@bryan-thompson/inspector-assessment-client 1.35.1 → 1.35.3

package/lib/lib/aupPatterns.js

@@ -294,6 +294,91 @@ export const HIGH_RISK_DOMAINS = [
         reason: "May involve insurance decisions or claims processing",
     },
 ];
+/**
+ * Analytics/Reporting Exemption Patterns (Issue #139)
+ *
+ * These patterns identify legitimate analytics and reporting use cases
+ * that should NOT trigger "Financial Services" high-risk domain flag.
+ *
+ * Key distinction:
+ * - Analytics: filter, track, report, analyze, dashboard, metric
+ * - Transactions: process, transfer, execute, withdraw, deposit
+ */
+export const FINANCIAL_ANALYTICS_EXEMPTION_PATTERNS = [
+    // Analytics/BI tool indicators
+    /\b(analytics|analytic)\b/i,
+    /\bdashboard\b/i,
+    /\bmetric(s)?\b/i,
+    /\breport(ing|s)?\b/i,
+    /\binsight(s)?\b/i,
+    /\bvisualization\b/i,
+    // Filter/query patterns (read-only operations)
+    /\bfilter\s*(by|on|for)\b/i,
+    /\bsort\s*(by|on)\b/i,
+    /\bgroup\s*(by|on)\b/i,
+    /\bquery\b/i,
+    /\bsearch\b/i,
+    // Tracking/monitoring (read operations)
+    /\btrack(ing|er)?\b/i,
+    /\bmonitor(ing)?\b/i,
+    /\bsession\s*(record(ing)?|replay|data)\b/i,
+    /\bheatmaps?\b/i,
+    /\bclick\s*(map|track)\b/i,
+    // BI/Analytics platforms
+    /\bclarity\b/i, // Microsoft Clarity
+    /\bgoogle\s*analytics\b/i,
+    /\bmixpanel\b/i,
+    /\bamplitude\b/i,
+    /\bsegment\b/i,
+    /\bplausible\b/i,
+    /\bmatomo\b/i,
+    /\bhotjar\b/i,
+    // Read-only financial field indicators
+    /\bproduct(Price|Purchases|Revenue|Sales)\b/i,
+    /\border(Value|Total|Amount)\b/i,
+    /\bconversion(Rate|Value)?\b/i,
+    /\brevenue\s*(metric|data|report)/i,
+    /\bsales\s*(data|report|metric)/i,
+    /\btransaction(Count|Volume)\b/i, // Aggregate metrics, not processing
+];
+/**
+ * Financial Transaction Action Patterns (Issue #139)
+ *
+ * These patterns identify ACTUAL financial transaction capabilities
+ * that SHOULD trigger the "Financial Services" high-risk domain flag.
+ *
+ * These indicate the server can perform financial operations, not just
+ * analyze/report on financial data.
+ */
+export const FINANCIAL_ACTION_PATTERNS = [
+    // Payment processing
+    /\b(process|submit|initiate)\s*(payment|transaction)/i,
+    /\bcharge\s*(card|customer|account)/i,
+    /\bcreate\s*(payment|invoice|charge)/i,
+    // Fund transfers
+    /\btransfer\s*(fund|money|balance)/i,
+    /\bsend\s*money\b/i,
+    /\bwire\s*transfer\b/i,
+    // Account operations
+    /\bwithdraw(al)?\b/i,
+    /\bdeposit\b/i,
+    /\bdebit\b/i,
+    /\bcredit\s*(account|card|balance)/i,
+    // Trading operations
+    /\b(execute|place|submit)\s*(trade|order)/i,
+    /\bbuy\s*(stock|share|asset|crypto)/i,
+    /\bsell\s*(stock|share|asset|crypto)/i,
+    /\bmarket\s*order\b/i,
+    /\blimit\s*order\b/i,
+    // Investment operations
+    /\binvest\s*in\b/i,
+    /\ballocate\s*(fund|capital)/i,
+    /\brebalance\s*portfolio/i,
+    // Crypto operations
+    /\bmint\s*(token|nft)/i,
+    /\bswap\s*(token|crypto)/i,
+    /\bstake\b/i,
+];
 /**
  * Get all patterns for a specific severity level
  */
@@ -330,12 +415,67 @@ export function checkTextForAUPViolations(text) {
     }
     return violations;
 }
+/**
+ * Check if text indicates analytics/reporting use case (Issue #139)
+ *
+ * @param text - The text to analyze (tool name, description, or README)
+ * @returns true if analytics/reporting patterns are detected
+ */
+export function isAnalyticsContext(text) {
+    return FINANCIAL_ANALYTICS_EXEMPTION_PATTERNS.some((pattern) => pattern.test(text));
+}
+/**
+ * Check if text indicates actual financial transaction capabilities (Issue #139)
+ *
+ * @param text - The text to analyze
+ * @returns true if financial action patterns are detected
+ */
+export function hasFinancialActions(text) {
+    return FINANCIAL_ACTION_PATTERNS.some((pattern) => pattern.test(text));
+}
+/**
+ * Context-aware check for financial high-risk domain (Issue #139)
+ *
+ * Returns true ONLY if:
+ * 1. Financial keywords are present AND
+ * 2. Financial action patterns are present OR analytics exemption patterns are absent
+ *
+ * This prevents false positives for analytics/reporting servers while
+ * maintaining detection of actual financial transaction servers.
+ *
+ * @param text - The text to analyze
+ * @returns true if this is genuinely a financial services context
+ */
+export function isFinancialServicesContext(text) {
+    const hasFinancialKeyword = /\b(financial|banking|payment|trading|investment)/i.test(text);
+    if (!hasFinancialKeyword) {
+        return false;
+    }
+    // If financial action patterns are present, it's genuinely financial services
+    if (hasFinancialActions(text)) {
+        return true;
+    }
+    // If analytics context is detected, exempt from financial services flag
+    if (isAnalyticsContext(text)) {
+        return false;
+    }
+    // Default: treat as financial services if keywords present but no clear context
+    return true;
+}
 /**
  * Check text for high-risk domain keywords
+ * Now with context-aware detection for Financial Services (Issue #139)
  */
 export function checkTextForHighRiskDomains(text) {
     const matches = [];
     for (const domainDef of HIGH_RISK_DOMAINS) {
+        // Issue #139: Context-aware Financial Services detection
+        // Skip Financial Services if text is analytics context without financial actions
+        if (domainDef.domain === "Financial Services") {
+            if (!isFinancialServicesContext(text)) {
+                continue; // Skip - this is analytics, not financial transactions
+            }
+        }
         const match = text.match(domainDef.pattern);
         if (match) {
             matches.push({

package/lib/lib/securityPatterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"securityPatterns.d.ts","sourceRoot":"","sources":["../../src/lib/securityPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,aAAa,EAo7DnD,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,eAAe,EAAE,CAQnB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,EAAE,CAEtD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;;;;;;;;EA8BnC"}
+{"version":3,"file":"securityPatterns.d.ts","sourceRoot":"","sources":["../../src/lib/securityPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,aAAa,EAoiEnD,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,eAAe,EAAE,CAQnB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,EAAE,CAEtD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;;;;;;;;EA8BnC"}

package/lib/lib/securityPatterns.js

@@ -1809,6 +1809,98 @@ export const SECURITY_ATTACK_PATTERNS = [
             },
         ],
     },
+    // ==========================================
+    // EXCESSIVE PERMISSIONS SCOPE TESTS (Issue #144, Challenge #22)
+    // ==========================================
+    // 32. EXCESSIVE PERMISSIONS SCOPE
+    {
+        attackName: "Excessive Permissions Scope",
+        description: "Test if tools with restrictive annotations (readOnlyHint=True) allow privileged operations via specific inputs (CWE-250, CWE-269)",
+        payloads: [
+            // Privileged action payloads for tools that claim readOnlyHint=True
+            {
+                payload: "write_file",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"write"/i,
+                riskLevel: "HIGH",
+                description: "Write operation bypassing readOnlyHint=True annotation (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            {
+                payload: "delete_data",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"delete"/i,
+                riskLevel: "HIGH",
+                description: "Delete operation bypassing destructiveHint=False annotation (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            {
+                payload: "execute_command",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"execute"/i,
+                riskLevel: "HIGH",
+                description: "Execute operation bypassing readOnlyHint=True annotation (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            {
+                payload: "network_request",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"network"/i,
+                riskLevel: "HIGH",
+                description: "Network operation bypassing openWorldHint=False annotation (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            {
+                payload: "modify_config",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"modify"/i,
+                riskLevel: "HIGH",
+                description: "Config modification bypassing readOnlyHint=True annotation (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            {
+                payload: "environment_access",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"environment"/i,
+                riskLevel: "HIGH",
+                description: "Environment access bypassing annotation restrictions (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            // Escalation keyword payloads for tools that claim readOnlyHint=True
+            {
+                payload: "show admin users",
+                evidence: /"scope_escalation"\s*:\s*true|"privileged_data"\s*:|admin[_-]?mode[_-]?activated/i,
+                riskLevel: "HIGH",
+                description: "Keyword-triggered privilege escalation via 'admin' (CWE-269)",
+                payloadType: "scope_escalation",
+                parameterTypes: ["request", "query", "input", "text", "message"],
+            },
+            {
+                payload: "sudo access logs",
+                evidence: /"scope_escalation"\s*:\s*true|"system_secrets"\s*:|"trigger_keyword"\s*:\s*"sudo"/i,
+                riskLevel: "HIGH",
+                description: "Keyword-triggered privilege escalation via 'sudo' (CWE-269)",
+                payloadType: "scope_escalation",
+                parameterTypes: ["request", "query", "input", "text", "message"],
+            },
+            {
+                payload: "elevate to root",
+                evidence: /"scope_escalation"\s*:\s*true|"trigger_keyword"\s*:\s*"(elevate|root)"/i,
+                riskLevel: "HIGH",
+                description: "Keyword-triggered privilege escalation via 'elevate' or 'root' (CWE-269)",
+                payloadType: "scope_escalation",
+                parameterTypes: ["request", "query", "input", "text", "message"],
+            },
+            {
+                payload: "get superuser privileges",
+                evidence: /"scope_escalation"\s*:\s*true|"trigger_keyword"\s*:\s*"(superuser|privilege)"/i,
+                riskLevel: "HIGH",
+                description: "Keyword-triggered privilege escalation via 'superuser' or 'privilege' (CWE-269)",
+                payloadType: "scope_escalation",
+                parameterTypes: ["request", "query", "input", "text", "message"],
+            },
+        ],
+    },
 ];
 /**
  * Get all payloads for an attack type

package/lib/services/assessment/modules/DeveloperExperienceAssessor.d.ts

@@ -12,7 +12,7 @@
  *
  * @module assessment/modules/DeveloperExperienceAssessor
  */
-import { DocumentationMetrics, UsabilityMetrics, AssessmentStatus } from "../../../lib/assessmentTypes.js";
+import { DocumentationMetrics, UsabilityMetrics, AssessmentStatus, NamespaceDetectionResult } from "../../../lib/assessmentTypes.js";
 import { BaseAssessor } from "./BaseAssessor.js";
 import { AssessmentContext } from "../AssessmentOrchestrator.js";
 /**
@@ -35,6 +35,8 @@ export interface DeveloperExperienceAssessment {
         usability: number;
         overall: number;
     };
+    /** Namespace detection results (Issue #142) */
+    namespaceDetection?: NamespaceDetectionResult;
 }
 export declare class DeveloperExperienceAssessor extends BaseAssessor<DeveloperExperienceAssessment> {
     assess(context: AssessmentContext): Promise<DeveloperExperienceAssessment>;
@@ -97,6 +99,29 @@ export declare class DeveloperExperienceAssessor extends BaseAssessor<DeveloperE
     private isDescriptiveName;
     private getToolSchema;
     private calculateUsabilityScore;
+    /**
+     * Detect namespace/prefix patterns in tool names.
+     * This helps identify intentional naming conventions like:
+     * - calc_add, calc_subtract -> namespace "calc"
+     * - fileRead, fileWrite -> namespace "file"
+     * - myserver_tool1, myserver_tool2 -> matches server name
+     */
+    private detectNamespace;
+    /**
+     * Find common prefix among tool names.
+     * Handles both snake_case (calc_add) and camelCase (calcAdd) conventions.
+     */
+    private findCommonPrefix;
+    /**
+     * Check if tool names use the server name as a prefix.
+     * Normalizes server name to match common patterns.
+     */
+    private checkServerNamePrefix;
+    /**
+     * Normalize server name for prefix matching.
+     * Converts "My-Server" -> "myserver", "my_server" -> "myserver"
+     */
+    private normalizeServerName;
     private determineOverallStatus;
     private generateExplanation;
     private generateRecommendations;

package/lib/services/assessment/modules/DeveloperExperienceAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeveloperExperienceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/DeveloperExperienceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAEhB,gBAAgB,EAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,yCAAyC;IACzC,aAAa,EAAE,oBAAoB,CAAC;IACpC,qCAAqC;IACrC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,gDAAgD;IAChD,MAAM,EAAE,gBAAgB,CAAC;IACzB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iDAAiD;IACjD,MAAM,EAAE;QACN,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,qBAAa,2BAA4B,SAAQ,YAAY,CAAC,6BAA6B,CAAC;IACpF,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,6BAA6B,CAAC;IAsEzC,OAAO,CAAC,oBAAoB;IAmH5B,OAAO,CAAC,yBAAyB;IA4CjC,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,sBAAsB;IA8B9B,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,mBAAmB;IAwC3B,OAAO,CAAC,wBAAwB;IAahC,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,sBAAsB;IAY9B,OAAO,CAAC,mBAAmB;IA6B3B;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAkBlC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAW9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAgC7B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAgBjC;;;OAGG;IACH,OAAO,CAAC,aAAa;IAoBrB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAsEzB,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,uBAAuB;IAsC/B,OAAO,CAAC,uBAAuB;IAwC/B,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,kBAAkB;IAsC1B,OAAO,CAAC,iBAAiB;IAiCzB,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,sBAAsB;IAM9B,OAAO,CAAC,mBAAmB;IAyC3B,OAAO,CAAC,uBAAuB;CAmDhC"}
+{"version":3,"file":"DeveloperExperienceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/DeveloperExperienceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAEhB,gBAAgB,EAKhB,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,yCAAyC;IACzC,aAAa,EAAE,oBAAoB,CAAC;IACpC,qCAAqC;IACrC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,gDAAgD;IAChD,MAAM,EAAE,gBAAgB,CAAC;IACzB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iDAAiD;IACjD,MAAM,EAAE;QACN,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,+CAA+C;IAC/C,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;CAC/C;AAED,qBAAa,2BAA4B,SAAQ,YAAY,CAAC,6BAA6B,CAAC;IACpF,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,6BAA6B,CAAC;IA6EzC,OAAO,CAAC,oBAAoB;IAmH5B,OAAO,CAAC,yBAAyB;IA4CjC,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,sBAAsB;IA8B9B,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,mBAAmB;IAwC3B,OAAO,CAAC,wBAAwB;IAahC,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,sBAAsB;IAY9B,OAAO,CAAC,mBAAmB;IA6B3B;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAkBlC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAW9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAgC7B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAgBjC;;;OAGG;IACH,OAAO,CAAC,aAAa;IAoBrB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAsEzB,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,uBAAuB;IAsC/B,OAAO,CAAC,uBAAuB;IAwC/B,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,kBAAkB;IAsC1B,OAAO,CAAC,iBAAiB;IAiCzB,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,uBAAuB;IAgB/B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAsEvB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IA0DxB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAsC7B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,sBAAsB;IAM9B,OAAO,CAAC,mBAAmB;IAyC3B,OAAO,CAAC,uBAAuB;CAmDhC"}

package/lib/services/assessment/modules/DeveloperExperienceAssessor.js

@@ -30,6 +30,8 @@ export class DeveloperExperienceAssessor extends BaseAssessor {
         // Assess usability
         const usabilityMetrics = this.analyzeUsability(context.tools);
         const usabilityScore = this.calculateUsabilityScore(usabilityMetrics);
+        // Issue #142: Detect namespace/prefix patterns in tool names
+        const namespaceDetection = this.detectNamespace(context.tools, context.serverInfo?.name);
         // Calculate overall score (weighted average: 60% docs, 40% usability)
         const overallScore = Math.round(documentationScore * 0.6 + usabilityScore * 0.4);
         // Determine status using Issue #55 thresholds
@@ -37,7 +39,7 @@ export class DeveloperExperienceAssessor extends BaseAssessor {
         // Generate explanation and recommendations
         const explanation = this.generateExplanation(documentationMetrics, usabilityMetrics, context.tools);
         const recommendations = this.generateRecommendations(documentationMetrics, usabilityMetrics);
-        this.testCount = 15; // Documentation (5) + Quality (6) + Usability (4) checks
+        this.testCount = 16; // Documentation (5) + Quality (6) + Usability (4) + Namespace (1) checks
         return {
             documentation: documentationMetrics,
             usability: usabilityMetrics,
@@ -49,6 +51,7 @@ export class DeveloperExperienceAssessor extends BaseAssessor {
                 usability: usabilityScore,
                 overall: overallScore,
             },
+            namespaceDetection,
         };
     }
     // ============================================================================
@@ -673,6 +676,162 @@ export class DeveloperExperienceAssessor extends BaseAssessor {
         return Math.round((score / maxScore) * 100);
     }
     // ============================================================================
+    // Namespace Detection (Issue #142)
+    // ============================================================================
+    /**
+     * Detect namespace/prefix patterns in tool names.
+     * This helps identify intentional naming conventions like:
+     * - calc_add, calc_subtract -> namespace "calc"
+     * - fileRead, fileWrite -> namespace "file"
+     * - myserver_tool1, myserver_tool2 -> matches server name
+     */
+    detectNamespace(tools, serverName) {
+        const toolNames = tools.map((t) => t.name);
+        const totalTools = toolNames.length;
+        // Need at least 2 tools to detect a namespace
+        if (totalTools < 2) {
+            return {
+                detected: false,
+                confidence: "low",
+                toolsCovered: 0,
+                totalTools,
+                matchPattern: "none",
+            };
+        }
+        // Try server name prefix first (highest priority)
+        if (serverName) {
+            const serverNameResult = this.checkServerNamePrefix(toolNames, serverName);
+            if (serverNameResult.matches >= 2 &&
+                serverNameResult.matches / totalTools >= 0.5) {
+                return {
+                    detected: true,
+                    namespace: this.normalizeServerName(serverName),
+                    confidence: "high",
+                    toolsCovered: serverNameResult.matches,
+                    totalTools,
+                    matchPattern: "serverName",
+                    evidence: serverNameResult.matchedTools.slice(0, 5),
+                };
+            }
+        }
+        // Try common prefix detection
+        const prefixResult = this.findCommonPrefix(toolNames);
+        if (prefixResult) {
+            const coverageRatio = prefixResult.count / totalTools;
+            const confidence = coverageRatio >= 0.5 ? "high" : coverageRatio >= 0.3 ? "medium" : "low";
+            if (prefixResult.count >= 2 && coverageRatio >= 0.3) {
+                return {
+                    detected: true,
+                    namespace: prefixResult.prefix,
+                    confidence,
+                    toolsCovered: prefixResult.count,
+                    totalTools,
+                    matchPattern: "prefix",
+                    evidence: prefixResult.matchedTools.slice(0, 5),
+                };
+            }
+        }
+        // No namespace detected
+        return {
+            detected: false,
+            confidence: "low",
+            toolsCovered: 0,
+            totalTools,
+            matchPattern: "none",
+        };
+    }
+    /**
+     * Find common prefix among tool names.
+     * Handles both snake_case (calc_add) and camelCase (calcAdd) conventions.
+     */
+    findCommonPrefix(toolNames) {
+        if (toolNames.length < 2)
+            return null;
+        // Build prefix frequency map
+        const prefixCounts = new Map();
+        for (const name of toolNames) {
+            // Extract prefix using snake_case separator
+            const snakeMatch = name.match(/^([a-z]+)_/);
+            if (snakeMatch && snakeMatch[1].length >= 3) {
+                const prefix = snakeMatch[1];
+                if (!prefixCounts.has(prefix)) {
+                    prefixCounts.set(prefix, []);
+                }
+                prefixCounts.get(prefix).push(name);
+            }
+            // Extract prefix using camelCase pattern
+            const camelMatch = name.match(/^([a-z]+)[A-Z]/);
+            if (camelMatch && camelMatch[1].length >= 3) {
+                const prefix = camelMatch[1];
+                if (!prefixCounts.has(prefix)) {
+                    prefixCounts.set(prefix, []);
+                }
+                // Avoid double-counting if snake_case already found this name
+                const existing = prefixCounts.get(prefix);
+                if (!existing.includes(name)) {
+                    existing.push(name);
+                }
+            }
+        }
+        // Find the prefix with the most matches
+        let bestPrefix = null;
+        let bestCount = 0;
+        let bestTools = [];
+        for (const [prefix, tools] of prefixCounts) {
+            if (tools.length > bestCount) {
+                bestPrefix = prefix;
+                bestCount = tools.length;
+                bestTools = tools;
+            }
+        }
+        if (bestPrefix && bestCount >= 2) {
+            return {
+                prefix: bestPrefix,
+                count: bestCount,
+                matchedTools: bestTools,
+            };
+        }
+        return null;
+    }
+    /**
+     * Check if tool names use the server name as a prefix.
+     * Normalizes server name to match common patterns.
+     */
+    checkServerNamePrefix(toolNames, serverName) {
+        const normalizedServerName = this.normalizeServerName(serverName);
+        const matchedTools = [];
+        for (const name of toolNames) {
+            const nameLower = name.toLowerCase();
+            // Check snake_case prefix (e.g., myserver_tool)
+            if (nameLower.startsWith(normalizedServerName + "_")) {
+                matchedTools.push(name);
+                continue;
+            }
+            // Check camelCase prefix (e.g., myserverTool)
+            if (nameLower.startsWith(normalizedServerName) &&
+                name.length > normalizedServerName.length &&
+                /[A-Z]/.test(name[normalizedServerName.length])) {
+                matchedTools.push(name);
+                continue;
+            }
+            // Check kebab-case prefix (e.g., myserver-tool)
+            if (nameLower.startsWith(normalizedServerName + "-")) {
+                matchedTools.push(name);
+            }
+        }
+        return {
+            matches: matchedTools.length,
+            matchedTools,
+        };
+    }
+    /**
+     * Normalize server name for prefix matching.
+     * Converts "My-Server" -> "myserver", "my_server" -> "myserver"
+     */
+    normalizeServerName(serverName) {
+        return serverName.toLowerCase().replace(/[-_\s]/g, "");
+    }
+    // ============================================================================
     // Combined Status, Explanation, and Recommendations
     // ============================================================================
     determineOverallStatus(overallScore) {

package/lib/services/assessment/modules/ManifestValidationAssessor.d.ts

@@ -13,7 +13,37 @@
 import { BaseAssessor } from "./BaseAssessor.js";
 import { AssessmentContext } from "../AssessmentOrchestrator.js";
 import type { ManifestValidationAssessment } from "../../../lib/assessmentTypes.js";
+/**
+ * Calculate Levenshtein distance between two strings
+ * Uses space-optimized two-row algorithm for O(min(n,m)) memory
+ * Used for "did you mean?" suggestions on mismatched tool names (Issue #140)
+ * Exported for testing (Issue #141 - ISSUE-002)
+ */
+export declare function levenshteinDistance(a: string, b: string, maxDist?: number): number;
 export declare class ManifestValidationAssessor extends BaseAssessor {
+    /**
+     * Get mcp_config from manifest (supports both root and nested v0.3 format)
+     * Issue #138: Manifest v0.3 places mcp_config under server object
+     *
+     * @param manifest - The parsed manifest JSON
+     * @returns The mcp_config object or undefined if not found in either location
+     */
+    private getMcpConfig;
+    /**
+     * Extract contact information from manifest (Issue #141 - D4 check)
+     * Supports: author object, author string (email parsing), repository fallback
+     *
+     * @param manifest - The parsed manifest JSON
+     * @returns Extracted contact info or undefined if no contact info found
+     */
+    private extractContactInfo;
+    /**
+     * Extract version information from manifest (Issue #141 - D5 check)
+     *
+     * @param manifest - The parsed manifest JSON
+     * @returns Extracted version info or undefined if no version found
+     */
+    private extractVersionInfo;
     /**
      * Run manifest validation assessment
      */
@@ -54,6 +84,16 @@ export declare class ManifestValidationAssessor extends BaseAssessor {
      * Validate version format (semver)
      */
     private validateVersionFormat;
+    /**
+     * Validate manifest tool declarations against actual server tools (Issue #140)
+     * Compares tool names in manifest.tools against context.tools from tools/list
+     * Uses Levenshtein distance for "did you mean?" suggestions
+     */
+    private validateToolNamesMatch;
+    /**
+     * Fetch with retry logic for transient network failures
+     */
+    private fetchWithRetry;
     /**
      * Validate privacy policy URLs are accessible
      */

package/lib/services/assessment/modules/ManifestValidationAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ManifestValidationAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ManifestValidationAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EACV,4BAA4B,EAK7B,MAAM,uBAAuB,CAAC;AAM/B,qBAAa,0BAA2B,SAAQ,YAAY;IAC1D;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,CAAC;IA6JxC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAmB/B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAgC/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAiC7B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAiChC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+CzB;;OAEG;IACH,OAAO,CAAC,YAAY;IAqCpB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA8B7B;;OAEG;YACW,yBAAyB;IAqFvC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAsB/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0C3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CA+ChC"}
+{"version":3,"file":"ManifestValidationAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ManifestValidationAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,KAAK,EACV,4BAA4B,EAS7B,MAAM,uBAAuB,CAAC;AAO/B;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,EACT,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAwCR;AA+BD,qBAAa,0BAA2B,SAAQ,YAAY;IAC1D;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAcpB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAqC1B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,CAAC;IAiMxC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAmB/B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAgC/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAiC7B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAiChC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+CzB;;OAEG;IACH,OAAO,CAAC,YAAY;IAqCpB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA4B7B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAyE9B;;OAEG;YACW,cAAc;IAuC5B;;OAEG;YACW,yBAAyB;IAmEvC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAsB/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0C3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CA+ChC"}