mcp-context-cost 0.11.0 → 0.11.1

package/dist/cli.d.ts

@@ -27,3 +27,30 @@ export declare function unknownFlags(argv: string[], spec: {
     value: string[];
     boolean: string[];
 }): string[];
+/**
+ * Every value a value-taking flag was given, in either accepted spelling:
+ * `--flag value` and `--flag=value`.
+ *
+ * Both forms are read here because reading only one of them is the same bug as
+ * ignoring an unknown flag. `--max-increase=100` was accepted by
+ * `unknownFlags` (which splits on `=`) and then invisible to a reader that only
+ * matched the bare token, so the gate it asked for silently did not run and the
+ * command exited 0 — a green check on a check that never happened.
+ */
+export declare function flagValues(argv: string[], name: string): string[];
+/** The last value given for a flag, or undefined when the flag is absent. */
+export declare function flagValue(argv: string[], name: string): string | undefined;
+/**
+ * Value-taking flags that appear with no usable value.
+ *
+ * A flag present without its value is a *usage error*, never an absent flag.
+ * `--max-increase` as the last argument — what a CI template renders when its
+ * variable is empty — otherwise reads as "no gate was asked for", and the run
+ * exits 0 on a change that should have failed it. That is the same green-check
+ * failure `unknownFlags` exists to prevent, reached through a different door,
+ * so it is refused in the same place and with the same severity.
+ */
+export declare function valuelessFlags(argv: string[], spec: {
+    value: string[];
+    boolean: string[];
+}): string[];

package/dist/cli.js

@@ -85,16 +85,87 @@ export function unknownFlags(argv, spec) {
     }
     return unknown;
 }
+/**
+ * Every value a value-taking flag was given, in either accepted spelling:
+ * `--flag value` and `--flag=value`.
+ *
+ * Both forms are read here because reading only one of them is the same bug as
+ * ignoring an unknown flag. `--max-increase=100` was accepted by
+ * `unknownFlags` (which splits on `=`) and then invisible to a reader that only
+ * matched the bare token, so the gate it asked for silently did not run and the
+ * command exited 0 — a green check on a check that never happened.
+ */
+export function flagValues(argv, name) {
+    const out = [];
+    for (let i = 0; i < argv.length; i++) {
+        const tok = argv[i];
+        if (tok === `--${name}`) {
+            const next = argv[i + 1];
+            // A following flag is not this flag's value; that case is a usage error,
+            // caught by `valuelessFlags`, and must not be read as a value here.
+            if (next !== undefined && !next.startsWith('--'))
+                out.push(next);
+            continue;
+        }
+        if (tok.startsWith(`--${name}=`))
+            out.push(tok.slice(name.length + 3));
+    }
+    return out;
+}
+/** The last value given for a flag, or undefined when the flag is absent. */
+export function flagValue(argv, name) {
+    const values = flagValues(argv, name);
+    return values.length ? values[values.length - 1] : undefined;
+}
+/**
+ * Value-taking flags that appear with no usable value.
+ *
+ * A flag present without its value is a *usage error*, never an absent flag.
+ * `--max-increase` as the last argument — what a CI template renders when its
+ * variable is empty — otherwise reads as "no gate was asked for", and the run
+ * exits 0 on a change that should have failed it. That is the same green-check
+ * failure `unknownFlags` exists to prevent, reached through a different door,
+ * so it is refused in the same place and with the same severity.
+ */
+export function valuelessFlags(argv, spec) {
+    const bad = [];
+    for (let i = 0; i < argv.length; i++) {
+        const tok = argv[i];
+        if (!tok.startsWith('--'))
+            continue;
+        const name = tok.slice(2).split('=')[0];
+        if (!spec.value.includes(name))
+            continue;
+        if (tok.includes('=')) {
+            if (tok.slice(name.length + 3) === '')
+                bad.push(`--${name}`);
+            continue;
+        }
+        const next = argv[i + 1];
+        if (next === undefined || next.startsWith('--'))
+            bad.push(`--${name}`);
+        else
+            i++; // consume the value, so `--command "--weird"` is not re-read as a flag
+    }
+    return bad;
+}
 function rejectUnknownFlags(cmd, argv, spec) {
     const bad = unknownFlags(argv, spec);
-    if (!bad.length)
-        return;
-    const all = [...spec.value, ...spec.boolean].sort().map((f) => `--${f}`).join(' ');
-    console.error(`unknown flag for \`${cmd}\`: ${bad.join(', ')}`);
-    console.error(`this is mcp-context-cost ${cliVersion()} — if you copied the command from the README,`);
-    console.error(`your install may be older than the docs. Try: npx -y mcp-context-cost@latest ${cmd} ...`);
-    console.error(`known flags for ${cmd}: ${all}`);
-    process.exit(2);
+    if (bad.length) {
+        const all = [...spec.value, ...spec.boolean].sort().map((f) => `--${f}`).join(' ');
+        console.error(`unknown flag for \`${cmd}\`: ${bad.join(', ')}`);
+        console.error(`this is mcp-context-cost ${cliVersion()} — if you copied the command from the README,`);
+        console.error(`your install may be older than the docs. Try: npx -y mcp-context-cost@latest ${cmd} ...`);
+        console.error(`known flags for ${cmd}: ${all}`);
+        process.exit(2);
+    }
+    const empty = valuelessFlags(argv, spec);
+    if (empty.length) {
+        console.error(`flag with no value for \`${cmd}\`: ${empty.join(', ')}`);
+        console.error(`a flag given without its value is refused rather than ignored: ignoring it would run`);
+        console.error(`a command that quietly does less than it was asked to — a gate that never gates.`);
+        process.exit(2);
+    }
 }
 const [, , cmd, ...rest] = process.argv;
 if (cmd === 'audit') {
@@ -113,11 +184,8 @@ if (cmd === 'audit') {
         ],
         boolean: ['json', 'docker', 'claude', 'suggest', 'changed'],
     });
-    const argOf = (name) => {
-        const i = rest.indexOf(`--${name}`);
-        return i >= 0 ? rest[i + 1] : undefined;
-    };
-    const all = (name) => rest.flatMap((a, i) => (a === `--${name}` && rest[i + 1] ? [rest[i + 1]] : []));
+    const argOf = (name) => flagValue(rest, name);
+    const all = (name) => flagValues(rest, name);
     const json = rest.includes('--json');
     const numeric = (name) => {
         const raw = argOf(name);
@@ -249,8 +317,7 @@ if (cmd === 'audit') {
 else if (cmd === 'verify') {
     rejectUnknownFlags('verify', rest, { value: ['remote'], boolean: ['json'] });
     const json = rest.includes('--json');
-    const remoteIdx = rest.indexOf('--remote');
-    const remoteUrl = remoteIdx >= 0 ? rest[remoteIdx + 1] : undefined;
+    const remoteUrl = flagValue(rest, 'remote');
     const path = rest.find((a) => !a.startsWith('--') && a !== remoteUrl);
     if (!remoteUrl && !path) {
         console.error('usage: mcp-context-cost verify <measurement.json> [--json]');
@@ -298,10 +365,7 @@ else if (cmd === 'measure') {
         value: ['name', 'command', 'remote', 'timeout', 'docker-image', 'baseline', 'max-increase', 'budget'],
         boolean: ['docker'],
     });
-    const argOf = (name) => {
-        const i = rest.indexOf(`--${name}`);
-        return i >= 0 ? rest[i + 1] : undefined;
-    };
+    const argOf = (name) => flagValue(rest, name);
     const command = argOf('command');
     const remoteUrl = argOf('remote');
     if (remoteUrl && !/^https?:\/\//i.test(remoteUrl)) {

package/dist/core/server-diff.d.ts

@@ -46,6 +46,22 @@ export interface ServerDiff {
     /** Per-tool breakdown of an established change. */
     attribution: ToolAttribution | null;
 }
+/**
+ * Whether two measurements describe the same server, as far as what they
+ * recorded can say.
+ *
+ * A baseline is a path the caller passes, and nothing about the path proves it
+ * belongs to the server being measured — a monorepo with `baseline-a.json` and
+ * `baseline-b.json` is one copy-paste away from diffing two unrelated servers
+ * and reporting the difference as though it meant something. Both sides record
+ * `serverName` (what the server called itself at `initialize`), so where both
+ * carry one and they disagree, the comparison is refused.
+ *
+ * Only a disagreement counts. A measurement predating the field, or one whose
+ * server reports no name, is unknown rather than mismatched, and unknown is not
+ * evidence of anything — the same rule the isolation column follows.
+ */
+export declare function sameServer(baseline: Measurement, current: Measurement): boolean;
 export declare function diffServer(name: string, baseline: Measurement | null, current: Measurement): ServerDiff;
 export interface ServerGate {
     pass: boolean;

package/dist/core/server-diff.js

@@ -35,6 +35,28 @@ const sideOf = (m) => {
         measuredAt: v.date,
     };
 };
+/**
+ * Whether two measurements describe the same server, as far as what they
+ * recorded can say.
+ *
+ * A baseline is a path the caller passes, and nothing about the path proves it
+ * belongs to the server being measured — a monorepo with `baseline-a.json` and
+ * `baseline-b.json` is one copy-paste away from diffing two unrelated servers
+ * and reporting the difference as though it meant something. Both sides record
+ * `serverName` (what the server called itself at `initialize`), so where both
+ * carry one and they disagree, the comparison is refused.
+ *
+ * Only a disagreement counts. A measurement predating the field, or one whose
+ * server reports no name, is unknown rather than mismatched, and unknown is not
+ * evidence of anything — the same rule the isolation column follows.
+ */
+export function sameServer(baseline, current) {
+    const a = typeof baseline.serverName === 'string' ? baseline.serverName : '';
+    const b = typeof current.serverName === 'string' ? current.serverName : '';
+    if (!a || !b)
+        return true;
+    return a === b;
+}
 export function diffServer(name, baseline, current) {
     const before = sideOf(baseline);
     const after = sideOf(current);
@@ -65,6 +87,16 @@ export function diffServer(name, baseline, current) {
                 : 'no baseline to compare against',
         };
     }
+    // Checked only once both sides measured, so a mismatch is reported as what it
+    // is rather than hidden behind an unmeasured side.
+    if (!sameServer(baseline, current)) {
+        return {
+            ...base,
+            problem: `the baseline measured '${baseline.serverName}' and this run measured ` +
+                `'${current.serverName}' — a difference between two servers is not a change to either, ` +
+                `so nothing is compared`,
+        };
+    }
     const identical = before.canonicalSha256 === after.canonicalSha256;
     const beforeVec = vectorEntryOf(baseline);
     const afterVec = vectorEntryOf(current);
@@ -101,11 +133,14 @@ export function evaluateServerGate(diff, limits) {
             // A short reason rather than the diff's full sentence: the diff has
             // already printed that above, and a gate line that repeats it in full
             // buries the verdict it exists to state.
+            // Both sides measured and still not exact means exactly one thing today:
+            // the baseline describes a different server. Kept as its own branch so a
+            // future non-exact case cannot inherit this sentence by accident.
             const reason = !diff.after
                 ? 'this run produced no number'
                 : !diff.before
                     ? 'the baseline carries no measured number'
-                    : 'no comparable baseline';
+                    : 'the baseline describes a different server';
             return {
                 pass: false,
                 failure: `INCREASE FAIL: ${reason}, so the change could not be established and the gate has not passed.`,

package/dist/sweep/regressions.js

@@ -74,11 +74,24 @@ export function loadToolVectors(server, root = process.cwd()) {
 export function writeCaptureIndex(entries, root = process.cwd()) {
     const captures = {};
     const current = {};
+    // A hash two servers share identifies neither of them. The set already holds
+    // near-duplicate pairs (`redis`/`redis-legacy`, `github`/`github-legacy`), and
+    // one package listed under two slugs would produce byte-identical captures —
+    // whereupon the later write would silently rename the earlier server's capture
+    // and `audit --changed` would print the wrong name with full confidence.
+    // Ambiguous hashes are dropped instead, so `identify` answers `unknown`: an
+    // absence of a record, which is true, rather than a confident misattribution.
+    const ambiguous = new Set();
     for (const entry of entries) {
         const vectors = loadToolVectors(entry.name, root);
         if (!vectors || vectors.entries.length === 0)
             continue;
         for (const e of vectors.entries) {
+            const held = captures[e.canonicalSha256];
+            if (held && held.server !== entry.name) {
+                ambiguous.add(e.canonicalSha256);
+                continue;
+            }
             captures[e.canonicalSha256] = {
                 server: entry.name,
                 date: e.date,
@@ -88,6 +101,8 @@ export function writeCaptureIndex(entries, root = process.cwd()) {
         }
         current[entry.name] = vectors.entries[vectors.entries.length - 1].canonicalSha256;
     }
+    for (const sha of ambiguous)
+        delete captures[sha];
     const index = {
         method: CAPTURE_INDEX_METHOD,
         generatedAt: new Date().toISOString().slice(0, 10),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-context-cost",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Measure what your MCP servers cost in context tokens — audit your own config, or badge the server you publish",
   "type": "module",
   "license": "MIT",