@bryan-thompson/inspector-assessment-cli 1.43.2 → 1.43.3

package/build/assess-full.js

@@ -3,131 +3,561 @@
  * Full Assessment Runner CLI
  *
  * Runs comprehensive MCP server assessment using AssessmentOrchestrator
- * with all 17 assessor modules and optional Claude Code integration.
+ * with all 11 assessor modules and optional Claude Code integration.
  *
  * Usage:
  *   mcp-assess-full --server <server-name> [--claude-enabled] [--full]
  *   mcp-assess-full my-server --source ./my-server --output ./results.json
  */
-import { ScopedListenerConfig } from "./lib/event-config.js";
-// Import from extracted modules
-import { parseArgs } from "./lib/cli-parser.js";
-import { runFullAssessment, runSingleModule } from "./lib/assessment-runner.js";
-import { saveResults, saveTieredResults, saveSummaryOnly, displaySummary, saveSingleModuleResults, displaySingleModuleSummary, } from "./lib/result-output.js";
-import { handleComparison, displayComparisonSummary, } from "./lib/comparison-handler.js";
-import { shouldAutoTier, formatTokenEstimate, } from "../../client/lib/lib/assessment/summarizer/index.js";
-// ============================================================================
-// Main Entry Point
-// ============================================================================
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+// Import from local client lib (will use package exports when published)
+import { AssessmentOrchestrator, } from "../../client/lib/services/assessment/AssessmentOrchestrator.js";
+import { DEFAULT_ASSESSMENT_CONFIG, } from "../../client/lib/lib/assessmentTypes.js";
+import { FULL_CLAUDE_CODE_CONFIG } from "../../client/lib/services/assessment/lib/claudeCodeBridge.js";
 /**
- * Main execution
+ * Load server configuration from Claude Code's MCP settings
  */
-async function main() {
-    // Use scoped listener configuration instead of global modification
-    // See GitHub Issue #33 for rationale
-    const listenerConfig = new ScopedListenerConfig(50);
-    try {
-        const options = parseArgs();
-        if (options.helpRequested ||
-            options.versionRequested ||
-            options.listModules) {
-            return;
+function loadServerConfig(serverName, configPath) {
+    const possiblePaths = [
+        configPath,
+        path.join(os.homedir(), ".config", "mcp", "servers", `${serverName}.json`),
+        path.join(os.homedir(), ".config", "claude", "claude_desktop_config.json"),
+    ].filter(Boolean);
+    for (const tryPath of possiblePaths) {
+        if (!fs.existsSync(tryPath))
+            continue;
+        const config = JSON.parse(fs.readFileSync(tryPath, "utf-8"));
+        if (config.mcpServers && config.mcpServers[serverName]) {
+            const serverConfig = config.mcpServers[serverName];
+            return {
+                transport: "stdio",
+                command: serverConfig.command,
+                args: serverConfig.args || [],
+                env: serverConfig.env || {},
+            };
         }
-        // Apply scoped listener configuration for assessment
-        listenerConfig.apply();
-        // Single module mode - bypass orchestrator for lightweight execution (Issue #184)
-        if (options.singleModule) {
-            const result = await runSingleModule(options.singleModule, options);
-            if (!options.jsonOnly) {
-                displaySingleModuleSummary(result);
+        if (config.url ||
+            config.transport === "http" ||
+            config.transport === "sse") {
+            if (!config.url) {
+                throw new Error(`Invalid server config: transport is '${config.transport}' but 'url' is missing`);
             }
-            const outputPath = saveSingleModuleResults(options.serverName, options.singleModule, result, options);
-            if (options.jsonOnly) {
-                console.log(outputPath);
+            return {
+                transport: config.transport || "http",
+                url: config.url,
+            };
+        }
+        if (config.command) {
+            return {
+                transport: "stdio",
+                command: config.command,
+                args: config.args || [],
+                env: config.env || {},
+            };
+        }
+    }
+    throw new Error(`Server config not found for: ${serverName}\nTried: ${possiblePaths.join(", ")}`);
+}
+/**
+ * Load optional files from source code path
+ */
+function loadSourceFiles(sourcePath) {
+    const result = {};
+    const readmePaths = ["README.md", "readme.md", "Readme.md"];
+    for (const readmePath of readmePaths) {
+        const fullPath = path.join(sourcePath, readmePath);
+        if (fs.existsSync(fullPath)) {
+            result.readmeContent = fs.readFileSync(fullPath, "utf-8");
+            break;
+        }
+    }
+    const packagePath = path.join(sourcePath, "package.json");
+    if (fs.existsSync(packagePath)) {
+        result.packageJson = JSON.parse(fs.readFileSync(packagePath, "utf-8"));
+    }
+    const manifestPath = path.join(sourcePath, "manifest.json");
+    if (fs.existsSync(manifestPath)) {
+        result.manifestRaw = fs.readFileSync(manifestPath, "utf-8");
+        try {
+            result.manifestJson = JSON.parse(result.manifestRaw);
+        }
+        catch {
+            console.warn("[Assessment] Failed to parse manifest.json");
+        }
+    }
+    result.sourceCodeFiles = new Map();
+    const sourceExtensions = [".ts", ".js", ".py", ".go", ".rs"];
+    const loadSourceDir = (dir, prefix = "") => {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.name.startsWith(".") || entry.name === "node_modules")
+                continue;
+            const fullPath = path.join(dir, entry.name);
+            const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+            if (entry.isDirectory()) {
+                loadSourceDir(fullPath, relativePath);
             }
-            else {
-                console.log(`\n📄 Results saved to: ${outputPath}\n`);
+            else if (sourceExtensions.some((ext) => entry.name.endsWith(ext))) {
+                try {
+                    const content = fs.readFileSync(fullPath, "utf-8");
+                    if (content.length < 100000) {
+                        result.sourceCodeFiles.set(relativePath, content);
+                    }
+                }
+                catch {
+                    // Skip unreadable files
+                }
             }
-            const exitCode = result.status === "FAIL" ? 1 : 0;
-            setTimeout(() => process.exit(exitCode), 10);
-            return;
         }
-        const results = await runFullAssessment(options);
-        // Pre-flight mode handles its own output and exit
-        if (options.preflightOnly) {
-            return;
+    };
+    try {
+        loadSourceDir(sourcePath);
+    }
+    catch (e) {
+        console.warn("[Assessment] Could not load source files:", e);
+    }
+    return result;
+}
+/**
+ * Connect to MCP server via configured transport
+ */
+async function connectToServer(config) {
+    let transport;
+    switch (config.transport) {
+        case "http":
+            if (!config.url)
+                throw new Error("URL required for HTTP transport");
+            transport = new StreamableHTTPClientTransport(new URL(config.url));
+            break;
+        case "sse":
+            if (!config.url)
+                throw new Error("URL required for SSE transport");
+            transport = new SSEClientTransport(new URL(config.url));
+            break;
+        case "stdio":
+        default:
+            if (!config.command)
+                throw new Error("Command required for stdio transport");
+            transport = new StdioClientTransport({
+                command: config.command,
+                args: config.args,
+                env: {
+                    ...Object.fromEntries(Object.entries(process.env).filter(([, v]) => v !== undefined)),
+                    ...config.env,
+                },
+                stderr: "pipe",
+            });
+            break;
+    }
+    const client = new Client({
+        name: "mcp-assess-full",
+        version: "1.0.0",
+    }, {
+        capabilities: {},
+    });
+    await client.connect(transport);
+    return client;
+}
+/**
+ * Create callTool wrapper for assessment context
+ */
+function createCallToolWrapper(client) {
+    return async (name, params) => {
+        try {
+            const response = await client.callTool({
+                name,
+                arguments: params,
+            });
+            return {
+                content: response.content,
+                isError: response.isError || false,
+                structuredContent: response
+                    .structuredContent,
+            };
         }
-        // Handle comparison mode
-        const comparison = handleComparison(results, options);
-        // If comparison was requested but returned null, baseline file was not found
-        if (options.comparePath && !comparison) {
-            setTimeout(() => process.exit(1), 10);
-            return;
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+                    },
+                ],
+                isError: true,
+            };
         }
-        if (comparison?.diffOutputPath) {
-            // Diff-only mode: output path and exit
-            console.log(comparison.diffOutputPath);
-            setTimeout(() => process.exit(comparison.exitCode), 10);
-            return;
+    };
+}
+/**
+ * Build assessment configuration
+ */
+function buildConfig(options) {
+    const config = {
+        ...DEFAULT_ASSESSMENT_CONFIG,
+        enableExtendedAssessment: options.fullAssessment !== false,
+        parallelTesting: true,
+        testTimeout: 30000,
+    };
+    if (options.auditMode) {
+        // Audit mode: only HIGH-value modules for automated MCP auditing
+        config.assessmentCategories = {
+            functionality: true,
+            security: true,
+            documentation: false,
+            errorHandling: true,
+            usability: false,
+            mcpSpecCompliance: true,
+            aupCompliance: false,
+            toolAnnotations: true,
+            prohibitedLibraries: false,
+            manifestValidation: false,
+            portability: false,
+        };
+    }
+    else if (options.fullAssessment !== false) {
+        config.assessmentCategories = {
+            functionality: true,
+            security: true,
+            documentation: true,
+            errorHandling: true,
+            usability: true,
+            mcpSpecCompliance: true,
+            aupCompliance: true,
+            toolAnnotations: true,
+            prohibitedLibraries: true,
+            manifestValidation: true,
+            portability: true,
+        };
+    }
+    if (options.claudeEnabled) {
+        config.claudeCode = {
+            enabled: true,
+            timeout: FULL_CLAUDE_CODE_CONFIG.timeout || 60000,
+            maxRetries: FULL_CLAUDE_CODE_CONFIG.maxRetries || 2,
+            features: {
+                intelligentTestGeneration: true,
+                aupSemanticAnalysis: true,
+                annotationInference: true,
+                documentationQuality: true,
+            },
+        };
+    }
+    return config;
+}
+/**
+ * Run full assessment
+ */
+async function runFullAssessment(options) {
+    if (!options.jsonOnly) {
+        console.log(`\n🔍 Starting full assessment for: ${options.serverName}`);
+    }
+    const serverConfig = loadServerConfig(options.serverName, options.serverConfigPath);
+    if (!options.jsonOnly) {
+        console.log("✅ Server config loaded");
+    }
+    const client = await connectToServer(serverConfig);
+    if (!options.jsonOnly) {
+        console.log("✅ Connected to MCP server");
+    }
+    const response = await client.listTools();
+    const tools = response.tools || [];
+    if (!options.jsonOnly) {
+        console.log(`🔧 Found ${tools.length} tool${tools.length !== 1 ? "s" : ""}`);
+    }
+    const config = buildConfig(options);
+    const orchestrator = new AssessmentOrchestrator(config);
+    if (!options.jsonOnly) {
+        if (orchestrator.isClaudeEnabled()) {
+            console.log("🤖 Claude Code integration enabled");
         }
-        // Display comparison summary if in comparison mode (not diff-only)
-        if (comparison && !options.jsonOnly) {
-            displayComparisonSummary(comparison.diff);
+        else if (options.claudeEnabled) {
+            console.log("⚠️  Claude Code requested but not available");
         }
-        // Display results summary
+    }
+    let sourceFiles = {};
+    if (options.sourceCodePath && fs.existsSync(options.sourceCodePath)) {
+        sourceFiles = loadSourceFiles(options.sourceCodePath);
         if (!options.jsonOnly) {
-            displaySummary(results);
+            console.log(`📁 Loaded source files from: ${options.sourceCodePath}`);
         }
-        // Determine output format (Issue #136: Tiered output strategy)
-        let effectiveFormat = options.outputFormat || "full";
-        // Auto-tier if requested and results exceed threshold
-        if (effectiveFormat === "full" &&
-            options.autoTier &&
-            shouldAutoTier(results)) {
-            effectiveFormat = "tiered";
-            if (!options.jsonOnly) {
-                const estimate = formatTokenEstimate(Math.ceil(JSON.stringify(results).length / 4));
-                console.log(`\n📊 Auto-tiering enabled: ${estimate.tokens} tokens (${estimate.recommendation})`);
-            }
+    }
+    const context = {
+        serverName: options.serverName,
+        tools,
+        callTool: createCallToolWrapper(client),
+        config,
+        sourceCodePath: options.sourceCodePath,
+        transportType: serverConfig.transport || "stdio",
+        ...sourceFiles,
+    };
+    if (!options.jsonOnly) {
+        console.log(`\n🏃 Running assessment with ${Object.keys(config.assessmentCategories || {}).length} modules...`);
+        console.log("");
+    }
+    const results = await orchestrator.runFullAssessment(context);
+    await client.close();
+    return results;
+}
+/**
+ * Save results to JSON file
+ */
+function saveResults(serverName, results, outputPath, transportType) {
+    const defaultPath = `/tmp/inspector-full-assessment-${serverName}.json`;
+    const finalPath = outputPath || defaultPath;
+    // Build audit summary for automated consumption
+    const securityResult = results.security;
+    const functionalityResult = results.functionality;
+    const mcpResult = results.mcpSpecCompliance;
+    const errorResult = results.errorHandling;
+    const auditSummary = {
+        highConfidenceVulnerabilities: securityResult?.auditAnalysis?.highConfidenceVulnerabilities || [],
+        needsReview: securityResult?.auditAnalysis?.needsReview || [],
+        falsePositiveLikelihood: securityResult?.auditAnalysis?.falsePositiveLikelihood || {},
+        functionalTools: functionalityResult?.workingTools || 0,
+        totalTools: functionalityResult?.totalTools || 0,
+        mcpComplianceScore: errorResult?.metrics?.mcpComplianceScore || 0,
+        transportType: transportType || "unknown",
+        recommendedAction: results.overallStatus === "PASS"
+            ? "APPROVE"
+            : results.overallStatus === "FAIL"
+                ? "REJECT"
+                : "REVIEW",
+    };
+    const output = {
+        timestamp: new Date().toISOString(),
+        assessmentType: "full",
+        auditSummary,
+        ...results,
+    };
+    fs.writeFileSync(finalPath, JSON.stringify(output, null, 2));
+    return finalPath;
+}
+/**
+ * Display summary
+ */
+function displaySummary(results) {
+    const { overallStatus, summary, totalTestsRun, executionTime, functionality, security, aupCompliance, toolAnnotations, portability, documentation, errorHandling, mcpSpecCompliance, prohibitedLibraries, manifestValidation, } = results;
+    console.log("\n" + "=".repeat(70));
+    console.log("FULL ASSESSMENT RESULTS");
+    console.log("=".repeat(70));
+    console.log(`Server: ${results.serverName}`);
+    console.log(`Overall Status: ${overallStatus}`);
+    console.log(`Total Tests Run: ${totalTestsRun}`);
+    console.log(`Execution Time: ${executionTime}ms`);
+    console.log("-".repeat(70));
+    console.log("\n📊 MODULE STATUS:");
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const modules = [
+        ["Functionality", functionality],
+        ["Security", security],
+        ["Documentation", documentation],
+        ["Error Handling", errorHandling],
+        ["MCP Spec Compliance", mcpSpecCompliance],
+        ["AUP Compliance", aupCompliance],
+        ["Tool Annotations", toolAnnotations],
+        ["Prohibited Libraries", prohibitedLibraries],
+        ["Manifest Validation", manifestValidation],
+        ["Portability", portability],
+    ];
+    for (const [name, module] of modules) {
+        if (module) {
+            const icon = module.status === "PASS"
+                ? "✅"
+                : module.status === "FAIL"
+                    ? "❌"
+                    : "⚠️";
+            console.log(`   ${icon} ${name}: ${module.status}`);
         }
-        // Save results in appropriate format
-        let outputPath;
-        if (effectiveFormat === "tiered") {
-            const tieredOutput = saveTieredResults(options.serverName, results, options);
-            outputPath = tieredOutput.outputDir;
-            if (options.jsonOnly) {
-                console.log(outputPath);
-            }
-            else {
-                console.log(`\n📁 Tiered output saved to: ${outputPath}/`);
-                console.log(`   📋 Executive Summary: executive-summary.json`);
-                console.log(`   📋 Tool Summaries: tool-summaries.json`);
-                console.log(`   📋 Tool Details: tools/ (${tieredOutput.toolDetailRefs.length} files)`);
-                console.log(`   📊 Total tokens: ~${tieredOutput.executiveSummary.estimatedTokens + tieredOutput.toolSummaries.estimatedTokens} (summaries only)\n`);
-            }
+    }
+    console.log("\n📋 KEY FINDINGS:");
+    console.log(`   ${summary}`);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const securityModule = security;
+    if (securityModule?.vulnerabilities?.length > 0) {
+        const vulns = securityModule.vulnerabilities;
+        console.log(`\n🔒 SECURITY VULNERABILITIES (${vulns.length}):`);
+        for (const vuln of vulns.slice(0, 5)) {
+            console.log(`   • ${vuln}`);
         }
-        else if (effectiveFormat === "summary-only") {
-            outputPath = saveSummaryOnly(options.serverName, results, options);
-            if (options.jsonOnly) {
-                console.log(outputPath);
-            }
-            else {
-                console.log(`\n📁 Summary output saved to: ${outputPath}/`);
-                console.log(`   📋 Executive Summary: executive-summary.json`);
-                console.log(`   📋 Tool Summaries: tool-summaries.json\n`);
-            }
+        if (vulns.length > 5) {
+            console.log(`   ... and ${vulns.length - 5} more`);
+        }
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const aupModule = aupCompliance;
+    if (aupModule?.violations?.length > 0) {
+        const violations = aupModule.violations;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const critical = violations.filter((v) => v.severity === "CRITICAL");
+        console.log(`\n⚖️  AUP FINDINGS:`);
+        console.log(`   Total flagged: ${violations.length}`);
+        if (critical.length > 0) {
+            console.log(`   🚨 CRITICAL violations: ${critical.length}`);
+        }
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const annotationsModule = toolAnnotations;
+    if (annotationsModule) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const funcModule = functionality;
+        console.log(`\n🏷️  TOOL ANNOTATIONS:`);
+        console.log(`   Annotated: ${annotationsModule.annotatedCount || 0}/${funcModule?.workingTools || 0}`);
+        if (annotationsModule.missingAnnotationsCount > 0) {
+            console.log(`   Missing: ${annotationsModule.missingAnnotationsCount}`);
+        }
+        if (annotationsModule.misalignedAnnotationsCount > 0) {
+            console.log(`   ⚠️  Misalignments: ${annotationsModule.misalignedAnnotationsCount}`);
+        }
+    }
+    if (results.recommendations?.length > 0) {
+        console.log("\n💡 RECOMMENDATIONS:");
+        for (const rec of results.recommendations.slice(0, 5)) {
+            console.log(`   • ${rec}`);
+        }
+    }
+    console.log("\n" + "=".repeat(70));
+}
+/**
+ * Parse command-line arguments
+ */
+function parseArgs() {
+    const args = process.argv.slice(2);
+    const options = {};
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (!arg)
+            continue;
+        switch (arg) {
+            case "--server":
+            case "-s":
+                options.serverName = args[++i];
+                break;
+            case "--config":
+            case "-c":
+                options.serverConfigPath = args[++i];
+                break;
+            case "--output":
+            case "-o":
+                options.outputPath = args[++i];
+                break;
+            case "--source":
+                options.sourceCodePath = args[++i];
+                break;
+            case "--claude-enabled":
+                options.claudeEnabled = true;
+                break;
+            case "--full":
+                options.fullAssessment = true;
+                break;
+            case "--audit-mode":
+                options.auditMode = true;
+                break;
+            case "--verbose":
+            case "-v":
+                options.verbose = true;
+                break;
+            case "--json":
+                options.jsonOnly = true;
+                break;
+            case "--help":
+            case "-h":
+                printHelp();
+                options.helpRequested = true;
+                return options;
+            default:
+                if (!arg.startsWith("-")) {
+                    if (!options.serverName) {
+                        options.serverName = arg;
+                    }
+                }
+                else {
+                    console.error(`Unknown argument: ${arg}`);
+                    printHelp();
+                    setTimeout(() => process.exit(1), 10);
+                    options.helpRequested = true;
+                    return options;
+                }
+        }
+    }
+    if (!options.serverName) {
+        console.error("Error: --server is required");
+        printHelp();
+        setTimeout(() => process.exit(1), 10);
+        options.helpRequested = true;
+        return options;
+    }
+    return options;
+}
+/**
+ * Print help message
+ */
+function printHelp() {
+    console.log(`
+Usage: mcp-assess-full [options] [server-name]
+
+Run comprehensive MCP server assessment with all 11 assessor modules.
+
+Options:
+  --server, -s <name>    Server name (required, or pass as first positional arg)
+  --config, -c <path>    Path to server config JSON
+  --output, -o <path>    Output JSON path (default: /tmp/inspector-full-assessment-<server>.json)
+  --source <path>        Source code path for deep analysis (AUP, portability, etc.)
+  --claude-enabled       Enable Claude Code integration for intelligent analysis
+  --full                 Enable all assessment modules (default)
+  --audit-mode           Run only high-value modules for automated MCP auditing
+                         (Functionality, Security, ErrorHandling, MCPSpecCompliance, ToolAnnotations)
+                         Reduces false positives and includes audit summary in output
+  --json                 Output only JSON (no console summary)
+  --verbose, -v          Enable verbose logging
+  --help, -h             Show this help message
+
+Assessment Modules (11 total):
+  • Functionality      - Tests all tools work correctly
+  • Security           - Prompt injection & vulnerability testing
+  • Documentation      - README completeness checks
+  • Error Handling     - Validates error responses
+  • Usability          - Input validation & UX
+  • MCP Spec           - Protocol compliance
+  • AUP Compliance     - Acceptable Use Policy checks
+  • Tool Annotations   - readOnlyHint/destructiveHint validation
+  • Prohibited Libs    - Dependency security checks
+  • Manifest           - MCPB manifest.json validation
+  • Portability        - Cross-platform compatibility
+
+Examples:
+  mcp-assess-full my-server
+  mcp-assess-full --server broken-mcp --claude-enabled
+  mcp-assess-full --server my-server --source ./my-server --output ./results.json
+  `);
+}
+/**
+ * Main execution
+ */
+async function main() {
+    try {
+        const options = parseArgs();
+        if (options.helpRequested) {
+            return;
+        }
+        const results = await runFullAssessment(options);
+        if (!options.jsonOnly) {
+            displaySummary(results);
+        }
+        // Determine transport type for audit summary
+        const serverConfig = loadServerConfig(options.serverName, options.serverConfigPath);
+        const outputPath = saveResults(options.serverName, results, options.outputPath, serverConfig.transport || "stdio");
+        if (options.jsonOnly) {
+            console.log(outputPath);
         }
         else {
-            // Default: full output
-            outputPath = saveResults(options.serverName, results, options);
-            if (options.jsonOnly) {
-                console.log(outputPath);
-            }
-            else {
-                console.log(`📄 Results saved to: ${outputPath}\n`);
-            }
+            console.log(`📄 Results saved to: ${outputPath}\n`);
         }
-        // Exit with appropriate code
         const exitCode = results.overallStatus === "FAIL" ? 1 : 0;
         setTimeout(() => process.exit(exitCode), 10);
     }
@@ -139,9 +569,5 @@ async function main() {
         }
         setTimeout(() => process.exit(1), 10);
     }
-    finally {
-        // Restore original listener configuration
-        listenerConfig.restore();
-    }
 }
 main();

package/build/assess-security.js

@@ -11,73 +11,58 @@
  */
 import * as fs from "fs";
 import * as path from "path";
-import { execSync } from "child_process";
+import * as os from "os";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-// Import shared server config loading (Issue #84 - Zod validation)
-import { loadServerConfig } from "./lib/assessment-runner/server-config.js";
-/**
- * Validate that a command is safe to execute
- * - Must be an absolute path or resolvable via PATH
- * - Must not contain shell metacharacters
- */
-function validateCommand(command) {
-    // Check for shell metacharacters that could indicate injection
-    const dangerousChars = /[;&|`$(){}[\]<>!\\]/;
-    if (dangerousChars.test(command)) {
-        throw new Error(`Invalid command: contains shell metacharacters: ${command}`);
-    }
-    // Verify the command exists and is executable
-    try {
-        // Use 'which' on Unix-like systems, 'where' on Windows
-        const whichCmd = process.platform === "win32" ? "where" : "which";
-        execSync(`${whichCmd} "${command}"`, { stdio: "pipe" });
-    }
-    catch {
-        // Check if it's an absolute path that exists
-        if (path.isAbsolute(command) && fs.existsSync(command)) {
-            try {
-                fs.accessSync(command, fs.constants.X_OK);
-                return; // Command exists and is executable
-            }
-            catch {
-                throw new Error(`Command not executable: ${command}`);
-            }
-        }
-        throw new Error(`Command not found: ${command}`);
-    }
-}
+// Import from local client lib (will use package exports when published)
+import { SecurityAssessor } from "../../client/lib/services/assessment/modules/SecurityAssessor.js";
+import { DEFAULT_ASSESSMENT_CONFIG, } from "../../client/lib/lib/assessmentTypes.js";
 /**
- * Validate environment variables from config
- * - Keys must be valid env var names (alphanumeric + underscore)
- * - Values should not contain null bytes
+ * Load server configuration from Claude Code's MCP settings
  */
-function validateEnvVars(env) {
-    if (!env)
-        return {};
-    const validatedEnv = {};
-    const validKeyPattern = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
-    for (const [key, value] of Object.entries(env)) {
-        // Validate key format
-        if (!validKeyPattern.test(key)) {
-            console.warn(`Skipping invalid environment variable name: ${key} (must match [a-zA-Z_][a-zA-Z0-9_]*)`);
+function loadServerConfig(serverName, configPath) {
+    const possiblePaths = [
+        configPath,
+        path.join(os.homedir(), ".config", "mcp", "servers", `${serverName}.json`),
+        path.join(os.homedir(), ".config", "claude", "claude_desktop_config.json"),
+    ].filter(Boolean);
+    for (const tryPath of possiblePaths) {
+        if (!fs.existsSync(tryPath))
             continue;
+        const config = JSON.parse(fs.readFileSync(tryPath, "utf-8"));
+        if (config.mcpServers && config.mcpServers[serverName]) {
+            const serverConfig = config.mcpServers[serverName];
+            return {
+                transport: "stdio",
+                command: serverConfig.command,
+                args: serverConfig.args || [],
+                env: serverConfig.env || {},
+            };
         }
-        // Check for null bytes in value (could truncate strings)
-        if (typeof value === "string" && value.includes("\0")) {
-            console.warn(`Skipping environment variable with null byte: ${key}`);
-            continue;
+        if (config.url ||
+            config.transport === "http" ||
+            config.transport === "sse") {
+            if (!config.url) {
+                throw new Error(`Invalid server config: transport is '${config.transport}' but 'url' is missing`);
+            }
+            return {
+                transport: config.transport || "http",
+                url: config.url,
+            };
+        }
+        if (config.command) {
+            return {
+                transport: "stdio",
+                command: config.command,
+                args: config.args || [],
+                env: config.env || {},
+            };
         }
-        validatedEnv[key] = String(value);
     }
-    return validatedEnv;
+    throw new Error(`Server config not found for: ${serverName}\nTried: ${possiblePaths.join(", ")}`);
 }
-// Import from local client lib (will use package exports when published)
-import { SecurityAssessor } from "../../client/lib/services/assessment/modules/SecurityAssessor.js";
-import { DEFAULT_ASSESSMENT_CONFIG, } from "../../client/lib/lib/assessmentTypes.js";
-import { loadPerformanceConfig } from "../../client/lib/services/assessment/config/performanceConfig.js";
 /**
  * Connect to MCP server via configured transport
  */
@@ -98,16 +83,12 @@ async function connectToServer(config) {
         default:
             if (!config.command)
                 throw new Error("Command required for stdio transport");
-            // Validate command before execution to prevent injection attacks
-            validateCommand(config.command);
-            // Validate and sanitize environment variables from config
-            const validatedEnv = validateEnvVars(config.env);
             transport = new StdioClientTransport({
                 command: config.command,
                 args: config.args,
                 env: {
                     ...Object.fromEntries(Object.entries(process.env).filter(([, v]) => v !== undefined)),
-                    ...validatedEnv,
+                    ...config.env,
                 },
                 stderr: "pipe",
             });
@@ -172,22 +153,6 @@ function createCallToolWrapper(client) {
 async function runSecurityAssessment(options) {
     console.log(`\n🔍 Connecting to MCP server: ${options.serverName}`);
     const serverConfig = loadServerConfig(options.serverName, options.serverConfigPath);
-    // Load custom performance config if provided (Issue #37)
-    // Note: Currently, modules use DEFAULT_PERFORMANCE_CONFIG directly.
-    // This validates the config file but doesn't override runtime values yet.
-    if (options.performanceConfigPath) {
-        try {
-            const performanceConfig = loadPerformanceConfig(options.performanceConfigPath);
-            console.log(`📊 Performance config loaded from: ${options.performanceConfigPath}`);
-            console.log(`   Batch interval: ${performanceConfig.batchFlushIntervalMs}ms, ` +
-                `Security batch: ${performanceConfig.securityBatchSize}`);
-            // TODO: Wire performanceConfig through to SecurityAssessor
-        }
-        catch (error) {
-            console.error(`❌ Failed to load performance config: ${error instanceof Error ? error.message : String(error)}`);
-            throw error;
-        }
-    }
     const client = await connectToServer(serverConfig);
     console.log("✅ Connected successfully");
     const tools = await getTools(client, options.toolName);
@@ -197,7 +162,7 @@ async function runSecurityAssessment(options) {
     }
     const config = {
         ...DEFAULT_ASSESSMENT_CONFIG,
-        securityPatternsToTest: 30,
+        securityPatternsToTest: 13,
         reviewerMode: false,
         testTimeout: 30000,
     };
@@ -206,8 +171,9 @@ async function runSecurityAssessment(options) {
         tools,
         callTool: createCallToolWrapper(client),
         config,
+        transportType: serverConfig.transport || "stdio",
     };
-    console.log(`🛡️  Running security assessment with 30 attack patterns...`);
+    console.log(`🛡️  Running security assessment with 13 attack patterns...`);
     const assessor = new SecurityAssessor(config);
     const results = await assessor.assess(context);
     await client.close();
@@ -287,9 +253,6 @@ function parseArgs() {
             case "-v":
                 options.verbose = true;
                 break;
-            case "--performance-config":
-                options.performanceConfigPath = args[++i];
-                break;
             case "--help":
             case "-h":
                 printHelp();
@@ -326,23 +289,24 @@ function printHelp() {
     console.log(`
 Usage: mcp-assess-security [options] [server-name]
 
-Run security assessment against an MCP server with 30 attack patterns.
+Run security assessment against an MCP server with 13 attack patterns.
 
 Options:
   --server, -s <name>    Server name (required, or pass as first positional arg)
   --config, -c <path>    Path to server config JSON
   --output, -o <path>    Output JSON path (default: /tmp/inspector-security-assessment-<server>.json)
   --tool, -t <name>      Test only specific tool (default: test all tools)
-  --performance-config <path>  Path to performance tuning JSON (batch sizes, timeouts, etc.)
   --verbose, -v          Enable verbose logging
   --help, -h             Show this help message
 
-Attack Patterns Tested (30 total):
-  • Command Injection, SQL Injection, Path Traversal
-  • Calculator Injection, Code Execution, XXE
-  • Data Exfiltration, Token Theft, NoSQL Injection
-  • Unicode Bypass, Nested Injection, Package Squatting
-  • Session Management, Auth Bypass, and more...
+Attack Patterns Tested (13 total):
+  • Command Injection        • SQL Injection
+  • Calculator Injection     • Path Traversal
+  • Type Safety              • Boundary Testing
+  • Required Fields          • MCP Error Format
+  • Timeout Handling         • Indirect Prompt Injection
+  • Unicode Bypass           • Nested Injection
+  • Package Squatting
 
 Examples:
   mcp-assess-security my-server

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bryan-thompson/inspector-assessment-cli",
-  "version": "1.43.2",
+  "version": "1.43.3",
   "description": "CLI for the Enhanced MCP Inspector with assessment capabilities",
   "license": "MIT",
   "author": "Bryan Thompson <bryan@triepod.ai>",

package/build/lib/__tests__/zodErrorFormatter.test.js

@@ -1,282 +0,0 @@
-/**
- * Tests for Zod Error Formatting Utilities
- *
- * Validates the error formatting functions for CLI-friendly output.
- *
- * @module cli/lib/__tests__/zodErrorFormatter
- */
-// Uses Jest globals (describe, test, expect)
-import { jest } from "@jest/globals";
-import { z } from "zod";
-import { formatZodIssue, formatZodError, formatZodErrorIndented, printZodErrorForCli, zodErrorToArray, formatZodErrorForJson, formatUserFriendlyError, } from "../zodErrorFormatter.js";
-// Helper to create a ZodError with specific issues
-function createZodError(issues) {
-    // Create a schema that will fail and then manipulate the error
-    const schema = z.object({ dummy: z.string() });
-    const result = schema.safeParse({ dummy: 123 });
-    if (!result.success) {
-        // Replace the errors with our custom issues
-        result.error.issues = issues.map((issue) => ({
-            code: issue.code || "custom",
-            path: issue.path,
-            message: issue.message,
-        }));
-        return result.error;
-    }
-    throw new Error("Failed to create ZodError");
-}
-describe("zodErrorFormatter", () => {
-    describe("formatZodIssue", () => {
-        test("formats issue with empty path (message only)", () => {
-            const issue = { code: "custom", path: [], message: "Required" };
-            const result = formatZodIssue(issue);
-            expect(result).toBe("Required");
-        });
-        test("formats issue with single-level path", () => {
-            const issue = {
-                code: "custom",
-                path: ["field"],
-                message: "Invalid value",
-            };
-            const result = formatZodIssue(issue);
-            expect(result).toBe("field: Invalid value");
-        });
-        test("formats issue with nested path", () => {
-            const issue = {
-                code: "custom",
-                path: ["config", "nested", "field"],
-                message: "Must be a string",
-            };
-            const result = formatZodIssue(issue);
-            expect(result).toBe("config.nested.field: Must be a string");
-        });
-        test("formats issue with array index in path", () => {
-            const issue = {
-                code: "custom",
-                path: ["items", 0, "name"],
-                message: "Required",
-            };
-            const result = formatZodIssue(issue);
-            expect(result).toBe("items.0.name: Required");
-        });
-    });
-    describe("formatZodError", () => {
-        test("formats single error", () => {
-            const error = createZodError([
-                { path: ["field"], message: "Invalid value" },
-            ]);
-            const result = formatZodError(error);
-            expect(result).toBe("field: Invalid value");
-        });
-        test("formats multiple errors with newlines", () => {
-            const error = createZodError([
-                { path: ["field1"], message: "Error 1" },
-                { path: ["field2"], message: "Error 2" },
-                { path: ["field3"], message: "Error 3" },
-            ]);
-            const result = formatZodError(error);
-            expect(result).toBe("field1: Error 1\nfield2: Error 2\nfield3: Error 3");
-        });
-        test("handles error with empty path", () => {
-            const error = createZodError([{ path: [], message: "Global error" }]);
-            const result = formatZodError(error);
-            expect(result).toBe("Global error");
-        });
-    });
-    describe("formatZodErrorIndented", () => {
-        test("uses default indentation (two spaces)", () => {
-            const error = createZodError([
-                { path: ["field"], message: "Invalid value" },
-            ]);
-            const result = formatZodErrorIndented(error);
-            expect(result).toBe("  field: Invalid value");
-        });
-        test("uses custom indentation", () => {
-            const error = createZodError([
-                { path: ["field"], message: "Invalid value" },
-            ]);
-            const result = formatZodErrorIndented(error, "\t");
-            expect(result).toBe("\tfield: Invalid value");
-        });
-        test("uses four spaces indentation", () => {
-            const error = createZodError([
-                { path: ["field"], message: "Invalid value" },
-            ]);
-            const result = formatZodErrorIndented(error, "    ");
-            expect(result).toBe("    field: Invalid value");
-        });
-        test("applies indent to each line for multiple errors", () => {
-            const error = createZodError([
-                { path: ["field1"], message: "Error 1" },
-                { path: ["field2"], message: "Error 2" },
-            ]);
-            const result = formatZodErrorIndented(error, ">> ");
-            expect(result).toBe(">> field1: Error 1\n>> field2: Error 2");
-        });
-        test("uses empty indentation", () => {
-            const error = createZodError([
-                { path: ["field"], message: "Invalid value" },
-            ]);
-            const result = formatZodErrorIndented(error, "");
-            expect(result).toBe("field: Invalid value");
-        });
-    });
-    describe("printZodErrorForCli", () => {
-        let consoleSpy;
-        beforeEach(() => {
-            consoleSpy = jest.spyOn(console, "error").mockImplementation(() => { });
-        });
-        afterEach(() => {
-            consoleSpy.mockRestore();
-        });
-        test("prints with context prefix", () => {
-            const error = createZodError([
-                { path: ["field"], message: "Invalid value" },
-            ]);
-            printZodErrorForCli(error, "config file");
-            expect(consoleSpy).toHaveBeenCalledWith("Error in config file:\n  field: Invalid value");
-        });
-        test("prints without context (default prefix)", () => {
-            const error = createZodError([
-                { path: ["field"], message: "Invalid value" },
-            ]);
-            printZodErrorForCli(error);
-            expect(consoleSpy).toHaveBeenCalledWith("Validation error:\n  field: Invalid value");
-        });
-        test("outputs multiple errors with indentation", () => {
-            const error = createZodError([
-                { path: ["field1"], message: "Error 1" },
-                { path: ["field2"], message: "Error 2" },
-            ]);
-            printZodErrorForCli(error, "CLI arguments");
-            expect(consoleSpy).toHaveBeenCalledWith("Error in CLI arguments:\n  field1: Error 1\n  field2: Error 2");
-        });
-    });
-    describe("zodErrorToArray", () => {
-        test("converts single error to array", () => {
-            const error = createZodError([
-                { path: ["field"], message: "Invalid value" },
-            ]);
-            const result = zodErrorToArray(error);
-            expect(result).toEqual(["field: Invalid value"]);
-        });
-        test("converts multiple errors to array", () => {
-            const error = createZodError([
-                { path: ["field1"], message: "Error 1" },
-                { path: ["field2"], message: "Error 2" },
-                { path: ["field3"], message: "Error 3" },
-            ]);
-            const result = zodErrorToArray(error);
-            expect(result).toEqual([
-                "field1: Error 1",
-                "field2: Error 2",
-                "field3: Error 3",
-            ]);
-        });
-        test("returns array preserving order", () => {
-            const error = createZodError([
-                { path: ["z"], message: "Z error" },
-                { path: ["a"], message: "A error" },
-                { path: ["m"], message: "M error" },
-            ]);
-            const result = zodErrorToArray(error);
-            expect(result).toEqual(["z: Z error", "a: A error", "m: M error"]);
-        });
-    });
-    describe("formatZodErrorForJson", () => {
-        test("includes message field", () => {
-            const error = createZodError([
-                { path: ["field"], message: "Invalid value" },
-            ]);
-            const result = formatZodErrorForJson(error);
-            expect(result.message).toBe("Validation failed");
-        });
-        test("includes errors array with path, message, code", () => {
-            const error = createZodError([
-                { path: ["field"], message: "Invalid value", code: "invalid_type" },
-            ]);
-            const result = formatZodErrorForJson(error);
-            expect(result.errors).toHaveLength(1);
-            expect(result.errors[0]).toEqual({
-                path: ["field"],
-                message: "Invalid value",
-                code: "invalid_type",
-            });
-        });
-        test("preserves path as array with numbers and strings", () => {
-            const error = createZodError([
-                { path: ["items", 0, "nested", 1, "field"], message: "Error" },
-            ]);
-            const result = formatZodErrorForJson(error);
-            expect(result.errors[0].path).toEqual(["items", 0, "nested", 1, "field"]);
-        });
-        test("handles multiple errors", () => {
-            const error = createZodError([
-                { path: ["field1"], message: "Error 1", code: "too_small" },
-                { path: ["field2"], message: "Error 2", code: "invalid_type" },
-            ]);
-            const result = formatZodErrorForJson(error);
-            expect(result.errors).toHaveLength(2);
-            expect(result.errors[0].code).toBe("too_small");
-            expect(result.errors[1].code).toBe("invalid_type");
-        });
-    });
-    describe("formatUserFriendlyError", () => {
-        test("single error returns plain message", () => {
-            const error = createZodError([
-                { path: ["username"], message: "Required" },
-            ]);
-            const result = formatUserFriendlyError(error);
-            expect(result).toBe("username: Required");
-        });
-        test("single error with empty path returns message only", () => {
-            const error = createZodError([{ path: [], message: "Invalid input" }]);
-            const result = formatUserFriendlyError(error);
-            expect(result).toBe("Invalid input");
-        });
-        test("multiple errors returns bulleted list", () => {
-            const error = createZodError([
-                { path: ["field1"], message: "Error 1" },
-                { path: ["field2"], message: "Error 2" },
-            ]);
-            const result = formatUserFriendlyError(error);
-            expect(result).toBe("Multiple validation errors:\n  - field1: Error 1\n  - field2: Error 2");
-        });
-        test("applies field label mapping", () => {
-            const error = createZodError([
-                { path: ["serverName"], message: "Required" },
-            ]);
-            const labels = { serverName: "Server Name" };
-            const result = formatUserFriendlyError(error, labels);
-            expect(result).toBe("Server Name: Required");
-        });
-        test("applies labels for multiple errors", () => {
-            const error = createZodError([
-                { path: ["serverName"], message: "Required" },
-                { path: ["configPath"], message: "Invalid path" },
-            ]);
-            const labels = {
-                serverName: "Server Name",
-                configPath: "Configuration Path",
-            };
-            const result = formatUserFriendlyError(error, labels);
-            expect(result).toBe("Multiple validation errors:\n  - Server Name: Required\n  - Configuration Path: Invalid path");
-        });
-        test("falls back to path when no matching label", () => {
-            const error = createZodError([
-                { path: ["unknownField"], message: "Error" },
-            ]);
-            const labels = { otherField: "Other Field" };
-            const result = formatUserFriendlyError(error, labels);
-            expect(result).toBe("unknownField: Error");
-        });
-        test("handles nested path with labels", () => {
-            const error = createZodError([
-                { path: ["config", "nested"], message: "Invalid" },
-            ]);
-            const labels = { "config.nested": "Nested Config" };
-            const result = formatUserFriendlyError(error, labels);
-            expect(result).toBe("Nested Config: Invalid");
-        });
-    });
-});