fullcourtdefense-cli 1.3.0 → 1.3.2

package/dist/commands/discover.js

@@ -38,11 +38,29 @@ exports.runDiscoverUpload = runDiscoverUpload;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
+const config_1 = require("../config");
 const discoverProxy_1 = require("./discoverProxy");
 const discoverSchedule_1 = require("./discoverSchedule");
 const discoverPaths_1 = require("./discoverPaths");
 const knownMcpServers_1 = require("./knownMcpServers");
+const discoverAgentFiles_1 = require("./discoverAgentFiles");
+const discoverBlastRadius_1 = require("./discoverBlastRadius");
+const discoverSecrets_1 = require("./discoverSecrets");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
+function parseSurfaces(args) {
+    const raw = (args.surface || args.type || 'mcp').toLowerCase().trim();
+    if (raw === 'all' || raw === 'full') {
+        return new Set(['mcp', 'secrets', 'agent-files', 'posture']);
+    }
+    const allowed = ['mcp', 'secrets', 'agent-files', 'posture'];
+    const picked = raw.split(',').map(part => part.trim()).filter(Boolean);
+    const surfaces = new Set();
+    for (const part of picked) {
+        if (allowed.includes(part))
+            surfaces.add(part);
+    }
+    return surfaces.size > 0 ? surfaces : new Set(['mcp']);
+}
 const SECRET_VALUE = /sk-[A-Za-z0-9_-]{12,}|ghp_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{20,}/;
 const SECRET_KEY = /key|token|secret|password|credential|api[_-]?key/i;
 function machineFingerprint() {
@@ -103,6 +121,55 @@ function scoreRisk(s) {
     }
     return { level, tags };
 }
+function pushDiscoveredServer(out, name, cfgRaw, source, configPath) {
+    const cfg = (cfgRaw || {});
+    const command = typeof cfg.command === 'string' ? cfg.command : undefined;
+    const args = Array.isArray(cfg.args) ? cfg.args.map(String) : undefined;
+    const url = typeof cfg.url === 'string' ? cfg.url : (typeof cfg.serverUrl === 'string' ? cfg.serverUrl : undefined);
+    const env = (cfg.env && typeof cfg.env === 'object') ? cfg.env : {};
+    const envKeys = Object.keys(env);
+    const transport = url
+        ? (/\/sse(\b|$)/.test(url) ? 'sse' : 'http')
+        : command ? 'stdio' : 'unknown';
+    const tools = Array.isArray(cfg.tools)
+        ? cfg.tools
+            .map((t) => {
+            if (typeof t === 'string')
+                return { name: t };
+            if (t && typeof t.name === 'string')
+                return { name: t.name, description: typeof t.description === 'string' ? t.description : undefined };
+            return null;
+        })
+            .filter(Boolean)
+        : [];
+    const { level, tags } = scoreRisk({ serverName: name, command, args, url });
+    const warnings = [];
+    const blob = `${command || ''} ${(args || []).join(' ')} ${JSON.stringify(env)}`;
+    if (SECRET_VALUE.test(blob))
+        warnings.push('Hardcoded secret/API token detected in config (rotate + use env var).');
+    for (const [k, v] of Object.entries(env)) {
+        const val = String(v ?? '');
+        if (SECRET_KEY.test(k) && val && !/^\$\{?[A-Za-z0-9_]+\}?$/.test(val)) {
+            warnings.push(`Env "${k}" appears to contain a literal secret value.`);
+        }
+    }
+    out.push({
+        serverName: name,
+        command,
+        args,
+        url,
+        transport,
+        envKeys,
+        tools,
+        source,
+        configPath,
+        riskLevel: level,
+        riskTags: tags,
+        warnings,
+        probeMode: 'config',
+        proxyStatus: 'unknown',
+    });
+}
 function parseConfigFile(filePath, source) {
     let raw;
     try {
@@ -118,56 +185,21 @@ function parseConfigFile(filePath, source) {
     catch {
         return [];
     }
-    const servers = extractServerMap(parsed);
     const out = [];
-    for (const [name, cfgRaw] of Object.entries(servers)) {
-        const cfg = (cfgRaw || {});
-        const command = typeof cfg.command === 'string' ? cfg.command : undefined;
-        const args = Array.isArray(cfg.args) ? cfg.args.map(String) : undefined;
-        const url = typeof cfg.url === 'string' ? cfg.url : (typeof cfg.serverUrl === 'string' ? cfg.serverUrl : undefined);
-        const env = (cfg.env && typeof cfg.env === 'object') ? cfg.env : {};
-        const envKeys = Object.keys(env);
-        const transport = url
-            ? (/\/sse(\b|$)/.test(url) ? 'sse' : 'http')
-            : command ? 'stdio' : 'unknown';
-        const tools = Array.isArray(cfg.tools)
-            ? cfg.tools
-                .map((t) => {
-                if (typeof t === 'string')
-                    return { name: t };
-                if (t && typeof t.name === 'string')
-                    return { name: t.name, description: typeof t.description === 'string' ? t.description : undefined };
-                return null;
-            })
-                .filter(Boolean)
-            : [];
-        const { level, tags } = scoreRisk({ serverName: name, command, args, url });
-        const warnings = [];
-        const blob = `${command || ''} ${(args || []).join(' ')} ${JSON.stringify(env)}`;
-        if (SECRET_VALUE.test(blob))
-            warnings.push('Hardcoded secret/API token detected in config (rotate + use env var).');
-        for (const [k, v] of Object.entries(env)) {
-            const val = String(v ?? '');
-            if (SECRET_KEY.test(k) && val && !/^\$\{?[A-Za-z0-9_]+\}?$/.test(val)) {
-                warnings.push(`Env "${k}" appears to contain a literal secret value.`);
+    for (const [name, cfgRaw] of Object.entries(extractServerMap(parsed))) {
+        pushDiscoveredServer(out, name, cfgRaw, source, filePath);
+    }
+    // Claude Code stores MCP per-project inside ~/.claude.json
+    if (/claude code/i.test(source) && parsed?.projects && typeof parsed.projects === 'object') {
+        for (const [projectPath, projectCfg] of Object.entries(parsed.projects)) {
+            const projectServers = projectCfg?.mcpServers;
+            if (!projectServers || typeof projectServers !== 'object')
+                continue;
+            const projectLabel = projectPath.split(/[/\\]/).filter(Boolean).slice(-1)[0] || projectPath;
+            for (const [name, cfgRaw] of Object.entries(projectServers)) {
+                pushDiscoveredServer(out, name, cfgRaw, `${source} · ${projectLabel}`, filePath);
             }
         }
-        out.push({
-            serverName: name,
-            command,
-            args,
-            url,
-            transport,
-            envKeys,
-            tools,
-            source,
-            configPath: filePath,
-            riskLevel: level,
-            riskTags: tags,
-            warnings,
-            probeMode: 'config',
-            proxyStatus: 'unknown',
-        });
     }
     return out;
 }
@@ -256,13 +288,14 @@ async function enrichWithDeepProbe(servers, silent) {
         server.probeMode = 'deep';
     }
 }
-/** Merge servers found in multiple files; keep richest record, union sources. */
+/** Dedupe within the same config file + server name only (keep separate entries per client config path). */
 function dedupe(servers) {
-    const byName = new Map();
+    const byKey = new Map();
     for (const s of servers) {
-        const existing = byName.get(s.serverName);
+        const key = `${s.configPath.toLowerCase()}::${s.serverName.toLowerCase()}`;
+        const existing = byKey.get(key);
         if (!existing) {
-            byName.set(s.serverName, { ...s, source: s.source });
+            byKey.set(key, { ...s });
             continue;
         }
         if (!existing.source.includes(s.source))
@@ -277,7 +310,7 @@ function dedupe(servers) {
         if (s.probeMode === 'deep')
             existing.probeMode = 'deep';
     }
-    return [...byName.values()];
+    return [...byKey.values()];
 }
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
@@ -318,11 +351,50 @@ function proxyStatusLabel(status) {
         return 'Direct — needs gateway';
     return 'Unknown';
 }
-async function upload(servers, host, clientCoverage, apiUrl, apiKey, connectorName) {
+function sanitizeSecretForUpload(finding) {
+    return {
+        id: finding.id,
+        category: finding.category,
+        severity: finding.severity,
+        provider: finding.provider,
+        filePath: finding.filePath,
+        lineNumber: finding.lineNumber,
+        title: finding.title,
+        detail: finding.detail,
+        redactedPreview: finding.redactedPreview,
+        remediation: finding.remediation,
+    };
+}
+function sanitizeAgentFileForUpload(finding) {
+    return {
+        id: finding.id,
+        kind: finding.kind,
+        client: finding.client,
+        filePath: finding.filePath,
+        title: finding.title,
+        sizeBytes: finding.sizeBytes,
+        lineCount: finding.lineCount,
+        riskTags: finding.riskTags,
+        excerpt: finding.excerpt,
+    };
+}
+async function upload(servers, host, clientCoverage, apiUrl, apiKey, connectorName, extras) {
     const payload = {
         connectorName: connectorName || `Desktop MCP · ${host.hostname}`,
         host,
         clientCoverage,
+        posture: extras?.posture ? {
+            score: extras.posture.score,
+            grade: extras.posture.grade,
+            drivers: extras.posture.drivers,
+            combos: extras.posture.combos,
+            secretsHealthScore: extras.secrets?.healthScore,
+            secretsCritical: extras.secrets?.findings.filter(f => f.severity === 'critical').length ?? 0,
+            secretsHigh: extras.secrets?.findings.filter(f => f.severity === 'high').length ?? 0,
+            agentFilesCount: extras.agentFiles?.length ?? 0,
+        } : undefined,
+        secrets: extras?.secrets?.findings.slice(0, 100).map(sanitizeSecretForUpload),
+        agentFiles: extras?.agentFiles?.slice(0, 100).map(sanitizeAgentFileForUpload),
         servers: servers.map(s => ({
             serverName: s.serverName,
             command: s.command,
@@ -351,10 +423,71 @@ async function upload(servers, host, clientCoverage, apiUrl, apiKey, connectorNa
         throw new Error(data.error || `Upload failed (${resp.status})`);
     }
     const ingested = data.data?.ingested ?? servers.length;
-    console.log(`${COLOR.green}Uploaded ${ingested} MCP server(s) from ${host.hostname} to your AI Inventory.${COLOR.reset}`);
+    const postureNote = extras?.posture ? ` · machine score ${extras.posture.score}/100 (${extras.posture.grade})` : '';
+    console.log(`${COLOR.green}Uploaded ${ingested} MCP server(s) from ${host.hostname} to your AI Inventory${postureNote}.${COLOR.reset}`);
+}
+function printSecretsReport(secrets, silent) {
+    if (silent)
+        return;
+    console.log(`\n${COLOR.bold}${COLOR.cyan}Secrets & exposure${COLOR.reset}`);
+    console.log(`${COLOR.gray}Scanned ${secrets.scannedFiles} file(s) and ${secrets.scannedStores} credential store(s). Health ${secrets.healthScore}/100.${COLOR.reset}\n`);
+    if (secrets.findings.length === 0) {
+        console.log(`${COLOR.green}No obvious leaked secrets in scanned locations.${COLOR.reset}`);
+        return;
+    }
+    for (const f of secrets.findings.slice(0, 40)) {
+        const col = f.severity === 'critical' || f.severity === 'high' ? COLOR.red : f.severity === 'medium' ? COLOR.yellow : COLOR.gray;
+        console.log(`  ${col}[${f.severity.toUpperCase()}]${COLOR.reset} ${COLOR.bold}${f.title}${COLOR.reset} ${COLOR.gray}(${f.category})${COLOR.reset}`);
+        console.log(`        ${COLOR.gray}path:${COLOR.reset} ${f.filePath}${f.lineNumber ? `:${f.lineNumber}` : ''}`);
+        if (f.redactedPreview)
+            console.log(`        ${COLOR.gray}preview:${COLOR.reset} ${f.redactedPreview}`);
+        console.log(`        ${COLOR.gray}fix:${COLOR.reset} ${f.remediation}`);
+        console.log('');
+    }
+    if (secrets.findings.length > 40) {
+        console.log(`${COLOR.gray}… and ${secrets.findings.length - 40} more (use --json for full list).${COLOR.reset}`);
+    }
+}
+function printAgentFilesReport(files, silent) {
+    if (silent)
+        return;
+    console.log(`\n${COLOR.bold}${COLOR.cyan}Agent files (rules / skills / instructions)${COLOR.reset}`);
+    console.log(`${COLOR.gray}Found ${files.length} file(s) that shape agent behavior on this machine.${COLOR.reset}\n`);
+    if (files.length === 0) {
+        console.log(`${COLOR.yellow}No Cursor rules, AGENTS.md, CLAUDE.md, or skill files found in home or project.${COLOR.reset}`);
+        return;
+    }
+    for (const f of files.slice(0, 30)) {
+        console.log(`  ${COLOR.bold}${f.title}${COLOR.reset} ${COLOR.gray}(${f.kind}${f.client ? ` · ${f.client}` : ''})${COLOR.reset}`);
+        console.log(`        ${COLOR.gray}path:${COLOR.reset} ${f.filePath} · ${f.lineCount} lines`);
+        if (f.riskTags.length)
+            console.log(`        ${COLOR.red}tags:${COLOR.reset} ${f.riskTags.join(', ')}`);
+        if (f.excerpt)
+            console.log(`        ${COLOR.gray}excerpt:${COLOR.reset} ${f.excerpt}${f.excerpt.length >= 180 ? '…' : ''}`);
+        console.log('');
+    }
+}
+function printPostureReport(posture, silent) {
+    if (silent)
+        return;
+    const col = posture.score >= 80 ? COLOR.green : posture.score >= 60 ? COLOR.yellow : COLOR.red;
+    console.log(`\n${COLOR.bold}${COLOR.cyan}Machine blast radius${COLOR.reset}`);
+    console.log(`${col}${COLOR.bold}Score ${posture.score}/100 · Grade ${posture.grade}${COLOR.reset}`);
+    if (posture.drivers.length)
+        console.log(`${COLOR.gray}Drivers: ${posture.drivers.join(' · ')}${COLOR.reset}`);
+    if (posture.combos.length === 0) {
+        console.log(`${COLOR.green}No dangerous MCP combos detected.${COLOR.reset}`);
+        return;
+    }
+    console.log('');
+    for (const combo of posture.combos) {
+        const c = combo.severity === 'critical' ? COLOR.red : combo.severity === 'high' ? COLOR.yellow : COLOR.gray;
+        console.log(`  ${c}[${combo.severity.toUpperCase()}]${COLOR.reset} ${COLOR.bold}${combo.title}${COLOR.reset}`);
+        console.log(`        ${combo.detail}`);
+    }
 }
 async function discoverCommand(args, config) {
-    const type = (args.type || 'mcp').toLowerCase();
+    const surfaces = parseSurfaces(args);
     const silent = args.silent === 'true';
     const deep = args.deep === 'true';
     if (args.unschedule === 'true') {
@@ -372,141 +505,139 @@ async function discoverCommand(args, config) {
         }
         return;
     }
-    if (type !== 'mcp') {
-        if (!silent)
-            console.error(`Unsupported discover type "${type}". Supported: mcp`);
-        process.exit(1);
-    }
     const cwd = process.cwd();
-    const candidates = candidateConfigPaths(cwd, args.extraPath);
+    const runMcp = surfaces.has('mcp');
     const scanned = [];
     let found = [];
-    for (const c of candidates) {
-        scanned.push({ path: c.path, source: c.source });
-        if (fs.existsSync(c.path)) {
-            found.push(...parseConfigFile(c.path, c.source));
+    let clientCoverage = [];
+    if (runMcp) {
+        const candidates = candidateConfigPaths(cwd, args.extraPath);
+        for (const c of candidates) {
+            scanned.push({ path: c.path, source: c.source });
+            if (fs.existsSync(c.path)) {
+                found.push(...parseConfigFile(c.path, c.source));
+            }
+        }
+        found = dedupe(found);
+        clientCoverage = applyProxyClassification(found, scanned, cwd);
+        if (deep && found.length > 0) {
+            if (!silent)
+                console.log(`${COLOR.gray}Running deep probe (HTTP/SSE tools/list)…${COLOR.reset}`);
+            await enrichWithDeepProbe(found, silent);
         }
     }
-    found = dedupe(found);
-    const clientCoverage = applyProxyClassification(found, scanned, cwd);
-    if (deep && found.length > 0) {
-        if (!silent)
-            console.log(`${COLOR.gray}Running deep probe (HTTP/SSE tools/list)…${COLOR.reset}`);
-        await enrichWithDeepProbe(found, silent);
-    }
+    const secrets = surfaces.has('secrets') || surfaces.has('posture')
+        ? (0, discoverSecrets_1.scanSecrets)({ cwd })
+        : undefined;
+    const agentFiles = surfaces.has('agent-files') || surfaces.has('posture')
+        ? (0, discoverAgentFiles_1.scanAgentFiles)({ cwd })
+        : undefined;
+    const posture = surfaces.has('posture')
+        ? (0, discoverBlastRadius_1.computeBlastRadius)({
+            mcpServers: found,
+            clientCoverage,
+            secrets: secrets || { findings: [], scannedFiles: 0, scannedStores: 0, healthScore: 100 },
+            agentFiles: agentFiles || [],
+        })
+        : undefined;
     const host = buildHostMetadata(args.userEmail, deep && found.some(s => s.probeMode === 'deep') ? 'deep' : 'config');
     if (args.json === 'true') {
         console.log(JSON.stringify({
             host,
+            surfaces: [...surfaces],
             scannedFiles: scanned.map(s => `${s.source} → ${s.path}`),
             clientCoverage,
             servers: found,
+            secrets,
+            agentFiles,
+            posture,
         }, null, 2));
         return;
     }
+    const uploadExtras = { secrets, agentFiles, posture };
+    async function maybeUpload() {
+        if (args.upload !== 'true')
+            return;
+        const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
+        if (!creds.apiKey) {
+            if (!silent) {
+                console.error(`\n${COLOR.red}--upload requires an API key.${COLOR.reset} Run \`fullcourtdefense setup\` first.`);
+            }
+            process.exit(1);
+        }
+        await upload(found, host, clientCoverage, creds.apiUrl, creds.apiKey, args.connectorName, uploadExtras);
+    }
     if (silent) {
         if (args.upload === 'true') {
-            const apiKey = args.apiKey || config.apiKey || process.env.FULLCOURTDEFENSE_API_KEY;
-            const apiUrl = args.apiUrl || config.apiUrl || DEFAULT_API_URL;
-            if (!apiKey)
+            const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
+            if (!creds.apiKey)
                 process.exit(1);
-            if (scanned.length === 0)
+            if (!runMcp && !secrets && !agentFiles && !posture)
                 return;
-            await upload(found, host, clientCoverage, apiUrl, apiKey, args.connectorName);
+            await maybeUpload();
         }
         return;
     }
-    console.log(`\n${COLOR.bold}${COLOR.cyan}MCP server discovery${COLOR.reset}`);
-    console.log(`${COLOR.gray}Host ${host.hostname} · ${host.platform} · machine ${host.machineId}${COLOR.reset}`);
-    console.log(`${COLOR.gray}Scanned ${candidates.length} known config locations on this machine.${COLOR.reset}\n`);
-    if (scanned.length === 0) {
-        console.log(`${COLOR.yellow}No MCP config files found.${COLOR.reset}`);
-        console.log(`${COLOR.gray}Looked in Cursor, Claude Desktop/Code, VS Code, Windsurf, Codex, Gemini CLI, and repo-root configs.${COLOR.reset}`);
-        return;
-    }
-    console.log(`${COLOR.bold}AI clients checked (${scanned.length}):${COLOR.reset}`);
-    for (const s of scanned) {
-        const exists = fs.existsSync(s.path);
-        console.log(`  ${COLOR.dim}•${COLOR.reset} ${s.source} → ${s.path}${exists ? '' : ` ${COLOR.yellow}(not created yet)${COLOR.reset}`}`);
-    }
-    console.log('');
-    if (clientCoverage.length > 0) {
-        console.log(`${COLOR.bold}Client coverage:${COLOR.reset}`);
-        for (const row of clientCoverage) {
-            const gateway = row.mcpGatewayInstalled ? `${COLOR.green}gateway ✓${COLOR.reset}` : `${COLOR.red}no gateway${COLOR.reset}`;
-            const hooks = row.clientKey === 'cursor'
-                ? (row.cursorHooksInstalled ? `${COLOR.green}hooks ✓ (${row.cursorHookEvents.join(', ')})${COLOR.reset}` : `${COLOR.yellow}no hooks${COLOR.reset}`)
-                : '';
-            console.log(`  ${COLOR.dim}•${COLOR.reset} ${row.client} — ${row.mcpServerCount} MCP · ${gateway}${hooks ? ` · ${hooks}` : ''}`);
-            if (row.clientKey === 'claude_desktop' && !row.mcpGatewayInstalled && row.mcpServerCount === 0) {
-                console.log(`        ${COLOR.gray}Install: fullcourtdefense install-claude-desktop-mcp-gateway --shield-id ... --mcp-command npm --mcp-args "run mcp"${COLOR.reset}`);
-            }
+    const title = surfaces.size === 1 && surfaces.has('mcp')
+        ? 'MCP server discovery'
+        : `Desktop AI posture (${[...surfaces].join(', ')})`;
+    console.log(`\n${COLOR.bold}${COLOR.cyan}${title}${COLOR.reset}`);
+    console.log(`${COLOR.gray}Host ${host.hostname} · ${host.platform} · machine ${host.machineId}${COLOR.reset}\n`);
+    if (runMcp) {
+        console.log(`${COLOR.bold}MCP inventory${COLOR.reset}`);
+        if (scanned.length === 0) {
+            console.log(`${COLOR.yellow}No MCP config files found.${COLOR.reset}\n`);
         }
-        console.log('');
-    }
-    if (found.length === 0) {
-        console.log(`${COLOR.yellow}No MCP servers configured in these clients yet.${COLOR.reset}`);
-        console.log(`${COLOR.gray}Install gateway everywhere: fullcourtdefense install-mcp-gateway --clients all --shield-id ... --shield-key ... --mcp-command npm --mcp-args "run mcp"${COLOR.reset}`);
-        if (args.upload === 'true') {
-            const apiKey = args.apiKey || config.apiKey || process.env.FULLCOURTDEFENSE_API_KEY;
-            const apiUrl = args.apiUrl || config.apiUrl || DEFAULT_API_URL;
-            if (!apiKey) {
-                console.error(`\n${COLOR.red}--upload requires an API key.${COLOR.reset}`);
-                process.exit(1);
+        else {
+            console.log(`${COLOR.gray}Scanned ${scanned.length} known config locations.${COLOR.reset}\n`);
+            for (const s of scanned) {
+                const exists = fs.existsSync(s.path);
+                console.log(`  ${COLOR.dim}•${COLOR.reset} ${s.source} → ${s.path}${exists ? '' : ` ${COLOR.yellow}(not created yet)${COLOR.reset}`}`);
             }
             console.log('');
-            await upload(found, host, clientCoverage, apiUrl, apiKey, args.connectorName);
-        }
-        else {
-            console.log(`${COLOR.gray}Run with --upload to push client coverage into AI Inventory.${COLOR.reset}`);
-        }
-        return;
-    }
-    const order = { critical: 0, high: 1, medium: 2, low: 3 };
-    found.sort((a, b) => order[a.riskLevel] - order[b.riskLevel]);
-    console.log(`${COLOR.bold}${found.length} MCP server(s) discovered:${COLOR.reset}\n`);
-    for (const s of found) {
-        const col = riskColor(s.riskLevel);
-        const target = s.command ? `${s.command} ${(s.args || []).join(' ')}`.trim() : (s.url || 'unknown');
-        const proxyCol = s.proxyStatus === 'direct' ? COLOR.red : s.proxyStatus === 'proxied' || s.proxyStatus === 'fcd_gateway' ? COLOR.green : COLOR.yellow;
-        console.log(`  ${col}${COLOR.bold}[${s.riskLevel.toUpperCase()}]${COLOR.reset} ${COLOR.bold}${s.serverName}${COLOR.reset} ${COLOR.gray}(${s.transport}${s.probeMode === 'deep' ? ', deep' : ''})${COLOR.reset} ${proxyCol}${proxyStatusLabel(s.proxyStatus)}${COLOR.reset}`);
-        if (s.serverDescription)
-            console.log(`        ${COLOR.gray}about:${COLOR.reset} ${s.serverDescription}`);
-        console.log(`        ${COLOR.gray}target:${COLOR.reset} ${target}`);
-        if (s.riskTags.length)
-            console.log(`        ${COLOR.gray}tags:${COLOR.reset} ${s.riskTags.join(', ')}`);
-        if (s.tools.length) {
-            const names = s.tools.map(t => t.name);
-            console.log(`        ${COLOR.gray}tools:${COLOR.reset} ${names.slice(0, 12).join(', ')}${names.length > 12 ? ' …' : ''}`);
+            if (clientCoverage.length > 0) {
+                for (const row of clientCoverage) {
+                    const gateway = row.mcpGatewayInstalled ? `${COLOR.green}gateway ✓${COLOR.reset}` : `${COLOR.red}no gateway${COLOR.reset}`;
+                    console.log(`  ${COLOR.dim}•${COLOR.reset} ${row.client} — ${row.mcpServerCount} MCP · ${gateway}`);
+                }
+                console.log('');
+            }
+            if (found.length > 0) {
+                const order = { critical: 0, high: 1, medium: 2, low: 3 };
+                found.sort((a, b) => order[a.riskLevel] - order[b.riskLevel]);
+                for (const s of found) {
+                    const col = riskColor(s.riskLevel);
+                    const target = s.command ? `${s.command} ${(s.args || []).join(' ')}`.trim() : (s.url || 'unknown');
+                    console.log(`  ${col}[${s.riskLevel.toUpperCase()}]${COLOR.reset} ${s.serverName} — ${target} (${proxyStatusLabel(s.proxyStatus)})`);
+                }
+                console.log('');
+            }
         }
-        console.log(`        ${COLOR.gray}from:${COLOR.reset} ${s.source}`);
-        for (const w of s.warnings)
-            console.log(`        ${COLOR.red}⚠ ${w}${COLOR.reset}`);
-        console.log('');
     }
-    const counts = found.reduce((acc, s) => { acc[s.riskLevel] = (acc[s.riskLevel] || 0) + 1; return acc; }, {});
-    console.log(`${COLOR.bold}Summary:${COLOR.reset} ${counts.critical || 0} critical · ${counts.high || 0} high · ${counts.medium || 0} medium · ${counts.low || 0} low`);
+    if (secrets)
+        printSecretsReport(secrets, silent);
+    if (agentFiles)
+        printAgentFilesReport(agentFiles, silent);
+    if (posture)
+        printPostureReport(posture, silent);
     if (args.upload === 'true') {
-        const apiKey = args.apiKey || config.apiKey || process.env.FULLCOURTDEFENSE_API_KEY;
-        const apiUrl = args.apiUrl || config.apiUrl || DEFAULT_API_URL;
-        if (!apiKey) {
-            console.error(`\n${COLOR.red}--upload requires an API key.${COLOR.reset} Set --api-key, FULLCOURTDEFENSE_API_KEY, or apiKey in config.`);
-            process.exit(1);
-        }
         console.log('');
-        await upload(found, host, clientCoverage, apiUrl, apiKey, args.connectorName);
+        await maybeUpload();
     }
     else {
-        console.log(`${COLOR.gray}Run with --upload to push these into your AI Inventory.${COLOR.reset}`);
-        if (!deep)
-            console.log(`${COLOR.gray}Add --deep to live-probe HTTP/SSE servers for tools/list.${COLOR.reset}`);
-        console.log(`${COLOR.gray}Add --schedule daily for automatic daily upload (MDM/fleet).${COLOR.reset}`);
+        console.log(`${COLOR.gray}Run with --upload to push results into AI Fleet.${COLOR.reset}`);
+        if (runMcp && !deep)
+            console.log(`${COLOR.gray}Add --deep to live-probe HTTP/SSE MCP servers.${COLOR.reset}`);
+        if (!surfaces.has('secrets'))
+            console.log(`${COLOR.gray}Add --surface secrets for .env / credential store scan (local-only).${COLOR.reset}`);
+        if (surfaces.size < 4)
+            console.log(`${COLOR.gray}Add --surface all for MCP + secrets + agent files + blast radius.${COLOR.reset}`);
     }
 }
 /** Upload-only discover — used after install-mcp-gateway --upload. */
 async function runDiscoverUpload(args, config) {
     await discoverCommand({
-        type: 'mcp',
+        surface: 'all',
         upload: 'true',
         silent: args.silent ? 'true' : undefined,
         apiKey: args.apiKey,

package/dist/commands/discoverAgentFiles.d.ts

@@ -0,0 +1,15 @@
+export type AgentFileKind = 'rules' | 'skills' | 'instructions' | 'hooks' | 'memory' | 'other';
+export interface AgentFileFinding {
+    id: string;
+    kind: AgentFileKind;
+    client?: string;
+    filePath: string;
+    title: string;
+    sizeBytes: number;
+    lineCount: number;
+    riskTags: string[];
+    excerpt?: string;
+}
+export declare function scanAgentFiles(options?: {
+    cwd?: string;
+}): AgentFileFinding[];