Summary

Six new MCP tools focused on the "is this actually a bug?" verification workflow that comes up constantly when auditing repack databases. Each one combines several raw db_query calls into a single focused inspection and surfaces the patterns that most often produce false positives when bug-hunting.

New tools

• inspect_creature(entry) — single deep-dive: template (with ScriptName + AIName), quest starter/ender, vendor count, smart_scripts summary, spawn count, loot table summary. Warns when SmartAI gossip handlers coexist with a gossip_menu_id.
• inspect_gossip_chain(menu_id) — full gossip trace: row + options + per-option action_menu_id status (exists / missing / GOSSIP_OPTION_* sentinel like 1048576 = battlefield queue) + all NPCs using the menu + cross-referenced SmartAI event 62/64 handlers.
• get_smart_scripts(entryorguid, source_type=0) — first-class SmartAI access with human-readable event_type / action_type names. Flags gossip handlers up front.
• find_orphan_refs(source_table, source_column, target_table, target_column, where?, exclude_sentinels?) — generic FK-integrity sweep. Auto-excludes gossip option sentinels when scanning action_menu_id. Returns count + sample rows + reproducible SQL.
• check_scriptname(name) — greps the configured worldserver core source tree (new config field core_source_path) for a ScriptName. Returns file:line hits or a "not in upstream — may be in modified core" warning.
• inspect_loot_table(table, entry) — classifies each loot row as valid item / currency (negative ID) / reference / missing. Prevents "drops nothing" misframings on tables that actually have a mix of working and broken rows.

New documentation

• docs/BUGHUNT.md — anti-false-positive playbook codifying lessons from a live audit session:
  • Negative item IDs are currencies, not missing items
  • GOSSIP_OPTION_* sentinels (1048576 = BATTLEFIELD, 2097152 = AUCTIONEER, etc.) are not menu IDs
  • SmartAI event 62 / 64 bypasses missing gossip_menu rows
  • ScriptName implies C++ handling — verify before claiming DB-level breakage
  • Don't cherry-pick evidence rows
  • Mark UNVERIFIED rather than file on a hunch
• Includes pre-built find_orphan_refs sweep recipes for the most productive integrity audits.

Config

New optional field in config.json:

{
  "core_source_path": "C:/path/to/your/SkyFire_or_TrinityCore/checkout"
}

Required for check_scriptname. When unset, that tool returns a clear "not configured" message instead of erroring; the other five tools work without it.

Upgrade

cd wow-server-mcp
git pull
npm install
npm run build

Then restart your AI client to load the new code.

Tool count

76 → 82 total tools.