@bryan-thompson/inspector-assessment-client 1.26.6 → 1.27.0

package/lib/services/assessment/modules/ErrorHandlingAssessor.js

@@ -4,9 +4,18 @@
  */
 import { BaseAssessor } from "./BaseAssessor.js";
 import { createConcurrencyLimit } from "../lib/concurrencyLimit.js";
+import { ExecutionArtifactDetector } from "./securityTests/ExecutionArtifactDetector.js";
+import { SafeResponseDetector } from "./securityTests/SafeResponseDetector.js";
 export class ErrorHandlingAssessor extends BaseAssessor {
+    executionDetector;
+    safeResponseDetector;
+    constructor(config) {
+        super(config);
+        this.executionDetector = new ExecutionArtifactDetector();
+        this.safeResponseDetector = new SafeResponseDetector();
+    }
     async assess(context) {
-        this.log("Starting error handling assessment");
+        this.logger.info("Starting error handling assessment");
         const testDetails = [];
         let passedTests = 0;
         // Test a sample of tools for error handling
@@ -14,7 +23,7 @@ export class ErrorHandlingAssessor extends BaseAssessor {
         // Parallel tool testing with concurrency limit
         const concurrency = this.config.maxParallelTests ?? 5;
         const limit = createConcurrencyLimit(concurrency, this.logger);
-        this.log(`Testing ${toolsToTest.length} tools for error handling with concurrency limit of ${concurrency}`);
+        this.logger.info(`Testing ${toolsToTest.length} tools for error handling with concurrency limit of ${concurrency}`);
         const allToolTests = await Promise.all(toolsToTest.map((tool) => limit(async () => {
             const toolTests = await this.testToolErrorHandling(tool, context.callTool);
             // Add delay between tests to avoid rate limiting
@@ -50,34 +59,34 @@ export class ErrorHandlingAssessor extends BaseAssessor {
         if (this.config.selectedToolsForTesting !== undefined) {
             // Warn if deprecated maxToolsToTestForErrors is also set
             if (this.config.maxToolsToTestForErrors !== undefined) {
-                this.log(`Warning: Both selectedToolsForTesting and maxToolsToTestForErrors are set. ` +
+                this.logger.info(`Warning: Both selectedToolsForTesting and maxToolsToTestForErrors are set. ` +
                     `Using selectedToolsForTesting (maxToolsToTestForErrors is deprecated).`);
             }
             const selectedNames = new Set(this.config.selectedToolsForTesting);
             const selectedTools = tools.filter((tool) => selectedNames.has(tool.name));
             // Empty array means user explicitly selected 0 tools
             if (this.config.selectedToolsForTesting.length === 0) {
-                this.log(`User selected 0 tools for error handling - skipping tests`);
+                this.logger.info(`User selected 0 tools for error handling - skipping tests`);
                 return [];
             }
             // If no tools matched the names (config out of sync), log warning but respect selection
             if (selectedTools.length === 0) {
-                this.log(`Warning: No tools matched selection (${this.config.selectedToolsForTesting.join(", ")})`);
+                this.logger.info(`Warning: No tools matched selection (${this.config.selectedToolsForTesting.join(", ")})`);
                 return [];
             }
-            this.log(`Testing ${selectedTools.length} selected tools out of ${tools.length} for error handling`);
+            this.logger.info(`Testing ${selectedTools.length} selected tools out of ${tools.length} for error handling`);
             return selectedTools;
         }
         // Backward compatibility: use old maxToolsToTestForErrors configuration
         const configLimit = this.config.maxToolsToTestForErrors;
         // If -1, test all tools
         if (configLimit === -1) {
-            this.log(`Testing all ${tools.length} tools for error handling`);
+            this.logger.info(`Testing all ${tools.length} tools for error handling`);
             return tools;
         }
         // Otherwise use the configured limit (default to 5 if not set)
         const maxTools = Math.min(configLimit ?? 5, tools.length);
-        this.log(`Testing ${maxTools} out of ${tools.length} tools for error handling`);
+        this.logger.info(`Testing ${maxTools} out of ${tools.length} tools for error handling`);
         return tools.slice(0, maxTools);
     }
     async testToolErrorHandling(tool, callTool) {
@@ -428,17 +437,122 @@ export class ErrorHandlingAssessor extends BaseAssessor {
         return params;
     }
     // isErrorResponse and extractErrorInfo moved to BaseAssessor for reuse across all assessors
+    /**
+     * Analyze invalid_values response to determine scoring impact
+     * Issue #99: Contextual empty string validation scoring
+     *
+     * Classifications:
+     * - safe_rejection: Tool rejected with error (no penalty)
+     * - safe_reflection: Tool stored/echoed without executing (no penalty)
+     * - defensive_programming: Tool handled gracefully (no penalty)
+     * - execution_detected: Tool executed input (penalty)
+     * - unknown: Cannot determine (partial penalty)
+     */
+    analyzeInvalidValuesResponse(test) {
+        const responseText = this.extractResponseTextSafe(test.actualResponse.rawResponse);
+        // Case 1: Tool rejected with error - best case (no penalty)
+        if (test.actualResponse.isError) {
+            return {
+                shouldPenalize: false,
+                penaltyAmount: 0,
+                classification: "safe_rejection",
+                reason: "Tool properly rejected invalid input",
+            };
+        }
+        // Case 2: Defensive programming patterns (no penalty)
+        // Check BEFORE execution detection because patterns like "query returned 0"
+        // might match execution indicators but are actually safe
+        if (this.isDefensiveProgrammingResponse(responseText)) {
+            return {
+                shouldPenalize: false,
+                penaltyAmount: 0,
+                classification: "defensive_programming",
+                reason: "Tool handled empty input defensively",
+            };
+        }
+        // Case 3: Safe reflection patterns (no penalty)
+        if (this.safeResponseDetector.isReflectionResponse(responseText)) {
+            return {
+                shouldPenalize: false,
+                penaltyAmount: 0,
+                classification: "safe_reflection",
+                reason: "Tool safely reflected input without execution",
+            };
+        }
+        // Case 4: Check for execution evidence - VULNERABLE (full penalty)
+        if (this.executionDetector.hasExecutionEvidence(responseText) ||
+            this.executionDetector.detectExecutionArtifacts(responseText)) {
+            return {
+                shouldPenalize: true,
+                penaltyAmount: 100,
+                classification: "execution_detected",
+                reason: "Tool executed input without validation",
+            };
+        }
+        // Case 5: Unknown - partial penalty for manual review
+        return {
+            shouldPenalize: true,
+            penaltyAmount: 25,
+            classification: "unknown",
+            reason: "Unable to determine safety - manual review recommended",
+        };
+    }
+    /**
+     * Safely extract response text from various response formats
+     */
+    extractResponseTextSafe(rawResponse) {
+        if (typeof rawResponse === "string")
+            return rawResponse;
+        if (rawResponse && typeof rawResponse === "object") {
+            const resp = rawResponse;
+            if (resp.content && Array.isArray(resp.content)) {
+                return resp.content
+                    .map((c) => (c.type === "text" ? c.text : ""))
+                    .join(" ");
+            }
+            return JSON.stringify(rawResponse);
+        }
+        return String(rawResponse || "");
+    }
+    /**
+     * Check for defensive programming patterns - tool accepted but caused no harm
+     * Examples: "Deleted 0 keys", "No results found", "Query returned 0"
+     */
+    isDefensiveProgrammingResponse(responseText) {
+        // Patterns for safe "no-op" responses where tool handled empty input gracefully
+        // Use word boundaries (\b) to avoid matching numbers like "10" or "15"
+        const patterns = [
+            /deleted\s+0\s+(keys?|records?|rows?|items?)/i,
+            /no\s+(results?|matches?|items?)\s+found/i,
+            /\b0\s+items?\s+(deleted|updated|processed)/i, // \b prevents matching "10 items"
+            /nothing\s+to\s+(delete|update|process)/i,
+            /empty\s+(result|response|query)/i,
+            /no\s+action\s+taken/i,
+            /query\s+returned\s+0\b/i, // \b prevents matching "query returned 05" etc.
+        ];
+        return patterns.some((p) => p.test(responseText));
+    }
     calculateMetrics(tests, _passed) {
         // Calculate enhanced score with bonus points for quality
         let enhancedScore = 0;
         let maxPossibleScore = 0;
         tests.forEach((test) => {
-            // Phase 1: Exclude "invalid_values" tests from scoring (informational only)
-            // Reason: These tests penalize tools that handle edge cases gracefully (empty strings, etc.)
-            // Instead of rejecting them, which is often correct defensive programming.
-            // Real schema violations will be tested separately in Phase 2+.
+            // Issue #99: Contextual scoring for invalid_values tests
+            // Instead of blanket exclusion, analyze response patterns to determine if
+            // the tool safely handled empty strings (defensive programming, reflection)
+            // or if it executed without validation (security concern).
             if (test.testType === "invalid_values") {
-                return; // Skip scoring, but still included in testDetails
+                const analysis = this.analyzeInvalidValuesResponse(test);
+                if (!analysis.shouldPenalize) {
+                    // Safe response (rejection, reflection, or defensive programming)
+                    // Skip scoring to preserve backward compatibility for well-behaved tools
+                    return;
+                }
+                // Execution detected or unknown - include in scoring with penalty
+                maxPossibleScore += 100;
+                const scoreEarned = 100 * (1 - analysis.penaltyAmount / 100);
+                enhancedScore += test.passed ? scoreEarned : 0;
+                return;
             }
             maxPossibleScore += 100; // Base score for each test
             if (test.passed) {

package/lib/services/assessment/modules/ExternalAPIScannerAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ExternalAPIScannerAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ExternalAPIScannerAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAEV,4BAA4B,EAE7B,MAAM,uBAAuB,CAAC;AAmE/B,qBAAa,0BAA2B,SAAQ,YAAY;IACpD,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,CAAC;IA6DxC;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACH,OAAO,CAAC,eAAe;IA0BvB;;OAEG;IACH,OAAO,CAAC,aAAa;IAIrB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAIhB;;OAEG;IACH,OAAO,CAAC,eAAe;IASvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAsBxB;;OAEG;IACH,OAAO,CAAC,aAAa;IAcrB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAyB3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA2B/B;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAa7B"}
+{"version":3,"file":"ExternalAPIScannerAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ExternalAPIScannerAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAEV,4BAA4B,EAE7B,MAAM,uBAAuB,CAAC;AAmE/B,qBAAa,0BAA2B,SAAQ,YAAY;IACpD,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,CAAC;IA+DxC;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACH,OAAO,CAAC,eAAe;IA0BvB;;OAEG;IACH,OAAO,CAAC,aAAa;IAIrB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAIhB;;OAEG;IACH,OAAO,CAAC,eAAe;IASvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAsBxB;;OAEG;IACH,OAAO,CAAC,aAAa;IAcrB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAyB3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA2B/B;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAa7B"}

package/lib/services/assessment/modules/ExternalAPIScannerAssessor.js

@@ -74,13 +74,13 @@ const SKIP_FILE_PATTERNS = [
 ];
 export class ExternalAPIScannerAssessor extends BaseAssessor {
     async assess(context) {
-        this.log("Starting external API scanner assessment");
+        this.logger.info("Starting external API scanner assessment");
         this.resetTestCount();
         const detectedAPIs = [];
         let scannedFiles = 0;
         // Check if source code analysis is enabled
         if (!context.sourceCodeFiles || !context.config.enableSourceCodeAnalysis) {
-            this.log("Source code analysis not enabled, skipping external API scan");
+            this.logger.info("Source code analysis not enabled, skipping external API scan");
             return this.createNoSourceResult();
         }
         // Scan each source file
@@ -100,7 +100,7 @@ export class ExternalAPIScannerAssessor extends BaseAssessor {
         const status = this.computeStatus(detectedAPIs, affiliationWarning);
         const explanation = this.generateExplanation(detectedAPIs, uniqueServices, affiliationWarning, scannedFiles);
         const recommendations = this.generateRecommendations(uniqueServices, affiliationWarning);
-        this.log(`External API scan complete: ${detectedAPIs.length} APIs found in ${scannedFiles} files`);
+        this.logger.info(`External API scan complete: ${detectedAPIs.length} APIs found in ${scannedFiles} files`);
         return {
             detectedAPIs,
             uniqueServices,

package/lib/services/assessment/modules/FunctionalityAssessor.js

@@ -23,23 +23,23 @@ export class FunctionalityAssessor extends BaseAssessor {
             const selectedTools = tools.filter((tool) => selectedNames.has(tool.name));
             // Empty array means user explicitly selected 0 tools
             if (this.config.selectedToolsForTesting.length === 0) {
-                this.log(`User selected 0 tools for functionality testing - skipping tests`);
+                this.logger.info(`User selected 0 tools for functionality testing - skipping tests`);
                 return [];
             }
             // If no tools matched the names (config out of sync), log warning but respect selection
             if (selectedTools.length === 0) {
-                this.log(`Warning: No tools matched selection (${this.config.selectedToolsForTesting.join(", ")})`);
+                this.logger.info(`Warning: No tools matched selection (${this.config.selectedToolsForTesting.join(", ")})`);
                 return [];
             }
-            this.log(`Testing ${selectedTools.length} selected tools out of ${tools.length} for functionality`);
+            this.logger.info(`Testing ${selectedTools.length} selected tools out of ${tools.length} for functionality`);
             return selectedTools;
         }
         // Default: test all tools
-        this.log(`Testing all ${tools.length} tools for functionality`);
+        this.logger.info(`Testing all ${tools.length} tools for functionality`);
         return tools;
     }
     async assess(context) {
-        this.log(`Starting functionality assessment${this.config.reviewerMode ? " (reviewer mode - quick verification)" : ""}`);
+        this.logger.info(`Starting functionality assessment${this.config.reviewerMode ? " (reviewer mode - quick verification)" : ""}`);
         const toolResults = [];
         const brokenTools = [];
         let workingTools = 0;
@@ -71,7 +71,7 @@ export class FunctionalityAssessor extends BaseAssessor {
             batchCount = 0;
             lastBatchTime = Date.now();
         };
-        this.log(`Testing ${toolsToTest.length} tools with concurrency limit of ${concurrency}`);
+        this.logger.info(`Testing ${toolsToTest.length} tools with concurrency limit of ${concurrency}`);
         const results = await Promise.all(toolsToTest.map((tool) => limit(async () => {
             this.testCount++;
             completedTests++;
@@ -103,7 +103,7 @@ export class FunctionalityAssessor extends BaseAssessor {
             else if (result.status === "broken") {
                 brokenTools.push(result.toolName);
                 if (this.config.skipBrokenTools) {
-                    this.log(`Skipping further tests for broken tool: ${result.toolName}`);
+                    this.logger.info(`Skipping further tests for broken tool: ${result.toolName}`);
                 }
             }
         }
@@ -141,7 +141,7 @@ export class FunctionalityAssessor extends BaseAssessor {
             const cleanedParams = schema
                 ? cleanParams(testParams, schema)
                 : testParams;
-            this.log(`Testing tool: ${tool.name} with params: ${JSON.stringify(cleanedParams)}`);
+            this.logger.info(`Testing tool: ${tool.name} with params: ${JSON.stringify(cleanedParams)}`);
             // Execute tool with timeout
             const response = await this.executeWithTimeout(callTool(tool.name, cleanedParams), this.config.testTimeout);
             const executionTime = Date.now() - startTime;
@@ -197,7 +197,7 @@ export class FunctionalityAssessor extends BaseAssessor {
             };
         }
         catch (error) {
-            this.logError(`Tool execution failed: ${tool.name}`, error);
+            this.logger.error(`Tool execution failed: ${tool.name}`, { error });
             return {
                 toolName: tool.name,
                 tested: true,

package/lib/services/assessment/modules/MCPSpecComplianceAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MCPSpecComplianceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/MCPSpecComplianceAssessor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,2BAA2B,EAM3B,uBAAuB,EAKxB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,YAAY;IACzD,OAAO,CAAC,GAAG,CAAc;gBAEb,MAAM,EAAE,uBAAuB;IAa3C;;;OAGG;IACG,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,2BAA2B,CAAC;IAyHvC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;OAGG;YACW,sBAAsB;IA6BpC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAyB/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;;OAGG;YACW,mBAAmB;IAsCjC;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAoDnC;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IA0FnC;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAyFjC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAsB/B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA4B9B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA2C7B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAoF5B;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAyBjC;;OAEG;IACH,OAAO,CAAC,6BAA6B;CA0DtC"}
+{"version":3,"file":"MCPSpecComplianceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/MCPSpecComplianceAssessor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,2BAA2B,EAM3B,uBAAuB,EAKxB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,YAAY;IACzD,OAAO,CAAC,GAAG,CAAc;gBAEb,MAAM,EAAE,uBAAuB;IAa3C;;;OAGG;IACG,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,2BAA2B,CAAC;IAyHvC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA4B9B;;;OAGG;YACW,sBAAsB;IA6BpC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAyB/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;;OAGG;YACW,mBAAmB;IAsCjC;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAoDnC;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IA8FnC;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAyFjC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAsB/B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA4B9B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA2C7B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAoF5B;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAyBjC;;OAEG;IACH,OAAO,CAAC,6BAA6B;CA0DtC"}

package/lib/services/assessment/modules/MCPSpecComplianceAssessor.js

@@ -90,7 +90,7 @@ export class MCPSpecComplianceAssessor extends BaseAssessor {
         const totalChecks = checksArray.length;
         const complianceScore = (passedCount / totalChecks) * 100;
         // Log score/check consistency for debugging
-        this.log(`MCP Compliance: ${passedCount}/${totalChecks} checks passed (${complianceScore.toFixed(1)}%)`);
+        this.logger.info(`MCP Compliance: ${passedCount}/${totalChecks} checks passed (${complianceScore.toFixed(1)}%)`);
         // Determine status based on protocol checks only
         let status;
         if (!protocolChecks.serverInfoValidity.passed) {
@@ -135,16 +135,16 @@ export class MCPSpecComplianceAssessor extends BaseAssessor {
         const metadata = context.serverInfo?.metadata;
         const protocolVersion = metadata?.protocolVersion;
         if (protocolVersion) {
-            this.log(`Using protocol version from metadata: ${protocolVersion}`);
+            this.logger.info(`Using protocol version from metadata: ${protocolVersion}`);
             return protocolVersion;
         }
         // Fall back to server version
         if (context.serverInfo?.version) {
-            this.log(`Using server version as protocol version: ${context.serverInfo.version}`);
+            this.logger.info(`Using server version as protocol version: ${context.serverInfo.version}`);
             return context.serverInfo.version;
         }
         // Default if no version information available
-        this.log("No protocol version information available, using default");
+        this.logger.info("No protocol version information available, using default");
         return "2025-06-18"; // Current MCP spec version as fallback
     }
     /**
@@ -183,14 +183,14 @@ export class MCPSpecComplianceAssessor extends BaseAssessor {
         // Check if name is properly set (should be a string, not null/undefined)
         if (serverInfo.name !== undefined && serverInfo.name !== null) {
             if (typeof serverInfo.name !== "string") {
-                this.log("Server info name is not a string");
+                this.logger.info("Server info name is not a string");
                 return false;
             }
         }
         // Check if metadata is properly formatted (should be an object if present)
         if (serverInfo.metadata !== undefined && serverInfo.metadata !== null) {
             if (typeof serverInfo.metadata !== "object") {
-                this.log("Server info metadata is not an object");
+                this.logger.info("Server info metadata is not an object");
                 return false;
             }
         }
@@ -297,7 +297,7 @@ export class MCPSpecComplianceAssessor extends BaseAssessor {
         const totalTools = tools.length;
         const coveragePercent = totalTools > 0 ? Math.round((withOutputSchema / totalTools) * 100) : 0;
         // Log for debugging
-        this.log(`Structured output support: ${withOutputSchema}/${totalTools} tools (${coveragePercent}%)`);
+        this.logger.info(`Structured output support: ${withOutputSchema}/${totalTools} tools (${coveragePercent}%)`);
         const coverage = {
             totalTools,
             withOutputSchema,
@@ -344,11 +344,11 @@ export class MCPSpecComplianceAssessor extends BaseAssessor {
             }
             // Check listChanged notification support
             if (capabilities.resources.listChanged) {
-                this.log("Server declares resources.listChanged notification support");
+                this.logger.info("Server declares resources.listChanged notification support");
             }
             // Check subscribe support
             if (capabilities.resources.subscribe) {
-                this.log("Server declares resource subscription support");
+                this.logger.info("Server declares resource subscription support");
             }
             this.testCount++;
         }
@@ -362,13 +362,13 @@ export class MCPSpecComplianceAssessor extends BaseAssessor {
             }
             // Check listChanged notification support
             if (capabilities.prompts.listChanged) {
-                this.log("Server declares prompts.listChanged notification support");
+                this.logger.info("Server declares prompts.listChanged notification support");
             }
             this.testCount++;
         }
         // Check logging capability
         if (capabilities.logging) {
-            this.log("Server declares logging capability");
+            this.logger.info("Server declares logging capability");
             this.testCount++;
         }
         // Determine pass/fail
@@ -433,7 +433,7 @@ export class MCPSpecComplianceAssessor extends BaseAssessor {
             (transport === "http" || transport === "streamable-http")) {
             // For HTTP transport on 2025-06-18+, headers are required
             // We assume compliance if using the new protocol version
-            this.log(`HTTP transport detected with protocol ${protocolVersion} - header compliance assumed`);
+            this.logger.info(`HTTP transport detected with protocol ${protocolVersion} - header compliance assumed`);
         }
         // Determine confidence based on detection method
         const confidence = hasTransportMetadata ? "medium" : "low";

package/lib/services/assessment/modules/ManifestValidationAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ManifestValidationAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ManifestValidationAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EACV,4BAA4B,EAK7B,MAAM,uBAAuB,CAAC;AAM/B,qBAAa,0BAA2B,SAAQ,YAAY;IAC1D;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,CAAC;IA6JxC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAmB/B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAgC/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAiC7B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAiChC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+CzB;;OAEG;IACH,OAAO,CAAC,YAAY;IAqCpB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA8B7B;;OAEG;YACW,yBAAyB;IAoFvC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAsB/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0C3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CA+ChC"}
+{"version":3,"file":"ManifestValidationAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ManifestValidationAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EACV,4BAA4B,EAK7B,MAAM,uBAAuB,CAAC;AAM/B,qBAAa,0BAA2B,SAAQ,YAAY;IAC1D;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,CAAC;IA6JxC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAmB/B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAgC/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAiC7B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAiChC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+CzB;;OAEG;IACH,OAAO,CAAC,YAAY;IAqCpB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA8B7B;;OAEG;YACW,yBAAyB;IAqFvC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAsB/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0C3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CA+ChC"}

package/lib/services/assessment/modules/ManifestValidationAssessor.js

@@ -19,7 +19,7 @@ export class ManifestValidationAssessor extends BaseAssessor {
      * Run manifest validation assessment
      */
     async assess(context) {
-        this.log("Starting manifest validation assessment");
+        this.logger.info("Starting manifest validation assessment");
         this.testCount = 0;
         // Check if manifest is available
         if (!context.manifestJson && !context.manifestRaw) {
@@ -91,7 +91,7 @@ export class ManifestValidationAssessor extends BaseAssessor {
         if (manifest.privacy_policies &&
             Array.isArray(manifest.privacy_policies) &&
             manifest.privacy_policies.length > 0) {
-            this.log(`Validating ${manifest.privacy_policies.length} privacy policy URL(s)`);
+            this.logger.info(`Validating ${manifest.privacy_policies.length} privacy policy URL(s)`);
             const policyResults = await this.validatePrivacyPolicyUrls(manifest.privacy_policies);
             privacyPolicies = {
                 declared: manifest.privacy_policies,
@@ -121,7 +121,7 @@ export class ManifestValidationAssessor extends BaseAssessor {
         const status = this.determineManifestStatus(validationResults, hasRequiredFields);
         const explanation = this.generateExplanation(validationResults, hasRequiredFields, hasIcon, privacyPolicies);
         const recommendations = this.generateRecommendations(validationResults, privacyPolicies);
-        this.log(`Assessment complete: ${validationResults.filter((r) => r.valid).length}/${validationResults.length} checks passed`);
+        this.logger.info(`Assessment complete: ${validationResults.filter((r) => r.valid).length}/${validationResults.length} checks passed`);
         return {
             hasManifest: true,
             manifestVersion: manifest.manifest_version,
@@ -413,7 +413,9 @@ export class ManifestValidationAssessor extends BaseAssessor {
                 new URL(url);
             }
             catch (error) {
-                this.logError(`Invalid privacy policy URL format: ${url}`, error);
+                this.logger.error(`Invalid privacy policy URL format: ${url}`, {
+                    error,
+                });
                 results.push({
                     url,
                     accessible: false,
@@ -460,7 +462,9 @@ export class ManifestValidationAssessor extends BaseAssessor {
                     });
                 }
                 catch (fetchError) {
-                    this.logError(`Failed to fetch privacy policy URL: ${url}`, fetchError);
+                    this.logger.error(`Failed to fetch privacy policy URL: ${url}`, {
+                        error: fetchError,
+                    });
                     results.push({
                         url,
                         accessible: false,

package/lib/services/assessment/modules/PortabilityAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PortabilityAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/PortabilityAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,uBAAuB,CAAC;AA8H/B,qBAAa,mBAAoB,SAAQ,YAAY;IACnD;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAuHxE;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAiD5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAuE/B;;OAEG;IACH,OAAO,CAAC,QAAQ;IAiIhB;;OAEG;IACH,OAAO,CAAC,cAAc;IAkBtB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAmClC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAqC3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CAmDhC"}
+{"version":3,"file":"PortabilityAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/PortabilityAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,uBAAuB,CAAC;AA8H/B,qBAAa,mBAAoB,SAAQ,YAAY;IACnD;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAyHxE;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAiD5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAuE/B;;OAEG;IACH,OAAO,CAAC,QAAQ;IAiIhB;;OAEG;IACH,OAAO,CAAC,cAAc;IAkBtB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAmClC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAqC3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CAmDhC"}

package/lib/services/assessment/modules/PortabilityAssessor.js

@@ -124,7 +124,7 @@ export class PortabilityAssessor extends BaseAssessor {
      * Run portability assessment
      */
     async assess(context) {
-        this.log("Starting portability assessment");
+        this.logger.info("Starting portability assessment");
         this.testCount = 0;
         const issues = [];
         let scannedFiles = 0;
@@ -159,7 +159,7 @@ export class PortabilityAssessor extends BaseAssessor {
         }
         // Check source code files if available
         if (context.sourceCodeFiles && context.config.enableSourceCodeAnalysis) {
-            this.log("Scanning source code files for portability issues...");
+            this.logger.info("Scanning source code files for portability issues...");
             for (const [filePath, content] of context.sourceCodeFiles) {
                 // Skip irrelevant files
                 if (this.shouldSkipFile(filePath))
@@ -185,7 +185,7 @@ export class PortabilityAssessor extends BaseAssessor {
         const status = this.determinePortabilityStatus(issues, usesDirname, usesBundleRoot);
         const explanation = this.generateExplanation(issues, usesDirname, usesBundleRoot, scannedFiles);
         const recommendations = this.generateRecommendations(issues, usesDirname, usesBundleRoot);
-        this.log(`Assessment complete: ${issues.length} portability issues found`);
+        this.logger.info(`Assessment complete: ${issues.length} portability issues found`);
         // NEW: Analyze shell commands and platform coverage (Issue #9)
         const shellCommands = this.analyzeShellCommands(context);
         const platformCoverage = this.analyzePlatformCoverage(issues);

package/lib/services/assessment/modules/ProhibitedLibrariesAssessor.js

@@ -16,7 +16,7 @@ export class ProhibitedLibrariesAssessor extends BaseAssessor {
      * Run prohibited libraries assessment
      */
     async assess(context) {
-        this.log("Starting prohibited libraries assessment");
+        this.logger.info("Starting prohibited libraries assessment");
         this.testCount = 0;
         const matches = [];
         const scannedFiles = [];
@@ -24,7 +24,7 @@ export class ProhibitedLibrariesAssessor extends BaseAssessor {
         let hasMediaLibraries = false;
         // Check package.json dependencies
         if (context.packageJson) {
-            this.log("Scanning package.json dependencies...");
+            this.logger.info("Scanning package.json dependencies...");
             this.testCount++;
             scannedFiles.push("package.json");
             const packageJson = context.packageJson;
@@ -64,7 +64,7 @@ export class ProhibitedLibrariesAssessor extends BaseAssessor {
         }
         // Check source code files if available
         if (context.sourceCodeFiles && context.config.enableSourceCodeAnalysis) {
-            this.log("Scanning source code files...");
+            this.logger.info("Scanning source code files...");
             for (const [filePath, content] of context.sourceCodeFiles) {
                 // Check Python requirements files
                 if (filePath.endsWith("requirements.txt") ||
@@ -126,7 +126,7 @@ export class ProhibitedLibrariesAssessor extends BaseAssessor {
         const status = this.calculateStatusFromMatches(uniqueMatches);
         const explanation = this.generateExplanation(uniqueMatches, hasFinancialLibraries, hasMediaLibraries, scannedFiles);
         const recommendations = this.generateRecommendations(uniqueMatches);
-        this.log(`Assessment complete: ${uniqueMatches.length} prohibited libraries found`);
+        this.logger.info(`Assessment complete: ${uniqueMatches.length} prohibited libraries found`);
         return {
             matches: uniqueMatches,
             scannedFiles,

package/lib/services/assessment/modules/PromptAssessor.js

@@ -67,7 +67,7 @@ export class PromptAssessor extends BaseAssessor {
         if (!context.prompts || context.prompts.length === 0) {
             return this.createNoPromptsResponse();
         }
-        this.log(`Testing ${context.prompts.length} prompts`);
+        this.logger.info(`Testing ${context.prompts.length} prompts`);
         // Test each prompt
         for (const prompt of context.prompts) {
             this.testCount++;
@@ -216,7 +216,7 @@ export class PromptAssessor extends BaseAssessor {
             return { success: true, unsafeContent, executionTime };
         }
         catch (error) {
-            this.logError(`Prompt execution failed: ${prompt.name}`, error);
+            this.logger.error(`Prompt execution failed: ${prompt.name}`, { error });
             return {
                 success: false,
                 unsafeContent: false,

package/lib/services/assessment/modules/ProtocolComplianceAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProtocolComplianceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ProtocolComplianceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,2BAA2B,EAM3B,uBAAuB,EAKxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAOpE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAmB9D;;;GAGG;AACH,MAAM,WAAW,4BAA6B,SAAQ,2BAA2B;IAC/E,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE;QAClB,mBAAmB,EAAE,aAAa,CAAC;QACnC,kBAAkB,EAAE,aAAa,CAAC;QAClC,uBAAuB,EAAE,aAAa,CAAC;KACxC,CAAC;CACH;AAED,qBAAa,0BAA2B,SAAQ,YAAY,CAAC,4BAA4B,CAAC;IACxF,OAAO,CAAC,GAAG,CAAc;gBAEb,MAAM,EAAE,uBAAuB;IAK3C;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;;OAGG;IACG,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,CAAC;IAyIxC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqB9B;;OAEG;YACW,sBAAsB;IAuBpC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAsB/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAwC7B;;OAEG;YACW,mBAAmB;IAiCjC;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAiDnC;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAkEnC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;OAEG;YACW,wBAAwB;IA4GtC;;OAEG;YACW,uBAAuB;IA2FrC;;OAEG;YACW,4BAA4B;IAoD1C,OAAO,CAAC,yBAAyB;IAkEjC,OAAO,CAAC,uBAAuB;IAqB/B,OAAO,CAAC,sBAAsB;IA0B9B,OAAO,CAAC,qBAAqB;IAgC7B,OAAO,CAAC,oBAAoB;IA8E5B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAoC3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CAqEhC"}
+{"version":3,"file":"ProtocolComplianceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ProtocolComplianceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,2BAA2B,EAM3B,uBAAuB,EAKxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAOpE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAmB9D;;;GAGG;AACH,MAAM,WAAW,4BAA6B,SAAQ,2BAA2B;IAC/E,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE;QAClB,mBAAmB,EAAE,aAAa,CAAC;QACnC,kBAAkB,EAAE,aAAa,CAAC;QAClC,uBAAuB,EAAE,aAAa,CAAC;KACxC,CAAC;CACH;AAED,qBAAa,0BAA2B,SAAQ,YAAY,CAAC,4BAA4B,CAAC;IACxF,OAAO,CAAC,GAAG,CAAc;gBAEb,MAAM,EAAE,uBAAuB;IAK3C;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;;OAGG;IACG,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,CAAC;IAyIxC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;OAEG;YACW,sBAAsB;IAuBpC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAsB/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAwC7B;;OAEG;YACW,mBAAmB;IAiCjC;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAiDnC;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAkEnC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;OAEG;YACW,wBAAwB;IA4GtC;;OAEG;YACW,uBAAuB;IA2FrC;;OAEG;YACW,4BAA4B;IAoD1C,OAAO,CAAC,yBAAyB;IAkEjC,OAAO,CAAC,uBAAuB;IAqB/B,OAAO,CAAC,sBAAsB;IA0B9B,OAAO,CAAC,qBAAqB;IAgC7B,OAAO,CAAC,oBAAoB;IA8E5B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAoC3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CAqEhC"}

package/lib/services/assessment/modules/ProtocolComplianceAssessor.js

@@ -126,7 +126,7 @@ export class ProtocolComplianceAssessor extends BaseAssessor {
         // Track test count
         this.testCount = totalChecks;
         // Log score/check consistency for debugging
-        this.log(`Protocol Compliance: ${passedCount}/${totalChecks} checks passed (${complianceScore.toFixed(1)}%)`);
+        this.logger.info(`Protocol Compliance: ${passedCount}/${totalChecks} checks passed (${complianceScore.toFixed(1)}%)`);
         // Determine status based on protocol checks only
         let status;
         if (!protocolChecks.serverInfoValidity.passed) {
@@ -171,14 +171,14 @@ export class ProtocolComplianceAssessor extends BaseAssessor {
         const metadata = context.serverInfo?.metadata;
         const protocolVersion = metadata?.protocolVersion;
         if (protocolVersion) {
-            this.log(`Using protocol version from metadata: ${protocolVersion}`);
+            this.logger.info(`Using protocol version from metadata: ${protocolVersion}`);
             return protocolVersion;
         }
         if (context.serverInfo?.version) {
-            this.log(`Using server version as protocol version: ${context.serverInfo.version}`);
+            this.logger.info(`Using server version as protocol version: ${context.serverInfo.version}`);
             return context.serverInfo.version;
         }
-        this.log("No protocol version information available, using default");
+        this.logger.info("No protocol version information available, using default");
         return "2025-06-18";
     }
     /**
@@ -208,13 +208,13 @@ export class ProtocolComplianceAssessor extends BaseAssessor {
         }
         if (serverInfo.name !== undefined && serverInfo.name !== null) {
             if (typeof serverInfo.name !== "string") {
-                this.log("Server info name is not a string");
+                this.logger.info("Server info name is not a string");
                 return false;
             }
         }
         if (serverInfo.metadata !== undefined && serverInfo.metadata !== null) {
             if (typeof serverInfo.metadata !== "object") {
-                this.log("Server info metadata is not an object");
+                this.logger.info("Server info metadata is not an object");
                 return false;
             }
         }
@@ -310,7 +310,7 @@ export class ProtocolComplianceAssessor extends BaseAssessor {
         }
         const totalTools = tools.length;
         const coveragePercent = totalTools > 0 ? Math.round((withOutputSchema / totalTools) * 100) : 0;
-        this.log(`Structured output support: ${withOutputSchema}/${totalTools} tools (${coveragePercent}%)`);
+        this.logger.info(`Structured output support: ${withOutputSchema}/${totalTools} tools (${coveragePercent}%)`);
         const coverage = {
             totalTools,
             withOutputSchema,

package/lib/services/assessment/modules/ProtocolConformanceAssessor.js

@@ -268,7 +268,7 @@ export class ProtocolConformanceAssessor extends BaseAssessor {
             };
         }
         catch (error) {
-            this.logError("Content type validation failed", error);
+            this.logger.error("Content type validation failed", { error });
             return {
                 passed: false,
                 confidence: "medium",

package/lib/services/assessment/modules/ResourceAssessor.js

@@ -211,7 +211,7 @@ export class ResourceAssessor extends BaseAssessor {
         }
         const resources = context.resources || [];
         const templates = context.resourceTemplates || [];
-        this.log(`Testing ${resources.length} resources and ${templates.length} resource templates`);
+        this.logger.info(`Testing ${resources.length} resources and ${templates.length} resource templates`);
         // Test each resource
         for (const resource of resources) {
             this.testCount++;