commit HEAD
 
 ---
 
+## MCP Integration with Claude Desktop
+
+CodeWave is available as an **MCP (Model Context Protocol) server**, allowing you to evaluate commits and analyze code quality directly within **Claude Desktop** through natural conversation.
+
+### What You Can Do
+
+- **Evaluate commits conversationally**: Ask Claude to evaluate your latest commits
+- **Get insights without commands**: No need to remember CLI syntax
+- **Generate OKRs**: Create data-driven development goals based on commit history
+- **Compare quality**: Track improvements between commits
+- **Analyze teams**: Get team-wide code quality statistics
+- **Export reports**: Save evaluations to HTML/Markdown/JSON formats
+
+### Quick Start
+
+```bash
+# 1. Install CodeWave globally
+npm install -g @techdebtgpt/codewave
+
+# 2. Configure CodeWave
+codewave config --init
+
+# 3. Setup Claude Desktop
+# See docs/MCP_SETUP.md for detailed instructions
+```
+
+### Example Conversation
+
+```
+You: "Evaluate my last commit and tell me if there are any concerns"
+
+Claude: [Uses CodeWave MCP to evaluate]
+        "I've evaluated commit abc123. Overall score: 8.5/10.
+
+        The code quality is excellent (9.0/10), but there are two concerns:
+        1. Missing rate limiting on the login endpoint
+        2. Password validation could be stronger
+
+        I recommend adding rate limiting before pushing to production..."
+```
+
+### Available Tools
+
+- **10 production-ready tools** for evaluation, analytics, and reporting
+- **Support for inline configuration** (no config file needed)
+- **Three analysis modes**: fast, normal, and deep
+- **Batch operations**: Evaluate up to 10 commits at once
+- **No API calls** for analytics tools (instant results)
+
+### Key Features
+
+| Feature | Description |
+|---------|-------------|
+| Natural language interface | Chat with Claude instead of remembering commands |
+| Conversational workflows | Combine multiple tools in one conversation |
+| Context awareness | Claude remembers previous results in the conversation |
+| Intelligent interpretation | Claude explains results in plain language |
+| Follow-up questions | Ask for clarification or deeper analysis |
+
+### Available MCP Tools
+
+| Tool | Purpose | Makes API Calls? |
+|------|---------|------------------|
+| `evaluate_commit` | Evaluate single commit | Yes |
+| `batch_evaluate` | Evaluate multiple commits | Yes |
+| `generate_okr` | Generate developer OKRs | Yes |
+| `check_config` | Verify configuration | No |
+| `list_evaluations` | Browse evaluation history | No |
+| `get_report` | Get detailed commit report | No |
+| `get_author_stats` | Analyze developer stats | No |
+| `compare_commits` | Compare two commits | No |
+| `get_team_stats` | Team-wide statistics | No |
+| `export_report` | Export to file | No |
+
+### Documentation
+
+- **[MCP Setup Guide](./docs/MCP_SETUP.md)** - Installation and Claude Desktop configuration
+- **[MCP Tools Reference](./docs/MCP_TOOLS_REFERENCE.md)** - Complete tool documentation with examples
+- **[MCP Examples](./docs/MCP_EXAMPLES.md)** - Practical workflows and example conversations
+
+### Requirements
+
+- **Claude Desktop** app installed ([download](https://claude.ai/download))
+- **Node.js** ≥18.0.0
+- **CodeWave** globally installed
+- **Valid configuration** with LLM API key
+
+### How It Works
+
+```
+┌─────────────────┐
+│  Claude Desktop │
+│   (Your Chat)   │
+└────────┬────────┘
+         │
+         │ Natural language request
+         │ "Evaluate my last commit"
+         │
+         ▼
+┌─────────────────┐
+│  MCP Protocol   │
+│   (JSON-RPC)    │
+└────────┬────────┘
+         │
+         │ Tool call: evaluate_commit
+         │
+         ▼
+┌─────────────────┐
+│ CodeWave Server │
+│  Multi-Agent AI │
+└────────┬────────┘
+         │
+         │ Results
+         │
+         ▼
+┌─────────────────┐
+│  Claude Desktop │
+│ (Interprets &   │
+│  Explains)      │
+└─────────────────┘
+```
+
+### Getting Started
+
+1. **Complete setup**: Follow the [MCP Setup Guide](./docs/MCP_SETUP.md)
+2. **Try examples**: See [MCP Examples](./docs/MCP_EXAMPLES.md) for workflows
+3. **Learn tools**: Reference [MCP Tools Reference](./docs/MCP_TOOLS_REFERENCE.md) as needed
+
+### MCP vs CLI
+
+Both interfaces use the same CodeWave engine. Choose based on your workflow:
+
+| Use Case | Recommended Interface |
+|----------|----------------------|
+| Interactive exploration | **MCP (Claude Desktop)** |
+| Quick quality checks | **MCP (Claude Desktop)** |
+| Learning patterns | **MCP (Claude Desktop)** |
+| Performance reviews | **MCP (Claude Desktop)** |
+| CI/CD automation | **CLI** |
+| Scripting/batch jobs | **CLI** |
+| Custom integrations | **CLI + API** |
+
+See [docs/MCP_SETUP.md](./docs/MCP_SETUP.md) for complete setup instructions.
+
+---
+
 ## Examples
 
 ### Example 1: Evaluate Latest 5 Commits