AST MCP — inspect structurally, write safely

Structural patterns are syntactic. They do not provide semantic type identity.
The pinned ast-bro write operation changes the first match per file, not every match in one file.
The pinned ast-bro npm package currently provides a precompiled binary only for macOS Apple Silicon; other platforms require a Cargo installation and AST_BRO_BINARY.
run does not create files, perform semantic renames, or guarantee formatted output by itself.
Parse health comes from map.error_count, not from an empty structural search.
Markdown is structurally inspectable through map and show, but edits use the guarded Aider route.
file_read is intentionally unavailable for AST-capable files.
Routing hooks are a best-effort agent nudge, not a security boundary. They reject known manual edit paths but leave Git operations, output redirection, repository scripts, and arbitrary execution to the host sandbox.
HTTP session IDs are correlation identifiers, not authentication.
Multiple configured roots deliberately enlarge the connected agent's filesystem boundary.
A formatter rejection, capped preview, stale hash, ambiguous match, or lost MCP connection stops the write rather than choosing a weaker mutation path.

Limitations