cuonztech-agent-harness 0.6.0 → 0.8.0

package/dist/proxy/guarded-stdio.js

@@ -0,0 +1,174 @@
+import { JSONRPCMessageSchema } from "@modelcontextprotocol/sdk/types.js";
+const MAX_BUFFER = 10 * 1024 * 1024;
+const INTEGER_REASON = "an integer beyond 2^53 (9007199254740992)";
+const DECIMAL_REASON = "a number with more digits than a double can hold exactly (beyond 2^53 precision)";
+const JSON_NUMBER = /^-?(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/;
+// Why a JSON number token would not survive JSON.parse unchanged, or undefined.
+// Plain floats such as 1.5, 1e3, 0.1 or 129.95 are fine; an integer written as
+// 9007199254740993.0, 9007199254740993E0 or 90071992547409930e-1 is not.
+function numberProblem(token) {
+    const match = JSON_NUMBER.exec(token);
+    if (!match)
+        return undefined;
+    const value = Number(token);
+    if (!Number.isFinite(value))
+        return INTEGER_REASON;
+    const intPart = token.replace(/^-/, "").split(/[.eE]/)[0];
+    const fraction = match[2] ?? "";
+    // Resolve the exponent: digits * 10^scale, without trailing zeros in digits.
+    const rawDigits = (intPart + fraction).replace(/^0+/, "");
+    const digits = rawDigits.replace(/0+$/, "");
+    if (digits === "")
+        return undefined; // zero
+    const scale = Number(match[3] ?? "0") - fraction.length + (rawDigits.length - digits.length);
+    if (value === 0)
+        return DECIMAL_REASON; // underflow, e.g. 1e-400
+    if (scale >= 0) {
+        try {
+            return BigInt(Math.abs(value)) === BigInt(digits) * 10n ** BigInt(scale) ? undefined : INTEGER_REASON;
+        }
+        catch {
+            return INTEGER_REASON;
+        }
+    }
+    return digits.length > 17 ? DECIMAL_REASON : undefined;
+}
+// Reasons why a raw JSON text cannot pass through a parse/serialize round trip.
+export function findUnforwardable(json) {
+    const reasons = new Set();
+    const n = json.length;
+    let i = 0;
+    while (i < n) {
+        const c = json[i];
+        if (c === '"') {
+            let j = i + 1;
+            while (j < n && json[j] !== '"')
+                j += json[j] === "\\" ? 2 : 1;
+            let k = j + 1;
+            while (k < n && /\s/.test(json[k]))
+                k++;
+            if (json[k] === ":") {
+                let key;
+                try {
+                    key = JSON.parse(json.slice(i, j + 1));
+                }
+                catch {
+                    key = undefined;
+                }
+                if (key === "__proto__")
+                    reasons.add('an argument named "__proto__"');
+            }
+            i = j + 1;
+        }
+        else if (c === "-" || (c !== undefined && c >= "0" && c <= "9")) {
+            let j = i + 1;
+            while (j < n && /[0-9.eE+-]/.test(json[j]))
+                j++;
+            const token = json.slice(i, j);
+            const reason = numberProblem(token);
+            if (reason)
+                reasons.add(reason);
+            i = j;
+        }
+        else {
+            i++;
+        }
+    }
+    return [...reasons];
+}
+export class GuardedStdioServerTransport {
+    stdin;
+    stdout;
+    notify;
+    onclose;
+    onerror;
+    onmessage;
+    buffer;
+    started = false;
+    constructor(stdin = process.stdin, stdout = process.stdout, notify = () => undefined) {
+        this.stdin = stdin;
+        this.stdout = stdout;
+        this.notify = notify;
+    }
+    ondata = (chunk) => {
+        try {
+            const size = (this.buffer?.length ?? 0) + chunk.length;
+            if (size > MAX_BUFFER) {
+                this.buffer = undefined;
+                throw new Error(`stdin message exceeded maximum size of ${MAX_BUFFER} bytes`);
+            }
+            this.buffer = this.buffer ? Buffer.concat([this.buffer, chunk]) : chunk;
+            this.drain();
+        }
+        catch (error) {
+            this.onerror?.(error);
+            void this.close();
+        }
+    };
+    onstdinerror = (error) => {
+        this.onerror?.(error);
+    };
+    async start() {
+        if (this.started)
+            throw new Error("GuardedStdioServerTransport already started!");
+        this.started = true;
+        this.stdin.on("data", this.ondata);
+        this.stdin.on("error", this.onstdinerror);
+    }
+    drain() {
+        for (;;) {
+            if (!this.buffer)
+                return;
+            const index = this.buffer.indexOf("\n");
+            if (index === -1)
+                return;
+            const line = this.buffer.toString("utf8", 0, index).replace(/\r$/, "");
+            this.buffer = this.buffer.subarray(index + 1);
+            try {
+                const parsed = JSON.parse(line);
+                if (parsed && parsed.method === "tools/call" && (typeof parsed.id === "string" || typeof parsed.id === "number")) {
+                    const reasons = findUnforwardable(line);
+                    if (reasons.length > 0) {
+                        this.notify(`Refused a tools/call (id ${String(parsed.id)}): it contains ${reasons.join(" and ")}, which cannot be forwarded unchanged.`);
+                        void this.send({
+                            jsonrpc: "2.0",
+                            id: parsed.id,
+                            result: {
+                                isError: true,
+                                content: [
+                                    {
+                                        type: "text",
+                                        text: `The test harness did not forward this call: it contains ${reasons.join(" and ")}. ` +
+                                            "JSON processing would have changed the value, so a different operation than the one you meant would have been executed. " +
+                                            "Send such values as strings and call again.",
+                                    },
+                                ],
+                            },
+                        });
+                        continue;
+                    }
+                }
+                this.onmessage?.(JSONRPCMessageSchema.parse(parsed));
+            }
+            catch (error) {
+                this.onerror?.(error);
+            }
+        }
+    }
+    async close() {
+        this.stdin.off("data", this.ondata);
+        this.stdin.off("error", this.onstdinerror);
+        if (this.stdin.listenerCount("data") === 0)
+            this.stdin.pause();
+        this.buffer = undefined;
+        this.onclose?.();
+    }
+    send(message) {
+        return new Promise((resolve) => {
+            if (this.stdout.write(JSON.stringify(message) + "\n"))
+                resolve();
+            else
+                this.stdout.once("drain", resolve);
+        });
+    }
+}

package/dist/proxy/interceptor.js

@@ -247,8 +247,8 @@ export class ProxyInterceptor {
     getKeyCapableTools() {
         return [...this.session.keyCapableTools];
     }
-    async interceptToolCall(toolName, args) {
-        const result = await this.handleToolCall(toolName, args);
+    async interceptToolCall(toolName, args, signal) {
+        const result = await this.handleToolCall(toolName, args, signal);
         try {
             await this.onCallRecorded?.();
         }
@@ -257,7 +257,7 @@ export class ProxyInterceptor {
         }
         return result;
     }
-    async handleToolCall(toolName, args) {
+    async handleToolCall(toolName, args, signal) {
         // Everything up to the first await runs synchronously, so two calls
         // dispatched in parallel still get distinct, ordered write positions —
         // only one of them can be "the first write" a scenario fires on.
@@ -317,10 +317,12 @@ export class ProxyInterceptor {
                 // see interceptToolCall
             }
             try {
-                const result = (await this.upstreamClient.callTool({
-                    name: toolName,
-                    arguments: mergedArgs,
-                }));
+                // The client cancelled while this call waited (onCallRecorded or a
+                // scenario delay). Do not start the upstream write at all.
+                if (signal?.aborted) {
+                    throw new Error("cancelled by client before dispatch");
+                }
+                const result = (await this.upstreamClient.callTool({ name: toolName, arguments: mergedArgs }, undefined, { signal }));
                 upstreamResult = result;
                 upstreamIsError = Boolean(result.isError);
                 const content = Array.isArray(result.content)

package/dist/report-file-guard.js

@@ -0,0 +1,123 @@
+// The proxy writes its report to --report-file at startup and after every call,
+// replacing whatever is there. A mistyped path must not turn into the loss of
+// an unrelated file (the upstream's own script, a config, a spreadsheet): an
+// existing file is only replaced if it is empty or an earlier harness report.
+import { existsSync, readFileSync, renameSync, statSync } from "node:fs";
+import { basename, dirname, extname, join } from "node:path";
+const MAX_REPORT_BYTES = 8 * 1024 * 1024;
+export function isReplaceableReportFile(path) {
+    try {
+        const info = statSync(path, { throwIfNoEntry: false });
+        if (!info || !info.isFile())
+            return true; // nothing there, or rejected by other checks
+        if (info.size === 0)
+            return true;
+        if (info.size > MAX_REPORT_BYTES)
+            return false;
+        const parsed = JSON.parse(readFileSync(path, "utf-8"));
+        return (parsed !== null &&
+            typeof parsed === "object" &&
+            typeof parsed.harnessVersion === "string");
+    }
+    catch {
+        return false;
+    }
+}
+export function notReplaceableMessage(flag, path) {
+    return (`${flag} "${path}" already exists and is not an earlier harness report. ` +
+        "Refusing to overwrite it. Choose another file name (for example harness-report.json), " +
+        "or remove the file yourself if you really want it gone.");
+}
+// Windows device names: writing to "NUL" or "CON" as a relative path can
+// create a real file of that name (or block on a device).
+// Checked for every path segment ("C:\\NUL\\x.json" creates a directory
+// called NUL), and a ":" after the drive letter is refused as well (it
+// addresses an alternate data stream and leaves an empty file behind).
+export function isReservedFileName(path) {
+    if (process.platform !== "win32")
+        return false;
+    // "\\?\C:\dir\file" is an ordinary long-path spelling.
+    const withoutDrive = path.replace(/^\\\\\?\\/, "").replace(/^[a-zA-Z]:/, "");
+    if (withoutDrive.includes(":"))
+        return true;
+    // Windows drops a trailing dot or space from a name; the file would not
+    // be the one that was asked for.
+    if (/[. ]$/.test(withoutDrive))
+        return true;
+    return withoutDrive
+        .split(/[\\/]+/)
+        .some((segment) => /^(nul|con|prn|aux|com[1-9]|lpt[1-9])(\..*)?$/i.test(segment));
+}
+export function inspectReportForArchive(parsed) {
+    if (parsed === null || typeof parsed !== "object") {
+        return { shouldArchive: false, callsCount: 0 };
+    }
+    const obj = parsed;
+    if (typeof obj.harnessVersion !== "string") {
+        return { shouldArchive: false, callsCount: 0 };
+    }
+    // Startup placeholders or errors from earlier runs never get archived,
+    // preventing runaway file proliferation on repeated reconnects.
+    if (obj.status === "starting" || typeof obj.startupError === "string") {
+        return { shouldArchive: false, callsCount: 0 };
+    }
+    const reportObj = obj.report;
+    const calls = Array.isArray(reportObj?.calls) ? reportObj.calls : [];
+    const forensics = obj.call_forensics;
+    const timeline = Array.isArray(forensics?.timeline) ? forensics.timeline : [];
+    const callsCount = Math.max(calls.length, timeline.length);
+    const verdict = typeof obj.verdict === "string" ? obj.verdict : undefined;
+    // We archive if there is at least one recorded call or an evaluated verdict (PASS / FAIL)
+    const shouldArchive = callsCount > 0 || verdict === "PASS" || verdict === "FAIL";
+    return {
+        shouldArchive,
+        verdict,
+        callsCount,
+    };
+}
+export function computeArchiveReportPath(filePath, now = new Date()) {
+    const dir = dirname(filePath);
+    const ext = extname(filePath);
+    const name = basename(filePath, ext);
+    // ISO timestamp with colon replaced by '-' for Windows filesystem compatibility:
+    // e.g. 2026-10-30T17-25-00.123Z
+    const safeTimestamp = now.toISOString().replace(/:/g, "-");
+    let candidate = join(dir, `${name}.${safeTimestamp}${ext || ".json"}`);
+    let counter = 1;
+    while (existsSync(candidate)) {
+        candidate = join(dir, `${name}.${safeTimestamp}.${counter}${ext || ".json"}`);
+        counter++;
+    }
+    return candidate;
+}
+export function archivePreviousReportSync(filePath, now = new Date()) {
+    const info = statSync(filePath, { throwIfNoEntry: false });
+    if (!info || !info.isFile())
+        return null;
+    if (info.size === 0 || info.size > MAX_REPORT_BYTES)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+    const check = inspectReportForArchive(parsed);
+    if (!check.shouldArchive)
+        return null;
+    const archivePath = computeArchiveReportPath(filePath, now);
+    try {
+        renameSync(filePath, archivePath);
+    }
+    catch (err) {
+        throw new Error(`could not archive previous report file "${filePath}" to "${archivePath}": ` +
+            `${err instanceof Error ? err.message : String(err)}`);
+    }
+    return {
+        archivedPath: archivePath,
+        verdict: check.verdict,
+        callsCount: check.callsCount,
+        archivedAt: now.toISOString(),
+    };
+}

package/dist/schema-audit.js

@@ -0,0 +1,193 @@
+import { classifyUpstreamTool } from "./proxy/interceptor.js";
+// Felder, die auf einen Idempotenz-Schlüssel hindeuten (verglichen ohne
+// Gross-/Kleinschreibung und ohne Trennzeichen: idempotency_key = idempotencyKey).
+const IDEMPOTENCY_FIELDS = new Set([
+    "idempotencykey",
+    "requestid",
+    "clientreferenceid",
+    "dedupkey",
+    "transactionid",
+]);
+const IDEMPOTENCY_PATCH = {
+    type: "string",
+    description: "Eindeutiger Schlüssel zur Vermeidung von Doppelausführungen bei Wiederholungsversuchen",
+};
+// Verben am Anfang eines Tool-Namens; sie sagen nichts über das Objekt, auf das
+// das Tool wirkt ("create_booking" und "list_bookings" betreffen "booking").
+const VERBS = new Set([
+    "create", "add", "book", "send", "update", "delete", "remove", "cancel", "submit", "post", "insert",
+    "register", "schedule", "transfer", "refund", "reserve", "issue", "withdraw", "deposit", "purchase",
+    "approve", "pay", "charge", "confirm", "place", "write", "set", "make", "new", "check", "apply",
+    "get", "list", "search", "find", "read", "fetch", "query", "show", "lookup", "view", "count",
+    "describe", "retrieve", "browse", "filter",
+]);
+const STOP_WORDS = new Set(["a", "an", "the", "by", "for", "of", "in", "to", "on", "with", "from", "my", "me"]);
+// Namen, die kein bestimmtes Objekt bezeichnen: ein Tool, das nur aus Verb und
+// einem solchen Wort besteht ("search", "list_all", "query_records"), sucht überall.
+const GENERIC_NOUNS = new Set(["all", "any", "everything", "record", "item", "object", "data", "entity", "resource", "result"]);
+const LOOKUP_VERBS = new Set(["list", "search", "find", "query", "lookup", "browse", "filter", "get", "read", "fetch", "retrieve", "show", "view"]);
+function tokens(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((t) => t.length > 0);
+}
+function singular(word) {
+    if (word.length > 4 && word.endsWith("ies"))
+        return `${word.slice(0, -3)}y`;
+    if (word.length > 4 && /(ses|xes|zes|ches|shes)$/.test(word))
+        return word.slice(0, -2);
+    if (word.length > 3 && word.endsWith("s") && !/(ss|us|is)$/.test(word))
+        return word.slice(0, -1);
+    return word;
+}
+function nouns(name) {
+    return tokens(name)
+        .filter((t) => !VERBS.has(t) && !STOP_WORDS.has(t))
+        .map(singular);
+}
+function isGenericLookup(name) {
+    const parts = tokens(name);
+    const first = parts[0];
+    if (first === undefined || !LOOKUP_VERBS.has(first))
+        return false;
+    const rest = nouns(name);
+    return rest.length === 0 || rest.every((n) => GENERIC_NOUNS.has(n));
+}
+function normalizedFieldName(name) {
+    return name.replace(/[^A-Za-z0-9]/g, "").toLowerCase();
+}
+function isIdField(field) {
+    return (field.toLowerCase() === "id" ||
+        /[_-]id$/i.test(field) ||
+        /[a-z0-9]Id$/.test(field) ||
+        /(^|[_-])uuid$/i.test(field) ||
+        /[a-z0-9]Uuid$/.test(field));
+}
+function propertyNames(tool) {
+    const properties = tool.inputSchema?.properties;
+    return properties !== null && typeof properties === "object" ? Object.keys(properties) : [];
+}
+function requiresId(tool) {
+    const required = tool.inputSchema?.required;
+    return Array.isArray(required) && required.some((f) => typeof f === "string" && isIdField(f));
+}
+function hasAnnotations(tool) {
+    const a = tool.annotations;
+    if (a === undefined || a === null || typeof a !== "object")
+        return false;
+    return a.readOnlyHint !== undefined || a.destructiveHint !== undefined || a.idempotentHint !== undefined;
+}
+// Ein Tool-Name kommt vom Upstream: Steuerzeichen dürfen in Texten keine Zeilen vortäuschen.
+export function shown(name) {
+    return name.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, "?");
+}
+function plural(count, one, many) {
+    return count === 1 ? one : many;
+}
+function summarize(total, writes, reads, ambiguous, withoutKey, withoutLookup, high) {
+    if (total === 0)
+        return "Der Server meldet keine Tools; es gab nichts zu beurteilen.";
+    const parts = [
+        `Der Server bietet ${total} ${plural(total, "Tool", "Tools")}: ${writes} schreibend, ${reads} lesend` +
+            (ambiguous > 0 ? `, ${ambiguous} nicht eindeutig einzuordnen` : "") +
+            ".",
+    ];
+    if (writes + ambiguous === 0) {
+        parts.push("Es wurde kein Schreib-Tool erkannt; damit gibt es keine Doppelausführung zu verhindern und kein Szenario, das auslösen könnte.");
+        return parts.join(" ");
+    }
+    parts.push(withoutKey.length === 0
+        ? "Alle Schreib-Tools haben ein Feld für einen Idempotenz-Schlüssel."
+        : `${withoutKey.length} ${plural(withoutKey.length, "Schreib-Tool hat", "Schreib-Tools haben")} keinen Idempotenz-Schlüssel (${withoutKey.map(shown).join(", ")}): Das Zielsystem kann einen wiederholten Aufruf nicht als Duplikat erkennen.`);
+    parts.push(withoutLookup.length === 0
+        ? "Für alle Schreib-Tools gibt es ein Lese- oder Such-Tool ohne Pflicht-ID, mit dem ein Agent nach einem Timeout nachsehen kann."
+        : `Für ${withoutLookup.length} ${plural(withoutLookup.length, "Schreib-Tool gibt", "Schreib-Tools gibt")} es kein Lese- oder Such-Tool ohne Pflicht-ID (${withoutLookup.map(shown).join(", ")}): Ein Agent kann nach einem Timeout nicht selbstständig prüfen, ob der Vorgang schon ausgeführt wurde.`);
+    parts.push(high === 0
+        ? "Kein Tool hat die Risikostufe HOCH."
+        : `${high} ${plural(high, "Tool hat", "Tools haben")} die Risikostufe HOCH (weder Schlüssel noch Nachsehen ohne ID).`);
+    return parts.join(" ");
+}
+export function auditToolSchemas(tools, options = {}) {
+    const config = {
+        writeToolPatterns: options.writeToolPatterns ?? [],
+        readToolPatterns: options.readToolPatterns ?? [],
+    };
+    const classOf = (tool) => {
+        const c = classifyUpstreamTool(tool, config).class;
+        return c === "unclassified" ? "ambiguous" : c;
+    };
+    const classified = tools.map((tool) => ({ tool, classification: classOf(tool) }));
+    const readTools = classified.filter((c) => c.classification === "read").map((c) => c.tool);
+    const entries = classified.map(({ tool, classification }) => {
+        const isWrite = classification !== "read";
+        const keyField = propertyNames(tool).find((p) => IDEMPOTENCY_FIELDS.has(normalizedFieldName(p))) ?? null;
+        const hasKey = keyField !== null;
+        const annotated = hasAnnotations(tool);
+        let matching = [];
+        if (isWrite) {
+            const own = new Set(nouns(tool.name));
+            matching = readTools
+                .filter((r) => r.name !== tool.name && (nouns(r.name).some((n) => own.has(n)) || isGenericLookup(r.name)))
+                .map((r) => r.name);
+        }
+        const canVerify = isWrite && readTools.some((r) => matching.includes(r.name) && !requiresId(r));
+        let risk = "LOW";
+        if (isWrite) {
+            if (!hasKey && !canVerify)
+                risk = "HIGH";
+            else if (!hasKey || !canVerify)
+                risk = "MEDIUM";
+        }
+        const findings = [];
+        if (isWrite) {
+            if (classification === "ambiguous") {
+                findings.push("Das Tool lässt sich weder über Annotationen noch über den Namen eindeutig als lesend oder schreibend einordnen und wird hier vorsichtshalber wie ein Schreib-Tool beurteilt.");
+            }
+            if (!hasKey) {
+                findings.push("Kein Idempotenz-Schlüssel (z. B. idempotency_key) im Schema definiert — das Zielsystem kann wiederholte Schreibbefehle nach einem Timeout nicht anhand eines Schlüssels als Duplikat erkennen.");
+            }
+            else if (keyField !== "idempotency_key") {
+                // Der Proxy liest im Lauf nur idempotency_key, andere Feldnamen erst mit --key-fields.
+                findings.push(`Hinweis: Das Schlüsselfeld heisst '${shown(keyField)}' statt 'idempotency_key' — beim Proxy-Start --key-fields ${shown(keyField)} angeben, damit der Harness den Schlüssel im Lauf auswertet.`);
+            }
+            if (!canVerify) {
+                findings.push(matching.length === 0
+                    ? "Kein passendes Lese- oder Such-Tool ohne Pflicht-ID gefunden — der Agent kann nach einem abgebrochenen Schreibbefehl nicht selbstständig prüfen, ob der Vorgang bereits ausgeführt wurde."
+                    : `Die passenden Lese-Tools (${matching.map(shown).join(", ")}) verlangen alle eine ID als Pflichtfeld — nach einem Timeout kennt der Agent die vom Server vergebene ID noch nicht und kann den Vorgang nicht selbstständig nachschlagen.`);
+            }
+            if (!annotated) {
+                findings.push("Keine MCP-Tool-Annotationen (readOnlyHint / destructiveHint / idempotentHint) hinterlegt.");
+            }
+        }
+        return {
+            name: tool.name,
+            classification,
+            hasIdempotencyKey: hasKey,
+            idempotencyFieldName: keyField,
+            hasMcpAnnotations: annotated,
+            matchingReadTools: matching,
+            canVerifyWithoutId: canVerify,
+            riskLevel: risk,
+            findingsDe: findings,
+            recommendedSchemaPatch: isWrite && !hasKey ? { ...IDEMPOTENCY_PATCH } : null,
+        };
+    });
+    const writeLike = entries.filter((e) => e.classification !== "read");
+    const writeToolsWithoutIdempotencyKey = writeLike.filter((e) => !e.hasIdempotencyKey).map((e) => e.name);
+    const writeToolsWithoutLookupTool = writeLike.filter((e) => !e.canVerifyWithoutId).map((e) => e.name);
+    const count = (c) => entries.filter((e) => e.classification === c).length;
+    const highRiskToolsCount = entries.filter((e) => e.riskLevel === "HIGH").length;
+    return {
+        totalTools: entries.length,
+        writeToolsCount: count("write"),
+        readToolsCount: count("read"),
+        ambiguousToolsCount: count("ambiguous"),
+        writeToolsWithoutIdempotencyKey,
+        writeToolsWithoutLookupTool,
+        highRiskToolsCount,
+        tools: entries,
+        summaryDe: summarize(entries.length, count("write"), count("read"), count("ambiguous"), writeToolsWithoutIdempotencyKey, writeToolsWithoutLookupTool, highRiskToolsCount),
+    };
+}

package/dist/server/stdio.js

@@ -1,5 +1,10 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-export async function startStdio(server) {
-    const transport = new StdioServerTransport();
+import { GuardedStdioServerTransport } from "../proxy/guarded-stdio.js";
+// With `guard`, calls that cannot be forwarded unchanged (see
+// proxy/guarded-stdio.ts) are refused; `guard` receives a log line for each.
+export async function startStdio(server, guard) {
+    const transport = guard
+        ? new GuardedStdioServerTransport(process.stdin, process.stdout, guard.log)
+        : new StdioServerTransport();
     await server.connect(transport);
 }

package/dist/tools/handlers.js

@@ -296,7 +296,10 @@ export async function handleGetReport(args, options = {}) {
 // Resilience Score + Hardening Patches for THIS session's own audit report —
 // unlike `benchmark` mode (which scores a hardcoded scripted call sequence
 // against itself), this scores whatever the connected agent actually did.
-export function handleGetScore(args) {
+// `patches: false` (Proxy ohne gültige Lizenz): Score und Urteil unverändert, die Härtungsvorschläge
+// (Textbausteine) gehören zum Pro-Umfang und werden durch einen Hinweis ersetzt.
+export function handleGetScore(args, options = {}) {
+    const withPatches = options.patches ?? true;
     const session = getSession(args.session_id);
     if (!session) {
         return {
@@ -311,11 +314,13 @@ export function handleGetScore(args) {
     }
     const report = generateReport(session);
     const score = computeScore([report]);
-    const patches = generatePatches([report], score);
+    const patches = withPatches ? generatePatches([report], score) : [];
     const format = args.format ?? "markdown";
+    const lockedNote = "Keine gültige Lizenz: Die Härtungsvorschläge (Textbausteine) gehören zum Pro-Umfang. " +
+        "Score und Urteil sind vollständig. Lizenz: https://cuonztech.ch/agent-harness.html#audit";
     const output = format === "json"
-        ? JSON.stringify({ score, patches }, null, 2)
-        : [formatScoreReport(score), patches.length > 0 ? formatPatchReport(patches) : null]
+        ? JSON.stringify({ score, patches, ...(withPatches ? {} : { limitedByLicense: true, licenseNotice: lockedNote }) }, null, 2)
+        : [formatScoreReport(score), withPatches ? (patches.length > 0 ? formatPatchReport(patches) : null) : lockedNote]
             .filter(Boolean)
             .join("\n\n");
     return {

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/dist/ui/discover.js

@@ -0,0 +1,71 @@
+// Read-only discovery of MCP servers the user has already configured on this
+// machine, so step 3 of the UI does not make them hunt for file paths.
+// Privacy: only name, command and args are ever taken from a config file.
+// "env", "headers" and every other field are never read or returned.
+import { readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+const MAX_CONFIG_BYTES = 1024 * 1024;
+const MAX_SERVERS = 50;
+const SELF_NAMES = new Set(["agent-harness", "cuonztech-agent-harness"]);
+function desktopConfigPath() {
+    if (process.platform === "win32") {
+        return join(process.env.APPDATA ?? join(homedir(), "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+    }
+    if (process.platform === "darwin") {
+        return join(homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    }
+    return join(homedir(), ".config", "Claude", "claude_desktop_config.json");
+}
+function candidateFiles() {
+    const files = [
+        { source: "Claude Desktop", path: desktopConfigPath() },
+        { source: "Cursor", path: join(homedir(), ".cursor", "mcp.json") },
+        { source: "Cursor (Projekt)", path: resolve(".cursor", "mcp.json") },
+        { source: "Claude Code (Projekt)", path: resolve(".mcp.json") },
+    ];
+    const custom = process.env.CUONZTECH_MCP_CONFIG_PATH;
+    if (custom && custom.trim() !== "")
+        files.push({ source: "Eigene Konfiguration", path: custom.trim() });
+    return files;
+}
+function pointsAtHarness(name, command, args) {
+    if (SELF_NAMES.has(name.toLowerCase()))
+        return true;
+    return [command, ...args].some((part) => part.toLowerCase().includes("cuonztech-agent-harness"));
+}
+export function discoverMcpServers() {
+    const found = [];
+    const seen = new Set();
+    for (const { source, path } of candidateFiles()) {
+        try {
+            if (statSync(path).size > MAX_CONFIG_BYTES)
+                continue;
+            const parsed = JSON.parse(readFileSync(path, "utf-8"));
+            const servers = parsed?.mcpServers;
+            if (!servers || typeof servers !== "object" || Array.isArray(servers))
+                continue;
+            for (const [name, entry] of Object.entries(servers)) {
+                if (!entry || typeof entry !== "object")
+                    continue;
+                const { command, args } = entry;
+                if (typeof command !== "string" || command.trim() === "")
+                    continue;
+                const argList = Array.isArray(args) ? args.filter((a) => typeof a === "string") : [];
+                if (pointsAtHarness(name, command, argList))
+                    continue;
+                const key = JSON.stringify([name, command, argList]);
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                found.push({ name, source, command, args: argList });
+                if (found.length >= MAX_SERVERS)
+                    return found;
+            }
+        }
+        catch {
+            // Missing or unreadable file: not an error for discovery.
+        }
+    }
+    return found;
+}