pm-copilot CLAUDE.md

PM Copilot — MCP Server

MCP server connecting an LLM to customer signal data (HelpScout support tickets + ProductLift feature requests). Architecture and quickstart: README.md. Contributor process: CONTRIBUTING.md.

Commands

npm run build       # Compile TypeScript (also chmods dist/index.js)
npm run dev         # Watch mode
npm test            # Vitest unit tests
npm start           # Run the server
npm run tool -- <tool_name> '<json-params>'  # Call one tool directly, no MCP client (use --list to enumerate)
npm run eval        # Theme-matching precision/recall (--failures, --json, --fixture, --min-f1)
npm run audit:ci    # Dependency audit gate (prepublishOnly runs build + test + this)

Run npm run build after source changes before testing through an MCP client — clients execute dist/index.js. Restart Claude Code to pick up server changes. The server is registered via the project-scoped .mcp.json; re-add with claude mcp add pm-copilot --scope project -- node dist/index.js.

PII guardrails (load-bearing for any PR)

• Scrub patterns live in src/pii-scrubber.ts (SSN, Luhn-validated credit cards, email addresses, phone numbers); they are applied in src/format.ts before text enters analysis or leaves the server. Customer email field is always [REDACTED] regardless of match.
• Never send unscrubbed customer text. New customer data sources must route through the format layer.
• Excluded by design (don't add without scoping a privacy review): agent/admin responses, internal HelpScout notes, attachments, voter identities, commenter names and emails, raw thread bodies. kpi_context is passed through verbatim — caller's responsibility.
• Chatbase is the widest PII surface (unbounded chat free text). formatDeflectedConversation reads role: "user" turns only and deliberately drops assistant turns, form_submission (captured lead PII), userId and country. src/deflection.test.ts asserts none of those reach the formatted output — keep that test passing.
• Every tool response includes pii_scrubbing_applied: true and pii_categories_redacted: [...]. preview_only: true on generate_product_plan returns a manifest without fetching data.