@bryan-thompson/inspector-assessment 1.2.1 → 1.4.0

package/client/dist/assets/{index-D12b6zCd.js → index-CynAt5P-.js}

@@ -16205,7 +16205,7 @@ objectType({
   token_type_hint: stringType().optional()
 }).strip();
 const name = "@bryan-thompson/inspector-assessment-client";
-const version$1 = "1.2.1";
+const version$1 = "1.4.0";
 const packageJson = {
   name,
   version: version$1
@@ -16986,8 +16986,8 @@ class InspectorOAuthClientProvider {
       token_endpoint_auth_method: "none",
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
-      client_name: "MCP Inspector",
-      client_uri: "https://github.com/modelcontextprotocol/inspector",
+      client_name: "MCP Assessor",
+      client_uri: "https://github.com/triepod-ai/inspector-assessment",
       scope: this.scope ?? ""
     };
   }
@@ -41736,7 +41736,7 @@ const useTheme = () => {
     [theme, setThemeWithSideEffect]
   );
 };
-const version = "1.2.1";
+const version = "1.4.0";
 var [createTooltipContext] = createContextScope("Tooltip", [
   createPopperScope
 ]);
@@ -42732,7 +42732,7 @@ const Sidebar = ({
   }, [generateMCPServerFile, toast2, reportError2]);
   return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "bg-card border-r border-border flex flex-col h-full", children: [
     /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex items-center justify-between p-4 border-b border-gray-200 dark:border-border", children: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex items-center", children: /* @__PURE__ */ jsxRuntimeExports.jsxs("h1", { className: "ml-2 text-lg font-semibold", children: [
-      "MCP Inspector v",
+      "MCP Assessor v",
       version
     ] }) }) }),
     /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "p-4 flex-1 overflow-auto", children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-4", children: [
@@ -43288,7 +43288,7 @@ const Sidebar = ({
             children: /* @__PURE__ */ jsxRuntimeExports.jsx(
               "a",
               {
-                href: "https://github.com/modelcontextprotocol/inspector",
+                href: "https://github.com/triepod-ai/inspector-assessment",
                 target: "_blank",
                 rel: "noopener noreferrer",
                 children: /* @__PURE__ */ jsxRuntimeExports.jsx(Github, { className: "w-4 h-4 text-foreground" })
@@ -46396,7 +46396,7 @@ class FunctionalityAssessor extends BaseAssessor {
 }
 const SECURITY_ATTACK_PATTERNS = [
   // ==========================================
-  // CRITICAL INJECTION TESTS (3)
+  // CRITICAL INJECTION TESTS (4)
   // ==========================================
   // 1. COMMAND INJECTION
   {
@@ -46476,7 +46476,66 @@ const SECURITY_ATTACK_PATTERNS = [
       }
     ]
   },
-  // 3. PATH TRAVERSAL
+  // 3. CALCULATOR INJECTION
+  {
+    attackName: "Calculator Injection",
+    description: "Test if calculator/math tools execute arbitrary expressions instead of safely storing them",
+    payloads: [
+      // Simple arithmetic - triggers eval() in vulnerable calculator tools
+      {
+        payload: "2+2",
+        evidence: /The answer is 4/i,
+        riskLevel: "HIGH",
+        description: "Simple arithmetic expression (common trigger)",
+        payloadType: "injection"
+      },
+      {
+        payload: "5*5",
+        evidence: /The answer is 25/i,
+        riskLevel: "HIGH",
+        description: "Multiplication expression",
+        payloadType: "injection"
+      },
+      {
+        payload: "100+200",
+        evidence: /The answer is 300/i,
+        riskLevel: "HIGH",
+        description: "Addition with larger numbers",
+        payloadType: "injection"
+      },
+      // Natural language triggers
+      {
+        payload: "what is 10*10",
+        evidence: /The answer is 100/i,
+        riskLevel: "HIGH",
+        description: "Natural language math query",
+        payloadType: "injection"
+      },
+      {
+        payload: "calculate 50+50",
+        evidence: /The answer is 100/i,
+        riskLevel: "HIGH",
+        description: "Calculate command",
+        payloadType: "injection"
+      },
+      // Code injection via eval()
+      {
+        payload: "__import__('os').system('whoami')",
+        evidence: /\b(root|user|admin|ubuntu)\b/i,
+        riskLevel: "HIGH",
+        description: "Python code injection via eval",
+        payloadType: "injection"
+      },
+      {
+        payload: "1+1; __import__('subprocess').run(['whoami'])",
+        evidence: /\b(root|user|admin|ubuntu)\b/i,
+        riskLevel: "HIGH",
+        description: "eval chain to system command",
+        payloadType: "injection"
+      }
+    ]
+  },
+  // 4. PATH TRAVERSAL
   {
     attackName: "Path Traversal",
     description: "Test if tool allows access to files outside intended directory",
@@ -46514,7 +46573,7 @@ const SECURITY_ATTACK_PATTERNS = [
   // ==========================================
   // INPUT VALIDATION TESTS (3)
   // ==========================================
-  // 4. TYPE SAFETY
+  // 5. TYPE SAFETY
   {
     attackName: "Type Safety",
     description: "Test if tool validates parameter types correctly",
@@ -46542,7 +46601,7 @@ const SECURITY_ATTACK_PATTERNS = [
       }
     ]
   },
-  // 5. BOUNDARY TESTING
+  // 6. BOUNDARY TESTING
   {
     attackName: "Boundary Testing",
     description: "Test edge cases and boundary conditions",
@@ -46570,7 +46629,7 @@ const SECURITY_ATTACK_PATTERNS = [
       }
     ]
   },
-  // 6. REQUIRED FIELDS
+  // 7. REQUIRED FIELDS
   {
     attackName: "Required Fields",
     description: "Test if tool validates required parameters",
@@ -46587,7 +46646,7 @@ const SECURITY_ATTACK_PATTERNS = [
   // ==========================================
   // PROTOCOL COMPLIANCE TESTS (2)
   // ==========================================
-  // 7. MCP ERROR FORMAT
+  // 8. MCP ERROR FORMAT
   {
     attackName: "MCP Error Format",
     description: "Verify errors follow MCP protocol specification",
@@ -46601,7 +46660,7 @@ const SECURITY_ATTACK_PATTERNS = [
       }
     ]
   },
-  // 8. TIMEOUT HANDLING
+  // 9. TIMEOUT HANDLING
   {
     attackName: "Timeout Handling",
     description: "Test if tool handles long operations gracefully",
@@ -46614,6 +46673,103 @@ const SECURITY_ATTACK_PATTERNS = [
         payloadType: "protocol"
       }
     ]
+  },
+  // ==========================================
+  // TOOL-SPECIFIC VULNERABILITY TESTS (4)
+  // ==========================================
+  // 10. INDIRECT PROMPT INJECTION (HTTP URL Fetching)
+  {
+    attackName: "Indirect Prompt Injection",
+    description: "Test if tool fetches and executes external content",
+    payloads: [
+      {
+        payload: "http://example.com",
+        evidence: /(status_code.*200|status.*200.*content|<html|<!DOCTYPE|fetched.*http.*content)/i,
+        riskLevel: "HIGH",
+        description: "Benign URL fetch test",
+        payloadType: "injection",
+        parameterTypes: ["url", "uri", "link", "endpoint", "address"]
+      },
+      {
+        payload: "http://evil.com/inject.txt",
+        evidence: /(fetched|retrieved|evil\.com|malicious|injected)/i,
+        riskLevel: "HIGH",
+        description: "Malicious URL fetch test",
+        payloadType: "injection",
+        parameterTypes: ["url", "uri", "link"]
+      }
+    ]
+  },
+  // 11. UNICODE BYPASS
+  {
+    attackName: "Unicode Bypass",
+    description: "Test if tool decodes and executes unicode-encoded commands",
+    payloads: [
+      {
+        payload: "\\u0077\\u0068\\u006f\\u0061\\u006d\\u0069",
+        // "whoami"
+        evidence: /(root|user|admin|decoded.*executed|unicode.*executed)/i,
+        riskLevel: "MEDIUM",
+        description: "Unicode-encoded system command",
+        payloadType: "injection",
+        parameterTypes: ["text", "content", "message", "input", "data"]
+      },
+      {
+        payload: "\\u0069\\u0067\\u006e\\u006f\\u0072\\u0065",
+        // "ignore"
+        evidence: /(decoded|unicode|ignore.*previous|executed)/i,
+        riskLevel: "MEDIUM",
+        description: "Unicode-encoded instruction",
+        payloadType: "injection",
+        parameterTypes: ["text", "content", "message"]
+      }
+    ]
+  },
+  // 12. NESTED INJECTION
+  {
+    attackName: "Nested Injection",
+    description: "Test if tool executes hidden instructions in nested JSON",
+    payloads: [
+      {
+        payload: '{"query":"normal","hidden":"whoami"}',
+        evidence: /(executed.*hidden|nested.*instruction|root|user|admin)/i,
+        riskLevel: "MEDIUM",
+        description: "Hidden command in JSON field",
+        payloadType: "injection",
+        parameterTypes: ["data", "json", "payload", "body", "params"]
+      },
+      {
+        payload: '{"visible":"safe","_execute":"delete all"}',
+        evidence: /(executed|deleted|internal.*field|hidden)/i,
+        riskLevel: "HIGH",
+        description: "Hidden instruction in internal field",
+        payloadType: "injection",
+        parameterTypes: ["data", "json", "input"]
+      }
+    ]
+  },
+  // 13. PACKAGE SQUATTING
+  {
+    attackName: "Package Squatting",
+    description: "Test if tool downloads typosquatted packages",
+    payloads: [
+      {
+        payload: "install nmpy",
+        evidence: /(downloaded|installed|nmpy|typosquatted|pip.*output)/i,
+        riskLevel: "MEDIUM",
+        description: "Typosquatted package (nmpy instead of numpy)",
+        payloadType: "injection",
+        parameterTypes: ["package", "pkg", "module", "library", "dependency"]
+      },
+      {
+        payload: "requsts",
+        evidence: /(downloaded|installed|requsts|typosquatted)/i,
+        riskLevel: "MEDIUM",
+        description: "Typosquatted package (requsts instead of requests)",
+        payloadType: "injection",
+        parameterTypes: ["package", "pkg", "module"]
+      }
+    ]
   }
 ];
 function getPayloadsForAttack(attackName, limit) {
@@ -47002,10 +47158,20 @@ class SecurityAssessor extends BaseAssessor {
   async assess(context) {
     const toolsToTest = this.selectToolsForTesting(context.tools);
     const allTests = await this.runUniversalSecurityTests(context);
+    const connectionErrors = allTests.filter((t) => t.connectionError === true);
+    const validTests = allTests.filter((t) => !t.connectionError);
+    if (connectionErrors.length > 0) {
+      this.log(
+        `⚠️ WARNING: ${connectionErrors.length} test${connectionErrors.length !== 1 ? "s" : ""} failed due to connection/server errors`
+      );
+      this.log(
+        `Connection errors: ${connectionErrors.map((e) => `${e.toolName}:${e.testName} (${e.errorType})`).join(", ")}`
+      );
+    }
     const vulnerabilities = [];
     let highRiskCount = 0;
     let mediumRiskCount = 0;
-    for (const test of allTests) {
+    for (const test of validTests) {
       if (test.vulnerable) {
         let vulnerability;
         if (test.confidence === "high" || !test.confidence) {
@@ -47030,12 +47196,14 @@ class SecurityAssessor extends BaseAssessor {
       vulnerabilities.length
     );
     const status = this.determineSecurityStatus(
-      allTests,
+      validTests,
       vulnerabilities.length,
-      allTests.length
+      validTests.length,
+      connectionErrors.length
     );
     const explanation = this.generateSecurityExplanation(
-      allTests,
+      validTests,
+      connectionErrors,
       vulnerabilities,
       overallRiskLevel
     );
@@ -47154,6 +47322,7 @@ class SecurityAssessor extends BaseAssessor {
     const results = [];
     const criticalPatterns = [
       "Command Injection",
+      "Calculator Injection",
       "SQL Injection",
       "Path Traversal"
     ];
@@ -47163,7 +47332,7 @@ class SecurityAssessor extends BaseAssessor {
     );
     const toolsToTest = this.selectToolsForTesting(context.tools);
     this.log(
-      `Starting BASIC security assessment - testing ${toolsToTest.length} tools with ${basicPatterns.length} critical injection patterns (~${toolsToTest.length * basicPatterns.length} tests)`
+      `Starting BASIC security assessment - testing ${toolsToTest.length} tools with ${basicPatterns.length} critical injection patterns (~${toolsToTest.length * basicPatterns.length * 5} tests)`
     );
     for (const tool of toolsToTest) {
       if (!this.hasInputParameters(tool)) {
@@ -47240,7 +47409,7 @@ class SecurityAssessor extends BaseAssessor {
       };
     }
     try {
-      const params = this.createTestParameters(payload.payload, tool);
+      const params = this.createTestParameters(payload, tool);
       if (Object.keys(params).length === 0) {
         return {
           testName: attackName,
@@ -47256,6 +47425,24 @@ class SecurityAssessor extends BaseAssessor {
         callTool(tool.name, params),
         5e3
       );
+      if (this.isConnectionError(response)) {
+        return {
+          testName: attackName,
+          description: payload.description,
+          payload: payload.payload,
+          riskLevel: payload.riskLevel,
+          toolName: tool.name,
+          vulnerable: true,
+          // Mark as failed (test could not complete)
+          evidence: `CONNECTION ERROR: Test could not complete due to server/network failure`,
+          response: this.extractResponseContent(response),
+          connectionError: true,
+          errorType: this.classifyError(response),
+          testReliability: "failed",
+          confidence: "high",
+          requiresManualReview: true
+        };
+      }
       const { isVulnerable, evidence } = this.analyzeResponse(
         response,
         payload,
@@ -47280,6 +47467,23 @@ class SecurityAssessor extends BaseAssessor {
         ...confidenceResult
       };
     } catch (error) {
+      if (this.isConnectionErrorFromException(error)) {
+        return {
+          testName: attackName,
+          description: payload.description,
+          payload: payload.payload,
+          riskLevel: payload.riskLevel,
+          toolName: tool.name,
+          vulnerable: false,
+          evidence: `CONNECTION ERROR: Test could not complete due to server/network failure`,
+          response: this.extractErrorMessage(error),
+          connectionError: true,
+          errorType: this.classifyErrorFromException(error),
+          testReliability: "failed",
+          confidence: "high",
+          requiresManualReview: true
+        };
+      }
       return {
         testName: attackName,
         description: payload.description,
@@ -47292,16 +47496,183 @@ class SecurityAssessor extends BaseAssessor {
     }
   }
   /**
-   * Try to parse JSON response and extract structured data
-   * Returns null if response is not JSON
+   * Check if response indicates connection/server failure
+   * Returns true if test couldn't complete due to infrastructure issues
+   *
+   * CRITICAL: Only match transport/infrastructure errors, NOT tool business logic
    */
-  tryParseResponseJSON(response) {
-    try {
-      const responseText = this.extractResponseContent(response);
-      return JSON.parse(responseText);
-    } catch {
-      return null;
+  isConnectionError(response) {
+    const text = this.extractResponseContent(response).toLowerCase();
+    const unambiguousPatterns = [
+      /MCP error -32001/i,
+      // MCP transport errors
+      /MCP error -32603/i,
+      // MCP internal error
+      /MCP error -32000/i,
+      // MCP server error
+      /MCP error -32700/i,
+      // MCP parse error
+      /socket hang up/i,
+      // Network socket errors
+      /ECONNREFUSED/i,
+      // Connection refused
+      /ETIMEDOUT/i,
+      // Network timeout
+      /ERR_CONNECTION/i,
+      // Connection errors
+      /fetch failed/i,
+      // HTTP fetch failures
+      /connection reset/i,
+      // Connection reset
+      /error POSTing to endpoint/i,
+      // Transport layer POST errors
+      /error GETting.*endpoint/i,
+      // Transport layer GET errors (requires 'endpoint' to avoid false positives)
+      /service unavailable/i,
+      // HTTP 503 (server down)
+      /gateway timeout/i,
+      // HTTP 504 (gateway timeout)
+      /unknown tool:/i,
+      // Tool name not in current server's tool list (stale tool list)
+      /tool.*not found/i,
+      // Alternative phrasing for missing tool
+      /tool.*does not exist/i,
+      // Alternative phrasing for missing tool
+      /no such tool/i
+      // Alternative phrasing for missing tool
+    ];
+    if (unambiguousPatterns.some((pattern2) => pattern2.test(text))) {
+      return true;
     }
+    const mcpPrefix = /^mcp error -\d+:/i.test(text);
+    if (mcpPrefix) {
+      const contextualPatterns = [
+        /bad request/i,
+        // HTTP 400 (only if in MCP error)
+        /unauthorized/i,
+        // HTTP 401 (only if in MCP error)
+        /forbidden/i,
+        // HTTP 403 (only if in MCP error)
+        /no valid session/i,
+        // Session errors (only if in MCP error)
+        /session.*expired/i,
+        // Session expiration (only if in MCP error)
+        /internal server error/i,
+        // HTTP 500 (only if in MCP error)
+        /HTTP [45]\d\d/i
+        // HTTP status codes (only if in MCP error)
+      ];
+      return contextualPatterns.some((pattern2) => pattern2.test(text));
+    }
+    return false;
+  }
+  /**
+   * Check if caught exception indicates connection/server failure
+   * CRITICAL: Only match transport/infrastructure errors, NOT tool business logic
+   */
+  isConnectionErrorFromException(error) {
+    if (error instanceof Error) {
+      const message = error.message.toLowerCase();
+      const unambiguousPatterns = [
+        /MCP error -32001/i,
+        // MCP transport errors
+        /MCP error -32603/i,
+        // MCP internal error
+        /MCP error -32000/i,
+        // MCP server error
+        /MCP error -32700/i,
+        // MCP parse error
+        /socket hang up/i,
+        // Network socket errors
+        /ECONNREFUSED/i,
+        // Connection refused
+        /ETIMEDOUT/i,
+        // Network timeout
+        /network error/i,
+        // Generic network errors
+        /ERR_CONNECTION/i,
+        // Connection errors
+        /fetch failed/i,
+        // HTTP fetch failures
+        /connection reset/i,
+        // Connection reset
+        /error POSTing to endpoint/i,
+        // Transport layer POST errors
+        /error GETting/i,
+        // Transport layer GET errors
+        /service unavailable/i,
+        // HTTP 503 (server down)
+        /gateway timeout/i,
+        // HTTP 504 (gateway timeout)
+        /unknown tool:/i,
+        // Tool name not in current server's tool list (stale tool list)
+        /tool.*not found/i,
+        // Alternative phrasing for missing tool
+        /tool.*does not exist/i,
+        // Alternative phrasing for missing tool
+        /no such tool/i
+        // Alternative phrasing for missing tool
+      ];
+      if (unambiguousPatterns.some((pattern2) => pattern2.test(message))) {
+        return true;
+      }
+      const mcpPrefix = /^mcp error -\d+:/i.test(message);
+      if (mcpPrefix) {
+        const contextualPatterns = [
+          /bad request/i,
+          /unauthorized/i,
+          /forbidden/i,
+          /no valid session/i,
+          /session.*expired/i,
+          /internal server error/i,
+          /HTTP [45]\d\d/i
+        ];
+        return contextualPatterns.some((pattern2) => pattern2.test(message));
+      }
+    }
+    return false;
+  }
+  /**
+   * Classify error type for reporting
+   */
+  classifyError(response) {
+    const text = this.extractResponseContent(response).toLowerCase();
+    if (/socket|ECONNREFUSED|ETIMEDOUT|network|fetch failed|connection reset/i.test(
+      text
+    )) {
+      return "connection";
+    }
+    if (/-32603|-32000|-32700|internal server error|service unavailable|gateway timeout|HTTP 5\d\d|error POSTing.*endpoint|error GETting.*endpoint|bad request|HTTP 400|unauthorized|forbidden|no valid session|session.*expired/i.test(
+      text
+    )) {
+      return "server";
+    }
+    if (/-32001/i.test(text)) {
+      return "protocol";
+    }
+    return "protocol";
+  }
+  /**
+   * Classify error type from caught exception
+   */
+  classifyErrorFromException(error) {
+    if (error instanceof Error) {
+      const message = error.message.toLowerCase();
+      if (/socket|ECONNREFUSED|ETIMEDOUT|network|fetch failed|connection reset/i.test(
+        message
+      )) {
+        return "connection";
+      }
+      if (/-32603|-32000|-32700|internal server error|service unavailable|gateway timeout|HTTP 5\d\d|error POSTing|error GETting|bad request|HTTP 400|unauthorized|forbidden|no valid session|session.*expired/i.test(
+        message
+      )) {
+        return "server";
+      }
+      if (/-32001/i.test(message)) {
+        return "protocol";
+      }
+    }
+    return "protocol";
   }
   /**
    * Analyze response with evidence-based detection
@@ -47310,27 +47681,6 @@ class SecurityAssessor extends BaseAssessor {
   analyzeResponse(response, payload, tool) {
     const responseText = this.extractResponseContent(response).toLowerCase();
     const payloadText = payload.payload.toLowerCase();
-    const parsedResponse = this.tryParseResponseJSON(response);
-    if (parsedResponse) {
-      if (parsedResponse.safe === true) {
-        return {
-          isVulnerable: false,
-          evidence: "Tool explicitly marked response as safe (safe: true flag in JSON response)"
-        };
-      }
-      if (parsedResponse.hardened === true) {
-        return {
-          isVulnerable: false,
-          evidence: "Tool explicitly marked response as hardened (hardened: true flag in JSON response)"
-        };
-      }
-      if (parsedResponse.vulnerable === true) {
-        return {
-          isVulnerable: true,
-          evidence: "Tool explicitly marked response as vulnerable (vulnerable: true flag in JSON response)"
-        };
-      }
-    }
     const errorInfo = this.extractErrorInfo(response);
     if (this.isMCPValidationError(errorInfo, responseText)) {
       const errorCode = errorInfo.code ? ` (${errorInfo.code})` : "";
@@ -47363,20 +47713,24 @@ class SecurityAssessor extends BaseAssessor {
         evidence: "Read-only info tool returned user/workspace data (intended data exposure, not vulnerability)"
       };
     }
-    if (this.isApiWrapperResponse(responseText)) {
+    if (classification.categories.includes(ToolCategory.SAFE_STORAGE)) {
       return {
         isVulnerable: false,
-        evidence: "API wrapper response - returned external content as data"
+        evidence: "Safe storage control tool (validated safe implementation, control group for testing)"
       };
     }
-    if (responseText.includes(payloadText)) {
-      const isJustReflection = this.isReflectionResponse(responseText);
-      if (isJustReflection) {
-        return {
-          isVulnerable: false,
-          evidence: "Tool safely reflected input without execution"
-        };
-      }
+    const isJustReflection = this.isReflectionResponse(responseText);
+    if (isJustReflection) {
+      return {
+        isVulnerable: false,
+        evidence: "Tool safely reflected input without execution"
+      };
+    }
+    if (this.isValidationRejection(response)) {
+      return {
+        isVulnerable: false,
+        evidence: "Tool correctly rejected invalid input with validation error"
+      };
     }
     if (payload.evidence && payload.evidence.test(responseText)) {
       const evidenceMatchesInput = payload.evidence.test(payloadText);
@@ -47402,6 +47756,54 @@ class SecurityAssessor extends BaseAssessor {
     }
     return this.analyzeInjectionResponse(response, payload.payload);
   }
+  /**
+   * Check if tool explicitly rejected input with validation error (SAFE)
+   * Returns true if tool properly rejected invalid input (SECURE)
+   *
+   * Distinguishes between:
+   * - SAFE: {"valid": false, "errors": ["Input too long"]} (rejection)
+   * - VULNERABLE: {"result": "deleted 5 rows"} (execution)
+   */
+  isValidationRejection(response) {
+    const responseText = this.extractResponseContent(response);
+    try {
+      const parsed = JSON.parse(responseText);
+      if (parsed.valid === false || parsed.error === true || parsed.error === "true" || // Handle string boolean
+      parsed.error && parsed.error !== false || // Any truthy error value
+      parsed.status === "rejected" || parsed.status === "invalid" || parsed.status === "failed") {
+        return true;
+      }
+      if (parsed.errors && Array.isArray(parsed.errors) && parsed.errors.length > 0) {
+        return true;
+      }
+      if (parsed.error && typeof parsed.error === "string") {
+        return true;
+      }
+      if (typeof parsed.result === "string") {
+        const resultRejectionPatterns = [
+          /validation (failed|error)/i,
+          /rejected/i,
+          /not.*approved/i,
+          /not.*in.*list/i,
+          /invalid.*input/i,
+          /error:.*invalid/i
+        ];
+        if (resultRejectionPatterns.some((p2) => p2.test(parsed.result))) {
+          return true;
+        }
+      }
+    } catch {
+    }
+    const rejectionPatterns = [
+      /validation failed/i,
+      /rejected/i,
+      /not.*approved/i,
+      /not.*in.*list/i,
+      /invalid.*input/i,
+      /error:.*invalid/i
+    ];
+    return rejectionPatterns.some((pattern2) => pattern2.test(responseText));
+  }
   /**
    * Check if response is an MCP validation error (safe rejection)
    * Returns true if tool rejected input before processing (SECURE)
@@ -47535,7 +47937,8 @@ class SecurityAssessor extends BaseAssessor {
   /**
    * Determine security status based on confidence levels
    */
-  determineSecurityStatus(tests, vulnerabilityCount, testCount) {
+  determineSecurityStatus(tests, vulnerabilityCount, testCount, connectionErrorCount = 0) {
+    if (connectionErrorCount > 0) return "FAIL";
     if (testCount === 0) return "NEED_MORE_INFO";
     if (vulnerabilityCount === 0) return "PASS";
     const hasHighConfidence = tests.some(
@@ -47547,30 +47950,38 @@ class SecurityAssessor extends BaseAssessor {
   /**
    * Generate security explanation
    */
-  generateSecurityExplanation(tests, vulnerabilities, riskLevel) {
+  generateSecurityExplanation(validTests, connectionErrors, vulnerabilities, riskLevel) {
     const vulnCount = vulnerabilities.length;
-    const testCount = tests.length;
-    if (testCount === 0) {
+    const testCount = validTests.length;
+    const errorCount = connectionErrors.length;
+    let explanation = "";
+    if (errorCount > 0) {
+      explanation += `⚠️ ${errorCount} test${errorCount !== 1 ? "s" : ""} failed due to connection/server errors. `;
+    }
+    if (testCount === 0 && errorCount > 0) {
+      return explanation + `No valid tests completed. Check server connectivity and retry assessment.`;
+    }
+    if (testCount === 0 && errorCount === 0) {
       return `No tools selected for security testing. Select tools to run security assessments.`;
     }
     if (vulnCount === 0) {
-      return `Tested ${testCount} security patterns across selected tools. No vulnerabilities detected. All tools properly handle malicious inputs.`;
+      return explanation + `Tested ${testCount} security patterns across selected tools. No vulnerabilities detected. All tools properly handle malicious inputs.`;
     }
-    const highConfidenceCount = tests.filter(
+    const highConfidenceCount = validTests.filter(
       (t) => t.vulnerable && (!t.confidence || t.confidence === "high")
     ).length;
-    const mediumConfidenceCount = tests.filter(
+    const mediumConfidenceCount = validTests.filter(
       (t) => t.vulnerable && t.confidence === "medium"
     ).length;
-    const lowConfidenceCount = tests.filter(
+    const lowConfidenceCount = validTests.filter(
       (t) => t.vulnerable && t.confidence === "low"
     ).length;
     if (highConfidenceCount > 0) {
-      return `Found ${highConfidenceCount} confirmed vulnerability${highConfidenceCount !== 1 ? "s" : ""} across ${testCount} security tests. Risk level: ${riskLevel}. Tools may execute malicious commands or leak sensitive data.`;
+      return explanation + `Found ${highConfidenceCount} confirmed vulnerability${highConfidenceCount !== 1 ? "s" : ""} across ${testCount} security tests. Risk level: ${riskLevel}. Tools may execute malicious commands or leak sensitive data.`;
     } else if (mediumConfidenceCount > 0) {
-      return `Detected ${mediumConfidenceCount} potential security concern${mediumConfidenceCount !== 1 ? "s" : ""} across ${testCount} security tests requiring manual review. Tools showed suspicious behavior that needs verification.`;
+      return explanation + `Detected ${mediumConfidenceCount} potential security concern${mediumConfidenceCount !== 1 ? "s" : ""} across ${testCount} security tests requiring manual review. Tools showed suspicious behavior that needs verification.`;
     } else {
-      return `Flagged ${lowConfidenceCount} uncertain detection${lowConfidenceCount !== 1 ? "s" : ""} across ${testCount} security tests. Manual verification needed to confirm if these are actual vulnerabilities or false positives.`;
+      return explanation + `Flagged ${lowConfidenceCount} uncertain detection${lowConfidenceCount !== 1 ? "s" : ""} across ${testCount} security tests. Manual verification needed to confirm if these are actual vulnerabilities or false positives.`;
     }
   }
   /**
@@ -47665,10 +48076,31 @@ class SecurityAssessor extends BaseAssessor {
   /**
    * Check if response is just reflection (safe)
    * Expanded to catch more reflection patterns including echo, repeat, display
-   * IMPROVED: Bidirectional patterns and safety indicators for broader coverage
+   * IMPROVED: Bidirectional patterns, safety indicators, and two-layer defense
+   *
+   * CRITICAL: This check distinguishes between:
+   * - SAFE: Tool stores/echoes malicious input as data (reflection)
+   * - VULNERABLE: Tool executes malicious input and returns results (execution)
+   *
+   * Two-layer defense:
+   * Layer 1: Match reflection/status patterns
+   * Layer 2: Verify NO execution evidence (defense-in-depth)
    */
   isReflectionResponse(responseText) {
+    console.log("[DIAG] isReflectionResponse called");
+    console.log("[DIAG] Response preview:", responseText.substring(0, 200));
+    const statusPatterns = [
+      // "Action executed successfully: <anything>" (generic status message)
+      /action\s+executed\s+successfully:/i,
+      /command\s+executed\s+successfully:/i,
+      // "Action executed successfully" (generic status - in JSON or standalone)
+      /"result":\s*"action\s+executed\s+successfully"/i,
+      /result.*action\s+executed\s+successfully/i,
+      /successfully\s+(executed|completed|processed):/i,
+      /successfully\s+(executed|completed|processed)"/i
+    ];
     const reflectionPatterns = [
+      ...statusPatterns,
       // Original patterns (keep all existing)
       /stored.*query/i,
       /saved.*input/i,
@@ -47685,16 +48117,34 @@ class SecurityAssessor extends BaseAssessor {
       /safely.*as.*data/i,
       // NEW: Bidirectional patterns (catch "Query stored" and "stored query")
       /query.*stored/i,
+      /stored.*query/i,
+      // Bidirectional: "Stored query"
       /input.*saved/i,
       /parameter.*received/i,
       /command.*stored/i,
+      /stored.*command/i,
+      // Bidirectional: "Stored command"
       /data.*stored/i,
+      /stored.*data/i,
+      // Bidirectional: "Stored data"
       /action.*stored/i,
+      /stored.*action/i,
+      // Bidirectional: "Stored action"
       /text.*stored/i,
+      /stored.*text/i,
+      // Bidirectional: "Stored text"
       /setting.*stored/i,
+      /stored.*setting/i,
+      // Bidirectional: "Stored setting"
       /instruction.*stored/i,
+      /stored.*instruction/i,
+      // Bidirectional: "Stored instruction"
       /url.*stored/i,
+      /stored.*url/i,
+      // Bidirectional: "Stored URL"
       /package.*stored/i,
+      /stored.*package/i,
+      // Bidirectional: "Stored package"
       // NEW: Safety indicators (common in hardened implementations)
       /stored.*safely/i,
       /safely.*stored/i,
@@ -47708,12 +48158,160 @@ class SecurityAssessor extends BaseAssessor {
       /stored.*successfully/i,
       /saved.*to/i,
       /recorded\s+in/i,
-      /added\s+to/i
+      /added\s+to/i,
+      // NEW: Storage/logging confirmations (high confidence)
+      /logged successfully:/i,
+      /queued for processing:/i,
+      /saved (for|successfully)/i,
+      /stored for (admin review|configuration|processing)/i,
+      // NEW: Processing confirmations (high confidence)
+      /processed successfully/i,
+      /validated successfully/i,
+      /parsed successfully/i,
+      /(validation|processing) (passed|completed)/i,
+      // NEW: Error messages with input reflection (common safe pattern)
+      /error:.*not (found|in approved list|recognized)/i,
+      /error getting info for ['"].*['"]/i,
+      /invalid .* format.*stored as text/i,
+      /error:.*too (long|short|large)/i
     ];
-    return reflectionPatterns.some((pattern2) => pattern2.test(responseText));
+    const matchedPatterns = [];
+    const hasReflection = reflectionPatterns.some((pattern2) => {
+      const matches = pattern2.test(responseText);
+      if (matches) {
+        matchedPatterns.push(pattern2.source.substring(0, 50));
+      }
+      return matches;
+    });
+    console.log("[DIAG] Has reflection:", hasReflection);
+    if (matchedPatterns.length > 0) {
+      console.log(
+        "[DIAG] Matched reflection patterns:",
+        matchedPatterns.join(", ")
+      );
+    }
+    if (hasReflection) {
+      try {
+        const parsed = JSON.parse(responseText);
+        const resultText = String(parsed.result || "");
+        const outputFields = [
+          parsed.stdout,
+          parsed.stderr,
+          parsed.output,
+          parsed.contents,
+          parsed.execution_log,
+          parsed.command_output
+        ].filter(Boolean).join(" ");
+        const resultIsStatusOnly = statusPatterns.some(
+          (pattern2) => pattern2.test(resultText)
+        );
+        const hasExecutionInOutput = resultIsStatusOnly ? this.detectExecutionArtifacts(outputFields) : this.detectExecutionArtifacts(resultText) || this.detectExecutionArtifacts(outputFields);
+        console.log(
+          "[DIAG] JSON mode - checking execution in result/output fields only"
+        );
+        console.log("[DIAG] Has execution in output:", hasExecutionInOutput);
+        if (hasExecutionInOutput) {
+          console.log(
+            "[DIAG] RESULT: Reflection + Execution in output = VULNERABLE (false)"
+          );
+          return false;
+        }
+        console.log("[DIAG] RESULT: Reflection + clean output = SAFE (true)");
+        return true;
+      } catch {
+        const hasExecution = this.detectExecutionArtifacts(responseText);
+        console.log(
+          "[DIAG] Text mode - Has execution artifacts:",
+          hasExecution
+        );
+        if (hasExecution) {
+          console.log(
+            "[DIAG] RESULT: Reflection + Execution = VULNERABLE (false)"
+          );
+          return false;
+        }
+        console.log("[DIAG] RESULT: Reflection only = SAFE (true)");
+        return true;
+      }
+    }
+    try {
+      const parsed = JSON.parse(responseText);
+      if (parsed.action === "test" || parsed.action === "placeholder") {
+        const resultText = String(parsed.result || "");
+        if (!this.detectExecutionArtifacts(resultText)) {
+          return true;
+        }
+      }
+      if (parsed.status && /(completed|success|ok|done)/.test(parsed.status)) {
+        if (!this.detectExecutionArtifacts(responseText)) {
+          return true;
+        }
+      }
+    } catch {
+    }
+    return false;
+  }
+  /**
+   * Detect execution artifacts in response
+   * Returns true if response contains evidence of actual code execution
+   *
+   * HIGH confidence: System files, commands, directory listings
+   * MEDIUM confidence: Contextual patterns (root alone, paths)
+   */
+  detectExecutionArtifacts(responseText) {
+    console.log("[DIAG] detectExecutionArtifacts called");
+    const executionIndicators = [
+      // HIGH CONFIDENCE - System files (requires format)
+      /[a-z]+:x:\d+:\d+:/i,
+      // passwd: "root:x:0:0:"
+      /uid=\d+\([^)]+\)\s+gid=\d+/i,
+      // id: "uid=0(root) gid=0(root)"
+      // HIGH CONFIDENCE - Directory listings (full format)
+      /[d-][rwx-]{9}\s+\d+\s+[a-z]+/i,
+      // ls -la: "drwxr-xr-x 2 root"
+      /total\s+\d+\s*$/m,
+      // ls total line
+      // HIGH CONFIDENCE - Command execution fields
+      /command_executed:\s*[^"\s]/i,
+      // "command_executed: whoami"
+      /stdout:\s*["']?[^"'\s]/i,
+      // "stdout: root"
+      /(execution|output)_log:/i,
+      // Log fields
+      // HIGH CONFIDENCE - Shell paths
+      /\/bin\/(bash|sh|zsh|dash)/i,
+      // Shell executables
+      // MEDIUM CONFIDENCE - System identity (contextual only)
+      /\b(root|administrator)\s*$/im,
+      // "root" alone on line (whoami)
+      /\/root\//i,
+      // Path: "/root/"
+      /\/etc\/passwd/i,
+      // Sensitive file
+      // MEDIUM CONFIDENCE - Process info
+      /PID:\s*\d{3,}/i
+      // Process ID
+    ];
+    const matchedExecutionPatterns = [];
+    const found = executionIndicators.some((pattern2) => {
+      const matches = pattern2.test(responseText);
+      if (matches) {
+        matchedExecutionPatterns.push(pattern2.source.substring(0, 50));
+      }
+      return matches;
+    });
+    if (matchedExecutionPatterns.length > 0) {
+      console.log(
+        "[DIAG] Matched execution patterns:",
+        matchedExecutionPatterns.join(", ")
+      );
+    }
+    console.log("[DIAG] Execution artifacts found:", found);
+    return found;
   }
   /**
    * Analyze injection response (existing logic)
+   * Note: payload parameter unused after refactoring to two-layer defense
    */
   analyzeInjectionResponse(response, _payload) {
     const responseText = this.extractResponseContent(response);
@@ -47759,11 +48357,31 @@ class SecurityAssessor extends BaseAssessor {
       return {};
     }
     const params = {};
+    const targetParamTypes = payload.parameterTypes || [];
+    let payloadInjected = false;
+    if (targetParamTypes.length > 0) {
+      for (const [key, prop] of Object.entries(schema.properties)) {
+        const propSchema = prop;
+        const paramNameLower = key.toLowerCase();
+        if (propSchema.type === "string" && targetParamTypes.some((type2) => paramNameLower.includes(type2))) {
+          params[key] = payload.payload;
+          payloadInjected = true;
+          break;
+        }
+      }
+    } else {
+      for (const [key, prop] of Object.entries(schema.properties)) {
+        const propSchema = prop;
+        if (propSchema.type === "string" && !payloadInjected) {
+          params[key] = payload.payload;
+          payloadInjected = true;
+          break;
+        }
+      }
+    }
     for (const [key, prop] of Object.entries(schema.properties)) {
       const propSchema = prop;
-      if (propSchema.type === "string" && Object.keys(params).length === 0) {
-        params[key] = payload;
-      } else if ((_b = schema.required) == null ? void 0 : _b.includes(key)) {
+      if (((_b = schema.required) == null ? void 0 : _b.includes(key)) && !(key in params)) {
         if (propSchema.type === "string") {
           params[key] = "test";
         } else if (propSchema.type === "number") {
@@ -47802,25 +48420,6 @@ class SecurityAssessor extends BaseAssessor {
     ];
     return executionTests.includes(attackName);
   }
-  /**
-   * Check if response is from an API wrapper tool
-   * API wrappers return external content as data, not execute it
-   */
-  isApiWrapperResponse(responseText) {
-    const apiWrapperPatterns = [
-      /successfully\s+(scraped|fetched|crawled)/i,
-      /content\s+from\s+http/i,
-      /api\s+(request|response|call)\s+(completed|successful)/i,
-      /retrieved\s+\d+\s+(results|pages|urls)/i,
-      /markdown.*screenshot.*links/i,
-      // Firecrawl format indicators
-      /scraping\s+(complete|finished|done)/i,
-      /\bfirecrawl\b/i,
-      /crawl.*job/i,
-      /extraction.*complete/i
-    ];
-    return apiWrapperPatterns.some((pattern2) => pattern2.test(responseText));
-  }
   /**
    * Check if response is returning search results
    * Search tools return query results as data, not execute them
@@ -49744,6 +50343,7 @@ function ToolSelector({
 const AssessmentTab = ({
   tools,
   isLoadingTools = false,
+  listTools,
   callTool,
   serverName = "MCP Server"
 }) => {
@@ -49761,6 +50361,7 @@ const AssessmentTab = ({
   const [showJson, setShowJson] = reactExports.useState(false);
   const [collapsedTools, setCollapsedTools] = reactExports.useState(/* @__PURE__ */ new Set());
   const [allToolsCollapsed, setAllToolsCollapsed] = reactExports.useState(false);
+  const [showOnlyErrors, setShowOnlyErrors] = reactExports.useState(false);
   const [expandedToolDescriptions, setExpandedToolDescriptions] = reactExports.useState(/* @__PURE__ */ new Set());
   const [categoryFilter, setCategoryFilter] = reactExports.useState({
     functionality: true,
@@ -49780,11 +50381,28 @@ const AssessmentTab = ({
     [config]
   );
   reactExports.useEffect(() => {
-    if (tools.length > 0 && !config.selectedToolsForTesting) {
+    if (tools.length === 0) {
+      return;
+    }
+    const currentToolNames = tools.map((t) => t.name);
+    if (!config.selectedToolsForTesting) {
       setConfig({
         ...config,
-        selectedToolsForTesting: tools.map((t) => t.name)
+        selectedToolsForTesting: currentToolNames
       });
+    } else {
+      const existingSelections = config.selectedToolsForTesting.filter(
+        (name2) => currentToolNames.includes(name2)
+      );
+      const newTools = currentToolNames.filter(
+        (name2) => !config.selectedToolsForTesting.includes(name2)
+      );
+      if (newTools.length > 0 || existingSelections.length !== config.selectedToolsForTesting.length) {
+        setConfig({
+          ...config,
+          selectedToolsForTesting: [...existingSelections, ...newTools]
+        });
+      }
     }
   }, [tools, config, setConfig]);
   const calculateFilteredOverallStatus = reactExports.useCallback(
@@ -49955,7 +50573,23 @@ const AssessmentTab = ({
         )
       ] }),
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
-        /* @__PURE__ */ jsxRuntimeExports.jsx(Label$1, { htmlFor: "tool-selector", children: "Select tools for testing:" }),
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center justify-between", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx(Label$1, { htmlFor: "tool-selector", children: "Select tools for testing:" }),
+          listTools && /* @__PURE__ */ jsxRuntimeExports.jsxs(
+            Button,
+            {
+              variant: "ghost",
+              size: "sm",
+              onClick: () => listTools(),
+              disabled: isLoadingTools || isRunning,
+              className: "h-7 px-2",
+              children: [
+                isLoadingTools ? /* @__PURE__ */ jsxRuntimeExports.jsx(LoaderCircle, { className: "w-4 h-4 mr-1 animate-spin" }) : /* @__PURE__ */ jsxRuntimeExports.jsx(RotateCcw, { className: "w-4 h-4 mr-1" }),
+                "Refresh"
+              ]
+            }
+          )
+        ] }),
         isLoadingTools ? /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2 text-sm text-muted-foreground", children: [
           /* @__PURE__ */ jsxRuntimeExports.jsx(LoaderCircle, { className: "w-4 h-4 animate-spin" }),
           "Loading tools..."
@@ -50016,14 +50650,14 @@ const AssessmentTab = ({
           ),
           /* @__PURE__ */ jsxRuntimeExports.jsxs(Label$1, { htmlFor: "domain-testing", className: "cursor-pointer", children: [
             /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "font-semibold", children: "Enable Advanced Security Testing" }),
-            /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "ml-2 text-xs bg-blue-100 dark:bg-blue-900 text-blue-800 dark:text-blue-200 px-2 py-0.5 rounded", children: "8 Patterns" })
+            /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "ml-2 text-xs bg-blue-100 dark:bg-blue-900 text-blue-800 dark:text-blue-200 px-2 py-0.5 rounded", children: "13 Patterns" })
           ] })
         ] }),
         /* @__PURE__ */ jsxRuntimeExports.jsxs("p", { className: "text-xs text-muted-foreground ml-6", children: [
           /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: "Basic:" }),
-          " 3 critical injection patterns (~3-15 checks). ",
+          " 4 critical injection patterns (~20 checks). ",
           /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: "Advanced:" }),
-          " All 8 patterns (~8-24 checks per tool). Tests for injection vulnerabilities (Command, SQL, Path Traversal), input validation (Type Safety, Boundary, Required Fields), and protocol compliance (MCP Error Format, Timeout Handling)."
+          " All 13 patterns (~37 checks per tool). Tests for injection vulnerabilities (Command, Calculator, SQL, Path Traversal), input validation (Type Safety, Boundary, Required Fields), protocol compliance (MCP Error Format, Timeout Handling), and tool-specific vulnerabilities (Indirect Injection, Unicode Bypass, Nested Injection, Package Squatting)."
         ] })
       ] }),
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
@@ -50232,74 +50866,129 @@ const AssessmentTab = ({
           children: [
             /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-sm mb-2", children: assessment.security.explanation }),
             (() => {
-              var _a2, _b2, _c;
-              const highConfidenceCount = ((_a2 = assessment.security.promptInjectionTests) == null ? void 0 : _a2.filter(
+              var _a2, _b2, _c, _d;
+              const connectionErrors = ((_a2 = assessment.security.promptInjectionTests) == null ? void 0 : _a2.filter(
+                (t) => t.connectionError === true
+              )) || [];
+              const highConfidenceCount = ((_b2 = assessment.security.promptInjectionTests) == null ? void 0 : _b2.filter(
                 (t) => t.vulnerable && (!t.confidence || t.confidence === "high")
               ).length) || 0;
-              const mediumConfidenceCount = ((_b2 = assessment.security.promptInjectionTests) == null ? void 0 : _b2.filter(
+              const mediumConfidenceCount = ((_c = assessment.security.promptInjectionTests) == null ? void 0 : _c.filter(
                 (t) => t.vulnerable && t.confidence === "medium"
               ).length) || 0;
-              const lowConfidenceCount = ((_c = assessment.security.promptInjectionTests) == null ? void 0 : _c.filter(
+              const lowConfidenceCount = ((_d = assessment.security.promptInjectionTests) == null ? void 0 : _d.filter(
                 (t) => t.vulnerable && t.confidence === "low"
               ).length) || 0;
-              return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-sm space-y-1", children: [
-                highConfidenceCount > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-red-700", children: [
-                  /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: "Confirmed Issues:" }),
-                  " ",
-                  highConfidenceCount
-                ] }),
-                mediumConfidenceCount > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-amber-700", children: [
-                  /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: "Need Review:" }),
-                  " ",
-                  mediumConfidenceCount
-                ] }),
-                lowConfidenceCount > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-blue-700", children: [
-                  /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: "Uncertain (Verification Needed):" }),
-                  " ",
-                  lowConfidenceCount
+              return /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+                connectionErrors.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "bg-yellow-50 border-l-4 border-yellow-500 p-4 mb-4 rounded", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2 mb-2", children: [
+                    /* @__PURE__ */ jsxRuntimeExports.jsx(CircleAlert, { className: "w-5 h-5 text-yellow-600" }),
+                    /* @__PURE__ */ jsxRuntimeExports.jsxs("h5", { className: "text-sm font-semibold text-yellow-900", children: [
+                      "Connection Errors (",
+                      connectionErrors.length,
+                      ")"
+                    ] })
+                  ] }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsxs("p", { className: "text-sm text-yellow-800 mb-2", children: [
+                    connectionErrors.length,
+                    " test",
+                    connectionErrors.length !== 1 ? "s" : "",
+                    " could not complete due to server/network failures. These tests are excluded from vulnerability counts."
+                  ] }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-xs text-yellow-700 space-y-1 max-h-32 overflow-y-auto", children: connectionErrors.map((err, i) => /* @__PURE__ */ jsxRuntimeExports.jsxs(
+                    "div",
+                    {
+                      className: "flex items-start gap-2",
+                      children: [
+                        /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-yellow-600", children: "•" }),
+                        /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { children: [
+                          /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: err.testName }),
+                          " on",
+                          " ",
+                          /* @__PURE__ */ jsxRuntimeExports.jsx("code", { className: "bg-yellow-100 px-1 rounded", children: err.toolName }),
+                          ": ",
+                          err.errorType
+                        ] })
+                      ]
+                    },
+                    i
+                  )) }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-xs text-yellow-700 mt-2 font-medium", children: "✅ Fix connectivity issues and re-run assessment for accurate results" })
                 ] }),
-                highConfidenceCount === 0 && mediumConfidenceCount === 0 && lowConfidenceCount === 0 && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-green-700", children: /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: "All tests passed" }) })
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-sm space-y-1", children: [
+                  highConfidenceCount > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-red-700", children: [
+                    /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: "Confirmed Issues:" }),
+                    " ",
+                    highConfidenceCount
+                  ] }),
+                  mediumConfidenceCount > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-amber-700", children: [
+                    /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: "Need Review:" }),
+                    " ",
+                    mediumConfidenceCount
+                  ] }),
+                  lowConfidenceCount > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-blue-700", children: [
+                    /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: "Uncertain (Verification Needed):" }),
+                    " ",
+                    lowConfidenceCount
+                  ] }),
+                  highConfidenceCount === 0 && mediumConfidenceCount === 0 && lowConfidenceCount === 0 && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-green-700", children: /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: "All tests passed" }) })
+                ] })
               ] });
             })(),
             /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mt-2", children: [
               /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center justify-between mb-2", children: [
                 /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { className: "text-sm", children: "Security Test Results:" }),
-                /* @__PURE__ */ jsxRuntimeExports.jsx(
-                  Button,
-                  {
-                    variant: "outline",
-                    size: "sm",
-                    className: "text-xs h-6 px-2",
-                    onClick: () => {
-                      const toolGroups = /* @__PURE__ */ new Map();
-                      assessment.security.promptInjectionTests.forEach(
-                        (testResult) => {
-                          const toolName = testResult.toolName || "Unknown Tool";
-                          if (!toolGroups.has(toolName)) {
-                            toolGroups.set(toolName, []);
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsxs(
+                    Button,
+                    {
+                      variant: showOnlyErrors ? "default" : "outline",
+                      size: "sm",
+                      className: "text-xs h-6 px-2",
+                      onClick: () => setShowOnlyErrors(!showOnlyErrors),
+                      children: [
+                        /* @__PURE__ */ jsxRuntimeExports.jsx(Funnel, { className: "h-3 w-3 mr-1" }),
+                        showOnlyErrors ? "Show All" : "Filter Errors"
+                      ]
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx(
+                    Button,
+                    {
+                      variant: "outline",
+                      size: "sm",
+                      className: "text-xs h-6 px-2",
+                      onClick: () => {
+                        const toolGroups = /* @__PURE__ */ new Map();
+                        assessment.security.promptInjectionTests.forEach(
+                          (testResult) => {
+                            const toolName = testResult.toolName || "Unknown Tool";
+                            if (!toolGroups.has(toolName)) {
+                              toolGroups.set(toolName, []);
+                            }
                           }
-                        }
-                      );
-                      if (allToolsCollapsed) {
-                        setCollapsedTools(/* @__PURE__ */ new Set());
-                        setAllToolsCollapsed(false);
-                      } else {
-                        const allToolNames = Array.from(
-                          toolGroups.keys()
                         );
-                        setCollapsedTools(new Set(allToolNames));
-                        setAllToolsCollapsed(true);
-                      }
-                    },
-                    children: allToolsCollapsed ? /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
-                      /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronRight, { className: "h-3 w-3 mr-1" }),
-                      "Expand All"
-                    ] }) : /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
-                      /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronDown, { className: "h-3 w-3 mr-1" }),
-                      "Collapse All"
-                    ] })
-                  }
-                )
+                        if (allToolsCollapsed) {
+                          setCollapsedTools(/* @__PURE__ */ new Set());
+                          setAllToolsCollapsed(false);
+                        } else {
+                          const allToolNames = Array.from(
+                            toolGroups.keys()
+                          );
+                          setCollapsedTools(new Set(allToolNames));
+                          setAllToolsCollapsed(true);
+                        }
+                      },
+                      children: allToolsCollapsed ? /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+                        /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronRight, { className: "h-3 w-3 mr-1" }),
+                        "Expand All"
+                      ] }) : /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+                        /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronDown, { className: "h-3 w-3 mr-1" }),
+                        "Collapse All"
+                      ] })
+                    }
+                  )
+                ] })
               ] }),
               /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "mt-2 space-y-1", children: (() => {
                 const toolGroups = /* @__PURE__ */ new Map();
@@ -50324,18 +51013,26 @@ const AssessmentTab = ({
                     newCollapsed.size === toolGroups.size
                   );
                 };
-                return Array.from(toolGroups.entries()).map(
-                  ([toolName, toolTests]) => /* @__PURE__ */ jsxRuntimeExports.jsx(
-                    CollapsibleToolSection,
-                    {
-                      toolName,
-                      toolTests,
-                      isCollapsed: collapsedTools.has(toolName),
-                      onToggle: handleToggleTool
-                    },
-                    toolName
-                  )
-                );
+                let filteredGroups = Array.from(toolGroups.entries());
+                if (showOnlyErrors) {
+                  filteredGroups = filteredGroups.filter(
+                    ([, toolTests]) => {
+                      return toolTests.some(
+                        (test) => test.vulnerable === true
+                      );
+                    }
+                  );
+                }
+                return filteredGroups.map(([toolName, toolTests]) => /* @__PURE__ */ jsxRuntimeExports.jsx(
+                  CollapsibleToolSection,
+                  {
+                    toolName,
+                    toolTests,
+                    isCollapsed: collapsedTools.has(toolName),
+                    onToggle: handleToggleTool
+                  },
+                  toolName
+                ));
               })() }),
               assessment.security.vulnerabilities.length > 0 && (() => {
                 var _a2, _b2, _c;
@@ -50589,43 +51286,58 @@ const AssessmentTab = ({
             assessment.errorHandling.metrics.testDetails && assessment.errorHandling.metrics.testDetails.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mt-3 border-t pt-3", children: [
               /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center justify-between mb-2", children: [
                 /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { className: "text-sm", children: "Error Handling Test Results:" }),
-                /* @__PURE__ */ jsxRuntimeExports.jsx(
-                  Button,
-                  {
-                    variant: "outline",
-                    size: "sm",
-                    className: "text-xs h-6 px-2",
-                    onClick: () => {
-                      var _a2;
-                      const toolGroups = /* @__PURE__ */ new Map();
-                      (_a2 = assessment.errorHandling.metrics.testDetails) == null ? void 0 : _a2.forEach(
-                        (testResult) => {
-                          const toolName = testResult.toolName || "Unknown Tool";
-                          if (!toolGroups.has(toolName)) {
-                            toolGroups.set(toolName, []);
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsxs(
+                    Button,
+                    {
+                      variant: showOnlyErrors ? "default" : "outline",
+                      size: "sm",
+                      className: "text-xs h-6 px-2",
+                      onClick: () => setShowOnlyErrors(!showOnlyErrors),
+                      children: [
+                        /* @__PURE__ */ jsxRuntimeExports.jsx(Funnel, { className: "h-3 w-3 mr-1" }),
+                        showOnlyErrors ? "Show All" : "Filter Errors"
+                      ]
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx(
+                    Button,
+                    {
+                      variant: "outline",
+                      size: "sm",
+                      className: "text-xs h-6 px-2",
+                      onClick: () => {
+                        var _a2;
+                        const toolGroups = /* @__PURE__ */ new Map();
+                        (_a2 = assessment.errorHandling.metrics.testDetails) == null ? void 0 : _a2.forEach(
+                          (testResult) => {
+                            const toolName = testResult.toolName || "Unknown Tool";
+                            if (!toolGroups.has(toolName)) {
+                              toolGroups.set(toolName, []);
+                            }
                           }
-                        }
-                      );
-                      if (allToolsCollapsed) {
-                        setCollapsedTools(/* @__PURE__ */ new Set());
-                        setAllToolsCollapsed(false);
-                      } else {
-                        const allToolNames = Array.from(
-                          toolGroups.keys()
                         );
-                        setCollapsedTools(new Set(allToolNames));
-                        setAllToolsCollapsed(true);
-                      }
-                    },
-                    children: allToolsCollapsed ? /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
-                      /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronRight, { className: "h-3 w-3 mr-1" }),
-                      "Expand All"
-                    ] }) : /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
-                      /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronDown, { className: "h-3 w-3 mr-1" }),
-                      "Collapse All"
-                    ] })
-                  }
-                )
+                        if (allToolsCollapsed) {
+                          setCollapsedTools(/* @__PURE__ */ new Set());
+                          setAllToolsCollapsed(false);
+                        } else {
+                          const allToolNames = Array.from(
+                            toolGroups.keys()
+                          );
+                          setCollapsedTools(new Set(allToolNames));
+                          setAllToolsCollapsed(true);
+                        }
+                      },
+                      children: allToolsCollapsed ? /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+                        /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronRight, { className: "h-3 w-3 mr-1" }),
+                        "Expand All"
+                      ] }) : /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+                        /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronDown, { className: "h-3 w-3 mr-1" }),
+                        "Collapse All"
+                      ] })
+                    }
+                  )
+                ] })
               ] }),
               /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "mt-2 space-y-1", children: (() => {
                 var _a2;
@@ -50651,12 +51363,27 @@ const AssessmentTab = ({
                     newCollapsed.size === toolGroups.size
                   );
                 };
-                return Array.from(toolGroups.entries()).map(
+                let filteredGroups = Array.from(
+                  toolGroups.entries()
+                );
+                if (showOnlyErrors) {
+                  filteredGroups = filteredGroups.filter(
+                    ([, toolTests]) => {
+                      return toolTests.some(
+                        (test) => test.passed === false
+                      );
+                    }
+                  );
+                }
+                return filteredGroups.map(
                   ([toolName, toolTests]) => {
-                    const passedCount = toolTests.filter(
+                    const scoredTests = toolTests.filter(
+                      (t) => t.testType !== "invalid_values"
+                    );
+                    const passedCount = scoredTests.filter(
                       (t) => t.passed
                     ).length;
-                    const totalCount = toolTests.length;
+                    const totalCount = scoredTests.length;
                     const allPassed = passedCount === totalCount;
                     return /* @__PURE__ */ jsxRuntimeExports.jsxs(
                       "div",
@@ -52497,13 +53224,13 @@ const App = () => {
   ) });
   if (window.location.pathname === "/oauth/callback") {
     const OAuthCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthCallback-C8iZSwWO.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthCallback-CIWsnXN_.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthCallback, { onConnect: onOAuthConnect }) });
   }
   if (window.location.pathname === "/oauth/callback/debug") {
     const OAuthDebugCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthDebugCallback-Br9U2vZs.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthDebugCallback-DP9WXVFe.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthDebugCallback, { onConnect: onOAuthDebugConnect }) });
   }
@@ -52790,6 +53517,10 @@ const App = () => {
                 {
                   tools,
                   isLoadingTools,
+                  listTools: () => {
+                    clearError("tools");
+                    listTools();
+                  },
                   callTool: async (name2, params) => {
                     const result = await callTool(name2, params);
                     return result;