Move First Shared Tool into contrast-mcp-core

 // Imports: the critical swap
-18import com.contrast.labs.ai.mcp.contrast.tool.base.LocalSdkSingleTool;
+18import com.contrast.labs.ai.mcp.contrast.client.ContrastApiClient;
+19import com.contrast.labs.ai.mcp.contrast.tool.base.SingleTool;
 ...
+27import org.springframework.ai.chat.model.ToolContext;

 // Class declaration and dependency injection
-34    extends LocalSdkSingleTool<ListVulnerabilityTypesParams, List<String>> {
+36    extends SingleTool<ListVulnerabilityTypesParams, List<String>> {
+37
+38  private final ContrastApiClient contrastApiClient;
+39
+40  public ListVulnerabilityTypesTool(ContrastApiClient contrastApiClient) {
+41    this.contrastApiClient = contrastApiClient;
+42  }

 // @Tool method: ToolContext forwarding
-53  public SingleToolResponse<List<String>> listVulnerabilityTypes() {
-54    return executePipeline(ListVulnerabilityTypesParams::of);
+61  public SingleToolResponse<List<String>> listVulnerabilityTypes(ToolContext toolContext) {
+62    return executePipeline(ListVulnerabilityTypesParams::of, toolContext);

 // doExecute: data access through ContrastApiClient
-60    var sdk = getContrastSDK();
-61    var rules = sdk.getRules(getOrgId());
+68    var rules = contrastApiClient.getRules();

 // New: expected tool list for S4B invariant
+45  private static final List<Path> EXPECTED_CORE_PRODUCTION_TOOLS =
+46      List.of(
+47          sourcePath(
+48              "com/contrast/labs/ai/mcp/contrast/tool/vulnerability/"
+49                  + "ListVulnerabilityTypesTool.java"));

 // Removed: @Tool annotation was in the local-only blocklist
-62          new LocalOnlyPattern(
-63              "Spring AI transport/runtime dependency", "org.springframework.ai.tool.annotation"),

 // New test: exactly-one-tool invariant
+107  @Test
+108  void core_should_include_exactly_one_s4b_production_tool() throws IOException {
+109    var productionToolSources =
+110        javaSources()
+111            .filter(
+112                path -> sourceText(path).contains("org.springframework.ai.tool.annotation.Tool"))
+113            .map(CORE_MAIN::relativize)
+114            .toList();
+115
+116    assertThat(productionToolSources)
+117        .as("S4B moves exactly one shared production tool into core")
+118        .containsExactlyElementsOf(EXPECTED_CORE_PRODUCTION_TOOLS);
+119  }

 // Extracted helper: sourceText() now used by both tests
+141  private static String sourceText(Path path) {
+142    try {
+143      return Files.readString(path, StandardCharsets.UTF_8);
+144    } catch (IOException e) {
+145      throw new IllegalStateException("Failed to read " + path, e);
+146    }
+147  }

+1#!/usr/bin/env bash
+2# Temporary S4B slice gate — remove once the first-tool move is covered by permanent CI gates.
 ...
+87assert_file_exists "moved_tool_lives_in_core" "${CORE_TOOL}"
+88assert_file_absent "moved_tool_removed_from_stdio_app" "${STDIO_TOOL}"
+89assert_file_absent "get_scan_results_remains_out_of_core" "${CORE_SCAN_RESULTS}"
+90assert_contains "moved_tool_uses_contrast_api_client" "${CORE_TOOL}" 'ContrastApiClient'
+91assert_contains "moved_tool_calls_rules_through_client" "${CORE_TOOL}" ...
+92assert_contains "tool_method_declares_tool_context" "${CORE_TOOL}" ...
+93assert_contains "tool_context_forwarded_to_pipeline" "${CORE_TOOL}" ...
+94assert_not_contains "moved_tool_has_no_local_sdk_factory_cache_or_raw_sarif_access" ...
+95assert_not_contains "moved_tool_has_no_hidden_auth_or_org_parameters" ...
 ...
+101assert_equals "core_contains_exactly_one_production_tool" "1" "${CORE_TOOL_COUNT}"

 // Setup: ContrastApiClient replaces reflected SDK factory
-  private ContrastSDKFactory sdkFactory;
-  private ContrastSDK sdk;
+  private ContrastApiClient contrastApiClient;
 
-  sdk = mock();
-  sdkFactory = mock();
-  when(sdkFactory.getSDK()).thenReturn(sdk);
-  when(sdkFactory.getOrgId()).thenReturn(ORG_ID);
-  tool = new ListVulnerabilityTypesTool();
-  ReflectionTestUtils.setField(tool, "sdkFactory", sdkFactory);
+  contrastApiClient = mock();
+  tool = new ListVulnerabilityTypesTool(contrastApiClient);

+  @Test
+  void listVulnerabilityTypes_should_forward_tool_context_to_base_pipeline() {
+    // ... setup with rules mock ...
+    var toolContext = new ToolContext(Map.of("requestId", "req-123"));
+    var capturedContext = new AtomicReference<ToolContext>();
+    tool.setAuthenticationStrategy(context -> {
+      capturedContext.set(context);
+      return () -> {};
+    });
+    tool.listVulnerabilityTypes(toolContext);
+    assertThat(capturedContext.get()).isSameAs(toolContext);
+  }

+  @Test
+  void tool_method_should_declare_tool_context_for_remote_auth_forwarding() {
+    Method toolMethod = ListVulnerabilityTypesTool.class
+        .getDeclaredMethod("listVulnerabilityTypes", ToolContext.class);
+    assertThat(toolMethod.getAnnotation(Tool.class)).isNotNull();
+    assertThat(toolMethod.getParameterTypes()).containsExactly(ToolContext.class);
+  }

+  @Test
+  void tool_source_should_use_only_contrast_api_client_for_contrast_data_access() {
+    var source = Files.readString(TOOL_SOURCE, StandardCharsets.UTF_8);
+    assertThat(source).contains("ContrastApiClient");
+    assertThat(source).contains("contrastApiClient.getRules()");
+    assertThat(source)
+        .doesNotContain("ContrastSDKFactory")
+        .doesNotContain("SDKExtensionFactory")
+        .doesNotContain("SDKHelper")
+        .doesNotContain("getContrastSDK")
+        .doesNotContain("getSDKExtension")
+        .doesNotContain("getOrgId")
+        .doesNotContain("new ContrastSDK");
+  }

 // All 9 call sites updated: listVulnerabilityTypes() → listVulnerabilityTypes(null)
-    var response = listVulnerabilityTypesTool.listVulnerabilityTypes();
+    var response = listVulnerabilityTypesTool.listVulnerabilityTypes(null);