@eidonze/mcpdoctor 0.1.7 → 0.1.8

package/README.md

@@ -20,13 +20,13 @@ Read-only checks for MCP tool schemas and x402 payment endpoints. Use it before
 Check an MCP server without calling any tools:
 
 ```bash
-npx @eidonze/mcpdoctor@0.1.6 schema https://your-mcp-server.example/mcp --json
+npx @eidonze/mcpdoctor schema https://your-mcp-server.example/mcp --json
 ```
 
 Check an x402 endpoint without paying:
 
 ```bash
-npx @eidonze/mcpdoctor@0.1.6 inspect https://your-api.example/paid --method=POST --json
+npx @eidonze/mcpdoctor inspect https://your-api.example/paid --method=POST --json
 ```
 
 Requires Node.js 18+. No API key or wallet is needed.
@@ -88,7 +88,7 @@ jobs:
           format: markdown
 ```
 
-Use `mode: inspect` for an x402 preflight. The action fails on `FAIL` or `UNKNOWN` by default; set `fail-on: false` for an informational check.
+Use `mode: inspect` for an x402 preflight. The action fails on `FAIL` or `UNKNOWN` by default; set `fail-on: false` for an informational check. Looking for it in the Marketplace? Search "MCP Trust Check" or "mcp server test", or browse the [mcp-trust-check listing](https://github.com/marketplace/actions/mcp-trust-check).
 
 ## Starter template
 

package/bin/mcpdoctor-mcp.mjs

@@ -65,7 +65,7 @@ async function callTool(name, args) {
   throw new Error(`unknown tool: ${name}`);
 }
 
-const serverInfo = { name: 'mcpdoctor', version: '0.1.7' };
+const serverInfo = { name: 'mcpdoctor', version: '0.1.8' };
 const write = (msg) => process.stdout.write(JSON.stringify(msg) + '\n');
 
 const rl = readline.createInterface({ input: process.stdin, terminal: false });

package/bin/mcpdoctor.mjs

@@ -3,7 +3,7 @@ import { createHash } from 'node:crypto';
 
 const MAX_BODY = 1024 * 1024;
 const TIMEOUT = 10_000;
-const VERSION = '0.1.5';
+const VERSION = '0.1.8';
 
 const help = `mcpdoctor ${VERSION}
 
@@ -133,7 +133,8 @@ function markdown(report) {
   const lines = [`# mcpdoctor report`, '', `- Status: **${report.finalStatus}**`, `- Endpoint: ${report.endpoint}`, `- HTTP: ${report.http.status}`, `- Response: ${report.http.elapsedMs} ms / ${report.http.bodyBytes} bytes`, `- Body SHA-256: \`${report.http.bodySha256}\``, '', '## Payment requirements', ''];
   if (!report.x402.accepts.length) lines.push('- None parsed', '');
   report.x402.accepts.forEach((item, i) => lines.push(`### accepts[${i}]`, '', ...Object.entries(item).map(([key, value]) => `- ${key}: ${value ?? 'missing'}`), ''));
-  lines.push('## Findings', '', ...(report.findings.length ? report.findings.map((item) => `- **${item.status}** \`${item.code}\`: ${item.message}`) : ['- None']), '', '## Limitations', '', ...report.limitations.map((item) => `- ${item}`), '');
+  lines.push('## Findings', '', ...(report.findings.length ? report.findings.map((item) => `- **${item.status}** \`${item.code}\`: ${item.message}`) : ['- None']), '', '## Limitations', '', ...report.limitations.map((item) => `- ${item}`));
+  if (report.finalStatus === 'PASS') lines.push('', '## Next steps', '', 'Gate CI on this exact check (paste into .github/workflows/x402.yml):', '', '```yaml', '- uses: xka0085-byte/mcp-doctor@v1', '  with:', `    endpoint: ${report.endpoint}`, '    mode: inspect', '```', '', 'Weekly re-scan and docs: https://xka0085-byte.github.io/mcp-doctor/x402-endpoint-inspector.html');
   return lines.join('\n');
 }
 
@@ -166,7 +167,12 @@ async function schemaCommand(url, format) {
   }
   if (!findings.length) add('STATIC_SCHEMA_CHECKS_PASSED', 'INFO', `${tools.length} tools passed deterministic schema checks`);
   const report = { reportVersion: 1, inspectorVersion: VERSION, mode: 'read-only MCP initialize + tools/list', checkedAt: new Date().toISOString(), endpoint: url.toString(), finalStatus: findings.some(x => x.severity === 'FAIL') ? 'FAIL' : 'PASS', mcp: { protocolVersion: init?.result?.protocolVersion ?? null, serverInfo: init?.result?.serverInfo ?? null, toolCount: Array.isArray(tools) ? tools.length : null }, findings, limitations: ['Static schema checks do not predict model tool selection or prove behavior across all clients.', 'No tool was called; side effects, authorization, data quality and security were not tested.'] };
-  console.log(format === 'json' ? JSON.stringify(report, null, 2) : `# MCP Tool Schema Report\n\n- Status: **${report.finalStatus}**\n- Endpoint: ${report.endpoint}\n- Protocol: ${report.mcp.protocolVersion ?? 'unknown'}\n- Tools: ${report.mcp.toolCount ?? 'unknown'}\n\n${findings.map(x => `- **${x.severity}** \`${x.code}\`: ${x.message}`).join('\n')}\n\n${report.limitations.map(x => `- ${x}`).join('\n')}`);
+  if (format === 'json') { console.log(JSON.stringify(report, null, 2)); }
+  else {
+    let text = `# MCP Tool Schema Report\n\n- Status: **${report.finalStatus}**\n- Endpoint: ${report.endpoint}\n- Protocol: ${report.mcp.protocolVersion ?? 'unknown'}\n- Tools: ${report.mcp.toolCount ?? 'unknown'}\n\n${findings.map(x => `- **${x.severity}** \`${x.code}\`: ${x.message}`).join('\n')}\n\n${report.limitations.map(x => `- ${x}`).join('\n')}`;
+    if (report.finalStatus === 'PASS') text += `\n\nNext steps\n- Gate CI on this exact check (paste into .github/workflows/mcp.yml):\n\n    - uses: xka0085-byte/mcp-doctor@v1\n      with:\n        endpoint: ${report.endpoint}\n        mode: schema\n\n- Weekly re-scan and a README status badge: https://xka0085-byte.github.io/mcp-doctor/trust/\n`;
+    console.log(text);
+  }
   process.exitCode = report.finalStatus === 'PASS' ? 0 : 1;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eidonze/mcpdoctor",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "mcpName": "io.github.xka0085-byte/mcpdoctor",
   "description": "Read-only MCP and x402 endpoint preflight checks: 402 challenge shape, payment document parsing, accepts[] conformance, discovery manifests, response digest. Zero dependencies.",
   "license": "MIT",