fullcourtdefense-cli 1.1.17 → 1.3.0

package/README.md

@@ -53,8 +53,41 @@ fullcourtdefense init
 - `fullcourtdefense install-claude-code-mcp-gateway ...` — registers the protected MCP gateway in Claude Code.
 - `fullcourtdefense install-claude-desktop-mcp-gateway ...` — registers the protected MCP gateway in Claude Desktop.
 - `fullcourtdefense credits` — checks hosted scan credits for CI/CD API-key scans.
+- `fullcourtdefense discover` — scans local MCP client configs and reports risk; `--upload` sends desktop inventory to AI Inventory.
 - `fullcourtdefense init` — creates a starter config file.
 
+## Shadow AI / Desktop Discovery
+
+Find MCP servers configured on developer machines without reading chat history or spawning stdio servers by default:
+
+```bash
+# Scan this machine and print results
+fullcourtdefense discover
+
+# JSON output (includes host fingerprint + servers)
+fullcourtdefense discover --json
+
+# Upload to AI Inventory (requires CI/CD API key with audit:write)
+fullcourtdefense discover --upload --api-key YOUR_KEY
+
+# Live-probe HTTP/SSE MCP servers for tools/list (stdio stays config-only)
+fullcourtdefense discover --deep
+
+# Fleet / MDM script — silent upload with user attribution
+fullcourtdefense discover --upload --silent --user-email you@company.com --api-key YOUR_KEY
+
+# Daily automatic scan on this laptop (uses API key from env or ~/.fullcourtdefense.yml)
+fullcourtdefense discover --schedule daily --user-email you@company.com
+
+# Remove daily schedule
+fullcourtdefense discover --unschedule true
+
+# Scan an extra config path
+fullcourtdefense discover --path /path/to/mcp.json
+```
+
+Each upload includes host metadata (`machineId`, `hostname`, `platform`, `user`) so the same MCP server on different laptops appears as separate desktop inventory rows. The CLI is also available as `fcd` or `botguard` after global install.
+
 ## Config File
 
 Create a `.fullcourtdefense.yml` to avoid passing flags every time:

package/dist/commands/discover.d.ts

@@ -7,5 +7,27 @@ export interface DiscoverArgs {
     upload?: string;
     connectorName?: string;
     extraPath?: string;
+    deep?: string;
+    silent?: string;
+    userEmail?: string;
+    schedule?: string;
+    unschedule?: string;
+    scheduleHour?: string;
+}
+export interface DesktopDiscoveryHost {
+    machineId: string;
+    hostname: string;
+    platform: string;
+    user: string;
+    scannedAt: string;
+    probeMode: 'config' | 'deep';
 }
 export declare function discoverCommand(args: DiscoverArgs, config: BotGuardConfig): Promise<void>;
+/** Upload-only discover — used after install-mcp-gateway --upload. */
+export declare function runDiscoverUpload(args: {
+    apiKey?: string;
+    apiUrl?: string;
+    userEmail?: string;
+    silent?: boolean;
+    connectorName?: string;
+}, config: BotGuardConfig): Promise<void>;

package/dist/commands/discover.js

@@ -34,56 +34,35 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.discoverCommand = discoverCommand;
+exports.runDiscoverUpload = runDiscoverUpload;
+const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
-const path = __importStar(require("path"));
+const discoverProxy_1 = require("./discoverProxy");
+const discoverSchedule_1 = require("./discoverSchedule");
+const discoverPaths_1 = require("./discoverPaths");
+const knownMcpServers_1 = require("./knownMcpServers");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 const SECRET_VALUE = /sk-[A-Za-z0-9_-]{12,}|ghp_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{20,}/;
 const SECRET_KEY = /key|token|secret|password|credential|api[_-]?key/i;
-/** Where MCP client configs live, by client + OS. */
+function machineFingerprint() {
+    const seed = [os.hostname(), os.userInfo().username, os.platform(), os.arch()].join('|');
+    return crypto.createHash('sha256').update(seed).digest('hex').slice(0, 16);
+}
+function buildHostMetadata(userEmail, probeMode = 'config') {
+    const info = os.userInfo();
+    return {
+        machineId: machineFingerprint(),
+        hostname: os.hostname(),
+        platform: os.platform(),
+        user: userEmail || info.username,
+        scannedAt: new Date().toISOString(),
+        probeMode,
+    };
+}
+/** Where MCP client configs live — see discoverPaths.ts for the canonical list. */
 function candidateConfigPaths(cwd, extra) {
-    const home = os.homedir();
-    const appData = process.env.APPDATA || path.join(home, 'AppData', 'Roaming');
-    const localAppData = process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
-    const xdg = process.env.XDG_CONFIG_HOME || path.join(home, '.config');
-    const list = [
-        // Cursor
-        { path: path.join(home, '.cursor', 'mcp.json'), source: 'Cursor (global)' },
-        { path: path.join(cwd, '.cursor', 'mcp.json'), source: 'Cursor (project)' },
-        // Claude Desktop
-        { path: path.join(appData, 'Claude', 'claude_desktop_config.json'), source: 'Claude Desktop (win)' },
-        { path: path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json'), source: 'Claude Desktop (mac)' },
-        { path: path.join(xdg, 'Claude', 'claude_desktop_config.json'), source: 'Claude Desktop (linux)' },
-        // VS Code (project + user settings)
-        { path: path.join(cwd, '.vscode', 'mcp.json'), source: 'VS Code (project)' },
-        { path: path.join(appData, 'Code', 'User', 'settings.json'), source: 'VS Code (user, win)' },
-        { path: path.join(home, 'Library', 'Application Support', 'Code', 'User', 'settings.json'), source: 'VS Code (user, mac)' },
-        { path: path.join(xdg, 'Code', 'User', 'settings.json'), source: 'VS Code (user, linux)' },
-        // Windsurf
-        { path: path.join(home, '.codeium', 'windsurf', 'mcp_config.json'), source: 'Windsurf' },
-        // Generic / repo-root
-        { path: path.join(cwd, '.mcp.json'), source: 'Repo (.mcp.json)' },
-        { path: path.join(cwd, 'mcp.json'), source: 'Repo (mcp.json)' },
-    ];
-    if (process.platform === 'win32') {
-        const packagesDir = path.join(localAppData, 'Packages');
-        try {
-            for (const packageName of fs.readdirSync(packagesDir)) {
-                if (!/^Claude_/i.test(packageName))
-                    continue;
-                list.push({
-                    path: path.join(packagesDir, packageName, 'LocalCache', 'Roaming', 'Claude', 'claude_desktop_config.json'),
-                    source: 'Claude Desktop (win MSIX)',
-                });
-            }
-        }
-        catch {
-            // Missing Packages directory is normal on non-Store installs.
-        }
-    }
-    if (extra)
-        list.push({ path: path.resolve(extra), source: 'Custom path' });
-    return list;
+    return (0, discoverPaths_1.discoverScanTargets)(cwd, extra);
 }
 /** MCP servers can be declared under several keys across clients. */
 function extractServerMap(parsed) {
@@ -137,7 +116,7 @@ function parseConfigFile(filePath, source) {
         parsed = JSON.parse(raw);
     }
     catch {
-        return []; // settings.json with comments/JSONC — best-effort skip
+        return [];
     }
     const servers = extractServerMap(parsed);
     const out = [];
@@ -152,7 +131,15 @@ function parseConfigFile(filePath, source) {
             ? (/\/sse(\b|$)/.test(url) ? 'sse' : 'http')
             : command ? 'stdio' : 'unknown';
         const tools = Array.isArray(cfg.tools)
-            ? cfg.tools.map((t) => (typeof t === 'string' ? t : t?.name)).filter(Boolean).map(String)
+            ? cfg.tools
+                .map((t) => {
+                if (typeof t === 'string')
+                    return { name: t };
+                if (t && typeof t.name === 'string')
+                    return { name: t.name, description: typeof t.description === 'string' ? t.description : undefined };
+                return null;
+            })
+                .filter(Boolean)
             : [];
         const { level, tags } = scoreRisk({ serverName: name, command, args, url });
         const warnings = [];
@@ -178,10 +165,97 @@ function parseConfigFile(filePath, source) {
             riskLevel: level,
             riskTags: tags,
             warnings,
+            probeMode: 'config',
+            proxyStatus: 'unknown',
         });
     }
     return out;
 }
+async function mcpJsonRpc(endpoint, method, params, timeoutMs, sessionId) {
+    const headers = {
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+    };
+    if (sessionId)
+        headers['Mcp-Session-Id'] = sessionId;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const resp = await fetch(endpoint, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ jsonrpc: '2.0', id: Date.now(), method, params }),
+            signal: controller.signal,
+        });
+        const nextSession = resp.headers.get('mcp-session-id') || sessionId;
+        const ct = resp.headers.get('content-type') || '';
+        if (ct.includes('text/event-stream')) {
+            const text = await resp.text();
+            const dataLine = text.split('\n').find(line => line.startsWith('data: '));
+            return { json: dataLine ? JSON.parse(dataLine.slice(6)) : null, sessionId: nextSession || undefined };
+        }
+        return { json: await resp.json(), sessionId: nextSession || undefined };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Best-effort live tools/list for HTTP/SSE MCP servers (stdio skipped — would spawn processes). */
+async function probeHttpMcpTools(url, timeoutMs = 8000) {
+    const normalized = url.replace(/\/$/, '');
+    const candidates = [...new Set([
+            normalized,
+            normalized.replace(/\/sse(\?.*)?$/i, ''),
+            `${normalized}/mcp`,
+            normalized.replace(/\/sse(\?.*)?$/i, '/mcp'),
+        ])];
+    for (const endpoint of candidates) {
+        try {
+            const init = await mcpJsonRpc(endpoint, 'initialize', {
+                protocolVersion: '2024-11-05',
+                capabilities: {},
+                clientInfo: { name: 'fullcourtdefense-discover', version: '1.0.0' },
+            }, timeoutMs);
+            const sid = init.sessionId;
+            if (init.json?.error)
+                continue;
+            await mcpJsonRpc(endpoint, 'notifications/initialized', {}, timeoutMs, sid);
+            const listed = await mcpJsonRpc(endpoint, 'tools/list', {}, timeoutMs, sid);
+            const tools = listed.json?.result?.tools;
+            if (Array.isArray(tools) && tools.length > 0) {
+                return tools
+                    .map((t) => (t && typeof t.name === 'string' ? { name: t.name, description: typeof t.description === 'string' ? t.description : undefined } : null))
+                    .filter(Boolean);
+            }
+        }
+        catch {
+            // try next endpoint variant
+        }
+    }
+    return [];
+}
+async function enrichWithDeepProbe(servers, silent) {
+    for (const server of servers) {
+        if (server.transport !== 'http' && server.transport !== 'sse') {
+            if (!silent && server.transport === 'stdio') {
+                server.warnings.push('Deep probe skipped for stdio server (config-only inventory).');
+            }
+            continue;
+        }
+        if (!server.url)
+            continue;
+        const liveTools = await probeHttpMcpTools(server.url);
+        if (liveTools.length === 0) {
+            server.warnings.push('Deep probe could not list tools (server may require auth or be offline).');
+            continue;
+        }
+        const byName = new Map(server.tools.map(t => [t.name, t]));
+        for (const tool of liveTools)
+            byName.set(tool.name, tool);
+        server.tools = [...byName.values()];
+        server.probeMode = 'deep';
+    }
+}
 /** Merge servers found in multiple files; keep richest record, union sources. */
 function dedupe(servers) {
     const byName = new Map();
@@ -195,8 +269,13 @@ function dedupe(servers) {
             existing.source += `, ${s.source}`;
         existing.command = existing.command || s.command;
         existing.url = existing.url || s.url;
-        existing.tools = Array.from(new Set([...existing.tools, ...s.tools]));
+        const toolMap = new Map(existing.tools.map(t => [t.name, t]));
+        for (const t of s.tools)
+            toolMap.set(t.name, t);
+        existing.tools = [...toolMap.values()];
         existing.warnings = Array.from(new Set([...existing.warnings, ...s.warnings]));
+        if (s.probeMode === 'deep')
+            existing.probeMode = 'deep';
     }
     return [...byName.values()];
 }
@@ -207,14 +286,59 @@ const COLOR = {
 function riskColor(level) {
     return level === 'critical' || level === 'high' ? COLOR.red : level === 'medium' ? COLOR.yellow : COLOR.green;
 }
-async function upload(servers, apiUrl, apiKey, connectorName) {
+function applyProxyClassification(servers, scanned, cwd) {
+    const wrapsByConfig = (0, discoverProxy_1.buildGatewayWrapIndex)(servers);
+    for (const server of servers) {
+        server.proxyStatus = (0, discoverProxy_1.classifyProxyStatus)(server, wrapsByConfig);
+        if (server.proxyStatus === 'fcd_gateway') {
+            server.wrapsServerName = (0, discoverProxy_1.extractGatewayDownstream)(server)?.label;
+        }
+        if (server.proxyStatus === 'direct' && server.riskLevel !== 'low') {
+            server.warnings.push('Direct MCP — not proxied through Full Court Defense gateway.');
+        }
+        const info = (0, knownMcpServers_1.knownMcpServerInfo)(server.serverName, server.command);
+        if (info) {
+            server.serverKind = info.category;
+            server.serverDescription = info.description;
+        }
+        if (server.proxyStatus === 'direct') {
+            const hint = (0, knownMcpServers_1.directServerFixHint)(server.serverName);
+            if (hint && !server.warnings.includes(hint))
+                server.warnings.push(hint);
+        }
+    }
+    return (0, discoverProxy_1.buildClientCoverage)(scanned, servers, cwd);
+}
+function proxyStatusLabel(status) {
+    if (status === 'fcd_gateway')
+        return 'FCD gateway';
+    if (status === 'proxied')
+        return 'Proxied';
+    if (status === 'direct')
+        return 'Direct — needs gateway';
+    return 'Unknown';
+}
+async function upload(servers, host, clientCoverage, apiUrl, apiKey, connectorName) {
     const payload = {
-        connectorName: connectorName || 'Local MCP discovery (CLI)',
+        connectorName: connectorName || `Desktop MCP · ${host.hostname}`,
+        host,
+        clientCoverage,
         servers: servers.map(s => ({
             serverName: s.serverName,
             command: s.command,
             url: s.url,
-            tools: s.tools.map(name => ({ name })),
+            transport: s.transport,
+            clientSource: s.source,
+            configPath: s.configPath,
+            riskLevel: s.riskLevel,
+            riskTags: s.riskTags,
+            warnings: s.warnings,
+            probeMode: s.probeMode,
+            proxyStatus: s.proxyStatus,
+            wrapsServerName: s.wrapsServerName,
+            serverKind: s.serverKind,
+            serverDescription: s.serverDescription,
+            tools: s.tools,
         })),
     };
     const resp = await fetch(`${apiUrl.replace(/\/$/, '')}/api/cicd/discovery/mcp`, {
@@ -227,12 +351,30 @@ async function upload(servers, apiUrl, apiKey, connectorName) {
         throw new Error(data.error || `Upload failed (${resp.status})`);
     }
     const ingested = data.data?.ingested ?? servers.length;
-    console.log(`${COLOR.green}Uploaded ${ingested} MCP server(s) to your AI Inventory.${COLOR.reset}`);
+    console.log(`${COLOR.green}Uploaded ${ingested} MCP server(s) from ${host.hostname} to your AI Inventory.${COLOR.reset}`);
 }
 async function discoverCommand(args, config) {
     const type = (args.type || 'mcp').toLowerCase();
+    const silent = args.silent === 'true';
+    const deep = args.deep === 'true';
+    if (args.unschedule === 'true') {
+        (0, discoverSchedule_1.uninstallDailyDiscoverSchedule)();
+        if (!silent)
+            console.log('Removed daily desktop discovery schedule.');
+        return;
+    }
+    if (args.schedule === 'daily') {
+        const hour = args.scheduleHour ? Number.parseInt(args.scheduleHour, 10) : 9;
+        (0, discoverSchedule_1.installDailyDiscoverSchedule)({ userEmail: args.userEmail, hour: Number.isFinite(hour) ? hour : 9 });
+        if (!silent) {
+            console.log(`Daily desktop discovery scheduled (runs discover --upload --silent${args.userEmail ? ` --user-email ${args.userEmail}` : ''}).`);
+            console.log('Requires FULLCOURTDEFENSE_API_KEY or apiKey in ~/.fullcourtdefense.yml');
+        }
+        return;
+    }
     if (type !== 'mcp') {
-        console.error(`Unsupported discover type "${type}". Supported: mcp`);
+        if (!silent)
+            console.error(`Unsupported discover type "${type}". Supported: mcp`);
         process.exit(1);
     }
     const cwd = process.cwd();
@@ -240,29 +382,84 @@ async function discoverCommand(args, config) {
     const scanned = [];
     let found = [];
     for (const c of candidates) {
-        if (!fs.existsSync(c.path))
-            continue;
-        scanned.push(`${c.source} → ${c.path}`);
-        found.push(...parseConfigFile(c.path, c.source));
+        scanned.push({ path: c.path, source: c.source });
+        if (fs.existsSync(c.path)) {
+            found.push(...parseConfigFile(c.path, c.source));
+        }
     }
     found = dedupe(found);
+    const clientCoverage = applyProxyClassification(found, scanned, cwd);
+    if (deep && found.length > 0) {
+        if (!silent)
+            console.log(`${COLOR.gray}Running deep probe (HTTP/SSE tools/list)…${COLOR.reset}`);
+        await enrichWithDeepProbe(found, silent);
+    }
+    const host = buildHostMetadata(args.userEmail, deep && found.some(s => s.probeMode === 'deep') ? 'deep' : 'config');
     if (args.json === 'true') {
-        console.log(JSON.stringify({ scannedFiles: scanned, servers: found }, null, 2));
+        console.log(JSON.stringify({
+            host,
+            scannedFiles: scanned.map(s => `${s.source} → ${s.path}`),
+            clientCoverage,
+            servers: found,
+        }, null, 2));
+        return;
+    }
+    if (silent) {
+        if (args.upload === 'true') {
+            const apiKey = args.apiKey || config.apiKey || process.env.FULLCOURTDEFENSE_API_KEY;
+            const apiUrl = args.apiUrl || config.apiUrl || DEFAULT_API_URL;
+            if (!apiKey)
+                process.exit(1);
+            if (scanned.length === 0)
+                return;
+            await upload(found, host, clientCoverage, apiUrl, apiKey, args.connectorName);
+        }
         return;
     }
     console.log(`\n${COLOR.bold}${COLOR.cyan}MCP server discovery${COLOR.reset}`);
+    console.log(`${COLOR.gray}Host ${host.hostname} · ${host.platform} · machine ${host.machineId}${COLOR.reset}`);
     console.log(`${COLOR.gray}Scanned ${candidates.length} known config locations on this machine.${COLOR.reset}\n`);
     if (scanned.length === 0) {
         console.log(`${COLOR.yellow}No MCP config files found.${COLOR.reset}`);
-        console.log(`${COLOR.gray}Looked in Cursor, Claude Desktop, VS Code, Windsurf, and repo-root configs.${COLOR.reset}`);
+        console.log(`${COLOR.gray}Looked in Cursor, Claude Desktop/Code, VS Code, Windsurf, Codex, Gemini CLI, and repo-root configs.${COLOR.reset}`);
         return;
     }
-    console.log(`${COLOR.bold}Config files found:${COLOR.reset}`);
-    for (const s of scanned)
-        console.log(`  ${COLOR.dim}•${COLOR.reset} ${s}`);
+    console.log(`${COLOR.bold}AI clients checked (${scanned.length}):${COLOR.reset}`);
+    for (const s of scanned) {
+        const exists = fs.existsSync(s.path);
+        console.log(`  ${COLOR.dim}•${COLOR.reset} ${s.source} → ${s.path}${exists ? '' : ` ${COLOR.yellow}(not created yet)${COLOR.reset}`}`);
+    }
     console.log('');
+    if (clientCoverage.length > 0) {
+        console.log(`${COLOR.bold}Client coverage:${COLOR.reset}`);
+        for (const row of clientCoverage) {
+            const gateway = row.mcpGatewayInstalled ? `${COLOR.green}gateway ✓${COLOR.reset}` : `${COLOR.red}no gateway${COLOR.reset}`;
+            const hooks = row.clientKey === 'cursor'
+                ? (row.cursorHooksInstalled ? `${COLOR.green}hooks ✓ (${row.cursorHookEvents.join(', ')})${COLOR.reset}` : `${COLOR.yellow}no hooks${COLOR.reset}`)
+                : '';
+            console.log(`  ${COLOR.dim}•${COLOR.reset} ${row.client} — ${row.mcpServerCount} MCP · ${gateway}${hooks ? ` · ${hooks}` : ''}`);
+            if (row.clientKey === 'claude_desktop' && !row.mcpGatewayInstalled && row.mcpServerCount === 0) {
+                console.log(`        ${COLOR.gray}Install: fullcourtdefense install-claude-desktop-mcp-gateway --shield-id ... --mcp-command npm --mcp-args "run mcp"${COLOR.reset}`);
+            }
+        }
+        console.log('');
+    }
     if (found.length === 0) {
-        console.log(`${COLOR.yellow}Config files exist but declare no MCP servers.${COLOR.reset}`);
+        console.log(`${COLOR.yellow}No MCP servers configured in these clients yet.${COLOR.reset}`);
+        console.log(`${COLOR.gray}Install gateway everywhere: fullcourtdefense install-mcp-gateway --clients all --shield-id ... --shield-key ... --mcp-command npm --mcp-args "run mcp"${COLOR.reset}`);
+        if (args.upload === 'true') {
+            const apiKey = args.apiKey || config.apiKey || process.env.FULLCOURTDEFENSE_API_KEY;
+            const apiUrl = args.apiUrl || config.apiUrl || DEFAULT_API_URL;
+            if (!apiKey) {
+                console.error(`\n${COLOR.red}--upload requires an API key.${COLOR.reset}`);
+                process.exit(1);
+            }
+            console.log('');
+            await upload(found, host, clientCoverage, apiUrl, apiKey, args.connectorName);
+        }
+        else {
+            console.log(`${COLOR.gray}Run with --upload to push client coverage into AI Inventory.${COLOR.reset}`);
+        }
         return;
     }
     const order = { critical: 0, high: 1, medium: 2, low: 3 };
@@ -271,12 +468,17 @@ async function discoverCommand(args, config) {
     for (const s of found) {
         const col = riskColor(s.riskLevel);
         const target = s.command ? `${s.command} ${(s.args || []).join(' ')}`.trim() : (s.url || 'unknown');
-        console.log(`  ${col}${COLOR.bold}[${s.riskLevel.toUpperCase()}]${COLOR.reset} ${COLOR.bold}${s.serverName}${COLOR.reset} ${COLOR.gray}(${s.transport})${COLOR.reset}`);
+        const proxyCol = s.proxyStatus === 'direct' ? COLOR.red : s.proxyStatus === 'proxied' || s.proxyStatus === 'fcd_gateway' ? COLOR.green : COLOR.yellow;
+        console.log(`  ${col}${COLOR.bold}[${s.riskLevel.toUpperCase()}]${COLOR.reset} ${COLOR.bold}${s.serverName}${COLOR.reset} ${COLOR.gray}(${s.transport}${s.probeMode === 'deep' ? ', deep' : ''})${COLOR.reset} ${proxyCol}${proxyStatusLabel(s.proxyStatus)}${COLOR.reset}`);
+        if (s.serverDescription)
+            console.log(`        ${COLOR.gray}about:${COLOR.reset} ${s.serverDescription}`);
         console.log(`        ${COLOR.gray}target:${COLOR.reset} ${target}`);
         if (s.riskTags.length)
             console.log(`        ${COLOR.gray}tags:${COLOR.reset} ${s.riskTags.join(', ')}`);
-        if (s.tools.length)
-            console.log(`        ${COLOR.gray}tools:${COLOR.reset} ${s.tools.slice(0, 12).join(', ')}${s.tools.length > 12 ? ' …' : ''}`);
+        if (s.tools.length) {
+            const names = s.tools.map(t => t.name);
+            console.log(`        ${COLOR.gray}tools:${COLOR.reset} ${names.slice(0, 12).join(', ')}${names.length > 12 ? ' …' : ''}`);
+        }
         console.log(`        ${COLOR.gray}from:${COLOR.reset} ${s.source}`);
         for (const w of s.warnings)
             console.log(`        ${COLOR.red}⚠ ${w}${COLOR.reset}`);
@@ -292,9 +494,24 @@ async function discoverCommand(args, config) {
             process.exit(1);
         }
         console.log('');
-        await upload(found, apiUrl, apiKey, args.connectorName);
+        await upload(found, host, clientCoverage, apiUrl, apiKey, args.connectorName);
     }
     else {
         console.log(`${COLOR.gray}Run with --upload to push these into your AI Inventory.${COLOR.reset}`);
+        if (!deep)
+            console.log(`${COLOR.gray}Add --deep to live-probe HTTP/SSE servers for tools/list.${COLOR.reset}`);
+        console.log(`${COLOR.gray}Add --schedule daily for automatic daily upload (MDM/fleet).${COLOR.reset}`);
     }
 }
+/** Upload-only discover — used after install-mcp-gateway --upload. */
+async function runDiscoverUpload(args, config) {
+    await discoverCommand({
+        type: 'mcp',
+        upload: 'true',
+        silent: args.silent ? 'true' : undefined,
+        apiKey: args.apiKey,
+        apiUrl: args.apiUrl,
+        userEmail: args.userEmail,
+        connectorName: args.connectorName,
+    }, config);
+}

package/dist/commands/discoverPaths.d.ts

@@ -0,0 +1,18 @@
+export interface ConfigPathCandidate {
+    path: string;
+    source: string;
+    clientKey: string;
+}
+export interface ClaudeDesktopConfigCandidate {
+    file: string;
+    source: string;
+    exists: boolean;
+}
+export declare function claudeDesktopMsixCandidates(): ClaudeDesktopConfigCandidate[];
+export declare function claudeDesktopConfigCandidates(): ClaudeDesktopConfigCandidate[];
+export declare function claudeDesktopLikelyInstalled(): boolean;
+export declare function claudeDesktopInstallTargets(configPath?: string): ClaudeDesktopConfigCandidate[];
+/** All MCP client config locations discover / install should check. */
+export declare function candidateConfigPaths(cwd: string, extra?: string): ConfigPathCandidate[];
+/** Include config paths for apps that exist on disk even when the MCP file is not created yet. */
+export declare function discoverScanTargets(cwd: string, extra?: string): ConfigPathCandidate[];