# MSI Tree by PH3AR v0.0.1

> Public-safe Windows Installer MSI database viewer, table explorer, local editor, exporter, and static triage utility.

MSI Tree is the PlatPhormNews public-safe Windows Installer database workbench. It preserves MSI-specific product identity and integrates with platform services only as supporting capabilities.

## Public Access
- Public-safe UI, demo database, local parsing, table browsing, local cell editing, search, exports, static analysis, health, docs, discovery, and read-only MCP introspection are open by default.
- Future protected actions are scaffolded behind PLATPHORM_REQUIRE_API_KEY and accept PLATPHORM_API_KEY only when enforcement is enabled.
- MSI Tree never installs MSI packages, invokes msiexec, executes custom actions, or runs embedded binaries/scripts.

## Capabilities
- Demo database: 11 tables from generated demo state
- Standard parser schemas: 18
- Export formats: json, xml, sql, csv
- MCP tools: 22
- MCP resources: 10
- MCP prompts: 8
- Route compliance score: 100

## Endpoints
- API docs: https://msi.platphormnews.com/api/docs
- OpenAPI YAML: https://msi.platphormnews.com/openapi.yaml
- MCP: https://msi.platphormnews.com/api/mcp
- Health: https://msi.platphormnews.com/api/health
- RSS: https://msi.platphormnews.com/rss.xml
- Sitemap: https://msi.platphormnews.com/sitemap.xml

## Integrations
- JSON Tree: handoff (https://json.platphormnews.com)
- XML Tree: handoff (https://xml.platphormnews.com)
- SVG Editor: degraded (https://svg.platphormnews.com)
- ASCII Art: degraded (https://ascii.platphormnews.com)
- MCP Hub: available (https://mcp.platphormnews.com)

## Route Inventory
- GET /: public-safe - MSI Tree Workbench
- GET /viewer: public-safe - Viewer
- GET /demo: public-safe - Demo Database
- GET /tables: public-safe - Table Explorer
- GET /search: public-safe - Global Search
- GET /export: public-safe - Export Utility
- GET /analyze: public-safe - Static Analyzer
- GET /integrations: public-safe - Integrations
- GET /docs: public-safe - Documentation
- GET /faq: public-safe - FAQ
- GET /privacy: public-safe - Privacy
- GET /terms: public-safe - Terms
- GET /disclaimer: public-safe - Disclaimer
- GET /api/docs: public-safe - Public discovery or documentation route
- GET /openapi.yaml: public-safe - Public discovery or documentation route
- GET /openapi.json: public-safe - Public discovery or documentation route
- GET /llms.txt: public-safe - Public discovery or documentation route
- GET /llms-full.txt: public-safe - Public discovery or documentation route
- GET /llms-index.json: public-safe - Public discovery or documentation route
- GET /robots.txt: public-safe - Public discovery or documentation route
- GET /sitemap.xml: public-safe - Public discovery or documentation route
- GET /sitemap-main.xml: public-safe - Public discovery or documentation route
- GET /rss.xml: public-safe - Public discovery or documentation route
- GET /feed.xml: public-safe - Public discovery or documentation route
- GET /manifest.webmanifest: public-safe - Public discovery or documentation route
- GET /.well-known/mcp.json: public-safe - Public discovery or documentation route
- GET /.well-known/agents.json: public-safe - Public discovery or documentation route
- GET /.well-known/ai-plugin.json: public-safe - Public discovery or documentation route
- GET /.well-known/security.txt: public-safe - Public discovery or documentation route
- GET /.well-known/trust.json: public-safe - Public discovery or documentation route
- GET /api/health: public-safe - Public health summary with honest degraded states
- GET /api/v1/health: public-safe - Versioned public health summary
- POST /api/v1/msi/parse: public-safe - Bounded static MSI parser; public-safe in Phase 1, protected scaffolded
- GET /api/v1/msi/demo: public-safe - Demo MSI database metadata and rows
- GET /api/v1/msi/tables: public-safe - Demo MSI table list
- GET /api/v1/msi/tables/{tableName}: public-safe - Demo MSI table detail
- POST /api/v1/msi/search: public-safe - Search a provided MSI database or demo database
- POST /api/v1/msi/export/json: public-safe - Export provided MSI database or demo as JSON
- POST /api/v1/msi/export/xml: public-safe - Export provided MSI database or demo as XML
- POST /api/v1/msi/export/sql: public-safe - Export provided MSI database or demo as SQL
- POST /api/v1/msi/export/csv: public-safe - Export one MSI table as CSV
- POST /api/v1/msi/analyze: public-safe - Run deterministic static MSI analysis on provided database or demo
- POST /api/v1/msi/security: public-safe - Return static MSI security findings
- POST /api/v1/msi/summary: public-safe - Return SummaryInformation for provided database or demo
- GET /api/v1/integrations/status: public-safe - Public-safe integration status
- POST /api/v1/integrations/json: public-safe - Build a bounded JSON integration handoff payload
- POST /api/v1/integrations/xml: public-safe - Build a bounded XML integration handoff payload
- POST /api/v1/integrations/svg: public-safe - Build a bounded SVG integration handoff payload
- POST /api/v1/integrations/ascii: public-safe - Build a bounded ASCII integration handoff payload
- GET /api/mcp: public-safe - MCP endpoint metadata and usage
- POST /api/mcp: public-safe - JSON-RPC 2.0 MCP endpoint for MSI tools
- GET /api/cron/refresh: future protected - Bounded refresh/validation job; requires Vercel cron or PLATPHORM_API_KEY when enforcement is enabled
- POST /api/cron/refresh: future protected - Bounded refresh/validation job; requires Vercel cron or PLATPHORM_API_KEY when enforcement is enabled

## Trust Policy
Web dashboard, public-safe discovery, browser-based operations, trusted-domain discovery, standard route compliance, Vercel metadata capture, trace inspection, and agentic workflow discovery are intentionally supported for public read-only debugging and operator workflows. Mutating, administrative, ingestion, replay, fork, remediation, deployment, sync, test-triggering, reporting, and write actions require PLATPHORM_API_KEY.

## FAQ
### Does MSI Tree install or run MSI packages?
No. MSI Tree is a static viewer and analyzer. It does not invoke msiexec, install packages, execute custom actions, run embedded binaries, or launch scripts.

### Is public access allowed without PLATPHORM_API_KEY?
Yes. Phase 1 public-safe viewing, demo data, table browsing, local editing, exports, health, documentation, discovery files, and read-only MCP introspection are open by default.

### Where is uploaded MSI data stored?
Browser uploads are parsed locally for the interactive workbench. Server endpoints are bounded and do not persist raw MSI contents in Phase 1.

### Can I edit and save an MSI file?
You can edit local table values in the browser session and export structured representations. Phase 1 does not write a new MSI package.

### What do security findings mean?
Findings are deterministic static triage signals for human review. They are not malware verdicts and do not prove that an installer is safe or unsafe.

### How do integrations work?
JSON and XML integrations create copyable handoff payloads for their tree viewers. SVG and ASCII integrations are honest degraded handoffs until richer visual generation is implemented.