@bryan-thompson/inspector-assessment-client 1.31.0 → 1.32.0

package/lib/services/assessment/AssessmentOrchestrator.js

@@ -6,34 +6,9 @@
  * @module AssessmentOrchestrator
  */
 import { DEFAULT_ASSESSMENT_CONFIG, } from "../../lib/assessmentTypes.js";
-// Core assessment modules
-import { FunctionalityAssessor } from "./modules/FunctionalityAssessor.js";
-import { SecurityAssessor } from "./modules/SecurityAssessor.js";
-import { DocumentationAssessor } from "./modules/DocumentationAssessor.js";
-import { ErrorHandlingAssessor } from "./modules/ErrorHandlingAssessor.js";
-import { UsabilityAssessor } from "./modules/UsabilityAssessor.js";
-// Extended assessment modules - unified protocol compliance
-import { ProtocolComplianceAssessor } from "./modules/ProtocolComplianceAssessor.js";
-// New MCP Directory Compliance Gap assessors
-import { AUPComplianceAssessor } from "./modules/AUPComplianceAssessor.js";
-import { ToolAnnotationAssessor } from "./modules/ToolAnnotationAssessor.js";
-import { ProhibitedLibrariesAssessor } from "./modules/ProhibitedLibrariesAssessor.js";
-import { ManifestValidationAssessor } from "./modules/ManifestValidationAssessor.js";
-import { PortabilityAssessor } from "./modules/PortabilityAssessor.js";
-import { ExternalAPIScannerAssessor } from "./modules/ExternalAPIScannerAssessor.js";
-import { TemporalAssessor } from "./modules/TemporalAssessor.js";
-import { AuthenticationAssessor } from "./modules/AuthenticationAssessor.js";
-// New capability assessors
-import { ResourceAssessor } from "./modules/ResourceAssessor.js";
-import { PromptAssessor } from "./modules/PromptAssessor.js";
-import { CrossCapabilitySecurityAssessor } from "./modules/CrossCapabilitySecurityAssessor.js";
-// Code quality assessors
-import { FileModularizationAssessor } from "./modules/FileModularizationAssessor.js";
-// Official MCP conformance testing
-import { ConformanceAssessor } from "./modules/ConformanceAssessor.js";
 // Note: ProtocolConformanceAssessor merged into ProtocolComplianceAssessor (v1.25.2)
-// Pattern configuration for tool annotation assessment
-import { loadPatternConfig, compilePatterns, } from "./config/annotationPatterns.js";
+// Pattern configuration for tool annotation assessment now handled by registry (Issue #91)
+// See AssessorDefinitions.ts customSetup for ToolAnnotationAssessor
 // Claude Code integration for intelligent analysis
 import { ClaudeCodeBridge, FULL_CLAUDE_CODE_CONFIG, } from "./lib/claudeCodeBridge.js";
 import { TestDataGenerator } from "./TestDataGenerator.js";
@@ -41,6 +16,10 @@ import { TestDataGenerator } from "./TestDataGenerator.js";
 import { createLogger, DEFAULT_LOGGING_CONFIG } from "./lib/logger.js";
 // Extracted helpers for testability
 import { emitModuleStartedEvent, emitModuleProgress, determineOverallStatus, generateSummary, generateRecommendations, } from "./orchestratorHelpers.js";
+// Registry pattern for assessor management (Issue #91)
+import { AssessorRegistry, ASSESSOR_DEFINITIONS, } from "./registry/index.js";
+// Module scoring for dual-key output (Issue #124)
+import { calculateModuleScore } from "../../lib/moduleScoring.js";
 /**
  * Main orchestrator class for running MCP server assessments
  *
@@ -61,31 +40,71 @@ export class AssessmentOrchestrator {
     // Claude Code Bridge for intelligent analysis
     claudeBridge;
     claudeEnabled = false;
-    // Core assessors (optional to support --skip-modules)
-    functionalityAssessor;
-    securityAssessor;
-    documentationAssessor;
-    errorHandlingAssessor;
-    usabilityAssessor;
-    // Extended assessors - unified protocol compliance
-    protocolComplianceAssessor;
-    // New MCP Directory Compliance Gap assessors
-    aupComplianceAssessor;
-    toolAnnotationAssessor;
-    prohibitedLibrariesAssessor;
-    manifestValidationAssessor;
-    portabilityAssessor;
-    externalAPIScannerAssessor;
-    temporalAssessor;
-    authenticationAssessor;
-    // New capability assessors
-    resourceAssessor;
-    promptAssessor;
-    crossCapabilityAssessor;
-    // Code quality assessors
-    fileModularizationAssessor;
-    // Official MCP conformance testing (opt-in via --conformance flag)
-    conformanceAssessor;
+    // Registry for assessor management (Issue #91)
+    // Delegates construction, test count aggregation, and Claude bridge wiring
+    registry;
+    // ============================================================================
+    // Private getters for backward compatibility with tests
+    // Tests access these via type assertions: (orchestrator as any).assessorName
+    // These delegate to the registry to maintain a single source of truth
+    // ============================================================================
+    get functionalityAssessor() {
+        return this.registry.getAssessor("functionality");
+    }
+    get securityAssessor() {
+        return this.registry.getAssessor("security");
+    }
+    get documentationAssessor() {
+        return this.registry.getAssessor("documentation");
+    }
+    get errorHandlingAssessor() {
+        return this.registry.getAssessor("errorHandling");
+    }
+    get usabilityAssessor() {
+        return this.registry.getAssessor("usability");
+    }
+    get protocolComplianceAssessor() {
+        return this.registry.getAssessor("protocolCompliance");
+    }
+    get aupComplianceAssessor() {
+        return this.registry.getAssessor("aupCompliance");
+    }
+    get toolAnnotationAssessor() {
+        return this.registry.getAssessor("toolAnnotations");
+    }
+    get prohibitedLibrariesAssessor() {
+        return this.registry.getAssessor("prohibitedLibraries");
+    }
+    get manifestValidationAssessor() {
+        return this.registry.getAssessor("manifestValidation");
+    }
+    get portabilityAssessor() {
+        return this.registry.getAssessor("portability");
+    }
+    get externalAPIScannerAssessor() {
+        return this.registry.getAssessor("externalAPIScanner");
+    }
+    get temporalAssessor() {
+        return this.registry.getAssessor("temporal");
+    }
+    get authenticationAssessor() {
+        return this.registry.getAssessor("authentication");
+    }
+    get resourceAssessor() {
+        return this.registry.getAssessor("resources");
+    }
+    get promptAssessor() {
+        return this.registry.getAssessor("prompts");
+    }
+    get crossCapabilityAssessor() {
+        return this.registry.getAssessor("crossCapability");
+    }
+    get fileModularizationAssessor() {
+        return this.registry.getAssessor("fileModularization");
+    }
+    get conformanceAssessor() {
+        return this.registry.getAssessor("conformance");
+    }
     // Note: protocolConformanceAssessor merged into protocolComplianceAssessor (v1.25.2)
     constructor(config = {}) {
         this.config = { ...DEFAULT_ASSESSMENT_CONFIG, ...config };
@@ -104,97 +123,17 @@ export class AssessmentOrchestrator {
         if (this.config.claudeCode?.enabled) {
             this.initializeClaudeBridge(this.config.claudeCode);
         }
-        // Initialize core assessors (respects assessmentCategories config for --skip-modules)
-        if (this.config.assessmentCategories?.functionality !== false) {
-            this.functionalityAssessor = new FunctionalityAssessor(this.config);
-        }
-        if (this.config.assessmentCategories?.security !== false) {
-            this.securityAssessor = new SecurityAssessor(this.config);
-            // Wire up Claude bridge for security semantic analysis
-            if (this.claudeBridge) {
-                this.securityAssessor.setClaudeBridge(this.claudeBridge);
-            }
-        }
-        if (this.config.assessmentCategories?.documentation !== false) {
-            this.documentationAssessor = new DocumentationAssessor(this.config);
-        }
-        if (this.config.assessmentCategories?.errorHandling !== false) {
-            this.errorHandlingAssessor = new ErrorHandlingAssessor(this.config);
-        }
-        if (this.config.assessmentCategories?.usability !== false) {
-            this.usabilityAssessor = new UsabilityAssessor(this.config);
-        }
-        // Initialize extended assessors if enabled
-        if (this.config.enableExtendedAssessment) {
-            // Initialize unified protocol compliance assessor
-            // Supports new protocolCompliance flag and deprecated mcpSpecCompliance/protocolConformance
-            if (this.config.assessmentCategories?.protocolCompliance ||
-                this.config.assessmentCategories?.mcpSpecCompliance ||
-                this.config.assessmentCategories?.protocolConformance) {
-                this.protocolComplianceAssessor = new ProtocolComplianceAssessor(this.config);
-            }
-            // Initialize new MCP Directory Compliance Gap assessors
-            if (this.config.assessmentCategories?.aupCompliance) {
-                this.aupComplianceAssessor = new AUPComplianceAssessor(this.config);
-                // Wire up Claude bridge for semantic analysis
-                if (this.claudeBridge) {
-                    this.aupComplianceAssessor.setClaudeBridge(this.claudeBridge);
-                }
-            }
-            if (this.config.assessmentCategories?.toolAnnotations) {
-                this.toolAnnotationAssessor = new ToolAnnotationAssessor(this.config);
-                // Wire up Claude bridge for behavior inference
-                if (this.claudeBridge) {
-                    this.toolAnnotationAssessor.setClaudeBridge(this.claudeBridge);
-                }
-                // Load custom pattern configuration if provided
-                if (this.config.patternConfigPath) {
-                    const patternConfig = loadPatternConfig(this.config.patternConfigPath, this.logger);
-                    const compiledPatterns = compilePatterns(patternConfig);
-                    this.toolAnnotationAssessor.setPatterns(compiledPatterns);
-                }
-            }
-            if (this.config.assessmentCategories?.prohibitedLibraries) {
-                this.prohibitedLibrariesAssessor = new ProhibitedLibrariesAssessor(this.config);
-            }
-            if (this.config.assessmentCategories?.manifestValidation) {
-                this.manifestValidationAssessor = new ManifestValidationAssessor(this.config);
-            }
-            if (this.config.assessmentCategories?.portability) {
-                this.portabilityAssessor = new PortabilityAssessor(this.config);
-            }
-            if (this.config.assessmentCategories?.externalAPIScanner) {
-                this.externalAPIScannerAssessor = new ExternalAPIScannerAssessor(this.config);
-            }
-            if (this.config.assessmentCategories?.temporal) {
-                this.temporalAssessor = new TemporalAssessor(this.config);
-            }
-            if (this.config.assessmentCategories?.authentication) {
-                this.authenticationAssessor = new AuthenticationAssessor(this.config);
-            }
-            // Initialize new capability assessors
-            if (this.config.assessmentCategories?.resources) {
-                this.resourceAssessor = new ResourceAssessor(this.config);
-            }
-            if (this.config.assessmentCategories?.prompts) {
-                this.promptAssessor = new PromptAssessor(this.config);
-            }
-            if (this.config.assessmentCategories?.crossCapability) {
-                this.crossCapabilityAssessor = new CrossCapabilitySecurityAssessor(this.config);
-            }
-            // Initialize code quality assessors
-            if (this.config.assessmentCategories?.fileModularization) {
-                this.fileModularizationAssessor = new FileModularizationAssessor(this.config);
-            }
-            // Initialize official MCP conformance testing (opt-in via --conformance flag)
-            // Requires HTTP/SSE transport with serverUrl available
-            if (this.config.assessmentCategories?.conformance) {
-                this.conformanceAssessor = new ConformanceAssessor(this.config);
-            }
-            // Note: Protocol conformance now handled by unified ProtocolComplianceAssessor above
-        }
-        // Wire up Claude bridge to TestDataGenerator for intelligent test generation
+        // Initialize registry and register all enabled assessors (Issue #91)
+        // The registry handles:
+        // - Conditional instantiation based on config flags
+        // - Deprecated flag OR logic (e.g., protocolCompliance supports 3 flags)
+        // - Custom setup (e.g., ToolAnnotationAssessor pattern config)
+        // - Claude bridge wiring for supporting assessors
+        this.registry = new AssessorRegistry(this.config);
+        this.registry.registerAll(ASSESSOR_DEFINITIONS);
+        // Wire up Claude bridge to registry (handles all supporting assessors)
         if (this.claudeBridge) {
+            this.registry.setClaudeBridge(this.claudeBridge);
             TestDataGenerator.setClaudeBridge(this.claudeBridge);
         }
         // Set logger for TestDataGenerator diagnostic output
@@ -242,17 +181,9 @@ export class AssessmentOrchestrator {
             enabled: true,
         };
         this.initializeClaudeBridge(bridgeConfig);
-        // Wire up to existing assessors
+        // Wire up to all supporting assessors via registry
         if (this.claudeBridge) {
-            if (this.aupComplianceAssessor) {
-                this.aupComplianceAssessor.setClaudeBridge(this.claudeBridge);
-            }
-            if (this.toolAnnotationAssessor) {
-                this.toolAnnotationAssessor.setClaudeBridge(this.claudeBridge);
-            }
-            if (this.securityAssessor) {
-                this.securityAssessor.setClaudeBridge(this.claudeBridge);
-            }
+            this.registry.setClaudeBridge(this.claudeBridge);
             TestDataGenerator.setClaudeBridge(this.claudeBridge);
         }
     }
@@ -626,6 +557,41 @@ export class AssessmentOrchestrator {
                 assessmentResults.security.vulnerabilities.push(`RUG_PULL_TEMPORAL: ${detail.tool} - Tool behavior changed after invocation ${detail.firstDeviationAt}. Requires immediate manual review.`);
             }
         }
+        // Issue #124: Dual-key output for v2.0.0 transition
+        // Output BOTH old and new keys to maintain backward compatibility
+        // Old keys (documentation, usability, mcpSpecCompliance) will be removed in v2.0.0
+        // developerExperience (new) = documentation + usability (deprecated)
+        if (assessmentResults.documentation && assessmentResults.usability) {
+            const docScore = calculateModuleScore(assessmentResults.documentation) ?? 50;
+            const usabilityScore = calculateModuleScore(assessmentResults.usability) ?? 50;
+            const combinedStatus = determineOverallStatus({
+                documentation: assessmentResults.documentation,
+                usability: assessmentResults.usability,
+            });
+            assessmentResults.developerExperience = {
+                documentation: assessmentResults.documentation,
+                usability: assessmentResults.usability,
+                status: combinedStatus,
+                score: Math.round((docScore + usabilityScore) / 2),
+            };
+            // Emit deprecation warning for old keys
+            this.logger.warn("Output keys 'documentation' and 'usability' are deprecated. " +
+                "Use 'developerExperience' instead. These keys will be removed in v2.0.0.", {
+                deprecated: ["documentation", "usability"],
+                replacement: "developerExperience",
+            });
+        }
+        // protocolCompliance (new) = mcpSpecCompliance (deprecated)
+        if (assessmentResults.mcpSpecCompliance) {
+            assessmentResults.protocolCompliance =
+                assessmentResults.mcpSpecCompliance;
+            // Emit deprecation warning for old key
+            this.logger.warn("Output key 'mcpSpecCompliance' is deprecated. " +
+                "Use 'protocolCompliance' instead. This key will be removed in v2.0.0.", {
+                deprecated: ["mcpSpecCompliance"],
+                replacement: "protocolCompliance",
+            });
+        }
         // Collect test counts from all assessors
         this.totalTestsRun = this.collectTotalTestCount();
         // Determine overall status

package/lib/services/assessment/modules/ConformanceAssessor.d.ts

@@ -36,6 +36,10 @@ export declare class ConformanceAssessor extends BaseAssessor<ConformanceAssessm
      * Parse checks.json file from conformance results
      */
     private parseChecksFile;
+    /**
+     * Check if the MCP conformance package is available
+     */
+    private isConformancePackageAvailable;
     /**
      * Cleanup temporary directory
      */

package/lib/services/assessment/modules/ConformanceAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConformanceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ConformanceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,gCAAgC,CAAC;AAgCxC;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,YAAY,CAAC,qBAAqB,CAAC;IAC1E;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAwFxE;;OAEG;YACW,WAAW;IAwEzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAwBtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAmBvB;;OAEG;IACH,OAAO,CAAC,cAAc;IAQtB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IA+BlC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAyB3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA+C/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;CAmB5B"}
+{"version":3,"file":"ConformanceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ConformanceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,gCAAgC,CAAC;AAgCxC;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,YAAY,CAAC,qBAAqB,CAAC;IAC1E;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAkGxE;;OAEG;YACW,WAAW;IAwEzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAwBtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAmBvB;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAarC;;OAEG;IACH,OAAO,CAAC,cAAc;IAQtB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IA+BlC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAyB3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA+C/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;CAmB5B"}

package/lib/services/assessment/modules/ConformanceAssessor.js

@@ -49,6 +49,11 @@ export class ConformanceAssessor extends BaseAssessor {
             this.logger.info("Conformance tests skipped: serverUrl not available (requires HTTP/SSE transport)");
             return this.createSkippedResult("Server URL not available. Conformance tests require HTTP or SSE transport.");
         }
+        // Check if conformance package is available
+        if (!this.isConformancePackageAvailable()) {
+            this.logger.warn("MCP conformance package not available. Install with: npm install -g @modelcontextprotocol/conformance");
+            return this.createSkippedResult("MCP conformance package not installed. Run: npm install -g @modelcontextprotocol/conformance");
+        }
         this.logger.info(`Running conformance tests against: ${serverUrl}`);
         const scenarios = [];
         const allChecks = [];
@@ -199,6 +204,22 @@ export class ConformanceAssessor extends BaseAssessor {
             return [];
         }
     }
+    /**
+     * Check if the MCP conformance package is available
+     */
+    isConformancePackageAvailable() {
+        try {
+            execFileSync("npx", ["@modelcontextprotocol/conformance", "--version"], {
+                timeout: 30000,
+                stdio: "pipe",
+                encoding: "utf-8",
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * Cleanup temporary directory
      */

package/lib/services/assessment/modules/ResourceAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ResourceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ResourceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,kBAAkB,EAGnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAuQ9D,qBAAa,gBAAiB,SAAQ,YAAY;IAC1C,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA8FrE,OAAO,CAAC,yBAAyB;YAiBnB,YAAY;IAoG1B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;YAsBjB,oBAAoB;IAkGlC;;;OAGG;YACW,6BAA6B;IA4F3C;;;OAGG;YACW,2BAA2B;IA0DzC;;OAEG;YACW,mBAAmB;IAmEjC,OAAO,CAAC,UAAU;IAsBlB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,wBAAwB;IAIhC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,yBAAyB;IAYjC,OAAO,CAAC,uBAAuB;IAqB/B,OAAO,CAAC,mBAAmB;IAoC3B,OAAO,CAAC,uBAAuB;CA+DhC"}
+{"version":3,"file":"ResourceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ResourceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,kBAAkB,EAGnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAuQ9D,qBAAa,gBAAiB,SAAQ,YAAY;IAC1C,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA8FrE,OAAO,CAAC,yBAAyB;YAiBnB,YAAY;IAoG1B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;YAsBjB,oBAAoB;IAkGlC;;;OAGG;YACW,6BAA6B;IA4F3C;;;OAGG;YACW,2BAA2B;IAgEzC;;OAEG;YACW,mBAAmB;IAmEjC,OAAO,CAAC,UAAU;IAsBlB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,wBAAwB;IAIhC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,yBAAyB;IAYjC,OAAO,CAAC,uBAAuB;IAqB/B,OAAO,CAAC,mBAAmB;IAoC3B,OAAO,CAAC,uBAAuB;CA+DhC"}

package/lib/services/assessment/modules/ResourceAssessor.js

@@ -605,7 +605,8 @@ export class ResourceAssessor extends BaseAssessor {
             baseSchemes.add("file");
             baseSchemes.add("resource");
         }
-        // Test hidden resource patterns
+        // Test hidden resource patterns with rate limiting to avoid overwhelming target
+        const PROBE_DELAY_MS = 50; // 50ms delay between probes
         for (const pattern of HIDDEN_RESOURCE_PATTERNS) {
             // For patterns with their own scheme, test directly
             if (pattern.includes("://")) {
@@ -614,6 +615,8 @@ export class ResourceAssessor extends BaseAssessor {
                 if (probeResult) {
                     results.push(probeResult);
                 }
+                // Rate limit between probes
+                await new Promise((resolve) => setTimeout(resolve, PROBE_DELAY_MS));
             }
             else {
                 // For file paths, combine with discovered schemes
@@ -624,6 +627,8 @@ export class ResourceAssessor extends BaseAssessor {
                     if (probeResult) {
                         results.push(probeResult);
                     }
+                    // Rate limit between probes
+                    await new Promise((resolve) => setTimeout(resolve, PROBE_DELAY_MS));
                 }
             }
         }

package/lib/services/assessment/registry/AssessorDefinitions.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Assessor Definitions
+ *
+ * Declarative configuration for all 19 assessors.
+ * Single source of truth for assessor registration, phase ordering,
+ * config flags, and Claude bridge support.
+ *
+ * @module assessment/registry/AssessorDefinitions
+ * @see GitHub Issue #91
+ */
+import type { AssessorDefinition } from "./types.js";
+import { AssessmentPhase } from "./types.js";
+/**
+ * All assessor definitions in phase order.
+ * This is the single source of truth for assessor registration.
+ *
+ * Order within phases:
+ * - Phase 0 (PRE): Temporal only
+ * - Phase 1 (CORE): Functionality, Security, Documentation, ErrorHandling, Usability
+ * - Phase 2 (PROTOCOL): ProtocolCompliance
+ * - Phase 3 (COMPLIANCE): AUP, Annotations, Libraries, Manifest, Portability, APIs, Auth
+ * - Phase 4 (CAPABILITY): Resources, Prompts, CrossCapability
+ * - Phase 5 (QUALITY): FileModularization, Conformance
+ */
+export declare const ASSESSOR_DEFINITIONS: AssessorDefinition[];
+/**
+ * Map of assessor ID to definition for fast lookup.
+ */
+export declare const ASSESSOR_DEFINITION_MAP: Map<string, AssessorDefinition>;
+/**
+ * Get assessor definitions by phase.
+ */
+export declare function getDefinitionsByPhase(phase: AssessmentPhase): AssessorDefinition[];
+/**
+ * Get all phases in execution order.
+ */
+export declare function getOrderedPhases(): AssessmentPhase[];
+//# sourceMappingURL=AssessorDefinitions.d.ts.map

package/lib/services/assessment/registry/AssessorDefinitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AssessorDefinitions.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/registry/AssessorDefinitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AA4D1C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,EAAE,kBAAkB,EA4SpD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAEnE,CAAC;AAEF;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,eAAe,GACrB,kBAAkB,EAAE,CAEtB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,eAAe,EAAE,CASpD"}