npm - fullcourtdefense-cli - Versions diffs - 1.7.20 → 1.7.21 - Mend

fullcourtdefense-cli 1.7.20 → 1.7.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/commands/agentCi.js +1 -1
package/dist/commands/local-scan.js +761 -761
package/dist/version.json +1 -1
package/package.json +44 -44

package/dist/commands/local-scan.js CHANGED Viewed

@@ -1080,769 +1080,769 @@ function localMcpServerOptions() {
 function compactScanHtml(args) {
     const auth = currentShieldConfig(args);
     const isConfigured = Boolean(auth.shieldId && auth.shieldKey);
-    return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>Full Court Defense Local Scanner</title>
-  <style>
-    :root { color-scheme: light; font-family: Inter, ui-sans-serif, system-ui, -apple-system, Segoe UI, sans-serif; }
-    body { margin: 0; background: #f8fafc; color: #0f172a; }
-    .wrap { max-width: 1100px; margin: 0 auto; padding: 28px 18px 48px; }
-    .hero { border: 1px solid #bfdbfe; background: linear-gradient(135deg, #eff6ff, #ecfdf5); border-radius: 24px; padding: 22px; box-shadow: 0 10px 30px rgba(15,23,42,.06); }
-    .auth { margin-top: 18px; border: 1px solid ${isConfigured ? '#bbf7d0' : '#fed7aa'}; background: ${isConfigured ? '#f0fdf4' : '#fff7ed'}; border-radius: 20px; padding: 16px; }
-    .eyebrow { color: #1d4ed8; font-size: 12px; font-weight: 900; letter-spacing: .08em; text-transform: uppercase; }
-    h1 { margin: 6px 0 8px; font-size: 26px; line-height: 1.15; }
-    p { color: #475569; line-height: 1.55; }
-    .grid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 12px; }
-    .menuShell { display: grid; grid-template-columns: minmax(0, 1.15fr) minmax(0, 1.15fr) minmax(180px, .7fr); gap: 14px; margin-top: 18px; align-items: stretch; }
-    .menuGroup { border: 1px solid #dbeafe; background: rgba(255,255,255,.7); border-radius: 20px; padding: 12px; }
-    .menuGroup.run { border-color: #bbf7d0; background: #f0fdf4; }
-    .menuLabel { color: #475569; font-size: 11px; font-weight: 900; letter-spacing: .08em; text-transform: uppercase; margin: 0 0 9px; }
-    .steps { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 10px; margin-top: 18px; }
-    .step { border: 1px solid #e2e8f0; background: white; color: #64748b; border-radius: 16px; padding: 12px; font-size: 12px; font-weight: 900; }
-    .step.active { border-color: #2563eb; background: #eff6ff; color: #1d4ed8; }
-    .step.done { border-color: #bbf7d0; background: #f0fdf4; color: #166534; }
-    .sectionTitle { display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-bottom: 12px; }
-    .sectionTitle h2 { margin: 0; font-size: 18px; }
-    .muted { color: #64748b; font-size: 13px; }
-    .card { cursor: pointer; border: 2px solid #e2e8f0; background: white; border-radius: 18px; padding: 16px; text-align: left; transition: .15s ease; }
-    .workflowCard { min-height: 118px; }
-    .workflowCard b { font-size: 18px; }
-    .workflowCard span { font-size: 13px; }
-    .landingScanGrid { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 10px; }
-    .scanTypeGrid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; margin: 12px 0; }
-    .advancedScanGrid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; margin: 8px 0 12px; }
-    .card:hover, .card.active { border-color: #2563eb; background: #eff6ff; transform: translateY(-1px); }
-    .card b { display: block; font-size: 14px; margin-bottom: 4px; }
-    .card span { color: #64748b; font-size: 12px; line-height: 1.35; }
-    .panel { margin-top: 18px; border: 1px solid #e2e8f0; border-radius: 22px; background: white; padding: 18px; }
-    label { display: block; font-size: 12px; font-weight: 800; color: #475569; margin: 12px 0 6px; }
-    input, select, textarea { box-sizing: border-box; width: 100%; border: 1px solid #cbd5e1; border-radius: 12px; padding: 11px 12px; font: inherit; font-size: 14px; }
-    textarea { min-height: 92px; font-family: ui-monospace, SFMono-Regular, Consolas, monospace; }
-    .two { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }
-    .actions { display: flex; gap: 10px; align-items: center; margin-top: 16px; flex-wrap: wrap; }
-    button.primary { border: 0; background: #16a34a; color: white; border-radius: 13px; padding: 12px 18px; font-weight: 900; cursor: pointer; box-shadow: 0 12px 24px rgba(22,163,74,.18); }
-    button.primary:disabled { background: #cbd5e1; cursor: not-allowed; box-shadow: none; }
-    button.secondary { border: 1px solid #cbd5e1; background: white; color: #334155; border-radius: 13px; padding: 11px 16px; font-weight: 800; cursor: pointer; }
-    .note { margin-top: 14px; border: 1px solid #bbf7d0; background: #f0fdf4; color: #166534; border-radius: 16px; padding: 12px; font-size: 13px; }
-    .console { margin-top: 18px; overflow: hidden; border-radius: 22px; border: 1px solid #1e293b; background: #020617; box-shadow: 0 18px 40px rgba(15,23,42,.18); }
-    .consoleHead { display: flex; justify-content: space-between; align-items: center; gap: 12px; padding: 12px 14px; border-bottom: 1px solid #1e293b; background: #0f172a; color: #e2e8f0; }
-    .consoleHead b { font-size: 13px; }
-    .pill { border: 1px solid #334155; background: #111827; color: #93c5fd; border-radius: 999px; padding: 4px 9px; font-size: 11px; font-weight: 800; }
-    pre { margin: 0; white-space: pre-wrap; overflow: auto; background: #020617; color: #d1fae5; padding: 14px; height: 380px; font: 12px/1.55 ui-monospace, SFMono-Regular, Consolas, monospace; }
-    .resultCard { margin-top: 14px; border: 1px solid #dbeafe; background: #f8fbff; border-radius: 16px; padding: 14px; }
-    .resultHead { display: flex; justify-content: space-between; align-items: center; gap: 10px; margin-bottom: 10px; }
-    .resultTitle { font-size: 14px; font-weight: 900; color: #0f172a; }
-    .statusTag { border: 1px solid #cbd5e1; border-radius: 999px; padding: 4px 10px; font-size: 12px; font-weight: 900; }
-    .statusTag.pass { border-color: #bbf7d0; color: #166534; background: #f0fdf4; }
-    .statusTag.fail { border-color: #fecaca; color: #991b1b; background: #fef2f2; }
-    .resultGrid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 10px; }
-    .resultMetric { border: 1px solid #e2e8f0; background: white; border-radius: 12px; padding: 10px; }
-    .resultMetric b { display: block; font-size: 11px; color: #64748b; text-transform: uppercase; letter-spacing: .05em; margin-bottom: 4px; }
-    .resultMetric span { font-size: 16px; font-weight: 800; color: #0f172a; }
-    .resultMeta { margin-top: 10px; color: #334155; font-size: 12px; line-height: 1.5; }
-    .resultMeta a { color: #1d4ed8; }
-    .mcpBanner { margin-top: 10px; border-radius: 14px; padding: 12px; font-size: 13px; line-height: 1.45; }
-    .mcpBanner.ok { border: 1px solid #bbf7d0; background: #f0fdf4; color: #166534; }
-    .mcpBanner.blocked { border: 1px solid #fecaca; background: #fef2f2; color: #991b1b; }
-    .mcpCards { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 10px; margin-top: 10px; }
-    .mcpCard { border: 1px solid #e2e8f0; background: white; border-radius: 12px; padding: 10px; }
-    .mcpCard b { display: block; color: #64748b; font-size: 11px; text-transform: uppercase; letter-spacing: .05em; margin-bottom: 4px; }
-    .mcpCard span { color: #0f172a; font-size: 13px; font-weight: 750; overflow-wrap: anywhere; }
-    .localTable { width: 100%; border-collapse: collapse; margin-top: 10px; font-size: 12px; overflow: hidden; border-radius: 12px; }
-    .localTable th, .localTable td { border-bottom: 1px solid #e2e8f0; padding: 8px; text-align: left; vertical-align: top; }
-    .localTable th { color: #475569; background: #f8fafc; font-size: 11px; text-transform: uppercase; letter-spacing: .05em; }
-    .copyBox { margin-top: 10px; }
-    .hidden { display: none; }
-    @media (max-width: 800px) { .grid, .two, .menuShell { grid-template-columns: 1fr; } }
-  </style>
-</head>
-<body>
-  <main class="wrap">
-    <section class="hero">
-      <div class="eyebrow">Local Web Console</div>
-      <h1>Choose a local workflow</h1>
-      <p>Pick one clear path. Run MCP Tool is a one-off tool call. Security Scan is a red-team scan against an internal endpoint, RAG target, or MCP server.</p>
-      <div class="auth">
-        <div class="eyebrow">${isConfigured ? 'Authenticated' : 'Authentication Required'}</div>
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Full Court Defense Local Scanner</title>
+  <style>
+    :root { color-scheme: light; font-family: Inter, ui-sans-serif, system-ui, -apple-system, Segoe UI, sans-serif; }
+    body { margin: 0; background: #f8fafc; color: #0f172a; }
+    .wrap { max-width: 1100px; margin: 0 auto; padding: 28px 18px 48px; }
+    .hero { border: 1px solid #bfdbfe; background: linear-gradient(135deg, #eff6ff, #ecfdf5); border-radius: 24px; padding: 22px; box-shadow: 0 10px 30px rgba(15,23,42,.06); }
+    .auth { margin-top: 18px; border: 1px solid ${isConfigured ? '#bbf7d0' : '#fed7aa'}; background: ${isConfigured ? '#f0fdf4' : '#fff7ed'}; border-radius: 20px; padding: 16px; }
+    .eyebrow { color: #1d4ed8; font-size: 12px; font-weight: 900; letter-spacing: .08em; text-transform: uppercase; }
+    h1 { margin: 6px 0 8px; font-size: 26px; line-height: 1.15; }
+    p { color: #475569; line-height: 1.55; }
+    .grid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 12px; }
+    .menuShell { display: grid; grid-template-columns: minmax(0, 1.15fr) minmax(0, 1.15fr) minmax(180px, .7fr); gap: 14px; margin-top: 18px; align-items: stretch; }
+    .menuGroup { border: 1px solid #dbeafe; background: rgba(255,255,255,.7); border-radius: 20px; padding: 12px; }
+    .menuGroup.run { border-color: #bbf7d0; background: #f0fdf4; }
+    .menuLabel { color: #475569; font-size: 11px; font-weight: 900; letter-spacing: .08em; text-transform: uppercase; margin: 0 0 9px; }
+    .steps { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 10px; margin-top: 18px; }
+    .step { border: 1px solid #e2e8f0; background: white; color: #64748b; border-radius: 16px; padding: 12px; font-size: 12px; font-weight: 900; }
+    .step.active { border-color: #2563eb; background: #eff6ff; color: #1d4ed8; }
+    .step.done { border-color: #bbf7d0; background: #f0fdf4; color: #166534; }
+    .sectionTitle { display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-bottom: 12px; }
+    .sectionTitle h2 { margin: 0; font-size: 18px; }
+    .muted { color: #64748b; font-size: 13px; }
+    .card { cursor: pointer; border: 2px solid #e2e8f0; background: white; border-radius: 18px; padding: 16px; text-align: left; transition: .15s ease; }
+    .workflowCard { min-height: 118px; }
+    .workflowCard b { font-size: 18px; }
+    .workflowCard span { font-size: 13px; }
+    .landingScanGrid { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 10px; }
+    .scanTypeGrid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; margin: 12px 0; }
+    .advancedScanGrid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; margin: 8px 0 12px; }
+    .card:hover, .card.active { border-color: #2563eb; background: #eff6ff; transform: translateY(-1px); }
+    .card b { display: block; font-size: 14px; margin-bottom: 4px; }
+    .card span { color: #64748b; font-size: 12px; line-height: 1.35; }
+    .panel { margin-top: 18px; border: 1px solid #e2e8f0; border-radius: 22px; background: white; padding: 18px; }
+    label { display: block; font-size: 12px; font-weight: 800; color: #475569; margin: 12px 0 6px; }
+    input, select, textarea { box-sizing: border-box; width: 100%; border: 1px solid #cbd5e1; border-radius: 12px; padding: 11px 12px; font: inherit; font-size: 14px; }
+    textarea { min-height: 92px; font-family: ui-monospace, SFMono-Regular, Consolas, monospace; }
+    .two { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }
+    .actions { display: flex; gap: 10px; align-items: center; margin-top: 16px; flex-wrap: wrap; }
+    button.primary { border: 0; background: #16a34a; color: white; border-radius: 13px; padding: 12px 18px; font-weight: 900; cursor: pointer; box-shadow: 0 12px 24px rgba(22,163,74,.18); }
+    button.primary:disabled { background: #cbd5e1; cursor: not-allowed; box-shadow: none; }
+    button.secondary { border: 1px solid #cbd5e1; background: white; color: #334155; border-radius: 13px; padding: 11px 16px; font-weight: 800; cursor: pointer; }
+    .note { margin-top: 14px; border: 1px solid #bbf7d0; background: #f0fdf4; color: #166534; border-radius: 16px; padding: 12px; font-size: 13px; }
+    .console { margin-top: 18px; overflow: hidden; border-radius: 22px; border: 1px solid #1e293b; background: #020617; box-shadow: 0 18px 40px rgba(15,23,42,.18); }
+    .consoleHead { display: flex; justify-content: space-between; align-items: center; gap: 12px; padding: 12px 14px; border-bottom: 1px solid #1e293b; background: #0f172a; color: #e2e8f0; }
+    .consoleHead b { font-size: 13px; }
+    .pill { border: 1px solid #334155; background: #111827; color: #93c5fd; border-radius: 999px; padding: 4px 9px; font-size: 11px; font-weight: 800; }
+    pre { margin: 0; white-space: pre-wrap; overflow: auto; background: #020617; color: #d1fae5; padding: 14px; height: 380px; font: 12px/1.55 ui-monospace, SFMono-Regular, Consolas, monospace; }
+    .resultCard { margin-top: 14px; border: 1px solid #dbeafe; background: #f8fbff; border-radius: 16px; padding: 14px; }
+    .resultHead { display: flex; justify-content: space-between; align-items: center; gap: 10px; margin-bottom: 10px; }
+    .resultTitle { font-size: 14px; font-weight: 900; color: #0f172a; }
+    .statusTag { border: 1px solid #cbd5e1; border-radius: 999px; padding: 4px 10px; font-size: 12px; font-weight: 900; }
+    .statusTag.pass { border-color: #bbf7d0; color: #166534; background: #f0fdf4; }
+    .statusTag.fail { border-color: #fecaca; color: #991b1b; background: #fef2f2; }
+    .resultGrid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 10px; }
+    .resultMetric { border: 1px solid #e2e8f0; background: white; border-radius: 12px; padding: 10px; }
+    .resultMetric b { display: block; font-size: 11px; color: #64748b; text-transform: uppercase; letter-spacing: .05em; margin-bottom: 4px; }
+    .resultMetric span { font-size: 16px; font-weight: 800; color: #0f172a; }
+    .resultMeta { margin-top: 10px; color: #334155; font-size: 12px; line-height: 1.5; }
+    .resultMeta a { color: #1d4ed8; }
+    .mcpBanner { margin-top: 10px; border-radius: 14px; padding: 12px; font-size: 13px; line-height: 1.45; }
+    .mcpBanner.ok { border: 1px solid #bbf7d0; background: #f0fdf4; color: #166534; }
+    .mcpBanner.blocked { border: 1px solid #fecaca; background: #fef2f2; color: #991b1b; }
+    .mcpCards { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 10px; margin-top: 10px; }
+    .mcpCard { border: 1px solid #e2e8f0; background: white; border-radius: 12px; padding: 10px; }
+    .mcpCard b { display: block; color: #64748b; font-size: 11px; text-transform: uppercase; letter-spacing: .05em; margin-bottom: 4px; }
+    .mcpCard span { color: #0f172a; font-size: 13px; font-weight: 750; overflow-wrap: anywhere; }
+    .localTable { width: 100%; border-collapse: collapse; margin-top: 10px; font-size: 12px; overflow: hidden; border-radius: 12px; }
+    .localTable th, .localTable td { border-bottom: 1px solid #e2e8f0; padding: 8px; text-align: left; vertical-align: top; }
+    .localTable th { color: #475569; background: #f8fafc; font-size: 11px; text-transform: uppercase; letter-spacing: .05em; }
+    .copyBox { margin-top: 10px; }
+    .hidden { display: none; }
+    @media (max-width: 800px) { .grid, .two, .menuShell { grid-template-columns: 1fr; } }
+  </style>
+</head>
+<body>
+  <main class="wrap">
+    <section class="hero">
+      <div class="eyebrow">Local Web Console</div>
+      <h1>Choose a local workflow</h1>
+      <p>Pick one clear path. Run MCP Tool is a one-off tool call. Security Scan is a red-team scan against an internal endpoint, RAG target, or MCP server.</p>
+      <div class="auth">
+        <div class="eyebrow">${isConfigured ? 'Authenticated' : 'Authentication Required'}</div>
         <p id="authStatus">${isConfigured
         ? `Connected to Shield ${htmlEscape(maskSecret(auth.shieldId))}. Reports will save to Full Court Defense.`
-        : 'Configure CLI once with fullcourtdefense configure, then run local scans. UI uses saved local config automatically.'}</p>
-        <div class="actions">
-          <button class="secondary" id="toggleSetup">Change Shield settings</button>
-          <button class="secondary" id="checkBackend">Check outbound backend</button>
-        </div>
-        <div id="setupPanel" class="hidden">
-          <div class="two">
-            <div><label>Shield ID</label><input id="shieldId" value="${htmlEscape(auth.shieldId || '')}" placeholder="sh_..." /></div>
-            <div><label>Shield key</label><input id="shieldKey" type="password" value="${htmlEscape(auth.shieldKey || '')}" placeholder="shsk_..." /></div>
-          </div>
-          <label>Backend API URL</label>
-          <input id="apiUrl" value="${htmlEscape(auth.apiUrl || DEFAULT_API_URL)}" placeholder="https://api.fullcourtdefense.ai" />
-          <div class="actions">
-            <button class="secondary" id="saveSetup">Save Shield settings</button>
-          </div>
-        </div>
-        <div class="note" id="backendStatus">Backend status: not checked yet.</div>
-      </div>
-      <div class="steps" id="scanSteps">
-        <div class="step active" id="step-dot-1">1. Connect target</div>
-        <div class="step" id="step-dot-2">2. Select scan type</div>
-        <div class="step" id="step-dot-3">3. Run red-team scan</div>
-      </div>
-      <div class="menuShell" id="cards">
-        <div class="menuGroup run">
-          <div class="menuLabel">Run, not a scan</div>
-          <button class="card workflowCard active" data-workflow="runner"><b>Run one MCP tool</b><span>Call exactly one local MCP tool through a direct server or protected gateway. Best for demos and policy checks.</span></button>
-        </div>
-        <div class="menuGroup">
-          <div class="menuLabel">Security scans</div>
-          <div class="landingScanGrid">
-            <button class="card workflowCard" data-workflow="bot"><b>Bot Scan</b><span>Red-team an internal bot, agent, or chat API.</span></button>
-            <button class="card workflowCard" data-workflow="posture"><b>Security Posture Scan</b><span>Run web-style endpoint security checkup.</span></button>
-            <button class="card workflowCard" data-workflow="mcp"><b>MCP Scan</b><span>Scan an MCP server or protected gateway for risky tool paths.</span></button>
-            <button class="card workflowCard" data-workflow="mcp-posture"><b>MCP Posture Scan</b><span>Inventory exposed MCP tools without invoking them.</span></button>
-          </div>
-        </div>
-        <div class="menuGroup">
-          <div class="menuLabel">Help</div>
-          <button class="card workflowCard" data-workflow="help"><b>Options</b><span>Modes, formats, and when to use each local workflow.</span></button>
-        </div>
-      </div>
-    </section>
-    <section class="panel hidden" id="workflowPanel">
-      <div id="step-1" class="stepSection">
-      <div class="sectionTitle">
-        <div>
-          <h2 id="connectTitle">Run MCP Tool</h2>
-          <div class="muted" id="connectSubtitle">Call one MCP tool from this machine. This is not a scan.</div>
-        </div>
-      </div>
-      <div id="runner-fields">
-        <div class="note">This is not a scan. It runs one MCP tool call from this machine. Use a protected proxy/gateway command to show policy decisions, or a direct local MCP server for raw tool testing.</div>
-        <label>Saved/protected MCP server</label>
-        <select id="runnerServer">
-          <option value="">Manual connection...</option>
-        </select>
-        <div class="two">
-          <div>
-            <label>Protected MCP HTTP/SSE URL</label>
-            <input id="runnerMcpUrl" placeholder="Optional: http://127.0.0.1:5066/mcp" />
-          </div>
-          <div>
-            <label>Tool name</label>
-            <input id="runnerTool" placeholder="Example: lookup_customer_profile" />
-          </div>
-        </div>
-        <div class="two">
-          <div>
-            <label>Operation/action override</label>
-            <input id="runnerOperation" placeholder="optional, e.g. read / write / delete / payment:write" />
-          </div>
-          <div>
-            <label>Why use this?</label>
-            <input value="Use when one tool supports multiple actions" readonly />
-          </div>
-        </div>
-        <div class="two">
-          <div><label>Or stdio command</label><input id="runnerMcpCommand" placeholder="node" /></div>
-          <div><label>Command args</label><input id="runnerMcpArgs" placeholder="C:\\path\\to\\mcp-server.js" /></div>
-        </div>
-        <label>Tool arguments JSON</label>
-        <textarea id="runnerToolArgs" spellcheck="false">{
-  "customerId": "RO-PB-10492"
-}</textarea>
-        <div class="actions">
-          <button class="primary" id="runMcpTool">Run MCP tool</button>
-          <button class="secondary" id="copyMcpResult">Copy result</button>
-        </div>
-        <div id="mcpResultCard" class="resultCard hidden">
-          <div class="resultHead">
-            <div class="resultTitle">MCP tool result</div>
-            <span id="mcpResultStatus" class="statusTag">READY</span>
-          </div>
-          <div id="mcpResultTable"></div>
-          <div class="copyBox">
-            <label>Copyable JSON</label>
-            <textarea id="mcpResultJson" spellcheck="false" readonly></textarea>
-          </div>
-        </div>
-      </div>
-      <div id="scan-picker" class="hidden">
-        <div class="note">Security scans run red-team templates locally from this machine. First choose what you want to test.</div>
-        <div class="scanTypeGrid">
-          <button class="card scanTypeCard active" data-target="endpoint"><b>Bot Scan</b><span>Red-team an internal bot, agent, or chat API with prompt-injection templates.</span></button>
-          <button class="card scanTypeCard" data-target="posture"><b>Security Posture Scan</b><span>Run the web-style checkup for HTTPS, headers, auth exposure, and endpoint posture.</span></button>
-        </div>
-        <div class="menuLabel">Advanced local targets</div>
-        <div class="advancedScanGrid">
-          <button class="card scanTypeCard" data-target="rag"><b>RAG Scan</b><span>Test retrieval URL or local corpus path.</span></button>
-          <button class="card scanTypeCard" data-target="mcp"><b>MCP Scan</b><span>Scan tool responses and tool-abuse paths.</span></button>
-          <button class="card scanTypeCard" data-target="mcp-posture"><b>MCP Posture Scan</b><span>List tools and flag risky exposed capabilities.</span></button>
-        </div>
-      </div>
-      <div id="endpoint-fields" class="hidden">
-        <label>Internal endpoint URL</label>
-        <input id="endpoint" placeholder="http://127.0.0.1:3000/chat" />
-        <div class="two">
-          <div><label>Request field</label><input id="inputField" value="message" /></div>
-          <div><label>Output field</label><input id="outputField" value="response" /></div>
-        </div>
-      </div>
-      <div id="posture-fields" class="hidden">
-        <div class="note">Security Posture Scan checks HTTP endpoint configuration, auth exposure, headers, transport, and operational security signals. To test MCP tools, choose MCP Scan from the Security Scans cards.</div>
-        <div class="two">
-          <div>
-            <label>AI endpoint URL</label>
-            <input id="postureUrl" placeholder="https://your-ai-endpoint.com/api/chat" />
-          </div>
-          <div>
-            <label>HTTP method</label>
-            <select id="postureMethod"><option value="POST" selected>POST</option><option value="GET">GET</option></select>
-          </div>
-        </div>
-        <div class="two">
-          <div>
-            <label>Auth type</label>
-            <select id="postureAuthType"><option value="none" selected>No Auth</option><option value="bearer">Bearer Token</option><option value="api-key">API Key</option></select>
-          </div>
-          <div>
-            <label>Token / API key value</label>
-            <input id="postureToken" type="password" placeholder="Optional" />
-          </div>
-        </div>
-      </div>
-      <div id="rag-fields" class="hidden">
-        <label>RAG retrieval URL</label>
-        <input id="ragUrl" placeholder="http://127.0.0.1:8787/rag/retrieve" />
-        <div class="two">
-          <div><label>RAG request field</label><input id="ragInputField" value="query" /></div>
-          <div><label>RAG output field</label><input id="ragOutputField" value="chunks" /></div>
-        </div>
-        <label>Or local corpus path</label>
-        <input id="ragPath" placeholder="C:\\company\\docs" />
-      </div>
-      <div id="mcp-fields" class="hidden">
-        <div class="note" id="mcpModeNote">MCP Scan runs red-team templates against MCP tool behavior. MCP Posture Scan lists exposed tools and flags risky capabilities without invoking them.</div>
-        <div class="two">
-          <div><label>MCP HTTP/SSE URL</label><input id="mcpUrl" placeholder="http://127.0.0.1:5066/mcp" /></div>
-          <div><label>MCP tool</label><input id="mcpTool" value="all" /></div>
-        </div>
-        <div class="two">
-          <div><label>Or stdio command</label><input id="mcpCommand" placeholder="node" /></div>
-          <div><label>Command args</label><input id="mcpArgs" placeholder=".\\server.js" /></div>
-        </div>
-      </div>
-      <div id="help-fields" class="hidden">
-        <div class="note">Use Run MCP Tool for one live tool call. Use Endpoint, RAG, or MCP Scan for red-team testing. Scan reports save back to the normal web report history when a Shield key is configured.</div>
-      </div>
-      <div class="actions" id="scanActions">
-        <button class="secondary" id="command">Show CLI command</button>
-        <button class="primary" id="connectNext">Continue to scan type</button>
-      </div>
-      </div>
-      <div id="step-2" class="stepSection hidden">
-      <div class="sectionTitle">
-        <div>
-          <h2>Select scan type</h2>
-          <div class="muted">Same scan modes as web red-team scanning.</div>
-        </div>
-      </div>
-      <div class="two">
-        <div>
-          <label>Scan mode</label>
-          <select id="mode"><option value="quick" selected>Quick</option><option value="full">Full</option><option value="targeted">Targeted</option><option value="deep">Deep</option></select>
-        </div>
-        <div>
-          <label>Output format</label>
-          <select id="format"><option value="summary">Summary</option><option value="report" selected>Report</option><option value="full-report">Full report</option><option value="json">JSON</option></select>
-        </div>
-      </div>
-      <div class="note">Quick runs 20 critical/high templates. Full runs the full bundled web attack corpus. Targeted adds your target context.</div>
-      <div class="actions">
-        <button class="secondary" id="backToConnect">Back</button>
-        <button class="primary" id="scanTypeNext">Continue to scan</button>
-      </div>
-      </div>
-      <div id="step-3" class="stepSection hidden">
-      <div class="sectionTitle">
-        <div>
-          <h2>Run red-team scan</h2>
-          <div class="muted">The scan executes locally and saves a report through our backend.</div>
-        </div>
-      </div>
-      <div class="actions">
-        <button class="primary" id="run" ${isConfigured ? '' : 'disabled'}>Run local scan</button>
-        <button class="secondary" id="newScan">New scan</button>
-      </div>
-      <div class="note">This page only listens on 127.0.0.1. It can reach localhost/VPN targets because it runs from your machine.</div>
-      <div id="resultCard" class="resultCard hidden">
-        <div class="resultHead">
-          <div class="resultTitle">Scan result</div>
-          <span id="resultStatus" class="statusTag">READY</span>
-        </div>
-        <div class="resultGrid">
-          <div class="resultMetric"><b>Score</b><span id="resultScore">-</span></div>
-          <div class="resultMetric"><b>Passed</b><span id="resultPassed">-</span></div>
-          <div class="resultMetric"><b>Failed</b><span id="resultFailed">-</span></div>
-          <div class="resultMetric"><b>Violations</b><span id="resultViolations">-</span></div>
-          <div class="resultMetric"><b>Session</b><span id="resultSession">-</span></div>
-          <div class="resultMetric"><b>Target</b><span id="resultTarget">-</span></div>
-        </div>
-        <div class="resultMeta" id="resultMeta"></div>
-      </div>
-      <div class="console">
-        <div class="consoleHead">
-          <b>Red-team console</b>
-          <span class="pill" id="consoleStatus">Ready</span>
-        </div>
-        <pre id="out">Full Court Defense Local Web Console ready.
-Choose Run MCP Tool for one live tool call.
-Choose Endpoint/RAG/MCP Scan for a local red-team scan.
-Local targets stay on this machine; saved scan reports go to Full Court Defense.</pre>
-      </div>
-      </div>
-    </section>
-  </main>
-  <script>
-    const scanTargets = ['endpoint','posture','rag','mcp','mcp-posture'];
-    let target = 'home';
-    let step = 1;
-    const qs = new URLSearchParams(location.search);
-    if (['runner','endpoint','posture','rag','mcp','mcp-posture','help'].includes(qs.get('target'))) target = qs.get('target');
-    const byId = id => document.getElementById(id);
-    const workflow = () => target === 'endpoint' ? 'bot' : target === 'posture' ? 'posture' : target === 'home' ? '' : target;
-    const sync = () => {
-      document.querySelectorAll('.workflowCard').forEach(c => c.classList.toggle('active', c.dataset.workflow === workflow()));
-      document.querySelectorAll('.scanTypeCard').forEach(c => c.classList.toggle('active', c.dataset.target === target));
-      byId('workflowPanel').classList.toggle('hidden', target === 'home');
-      ['runner','endpoint','posture','rag','mcp','help'].forEach(id => {
-        const show = id === 'mcp' ? ['mcp','mcp-posture'].includes(target) : id === target;
-        byId(id + '-fields').classList.toggle('hidden', !show);
-      });
-      const scanTarget = scanTargets.includes(target);
-      byId('mcpModeNote').textContent = target === 'mcp-posture'
-        ? 'MCP Posture Scan lists exposed tools, checks whether the server appears protected, and flags risky capabilities without invoking any tool.'
-        : 'MCP Scan runs red-team templates against MCP tool behavior. Use MCP Posture Scan for inventory-only posture.';
-      byId('scan-picker').classList.toggle('hidden', !scanTarget);
-      byId('scanSteps').classList.toggle('hidden', !scanTarget);
-      byId('scanActions').classList.toggle('hidden', !scanTarget);
-      byId('connectTitle').textContent = target === 'runner'
-        ? 'Run MCP Tool'
-        : target === 'help'
-          ? 'Local workflow options'
-          : target === 'mcp-posture'
-            ? 'MCP posture scan'
-            : 'Choose scan target';
-      byId('connectSubtitle').textContent = target === 'runner'
-        ? 'Call one MCP tool from this machine. This is not a scan.'
-        : target === 'help'
-          ? 'Choose one-off tool run or local red-team scan.'
-          : target === 'mcp-posture'
-            ? 'Connect an MCP server or protected gateway. No tools are invoked.'
-            : 'Select Endpoint, RAG, or MCP, then connect the internal target.';
-      if (!scanTarget || target === 'home') setStep(1);
-    };
-    const setStep = next => {
-      step = next;
-      [1,2,3].forEach(n => {
-        byId('step-' + n).classList.toggle('hidden', n !== step);
-        byId('step-dot-' + n).classList.toggle('active', n === step);
-        byId('step-dot-' + n).classList.toggle('done', n < step);
-      });
-    };
-    document.querySelectorAll('.workflowCard').forEach(c => c.onclick = () => {
-      target = c.dataset.workflow === 'bot' ? 'endpoint' : c.dataset.workflow;
-      sync();
-      byId('workflowPanel').scrollIntoView({ behavior: 'smooth', block: 'start' });
-    });
-    document.querySelectorAll('.scanTypeCard').forEach(c => c.onclick = () => {
-      target = c.dataset.target;
-      sync();
-    });
-    sync();
-    byId('ragUrl').value = qs.get('ragUrl') || '';
-    byId('ragPath').value = qs.get('ragPath') || '';
-    byId('endpoint').value = qs.get('endpoint') || '';
-    byId('mcpUrl').value = qs.get('mcpUrl') || '';
-    byId('mcpCommand').value = qs.get('mcpCommand') || '';
-    byId('mcpArgs').value = qs.get('mcpArgs') || '';
-    byId('runnerMcpUrl').value = qs.get('mcpUrl') || '';
-    byId('runnerMcpCommand').value = qs.get('mcpCommand') || '';
-    byId('runnerMcpArgs').value = qs.get('mcpArgs') || '';
-    byId('runnerTool').value = qs.get('mcpTool') || '';
-    byId('runnerOperation').value = qs.get('operation') || '';
-    const payload = () => ({
-      target, mode: byId('mode').value, format: byId('format').value,
-      endpoint: byId('endpoint').value, inputField: byId('inputField').value, outputField: byId('outputField').value,
-      postureUrl: byId('postureUrl').value, postureMethod: byId('postureMethod').value, postureAuthType: byId('postureAuthType').value, postureToken: byId('postureToken').value,
-      ragUrl: byId('ragUrl').value, ragPath: byId('ragPath').value, ragInputField: byId('ragInputField').value, ragOutputField: byId('ragOutputField').value,
-      mcpUrl: byId('mcpUrl').value, mcpCommand: byId('mcpCommand').value, mcpArgs: byId('mcpArgs').value, mcpTool: byId('mcpTool').value
-    });
-    const mcpRunnerPayload = () => ({
-      mcpUrl: byId('runnerMcpUrl').value,
-      mcpCommand: byId('runnerMcpCommand').value,
-      mcpArgs: byId('runnerMcpArgs').value,
-      toolName: byId('runnerTool').value,
-      operation: byId('runnerOperation').value,
-      toolArgs: byId('runnerToolArgs').value
-    });
-    async function loadMcpServers() {
-      try {
-        const res = await fetch('/mcp/servers');
-        const data = await res.json();
-        const select = byId('runnerServer');
-        const options = data.servers || [];
-        select.innerHTML = '<option value="">Manual connection...</option>' + options.map((server, index) =>
-          '<option value="' + index + '">' + htmlEscape((server.protected ? 'Protected: ' : 'Direct: ') + server.name + ' - ' + server.source + (server.agentName ? ' - ' + server.agentName : '')) + '</option>'
-        ).join('');
-        select.onchange = () => {
-          const server = options[Number(select.value)];
-          if (!server) return;
-          byId('runnerMcpUrl').value = '';
-          byId('runnerMcpCommand').value = server.command || '';
-          byId('runnerMcpArgs').value = Array.isArray(server.args) ? server.args.map(part => /\\s/.test(part) ? JSON.stringify(part) : part).join(' ') : '';
-          setConsole('Loaded saved MCP server: ' + server.name + '\\n' + (server.protected ? 'This entry is already routed through FullCourtDefense gateway.' : 'Direct MCP entry. Wrap it with protect-all for policy enforcement.'), 'Server loaded');
-        };
-      } catch {
-        // Local server picker is convenience only; manual fields still work.
-      }
-    }
-    const renderCommand = p => {
-      const parts = ['fullcourtdefense scan --local --type', p.target, '--mode', p.mode, '--format', p.format, '--no-open'];
-      if (p.target === 'endpoint') parts.push('--endpoint', JSON.stringify(p.endpoint), '--method POST --request-format custom --input-field', p.inputField || 'message', '--output-field', p.outputField || 'response');
-      if (p.target === 'posture') return 'Security Posture Scan runs through this local web UI and calls the Full Court Defense posture checkup API for ' + (p.postureUrl || '<endpoint-url>');
-      if (p.target === 'rag') { if (p.ragUrl) parts.push('--rag-url', JSON.stringify(p.ragUrl), '--method POST --request-format custom --input-field', p.ragInputField || 'query', '--output-field', p.ragOutputField || 'chunks'); else parts.push('--rag-path', JSON.stringify(p.ragPath || '.\\\\docs')); }
-      if (p.target === 'mcp-posture') return 'MCP Posture Scan runs through this local web UI and inventories exposed tools for ' + (p.mcpUrl || ((p.mcpCommand || 'node') + ' ' + (p.mcpArgs || '.\\\\server.js')));
-      if (p.target === 'mcp') { if (p.mcpUrl) parts.push('--mcp-url', JSON.stringify(p.mcpUrl)); else parts.push('--mcp-command', p.mcpCommand || 'node', '--mcp-args', JSON.stringify(p.mcpArgs || '.\\\\server.js')); parts.push('--mcp-tool', p.mcpTool || 'all'); }
-      return parts.join(' ');
-    };
-    const setConsole = (value, status) => {
-      byId('out').innerHTML = htmlEscape(value).replace(/(https?:\\/\\/[^\\s)]+)/g, '<a style="color:#93c5fd" href="$1" target="_blank">$1</a>');
-      byId('out').scrollTop = byId('out').scrollHeight;
-      if (status) byId('consoleStatus').textContent = status;
-    };
-    const parseScanSummary = (text) => {
-      const match = (regex) => (text.match(regex)?.[1] || '').trim();
-      const status = match(/Status:\\s*(PASS|FAIL)/i).toUpperCase();
-      const score = match(/Score:\\s*(\\d+\\/?100?)/i) || match(/Score:\\s*(\\d+)/i);
-      const passed = match(/Passed:\\s*(\\d+)/i);
-      const failed = match(/Failed:\\s*(\\d+)/i);
-      const violations = match(/Violations:\\s*(\\d+)/i);
-      const session = match(/Session:\\s*([^\\n]+)/i);
-      const targetText = match(/Target:\\s*([^\\n]+)/i);
-      const reportUrl = match(/Web report:\\s*(https?:\\/\\/[^\\s]+)/i) || match(/Saved web report [^\\(]*\\((https?:\\/\\/[^\\s)]+)\\)/i);
-      if (!status && !score && !passed && !failed) return null;
-      return { status, score, passed, failed, violations, session, targetText, reportUrl };
-    };
-    const clearScanSummary = () => {
-      byId('resultCard').classList.add('hidden');
-      byId('resultStatus').textContent = 'READY';
-      byId('resultStatus').className = 'statusTag';
-      byId('resultScore').textContent = '-';
-      byId('resultPassed').textContent = '-';
-      byId('resultFailed').textContent = '-';
-      byId('resultViolations').textContent = '-';
-      byId('resultSession').textContent = '-';
-      byId('resultTarget').textContent = '-';
-      byId('resultMeta').innerHTML = '';
-    };
-    const setScanSummary = (summary) => {
-      if (!summary) return;
-      byId('resultCard').classList.remove('hidden');
-      const statusClass = summary.status === 'PASS' ? 'statusTag pass' : summary.status === 'FAIL' ? 'statusTag fail' : 'statusTag';
-      byId('resultStatus').className = statusClass;
-      byId('resultStatus').textContent = summary.status || 'COMPLETE';
-      byId('resultScore').textContent = summary.score || '-';
-      byId('resultPassed').textContent = summary.passed || '-';
-      byId('resultFailed').textContent = summary.failed || '-';
-      byId('resultViolations').textContent = summary.violations || '-';
-      byId('resultSession').textContent = summary.session || '-';
-      byId('resultTarget').textContent = summary.targetText ? summary.targetText.slice(0, 48) + (summary.targetText.length > 48 ? '…' : '') : '-';
-      byId('resultMeta').innerHTML = summary.reportUrl
-        ? 'Saved report: <a target="_blank" href="' + htmlEscape(summary.reportUrl) + '">' + htmlEscape(summary.reportUrl) + '</a>'
-        : 'No saved web report URL found in this output.';
-    };
-    const resetForNewScan = () => {
-      target = 'runner';
-      sync();
-      setStep(1);
-      byId('endpoint').value = '';
-      byId('postureUrl').value = '';
-      byId('postureMethod').value = 'POST';
-      byId('postureAuthType').value = 'none';
-      byId('postureToken').value = '';
-      byId('inputField').value = 'message';
-      byId('outputField').value = 'response';
-      byId('ragUrl').value = '';
-      byId('ragPath').value = '';
-      byId('ragInputField').value = 'query';
-      byId('ragOutputField').value = 'chunks';
-      byId('mcpUrl').value = '';
-      byId('mcpCommand').value = '';
-      byId('mcpArgs').value = '';
-      byId('mcpTool').value = 'all';
-      byId('runnerMcpUrl').value = '';
-      byId('runnerMcpCommand').value = '';
-      byId('runnerMcpArgs').value = '';
-      byId('runnerTool').value = '';
-      byId('runnerOperation').value = '';
-      byId('runnerToolArgs').value = '{\\n  "customerId": "RO-PB-10492"\\n}';
-      byId('mcpResultCard').classList.add('hidden');
-      byId('mcpResultJson').value = '';
-      byId('mcpResultTable').innerHTML = '';
-      byId('mode').value = 'quick';
-      byId('format').value = 'report';
-      clearScanSummary();
-      setConsole('Full Court Defense Local Web Console ready.\\n\\nChoose Run MCP Tool for one live tool call.\\nChoose Endpoint/RAG/MCP Scan for a local red-team scan.', 'Ready');
-    };
-    byId('command').onclick = () => { setConsole(renderCommand(payload()), 'Command'); };
-    byId('connectNext').onclick = () => setStep(2);
-    byId('backToConnect').onclick = () => setStep(1);
-    byId('scanTypeNext').onclick = () => setStep(3);
-    byId('newScan').onclick = () => resetForNewScan();
-    byId('toggleSetup').onclick = () => {
-      const panel = byId('setupPanel');
-      const hidden = panel.classList.contains('hidden');
-      panel.classList.toggle('hidden', !hidden);
-      byId('toggleSetup').textContent = hidden ? 'Hide Shield settings' : 'Change Shield settings';
-    };
-    byId('saveSetup').onclick = async () => {
-      byId('authStatus').textContent = 'Saving Shield settings...';
-      const res = await fetch('/auth/save', {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({
-          shieldId: byId('shieldId').value,
-          shieldKey: byId('shieldKey').value,
-          apiUrl: byId('apiUrl').value
-        })
-      });
-      const data = await res.json();
-      if (data.success) {
-        byId('authStatus').textContent = 'Connected to Shield ' + data.shieldId + '. Reports will save to Full Court Defense.';
-        byId('run').disabled = false;
-      } else {
-        byId('authStatus').textContent = data.error || 'Could not save Shield settings.';
-      }
-    };
-    const checkBackend = async () => {
-      byId('backendStatus').textContent = 'Checking outbound backend...';
-      const res = await fetch('/backend/check', {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({
-          shieldId: byId('shieldId').value,
-          shieldKey: byId('shieldKey').value,
-          apiUrl: byId('apiUrl').value
-        })
-      });
-      const data = await res.json();
-      if (data.ok) {
-        byId('backendStatus').textContent = 'Backend status: connected. Outbound scan/report traffic can reach Full Court Defense.';
-        byId('backendStatus').style.borderColor = '#bbf7d0';
-        byId('backendStatus').style.background = '#f0fdf4';
-        byId('backendStatus').style.color = '#166534';
-      } else {
-        byId('backendStatus').textContent = 'Backend status: not reachable. ' + (data.error || 'Check network/proxy/firewall/API URL.');
-        byId('backendStatus').style.borderColor = '#fecaca';
-        byId('backendStatus').style.background = '#fef2f2';
-        byId('backendStatus').style.color = '#991b1b';
-      }
-      return data.ok;
-    };
-    byId('checkBackend').onclick = checkBackend;
-    loadMcpServers();
-    checkBackend().catch(() => {});
-    function mcpRows(value) {
-      if (Array.isArray(value)) return value;
-      const content = value && value.content;
-      if (Array.isArray(content)) {
-        const textItem = content.find(item => item && typeof item.text === 'string');
-        if (textItem) {
-          try {
-            const parsed = JSON.parse(textItem.text);
-            if (Array.isArray(parsed)) return parsed;
-            if (parsed && Array.isArray(parsed.data)) return parsed.data;
-            if (parsed && Array.isArray(parsed.results)) return parsed.results;
-          } catch {}
-        }
-      }
-      if (value && Array.isArray(value.data)) return value.data;
-      if (value && Array.isArray(value.results)) return value.results;
-      return null;
-    }
-    function mcpText(value) {
-      if (value == null) return '';
-      if (typeof value === 'string') return value;
-      if (typeof value === 'number' || typeof value === 'boolean') return String(value);
-      const content = value.content;
-      if (Array.isArray(content)) {
-        return content
-          .map(item => item && typeof item.text === 'string' ? item.text : '')
-          .filter(Boolean)
-          .join('\\n');
-      }
-      return '';
-    }
-    function mcpObject(value) {
-      if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
-      const contentText = mcpText(value);
-      if (contentText) {
-        try {
-          const parsed = JSON.parse(contentText);
-          if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) return parsed;
-        } catch {}
-      }
-      if (value.data && typeof value.data === 'object' && !Array.isArray(value.data)) return value.data;
-      if (value.result && typeof value.result === 'object' && !Array.isArray(value.result)) return value.result;
-      return value;
-    }
-    function cellValue(value) {
-      if (value == null) return '';
-      if (typeof value === 'object') return JSON.stringify(value);
-      return String(value);
-    }
-    function renderObjectCards(obj) {
-      const preferred = ['id', 'customerId', 'name', 'title', 'status', 'plan', 'email', 'decision', 'matchedPolicy', 'reason', 'ok'];
-      const keys = Array.from(new Set([...preferred.filter(k => Object.prototype.hasOwnProperty.call(obj, k)), ...Object.keys(obj)])).slice(0, 12);
-      return '<div class="mcpCards">' + keys.map(k => '<div class="mcpCard"><b>' + htmlEscape(k) + '</b><span>' + htmlEscape(cellValue(obj[k])) + '</span></div>').join('') + '</div>';
-    }
-    function renderMcpTable(rows) {
-      const preferred = ['id', 'customerId', 'name', 'title', 'status', 'plan', 'email', 'createdAt', 'updatedAt'];
-      const keys = Array.from(new Set([...preferred.filter(k => rows.some(row => row && Object.prototype.hasOwnProperty.call(row, k))), ...rows.flatMap(row => Object.keys(row || {}))])).slice(0, 10);
-      return '<table class="localTable"><thead><tr>' + keys.map(k => '<th>' + htmlEscape(k) + '</th>').join('') + '</tr></thead><tbody>' +
-        rows.slice(0, 50).map(row => '<tr>' + keys.map(k => '<td>' + htmlEscape(cellValue(row[k])) + '</td>').join('') + '</tr>').join('') +
-        '</tbody></table>' +
-        (rows.length > 50 ? '<div class="resultMeta">Showing first 50 rows. Full result is in raw JSON below.</div>' : '');
-    }
-    function renderMcpResult(data) {
-      byId('mcpResultCard').classList.remove('hidden');
-      byId('mcpResultStatus').textContent = data.blocked ? 'BLOCKED' : data.success ? 'ALLOW / RESULT' : 'ERROR';
-      byId('mcpResultStatus').className = data.success ? 'statusTag pass' : 'statusTag fail';
-      byId('mcpResultJson').value = JSON.stringify(data, null, 2);
-      const rows = data.success ? mcpRows(data.result) : null;
-      if (rows && rows.length && rows.every(row => row && typeof row === 'object' && !Array.isArray(row))) {
-        byId('mcpResultTable').innerHTML = '<div class="mcpBanner ok"><b>Allowed.</b> Tool returned ' + rows.length + ' row(s).</div>' + renderMcpTable(rows);
-      } else if (data.success) {
-        const obj = mcpObject(data.result);
-        const text = mcpText(data.result);
-        byId('mcpResultTable').innerHTML = '<div class="mcpBanner ok"><b>Allowed.</b> Tool call completed through the configured MCP server/proxy.</div>' +
-          (obj ? renderObjectCards(obj) : '<div class="resultMeta">' + htmlEscape(text || 'Result is shown as raw JSON below.') + '</div>');
-      } else {
-        const blockedCopy = data.blocked
-          ? 'Blocked because a FullCourtDefense policy or local safety rule is defined for this tool/action.'
-          : 'The MCP call failed before a successful tool result was returned.';
-        byId('mcpResultTable').innerHTML = '<div class="mcpBanner blocked"><b>' + (data.blocked ? 'Blocked by policy.' : 'MCP error.') + '</b> ' + htmlEscape(blockedCopy) + '<br/><span>' + htmlEscape(data.reason || data.error || 'No reason returned.') + '</span></div>';
-      }
-    }
-    byId('copyMcpResult').onclick = async () => {
-      await navigator.clipboard?.writeText(byId('mcpResultJson').value || '').catch(() => undefined);
-      byId('copyMcpResult').textContent = 'Copied';
-      setTimeout(() => { byId('copyMcpResult').textContent = 'Copy result'; }, 1200);
-    };
-    byId('runMcpTool').onclick = async () => {
-      byId('runMcpTool').disabled = true;
-      byId('runMcpTool').textContent = 'Running...';
-      byId('mcpResultCard').classList.add('hidden');
-      setConsole('Calling MCP tool locally through configured proxy/server...\\n', 'Running MCP');
-      try {
-        const res = await fetch('/mcp/run', {
-          method: 'POST',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify(mcpRunnerPayload())
-        });
-        const data = await res.json();
-        renderMcpResult(data);
-        setConsole(JSON.stringify(data, null, 2), data.success ? 'MCP complete' : 'MCP blocked/error');
-      } catch (error) {
-        const data = { success: false, error: error && error.message ? error.message : String(error) };
-        renderMcpResult(data);
-        setConsole(JSON.stringify(data, null, 2), 'MCP error');
-      } finally {
-        byId('runMcpTool').disabled = false;
-        byId('runMcpTool').textContent = 'Run MCP tool';
-      }
-    };
-    byId('run').onclick = async () => {
-      if (byId('run').disabled) return;
-      byId('run').disabled = true;
-      byId('run').textContent = 'Running...';
-      clearScanSummary();
-      if (target === 'mcp-posture') {
-        try {
-          setConsole('Starting MCP Posture Scan...\\nNo MCP tools will be invoked; this only lists exposed tools.\\n', 'Running MCP posture');
-          const postureRes = await fetch('/mcp/posture', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload()) });
-          const postureData = await postureRes.json();
-          setConsole(JSON.stringify(postureData, null, 2), postureData.ok ? 'MCP posture complete' : 'MCP posture failed');
-        } catch (error) {
-          setConsole('MCP Posture Scan failed: ' + (error && error.message ? error.message : String(error)), 'MCP posture failed');
-        } finally {
-          byId('run').disabled = false;
-          byId('run').textContent = 'Run local scan';
-        }
-        return;
-      }
-      const backendOk = await checkBackend();
-      if (!backendOk) {
-        setConsole('Outbound backend check failed. Fix backend connectivity before scanning so verdicts and reports can be generated.', 'Blocked');
-        byId('run').disabled = false;
-        byId('run').textContent = 'Run local scan';
-        return;
-      }
-      if (target === 'posture') {
-        try {
-          setConsole('Starting Security Posture Scan...\\n', 'Running posture');
-          const postureRes = await fetch('/posture/run', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload()) });
-          const postureData = await postureRes.json();
-          setConsole(JSON.stringify(postureData, null, 2), postureData.ok ? 'Posture complete' : 'Posture failed');
-        } catch (error) {
-          setConsole('Security Posture Scan failed: ' + (error && error.message ? error.message : String(error)), 'Posture failed');
-        } finally {
-          byId('run').disabled = false;
-          byId('run').textContent = 'Run local scan';
-        }
-        return;
-      }
-      setConsole('Starting local red-team scan...\\n', 'Running');
-      const res = await fetch('/run', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload()) });
-      if (!res.body) {
-        const finalText = await res.text();
-        setConsole(finalText, 'Complete');
-        setScanSummary(parseScanSummary(finalText));
-        byId('run').disabled = false;
-        byId('run').textContent = 'Run local scan';
-        return;
-      }
-      const reader = res.body.getReader();
-      const decoder = new TextDecoder();
-      let text = '';
-      while (true) {
-        const next = await reader.read();
-        if (next.done) break;
-        text += decoder.decode(next.value, { stream: true });
-        setConsole(text, 'Running');
-      }
-      byId('consoleStatus').textContent = 'Complete';
-      setScanSummary(parseScanSummary(text));
-      byId('run').disabled = false;
-      byId('run').textContent = 'Run local scan';
-    };
-    function htmlEscape(s) { return s.replace(/[&<>"]/g, ch => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[ch])); }
-  </script>
-</body>
+        : 'Configure CLI once with fullcourtdefense configure, then run local scans. UI uses saved local config automatically.'}</p>
+        <div class="actions">
+          <button class="secondary" id="toggleSetup">Change Shield settings</button>
+          <button class="secondary" id="checkBackend">Check outbound backend</button>
+        </div>
+        <div id="setupPanel" class="hidden">
+          <div class="two">
+            <div><label>Shield ID</label><input id="shieldId" value="${htmlEscape(auth.shieldId || '')}" placeholder="sh_..." /></div>
+            <div><label>Shield key</label><input id="shieldKey" type="password" value="${htmlEscape(auth.shieldKey || '')}" placeholder="shsk_..." /></div>
+          </div>
+          <label>Backend API URL</label>
+          <input id="apiUrl" value="${htmlEscape(auth.apiUrl || DEFAULT_API_URL)}" placeholder="https://api.fullcourtdefense.ai" />
+          <div class="actions">
+            <button class="secondary" id="saveSetup">Save Shield settings</button>
+          </div>
+        </div>
+        <div class="note" id="backendStatus">Backend status: not checked yet.</div>
+      </div>
+      <div class="steps" id="scanSteps">
+        <div class="step active" id="step-dot-1">1. Connect target</div>
+        <div class="step" id="step-dot-2">2. Select scan type</div>
+        <div class="step" id="step-dot-3">3. Run red-team scan</div>
+      </div>
+      <div class="menuShell" id="cards">
+        <div class="menuGroup run">
+          <div class="menuLabel">Run, not a scan</div>
+          <button class="card workflowCard active" data-workflow="runner"><b>Run one MCP tool</b><span>Call exactly one local MCP tool through a direct server or protected gateway. Best for demos and policy checks.</span></button>
+        </div>
+        <div class="menuGroup">
+          <div class="menuLabel">Security scans</div>
+          <div class="landingScanGrid">
+            <button class="card workflowCard" data-workflow="bot"><b>Bot Scan</b><span>Red-team an internal bot, agent, or chat API.</span></button>
+            <button class="card workflowCard" data-workflow="posture"><b>Security Posture Scan</b><span>Run web-style endpoint security checkup.</span></button>
+            <button class="card workflowCard" data-workflow="mcp"><b>MCP Scan</b><span>Scan an MCP server or protected gateway for risky tool paths.</span></button>
+            <button class="card workflowCard" data-workflow="mcp-posture"><b>MCP Posture Scan</b><span>Inventory exposed MCP tools without invoking them.</span></button>
+          </div>
+        </div>
+        <div class="menuGroup">
+          <div class="menuLabel">Help</div>
+          <button class="card workflowCard" data-workflow="help"><b>Options</b><span>Modes, formats, and when to use each local workflow.</span></button>
+        </div>
+      </div>
+    </section>
+    <section class="panel hidden" id="workflowPanel">
+      <div id="step-1" class="stepSection">
+      <div class="sectionTitle">
+        <div>
+          <h2 id="connectTitle">Run MCP Tool</h2>
+          <div class="muted" id="connectSubtitle">Call one MCP tool from this machine. This is not a scan.</div>
+        </div>
+      </div>
+      <div id="runner-fields">
+        <div class="note">This is not a scan. It runs one MCP tool call from this machine. Use a protected proxy/gateway command to show policy decisions, or a direct local MCP server for raw tool testing.</div>
+        <label>Saved/protected MCP server</label>
+        <select id="runnerServer">
+          <option value="">Manual connection...</option>
+        </select>
+        <div class="two">
+          <div>
+            <label>Protected MCP HTTP/SSE URL</label>
+            <input id="runnerMcpUrl" placeholder="Optional: http://127.0.0.1:5066/mcp" />
+          </div>
+          <div>
+            <label>Tool name</label>
+            <input id="runnerTool" placeholder="Example: lookup_customer_profile" />
+          </div>
+        </div>
+        <div class="two">
+          <div>
+            <label>Operation/action override</label>
+            <input id="runnerOperation" placeholder="optional, e.g. read / write / delete / payment:write" />
+          </div>
+          <div>
+            <label>Why use this?</label>
+            <input value="Use when one tool supports multiple actions" readonly />
+          </div>
+        </div>
+        <div class="two">
+          <div><label>Or stdio command</label><input id="runnerMcpCommand" placeholder="node" /></div>
+          <div><label>Command args</label><input id="runnerMcpArgs" placeholder="C:\\path\\to\\mcp-server.js" /></div>
+        </div>
+        <label>Tool arguments JSON</label>
+        <textarea id="runnerToolArgs" spellcheck="false">{
+  "customerId": "RO-PB-10492"
+}</textarea>
+        <div class="actions">
+          <button class="primary" id="runMcpTool">Run MCP tool</button>
+          <button class="secondary" id="copyMcpResult">Copy result</button>
+        </div>
+        <div id="mcpResultCard" class="resultCard hidden">
+          <div class="resultHead">
+            <div class="resultTitle">MCP tool result</div>
+            <span id="mcpResultStatus" class="statusTag">READY</span>
+          </div>
+          <div id="mcpResultTable"></div>
+          <div class="copyBox">
+            <label>Copyable JSON</label>
+            <textarea id="mcpResultJson" spellcheck="false" readonly></textarea>
+          </div>
+        </div>
+      </div>
+      <div id="scan-picker" class="hidden">
+        <div class="note">Security scans run red-team templates locally from this machine. First choose what you want to test.</div>
+        <div class="scanTypeGrid">
+          <button class="card scanTypeCard active" data-target="endpoint"><b>Bot Scan</b><span>Red-team an internal bot, agent, or chat API with prompt-injection templates.</span></button>
+          <button class="card scanTypeCard" data-target="posture"><b>Security Posture Scan</b><span>Run the web-style checkup for HTTPS, headers, auth exposure, and endpoint posture.</span></button>
+        </div>
+        <div class="menuLabel">Advanced local targets</div>
+        <div class="advancedScanGrid">
+          <button class="card scanTypeCard" data-target="rag"><b>RAG Scan</b><span>Test retrieval URL or local corpus path.</span></button>
+          <button class="card scanTypeCard" data-target="mcp"><b>MCP Scan</b><span>Scan tool responses and tool-abuse paths.</span></button>
+          <button class="card scanTypeCard" data-target="mcp-posture"><b>MCP Posture Scan</b><span>List tools and flag risky exposed capabilities.</span></button>
+        </div>
+      </div>
+      <div id="endpoint-fields" class="hidden">
+        <label>Internal endpoint URL</label>
+        <input id="endpoint" placeholder="http://127.0.0.1:3000/chat" />
+        <div class="two">
+          <div><label>Request field</label><input id="inputField" value="message" /></div>
+          <div><label>Output field</label><input id="outputField" value="response" /></div>
+        </div>
+      </div>
+      <div id="posture-fields" class="hidden">
+        <div class="note">Security Posture Scan checks HTTP endpoint configuration, auth exposure, headers, transport, and operational security signals. To test MCP tools, choose MCP Scan from the Security Scans cards.</div>
+        <div class="two">
+          <div>
+            <label>AI endpoint URL</label>
+            <input id="postureUrl" placeholder="https://your-ai-endpoint.com/api/chat" />
+          </div>
+          <div>
+            <label>HTTP method</label>
+            <select id="postureMethod"><option value="POST" selected>POST</option><option value="GET">GET</option></select>
+          </div>
+        </div>
+        <div class="two">
+          <div>
+            <label>Auth type</label>
+            <select id="postureAuthType"><option value="none" selected>No Auth</option><option value="bearer">Bearer Token</option><option value="api-key">API Key</option></select>
+          </div>
+          <div>
+            <label>Token / API key value</label>
+            <input id="postureToken" type="password" placeholder="Optional" />
+          </div>
+        </div>
+      </div>
+      <div id="rag-fields" class="hidden">
+        <label>RAG retrieval URL</label>
+        <input id="ragUrl" placeholder="http://127.0.0.1:8787/rag/retrieve" />
+        <div class="two">
+          <div><label>RAG request field</label><input id="ragInputField" value="query" /></div>
+          <div><label>RAG output field</label><input id="ragOutputField" value="chunks" /></div>
+        </div>
+        <label>Or local corpus path</label>
+        <input id="ragPath" placeholder="C:\\company\\docs" />
+      </div>
+      <div id="mcp-fields" class="hidden">
+        <div class="note" id="mcpModeNote">MCP Scan runs red-team templates against MCP tool behavior. MCP Posture Scan lists exposed tools and flags risky capabilities without invoking them.</div>
+        <div class="two">
+          <div><label>MCP HTTP/SSE URL</label><input id="mcpUrl" placeholder="http://127.0.0.1:5066/mcp" /></div>
+          <div><label>MCP tool</label><input id="mcpTool" value="all" /></div>
+        </div>
+        <div class="two">
+          <div><label>Or stdio command</label><input id="mcpCommand" placeholder="node" /></div>
+          <div><label>Command args</label><input id="mcpArgs" placeholder=".\\server.js" /></div>
+        </div>
+      </div>
+      <div id="help-fields" class="hidden">
+        <div class="note">Use Run MCP Tool for one live tool call. Use Endpoint, RAG, or MCP Scan for red-team testing. Scan reports save back to the normal web report history when a Shield key is configured.</div>
+      </div>
+      <div class="actions" id="scanActions">
+        <button class="secondary" id="command">Show CLI command</button>
+        <button class="primary" id="connectNext">Continue to scan type</button>
+      </div>
+      </div>
+      <div id="step-2" class="stepSection hidden">
+      <div class="sectionTitle">
+        <div>
+          <h2>Select scan type</h2>
+          <div class="muted">Same scan modes as web red-team scanning.</div>
+        </div>
+      </div>
+      <div class="two">
+        <div>
+          <label>Scan mode</label>
+          <select id="mode"><option value="quick" selected>Quick</option><option value="full">Full</option><option value="targeted">Targeted</option><option value="deep">Deep</option></select>
+        </div>
+        <div>
+          <label>Output format</label>
+          <select id="format"><option value="summary">Summary</option><option value="report" selected>Report</option><option value="full-report">Full report</option><option value="json">JSON</option></select>
+        </div>
+      </div>
+      <div class="note">Quick runs 20 critical/high templates. Full runs the full bundled web attack corpus. Targeted adds your target context.</div>
+      <div class="actions">
+        <button class="secondary" id="backToConnect">Back</button>
+        <button class="primary" id="scanTypeNext">Continue to scan</button>
+      </div>
+      </div>
+      <div id="step-3" class="stepSection hidden">
+      <div class="sectionTitle">
+        <div>
+          <h2>Run red-team scan</h2>
+          <div class="muted">The scan executes locally and saves a report through our backend.</div>
+        </div>
+      </div>
+      <div class="actions">
+        <button class="primary" id="run" ${isConfigured ? '' : 'disabled'}>Run local scan</button>
+        <button class="secondary" id="newScan">New scan</button>
+      </div>
+      <div class="note">This page only listens on 127.0.0.1. It can reach localhost/VPN targets because it runs from your machine.</div>
+      <div id="resultCard" class="resultCard hidden">
+        <div class="resultHead">
+          <div class="resultTitle">Scan result</div>
+          <span id="resultStatus" class="statusTag">READY</span>
+        </div>
+        <div class="resultGrid">
+          <div class="resultMetric"><b>Score</b><span id="resultScore">-</span></div>
+          <div class="resultMetric"><b>Passed</b><span id="resultPassed">-</span></div>
+          <div class="resultMetric"><b>Failed</b><span id="resultFailed">-</span></div>
+          <div class="resultMetric"><b>Violations</b><span id="resultViolations">-</span></div>
+          <div class="resultMetric"><b>Session</b><span id="resultSession">-</span></div>
+          <div class="resultMetric"><b>Target</b><span id="resultTarget">-</span></div>
+        </div>
+        <div class="resultMeta" id="resultMeta"></div>
+      </div>
+      <div class="console">
+        <div class="consoleHead">
+          <b>Red-team console</b>
+          <span class="pill" id="consoleStatus">Ready</span>
+        </div>
+        <pre id="out">Full Court Defense Local Web Console ready.
+Choose Run MCP Tool for one live tool call.
+Choose Endpoint/RAG/MCP Scan for a local red-team scan.
+Local targets stay on this machine; saved scan reports go to Full Court Defense.</pre>
+      </div>
+      </div>
+    </section>
+  </main>
+  <script>
+    const scanTargets = ['endpoint','posture','rag','mcp','mcp-posture'];
+    let target = 'home';
+    let step = 1;
+    const qs = new URLSearchParams(location.search);
+    if (['runner','endpoint','posture','rag','mcp','mcp-posture','help'].includes(qs.get('target'))) target = qs.get('target');
+    const byId = id => document.getElementById(id);
+    const workflow = () => target === 'endpoint' ? 'bot' : target === 'posture' ? 'posture' : target === 'home' ? '' : target;
+    const sync = () => {
+      document.querySelectorAll('.workflowCard').forEach(c => c.classList.toggle('active', c.dataset.workflow === workflow()));
+      document.querySelectorAll('.scanTypeCard').forEach(c => c.classList.toggle('active', c.dataset.target === target));
+      byId('workflowPanel').classList.toggle('hidden', target === 'home');
+      ['runner','endpoint','posture','rag','mcp','help'].forEach(id => {
+        const show = id === 'mcp' ? ['mcp','mcp-posture'].includes(target) : id === target;
+        byId(id + '-fields').classList.toggle('hidden', !show);
+      });
+      const scanTarget = scanTargets.includes(target);
+      byId('mcpModeNote').textContent = target === 'mcp-posture'
+        ? 'MCP Posture Scan lists exposed tools, checks whether the server appears protected, and flags risky capabilities without invoking any tool.'
+        : 'MCP Scan runs red-team templates against MCP tool behavior. Use MCP Posture Scan for inventory-only posture.';
+      byId('scan-picker').classList.toggle('hidden', !scanTarget);
+      byId('scanSteps').classList.toggle('hidden', !scanTarget);
+      byId('scanActions').classList.toggle('hidden', !scanTarget);
+      byId('connectTitle').textContent = target === 'runner'
+        ? 'Run MCP Tool'
+        : target === 'help'
+          ? 'Local workflow options'
+          : target === 'mcp-posture'
+            ? 'MCP posture scan'
+            : 'Choose scan target';
+      byId('connectSubtitle').textContent = target === 'runner'
+        ? 'Call one MCP tool from this machine. This is not a scan.'
+        : target === 'help'
+          ? 'Choose one-off tool run or local red-team scan.'
+          : target === 'mcp-posture'
+            ? 'Connect an MCP server or protected gateway. No tools are invoked.'
+            : 'Select Endpoint, RAG, or MCP, then connect the internal target.';
+      if (!scanTarget || target === 'home') setStep(1);
+    };
+    const setStep = next => {
+      step = next;
+      [1,2,3].forEach(n => {
+        byId('step-' + n).classList.toggle('hidden', n !== step);
+        byId('step-dot-' + n).classList.toggle('active', n === step);
+        byId('step-dot-' + n).classList.toggle('done', n < step);
+      });
+    };
+    document.querySelectorAll('.workflowCard').forEach(c => c.onclick = () => {
+      target = c.dataset.workflow === 'bot' ? 'endpoint' : c.dataset.workflow;
+      sync();
+      byId('workflowPanel').scrollIntoView({ behavior: 'smooth', block: 'start' });
+    });
+    document.querySelectorAll('.scanTypeCard').forEach(c => c.onclick = () => {
+      target = c.dataset.target;
+      sync();
+    });
+    sync();
+    byId('ragUrl').value = qs.get('ragUrl') || '';
+    byId('ragPath').value = qs.get('ragPath') || '';
+    byId('endpoint').value = qs.get('endpoint') || '';
+    byId('mcpUrl').value = qs.get('mcpUrl') || '';
+    byId('mcpCommand').value = qs.get('mcpCommand') || '';
+    byId('mcpArgs').value = qs.get('mcpArgs') || '';
+    byId('runnerMcpUrl').value = qs.get('mcpUrl') || '';
+    byId('runnerMcpCommand').value = qs.get('mcpCommand') || '';
+    byId('runnerMcpArgs').value = qs.get('mcpArgs') || '';
+    byId('runnerTool').value = qs.get('mcpTool') || '';
+    byId('runnerOperation').value = qs.get('operation') || '';
+    const payload = () => ({
+      target, mode: byId('mode').value, format: byId('format').value,
+      endpoint: byId('endpoint').value, inputField: byId('inputField').value, outputField: byId('outputField').value,
+      postureUrl: byId('postureUrl').value, postureMethod: byId('postureMethod').value, postureAuthType: byId('postureAuthType').value, postureToken: byId('postureToken').value,
+      ragUrl: byId('ragUrl').value, ragPath: byId('ragPath').value, ragInputField: byId('ragInputField').value, ragOutputField: byId('ragOutputField').value,
+      mcpUrl: byId('mcpUrl').value, mcpCommand: byId('mcpCommand').value, mcpArgs: byId('mcpArgs').value, mcpTool: byId('mcpTool').value
+    });
+    const mcpRunnerPayload = () => ({
+      mcpUrl: byId('runnerMcpUrl').value,
+      mcpCommand: byId('runnerMcpCommand').value,
+      mcpArgs: byId('runnerMcpArgs').value,
+      toolName: byId('runnerTool').value,
+      operation: byId('runnerOperation').value,
+      toolArgs: byId('runnerToolArgs').value
+    });
+    async function loadMcpServers() {
+      try {
+        const res = await fetch('/mcp/servers');
+        const data = await res.json();
+        const select = byId('runnerServer');
+        const options = data.servers || [];
+        select.innerHTML = '<option value="">Manual connection...</option>' + options.map((server, index) =>
+          '<option value="' + index + '">' + htmlEscape((server.protected ? 'Protected: ' : 'Direct: ') + server.name + ' - ' + server.source + (server.agentName ? ' - ' + server.agentName : '')) + '</option>'
+        ).join('');
+        select.onchange = () => {
+          const server = options[Number(select.value)];
+          if (!server) return;
+          byId('runnerMcpUrl').value = '';
+          byId('runnerMcpCommand').value = server.command || '';
+          byId('runnerMcpArgs').value = Array.isArray(server.args) ? server.args.map(part => /\\s/.test(part) ? JSON.stringify(part) : part).join(' ') : '';
+          setConsole('Loaded saved MCP server: ' + server.name + '\\n' + (server.protected ? 'This entry is already routed through FullCourtDefense gateway.' : 'Direct MCP entry. Wrap it with protect-all for policy enforcement.'), 'Server loaded');
+        };
+      } catch {
+        // Local server picker is convenience only; manual fields still work.
+      }
+    }
+    const renderCommand = p => {
+      const parts = ['fullcourtdefense scan --local --type', p.target, '--mode', p.mode, '--format', p.format, '--no-open'];
+      if (p.target === 'endpoint') parts.push('--endpoint', JSON.stringify(p.endpoint), '--method POST --request-format custom --input-field', p.inputField || 'message', '--output-field', p.outputField || 'response');
+      if (p.target === 'posture') return 'Security Posture Scan runs through this local web UI and calls the Full Court Defense posture checkup API for ' + (p.postureUrl || '<endpoint-url>');
+      if (p.target === 'rag') { if (p.ragUrl) parts.push('--rag-url', JSON.stringify(p.ragUrl), '--method POST --request-format custom --input-field', p.ragInputField || 'query', '--output-field', p.ragOutputField || 'chunks'); else parts.push('--rag-path', JSON.stringify(p.ragPath || '.\\\\docs')); }
+      if (p.target === 'mcp-posture') return 'MCP Posture Scan runs through this local web UI and inventories exposed tools for ' + (p.mcpUrl || ((p.mcpCommand || 'node') + ' ' + (p.mcpArgs || '.\\\\server.js')));
+      if (p.target === 'mcp') { if (p.mcpUrl) parts.push('--mcp-url', JSON.stringify(p.mcpUrl)); else parts.push('--mcp-command', p.mcpCommand || 'node', '--mcp-args', JSON.stringify(p.mcpArgs || '.\\\\server.js')); parts.push('--mcp-tool', p.mcpTool || 'all'); }
+      return parts.join(' ');
+    };
+    const setConsole = (value, status) => {
+      byId('out').innerHTML = htmlEscape(value).replace(/(https?:\\/\\/[^\\s)]+)/g, '<a style="color:#93c5fd" href="$1" target="_blank">$1</a>');
+      byId('out').scrollTop = byId('out').scrollHeight;
+      if (status) byId('consoleStatus').textContent = status;
+    };
+    const parseScanSummary = (text) => {
+      const match = (regex) => (text.match(regex)?.[1] || '').trim();
+      const status = match(/Status:\\s*(PASS|FAIL)/i).toUpperCase();
+      const score = match(/Score:\\s*(\\d+\\/?100?)/i) || match(/Score:\\s*(\\d+)/i);
+      const passed = match(/Passed:\\s*(\\d+)/i);
+      const failed = match(/Failed:\\s*(\\d+)/i);
+      const violations = match(/Violations:\\s*(\\d+)/i);
+      const session = match(/Session:\\s*([^\\n]+)/i);
+      const targetText = match(/Target:\\s*([^\\n]+)/i);
+      const reportUrl = match(/Web report:\\s*(https?:\\/\\/[^\\s]+)/i) || match(/Saved web report [^\\(]*\\((https?:\\/\\/[^\\s)]+)\\)/i);
+      if (!status && !score && !passed && !failed) return null;
+      return { status, score, passed, failed, violations, session, targetText, reportUrl };
+    };
+    const clearScanSummary = () => {
+      byId('resultCard').classList.add('hidden');
+      byId('resultStatus').textContent = 'READY';
+      byId('resultStatus').className = 'statusTag';
+      byId('resultScore').textContent = '-';
+      byId('resultPassed').textContent = '-';
+      byId('resultFailed').textContent = '-';
+      byId('resultViolations').textContent = '-';
+      byId('resultSession').textContent = '-';
+      byId('resultTarget').textContent = '-';
+      byId('resultMeta').innerHTML = '';
+    };
+    const setScanSummary = (summary) => {
+      if (!summary) return;
+      byId('resultCard').classList.remove('hidden');
+      const statusClass = summary.status === 'PASS' ? 'statusTag pass' : summary.status === 'FAIL' ? 'statusTag fail' : 'statusTag';
+      byId('resultStatus').className = statusClass;
+      byId('resultStatus').textContent = summary.status || 'COMPLETE';
+      byId('resultScore').textContent = summary.score || '-';
+      byId('resultPassed').textContent = summary.passed || '-';
+      byId('resultFailed').textContent = summary.failed || '-';
+      byId('resultViolations').textContent = summary.violations || '-';
+      byId('resultSession').textContent = summary.session || '-';
+      byId('resultTarget').textContent = summary.targetText ? summary.targetText.slice(0, 48) + (summary.targetText.length > 48 ? '…' : '') : '-';
+      byId('resultMeta').innerHTML = summary.reportUrl
+        ? 'Saved report: <a target="_blank" href="' + htmlEscape(summary.reportUrl) + '">' + htmlEscape(summary.reportUrl) + '</a>'
+        : 'No saved web report URL found in this output.';
+    };
+    const resetForNewScan = () => {
+      target = 'runner';
+      sync();
+      setStep(1);
+      byId('endpoint').value = '';
+      byId('postureUrl').value = '';
+      byId('postureMethod').value = 'POST';
+      byId('postureAuthType').value = 'none';
+      byId('postureToken').value = '';
+      byId('inputField').value = 'message';
+      byId('outputField').value = 'response';
+      byId('ragUrl').value = '';
+      byId('ragPath').value = '';
+      byId('ragInputField').value = 'query';
+      byId('ragOutputField').value = 'chunks';
+      byId('mcpUrl').value = '';
+      byId('mcpCommand').value = '';
+      byId('mcpArgs').value = '';
+      byId('mcpTool').value = 'all';
+      byId('runnerMcpUrl').value = '';
+      byId('runnerMcpCommand').value = '';
+      byId('runnerMcpArgs').value = '';
+      byId('runnerTool').value = '';
+      byId('runnerOperation').value = '';
+      byId('runnerToolArgs').value = '{\\n  "customerId": "RO-PB-10492"\\n}';
+      byId('mcpResultCard').classList.add('hidden');
+      byId('mcpResultJson').value = '';
+      byId('mcpResultTable').innerHTML = '';
+      byId('mode').value = 'quick';
+      byId('format').value = 'report';
+      clearScanSummary();
+      setConsole('Full Court Defense Local Web Console ready.\\n\\nChoose Run MCP Tool for one live tool call.\\nChoose Endpoint/RAG/MCP Scan for a local red-team scan.', 'Ready');
+    };
+    byId('command').onclick = () => { setConsole(renderCommand(payload()), 'Command'); };
+    byId('connectNext').onclick = () => setStep(2);
+    byId('backToConnect').onclick = () => setStep(1);
+    byId('scanTypeNext').onclick = () => setStep(3);
+    byId('newScan').onclick = () => resetForNewScan();
+    byId('toggleSetup').onclick = () => {
+      const panel = byId('setupPanel');
+      const hidden = panel.classList.contains('hidden');
+      panel.classList.toggle('hidden', !hidden);
+      byId('toggleSetup').textContent = hidden ? 'Hide Shield settings' : 'Change Shield settings';
+    };
+    byId('saveSetup').onclick = async () => {
+      byId('authStatus').textContent = 'Saving Shield settings...';
+      const res = await fetch('/auth/save', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          shieldId: byId('shieldId').value,
+          shieldKey: byId('shieldKey').value,
+          apiUrl: byId('apiUrl').value
+        })
+      });
+      const data = await res.json();
+      if (data.success) {
+        byId('authStatus').textContent = 'Connected to Shield ' + data.shieldId + '. Reports will save to Full Court Defense.';
+        byId('run').disabled = false;
+      } else {
+        byId('authStatus').textContent = data.error || 'Could not save Shield settings.';
+      }
+    };
+    const checkBackend = async () => {
+      byId('backendStatus').textContent = 'Checking outbound backend...';
+      const res = await fetch('/backend/check', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          shieldId: byId('shieldId').value,
+          shieldKey: byId('shieldKey').value,
+          apiUrl: byId('apiUrl').value
+        })
+      });
+      const data = await res.json();
+      if (data.ok) {
+        byId('backendStatus').textContent = 'Backend status: connected. Outbound scan/report traffic can reach Full Court Defense.';
+        byId('backendStatus').style.borderColor = '#bbf7d0';
+        byId('backendStatus').style.background = '#f0fdf4';
+        byId('backendStatus').style.color = '#166534';
+      } else {
+        byId('backendStatus').textContent = 'Backend status: not reachable. ' + (data.error || 'Check network/proxy/firewall/API URL.');
+        byId('backendStatus').style.borderColor = '#fecaca';
+        byId('backendStatus').style.background = '#fef2f2';
+        byId('backendStatus').style.color = '#991b1b';
+      }
+      return data.ok;
+    };
+    byId('checkBackend').onclick = checkBackend;
+    loadMcpServers();
+    checkBackend().catch(() => {});
+    function mcpRows(value) {
+      if (Array.isArray(value)) return value;
+      const content = value && value.content;
+      if (Array.isArray(content)) {
+        const textItem = content.find(item => item && typeof item.text === 'string');
+        if (textItem) {
+          try {
+            const parsed = JSON.parse(textItem.text);
+            if (Array.isArray(parsed)) return parsed;
+            if (parsed && Array.isArray(parsed.data)) return parsed.data;
+            if (parsed && Array.isArray(parsed.results)) return parsed.results;
+          } catch {}
+        }
+      }
+      if (value && Array.isArray(value.data)) return value.data;
+      if (value && Array.isArray(value.results)) return value.results;
+      return null;
+    }
+    function mcpText(value) {
+      if (value == null) return '';
+      if (typeof value === 'string') return value;
+      if (typeof value === 'number' || typeof value === 'boolean') return String(value);
+      const content = value.content;
+      if (Array.isArray(content)) {
+        return content
+          .map(item => item && typeof item.text === 'string' ? item.text : '')
+          .filter(Boolean)
+          .join('\\n');
+      }
+      return '';
+    }
+    function mcpObject(value) {
+      if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+      const contentText = mcpText(value);
+      if (contentText) {
+        try {
+          const parsed = JSON.parse(contentText);
+          if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) return parsed;
+        } catch {}
+      }
+      if (value.data && typeof value.data === 'object' && !Array.isArray(value.data)) return value.data;
+      if (value.result && typeof value.result === 'object' && !Array.isArray(value.result)) return value.result;
+      return value;
+    }
+    function cellValue(value) {
+      if (value == null) return '';
+      if (typeof value === 'object') return JSON.stringify(value);
+      return String(value);
+    }
+    function renderObjectCards(obj) {
+      const preferred = ['id', 'customerId', 'name', 'title', 'status', 'plan', 'email', 'decision', 'matchedPolicy', 'reason', 'ok'];
+      const keys = Array.from(new Set([...preferred.filter(k => Object.prototype.hasOwnProperty.call(obj, k)), ...Object.keys(obj)])).slice(0, 12);
+      return '<div class="mcpCards">' + keys.map(k => '<div class="mcpCard"><b>' + htmlEscape(k) + '</b><span>' + htmlEscape(cellValue(obj[k])) + '</span></div>').join('') + '</div>';
+    }
+    function renderMcpTable(rows) {
+      const preferred = ['id', 'customerId', 'name', 'title', 'status', 'plan', 'email', 'createdAt', 'updatedAt'];
+      const keys = Array.from(new Set([...preferred.filter(k => rows.some(row => row && Object.prototype.hasOwnProperty.call(row, k))), ...rows.flatMap(row => Object.keys(row || {}))])).slice(0, 10);
+      return '<table class="localTable"><thead><tr>' + keys.map(k => '<th>' + htmlEscape(k) + '</th>').join('') + '</tr></thead><tbody>' +
+        rows.slice(0, 50).map(row => '<tr>' + keys.map(k => '<td>' + htmlEscape(cellValue(row[k])) + '</td>').join('') + '</tr>').join('') +
+        '</tbody></table>' +
+        (rows.length > 50 ? '<div class="resultMeta">Showing first 50 rows. Full result is in raw JSON below.</div>' : '');
+    }
+    function renderMcpResult(data) {
+      byId('mcpResultCard').classList.remove('hidden');
+      byId('mcpResultStatus').textContent = data.blocked ? 'BLOCKED' : data.success ? 'ALLOW / RESULT' : 'ERROR';
+      byId('mcpResultStatus').className = data.success ? 'statusTag pass' : 'statusTag fail';
+      byId('mcpResultJson').value = JSON.stringify(data, null, 2);
+      const rows = data.success ? mcpRows(data.result) : null;
+      if (rows && rows.length && rows.every(row => row && typeof row === 'object' && !Array.isArray(row))) {
+        byId('mcpResultTable').innerHTML = '<div class="mcpBanner ok"><b>Allowed.</b> Tool returned ' + rows.length + ' row(s).</div>' + renderMcpTable(rows);
+      } else if (data.success) {
+        const obj = mcpObject(data.result);
+        const text = mcpText(data.result);
+        byId('mcpResultTable').innerHTML = '<div class="mcpBanner ok"><b>Allowed.</b> Tool call completed through the configured MCP server/proxy.</div>' +
+          (obj ? renderObjectCards(obj) : '<div class="resultMeta">' + htmlEscape(text || 'Result is shown as raw JSON below.') + '</div>');
+      } else {
+        const blockedCopy = data.blocked
+          ? 'Blocked because a FullCourtDefense policy or local safety rule is defined for this tool/action.'
+          : 'The MCP call failed before a successful tool result was returned.';
+        byId('mcpResultTable').innerHTML = '<div class="mcpBanner blocked"><b>' + (data.blocked ? 'Blocked by policy.' : 'MCP error.') + '</b> ' + htmlEscape(blockedCopy) + '<br/><span>' + htmlEscape(data.reason || data.error || 'No reason returned.') + '</span></div>';
+      }
+    }
+    byId('copyMcpResult').onclick = async () => {
+      await navigator.clipboard?.writeText(byId('mcpResultJson').value || '').catch(() => undefined);
+      byId('copyMcpResult').textContent = 'Copied';
+      setTimeout(() => { byId('copyMcpResult').textContent = 'Copy result'; }, 1200);
+    };
+    byId('runMcpTool').onclick = async () => {
+      byId('runMcpTool').disabled = true;
+      byId('runMcpTool').textContent = 'Running...';
+      byId('mcpResultCard').classList.add('hidden');
+      setConsole('Calling MCP tool locally through configured proxy/server...\\n', 'Running MCP');
+      try {
+        const res = await fetch('/mcp/run', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(mcpRunnerPayload())
+        });
+        const data = await res.json();
+        renderMcpResult(data);
+        setConsole(JSON.stringify(data, null, 2), data.success ? 'MCP complete' : 'MCP blocked/error');
+      } catch (error) {
+        const data = { success: false, error: error && error.message ? error.message : String(error) };
+        renderMcpResult(data);
+        setConsole(JSON.stringify(data, null, 2), 'MCP error');
+      } finally {
+        byId('runMcpTool').disabled = false;
+        byId('runMcpTool').textContent = 'Run MCP tool';
+      }
+    };
+    byId('run').onclick = async () => {
+      if (byId('run').disabled) return;
+      byId('run').disabled = true;
+      byId('run').textContent = 'Running...';
+      clearScanSummary();
+      if (target === 'mcp-posture') {
+        try {
+          setConsole('Starting MCP Posture Scan...\\nNo MCP tools will be invoked; this only lists exposed tools.\\n', 'Running MCP posture');
+          const postureRes = await fetch('/mcp/posture', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload()) });
+          const postureData = await postureRes.json();
+          setConsole(JSON.stringify(postureData, null, 2), postureData.ok ? 'MCP posture complete' : 'MCP posture failed');
+        } catch (error) {
+          setConsole('MCP Posture Scan failed: ' + (error && error.message ? error.message : String(error)), 'MCP posture failed');
+        } finally {
+          byId('run').disabled = false;
+          byId('run').textContent = 'Run local scan';
+        }
+        return;
+      }
+      const backendOk = await checkBackend();
+      if (!backendOk) {
+        setConsole('Outbound backend check failed. Fix backend connectivity before scanning so verdicts and reports can be generated.', 'Blocked');
+        byId('run').disabled = false;
+        byId('run').textContent = 'Run local scan';
+        return;
+      }
+      if (target === 'posture') {
+        try {
+          setConsole('Starting Security Posture Scan...\\n', 'Running posture');
+          const postureRes = await fetch('/posture/run', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload()) });
+          const postureData = await postureRes.json();
+          setConsole(JSON.stringify(postureData, null, 2), postureData.ok ? 'Posture complete' : 'Posture failed');
+        } catch (error) {
+          setConsole('Security Posture Scan failed: ' + (error && error.message ? error.message : String(error)), 'Posture failed');
+        } finally {
+          byId('run').disabled = false;
+          byId('run').textContent = 'Run local scan';
+        }
+        return;
+      }
+      setConsole('Starting local red-team scan...\\n', 'Running');
+      const res = await fetch('/run', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload()) });
+      if (!res.body) {
+        const finalText = await res.text();
+        setConsole(finalText, 'Complete');
+        setScanSummary(parseScanSummary(finalText));
+        byId('run').disabled = false;
+        byId('run').textContent = 'Run local scan';
+        return;
+      }
+      const reader = res.body.getReader();
+      const decoder = new TextDecoder();
+      let text = '';
+      while (true) {
+        const next = await reader.read();
+        if (next.done) break;
+        text += decoder.decode(next.value, { stream: true });
+        setConsole(text, 'Running');
+      }
+      byId('consoleStatus').textContent = 'Complete';
+      setScanSummary(parseScanSummary(text));
+      byId('run').disabled = false;
+      byId('run').textContent = 'Run local scan';
+    };
+    function htmlEscape(s) { return s.replace(/[&<>"]/g, ch => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[ch])); }
+  </script>
+</body>
 </html>`;
 }
 async function readRequestBody(req) {