@interlok/cli 1.3.0 → 1.3.1

package/README.md

@@ -11,7 +11,7 @@ npx @interlok/cli scan --ci --min-coverage 80 # exit 5 below 80% of high-risk wr
 npx @interlok/cli scan --publish             # signed public report + README badge (needs a key)
 ```
 
-Coverage counts only high-consequence write paths (money, access, deletion, code execution, deploys, messages to people) and how many have a guard. Tools whose names can't be classified count as high-risk until someone classifies them. `src/classify.ts` is the same file the hosted app uses; a test fails the build if they differ.
+Coverage counts only high-consequence write paths (money, access, deletion, code execution, deploys, messages to people) and how many have a guard. Tools whose names can't be classified count as high-risk until someone classifies them. A config file names servers but usually not their tools: without `--enumerate` (or an inventory that lists tools) the scan says which servers it could not check instead of calling them safe, and `--min-coverage` exits 5 because coverage cannot be measured. `src/classify.ts` is the same file the hosted app uses; a test fails the build if they differ.
 
 ## shadow: what your agent would have done, on every pull request
 

package/dist/index.js

@@ -5,7 +5,7 @@ import { scan } from "./scan.js";
 import { verifyFile } from "./verify.js";
 import { verifyProofBundle } from "./proof-verify.js";
 import { readFile } from "node:fs/promises";
-import { coverageOf, enumerate, findInventory } from "./inventory.js";
+import { coverageOf, enumerate, findInventory, scanVerdict, unlistedServers } from "./inventory.js";
 import { coverageLine } from "./classify.js";
 import { gateCommand } from "./gate.js";
 import { proxyCommand } from "./proxy.js";
@@ -40,6 +40,10 @@ async function main() {
         if (has("--enumerate"))
             inventory = await enumerate(inventory);
         const coverage = coverageOf(inventory);
+        const verdict = scanVerdict(coverage, inventory, coverageLine(coverage, "guarded"), {
+            filesFound: files.length > 0,
+            enumerated: has("--enumerate"),
+        });
         if (value("--format") === "cef" || has("--format=cef")) {
             findings.forEach((f) => console.log(`CEF:0|Interlok|CLI|1|${f.code}|${f.message}|${f.severity === "critical" ? 10 : 6}|file=${f.file}`));
         }
@@ -47,12 +51,14 @@ async function main() {
             console.log(JSON.stringify({
                 target,
                 inventory_files: files,
+                servers: inventory.servers.length,
+                servers_without_tools: unlistedServers(inventory),
                 coverage,
                 findings,
                 critical: findings.filter((f) => f.severity === "critical").length,
             }, null, 2));
         }
-        console.error(`coverage  ${coverageLine(coverage, "guarded")}${files.length ? "" : "  (no MCP config or inventory found; pass a file, or --enumerate to list tools)"}`);
+        console.error(`coverage  ${verdict.text}`);
         if (has("--publish")) {
             if (!api || !key)
                 throw new Error("--publish needs INTERLOK_URL and INTERLOK_API_KEY");
@@ -79,7 +85,12 @@ async function main() {
         const min = value("--min-coverage");
         if (min !== undefined) {
             const pct = coverage.rungs.guarded?.pct ?? null;
-            if (pct !== null && pct < Number(min)) {
+            // A CI gate must not pass on servers it could not see.
+            if (!verdict.measurable && inventory.servers.length) {
+                console.error(`coverage cannot be measured: ${verdict.text}`);
+                process.exitCode = 5;
+            }
+            else if (pct !== null && pct < Number(min)) {
                 console.error(`coverage ${pct}% is below --min-coverage ${min}`);
                 process.exitCode = 5;
             }

package/dist/inventory.d.ts

@@ -34,6 +34,20 @@ export declare function findInventory(target: string): Promise<{
 }>;
 /** The same normalisation the console uses: an inventory passes through; a client config is mapped. */
 export declare function toInventory(raw: any): Inventory;
+/** Servers whose tools are not listed in the inventory, so coverage cannot see them. */
+export declare function unlistedServers(inv: Inventory): string[];
+/**
+ * The one-line verdict printed after a scan. "No high-risk write paths" is only said when every
+ * server's tools were actually seen; a config that names servers without listing their tools gets
+ * told to enumerate instead of being told it is safe.
+ */
+export declare function scanVerdict(coverage: Coverage, inv: Inventory, line: string, opts: {
+    filesFound: boolean;
+    enumerated: boolean;
+}): {
+    text: string;
+    measurable: boolean;
+};
 export declare function coverageOf(inv: Inventory): Coverage;
 /** Start each server (or call it over HTTP) and list its tools. Opt-in: this runs the configured commands. */
 export declare function enumerate(inv: Inventory, timeoutMs?: number): Promise<Inventory>;

package/dist/inventory.js

@@ -53,6 +53,39 @@ export function toInventory(raw) {
         })),
     };
 }
+/** Servers whose tools are not listed in the inventory, so coverage cannot see them. */
+export function unlistedServers(inv) {
+    return inv.servers.filter((s) => !s.tools?.length).map((s) => s.name);
+}
+/**
+ * The one-line verdict printed after a scan. "No high-risk write paths" is only said when every
+ * server's tools were actually seen; a config that names servers without listing their tools gets
+ * told to enumerate instead of being told it is safe.
+ */
+export function scanVerdict(coverage, inv, line, opts) {
+    if (!opts.filesFound)
+        return {
+            text: "no MCP config or inventory found; pass a file, or --enumerate to list tools",
+            measurable: false,
+        };
+    const unlisted = unlistedServers(inv);
+    const n = inv.servers.length;
+    if (!unlisted.length)
+        return { text: line, measurable: true };
+    const names = unlisted.slice(0, 5).join(", ") + (unlisted.length > 5 ? ", …" : "");
+    const hint = opts.enumerated
+        ? "they did not answer when started; check their commands and credentials"
+        : "run with --enumerate to start them and check their tools";
+    if (unlisted.length === n)
+        return {
+            text: `${n} server${n === 1 ? "" : "s"} found (${names}), tools not listed: ${hint}`,
+            measurable: false,
+        };
+    return {
+        text: `${line} · ${unlisted.length} of ${n} servers not checked (${names}): ${hint}`,
+        measurable: coverage.high_risk_write_paths > 0,
+    };
+}
 export function coverageOf(inv) {
     const items = [];
     for (const s of inv.servers)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@interlok/cli",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Scan agent configurations, put MCP servers behind the Interlok gate, run Shadow observations, and verify receipts offline.",
   "license": "Apache-2.0",
   "repository": {