@bryan-thompson/inspector-assessment 1.35.2 → 1.36.0

package/client/lib/lib/moduleScoring.js

@@ -24,9 +24,27 @@ export function calculateModuleScore(result) {
     if (!result || typeof result !== "object")
         return null;
     const r = result;
-    // ErrorHandling module - uses metrics.mcpComplianceScore
+    // ErrorHandling module - validate test execution before scoring (Issue #153)
     const metrics = r.metrics;
     if (metrics?.mcpComplianceScore !== undefined) {
+        const metadata = r.testExecutionMetadata;
+        // If we have metadata, validate test execution
+        if (metadata) {
+            const { validTestsCompleted = 0, connectionErrorCount = 0, testCoveragePercent = 0, } = metadata;
+            // Case 1: All tests failed due to connection errors
+            // Return 0 score - can't verify error handling without successful test execution
+            // Note: validTestsCompleted=0 with connectionErrorCount=0 is allowed
+            // (e.g., no tools selected for testing - uses normal scoring)
+            if (validTestsCompleted === 0 && connectionErrorCount > 0) {
+                return 0;
+            }
+            // Case 2: Significant connection errors (>50% failure)
+            // Cap score at 50 - partial coverage means partial confidence
+            if (testCoveragePercent < 50 && connectionErrorCount > 0) {
+                const baseScore = Math.round(metrics.mcpComplianceScore);
+                return Math.min(50, baseScore);
+            }
+        }
         return Math.round(metrics.mcpComplianceScore);
     }
     // MCPSpecCompliance module - uses complianceScore
@@ -37,9 +55,28 @@ export function calculateModuleScore(result) {
     if (r.coveragePercentage !== undefined) {
         return Math.round(r.coveragePercentage);
     }
-    // Security module - 100% if no vulns, lower based on vuln count
+    // Security module - validate test execution before scoring (Issue #152)
     if (Array.isArray(r.vulnerabilities)) {
         const vulnCount = r.vulnerabilities.length;
+        const metadata = r.testExecutionMetadata;
+        // If we have metadata, validate test execution
+        if (metadata) {
+            const { validTestsCompleted = 0, connectionErrorCount = 0, testCoveragePercent = 0, } = metadata;
+            // Case 1: All tests failed due to connection errors
+            // Return 0 score - can't verify security without successful test execution
+            // Note: validTestsCompleted=0 with connectionErrorCount=0 is allowed
+            // (e.g., server has no security-relevant tools - uses normal scoring)
+            if (validTestsCompleted === 0 && connectionErrorCount > 0) {
+                return 0;
+            }
+            // Case 2: Significant connection errors (>50% failure)
+            // Cap score at 50 - partial coverage means partial confidence
+            if (testCoveragePercent < 50 && connectionErrorCount > 0) {
+                const baseScore = vulnCount === 0 ? 100 : Math.max(0, 100 - vulnCount * 10);
+                return Math.min(50, baseScore);
+            }
+        }
+        // Normal case: good test coverage, calculate based on vulnerabilities
         return vulnCount === 0 ? 100 : Math.max(0, 100 - vulnCount * 10);
     }
     // AUP module - 100% if no violations, lower based on violation count

package/client/lib/lib/securityPatterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"securityPatterns.d.ts","sourceRoot":"","sources":["../../src/lib/securityPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,aAAa,EAo7DnD,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,eAAe,EAAE,CAQnB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,EAAE,CAEtD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;;;;;;;;EA8BnC"}
+{"version":3,"file":"securityPatterns.d.ts","sourceRoot":"","sources":["../../src/lib/securityPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,aAAa,EAoiEnD,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,eAAe,EAAE,CAQnB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,EAAE,CAEtD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;;;;;;;;EA8BnC"}

package/client/lib/lib/securityPatterns.js

@@ -1809,6 +1809,98 @@ export const SECURITY_ATTACK_PATTERNS = [
             },
         ],
     },
+    // ==========================================
+    // EXCESSIVE PERMISSIONS SCOPE TESTS (Issue #144, Challenge #22)
+    // ==========================================
+    // 32. EXCESSIVE PERMISSIONS SCOPE
+    {
+        attackName: "Excessive Permissions Scope",
+        description: "Test if tools with restrictive annotations (readOnlyHint=True) allow privileged operations via specific inputs (CWE-250, CWE-269)",
+        payloads: [
+            // Privileged action payloads for tools that claim readOnlyHint=True
+            {
+                payload: "write_file",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"write"/i,
+                riskLevel: "HIGH",
+                description: "Write operation bypassing readOnlyHint=True annotation (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            {
+                payload: "delete_data",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"delete"/i,
+                riskLevel: "HIGH",
+                description: "Delete operation bypassing destructiveHint=False annotation (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            {
+                payload: "execute_command",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"execute"/i,
+                riskLevel: "HIGH",
+                description: "Execute operation bypassing readOnlyHint=True annotation (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            {
+                payload: "network_request",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"network"/i,
+                riskLevel: "HIGH",
+                description: "Network operation bypassing openWorldHint=False annotation (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            {
+                payload: "modify_config",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"modify"/i,
+                riskLevel: "HIGH",
+                description: "Config modification bypassing readOnlyHint=True annotation (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            {
+                payload: "environment_access",
+                evidence: /"scope_violation"\s*:\s*true|"actual_scope"\s*:\s*"environment"/i,
+                riskLevel: "HIGH",
+                description: "Environment access bypassing annotation restrictions (CWE-250)",
+                payloadType: "scope_violation",
+                parameterTypes: ["action", "operation", "command", "cmd"],
+            },
+            // Escalation keyword payloads for tools that claim readOnlyHint=True
+            {
+                payload: "show admin users",
+                evidence: /"scope_escalation"\s*:\s*true|"privileged_data"\s*:|admin[_-]?mode[_-]?activated/i,
+                riskLevel: "HIGH",
+                description: "Keyword-triggered privilege escalation via 'admin' (CWE-269)",
+                payloadType: "scope_escalation",
+                parameterTypes: ["request", "query", "input", "text", "message"],
+            },
+            {
+                payload: "sudo access logs",
+                evidence: /"scope_escalation"\s*:\s*true|"system_secrets"\s*:|"trigger_keyword"\s*:\s*"sudo"/i,
+                riskLevel: "HIGH",
+                description: "Keyword-triggered privilege escalation via 'sudo' (CWE-269)",
+                payloadType: "scope_escalation",
+                parameterTypes: ["request", "query", "input", "text", "message"],
+            },
+            {
+                payload: "elevate to root",
+                evidence: /"scope_escalation"\s*:\s*true|"trigger_keyword"\s*:\s*"(elevate|root)"/i,
+                riskLevel: "HIGH",
+                description: "Keyword-triggered privilege escalation via 'elevate' or 'root' (CWE-269)",
+                payloadType: "scope_escalation",
+                parameterTypes: ["request", "query", "input", "text", "message"],
+            },
+            {
+                payload: "get superuser privileges",
+                evidence: /"scope_escalation"\s*:\s*true|"trigger_keyword"\s*:\s*"(superuser|privilege)"/i,
+                riskLevel: "HIGH",
+                description: "Keyword-triggered privilege escalation via 'superuser' or 'privilege' (CWE-269)",
+                payloadType: "scope_escalation",
+                parameterTypes: ["request", "query", "input", "text", "message"],
+            },
+        ],
+    },
 ];
 /**
  * Get all payloads for an attack type

package/client/lib/services/assessment/modules/DeveloperExperienceAssessor.d.ts

@@ -12,7 +12,7 @@
  *
  * @module assessment/modules/DeveloperExperienceAssessor
  */
-import { DocumentationMetrics, UsabilityMetrics, AssessmentStatus } from "../../../lib/assessmentTypes.js";
+import { DocumentationMetrics, UsabilityMetrics, AssessmentStatus, NamespaceDetectionResult } from "../../../lib/assessmentTypes.js";
 import { BaseAssessor } from "./BaseAssessor.js";
 import { AssessmentContext } from "../AssessmentOrchestrator.js";
 /**
@@ -35,6 +35,8 @@ export interface DeveloperExperienceAssessment {
         usability: number;
         overall: number;
     };
+    /** Namespace detection results (Issue #142) */
+    namespaceDetection?: NamespaceDetectionResult;
 }
 export declare class DeveloperExperienceAssessor extends BaseAssessor<DeveloperExperienceAssessment> {
     assess(context: AssessmentContext): Promise<DeveloperExperienceAssessment>;
@@ -97,6 +99,29 @@ export declare class DeveloperExperienceAssessor extends BaseAssessor<DeveloperE
     private isDescriptiveName;
     private getToolSchema;
     private calculateUsabilityScore;
+    /**
+     * Detect namespace/prefix patterns in tool names.
+     * This helps identify intentional naming conventions like:
+     * - calc_add, calc_subtract -> namespace "calc"
+     * - fileRead, fileWrite -> namespace "file"
+     * - myserver_tool1, myserver_tool2 -> matches server name
+     */
+    private detectNamespace;
+    /**
+     * Find common prefix among tool names.
+     * Handles both snake_case (calc_add) and camelCase (calcAdd) conventions.
+     */
+    private findCommonPrefix;
+    /**
+     * Check if tool names use the server name as a prefix.
+     * Normalizes server name to match common patterns.
+     */
+    private checkServerNamePrefix;
+    /**
+     * Normalize server name for prefix matching.
+     * Converts "My-Server" -> "myserver", "my_server" -> "myserver"
+     */
+    private normalizeServerName;
     private determineOverallStatus;
     private generateExplanation;
     private generateRecommendations;

package/client/lib/services/assessment/modules/DeveloperExperienceAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeveloperExperienceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/DeveloperExperienceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAEhB,gBAAgB,EAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,yCAAyC;IACzC,aAAa,EAAE,oBAAoB,CAAC;IACpC,qCAAqC;IACrC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,gDAAgD;IAChD,MAAM,EAAE,gBAAgB,CAAC;IACzB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iDAAiD;IACjD,MAAM,EAAE;QACN,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,qBAAa,2BAA4B,SAAQ,YAAY,CAAC,6BAA6B,CAAC;IACpF,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,6BAA6B,CAAC;IAsEzC,OAAO,CAAC,oBAAoB;IAmH5B,OAAO,CAAC,yBAAyB;IA4CjC,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,sBAAsB;IA8B9B,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,mBAAmB;IAwC3B,OAAO,CAAC,wBAAwB;IAahC,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,sBAAsB;IAY9B,OAAO,CAAC,mBAAmB;IA6B3B;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAkBlC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAW9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAgC7B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAgBjC;;;OAGG;IACH,OAAO,CAAC,aAAa;IAoBrB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAsEzB,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,uBAAuB;IAsC/B,OAAO,CAAC,uBAAuB;IAwC/B,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,kBAAkB;IAsC1B,OAAO,CAAC,iBAAiB;IAiCzB,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,sBAAsB;IAM9B,OAAO,CAAC,mBAAmB;IAyC3B,OAAO,CAAC,uBAAuB;CAmDhC"}
+{"version":3,"file":"DeveloperExperienceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/DeveloperExperienceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAEhB,gBAAgB,EAKhB,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,yCAAyC;IACzC,aAAa,EAAE,oBAAoB,CAAC;IACpC,qCAAqC;IACrC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,gDAAgD;IAChD,MAAM,EAAE,gBAAgB,CAAC;IACzB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iDAAiD;IACjD,MAAM,EAAE;QACN,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,+CAA+C;IAC/C,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;CAC/C;AAED,qBAAa,2BAA4B,SAAQ,YAAY,CAAC,6BAA6B,CAAC;IACpF,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,6BAA6B,CAAC;IA6EzC,OAAO,CAAC,oBAAoB;IAmH5B,OAAO,CAAC,yBAAyB;IA4CjC,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,sBAAsB;IA8B9B,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,mBAAmB;IAwC3B,OAAO,CAAC,wBAAwB;IAahC,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,sBAAsB;IAY9B,OAAO,CAAC,mBAAmB;IA6B3B;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAkBlC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAW9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAgC7B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAgBjC;;;OAGG;IACH,OAAO,CAAC,aAAa;IAoBrB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAsEzB,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,uBAAuB;IAsC/B,OAAO,CAAC,uBAAuB;IAwC/B,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,kBAAkB;IAsC1B,OAAO,CAAC,iBAAiB;IAiCzB,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,uBAAuB;IAgB/B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAsEvB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IA0DxB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAsC7B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,sBAAsB;IAM9B,OAAO,CAAC,mBAAmB;IAyC3B,OAAO,CAAC,uBAAuB;CAmDhC"}

package/client/lib/services/assessment/modules/DeveloperExperienceAssessor.js

@@ -30,6 +30,8 @@ export class DeveloperExperienceAssessor extends BaseAssessor {
         // Assess usability
         const usabilityMetrics = this.analyzeUsability(context.tools);
         const usabilityScore = this.calculateUsabilityScore(usabilityMetrics);
+        // Issue #142: Detect namespace/prefix patterns in tool names
+        const namespaceDetection = this.detectNamespace(context.tools, context.serverInfo?.name);
         // Calculate overall score (weighted average: 60% docs, 40% usability)
         const overallScore = Math.round(documentationScore * 0.6 + usabilityScore * 0.4);
         // Determine status using Issue #55 thresholds
@@ -37,7 +39,7 @@ export class DeveloperExperienceAssessor extends BaseAssessor {
         // Generate explanation and recommendations
         const explanation = this.generateExplanation(documentationMetrics, usabilityMetrics, context.tools);
         const recommendations = this.generateRecommendations(documentationMetrics, usabilityMetrics);
-        this.testCount = 15; // Documentation (5) + Quality (6) + Usability (4) checks
+        this.testCount = 16; // Documentation (5) + Quality (6) + Usability (4) + Namespace (1) checks
         return {
             documentation: documentationMetrics,
             usability: usabilityMetrics,
@@ -49,6 +51,7 @@ export class DeveloperExperienceAssessor extends BaseAssessor {
                 usability: usabilityScore,
                 overall: overallScore,
             },
+            namespaceDetection,
         };
     }
     // ============================================================================
@@ -673,6 +676,162 @@ export class DeveloperExperienceAssessor extends BaseAssessor {
         return Math.round((score / maxScore) * 100);
     }
     // ============================================================================
+    // Namespace Detection (Issue #142)
+    // ============================================================================
+    /**
+     * Detect namespace/prefix patterns in tool names.
+     * This helps identify intentional naming conventions like:
+     * - calc_add, calc_subtract -> namespace "calc"
+     * - fileRead, fileWrite -> namespace "file"
+     * - myserver_tool1, myserver_tool2 -> matches server name
+     */
+    detectNamespace(tools, serverName) {
+        const toolNames = tools.map((t) => t.name);
+        const totalTools = toolNames.length;
+        // Need at least 2 tools to detect a namespace
+        if (totalTools < 2) {
+            return {
+                detected: false,
+                confidence: "low",
+                toolsCovered: 0,
+                totalTools,
+                matchPattern: "none",
+            };
+        }
+        // Try server name prefix first (highest priority)
+        if (serverName) {
+            const serverNameResult = this.checkServerNamePrefix(toolNames, serverName);
+            if (serverNameResult.matches >= 2 &&
+                serverNameResult.matches / totalTools >= 0.5) {
+                return {
+                    detected: true,
+                    namespace: this.normalizeServerName(serverName),
+                    confidence: "high",
+                    toolsCovered: serverNameResult.matches,
+                    totalTools,
+                    matchPattern: "serverName",
+                    evidence: serverNameResult.matchedTools.slice(0, 5),
+                };
+            }
+        }
+        // Try common prefix detection
+        const prefixResult = this.findCommonPrefix(toolNames);
+        if (prefixResult) {
+            const coverageRatio = prefixResult.count / totalTools;
+            const confidence = coverageRatio >= 0.5 ? "high" : coverageRatio >= 0.3 ? "medium" : "low";
+            if (prefixResult.count >= 2 && coverageRatio >= 0.3) {
+                return {
+                    detected: true,
+                    namespace: prefixResult.prefix,
+                    confidence,
+                    toolsCovered: prefixResult.count,
+                    totalTools,
+                    matchPattern: "prefix",
+                    evidence: prefixResult.matchedTools.slice(0, 5),
+                };
+            }
+        }
+        // No namespace detected
+        return {
+            detected: false,
+            confidence: "low",
+            toolsCovered: 0,
+            totalTools,
+            matchPattern: "none",
+        };
+    }
+    /**
+     * Find common prefix among tool names.
+     * Handles both snake_case (calc_add) and camelCase (calcAdd) conventions.
+     */
+    findCommonPrefix(toolNames) {
+        if (toolNames.length < 2)
+            return null;
+        // Build prefix frequency map
+        const prefixCounts = new Map();
+        for (const name of toolNames) {
+            // Extract prefix using snake_case separator
+            const snakeMatch = name.match(/^([a-z]+)_/);
+            if (snakeMatch && snakeMatch[1].length >= 3) {
+                const prefix = snakeMatch[1];
+                if (!prefixCounts.has(prefix)) {
+                    prefixCounts.set(prefix, []);
+                }
+                prefixCounts.get(prefix).push(name);
+            }
+            // Extract prefix using camelCase pattern
+            const camelMatch = name.match(/^([a-z]+)[A-Z]/);
+            if (camelMatch && camelMatch[1].length >= 3) {
+                const prefix = camelMatch[1];
+                if (!prefixCounts.has(prefix)) {
+                    prefixCounts.set(prefix, []);
+                }
+                // Avoid double-counting if snake_case already found this name
+                const existing = prefixCounts.get(prefix);
+                if (!existing.includes(name)) {
+                    existing.push(name);
+                }
+            }
+        }
+        // Find the prefix with the most matches
+        let bestPrefix = null;
+        let bestCount = 0;
+        let bestTools = [];
+        for (const [prefix, tools] of prefixCounts) {
+            if (tools.length > bestCount) {
+                bestPrefix = prefix;
+                bestCount = tools.length;
+                bestTools = tools;
+            }
+        }
+        if (bestPrefix && bestCount >= 2) {
+            return {
+                prefix: bestPrefix,
+                count: bestCount,
+                matchedTools: bestTools,
+            };
+        }
+        return null;
+    }
+    /**
+     * Check if tool names use the server name as a prefix.
+     * Normalizes server name to match common patterns.
+     */
+    checkServerNamePrefix(toolNames, serverName) {
+        const normalizedServerName = this.normalizeServerName(serverName);
+        const matchedTools = [];
+        for (const name of toolNames) {
+            const nameLower = name.toLowerCase();
+            // Check snake_case prefix (e.g., myserver_tool)
+            if (nameLower.startsWith(normalizedServerName + "_")) {
+                matchedTools.push(name);
+                continue;
+            }
+            // Check camelCase prefix (e.g., myserverTool)
+            if (nameLower.startsWith(normalizedServerName) &&
+                name.length > normalizedServerName.length &&
+                /[A-Z]/.test(name[normalizedServerName.length])) {
+                matchedTools.push(name);
+                continue;
+            }
+            // Check kebab-case prefix (e.g., myserver-tool)
+            if (nameLower.startsWith(normalizedServerName + "-")) {
+                matchedTools.push(name);
+            }
+        }
+        return {
+            matches: matchedTools.length,
+            matchedTools,
+        };
+    }
+    /**
+     * Normalize server name for prefix matching.
+     * Converts "My-Server" -> "myserver", "my_server" -> "myserver"
+     */
+    normalizeServerName(serverName) {
+        return serverName.toLowerCase().replace(/[-_\s]/g, "");
+    }
+    // ============================================================================
     // Combined Status, Explanation, and Recommendations
     // ============================================================================
     determineOverallStatus(overallScore) {

package/client/lib/services/assessment/modules/ErrorHandlingAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ErrorHandlingAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ErrorHandlingAssessor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,uBAAuB,EAKxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAS9D,qBAAa,qBAAsB,SAAQ,YAAY;IACrD,OAAO,CAAC,iBAAiB,CAA4B;IACrD,OAAO,CAAC,oBAAoB,CAAuB;gBAEvC,MAAM,EAAE,uBAAuB;IAMrC,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA0F1E,OAAO,CAAC,qBAAqB;YAuDf,qBAAqB;YA0BrB,qBAAqB;YAsGrB,cAAc;YAsFd,iBAAiB;YAiEjB,kBAAkB;IAgEhC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,uBAAuB;IAkC/B,OAAO,CAAC,0BAA0B;IAkClC,OAAO,CAAC,uBAAuB;IA4B/B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,4BAA4B;IAgEpC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;OAGG;IACH,OAAO,CAAC,8BAA8B;IAetC,OAAO,CAAC,gBAAgB;IA8GxB,OAAO,CAAC,4BAA4B;IAapC,OAAO,CAAC,mBAAmB;IAuE3B,OAAO,CAAC,uBAAuB;CA4ChC"}
+{"version":3,"file":"ErrorHandlingAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ErrorHandlingAssessor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,uBAAuB,EAKxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAS9D,qBAAa,qBAAsB,SAAQ,YAAY;IACrD,OAAO,CAAC,iBAAiB,CAA4B;IACrD,OAAO,CAAC,oBAAoB,CAAuB;gBAEvC,MAAM,EAAE,uBAAuB;IAMrC,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA6G1E,OAAO,CAAC,qBAAqB;YAuDf,qBAAqB;YA0BrB,qBAAqB;YAsGrB,cAAc;YAsFd,iBAAiB;YAiEjB,kBAAkB;IAgEhC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,uBAAuB;IAkC/B,OAAO,CAAC,0BAA0B;IAkClC,OAAO,CAAC,uBAAuB;IA4B/B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,4BAA4B;IAgEpC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;OAGG;IACH,OAAO,CAAC,8BAA8B;IAetC,OAAO,CAAC,gBAAgB;IA8GxB,OAAO,CAAC,4BAA4B;IAapC,OAAO,CAAC,mBAAmB;IAuE3B,OAAO,CAAC,uBAAuB;CA4ChC"}

package/client/lib/services/assessment/modules/ErrorHandlingAssessor.js

@@ -56,6 +56,14 @@ export class ErrorHandlingAssessor extends BaseAssessor {
             passedTests += toolTests.filter((t) => t.passed).length;
         }
         this.testCount = testDetails.length;
+        // Issue #153: Calculate test execution metadata for score validation
+        // Track which tools successfully produced test results vs failed due to connection errors
+        const totalToolsAttempted = toolsToTest.length;
+        const toolsWithResults = allToolTests.filter((tests) => tests.length > 0).length;
+        const connectionErrorCount = totalToolsAttempted - toolsWithResults;
+        const testCoveragePercent = totalToolsAttempted > 0
+            ? Math.round((toolsWithResults / totalToolsAttempted) * 100)
+            : 0;
         const metrics = this.calculateMetrics(testDetails, passedTests);
         const status = this.determineErrorHandlingStatus(metrics, testDetails.length);
         const explanation = this.generateExplanation(metrics, testDetails);
@@ -68,6 +76,13 @@ export class ErrorHandlingAssessor extends BaseAssessor {
             score: Math.round(metrics.mcpComplianceScore),
             explanation,
             recommendations,
+            // Issue #153: Test execution metadata for score validation
+            testExecutionMetadata: {
+                totalTestsAttempted: totalToolsAttempted,
+                validTestsCompleted: testDetails.length,
+                connectionErrorCount,
+                testCoveragePercent,
+            },
         };
     }
     selectToolsForTesting(tools) {

package/client/lib/services/assessment/modules/ManifestValidationAssessor.d.ts

@@ -13,6 +13,13 @@
 import { BaseAssessor } from "./BaseAssessor.js";
 import { AssessmentContext } from "../AssessmentOrchestrator.js";
 import type { ManifestValidationAssessment } from "../../../lib/assessmentTypes.js";
+/**
+ * Calculate Levenshtein distance between two strings
+ * Uses space-optimized two-row algorithm for O(min(n,m)) memory
+ * Used for "did you mean?" suggestions on mismatched tool names (Issue #140)
+ * Exported for testing (Issue #141 - ISSUE-002)
+ */
+export declare function levenshteinDistance(a: string, b: string, maxDist?: number): number;
 export declare class ManifestValidationAssessor extends BaseAssessor {
     /**
      * Get mcp_config from manifest (supports both root and nested v0.3 format)
@@ -22,6 +29,21 @@ export declare class ManifestValidationAssessor extends BaseAssessor {
      * @returns The mcp_config object or undefined if not found in either location
      */
     private getMcpConfig;
+    /**
+     * Extract contact information from manifest (Issue #141 - D4 check)
+     * Supports: author object, author string (email parsing), repository fallback
+     *
+     * @param manifest - The parsed manifest JSON
+     * @returns Extracted contact info or undefined if no contact info found
+     */
+    private extractContactInfo;
+    /**
+     * Extract version information from manifest (Issue #141 - D5 check)
+     *
+     * @param manifest - The parsed manifest JSON
+     * @returns Extracted version info or undefined if no version found
+     */
+    private extractVersionInfo;
     /**
      * Run manifest validation assessment
      */
@@ -62,6 +84,16 @@ export declare class ManifestValidationAssessor extends BaseAssessor {
      * Validate version format (semver)
      */
     private validateVersionFormat;
+    /**
+     * Validate manifest tool declarations against actual server tools (Issue #140)
+     * Compares tool names in manifest.tools against context.tools from tools/list
+     * Uses Levenshtein distance for "did you mean?" suggestions
+     */
+    private validateToolNamesMatch;
+    /**
+     * Fetch with retry logic for transient network failures
+     */
+    private fetchWithRetry;
     /**
      * Validate privacy policy URLs are accessible
      */

package/client/lib/services/assessment/modules/ManifestValidationAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ManifestValidationAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ManifestValidationAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EACV,4BAA4B,EAM7B,MAAM,uBAAuB,CAAC;AAM/B,qBAAa,0BAA2B,SAAQ,YAAY;IAC1D;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAcpB;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,CAAC;IAqLxC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAmB/B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAgC/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAiC7B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAiChC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+CzB;;OAEG;IACH,OAAO,CAAC,YAAY;IAqCpB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA8B7B;;OAEG;YACW,yBAAyB;IAqFvC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAsB/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0C3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CA+ChC"}
+{"version":3,"file":"ManifestValidationAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ManifestValidationAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,KAAK,EACV,4BAA4B,EAS7B,MAAM,uBAAuB,CAAC;AAO/B;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,EACT,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAwCR;AA+BD,qBAAa,0BAA2B,SAAQ,YAAY;IAC1D;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAcpB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAqC1B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,CAAC;IAiMxC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAmB/B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAgC/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAiC7B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAiChC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+CzB;;OAEG;IACH,OAAO,CAAC,YAAY;IAqCpB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA4B7B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAyE9B;;OAEG;YACW,cAAc;IAuC5B;;OAEG;YACW,yBAAyB;IAmEvC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAsB/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0C3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CA+ChC"}