@bryan-thompson/inspector-assessment-client 1.13.0 → 1.14.0

package/lib/services/assessment/modules/ManifestValidationAssessor.js

@@ -86,9 +86,41 @@ export class ManifestValidationAssessor extends BaseAssessor {
         // Validate version format
         this.testCount++;
         validationResults.push(this.validateVersionFormat(manifest.version));
+        // Validate privacy policy URLs if present
+        let privacyPolicies;
+        if (manifest.privacy_policies &&
+            Array.isArray(manifest.privacy_policies) &&
+            manifest.privacy_policies.length > 0) {
+            this.log(`Validating ${manifest.privacy_policies.length} privacy policy URL(s)`);
+            const policyResults = await this.validatePrivacyPolicyUrls(manifest.privacy_policies);
+            privacyPolicies = {
+                declared: manifest.privacy_policies,
+                validationResults: policyResults,
+                allAccessible: policyResults.every((r) => r.accessible),
+            };
+            // Add validation result for privacy policies
+            if (!privacyPolicies.allAccessible) {
+                const inaccessible = policyResults.filter((r) => !r.accessible);
+                validationResults.push({
+                    field: "privacy_policies",
+                    valid: false,
+                    value: manifest.privacy_policies,
+                    issue: `${inaccessible.length}/${policyResults.length} privacy policy URL(s) inaccessible`,
+                    severity: "WARNING",
+                });
+            }
+            else {
+                validationResults.push({
+                    field: "privacy_policies",
+                    valid: true,
+                    value: manifest.privacy_policies,
+                    severity: "INFO",
+                });
+            }
+        }
         const status = this.determineManifestStatus(validationResults, hasRequiredFields);
-        const explanation = this.generateExplanation(validationResults, hasRequiredFields, hasIcon);
-        const recommendations = this.generateRecommendations(validationResults);
+        const explanation = this.generateExplanation(validationResults, hasRequiredFields, hasIcon, privacyPolicies);
+        const recommendations = this.generateRecommendations(validationResults, privacyPolicies);
         this.log(`Assessment complete: ${validationResults.filter((r) => r.valid).length}/${validationResults.length} checks passed`);
         return {
             hasManifest: true,
@@ -97,6 +129,7 @@ export class ManifestValidationAssessor extends BaseAssessor {
             hasIcon,
             hasRequiredFields,
             missingFields,
+            privacyPolicies,
             status,
             explanation,
             recommendations,
@@ -368,6 +401,73 @@ export class ManifestValidationAssessor extends BaseAssessor {
             severity: "INFO",
         };
     }
+    /**
+     * Validate privacy policy URLs are accessible
+     */
+    async validatePrivacyPolicyUrls(privacyPolicies) {
+        const results = [];
+        for (const url of privacyPolicies) {
+            this.testCount++;
+            // Validate URL format first
+            try {
+                new URL(url);
+            }
+            catch {
+                results.push({
+                    url,
+                    accessible: false,
+                    error: "Invalid URL format",
+                });
+                continue;
+            }
+            try {
+                // Use HEAD request for efficiency, fallback to GET if needed
+                const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), 5000);
+                const response = await fetch(url, {
+                    method: "HEAD",
+                    signal: controller.signal,
+                    redirect: "follow",
+                });
+                clearTimeout(timeoutId);
+                results.push({
+                    url,
+                    accessible: response.ok,
+                    statusCode: response.status,
+                    contentType: response.headers.get("content-type") || undefined,
+                });
+            }
+            catch (error) {
+                // Try GET request as fallback (some servers reject HEAD)
+                try {
+                    const controller = new AbortController();
+                    const timeoutId = setTimeout(() => controller.abort(), 5000);
+                    const response = await fetch(url, {
+                        method: "GET",
+                        signal: controller.signal,
+                        redirect: "follow",
+                    });
+                    clearTimeout(timeoutId);
+                    results.push({
+                        url,
+                        accessible: response.ok,
+                        statusCode: response.status,
+                        contentType: response.headers.get("content-type") || undefined,
+                    });
+                }
+                catch (fetchError) {
+                    results.push({
+                        url,
+                        accessible: false,
+                        error: fetchError instanceof Error
+                            ? fetchError.message
+                            : "Network error",
+                    });
+                }
+            }
+        }
+        return results;
+    }
     /**
      * Determine overall status
      */
@@ -385,7 +485,7 @@ export class ManifestValidationAssessor extends BaseAssessor {
     /**
      * Generate explanation
      */
-    generateExplanation(results, hasRequiredFields, hasIcon) {
+    generateExplanation(results, hasRequiredFields, hasIcon, privacyPolicies) {
         const parts = [];
         const passed = results.filter((r) => r.valid).length;
         const total = results.length;
@@ -396,6 +496,10 @@ export class ManifestValidationAssessor extends BaseAssessor {
         if (!hasIcon) {
             parts.push("No icon found - recommended for MCPB bundles.");
         }
+        if (privacyPolicies && !privacyPolicies.allAccessible) {
+            const inaccessible = privacyPolicies.validationResults.filter((r) => !r.accessible);
+            parts.push(`${inaccessible.length} privacy policy URL(s) are inaccessible.`);
+        }
         const errors = results.filter((r) => !r.valid && r.severity === "ERROR");
         if (errors.length > 0) {
             parts.push(`${errors.length} error(s) require attention.`);
@@ -405,7 +509,7 @@ export class ManifestValidationAssessor extends BaseAssessor {
     /**
      * Generate recommendations
      */
-    generateRecommendations(results) {
+    generateRecommendations(results, privacyPolicies) {
         const recommendations = [];
         // Group by severity
         const errors = results.filter((r) => !r.valid && r.severity === "ERROR");
@@ -422,6 +526,16 @@ export class ManifestValidationAssessor extends BaseAssessor {
                 recommendations.push(`- ${warning.field}: ${warning.issue}`);
             }
         }
+        // Add privacy policy recommendations
+        if (privacyPolicies && !privacyPolicies.allAccessible) {
+            recommendations.push("PRIVACY POLICY - Fix inaccessible URLs:");
+            for (const result of privacyPolicies.validationResults) {
+                if (!result.accessible) {
+                    const reason = result.error || `HTTP ${result.statusCode}`;
+                    recommendations.push(`- ${result.url}: ${reason}`);
+                }
+            }
+        }
         if (recommendations.length === 0) {
             recommendations.push("Manifest validation passed. All required fields are present and valid.");
         }

package/lib/services/assessment/modules/index.d.ts

@@ -30,4 +30,5 @@ export { ToolAnnotationAssessor } from "./ToolAnnotationAssessor.js";
 export { ProhibitedLibrariesAssessor } from "./ProhibitedLibrariesAssessor.js";
 export { ManifestValidationAssessor } from "./ManifestValidationAssessor.js";
 export { PortabilityAssessor } from "./PortabilityAssessor.js";
+export { ExternalAPIScannerAssessor } from "./ExternalAPIScannerAssessor.js";
 //# sourceMappingURL=index.d.ts.map

package/lib/services/assessment/modules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAGxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAGxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC"}

package/lib/services/assessment/modules/index.js

@@ -33,3 +33,4 @@ export { ToolAnnotationAssessor } from "./ToolAnnotationAssessor.js";
 export { ProhibitedLibrariesAssessor } from "./ProhibitedLibrariesAssessor.js";
 export { ManifestValidationAssessor } from "./ManifestValidationAssessor.js";
 export { PortabilityAssessor } from "./PortabilityAssessor.js";
+export { ExternalAPIScannerAssessor } from "./ExternalAPIScannerAssessor.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bryan-thompson/inspector-assessment-client",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Client-side application for the Enhanced MCP Inspector with assessment capabilities",
   "license": "MIT",
   "author": "Bryan Thompson <bryan@triepod.ai>",