mcp-medic 1.0.0 → 1.0.1

package/README.md

@@ -1,27 +1,27 @@
-# mcp-doctor
+# mcp-medic
 
 Diagnose broken MCP (Model Context Protocol) server configs before they break your agent silently.
 
-`mcp-doctor` validates MCP server configurations, executes full protocol initialization handshakes across stdio/SSE/HTTP transports, checks all exposed tool JSON schemas against standard specifications, and simulates sample calls — providing actionable suggestions, in-editor VS Code diagnostics, fleet management, and CI-ready exit codes.
+`mcp-medic` validates MCP server configurations, executes full protocol initialization handshakes across stdio/SSE/HTTP transports, checks all exposed tool JSON schemas against standard specifications, and simulates sample calls — providing actionable suggestions, in-editor VS Code diagnostics, fleet management, and CI-ready exit codes.
 
 ---
 
 ## Features
 
-- 🔍 **Auto-Discovery**: Run `mcp-doctor check` with no arguments to auto-discover Claude Desktop, `.mcp.json`, and VS Code/Cursor MCP configuration paths across macOS, Windows, and Linux.
+- 🔍 **Auto-Discovery**: Run `mcp-medic check` with no arguments to auto-discover Claude Desktop, `.mcp.json`, and VS Code/Cursor MCP configuration paths across macOS, Windows, and Linux.
 - 💡 **Auto-Fix Suggestions**: Diagnose issues with clear, actionable fix suggestions using `--show-fixes`.
-- 🌐 **Registry Validation**: Validate published registry entries directly using `mcp-doctor check --registry <server-id>`.
-- 🏢 **Fleet Validation**: Scan and validate monorepos or multi-team configurations with `mcp-doctor check-all "<glob>"`.
-- ⚖️ **Drift Detection**: Catch environment divergence between staging and production configs with `mcp-doctor diff <configA> <configB>`.
-- 📜 **Policy-as-Code**: Enforce organizational constraints (e.g., banned transports, domain allowlists, minimum description lengths) via `.mcp-doctor-policy.json` / `--policy`.
+- 🌐 **Registry Validation**: Validate published registry entries directly using `mcp-medic check --registry <server-id>`.
+- 🏢 **Fleet Validation**: Scan and validate monorepos or multi-team configurations with `mcp-medic check-all "<glob>"`.
+- ⚖️ **Drift Detection**: Catch environment divergence between staging and production configs with `mcp-medic diff <configA> <configB>`.
+- 📜 **Policy-as-Code**: Enforce organizational constraints (e.g., banned transports, domain allowlists, minimum description lengths) via `.mcp-medic-policy.json` / `--policy`.
 - 📸 **Snapshot Baseline Mode**: Filter out legacy diagnostics with `--snapshot <baseline.json>` to gate only on newly introduced regressions.
 - 📊 **CI Reporting**: Export standard JUnit XML (`--export-junit <file.xml>`) and JSON (`--export-json <file.json>`) for seamless CI dashboard visualization.
-- 👀 **Watch Mode**: Re-run validation on save using `mcp-doctor watch <path>`.
+- 👀 **Watch Mode**: Re-run validation on save using `mcp-medic watch <path>`.
 - ⚡ **Transport Hardening**: Full handshake validation across stdio, HTTP (with OAuth token refresh), and SSE (with automatic retry resilience).
 - 💻 **VS Code Extension**: In-editor squiggles and hover tooltips showing diagnostics and suggested fixes.
 - 🚦 **CI Usability & Exit Codes**: Strict exit code taxonomy (`0` clean, `1` diagnostic failures, `2` usage/syntax errors) and `--fail-on <error|warning>`.
-- 🤖 **GitHub Action**: Drop-in CI integration via `shivam039/mcp-doctor@main` (or `mcp-doctor-action`).
-- 🧩 **Community Checks**: Conformance test helper (`runCheckConformanceSuite`) to build custom `mcp-doctor-check-*` check plugins.
+- 🤖 **GitHub Action**: Drop-in CI integration via `shivam039/mcp-doctor@main` (or `mcp-medic-action`).
+- 🧩 **Community Checks**: Conformance test helper (`runCheckConformanceSuite`) to build custom `mcp-medic-check-*` check plugins.
 
 ---
 
@@ -29,29 +29,29 @@ Diagnose broken MCP (Model Context Protocol) server configs before they break yo
 
 ```bash
 # Run against auto-discovered configs in current project / Claude Desktop
-npx mcp-doctor
+npx mcp-medic
 
 # Run check on a specific configuration file
-npx mcp-doctor check path/to/config.json
+npx mcp-medic check path/to/config.json
 
 # Validate all configs across a monorepo
-npx mcp-doctor check-all "configs/**/*.json"
+npx mcp-medic check-all "configs/**/*.json"
 
 # Compare two configs to detect drift
-npx mcp-doctor diff staging.mcp.json prod.mcp.json
+npx mcp-medic diff staging.mcp.json prod.mcp.json
 
 # Validate a published registry server directly without a local config
-npx mcp-doctor check --registry @modelcontextprotocol/server-memory
-npx mcp-doctor check --registry smithery:username/my-server
+npx mcp-medic check --registry @modelcontextprotocol/server-memory
+npx mcp-medic check --registry smithery:username/my-server
 
 # Apply organizational policy rules and export to JUnit XML
-npx mcp-doctor check path/to/config.json --policy .mcp-doctor-policy.json --export-junit results.xml
+npx mcp-medic check path/to/config.json --policy .mcp-medic-policy.json --export-junit results.xml
 
 # Display suggested fixes for flagged diagnostics
-npx mcp-doctor check path/to/config.json --show-fixes
+npx mcp-medic check path/to/config.json --show-fixes
 
 # Watch mode (re-runs checks on save)
-npx mcp-doctor watch path/to/config.json
+npx mcp-medic watch path/to/config.json
 ```
 
 ---
@@ -66,7 +66,7 @@ npx mcp-doctor watch path/to/config.json
 | `check --registry <id>` | Validate a published registry server directly |
 | `watch <path>` | Watch configuration file and re-run checks on file save |
 | `--config <path>` | Explicit configuration path |
-| `--policy <path>` | Apply organizational policy rules (`.mcp-doctor-policy.json`) |
+| `--policy <path>` | Apply organizational policy rules (`.mcp-medic-policy.json`) |
 | `--snapshot <path>` | Compare against baseline snapshot, reporting regressions only |
 | `--update-snapshot <path>` | Save diagnostic report as new baseline snapshot |
 | `--export-junit <file>` | Export report in JUnit XML format |
@@ -85,7 +85,7 @@ npx mcp-doctor watch path/to/config.json
 
 ---
 
-## Policy-as-Code (`.mcp-doctor-policy.json`)
+## Policy-as-Code (`.mcp-medic-policy.json`)
 
 Define organization-wide policies that compose with built-in checks:
 
@@ -101,7 +101,7 @@ Define organization-wide policies that compose with built-in checks:
 
 ## VS Code Extension
 
-The `mcp-doctor` VS Code extension provides:
+The `mcp-medic` VS Code extension provides:
 - Inline squiggles on `.mcp.json`, `mcp.json`, and `claude_desktop_config.json` files as you edit.
 - Hover tooltips showing the full diagnostic explanation and actionable suggested fix.
 
@@ -133,14 +133,14 @@ jobs:
 
 | Check ID | Package | Scope | Description |
 |---|---|---|---|
-| `schema.malformed` | `mcp-doctor` | **Official** | Verifies inputSchema is a valid JSON schema object |
-| `schema.missing-required` | `mcp-doctor` | **Official** | Flags required fields missing from properties |
-| `schema.type-mismatch` | `mcp-doctor` | **Official** | Flags invalid JSON schema types and enum mismatches |
-| `schema.missing-description` | `mcp-doctor` | **Official** | Flags tools and properties missing documentation |
-| `schema.sample-call-simulation` | `mcp-doctor` | **Official** | Simulates and validates synthetic call payloads |
-| `policy.*` | `mcp-doctor` | **Official** | Evaluates policy-as-code rules (transports, domains, length) |
-| `community.strict-typing` | `mcp-doctor-check-strict-typing` | *Community* | Enforces strict property type annotations |
-| `community.no-empty-enums` | `mcp-doctor-check-no-empty-enums` | *Community* | Ensures non-empty enum option lists |
+| `schema.malformed` | `mcp-medic` | **Official** | Verifies inputSchema is a valid JSON schema object |
+| `schema.missing-required` | `mcp-medic` | **Official** | Flags required fields missing from properties |
+| `schema.type-mismatch` | `mcp-medic` | **Official** | Flags invalid JSON schema types and enum mismatches |
+| `schema.missing-description` | `mcp-medic` | **Official** | Flags tools and properties missing documentation |
+| `schema.sample-call-simulation` | `mcp-medic` | **Official** | Simulates and validates synthetic call payloads |
+| `policy.*` | `mcp-medic` | **Official** | Evaluates policy-as-code rules (transports, domains, length) |
+| `community.strict-typing` | `mcp-medic-check-strict-typing` | *Community* | Enforces strict property type annotations |
+| `community.no-empty-enums` | `mcp-medic-check-no-empty-enums` | *Community* | Ensures non-empty enum option lists |
 
 To write and publish your own check plugin, see [Authoring Custom Checks](./docs/AUTHORING_CHECKS.md).
 
@@ -167,3 +167,4 @@ npm run test
 ## License
 
 MIT
+

package/action.yml

@@ -1,6 +1,6 @@
-name: 'mcp-doctor-action'
+name: 'mcp-medic-action'
 description: 'Diagnose broken MCP (Model Context Protocol) server configs in CI before they break your agent silently'
-author: 'mcp-doctor'
+author: 'Shivam Dixit'
 branding:
   icon: 'check-circle'
   color: 'green'
@@ -35,7 +35,7 @@ runs:
       with:
         node-version: '20'
 
-    - name: Run mcp-doctor
+    - name: Run mcp-medic
       shell: bash
       run: |
         ARGS="check"
@@ -54,4 +54,4 @@ runs:
         if [ "${{ inputs.verbose }}" = "true" ]; then
           ARGS="$ARGS --verbose"
         fi
-        npx --yes mcp-doctor $ARGS
+        npx --yes mcp-medic $ARGS

package/dist/checks/index.d.ts

@@ -3,4 +3,7 @@ export { missingRequiredFieldsCheck } from './missing-required-fields.js';
 export { typeMismatchCheck } from './type-mismatch.js';
 export { missingDescriptionCheck } from './missing-description.js';
 export { sampleCallSimulationCheck } from './sample-call-simulation.js';
+export { securityUntrustedRemoteCheck } from './security-untrusted-remote.js';
+export { securityOverbroadPermissionsCheck } from './security-overbroad-permissions.js';
+export { securityPromptInjectionRiskCheck } from './security-prompt-injection-risk.js';
 export declare const allChecks: import("../types.js").Check[];

package/dist/checks/index.js

@@ -3,15 +3,24 @@ export { missingRequiredFieldsCheck } from './missing-required-fields.js';
 export { typeMismatchCheck } from './type-mismatch.js';
 export { missingDescriptionCheck } from './missing-description.js';
 export { sampleCallSimulationCheck } from './sample-call-simulation.js';
+export { securityUntrustedRemoteCheck } from './security-untrusted-remote.js';
+export { securityOverbroadPermissionsCheck } from './security-overbroad-permissions.js';
+export { securityPromptInjectionRiskCheck } from './security-prompt-injection-risk.js';
 import { malformedSchemaCheck } from './malformed-schema.js';
 import { missingRequiredFieldsCheck } from './missing-required-fields.js';
 import { typeMismatchCheck } from './type-mismatch.js';
 import { missingDescriptionCheck } from './missing-description.js';
 import { sampleCallSimulationCheck } from './sample-call-simulation.js';
+import { securityUntrustedRemoteCheck } from './security-untrusted-remote.js';
+import { securityOverbroadPermissionsCheck } from './security-overbroad-permissions.js';
+import { securityPromptInjectionRiskCheck } from './security-prompt-injection-risk.js';
 export const allChecks = [
     malformedSchemaCheck,
     missingRequiredFieldsCheck,
     typeMismatchCheck,
     missingDescriptionCheck,
     sampleCallSimulationCheck,
+    securityUntrustedRemoteCheck,
+    securityOverbroadPermissionsCheck,
+    securityPromptInjectionRiskCheck,
 ];

package/dist/checks/security-overbroad-permissions.d.ts

@@ -0,0 +1,2 @@
+import type { Check } from '../types.js';
+export declare const securityOverbroadPermissionsCheck: Check;

package/dist/checks/security-overbroad-permissions.js

@@ -0,0 +1,117 @@
+import { HEURISTIC_DISCLAIMER } from './security-shared.js';
+// Ordered by specificity; matched against each top-level inputSchema property name.
+const PROPERTY_RULES = [
+    {
+        category: 'shell-command',
+        namePattern: /^(cmd|command|shell|bash|sh|exec|script|code)$/i,
+        hint: 'accepts an unconstrained shell/command string',
+    },
+    {
+        category: 'filesystem-path',
+        namePattern: /^(path|filepath|file_path|dir|directory|folder)$/i,
+        hint: 'accepts an unconstrained filesystem path',
+    },
+    {
+        category: 'network-request',
+        namePattern: /^(url|endpoint|host|target|uri)$/i,
+        hint: 'accepts an unconstrained network destination',
+    },
+];
+const DESCRIPTION_RULES = [
+    {
+        category: 'shell-command',
+        pattern: /\b(execute|executes|run|runs)\s+(any|arbitrary)\s+(shell|command|code)\b|\barbitrary\s+shell\s+command/i,
+        hint: 'description states it executes arbitrary shell commands or code',
+    },
+    {
+        category: 'filesystem-path',
+        pattern: /\bfull\s+filesystem\s+access\b|\baccess(?:es)?\s+(?:to\s+)?any\s+file\b|\b(?:read|write|delete)\s+any\s+file\b/i,
+        hint: 'description states it can access any file on the filesystem',
+    },
+    {
+        category: 'network-request',
+        pattern: /\b(unrestricted|arbitrary)\s+(network|http|url)\s+(access|request)\b/i,
+        hint: 'description states it allows unrestricted network access',
+    },
+];
+function isUnconstrainedString(propDef) {
+    if (!propDef || typeof propDef !== 'object' || Array.isArray(propDef))
+        return false;
+    const prop = propDef;
+    if (prop.type !== 'string')
+        return false;
+    if (Array.isArray(prop.enum) && prop.enum.length > 0)
+        return false;
+    if (typeof prop.pattern === 'string' && prop.pattern.length > 0)
+        return false;
+    return true;
+}
+function checkTool(tool, serverName) {
+    const results = [];
+    if (typeof tool.description === 'string') {
+        for (const rule of DESCRIPTION_RULES) {
+            if (rule.pattern.test(tool.description)) {
+                results.push({
+                    checkId: 'security.overbroad-permissions',
+                    severity: 'warning',
+                    message: `Tool "${tool.name}" ${rule.hint} — review before granting it broad access. (${HEURISTIC_DISCLAIMER})`,
+                    serverName,
+                    toolName: tool.name,
+                    details: { category: rule.category, source: 'description' },
+                    suggestedFix: {
+                        description: 'Confirm this scope is intentional after reviewing the server\'s source; prefer a server that exposes narrower, purpose-built tools instead of one broad tool.',
+                    },
+                });
+            }
+        }
+    }
+    const schema = tool.inputSchema;
+    if (schema && typeof schema === 'object' && !Array.isArray(schema)) {
+        const schemaObj = schema;
+        const properties = schemaObj.properties && typeof schemaObj.properties === 'object' && !Array.isArray(schemaObj.properties)
+            ? schemaObj.properties
+            : {};
+        for (const [propName, propDef] of Object.entries(properties)) {
+            if (!isUnconstrainedString(propDef))
+                continue;
+            const rule = PROPERTY_RULES.find((r) => r.namePattern.test(propName));
+            if (!rule)
+                continue;
+            results.push({
+                checkId: 'security.overbroad-permissions',
+                severity: 'warning',
+                message: `Tool "${tool.name}" parameter "${propName}" ${rule.hint} (no enum or pattern constraining it). (${HEURISTIC_DISCLAIMER})`,
+                serverName,
+                toolName: tool.name,
+                details: { category: rule.category, source: 'schema', property: propName },
+                suggestedFix: {
+                    description: `Constrain "${propName}" with an enum of allowed values or a validating pattern, or split it into narrower parameters, if you control this server.`,
+                },
+            });
+        }
+    }
+    return results;
+}
+export const securityOverbroadPermissionsCheck = {
+    id: 'security.overbroad-permissions',
+    description: `Flags tools whose description or schema implies unscoped filesystem/shell/network access (${HEURISTIC_DISCLAIMER}).`,
+    run(connection) {
+        const results = [];
+        try {
+            if (!connection.tools || !Array.isArray(connection.tools))
+                return results;
+            for (const tool of connection.tools) {
+                results.push(...checkTool(tool, connection.server.name));
+            }
+        }
+        catch (err) {
+            results.push({
+                checkId: 'security.overbroad-permissions',
+                severity: 'error',
+                message: `check failed internally: ${err instanceof Error ? err.message : String(err)}`,
+                serverName: connection.server.name,
+            });
+        }
+        return results;
+    },
+};

package/dist/checks/security-prompt-injection-risk.d.ts

@@ -0,0 +1,2 @@
+import type { Check } from '../types.js';
+export declare const securityPromptInjectionRiskCheck: Check;

package/dist/checks/security-prompt-injection-risk.js

@@ -0,0 +1,94 @@
+import { HEURISTIC_DISCLAIMER } from './security-shared.js';
+// Instruction-like language aimed at the model reading the tool description,
+// rather than at a human deciding whether to use the tool — a known MCP
+// supply-chain risk pattern (tool descriptions are injected into the
+// model's context).
+const INJECTION_PATTERNS = [
+    /\balways\s+call\s+this\s+(tool\s+)?first\b/i,
+    /\bignore\s+(all\s+)?(previous|prior|above)\s+instructions\b/i,
+    /\bdisregard\s+(the\s+)?(system\s+prompt|previous\s+instructions)\b/i,
+    /\bdo\s+not\s+(tell|inform)\s+the\s+user\b/i,
+    /\bnever\s+(mention|tell)\s+.*\bthe\s+user\b/i,
+    /\byou\s+must\s+(always|never)\s+\w/i,
+    /\bthis\s+is\s+a\s+system\s+(prompt|instruction)\b/i,
+    /\boverride\s+(your|any)\s+(previous|prior)\s+(instructions|guidelines)\b/i,
+    /\bact\s+as\s+(if\s+you\s+are|though\s+you\s+are)\b/i,
+];
+function findMatch(text) {
+    for (const pattern of INJECTION_PATTERNS) {
+        const match = pattern.exec(text);
+        if (match) {
+            return { pattern: pattern.source, snippet: match[0] };
+        }
+    }
+    return undefined;
+}
+export const securityPromptInjectionRiskCheck = {
+    id: 'security.prompt-injection-risk',
+    description: `Flags tool/parameter descriptions containing instruction-like language aimed at the model rather than a human (${HEURISTIC_DISCLAIMER}).`,
+    run(connection) {
+        const results = [];
+        try {
+            if (!connection.tools || !Array.isArray(connection.tools))
+                return results;
+            for (const tool of connection.tools) {
+                if (typeof tool.description === 'string') {
+                    const match = findMatch(tool.description);
+                    if (match) {
+                        results.push({
+                            checkId: 'security.prompt-injection-risk',
+                            severity: 'warning',
+                            message: `Tool "${tool.name}" description contains instruction-like language aimed at the model ` +
+                                `("${match.snippet}") rather than describing the tool to a human — a known MCP supply-chain ` +
+                                `risk pattern. (${HEURISTIC_DISCLAIMER})`,
+                            serverName: connection.server.name,
+                            toolName: tool.name,
+                            details: { source: 'description', matchedPattern: match.pattern, snippet: match.snippet },
+                            suggestedFix: {
+                                description: "Review this tool's description and the server's source before trusting it; rewrite or remove instruction-like language if you control this server.",
+                            },
+                        });
+                    }
+                }
+                const schema = tool.inputSchema;
+                if (schema && typeof schema === 'object' && !Array.isArray(schema)) {
+                    const properties = schema.properties;
+                    if (properties && typeof properties === 'object' && !Array.isArray(properties)) {
+                        for (const [propName, propDef] of Object.entries(properties)) {
+                            if (!propDef || typeof propDef !== 'object' || Array.isArray(propDef))
+                                continue;
+                            const description = propDef.description;
+                            if (typeof description !== 'string')
+                                continue;
+                            const match = findMatch(description);
+                            if (match) {
+                                results.push({
+                                    checkId: 'security.prompt-injection-risk',
+                                    severity: 'warning',
+                                    message: `Tool "${tool.name}" parameter "${propName}" description contains instruction-like language ` +
+                                        `aimed at the model ("${match.snippet}") rather than describing the parameter to a human. ` +
+                                        `(${HEURISTIC_DISCLAIMER})`,
+                                    serverName: connection.server.name,
+                                    toolName: tool.name,
+                                    details: { source: 'parameter-description', property: propName, matchedPattern: match.pattern, snippet: match.snippet },
+                                    suggestedFix: {
+                                        description: "Review this tool's description and the server's source before trusting it; rewrite or remove instruction-like language if you control this server.",
+                                    },
+                                });
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        catch (err) {
+            results.push({
+                checkId: 'security.prompt-injection-risk',
+                severity: 'error',
+                message: `check failed internally: ${err instanceof Error ? err.message : String(err)}`,
+                serverName: connection.server.name,
+            });
+        }
+        return results;
+    },
+};

package/dist/checks/security-shared.d.ts

@@ -0,0 +1,8 @@
+/**
+ * All security.* checks are heuristic pattern-matching over what a server
+ * *declares* (config URL, tool descriptions, tool schemas) — they cannot
+ * see what a server actually does. Every diagnostic they emit must say so
+ * (FR3-2.4): this is not a substitute for reading a third-party MCP
+ * server's source before trusting it.
+ */
+export declare const HEURISTIC_DISCLAIMER = "heuristic flag, not a guarantee \u2014 review this server's source before trusting it";

package/dist/checks/security-shared.js

@@ -0,0 +1,8 @@
+/**
+ * All security.* checks are heuristic pattern-matching over what a server
+ * *declares* (config URL, tool descriptions, tool schemas) — they cannot
+ * see what a server actually does. Every diagnostic they emit must say so
+ * (FR3-2.4): this is not a substitute for reading a third-party MCP
+ * server's source before trusting it.
+ */
+export const HEURISTIC_DISCLAIMER = "heuristic flag, not a guarantee — review this server's source before trusting it";

package/dist/checks/security-untrusted-remote.d.ts

@@ -0,0 +1,2 @@
+import type { Check } from '../types.js';
+export declare const securityUntrustedRemoteCheck: Check;

package/dist/checks/security-untrusted-remote.js

@@ -0,0 +1,71 @@
+import { HEURISTIC_DISCLAIMER } from './security-shared.js';
+function toHttps(url) {
+    return url.replace(/^http:\/\//i, 'https://');
+}
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1']);
+function isIpLiteralHost(hostname) {
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(hostname))
+        return true; // IPv4
+    if (hostname.includes(':') && /^[0-9a-fA-F:]+$/.test(hostname))
+        return true; // IPv6 (URL strips brackets)
+    return false;
+}
+export const securityUntrustedRemoteCheck = {
+    id: 'security.untrusted-remote',
+    description: `For SSE/HTTP servers, flags non-HTTPS URLs or raw IP-address hosts instead of domain names (${HEURISTIC_DISCLAIMER}).`,
+    run(connection) {
+        const results = [];
+        try {
+            const { server } = connection;
+            if (server.transport !== 'sse' && server.transport !== 'http')
+                return results;
+            if (typeof server.url !== 'string' || server.url.length === 0)
+                return results;
+            let parsed;
+            try {
+                parsed = new URL(server.url);
+            }
+            catch {
+                return results; // malformed URLs are the config-loader/protocol layer's concern, not this check's
+            }
+            if (parsed.protocol === 'http:') {
+                results.push({
+                    checkId: 'security.untrusted-remote',
+                    severity: 'warning',
+                    message: `Server "${server.name}" connects over unencrypted "http://"; requests, responses, and any headers ` +
+                        `(including auth tokens) travel in plaintext. Not blocking — legitimate local dev configs exist. ` +
+                        `(${HEURISTIC_DISCLAIMER})`,
+                    serverName: server.name,
+                    details: { url: server.url, reason: 'non-https' },
+                    suggestedFix: {
+                        description: `Switch to "${toHttps(server.url)}" if the server supports TLS.`,
+                        patch: { serverName: server.name, set: { url: toHttps(server.url) } },
+                    },
+                });
+            }
+            if (isIpLiteralHost(parsed.hostname) && !LOOPBACK_HOSTS.has(parsed.hostname)) {
+                results.push({
+                    checkId: 'security.untrusted-remote',
+                    severity: 'warning',
+                    message: `Server "${server.name}" points at a raw IP address ("${parsed.hostname}") instead of a domain name, ` +
+                        `making it hard to verify who actually operates the endpoint or notice if it changes hands. ` +
+                        `Not blocking — legitimate local dev configs exist. (${HEURISTIC_DISCLAIMER})`,
+                    serverName: server.name,
+                    details: { url: server.url, reason: 'ip-literal-host' },
+                    suggestedFix: {
+                        description: 'Point this server at a stable domain name you control or trust, if one is available.',
+                    },
+                });
+            }
+        }
+        catch (err) {
+            results.push({
+                checkId: 'security.untrusted-remote',
+                severity: 'error',
+                message: `check failed internally: ${err instanceof Error ? err.message : String(err)}`,
+                serverName: connection.server.name,
+            });
+        }
+        return results;
+    },
+};

package/dist/cli.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 export interface ParsedArgs {
-    command: 'check' | 'watch' | 'check-all' | 'diff' | 'help';
+    command: 'check' | 'watch' | 'check-all' | 'diff' | 'fix' | 'help';
     configPath?: string;
     configPathB?: string;
     globPattern?: string;
@@ -15,6 +15,13 @@ export interface ParsedArgs {
     showFixes: boolean;
     verbose: boolean;
     failOn: 'error' | 'warning';
+    checkFilter?: string;
+    dryRun: boolean;
 }
+/** Prompts the user with `question` and resolves true for an explicit "y"/"yes" answer. */
+export type ConfirmFn = (question: string) => Promise<boolean>;
 export declare function parseArgs(argv: string[]): ParsedArgs;
-export declare function main(argv?: string[]): Promise<number>;
+export interface CliDeps {
+    confirm?: ConfirmFn;
+}
+export declare function main(argv?: string[], deps?: CliDeps): Promise<number>;

package/dist/cli.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import * as readline from 'node:readline/promises';
 import { resolve } from 'node:path';
 import { runChecks, registerConnectImpl } from './orchestrator.js';
 import { formatReportHuman, formatReportJSON } from './report.js';
@@ -7,6 +8,7 @@ import { loadConfig } from './config-loader.js';
 import { discoverConfigFiles } from './discovery.js';
 import { watchFileDebounced } from './watch.js';
 import { resolveRegistryServer } from './registry.js';
+import { isConfigPatch, diffConfigPatch, applyConfigPatch } from './fix.js';
 import { loadPolicy, createPolicyChecks } from './policy.js';
 import { runFleetChecks, diffConfigs, filterDiagnosticsByBaseline } from './fleet.js';
 import { formatReportJUnit, formatFleetReportJUnit } from './junit.js';
@@ -18,6 +20,7 @@ export function parseArgs(argv) {
         showFixes: false,
         verbose: false,
         failOn: 'error',
+        dryRun: false,
     };
     const positional = [];
     for (let i = 0; i < argv.length; i++) {
@@ -31,6 +34,9 @@ export function parseArgs(argv) {
         else if (arg === '--verbose' || arg === '-v') {
             args.verbose = true;
         }
+        else if (arg === '--dry-run') {
+            args.dryRun = true;
+        }
         else if (arg === '--help' || arg === '-h') {
             args.command = 'help';
         }
@@ -41,6 +47,13 @@ export function parseArgs(argv) {
             }
             args.failOn = val;
         }
+        else if (arg === '--check') {
+            const val = argv[++i];
+            if (!val) {
+                throw new Error('--check requires a check id, e.g. --check security.untrusted-remote');
+            }
+            args.checkFilter = val;
+        }
         else if (arg === '--policy') {
             args.policyPath = argv[++i];
         }
@@ -84,7 +97,7 @@ export function parseArgs(argv) {
     }
     if (args.command !== 'help') {
         const first = positional[0];
-        if (first === 'check' || first === 'watch' || first === 'check-all' || first === 'diff') {
+        if (first === 'check' || first === 'watch' || first === 'check-all' || first === 'diff' || first === 'fix') {
             args.command = first;
             if (first === 'diff') {
                 args.configPath = positional[1];
@@ -135,20 +148,21 @@ async function loadProtocol() {
     }
 }
 function printHelp() {
-    console.log(`
-${pc.bold('mcp-doctor')} — Diagnose broken MCP server configs before they break your agent.
+    const helpText = `
+${pc.bold('mcp-medic')} — Diagnose broken MCP server configs before they break your agent.
 
-${pc.bold('USAGE')}
-  $ mcp-doctor [check] [path/to/config.json] [options]
-  $ mcp-doctor check --registry <server-id> [options]
-  $ mcp-doctor check-all "<glob-pattern>" [options]
-  $ mcp-doctor diff <configA.json> <configB.json>
-  $ mcp-doctor watch <path/to/config.json> [options]
+USAGE
+  $ mcp-medic [check] [path/to/config.json] [options]
+  $ mcp-medic check --registry <server-id> [options]
+  $ mcp-medic check-all "<glob-pattern>" [options]
+  $ mcp-medic diff <configA.json> <configB.json>
+  $ mcp-medic watch <path/to/config.json> [options]
+  $ mcp-medic fix <path/to/config.json> [--check <id>] [--dry-run]
 
-${pc.bold('OPTIONS')}
+OPTIONS
   --config <path>       Specify path to MCP configuration file
   --registry <id/url>   Validate published registry entry directly
-  --policy <path>       Apply organizational policy rules (.mcp-doctor-policy.json)
+  --policy <path>       Apply organizational policy rules (.mcp-medic-policy.json)
   --snapshot <path>     Filter report against baseline snapshot, reporting regressions only
   --update-snapshot <p> Save diagnostic report as new baseline snapshot
   --export-junit <file> Export report in JUnit XML format
@@ -160,11 +174,23 @@ ${pc.bold('OPTIONS')}
   --timeout <ms>        Per-server handshake timeout in milliseconds (default: 5000)
   --help, -h            Show help
 
-${pc.bold('EXIT CODES')}
-  0  All checks passed cleanly
+FIX OPTIONS (mcp-medic fix)
+  --check <id>          Only offer fixes from this check id (e.g. security.untrusted-remote)
+  --dry-run             Show every available fix as a diff; apply nothing, prompt for nothing
+
+FIX BEHAVIOR
+  Only diagnostics that carry a mechanical suggestedFix.patch can be
+  auto-applied (most diagnostics are description-only and must be fixed by
+  hand). Each one is shown as a diff and requires an explicit y/n
+  confirmation — fixes are never bulk-applied silently. Before writing
+  anything, the original file is copied to <path>.bak.
+
+EXIT CODES
+  0  All checks passed cleanly / fix completed (including "nothing to fix")
   1  Diagnostics failed (errors found, or warnings when --fail-on warning)
   2  Usage or configuration error (invalid flags, missing/malformed config)
-`);
+`;
+    console.log(helpText);
 }
 function colorizeHumanReport(text) {
     return text
@@ -275,25 +301,135 @@ async function loadConfigFromPath(configPath) {
         }
         return { exitCode: 2 };
     }
-    return { config };
+    return { config, rawText, rawJson };
+}
+async function defaultConfirm(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = (await rl.question(question)).trim().toLowerCase();
+        return answer === 'y' || answer === 'yes';
+    }
+    finally {
+        rl.close();
+    }
 }
-export async function main(argv = process.argv.slice(2)) {
+/**
+ * `mcp-doctor fix`: runs the same checks as `check`, then offers to apply
+ * every diagnostic whose suggestedFix carries a mechanical `patch` (see
+ * src/fix.ts). Per FR3-1: always shows a diff, always asks y/n per fix
+ * (never bulk-applies), always writes a `.bak` before touching the file,
+ * and `--dry-run` shows every diff without prompting or writing anything.
+ */
+async function executeFix(configPath, rawText, rawJson, config, args, confirm) {
+    const [checks] = await Promise.all([loadChecks(args.policyPath), loadProtocol()]);
+    const report = await runChecks(config, { timeoutMs: args.timeoutMs, checks, verbose: args.verbose });
+    let fixable = report.diagnostics.filter((d) => isConfigPatch(d.suggestedFix?.patch));
+    if (args.checkFilter) {
+        fixable = fixable.filter((d) => d.checkId === args.checkFilter);
+    }
+    // Multiple diagnostics can suggest the exact same patch; only offer it once.
+    const seen = new Set();
+    const uniqueFixable = [];
+    for (const diagnostic of fixable) {
+        const patch = diagnostic.suggestedFix.patch;
+        const key = JSON.stringify(patch);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        uniqueFixable.push({ diagnostic, patch });
+    }
+    if (uniqueFixable.length === 0) {
+        console.log(pc.green('No auto-fixable diagnostics found.'));
+        return 0;
+    }
+    let working = rawJson;
+    let applied = 0;
+    let skipped = 0;
+    const dryRunEntries = [];
+    for (const { diagnostic, patch } of uniqueFixable) {
+        const diffs = diffConfigPatch(working, patch);
+        if (diffs.length === 0)
+            continue; // already fixed — nothing to show or confirm
+        if (args.dryRun) {
+            dryRunEntries.push({
+                checkId: diagnostic.checkId,
+                serverName: diagnostic.serverName,
+                toolName: diagnostic.toolName,
+                message: diagnostic.message,
+                diff: diffs,
+            });
+            continue;
+        }
+        console.log('');
+        console.log(pc.bold(`[${diagnostic.severity}] ${diagnostic.serverName} — ${diagnostic.message} (${diagnostic.checkId})`));
+        for (const d of diffs) {
+            console.log(pc.red(`  - ${d.field}: ${JSON.stringify(d.before)}`));
+            console.log(pc.green(`  + ${d.field}: ${JSON.stringify(d.after)}`));
+        }
+        const proceed = await confirm(`Apply this fix to ${configPath}? [y/N] `);
+        if (proceed) {
+            working = applyConfigPatch(working, patch);
+            applied++;
+        }
+        else {
+            skipped++;
+        }
+    }
+    if (args.dryRun) {
+        if (args.json) {
+            console.log(JSON.stringify({ fixable: dryRunEntries.length, fixes: dryRunEntries }, null, 2));
+        }
+        else if (dryRunEntries.length === 0) {
+            console.log(pc.green('Dry run: nothing to fix (every fixable diagnostic is already applied).'));
+        }
+        else {
+            for (const entry of dryRunEntries) {
+                console.log('');
+                console.log(pc.bold(`[dry-run] ${entry.serverName} — ${entry.message} (${entry.checkId})`));
+                for (const d of entry.diff) {
+                    console.log(pc.red(`  - ${d.field}: ${JSON.stringify(d.before)}`));
+                    console.log(pc.green(`  + ${d.field}: ${JSON.stringify(d.after)}`));
+                }
+            }
+            console.log(pc.dim(`\nDry run: ${dryRunEntries.length} fix(es) shown, 0 applied.`));
+        }
+        return 0;
+    }
+    if (applied > 0) {
+        const backupPath = `${configPath}.bak`;
+        writeFileSync(backupPath, rawText, 'utf-8');
+        writeFileSync(configPath, `${JSON.stringify(working, null, 2)}\n`, 'utf-8');
+        console.log(pc.green(`\nApplied ${applied} fix(es). Original saved to ${backupPath}.`));
+    }
+    else {
+        console.log(pc.dim('\nNo fixes applied.'));
+    }
+    if (skipped > 0) {
+        console.log(pc.yellow(`Skipped ${skipped} fix(es).`));
+    }
+    return 0;
+}
+export async function main(argv = process.argv.slice(2), deps = {}) {
     let args;
     try {
         args = parseArgs(argv);
     }
     catch (err) {
-        console.error(pc.red(`mcp-doctor usage error: ${err instanceof Error ? err.message : String(err)}`));
+        console.error(pc.red(`mcp-medic usage error: ${err instanceof Error ? err.message : String(err)}`));
         return 2;
     }
     if (args.command === 'help') {
         printHelp();
         return 0;
     }
+    if (args.command === 'fix' && args.registryServer) {
+        console.error(pc.red('mcp-doctor fix does not support --registry — there is no local file to write the fix to.'));
+        return 2;
+    }
     // Handle diff command
     if (args.command === 'diff') {
         if (!args.configPath || !args.configPathB) {
-            console.error(pc.red('mcp-doctor diff requires two config paths: mcp-doctor diff <configA> <configB>'));
+            console.error(pc.red('mcp-medic diff requires two config paths: mcp-medic diff <configA> <configB>'));
             return 2;
         }
         const [resA, resB] = await Promise.all([
@@ -353,7 +489,7 @@ export async function main(argv = process.argv.slice(2)) {
             console.log(JSON.stringify(fleetReport, null, 2));
         }
         else {
-            console.log(pc.bold(`\nMCP Doctor Fleet Report`));
+            console.log(pc.bold(`\nMCP Medic Fleet Report`));
             console.log(`Files scanned: ${fleetReport.totalFiles} (${fleetReport.successfulFiles} valid, ${fleetReport.failedFiles} invalid)`);
             console.log(`Servers checked: ${fleetReport.totalServers}`);
             console.log(`Results: ${fleetReport.totalErrors} error(s), ${fleetReport.totalWarnings} warning(s)\n`);
@@ -441,17 +577,23 @@ export async function main(argv = process.argv.slice(2)) {
             });
         });
     }
+    if (args.command === 'fix') {
+        const { config, rawText, rawJson, exitCode } = await loadConfigFromPath(targetPath);
+        if (exitCode !== undefined || !config || rawText === undefined)
+            return exitCode ?? 2;
+        return executeFix(targetPath, rawText, rawJson, config, args, deps.confirm ?? defaultConfirm);
+    }
     const { config, exitCode } = await loadConfigFromPath(targetPath);
     if (exitCode !== undefined || !config)
         return exitCode ?? 2;
     return executeCheck(config, args);
 }
 // Only invoke automatically when run as CLI entry point
-if (process.argv[1] && (process.argv[1].endsWith('/cli.js') || process.argv[1].endsWith('/cli.ts') || process.argv[1].endsWith('/mcp-doctor'))) {
+if (process.argv[1] && (process.argv[1].endsWith('/cli.js') || process.argv[1].endsWith('/cli.ts') || process.argv[1].endsWith('/mcp-medic') || process.argv[1].endsWith('/mcp-doctor') || process.argv[1].endsWith('/mcpmedic') || process.argv[1].endsWith('/mcpdoctor'))) {
     main()
         .then((code) => process.exit(code))
         .catch((err) => {
-        console.error(pc.red(`mcp-doctor: unexpected error: ${err instanceof Error ? err.message : String(err)}`));
+        console.error(pc.red(`mcp-medic: unexpected error: ${err instanceof Error ? err.message : String(err)}`));
         process.exit(2);
     });
 }

package/dist/conformance.d.ts

@@ -4,7 +4,7 @@ export interface ConformanceResult {
     errors: string[];
 }
 /**
- * Conformance test helper for community check packages (mcp-doctor-check-*).
+ * Conformance test helper for community check packages (mcp-medic-check-*).
  * Validates that a Check implementation conforms strictly to CONTRACT.md.
  */
 export declare function runCheckConformanceSuite(check: Check): Promise<ConformanceResult>;

package/dist/conformance.js

@@ -1,6 +1,6 @@
 const VALID_SEVERITIES = new Set(['error', 'warning', 'info']);
 /**
- * Conformance test helper for community check packages (mcp-doctor-check-*).
+ * Conformance test helper for community check packages (mcp-medic-check-*).
  * Validates that a Check implementation conforms strictly to CONTRACT.md.
  */
 export async function runCheckConformanceSuite(check) {

package/dist/extension/index.d.ts

@@ -64,11 +64,11 @@ export interface MinimalVSCodeAPI {
 export declare function isMCPConfigFile(fileName: string): boolean;
 export declare function mapSeverity(severity: Severity, vscode: MinimalVSCodeAPI): number;
 /**
- * Validates a document content using mcp-doctor core and returns VS Code diagnostics.
+ * Validates a document content using mcp-medic core and returns VS Code diagnostics.
  */
 export declare function validateMCPDocument(document: MinimalTextDocument, vscode: MinimalVSCodeAPI): Promise<MinimalDiagnostic[]>;
 /**
- * Activates the lightweight MCP Doctor extension.
+ * Activates the lightweight MCP Medic extension.
  */
 export declare function activateExtension(context: {
     subscriptions: {

package/dist/extension/index.js

@@ -33,7 +33,7 @@ export function mapSeverity(severity, vscode) {
     }
 }
 /**
- * Validates a document content using mcp-doctor core and returns VS Code diagnostics.
+ * Validates a document content using mcp-medic core and returns VS Code diagnostics.
  */
 export async function validateMCPDocument(document, vscode) {
     if (!isMCPConfigFile(document.fileName)) {
@@ -50,7 +50,7 @@ export async function validateMCPDocument(document, vscode) {
                 range: new vscode.Range(0, 0, 0, 1),
                 message: `JSON syntax error in MCP config: ${parseErr instanceof Error ? parseErr.message : String(parseErr)}`,
                 severity: vscode.DiagnosticSeverity.Error,
-                source: 'mcp-doctor',
+                source: 'mcp-medic',
                 code: 'config.parse-error',
             },
         ];
@@ -61,7 +61,7 @@ export async function validateMCPDocument(document, vscode) {
             range: new vscode.Range(0, 0, 0, 1),
             message: errMessage,
             severity: vscode.DiagnosticSeverity.Error,
-            source: 'mcp-doctor',
+            source: 'mcp-medic',
             code: 'config.invalid-schema',
         }));
     }
@@ -79,7 +79,7 @@ export async function validateMCPDocument(document, vscode) {
             range: new vscode.Range(line, 0, line, endChar),
             message,
             severity: mapSeverity(d.severity, vscode),
-            source: 'mcp-doctor',
+            source: 'mcp-medic',
             code: d.checkId,
             suggestedFix: d.suggestedFix?.description,
         });
@@ -87,10 +87,10 @@ export async function validateMCPDocument(document, vscode) {
     return diagnostics;
 }
 /**
- * Activates the lightweight MCP Doctor extension.
+ * Activates the lightweight MCP Medic extension.
  */
 export function activateExtension(context, vscode) {
-    const collection = vscode.languages.createDiagnosticCollection('mcp-doctor');
+    const collection = vscode.languages.createDiagnosticCollection('mcp-medic');
     context.subscriptions.push(collection);
     let debounceTimer;
     const triggerValidation = (document) => {
@@ -114,7 +114,7 @@ export function activateExtension(context, vscode) {
             const currentLineText = lines[line] || '';
             return {
                 contents: [
-                    `**mcp-doctor diagnostic** (Line ${line + 1})`,
+                    `**mcp-medic diagnostic** (Line ${line + 1})`,
                     `Inspecting: \`${currentLineText.trim()}\``,
                 ],
             };

package/dist/fix.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Pure logic for `mcp-doctor fix`: applying a DiagnosticResult's
+ * `suggestedFix.patch` to the raw (untyped) config JSON that was read from
+ * disk. Deliberately has no file I/O or prompting — see src/cli.ts for the
+ * interactive `fix` command that wires this up to reads/writes/confirmation.
+ *
+ * `SuggestedFix.patch` is typed `unknown` in CONTRACT.md so any check can
+ * carry one without a CONTRACT change; this module defines and validates
+ * the one shape mcp-doctor's own checks emit and `fix` knows how to apply:
+ * a named-server, shallow field patch.
+ */
+export interface ConfigPatch {
+    /** Matches MCPServerConfig.name / config.servers[i].name in the raw JSON. */
+    serverName: string;
+    /** Shallow field values to merge into that server's raw config object. */
+    set: Record<string, unknown>;
+}
+export declare function isConfigPatch(value: unknown): value is ConfigPatch;
+export interface RawMcpConfig {
+    servers: Array<Record<string, unknown>>;
+    [key: string]: unknown;
+}
+export declare function isRawMcpConfig(value: unknown): value is RawMcpConfig;
+export interface FieldDiff {
+    field: string;
+    before: unknown;
+    after: unknown;
+}
+/**
+ * Computes what a patch would change, without mutating `rawConfig`.
+ * Returns [] when the target server can't be found, or when every field in
+ * `patch.set` already matches — i.e. the config is already fixed. This is
+ * what makes `fix` idempotent: applying an already-applied patch is a no-op
+ * with nothing to confirm.
+ */
+export declare function diffConfigPatch(rawConfig: unknown, patch: ConfigPatch): FieldDiff[];
+/**
+ * Returns a new raw config with `patch.set` fields merged into the named
+ * server. Never mutates `rawConfig`. Throws only on a structurally invalid
+ * config (not a config-shaped object) — callers should have already run it
+ * through loadConfig() before ever reaching a patch.
+ */
+export declare function applyConfigPatch(rawConfig: unknown, patch: ConfigPatch): RawMcpConfig;
+export declare function formatFieldDiff(diff: FieldDiff): string;

package/dist/fix.js

@@ -0,0 +1,85 @@
+/**
+ * Pure logic for `mcp-doctor fix`: applying a DiagnosticResult's
+ * `suggestedFix.patch` to the raw (untyped) config JSON that was read from
+ * disk. Deliberately has no file I/O or prompting — see src/cli.ts for the
+ * interactive `fix` command that wires this up to reads/writes/confirmation.
+ *
+ * `SuggestedFix.patch` is typed `unknown` in CONTRACT.md so any check can
+ * carry one without a CONTRACT change; this module defines and validates
+ * the one shape mcp-doctor's own checks emit and `fix` knows how to apply:
+ * a named-server, shallow field patch.
+ */
+export function isConfigPatch(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const v = value;
+    return (typeof v.serverName === 'string' &&
+        v.serverName.length > 0 &&
+        typeof v.set === 'object' &&
+        v.set !== null &&
+        !Array.isArray(v.set));
+}
+export function isRawMcpConfig(value) {
+    return (!!value &&
+        typeof value === 'object' &&
+        !Array.isArray(value) &&
+        Array.isArray(value.servers));
+}
+function findServer(config, serverName) {
+    return config.servers.find((s) => typeof s === 'object' && s !== null && !Array.isArray(s) && s.name === serverName);
+}
+function deepEqual(a, b) {
+    if (a === b)
+        return true;
+    if (typeof a !== typeof b)
+        return false;
+    if (a && b && typeof a === 'object' && typeof b === 'object') {
+        return JSON.stringify(a) === JSON.stringify(b);
+    }
+    return false;
+}
+/**
+ * Computes what a patch would change, without mutating `rawConfig`.
+ * Returns [] when the target server can't be found, or when every field in
+ * `patch.set` already matches — i.e. the config is already fixed. This is
+ * what makes `fix` idempotent: applying an already-applied patch is a no-op
+ * with nothing to confirm.
+ */
+export function diffConfigPatch(rawConfig, patch) {
+    if (!isRawMcpConfig(rawConfig))
+        return [];
+    const server = findServer(rawConfig, patch.serverName);
+    if (!server)
+        return [];
+    const diffs = [];
+    for (const [field, after] of Object.entries(patch.set)) {
+        const before = server[field];
+        if (!deepEqual(before, after)) {
+            diffs.push({ field, before, after });
+        }
+    }
+    return diffs;
+}
+/**
+ * Returns a new raw config with `patch.set` fields merged into the named
+ * server. Never mutates `rawConfig`. Throws only on a structurally invalid
+ * config (not a config-shaped object) — callers should have already run it
+ * through loadConfig() before ever reaching a patch.
+ */
+export function applyConfigPatch(rawConfig, patch) {
+    if (!isRawMcpConfig(rawConfig)) {
+        throw new Error('applyConfigPatch: expected a config object with a "servers" array');
+    }
+    return {
+        ...rawConfig,
+        servers: rawConfig.servers.map((s) => {
+            if (typeof s === 'object' && s !== null && !Array.isArray(s) && s.name === patch.serverName) {
+                return { ...s, ...patch.set };
+            }
+            return s;
+        }),
+    };
+}
+export function formatFieldDiff(diff) {
+    return `  - ${diff.field}: ${JSON.stringify(diff.before)}\n  + ${diff.field}: ${JSON.stringify(diff.after)}`;
+}

package/dist/junit.js

@@ -14,7 +14,7 @@ export function formatReportJUnit(report) {
     const totalTests = Math.max(1, report.connections.length + report.diagnostics.length);
     const totalErrors = report.summary.errors;
     lines.push('<?xml version="1.0" encoding="UTF-8"?>');
-    lines.push(`<testsuites name="mcp-doctor" tests="${totalTests}" failures="${totalErrors}" errors="0">`);
+    lines.push(`<testsuites name="mcp-medic" tests="${totalTests}" failures="${totalErrors}" errors="0">`);
     lines.push(`  <testsuite name="${escapeXml(report.configSource || 'mcp-config')}" tests="${totalTests}" failures="${totalErrors}">`);
     // Connection testcases
     for (const conn of report.connections) {
@@ -51,7 +51,7 @@ export function formatReportJUnit(report) {
 export function formatFleetReportJUnit(fleetReport) {
     const lines = [];
     lines.push('<?xml version="1.0" encoding="UTF-8"?>');
-    lines.push(`<testsuites name="mcp-doctor-fleet" tests="${fleetReport.totalServers}" failures="${fleetReport.totalErrors}">`);
+    lines.push(`<testsuites name="mcp-medic-fleet" tests="${fleetReport.totalServers}" failures="${fleetReport.totalErrors}">`);
     for (const fileResult of fleetReport.fileResults) {
         if (fileResult.report) {
             const rep = fileResult.report;

package/dist/policy.d.ts

@@ -1,14 +1,15 @@
 import type { Check, TransportType } from './types.js';
-export interface MCPDoctorPolicy {
+export interface MCPMedicPolicy {
     bannedTransports?: TransportType[];
     allowedDomains?: string[];
     minDescriptionLength?: number;
     requireToolDescriptions?: boolean;
 }
+export type MCPDoctorPolicy = MCPMedicPolicy;
 /**
- * Loads a policy from a file path, or auto-discovers .mcp-doctor-policy.json in cwd.
+ * Loads a policy from a file path, or auto-discovers .mcp-medic-policy.json (or .mcp-doctor-policy.json) in cwd.
  */
-export declare function loadPolicy(policyPath?: string, cwd?: string): MCPDoctorPolicy | undefined;
+export declare function loadPolicy(policyPath?: string, cwd?: string): MCPMedicPolicy | undefined;
 /**
  * Creates composable Check instances from an organization policy.
  * Policy checks seamlessly integrate with the standard Check interface.

package/dist/policy.js

@@ -1,10 +1,16 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { resolve } from 'node:path';
 /**
- * Loads a policy from a file path, or auto-discovers .mcp-doctor-policy.json in cwd.
+ * Loads a policy from a file path, or auto-discovers .mcp-medic-policy.json (or .mcp-doctor-policy.json) in cwd.
  */
 export function loadPolicy(policyPath, cwd = process.cwd()) {
-    const targetPath = policyPath ? resolve(policyPath) : resolve(cwd, '.mcp-doctor-policy.json');
+    let targetPath = policyPath ? resolve(policyPath) : resolve(cwd, '.mcp-medic-policy.json');
+    if (!policyPath && !existsSync(targetPath)) {
+        const fallbackPath = resolve(cwd, '.mcp-doctor-policy.json');
+        if (existsSync(fallbackPath)) {
+            targetPath = fallbackPath;
+        }
+    }
     if (!existsSync(targetPath)) {
         return undefined;
     }
@@ -81,7 +87,7 @@ export function createPolicyChecks(policy) {
                                 serverName: connection.server.name,
                                 details: { hostname, allowedDomains: allowed, url: connection.server.url },
                                 suggestedFix: {
-                                    description: `Configure server "${connection.server.name}" to use an approved domain or update .mcp-doctor-policy.json.`,
+                                    description: `Configure server "${connection.server.name}" to use an approved domain or update policy configuration.`,
                                 },
                             });
                         }

package/dist/protocol/connect.js

@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process';
 const PROTOCOL_VERSION = '2024-11-05';
-const CLIENT_INFO = { name: 'mcp-doctor', version: '0.0.1' };
+const CLIENT_INFO = { name: 'mcp-medic', version: '1.0.0' };
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }

package/dist/report.js

@@ -1,7 +1,7 @@
 /** Human-readable plain text report formatter. */
 export function formatReportHuman(report, options = {}) {
     const lines = [];
-    lines.push(`mcp-doctor report${report.configSource ? ` — ${report.configSource}` : ''}`);
+    lines.push(`mcp-medic report${report.configSource ? ` — ${report.configSource}` : ''}`);
     lines.push(`${report.summary.connected}/${report.summary.servers} servers connected, ` +
         `${report.summary.errors} error(s), ${report.summary.warnings} warning(s)`);
     lines.push('');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-medic",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Diagnose broken MCP (Model Context Protocol) server configs before they break your agent silently.",
   "type": "module",
   "main": "dist/index.js",
@@ -17,9 +17,11 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
+    "prepack": "npm run build",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "release": "node scripts/auto-release.js"
   },
   "keywords": [
     "mcp",