@bryan-thompson/inspector-assessment 1.37.0 → 1.38.1

package/cli/build/lib/assessment-runner/assessment-executor.js

@@ -22,6 +22,10 @@ import { setAnnotationDebugMode } from "../../../../client/lib/services/assessme
 import { getToolsWithPreservedHints } from "./tools-with-hints.js";
 // Issue #168: Import external API dependency detector
 import { ExternalAPIDependencyDetector } from "../../../../client/lib/services/assessment/helpers/ExternalAPIDependencyDetector.js";
+// Issue #172: Import stdio transport detector for C6/F6 compliance
+import { StdioTransportDetector } from "../../../../client/lib/services/assessment/helpers/StdioTransportDetector.js";
+// Issue #170: Import tool annotation extractor for security severity adjustment
+import { extractToolAnnotationsContext } from "../../../../client/lib/services/assessment/helpers/ToolAnnotationExtractor.js";
 /**
  * Run full assessment against an MCP server
  *
@@ -289,10 +293,30 @@ export async function runFullAssessment(options) {
     // Issue #168: Detect external API dependencies before assessors run
     // This enables TemporalAssessor, FunctionalityAssessor, and ErrorHandlingAssessor
     // to adjust their behavior for tools that depend on external APIs
+    // Enhanced: Pass sourceCodeFiles when available for more accurate detection
     const apiDetector = new ExternalAPIDependencyDetector();
-    const externalAPIDependencies = apiDetector.detect(tools);
+    const externalAPIDependencies = apiDetector.detect(tools, sourceFiles.sourceCodeFiles);
     if (!options.jsonOnly && externalAPIDependencies.detectedCount > 0) {
         console.log(`🌐 Detected ${externalAPIDependencies.detectedCount} tool(s) with external API dependencies`);
+        // Show domains if source code scanning found any
+        if (externalAPIDependencies.domains &&
+            externalAPIDependencies.domains.length > 0) {
+            console.log(`   Domains: ${externalAPIDependencies.domains.join(", ")}`);
+        }
+    }
+    // Issue #172: Detect transport capabilities from source code before assessors run
+    // This enables C6/F6 to correctly identify stdio servers without serverInfo metadata
+    const transportDetector = new StdioTransportDetector();
+    const transportDetection = transportDetector.detect(sourceFiles.sourceCodeFiles, sourceFiles.packageJson, sourceFiles.serverJson, serverConfig.transport);
+    if (!options.jsonOnly && transportDetection.evidence.length > 0) {
+        const transports = Array.from(transportDetection.detectedTransports).join(", ");
+        console.log(`🚀 Detected transport(s): ${transports} (${transportDetection.confidence} confidence)`);
+    }
+    // Issue #170: Extract tool annotations context for security severity adjustment
+    // This enables SecurityAssessor to reduce false positives for read-only servers
+    const toolAnnotationsContext = extractToolAnnotationsContext(tools);
+    if (!options.jsonOnly && toolAnnotationsContext.serverIsReadOnly) {
+        console.log(`📖 Server is 100% read-only (${toolAnnotationsContext.annotatedToolCount}/${toolAnnotationsContext.totalToolCount} tools annotated)`);
     }
     const context = {
         serverName: options.serverName,
@@ -317,6 +341,10 @@ export async function runFullAssessment(options) {
         serverCapabilities: serverCapabilities,
         // Issue #168: External API dependency detection for assessor behavior adjustment
         externalAPIDependencies,
+        // Issue #172: Transport detection for C6/F6 compliance
+        transportDetection,
+        // Issue #170: Tool annotations context for security severity adjustment
+        toolAnnotationsContext,
     };
     if (!options.jsonOnly) {
         console.log(`\n🏃 Running assessment with ${Object.keys(config.assessmentCategories || {}).length} modules...`);

package/cli/build/lib/assessment-runner/source-loader.js

@@ -99,6 +99,17 @@ export function loadSourceFiles(sourcePath, debug = false) {
             console.warn("[Assessment] Failed to parse manifest.json");
         }
     }
+    // Issue #172: Load server.json for transport configuration
+    const serverJsonPath = path.join(sourcePath, "server.json");
+    if (fs.existsSync(serverJsonPath)) {
+        try {
+            result.serverJson = JSON.parse(fs.readFileSync(serverJsonPath, "utf-8"));
+            log(`  ✓ Found server.json`);
+        }
+        catch {
+            console.warn("[Assessment] Failed to parse server.json");
+        }
+    }
     result.sourceCodeFiles = new Map();
     // Include config files for portability analysis
     const sourceExtensions = [

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bryan-thompson/inspector-assessment-cli",
-  "version": "1.37.0",
+  "version": "1.38.1",
   "description": "CLI for the Enhanced MCP Inspector with assessment capabilities",
   "license": "MIT",
   "author": "Bryan Thompson <bryan@triepod.ai>",

package/client/dist/assets/{OAuthCallback-6-wM7Zc1.js → OAuthCallback-2AYSUA_B.js}

@@ -1,4 +1,4 @@
-import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-DyCdQP10.js";
+import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-BDx5upZX.js";
 const OAuthCallback = ({ onConnect }) => {
   const { toast } = useToast();
   const hasProcessedRef = reactExports.useRef(false);

package/client/dist/assets/{OAuthDebugCallback-Bw9-AzzP.js → OAuthDebugCallback-CWkaV-fa.js}

@@ -1,4 +1,4 @@
-import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-DyCdQP10.js";
+import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-BDx5upZX.js";
 const OAuthDebugCallback = ({ onConnect }) => {
   reactExports.useEffect(() => {
     let isProcessed = false;