@bryan-thompson/inspector-assessment-client 1.24.1 → 1.25.0

package/lib/services/assessment/modules/ProtocolConformanceAssessor.d.ts

@@ -15,11 +15,32 @@ import type { ProtocolConformanceAssessment } from "../../../lib/assessment/exte
 import { BaseAssessor } from "./BaseAssessor.js";
 import { AssessmentContext } from "../AssessmentOrchestrator.js";
 export declare class ProtocolConformanceAssessor extends BaseAssessor<ProtocolConformanceAssessment> {
+    /**
+     * Select representative tools for testing (first, middle, last for diversity)
+     */
+    private selectToolsForTesting;
+    /**
+     * Get MCP spec version from config or use default
+     */
+    private getSpecVersion;
+    /**
+     * Get base URL for MCP specification
+     */
+    private getSpecBaseUrl;
+    /**
+     * Get lifecycle spec URL
+     */
+    private getSpecLifecycleUrl;
+    /**
+     * Get tools spec URL
+     */
+    private getSpecToolsUrl;
     assess(context: AssessmentContext): Promise<ProtocolConformanceAssessment>;
     /**
      * Check 1: Error Response Format
      * Validates that error responses follow MCP protocol structure
      *
+     * Tests multiple tools (up to 3) for representative coverage.
      * Based on conformance's ToolsCallErrorScenario:
      * - isError flag must be true
      * - content must be an array

package/lib/services/assessment/modules/ProtocolConformanceAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProtocolConformanceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ProtocolConformanceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EACV,6BAA6B,EAE9B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AA2B9D,qBAAa,2BAA4B,SAAQ,YAAY,CAAC,6BAA6B,CAAC;IACpF,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,6BAA6B,CAAC;IAqCzC;;;;;;;;OAQG;YACW,wBAAwB;IAoGtC;;;;;OAKG;YACW,uBAAuB;IAkGrC;;;;;;;;OAQG;YACW,4BAA4B;IAkD1C;;OAEG;IACH,OAAO,CAAC,yBAAyB;IA6BjC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAmC3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CA2ChC"}
+{"version":3,"file":"ProtocolConformanceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ProtocolConformanceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EACV,6BAA6B,EAE9B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAmB9D,qBAAa,2BAA4B,SAAQ,YAAY,CAAC,6BAA6B,CAAC;IAC1F;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;OAEG;IACH,OAAO,CAAC,eAAe;IAIjB,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,6BAA6B,CAAC;IAqCzC;;;;;;;;;OASG;YACW,wBAAwB;IAoHtC;;;;;OAKG;YACW,uBAAuB;IAkGrC;;;;;;;;OAQG;YACW,4BAA4B;IAkD1C;;OAEG;IACH,OAAO,CAAC,yBAAyB;IA6BjC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAmC3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CA6ChC"}

package/lib/services/assessment/modules/ProtocolConformanceAssessor.js

@@ -12,13 +12,6 @@
  * @module assessment/modules/ProtocolConformanceAssessor
  */
 import { BaseAssessor } from "./BaseAssessor.js";
-// MCP specification references
-// NOTE: Update this URL when targeting a newer MCP spec version
-// See: https://modelcontextprotocol.io/specification for available versions
-const MCP_SPEC_VERSION = "2025-06-18";
-const MCP_SPEC_BASE = `https://modelcontextprotocol.io/specification/${MCP_SPEC_VERSION}`;
-const SPEC_LIFECYCLE = `${MCP_SPEC_BASE}/basic/lifecycle`;
-const SPEC_TOOLS = `${MCP_SPEC_BASE}/server/tools`;
 // Valid MCP content types
 const VALID_CONTENT_TYPES = [
     "text",
@@ -28,6 +21,39 @@ const VALID_CONTENT_TYPES = [
     "resource_link",
 ];
 export class ProtocolConformanceAssessor extends BaseAssessor {
+    /**
+     * Select representative tools for testing (first, middle, last for diversity)
+     */
+    selectToolsForTesting(tools, maxTools = 3) {
+        if (tools.length <= maxTools)
+            return tools;
+        const indices = [0, Math.floor(tools.length / 2), tools.length - 1];
+        return [...new Set(indices)].slice(0, maxTools).map((i) => tools[i]);
+    }
+    /**
+     * Get MCP spec version from config or use default
+     */
+    getSpecVersion() {
+        return this.config.mcpProtocolVersion || "2025-06";
+    }
+    /**
+     * Get base URL for MCP specification
+     */
+    getSpecBaseUrl() {
+        return `https://modelcontextprotocol.io/specification/${this.getSpecVersion()}`;
+    }
+    /**
+     * Get lifecycle spec URL
+     */
+    getSpecLifecycleUrl() {
+        return `${this.getSpecBaseUrl()}/basic/lifecycle`;
+    }
+    /**
+     * Get tools spec URL
+     */
+    getSpecToolsUrl() {
+        return `${this.getSpecBaseUrl()}/server/tools`;
+    }
     async assess(context) {
         this.logger.info("Starting protocol conformance assessment");
         // Run all protocol checks
@@ -60,96 +86,108 @@ export class ProtocolConformanceAssessor extends BaseAssessor {
      * Check 1: Error Response Format
      * Validates that error responses follow MCP protocol structure
      *
+     * Tests multiple tools (up to 3) for representative coverage.
      * Based on conformance's ToolsCallErrorScenario:
      * - isError flag must be true
      * - content must be an array
      * - content items must have type: "text" and text field
      */
     async checkErrorResponseFormat(context) {
-        try {
-            const testTool = context.tools[0];
-            if (!testTool) {
-                return {
-                    passed: false,
-                    confidence: "low",
-                    evidence: "No tools available to test error response format",
-                    specReference: SPEC_LIFECYCLE,
-                    warnings: ["Cannot validate error format without tools"],
-                };
-            }
-            // Call with parameters designed to cause an error
-            // (invalid param that doesn't match schema)
-            const result = await this.executeWithTimeout(context.callTool(testTool.name, {
-                __test_invalid_param__: "should_cause_error",
-            }), this.config.testTimeout);
-            // Validate MCP error response structure
-            const contentArray = Array.isArray(result.content) ? result.content : [];
-            const validations = {
-                hasIsErrorFlag: result.isError === true,
-                hasContentArray: Array.isArray(result.content),
-                contentNotEmpty: contentArray.length > 0,
-                firstContentHasType: contentArray[0]?.type !== undefined,
-                firstContentIsTextOrResource: contentArray[0]?.type === "text" ||
-                    contentArray[0]?.type === "resource",
-                hasErrorMessage: typeof contentArray[0]?.text === "string" &&
-                    contentArray[0].text.length > 0,
-            };
-            const passedValidations = Object.values(validations).filter((v) => v);
-            const allPassed = passedValidations.length === Object.keys(validations).length;
-            // If result is not an error, that's okay - the tool might have accepted the params
-            // In that case, we can't validate error format, but it's not a failure
-            if (!result.isError && contentArray.length > 0) {
-                return {
-                    passed: true,
-                    confidence: "medium",
-                    evidence: "Tool did not return an error with invalid params (may have accepted them). Content structure is valid.",
-                    specReference: SPEC_LIFECYCLE,
-                    details: {
-                        note: "Tool accepted test params without error - cannot validate error format",
-                        contentStructure: contentArray.map((c) => ({
-                            type: c.type,
-                        })),
-                    },
-                };
-            }
+        const testTools = this.selectToolsForTesting(context.tools, 3);
+        if (testTools.length === 0) {
             return {
-                passed: allPassed,
-                confidence: allPassed ? "high" : "medium",
-                evidence: `${passedValidations.length}/${Object.keys(validations).length} error format validations passed`,
-                specReference: SPEC_LIFECYCLE,
-                details: {
-                    validations,
-                    sampleResponse: {
-                        isError: result.isError,
-                        contentLength: contentArray.length,
-                        firstContentType: contentArray[0]?.type,
-                    },
-                },
-                warnings: allPassed
-                    ? undefined
-                    : [
-                        "Error response does not fully comply with MCP protocol format",
-                        "Ensure errors have isError: true and content array with text type",
-                    ],
+                passed: false,
+                confidence: "low",
+                evidence: "No tools available to test error response format",
+                specReference: this.getSpecLifecycleUrl(),
+                warnings: ["Cannot validate error format without tools"],
             };
         }
-        catch (error) {
-            // If the call threw an exception instead of returning an error response,
-            // that's also a protocol violation (but might be SDK-level)
-            return {
-                passed: false,
-                confidence: "medium",
-                evidence: "Tool threw exception instead of returning error response",
-                specReference: SPEC_LIFECYCLE,
-                details: {
+        // Test each selected tool and collect results
+        const results = [];
+        for (const testTool of testTools) {
+            try {
+                // Call with parameters designed to cause an error
+                const result = await this.executeWithTimeout(context.callTool(testTool.name, {
+                    __test_invalid_param__: "should_cause_error",
+                }), this.config.testTimeout);
+                // Validate MCP error response structure
+                const contentArray = Array.isArray(result.content)
+                    ? result.content
+                    : [];
+                const validations = {
+                    hasIsErrorFlag: result.isError === true,
+                    hasContentArray: Array.isArray(result.content),
+                    contentNotEmpty: contentArray.length > 0,
+                    firstContentHasType: contentArray[0]?.type !== undefined,
+                    firstContentIsTextOrResource: contentArray[0]?.type === "text" ||
+                        contentArray[0]?.type === "resource",
+                    hasErrorMessage: typeof contentArray[0]?.text === "string" &&
+                        contentArray[0].text.length > 0,
+                };
+                // Tool did not return error - might have accepted params
+                if (!result.isError && contentArray.length > 0) {
+                    results.push({
+                        toolName: testTool.name,
+                        passed: true,
+                        isErrorResponse: false,
+                        validations,
+                    });
+                }
+                else {
+                    const passedValidations = Object.values(validations).filter((v) => v);
+                    const allPassed = passedValidations.length === Object.keys(validations).length;
+                    results.push({
+                        toolName: testTool.name,
+                        passed: allPassed,
+                        isErrorResponse: true,
+                        validations,
+                    });
+                }
+            }
+            catch (error) {
+                // Tool threw exception instead of returning error response
+                results.push({
+                    toolName: testTool.name,
+                    passed: false,
+                    isErrorResponse: false,
                     error: error instanceof Error ? error.message : String(error),
-                },
-                warnings: [
-                    "Tools should return error responses, not throw exceptions",
-                    "This may be caused by transport-level issues or SDK handling",
-                ],
-            };
+                });
+            }
+        }
+        // Aggregate results
+        const errorResponseResults = results.filter((r) => r.isErrorResponse);
+        const passedCount = results.filter((r) => r.passed).length;
+        const allPassed = passedCount === results.length;
+        // Determine confidence based on error response coverage
+        let confidence;
+        if (errorResponseResults.length === 0) {
+            // No tools returned errors - all accepted invalid params
+            confidence = "medium";
         }
+        else if (allPassed) {
+            confidence = "high";
+        }
+        else {
+            confidence = "medium";
+        }
+        return {
+            passed: allPassed,
+            confidence,
+            evidence: `Tested ${results.length} tool(s): ${passedCount}/${results.length} passed error format validation`,
+            specReference: this.getSpecLifecycleUrl(),
+            details: {
+                toolResults: results,
+                testedToolCount: results.length,
+                errorResponseCount: errorResponseResults.length,
+            },
+            warnings: allPassed
+                ? undefined
+                : [
+                    "Error response format issues detected in some tools",
+                    "Ensure all errors have isError: true and content array with text type",
+                ],
+        };
     }
     /**
      * Check 2: Content Type Support
@@ -165,7 +203,7 @@ export class ProtocolConformanceAssessor extends BaseAssessor {
                     passed: false,
                     confidence: "low",
                     evidence: "No tools available to test content types",
-                    specReference: SPEC_TOOLS,
+                    specReference: this.getSpecToolsUrl(),
                 };
             }
             // Check if tool has required params - if so, we can't easily test
@@ -178,7 +216,7 @@ export class ProtocolConformanceAssessor extends BaseAssessor {
                     passed: true,
                     confidence: "low",
                     evidence: "Cannot test content types without knowing valid parameters - tool has required params",
-                    specReference: SPEC_TOOLS,
+                    specReference: this.getSpecToolsUrl(),
                     warnings: [
                         "Content type validation requires valid tool parameters",
                         "Consider adding a tool without required params for protocol testing",
@@ -204,7 +242,7 @@ export class ProtocolConformanceAssessor extends BaseAssessor {
                 passed: allPassed,
                 confidence: allPassed ? "high" : "medium",
                 evidence: `${passedValidations.length}/${Object.keys(validations).length} content type checks passed`,
-                specReference: SPEC_TOOLS,
+                specReference: this.getSpecToolsUrl(),
                 details: {
                     validations,
                     detectedContentTypes: detectedTypes,
@@ -220,7 +258,7 @@ export class ProtocolConformanceAssessor extends BaseAssessor {
                 passed: false,
                 confidence: "medium",
                 evidence: "Could not test content types due to error",
-                specReference: SPEC_TOOLS,
+                specReference: this.getSpecToolsUrl(),
                 details: {
                     error: error instanceof Error ? error.message : String(error),
                 },
@@ -254,7 +292,7 @@ export class ProtocolConformanceAssessor extends BaseAssessor {
             passed: hasMinimumInfo,
             confidence: allPassed ? "high" : "medium",
             evidence: `${passedValidations.length}/${Object.keys(validations).length} initialization checks passed`,
-            specReference: SPEC_LIFECYCLE,
+            specReference: this.getSpecLifecycleUrl(),
             details: {
                 validations,
                 serverInfo: {
@@ -351,7 +389,7 @@ export class ProtocolConformanceAssessor extends BaseAssessor {
             recommendations.push("Protocol conformance is good. Consider testing with official @modelcontextprotocol/conformance suite for comprehensive validation.");
         }
         else {
-            recommendations.push(`Review MCP specification: ${MCP_SPEC_BASE}/`);
+            recommendations.push(`Review MCP specification: ${this.getSpecBaseUrl()}/`);
         }
         return recommendations;
     }

package/lib/services/assessment/modules/index.d.ts

@@ -2,36 +2,82 @@
  * MCP Server Assessment Modules
  *
  * This module exports all assessors for comprehensive MCP server evaluation.
+ * Modules are organized into 4 tiers based on assessment purpose.
  *
- * Original Assessors (from MCP Inspector):
+ * ## Module Tier Organization (v1.25.0+)
+ *
+ * ### Tier 1: Core Security (Always Run) - 6 modules
  * - FunctionalityAssessor - Tests tool execution and response handling
- * - DocumentationAssessor - Evaluates README and tool documentation
  * - SecurityAssessor - Checks for security vulnerabilities
+ * - TemporalAssessor - Detects rug pull vulnerabilities
  * - ErrorHandlingAssessor - Tests error handling patterns
- * - UsabilityAssessor - Evaluates tool naming and schemas
- * - MCPSpecComplianceAssessor - Verifies MCP specification compliance
+ * - ProtocolComplianceAssessor - MCP protocol + JSON-RPC validation (NEW)
+ * - AUPComplianceAssessor - Checks for Acceptable Use Policy violations
  *
- * MCP Directory Compliance Assessors (new):
- * - AUPComplianceAssessor - Checks for Acceptable Use Policy violations (14 categories)
+ * ### Tier 2: Compliance (MCP Directory) - 4 modules
  * - ToolAnnotationAssessor - Verifies tool annotations per Policy #17
  * - ProhibitedLibrariesAssessor - Detects prohibited libraries per Policy #28-30
  * - ManifestValidationAssessor - Validates MCPB manifest.json
+ * - AuthenticationAssessor - OAuth and authentication evaluation
+ *
+ * ### Tier 3: Capability-Based (Conditional) - 3 modules
+ * - ResourceAssessor - Resource security assessment
+ * - PromptAssessor - Prompt security assessment
+ * - CrossCapabilitySecurityAssessor - Cross-capability attack chains
+ *
+ * ### Tier 4: Extended (Optional) - 3 modules
+ * - DeveloperExperienceAssessor - Documentation + usability assessment (NEW)
  * - PortabilityAssessor - Checks for portability issues
- * - TemporalAssessor - Detects rug pull vulnerabilities (temporal behavior changes)
+ * - ExternalAPIScannerAssessor - External API detection
+ *
+ * ## Deprecated Modules (v1.25.0+)
+ * The following modules are deprecated and will be removed in v2.0.0:
+ * - DocumentationAssessor → use DeveloperExperienceAssessor
+ * - UsabilityAssessor → use DeveloperExperienceAssessor
+ * - MCPSpecComplianceAssessor → use ProtocolComplianceAssessor
+ * - ProtocolConformanceAssessor → use ProtocolComplianceAssessor
+ *
+ * @module assessment/modules
  */
 export { BaseAssessor } from "./BaseAssessor.js";
 export { FunctionalityAssessor } from "./FunctionalityAssessor.js";
-export { DocumentationAssessor } from "./DocumentationAssessor.js";
 export { SecurityAssessor } from "./SecurityAssessor.js";
+export { TemporalAssessor } from "./TemporalAssessor.js";
 export { ErrorHandlingAssessor } from "./ErrorHandlingAssessor.js";
-export { UsabilityAssessor } from "./UsabilityAssessor.js";
-export { MCPSpecComplianceAssessor } from "./MCPSpecComplianceAssessor.js";
+export { ProtocolComplianceAssessor } from "./ProtocolComplianceAssessor.js";
 export { AUPComplianceAssessor } from "./AUPComplianceAssessor.js";
 export { ToolAnnotationAssessor } from "./ToolAnnotationAssessor.js";
 export { ProhibitedLibrariesAssessor } from "./ProhibitedLibrariesAssessor.js";
 export { ManifestValidationAssessor } from "./ManifestValidationAssessor.js";
+export { AuthenticationAssessor } from "./AuthenticationAssessor.js";
+export { ResourceAssessor } from "./ResourceAssessor.js";
+export { PromptAssessor } from "./PromptAssessor.js";
+export { CrossCapabilitySecurityAssessor } from "./CrossCapabilitySecurityAssessor.js";
+export { DeveloperExperienceAssessor } from "./DeveloperExperienceAssessor.js";
 export { PortabilityAssessor } from "./PortabilityAssessor.js";
 export { ExternalAPIScannerAssessor } from "./ExternalAPIScannerAssessor.js";
-export { TemporalAssessor } from "./TemporalAssessor.js";
+/**
+ * @deprecated Use DeveloperExperienceAssessor instead.
+ * DocumentationAssessor has been merged into DeveloperExperienceAssessor.
+ * This export will be removed in v2.0.0.
+ */
+export { DocumentationAssessor } from "./DocumentationAssessor.js";
+/**
+ * @deprecated Use DeveloperExperienceAssessor instead.
+ * UsabilityAssessor has been merged into DeveloperExperienceAssessor.
+ * This export will be removed in v2.0.0.
+ */
+export { UsabilityAssessor } from "./UsabilityAssessor.js";
+/**
+ * @deprecated Use ProtocolComplianceAssessor instead.
+ * MCPSpecComplianceAssessor has been merged into ProtocolComplianceAssessor.
+ * This export will be removed in v2.0.0.
+ */
+export { MCPSpecComplianceAssessor } from "./MCPSpecComplianceAssessor.js";
+/**
+ * @deprecated Use ProtocolComplianceAssessor instead.
+ * ProtocolConformanceAssessor has been merged into ProtocolComplianceAssessor.
+ * This export will be removed in v2.0.0.
+ */
 export { ProtocolConformanceAssessor } from "./ProtocolConformanceAssessor.js";
 //# sourceMappingURL=index.d.ts.map

package/lib/services/assessment/modules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAGxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAM9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAMhE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAMlE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAMpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAM1E;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE;;;;GAIG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC"}

package/lib/services/assessment/modules/index.js

@@ -2,39 +2,97 @@
  * MCP Server Assessment Modules
  *
  * This module exports all assessors for comprehensive MCP server evaluation.
+ * Modules are organized into 4 tiers based on assessment purpose.
  *
- * Original Assessors (from MCP Inspector):
+ * ## Module Tier Organization (v1.25.0+)
+ *
+ * ### Tier 1: Core Security (Always Run) - 6 modules
  * - FunctionalityAssessor - Tests tool execution and response handling
- * - DocumentationAssessor - Evaluates README and tool documentation
  * - SecurityAssessor - Checks for security vulnerabilities
+ * - TemporalAssessor - Detects rug pull vulnerabilities
  * - ErrorHandlingAssessor - Tests error handling patterns
- * - UsabilityAssessor - Evaluates tool naming and schemas
- * - MCPSpecComplianceAssessor - Verifies MCP specification compliance
+ * - ProtocolComplianceAssessor - MCP protocol + JSON-RPC validation (NEW)
+ * - AUPComplianceAssessor - Checks for Acceptable Use Policy violations
  *
- * MCP Directory Compliance Assessors (new):
- * - AUPComplianceAssessor - Checks for Acceptable Use Policy violations (14 categories)
+ * ### Tier 2: Compliance (MCP Directory) - 4 modules
  * - ToolAnnotationAssessor - Verifies tool annotations per Policy #17
  * - ProhibitedLibrariesAssessor - Detects prohibited libraries per Policy #28-30
  * - ManifestValidationAssessor - Validates MCPB manifest.json
+ * - AuthenticationAssessor - OAuth and authentication evaluation
+ *
+ * ### Tier 3: Capability-Based (Conditional) - 3 modules
+ * - ResourceAssessor - Resource security assessment
+ * - PromptAssessor - Prompt security assessment
+ * - CrossCapabilitySecurityAssessor - Cross-capability attack chains
+ *
+ * ### Tier 4: Extended (Optional) - 3 modules
+ * - DeveloperExperienceAssessor - Documentation + usability assessment (NEW)
  * - PortabilityAssessor - Checks for portability issues
- * - TemporalAssessor - Detects rug pull vulnerabilities (temporal behavior changes)
+ * - ExternalAPIScannerAssessor - External API detection
+ *
+ * ## Deprecated Modules (v1.25.0+)
+ * The following modules are deprecated and will be removed in v2.0.0:
+ * - DocumentationAssessor → use DeveloperExperienceAssessor
+ * - UsabilityAssessor → use DeveloperExperienceAssessor
+ * - MCPSpecComplianceAssessor → use ProtocolComplianceAssessor
+ * - ProtocolConformanceAssessor → use ProtocolComplianceAssessor
+ *
+ * @module assessment/modules
  */
 // Base class
 export { BaseAssessor } from "./BaseAssessor.js";
-// Original MCP Inspector Assessors
+// ============================================================================
+// Tier 1: Core Security (Always Run)
+// ============================================================================
 export { FunctionalityAssessor } from "./FunctionalityAssessor.js";
-export { DocumentationAssessor } from "./DocumentationAssessor.js";
 export { SecurityAssessor } from "./SecurityAssessor.js";
+export { TemporalAssessor } from "./TemporalAssessor.js";
 export { ErrorHandlingAssessor } from "./ErrorHandlingAssessor.js";
-export { UsabilityAssessor } from "./UsabilityAssessor.js";
-export { MCPSpecComplianceAssessor } from "./MCPSpecComplianceAssessor.js";
-// MCP Directory Compliance Assessors
+export { ProtocolComplianceAssessor } from "./ProtocolComplianceAssessor.js";
 export { AUPComplianceAssessor } from "./AUPComplianceAssessor.js";
+// ============================================================================
+// Tier 2: Compliance (MCP Directory)
+// ============================================================================
 export { ToolAnnotationAssessor } from "./ToolAnnotationAssessor.js";
 export { ProhibitedLibrariesAssessor } from "./ProhibitedLibrariesAssessor.js";
 export { ManifestValidationAssessor } from "./ManifestValidationAssessor.js";
+export { AuthenticationAssessor } from "./AuthenticationAssessor.js";
+// ============================================================================
+// Tier 3: Capability-Based (Conditional)
+// ============================================================================
+export { ResourceAssessor } from "./ResourceAssessor.js";
+export { PromptAssessor } from "./PromptAssessor.js";
+export { CrossCapabilitySecurityAssessor } from "./CrossCapabilitySecurityAssessor.js";
+// ============================================================================
+// Tier 4: Extended (Optional)
+// ============================================================================
+export { DeveloperExperienceAssessor } from "./DeveloperExperienceAssessor.js";
 export { PortabilityAssessor } from "./PortabilityAssessor.js";
 export { ExternalAPIScannerAssessor } from "./ExternalAPIScannerAssessor.js";
-export { TemporalAssessor } from "./TemporalAssessor.js";
-// Protocol Conformance Assessor
+// ============================================================================
+// Deprecated Exports (backward compatibility - will be removed in v2.0.0)
+// ============================================================================
+/**
+ * @deprecated Use DeveloperExperienceAssessor instead.
+ * DocumentationAssessor has been merged into DeveloperExperienceAssessor.
+ * This export will be removed in v2.0.0.
+ */
+export { DocumentationAssessor } from "./DocumentationAssessor.js";
+/**
+ * @deprecated Use DeveloperExperienceAssessor instead.
+ * UsabilityAssessor has been merged into DeveloperExperienceAssessor.
+ * This export will be removed in v2.0.0.
+ */
+export { UsabilityAssessor } from "./UsabilityAssessor.js";
+/**
+ * @deprecated Use ProtocolComplianceAssessor instead.
+ * MCPSpecComplianceAssessor has been merged into ProtocolComplianceAssessor.
+ * This export will be removed in v2.0.0.
+ */
+export { MCPSpecComplianceAssessor } from "./MCPSpecComplianceAssessor.js";
+/**
+ * @deprecated Use ProtocolComplianceAssessor instead.
+ * ProtocolConformanceAssessor has been merged into ProtocolComplianceAssessor.
+ * This export will be removed in v2.0.0.
+ */
 export { ProtocolConformanceAssessor } from "./ProtocolConformanceAssessor.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bryan-thompson/inspector-assessment-client",
-  "version": "1.24.1",
+  "version": "1.25.0",
   "description": "Client-side application for the Enhanced MCP Inspector with assessment capabilities",
   "license": "MIT",
   "author": "Bryan Thompson <bryan@triepod.ai>",