# prospect_symbol [SUPPORT] 2ce5bc76 — ROBUST symbol prospecting with a three-rung fallback chain: tries codebase__search_graph FIRST (fast, graph-indexed); when it returns zero results OR the caller flags a mismatch (stale_graph=true), automatically retries via Serena extractor__find_symbol / extractor__find_declaration (AST-accurate, never stale); falls back to a BM25 keyword grep over search_code_semantic as a last resort so the caller NEVER has to notice a miss and switch tools by hand. Each rung is labelled in the result ({rung: 'graph'|'serena'|'semantic', hits:[...], fallback_reason: str?}) so the caller knows which level succeeded. All three legs are best-effort: a missing tunnel, inactive slot, or missing root_dir degrades to the next rung, never a bare error with no diagnostic. d5e60791 — every rung's outcome is recorded under result.rungs.{graph,serena,semantic}: status ('not_attempted'|'skipped'|'attempted'|'succeeded'|'empty'|'error'), attempted_tool/selected_tool, and (on skip/error) a reason/error + error_kind ('dependency_error' vs 'runtime_error') — a missing dependency (e.g. an uninstalled local package) or any other runtime failure in a rung is NEVER silently collapsed into rung='none' with no trace; fallback_reason is always populated when every rung misses. 4b8f083f — when root_dir is a git checkout, the graph rung is ALSO auto-skipped (same as an explicit stale_graph=true, with fallback_reason 'graph_skipped_commit_drift_detected') whenever a cheap local git rev-list --count finds real commits since the last index_repository run for this project — no waiting for a _graph_staleness warning from the server, which only fires when a SIBLING process re-indexes, never when nobody re-indexes at all. Pass root_dir to get this protection. Use this instead of calling codebase__search_graph directly whenever you are prospecting for a symbol, function, or class location — it is structurally immune to the class of silent graph-index miss that previously returned wrong line numbers or empty results for real symbols. Agent View of the PolicyLayer registry record for `prospect_symbol`. HTML page: https://policylayer.com/tools/io-github-ajc3xc-meridian/prospect-symbol ## Facts - Tool: `prospect_symbol` - Server: Meridian (`@meridianmcp/mcp`) — https://policylayer.com/tools/io-github-ajc3xc-meridian.md - Install: `npx -y @meridianmcp/mcp` - Homepage: https://github.com/meridianmcp/Meridian - Risk category: Execute (High risk) - Registry record: grade F, identity unverified - Server auth posture: open - Server CORS policy: * - Server rate-limited: no - Parameters: 8 (1 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `kind` | string | no | Optional symbol kind filter passed to search_code_semantic fallback (function/class/method/etc). | | `limit` | integer | no | Max results per rung (default 5). | | `symbol` | string | yes | The symbol/function/class/method name or short search query to prospect for. | | `root_dir` | string | no | Absolute path to the source tree root — used for the search_code_semantic fallback. If omitted, the semantic leg is skipped. | | `project_id` | string | no | Code-intel project id (repo-path slug) passed to codebase__search_graph. | | `session_id` | string | no | a8c0f3b7 — optional Meridian session id. Purely for attribution: when supplied, the durable code-intel prospecting receipt this call records (meridian.code_inte | | `stale_graph` | boolean | no | Set true to SKIP the graph rung and go straight to Serena (e.g. you already know the graph is stale from a _graph_staleness warning). | | `project_name` | string | no | Project name — an alternative to project_id; resolved to the id internally. project_id wins if both are given. | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "prospect_symbol", "arguments": { "symbol": "" } } } ``` ## Why prospect_symbol is rated High prospect_symbol triggers real processes with real consequences. An agent gone sideways doesn't fire it once. It starts dozens of builds, sends mass notifications, or burns through compute before anyone looks up. Risk signals: Bulk/mass operation — affects multiple targets ## Use case AI agents invoke prospect_symbol to trigger actions in Meridian. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Meridian: ```json { "version": "1", "default": "deny", "tools": { "prospect_symbol": { "limits": [ { "counter": "prospect_symbol_rate", "window": "minute", "max": 10, "scope": "grant" } ] } } } ``` ## Other tools on Meridian (174) - `archive_decision` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/archive-decision.md - `batch_mutate` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/batch-mutate.md - `claim_sprint_item` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/claim-sprint-item.md - `clear_capability_profile` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/clear-capability-profile.md - `clone_profile_layer` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/clone-profile-layer.md - `delete_custom_hook` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-custom-hook.md - `delete_note` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-note.md - `delete_sprint_item_pointer` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/delete-sprint-item-pointer.md - `fan_out_sprint_items` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/fan-out-sprint-items.md - `purge_ai_log` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/purge-ai-log.md - `record_handoff_correction` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/record-handoff-correction.md - `release_docx_region_claims` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/release-docx-region-claims.md - `request_hitl` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/request-hitl.md - `reset_plugin_override` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/reset-plugin-override.md - `reset_profile_layer` — Destructive — https://policylayer.com/tools/io-github-ajc3xc-meridian/reset-profile-layer.md - `complete_wave_gate` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/complete-wave-gate.md - `execute_batch` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/execute-batch.md - `run_verification` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/run-verification.md - `start_session` — Execute — https://policylayer.com/tools/io-github-ajc3xc-meridian/start-session.md - `analyze_model_efficiency` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/analyze-model-efficiency.md - `analyze_sprint` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/analyze-sprint.md - `batch_read` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/batch-read.md - `find_outputs_by_source` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-outputs-by-source.md - `find_similar_equation` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-similar-equation.md - `find_similar_figure` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-similar-figure.md - `find_similar_table` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-similar-table.md - `find_symbol_usages` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/find-symbol-usages.md - `get_agent_instructions` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/get-agent-instructions.md - `get_blog_posts` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/get-blog-posts.md - `get_capability_manifest` — Read — https://policylayer.com/tools/io-github-ajc3xc-meridian/get-capability-manifest.md - …and 144 more: https://policylayer.com/tools/io-github-ajc3xc-meridian.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-ajc3xc-meridian · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-ajc3xc-meridian