codex-plugin-doctor 1.50.0 → 1.52.0

package/dist/domain/types.d.ts

@@ -41,6 +41,8 @@ export interface BaselineSummary {
 }
 export interface CheckOptions {
     runtime?: boolean;
+    allowNetwork?: boolean;
+    allowLocalNetwork?: boolean;
     runtimeTranscript?: (line: string) => void;
     runtimeStartupTimeoutMs?: number;
     runtimeSandbox?: RuntimeSandboxMode;
@@ -90,6 +92,51 @@ export interface RuntimeScorecard {
     resourceTemplatesList: RuntimeCapabilityStatus;
     promptsList: RuntimeCapabilityStatus;
     promptGet: RuntimeCapabilityStatus;
+    conformance?: RuntimeConformanceScorecard;
+    remote?: RemoteRuntimeScorecard;
+}
+export interface RemoteRuntimeScorecard {
+    transport: RuntimeCapabilityStatus;
+    networkSafety: RuntimeCapabilityStatus;
+    initialize: RuntimeCapabilityStatus;
+    contentType: RuntimeCapabilityStatus;
+    session: "absent" | "present-valid" | "present-invalid";
+    protocolHeaders: RuntimeCapabilityStatus;
+    authorization: RuntimeCapabilityStatus;
+    overall: "pass" | "warn" | "fail" | "skipped";
+}
+export type McpConformanceProfile = "legacy" | "2025-11-25" | "future-compatible";
+export interface RuntimeConformanceScorecard {
+    protocolVersion: string | null;
+    profile: McpConformanceProfile | null;
+    capabilityConsistency: RuntimeCapabilityStatus;
+    taskDeclarations: RuntimeCapabilityStatus;
+    tasksList: RuntimeCapabilityStatus;
+    schemaDialect: RuntimeCapabilityStatus;
+    overall: "pass" | "warn" | "fail" | "skipped";
+}
+export interface McpToolObservation {
+    name: string;
+    inputSchema: unknown;
+    outputSchema?: unknown;
+    execution?: unknown;
+}
+export interface TasksListObservation {
+    status: "pass" | "fail" | "skipped";
+    itemCount: number;
+    pageCount: number;
+    failure?: "timeout" | "invalid";
+}
+export interface McpConformanceObservation {
+    protocolVersion: string;
+    capabilities: unknown;
+    tools: McpToolObservation[];
+    tasksList?: TasksListObservation;
+    skipToolDerivedChecks?: boolean;
+}
+export interface McpConformanceResult {
+    findings: Finding[];
+    scorecard: RuntimeConformanceScorecard;
 }
 export interface RuntimeProbeResult {
     findings: Finding[];

package/dist/index.d.ts

@@ -18,6 +18,10 @@ export { buildDoctorExportBundleFromAnalysis, buildDoctorRecommendationsFromAnal
 export { buildDoctorPerformanceReport, renderDoctorPerformanceReport, renderDoctorPerformanceReportJson, type BuildDoctorPerformanceReportOptions, type DoctorPerformanceReport, type DoctorPerformanceStage, type DoctorPerformanceStageName } from "./core/performance-report.js";
 export { buildDoctorRuntimePlan, evaluateRuntimeApproval, renderDoctorRuntimePlan, renderDoctorRuntimePlanMarkdown, renderDoctorRuntimePlanJson, runtimeApprovalPassed, type DoctorRuntimePlan, type RuntimeApprovalReport, type RuntimePlanServer } from "./core/runtime-plan.js";
 export { buildDoctorRuntimePolicyReport, renderDoctorRuntimePolicy, renderDoctorRuntimePolicyJson, type DoctorRuntimePolicyReport, type RuntimePolicyDecision, type RuntimePolicyRecommendation } from "./core/runtime-policy.js";
+export { inspectRemoteMcpUrl, type RemoteUrlInspection } from "./core/remote-url-policy.js";
+export { resolveRemoteTarget, RemoteNetworkPolicyError, type ResolvedRemoteTarget, type ResolveRemoteTargetOptions } from "./core/remote-network-policy.js";
+export { probeRemoteMcpServer, type RemoteMcpProbeOptions, type RemoteMcpProbeResult } from "./core/remote-mcp-probe.js";
+export { checkRemoteOAuthReadiness, type RemoteOAuthReadinessOptions, type RemoteOAuthReadinessResult } from "./core/remote-oauth-readiness.js";
 export { buildDoctorReviewBundle, diffDoctorReviewBundles, renderDoctorReviewBundle, renderDoctorReviewBundleDiff, renderDoctorReviewBundleDiffJson, renderDoctorReviewBundleJson, renderDoctorReviewBundleVerification, renderDoctorReviewBundleVerificationJson, verifyDoctorReviewBundle, type BuildDoctorReviewBundleOptions, type DoctorReviewBundle, type DoctorReviewBundleDiffChange, type DoctorReviewBundleDiffReport, type DoctorReviewBundleDiffSnapshot, type DoctorReviewBundleManifest, type DoctorReviewBundleVerificationReport } from "./core/review-bundle.js";
 export { buildDoctorReleaseEvidenceAssetReport, buildDoctorReleaseEvidenceReport, renderDoctorReleaseEvidenceAsset, renderDoctorReleaseEvidenceAssetJson, renderDoctorReleaseEvidence, renderDoctorReleaseEvidenceJson, renderDoctorReleaseEvidenceVerification, renderDoctorReleaseEvidenceVerificationJson, verifyDoctorReleaseEvidence, type BuildDoctorReleaseEvidenceOptions, type DoctorReleaseEvidenceAssetReport, type DoctorReleaseEvidenceGitMetadata, type DoctorReleaseEvidencePackageMetadata, type DoctorReleaseEvidenceReport, type DoctorReleaseEvidenceVerificationReport } from "./core/release-evidence.js";
 export { buildDoctorNpmPackageReport, renderDoctorNpmPackageReport, renderDoctorNpmPackageReportJson, type BuildDoctorNpmPackageReportOptions, type DoctorNpmPackageReport } from "./core/npm-package-doctor.js";

package/dist/index.js

@@ -18,6 +18,10 @@ export { buildDoctorExportBundleFromAnalysis, buildDoctorRecommendationsFromAnal
 export { buildDoctorPerformanceReport, renderDoctorPerformanceReport, renderDoctorPerformanceReportJson } from "./core/performance-report.js";
 export { buildDoctorRuntimePlan, evaluateRuntimeApproval, renderDoctorRuntimePlan, renderDoctorRuntimePlanMarkdown, renderDoctorRuntimePlanJson, runtimeApprovalPassed } from "./core/runtime-plan.js";
 export { buildDoctorRuntimePolicyReport, renderDoctorRuntimePolicy, renderDoctorRuntimePolicyJson } from "./core/runtime-policy.js";
+export { inspectRemoteMcpUrl } from "./core/remote-url-policy.js";
+export { resolveRemoteTarget, RemoteNetworkPolicyError } from "./core/remote-network-policy.js";
+export { probeRemoteMcpServer } from "./core/remote-mcp-probe.js";
+export { checkRemoteOAuthReadiness } from "./core/remote-oauth-readiness.js";
 export { buildDoctorReviewBundle, diffDoctorReviewBundles, renderDoctorReviewBundle, renderDoctorReviewBundleDiff, renderDoctorReviewBundleDiffJson, renderDoctorReviewBundleJson, renderDoctorReviewBundleVerification, renderDoctorReviewBundleVerificationJson, verifyDoctorReviewBundle } from "./core/review-bundle.js";
 export { buildDoctorReleaseEvidenceAssetReport, buildDoctorReleaseEvidenceReport, renderDoctorReleaseEvidenceAsset, renderDoctorReleaseEvidenceAssetJson, renderDoctorReleaseEvidence, renderDoctorReleaseEvidenceJson, renderDoctorReleaseEvidenceVerification, renderDoctorReleaseEvidenceVerificationJson, verifyDoctorReleaseEvidence } from "./core/release-evidence.js";
 export { buildDoctorNpmPackageReport, renderDoctorNpmPackageReport, renderDoctorNpmPackageReportJson } from "./core/npm-package-doctor.js";

package/dist/mcp/generic-mcp-doctor.d.ts

@@ -1,5 +1,5 @@
 import { type CompatibilityEnvironment, type CompatibilityMatrix } from "../compatibility/compatibility-matrix.js";
-import type { Finding } from "../domain/types.js";
+import type { Finding, RuntimeExecutionEvidence, RuntimeScorecard } from "../domain/types.js";
 import { type SecurityAudit } from "../security/security-audit.js";
 export interface GenericMcpDoctorReport {
     targetPath: string;
@@ -10,7 +10,15 @@ export interface GenericMcpDoctorReport {
     findings: Finding[];
     security: SecurityAudit;
     compatibility: CompatibilityMatrix;
+    runtimeScorecard?: RuntimeScorecard;
+    runtimeExecution?: RuntimeExecutionEvidence;
 }
-export declare function buildGenericMcpDoctor(targetPath: string, environment?: CompatibilityEnvironment): Promise<GenericMcpDoctorReport>;
+export interface GenericMcpDoctorOptions {
+    runtime?: boolean;
+    allowNetwork?: boolean;
+    allowLocalNetwork?: boolean;
+    runtimeStartupTimeoutMs?: number;
+}
+export declare function buildGenericMcpDoctor(targetPath: string, environment?: CompatibilityEnvironment, options?: GenericMcpDoctorOptions): Promise<GenericMcpDoctorReport>;
 export declare function renderGenericMcpDoctorJson(report: GenericMcpDoctorReport): string;
 export declare function renderGenericMcpDoctor(report: GenericMcpDoctorReport): string;

package/dist/mcp/generic-mcp-doctor.js

@@ -1,7 +1,8 @@
-import { stat } from "node:fs/promises";
+import { realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { buildCompatibilityMatrix, readMcpConfigPath } from "../compatibility/compatibility-matrix.js";
 import { readJsonFile } from "../core/read-json-file.js";
+import { probeRuntimeConfig } from "../core/runtime-probe.js";
 import { formatFindingFingerprintLine, withFindingFingerprints } from "../reporting/finding-fingerprint.js";
 import { auditMcpServerConfig, buildSecurityAuditFromFindings } from "../security/security-audit.js";
 function buildFinding(severity, id, message, impact, suggestedFix, evidence) {
@@ -63,39 +64,50 @@ function buildStaticMcpFindings(configPath, parsedConfig) {
             findings.push(buildFinding("fail", "mcp.server.invalid", `The MCP server \`${serverName}\` must be configured as an object.`, "MCP clients cannot interpret a server entry unless it is represented as an object with server options.", `Change the \`${serverName}\` entry in \`${configPath}\` to an object.`, { configPath, serverName, field: "server" }));
             continue;
         }
-        if (typeof serverConfig.command !== "string" && typeof serverConfig.url !== "string") {
+        const command = serverConfig.command;
+        const url = serverConfig.url;
+        if (typeof command !== "string" && typeof url !== "string") {
             findings.push(buildFinding("fail", "mcp.server.transport.missing", `The MCP server \`${serverName}\` must define either \`command\` or \`url\`.`, "MCP clients need a process command for stdio servers or a URL for remote servers.", `Add either \`command\` or \`url\` to the \`${serverName}\` entry in \`${configPath}\`.`, { configPath, serverName, field: "transport" }));
         }
+        if (typeof command === "string" && typeof url === "string") {
+            findings.push(buildFinding("fail", "mcp.server.transport.conflict", `The MCP server \`${serverName}\` must not define both \`command\` and \`url\`.`, "A server with two transports cannot be selected deterministically by MCP clients.", `Keep either \`command\` or \`url\` for the \`${serverName}\` entry in \`${configPath}\`.`, { configPath, serverName, field: "transport" }));
+        }
     }
     return {
         serverCount: Object.keys(servers).length,
         findings
     };
 }
-function mergeReportStatus(staticFindings, security) {
-    if (staticFindings.some((finding) => finding.severity === "fail") || security.status === "fail") {
+function mergeReportStatus(findings, security) {
+    if (findings.some((finding) => finding.severity === "fail") || security.status === "fail") {
         return "fail";
     }
-    if (staticFindings.some((finding) => finding.severity === "warn") || security.status === "warn") {
+    if (findings.some((finding) => finding.severity === "warn") || security.status === "warn") {
         return "warn";
     }
     return "pass";
 }
-export async function buildGenericMcpDoctor(targetPath, environment = {}) {
+export async function buildGenericMcpDoctor(targetPath, environment = {}, options = {}) {
     const rootPath = path.resolve(targetPath);
     const compatibility = await buildCompatibilityMatrix(rootPath, environment);
     const mcpConfigPath = await readMcpConfigPath(rootPath);
+    const canonicalRootPath = await realpath(rootPath).catch(() => null);
+    const canonicalMcpConfigPath = mcpConfigPath
+        ? await realpath(mcpConfigPath).catch(() => null)
+        : null;
     let parsedConfig = null;
     let staticFindings = [];
     let serverCount = 0;
     if (!mcpConfigPath || !(await fileExists(mcpConfigPath))) {
         staticFindings = buildStaticMcpFindings(null, null).findings;
     }
-    else if (!isPathWithinRoot(rootPath, mcpConfigPath)) {
+    else if (!canonicalRootPath ||
+        !canonicalMcpConfigPath ||
+        !isPathWithinRoot(canonicalRootPath, canonicalMcpConfigPath)) {
         staticFindings = [
             buildFinding("fail", "mcp.config.path_outside_root", "The MCP config path resolves outside the target root.", "A package that reads MCP configuration outside its root is harder to audit and can depend on unreviewed local files.", "Keep `.mcp.json` or the manifest `mcpServers` reference inside the package root.", {
                 configPath: path.relative(rootPath, mcpConfigPath).replaceAll("\\", "/"),
-                resolvedPath: mcpConfigPath,
+                resolvedPath: canonicalMcpConfigPath ?? mcpConfigPath,
                 field: "configPath"
             })
         ];
@@ -117,19 +129,35 @@ export async function buildGenericMcpDoctor(targetPath, environment = {}) {
         }
     }
     const security = buildSecurityAuditFromFindings(rootPath, mcpConfigPath && parsedConfig !== null
-        ? auditMcpServerConfig(rootPath, parsedConfig)
+        ? auditMcpServerConfig(rootPath, parsedConfig, { configPath: mcpConfigPath })
         : []);
-    const fingerprintedStaticFindings = withFindingFingerprints(staticFindings, rootPath);
-    const status = mergeReportStatus(fingerprintedStaticFindings, security);
+    const runtimeResult = options.runtime &&
+        mcpConfigPath !== null &&
+        parsedConfig !== null &&
+        canonicalRootPath !== null &&
+        canonicalMcpConfigPath !== null &&
+        isPathWithinRoot(canonicalRootPath, canonicalMcpConfigPath) &&
+        !staticFindings.some((finding) => finding.severity === "fail") &&
+        security.status !== "fail"
+        ? await probeRuntimeConfig(canonicalRootPath, canonicalMcpConfigPath, {
+            startupTimeoutMs: options.runtimeStartupTimeoutMs,
+            allowNetwork: options.allowNetwork,
+            allowLocalNetwork: options.allowLocalNetwork
+        })
+        : null;
+    const fingerprintedFindings = withFindingFingerprints([...staticFindings, ...(runtimeResult?.findings ?? [])], rootPath);
+    const status = mergeReportStatus(fingerprintedFindings, security);
     return {
         targetPath: rootPath,
         status,
         exitCode: status === "fail" ? 1 : 0,
         mcpConfigPath,
         serverCount,
-        findings: [...fingerprintedStaticFindings, ...security.findings],
+        findings: [...fingerprintedFindings, ...security.findings],
         security,
-        compatibility
+        compatibility,
+        ...(runtimeResult ? { runtimeScorecard: runtimeResult.scorecard } : {}),
+        ...(runtimeResult?.execution ? { runtimeExecution: runtimeResult.execution } : {})
     };
 }
 export function renderGenericMcpDoctorJson(report) {
@@ -153,6 +181,9 @@ export function renderGenericMcpDoctor(report) {
             .map((result) => `${result.client}=${result.status}`)
             .join(", ")}`
     ];
+    if (report.runtimeScorecard?.conformance) {
+        lines.push(`Runtime conformance: ${report.runtimeScorecard.conformance.overall.toUpperCase()}`);
+    }
     if (report.findings.length === 0) {
         lines.push("", "No findings.");
         return lines.join("\n");

package/dist/reporting/render-markdown-report.js

@@ -1,6 +1,49 @@
 import { formatFindingEvidenceLine } from "./format-finding-evidence.js";
 import { formatFindingFingerprintLine } from "./finding-fingerprint.js";
 import { buildRecommendedCommands } from "./recommended-commands.js";
+function appendRuntimeScorecard(lines, result) {
+    if (!result.runtimeScorecard) {
+        return;
+    }
+    lines.push("", "## Runtime Scorecard", "");
+    lines.push("| Operation | Status |");
+    lines.push("| --- | --- |");
+    lines.push(`| initialize | ${result.runtimeScorecard.initialize.toUpperCase()} |`);
+    lines.push(`| tools/list | ${result.runtimeScorecard.toolsList.toUpperCase()} |`);
+    lines.push(`| tools/call | ${result.runtimeScorecard.toolsCall.toUpperCase()} |`);
+    lines.push(`| resources/list | ${result.runtimeScorecard.resourcesList.toUpperCase()} |`);
+    lines.push(`| resources/read | ${result.runtimeScorecard.resourceRead.toUpperCase()} |`);
+    lines.push(`| resources/templates/list | ${result.runtimeScorecard.resourceTemplatesList.toUpperCase()} |`);
+    lines.push(`| prompts/list | ${result.runtimeScorecard.promptsList.toUpperCase()} |`);
+    lines.push(`| prompts/get | ${result.runtimeScorecard.promptGet.toUpperCase()} |`);
+    const conformance = result.runtimeScorecard.conformance;
+    if (conformance) {
+        lines.push("", "## MCP Conformance", "");
+        lines.push("| Check | Status |");
+        lines.push("| --- | --- |");
+        lines.push(`| Protocol version | ${conformance.protocolVersion ?? "unavailable"} |`);
+        lines.push(`| Profile | ${conformance.profile ?? "unavailable"} |`);
+        lines.push(`| Capability consistency | ${conformance.capabilityConsistency.toUpperCase()} |`);
+        lines.push(`| Task declarations | ${conformance.taskDeclarations.toUpperCase()} |`);
+        lines.push(`| Tasks list | ${conformance.tasksList.toUpperCase()} |`);
+        lines.push(`| Schema dialect | ${conformance.schemaDialect.toUpperCase()} |`);
+        lines.push(`| Overall | ${conformance.overall.toUpperCase()} |`);
+    }
+    const remote = result.runtimeScorecard.remote;
+    if (remote) {
+        lines.push("", "## Remote MCP Scorecard", "");
+        lines.push("| Check | Status |");
+        lines.push("| --- | --- |");
+        lines.push(`| Transport | ${remote.transport.toUpperCase()} |`);
+        lines.push(`| Network safety | ${remote.networkSafety.toUpperCase()} |`);
+        lines.push(`| Initialize | ${remote.initialize.toUpperCase()} |`);
+        lines.push(`| Content type | ${remote.contentType.toUpperCase()} |`);
+        lines.push(`| Session | ${remote.session.toUpperCase()} |`);
+        lines.push(`| Protocol headers | ${remote.protocolHeaders.toUpperCase()} |`);
+        lines.push(`| Authorization | ${remote.authorization.toUpperCase()} |`);
+        lines.push(`| Overall | ${remote.overall.toUpperCase()} |`);
+    }
+}
 export function buildMarkdownReport(result, options) {
     const failCount = result.findings.filter((finding) => finding.severity === "fail").length;
     const warnCount = result.findings.filter((finding) => finding.severity === "warn").length;
@@ -26,23 +69,11 @@ export function buildMarkdownReport(result, options) {
     if (result.runtimeExecution) {
         lines.push("", `Runtime backend: ${result.runtimeExecution.backend.toUpperCase()}`, `Runtime isolation: network=${result.runtimeExecution.network}, package=${result.runtimeExecution.packageMount}`);
     }
+    appendRuntimeScorecard(lines, result);
     if (result.findings.length === 0 && !result.suppressedFindings?.length) {
         lines.push("", result.baselineSummary ? "No new findings." : "No findings.");
         return lines.join("\n");
     }
-    if (result.runtimeScorecard) {
-        lines.push("", "## Runtime Scorecard", "");
-        lines.push("| Operation | Status |");
-        lines.push("| --- | --- |");
-        lines.push(`| initialize | ${result.runtimeScorecard.initialize.toUpperCase()} |`);
-        lines.push(`| tools/list | ${result.runtimeScorecard.toolsList.toUpperCase()} |`);
-        lines.push(`| tools/call | ${result.runtimeScorecard.toolsCall.toUpperCase()} |`);
-        lines.push(`| resources/list | ${result.runtimeScorecard.resourcesList.toUpperCase()} |`);
-        lines.push(`| resources/read | ${result.runtimeScorecard.resourceRead.toUpperCase()} |`);
-        lines.push(`| resources/templates/list | ${result.runtimeScorecard.resourceTemplatesList.toUpperCase()} |`);
-        lines.push(`| prompts/list | ${result.runtimeScorecard.promptsList.toUpperCase()} |`);
-        lines.push(`| prompts/get | ${result.runtimeScorecard.promptGet.toUpperCase()} |`);
-    }
     if (result.findings.length > 0) {
         const nextActions = Array.from(new Set(result.findings.map((finding) => finding.suggestedFix))).slice(0, 5);
         if (nextActions.length > 0) {

package/dist/reporting/render-text-report.js

@@ -24,6 +24,43 @@ function getGlyphs(ascii) {
             ok: "✔"
         };
 }
+function appendRuntimeScorecard(lines, result) {
+    if (!result.runtimeScorecard) {
+        return;
+    }
+    lines.push("", "Runtime Scorecard", "----------------");
+    lines.push(`initialize: ${result.runtimeScorecard.initialize}`);
+    lines.push(`tools/list: ${result.runtimeScorecard.toolsList}`);
+    lines.push(`tools/call: ${result.runtimeScorecard.toolsCall}`);
+    lines.push(`resources/list: ${result.runtimeScorecard.resourcesList}`);
+    lines.push(`resources/read: ${result.runtimeScorecard.resourceRead}`);
+    lines.push(`resources/templates/list: ${result.runtimeScorecard.resourceTemplatesList}`);
+    lines.push(`prompts/list: ${result.runtimeScorecard.promptsList}`);
+    lines.push(`prompts/get: ${result.runtimeScorecard.promptGet}`);
+    const conformance = result.runtimeScorecard.conformance;
+    if (conformance) {
+        lines.push("", "MCP Conformance", "---------------");
+        lines.push(`Protocol version: ${conformance.protocolVersion ?? "unavailable"}`);
+        lines.push(`Profile: ${conformance.profile ?? "unavailable"}`);
+        lines.push(`Capability consistency: ${conformance.capabilityConsistency}`);
+        lines.push(`Task declarations: ${conformance.taskDeclarations}`);
+        lines.push(`Tasks list: ${conformance.tasksList}`);
+        lines.push(`Schema dialect: ${conformance.schemaDialect}`);
+        lines.push(`Overall: ${conformance.overall}`);
+    }
+    const remote = result.runtimeScorecard.remote;
+    if (remote) {
+        lines.push("", "Remote MCP Scorecard", "--------------------");
+        lines.push(`transport: ${remote.transport}`);
+        lines.push(`network safety: ${remote.networkSafety}`);
+        lines.push(`initialize: ${remote.initialize}`);
+        lines.push(`content type: ${remote.contentType}`);
+        lines.push(`session: ${remote.session}`);
+        lines.push(`protocol headers: ${remote.protocolHeaders}`);
+        lines.push(`authorization: ${remote.authorization}`);
+        lines.push(`overall: ${remote.overall}`);
+    }
+}
 export function renderTextReport(result, options = {}) {
     const ascii = options.ascii ?? false;
     const explain = options.explain ?? false;
@@ -46,17 +83,7 @@ export function renderTextReport(result, options = {}) {
         lines.push(`Runtime backend: ${result.runtimeExecution.backend.toUpperCase()}`, `Runtime isolation: network=${result.runtimeExecution.network}, package=${result.runtimeExecution.packageMount}`);
     }
     if (result.findings.length === 0 && !result.suppressedFindings?.length) {
-        if (result.runtimeScorecard) {
-            lines.push("", "Runtime Scorecard", "----------------");
-            lines.push(`initialize: ${result.runtimeScorecard.initialize}`);
-            lines.push(`tools/list: ${result.runtimeScorecard.toolsList}`);
-            lines.push(`tools/call: ${result.runtimeScorecard.toolsCall}`);
-            lines.push(`resources/list: ${result.runtimeScorecard.resourcesList}`);
-            lines.push(`resources/read: ${result.runtimeScorecard.resourceRead}`);
-            lines.push(`resources/templates/list: ${result.runtimeScorecard.resourceTemplatesList}`);
-            lines.push(`prompts/list: ${result.runtimeScorecard.promptsList}`);
-            lines.push(`prompts/get: ${result.runtimeScorecard.promptGet}`);
-        }
+        appendRuntimeScorecard(lines, result);
         lines.push("", result.baselineSummary ? "No new findings." : "No findings.");
         return lines.join("\n");
     }
@@ -114,17 +141,7 @@ export function renderTextReport(result, options = {}) {
             lines.push(`  Expires: ${finding.suppression.expiresAt}`);
         }
     }
-    if (result.runtimeScorecard) {
-        lines.push("", "Runtime Scorecard", "----------------");
-        lines.push(`initialize: ${result.runtimeScorecard.initialize}`);
-        lines.push(`tools/list: ${result.runtimeScorecard.toolsList}`);
-        lines.push(`tools/call: ${result.runtimeScorecard.toolsCall}`);
-        lines.push(`resources/list: ${result.runtimeScorecard.resourcesList}`);
-        lines.push(`resources/read: ${result.runtimeScorecard.resourceRead}`);
-        lines.push(`resources/templates/list: ${result.runtimeScorecard.resourceTemplatesList}`);
-        lines.push(`prompts/list: ${result.runtimeScorecard.promptsList}`);
-        lines.push(`prompts/get: ${result.runtimeScorecard.promptGet}`);
-    }
+    appendRuntimeScorecard(lines, result);
     const recommendedCommands = buildRecommendedCommands(result);
     if (recommendedCommands.length > 0) {
         lines.push("", "Recommended Commands", "--------------------");