@bryan-thompson/inspector-assessment-cli 1.43.3 → 1.43.4

package/build/lib/cli-parser.js

@@ -316,6 +316,11 @@ export function parseArgs(argv) {
                 // Issue #137: Stage B enrichment for Claude semantic analysis
                 options.stageBVerbose = true;
                 break;
+            case "--audit-mode":
+                // Reduced false positives for automated MCP auditing
+                options.auditMode = true;
+                options.profile = "audit";
+                break;
             case "--static-only":
                 // Issue #213: Static-only assessment without server connection
                 options.staticOnly = true;
@@ -417,6 +422,13 @@ export function parseArgs(argv) {
         options.helpRequested = true;
         return options;
     }
+    // Validate mutual exclusivity of --audit-mode with --profile (audit-mode sets profile internally)
+    if (options.auditMode && options.profile && options.profile !== "audit") {
+        console.error("Error: --audit-mode cannot be used with --profile (audit mode sets its own profile)");
+        setTimeout(() => process.exit(1), 10);
+        options.helpRequested = true;
+        return options;
+    }
     // Validate mutual exclusivity of --module with orchestrator options (Issue #184)
     if (options.singleModule &&
         (options.skipModules?.length ||
@@ -547,7 +559,8 @@ Options:
   --claude-http          Enable Claude Code via HTTP transport (connects to mcp-auditor proxy)
   --mcp-auditor-url <url>  mcp-auditor URL for HTTP transport (default: http://localhost:8085)
   --full                 Enable all assessment modules (default)
-  --profile <name>       Use predefined module profile (quick, security, compliance, full, dev)
+  --audit-mode           Reduced false positives for automated MCP auditing (sets --profile audit)
+  --profile <name>       Use predefined module profile (quick, security, compliance, full, dev, audit)
   --temporal-invocations <n>  Number of invocations per tool for rug pull detection (default: 3)
   --skip-temporal        Skip temporal/rug pull testing (faster assessment)
   --conformance          Enable official MCP conformance tests (experimental, requires HTTP/SSE transport)

package/build/lib/cli-parserSchemas.js

@@ -24,6 +24,7 @@ export const AssessmentProfileNameSchema = z.enum([
     "full",
     "dev",
     "all",
+    "audit",
 ]);
 /**
  * Valid assessment module names.

package/build/lib/result-output.js

@@ -303,6 +303,27 @@ export function displaySummary(results) {
             console.log(`   • ${rec}`);
         }
     }
+    // Audit mode summary
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const auditAnalysis = security?.auditAnalysis;
+    if (auditAnalysis) {
+        console.log("\n🔍 AUDIT ANALYSIS (reduced false positives):");
+        if (auditAnalysis.highConfidenceVulnerabilities?.length > 0) {
+            console.log(`   🚨 High-confidence vulnerabilities: ${auditAnalysis.highConfidenceVulnerabilities.length}`);
+            for (const vuln of auditAnalysis.highConfidenceVulnerabilities.slice(0, 5)) {
+                console.log(`      • ${vuln}`);
+            }
+        }
+        else {
+            console.log("   ✅ No high-confidence vulnerabilities detected");
+        }
+        if (auditAnalysis.needsReview?.length > 0) {
+            console.log(`   ⚠️  Needs manual review: ${auditAnalysis.needsReview.length}`);
+            for (const item of auditAnalysis.needsReview.slice(0, 3)) {
+                console.log(`      • ${item}`);
+            }
+        }
+    }
     console.log("\n" + "=".repeat(70));
 }
 // ============================================================================

package/build/profiles.js

@@ -160,6 +160,20 @@ export const ASSESSMENT_PROFILES = {
      * Includes: Tier 1-4 + opt-in (prohibitedLibraries, manifestValidation, etc.)
      */
     all: [...ALL_MODULES],
+    /**
+     * Audit profile: Optimized for automated MCP auditing with reduced false positives
+     * Use when: --audit-mode flag, CI/CD pipeline audits
+     * Time: ~8-12 minutes
+     * Includes: Core security + compliance + capability + tool annotations
+     */
+    audit: [
+        "functionality",
+        "security",
+        "errorHandling",
+        "protocolCompliance",
+        "aupCompliance",
+        "toolAnnotations",
+    ],
 };
 export const PROFILE_METADATA = {
     quick: {
@@ -214,6 +228,12 @@ export const PROFILE_METADATA = {
             "Opt-In",
         ],
     },
+    audit: {
+        description: "Automated MCP auditing with reduced false positives (--audit-mode)",
+        estimatedTime: "~8-12 minutes",
+        moduleCount: ASSESSMENT_PROFILES.audit.length,
+        tiers: ["Tier 1 (Core Security)", "Tier 2 (Compliance, partial)"],
+    },
 };
 /**
  * Resolve module names, applying aliases for deprecated names.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bryan-thompson/inspector-assessment-cli",
-  "version": "1.43.3",
+  "version": "1.43.4",
   "description": "CLI for the Enhanced MCP Inspector with assessment capabilities",
   "license": "MIT",
   "author": "Bryan Thompson <bryan@triepod.ai>",