Refine threat-model prompt and update MCP server prompt handling

[Jeymz]

Description:

• Update prompts/threat-model.prompt.md to clarify intent, expected outputs, reviewer steps, and include concrete examples and a checklist for actionable threat-model reviews. See prompts/threat-model.prompt.md.
• Align the prompt with the threat-model-lite guidance to ensure consistent reviewer behavior. See skills/threat-model-lite/SKILL.md.
• Modify the MCP server to support the revised prompt workflow:
  • Update src/mcp_server.js to expose and route the revised prompt endpoints and to map prompt metadata to the new prompt structure. See src/mcp_server.js.
  • Adjust server.js wiring to register the updated MCP routes and startup behavior. See server.js.
  • Improve request validation and logging around prompt requests; minor refactor to src/mcp_tools/get_prompt.js and related prompt-listing helpers to return the new prompt metadata shape. See src/mcp_tools/get_prompt.js and src/mcp_tools/list_prompts.js.
• Backwards compatibility: changes are implemented to be as non-breaking as possible, but reviewers should validate integrations that consume MCP endpoints.
• Tests & runtime: no new heavy dependencies; run the local MCP server and exercise prompt endpoints to verify behavior.

[Copilot]

Pull request overview

This pull request refines the threat modeling prompt and updates the MCP server infrastructure to better support security-focused workflows. The changes improve request security, add rate limiting, and expand the threat-model prompt with comprehensive Mermaid diagram validation requirements and a more detailed output structure aligned with the threat-model-lite skill.

Changes:

• Enhanced threat-model prompt with mandatory Mermaid diagram validation using VSCode extension tools, detailed DFD requirements, and expanded 4Q framework guidance
• Improved MCP server security with header redaction, request body size limits, rate limiting (120 req/min on MCP endpoints), and enhanced error handling
• Added dual-exposure pattern for prompts (both as MCP tools and native MCP prompts) for client compatibility
• Updated application-security-architect agent with Mermaid Chart tool declarations

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/middlewares/reqInfo.js	Adds header redaction function to prevent logging of auth tokens, removes body from req.info
src/mcp_tools/list_prompts.js	Changes inputSchema from plain object to z.object({}) wrapper
src/mcp_tools/get_prompt.js	Adds isError flag to error responses for better error handling
src/mcp_server.js	Adds registerPrompt loop to expose prompts via native MCP protocol in addition to tools
src/express_app.js	Adds express-rate-limit, JSON body parser with 1MB limit, enhanced error handling, and try-catch for MCP POST handler
prompts/threat-model.prompt.md	Expands from 91 to 288 lines with comprehensive Mermaid tooling requirements, detailed DFD/sequence diagram specs, and structured 10-section output format
package.json	Removes unused ajv dependency, adds express-rate-limit as direct dependency
package-lock.json	Updates dependencies including MCP SDK to 1.26.0, express to 5.2.1, and various dev dependencies
agents/application-security-architect.agent.md	Adds Mermaid Chart VSCode extension tools to the agent's tool list