Expose bounded repository regex search and semantic filters through MCP

[Widthdom]

Problem and priority

P2 — posting order 6/10. Audit candidates: D06 + D07.

MCP agents cannot perform the same bounded semantic audit searches as the CLI: search tools omit origin/result-kind filtering, and find_in_file does not provide repository-wide regex scanning or continuation. Implement these together as one MCP search-contract/handler parity PR, reusing the existing CLI/query engine capabilities.

Reproduction and actual results

Initialize the project-built MCP server with the canonical database pinned, inspect tools/list, and issue these tools/call requests:

{"name":"search","arguments":{"query":"File.Delete","origin":"code"}}
{"name":"find_in_file","arguments":{"path":"src/CodeIndex/BoundedFile.cs","query":"Read","regex":true,"origin":"code"}}

Both return unknown_argument for the unadvertised semantic filter. find_in_file requires a path and has no all, cursor or lineScanLimit surface. This is an absent capability, not a violation of its current advertised contract.

The CLI already accepts the corresponding workflows:

dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll search File.Delete --origin code --json --db .cdidx/codeindex.db
dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll find 'TODO|FIXME|HACK' --regex --all --json --limit 30 --exclude-tests --db .cdidx/codeindex.db

The second command can return a scan-capped partial result with a usable next_cursor, which MCP clients currently cannot request/resume directly.

Implementation instructions and cautions

Start with src/CodeIndex/Mcp/McpToolArgumentContracts.cs, the corresponding advertised tool schemas and search/find handlers.

• Add origin inclusion/exclusion and supported result-kind/fixture filters through MCP, sharing CLI validation and classification semantics. Filter before final count/pagination; unsupported languages/contexts remain explicitly unknown.
• Add a bounded repository-wide regex-find surface with continuation and scan-budget controls. Prefer an additive tool/mode that preserves find_in_file's existing required-path contract; keep discovery, validation and dispatch synchronized.
• Reuse the existing query/cursor engine. Bind all filters, scope and relevant generation inputs into cursor validation; do not invent a second scanner or accept mismatched/stale cursors.
• Preserve regex timeouts, cancellation, path/exclusion rules, deterministic ordering, line/file/output budgets, and all partial/truncation/authority/recovery information in structured MCP results.
• Keep STDIO and HTTP on the shared handler contract. This concerns lexical match origin, not HTTP Origin/access-control policy. No new origin-classifier capabilities are required for this PR.

Acceptance and validation

• Exercise tools/list and real tools/call requests, including MCP batch_query where supported, rather than schema-only tests.
• Compare CLI and MCP rows/counts for executable code, comments, strings, fixtures and unknown regions under positive/negative semantic filters.
• Resume a multi-file regex query across scan caps with no lost/duplicated matches; cover mismatched filters/generation, zero-width matches, timeout, cancellation and tight response budgets.
• Preserve existing path-specific calls and invalid-argument contracts, and document the new tool names/parameters and continuation flow.

Prior issues

CLI foundation: closed #5324 added bounded regex-find origin/result-kind filters, building on #3423 and indexed-find work in #4725. This extends supported capabilities to MCP; it is not a recurrence of the earlier unsupported CLI combination. D06 and D07 share the MCP search schema/validation/handler changes and should be implemented in this single PR.

Baseline and delivery

Observed during the 2026-09-12 dogfood audit on macOS arm64, using repository-built cdidx 1.49.0 / Debug net8.0 at 36f2e68cb0d7f17bc9591d01ad3045abe870da9b. The build passed with zero warnings/errors. The root database and workspace-manifest freshness checks were healthy, with index and reference-graph completeness true. Counts/timings describe that checkout. Validation during discovery used focused CLI/MCP/LSP reproductions, not the full test suite.

Implement one focused PR for this issue. Follow AGENT_GUIDE.md and the relevant workflows, use the repository-built cdidx for discovery, preserve supported .NET 8/.NET 9 and cross-platform behavior, and avoid new runtime dependencies outside repository policy. Add focused behavioral tests for changed contracts, update affected help/documentation, and include a bilingual changelog.d/unreleased/ fragment for user-visible changes.

[Widthdom]

Work started on branch fix-issue5349, created from the latest fetched origin/main. I will add MCP semantic search filters and bounded repository-wide regex find with continuation, reuse the existing query engine, and validate the shared STDIO/HTTP contract with behavioral tests and a Codex adversarial review.