mcp-medic 1.2.0 → 1.2.2

package/dist/cli.d.ts

@@ -8,6 +8,7 @@ export interface ParsedArgs {
     policyPath?: string;
     exportJunit?: string;
     exportJson?: string;
+    exportSarif?: string;
     snapshotPath?: string;
     updateSnapshotPath?: string;
     json: boolean;
@@ -17,6 +18,8 @@ export interface ParsedArgs {
     failOn: 'error' | 'warning';
     checkFilter?: string;
     dryRun: boolean;
+    /** "auto" (default) or an explicit MCP protocolVersion string, e.g. "2025-06-18". */
+    protocolVersion: string;
 }
 /** Prompts the user with `question` and resolves true for an explicit "y"/"yes" answer. */
 export type ConfirmFn = (question: string) => Promise<boolean>;

package/dist/cli.js

@@ -13,6 +13,8 @@ import { isConfigPatch, diffConfigPatch, applyConfigPatch } from './fix.js';
 import { loadPolicy, createPolicyChecks } from './policy.js';
 import { runFleetChecks, diffConfigs, filterDiagnosticsByBaseline } from './fleet.js';
 import { formatReportJUnit, formatFleetReportJUnit } from './junit.js';
+import { formatReportSarif } from './sarif.js';
+import { SUPPORTED_PROTOCOL_VERSIONS } from './protocol/versions.js';
 import pc from 'picocolors';
 export function parseArgs(argv) {
     const args = {
@@ -22,6 +24,7 @@ export function parseArgs(argv) {
         verbose: false,
         failOn: 'error',
         dryRun: false,
+        protocolVersion: 'auto',
     };
     const positional = [];
     for (let i = 0; i < argv.length; i++) {
@@ -67,6 +70,9 @@ export function parseArgs(argv) {
         else if (arg === '--export-json') {
             args.exportJson = argv[++i];
         }
+        else if (arg === '--export-sarif') {
+            args.exportSarif = argv[++i];
+        }
         else if (arg === '--snapshot') {
             args.snapshotPath = argv[++i];
         }
@@ -95,6 +101,13 @@ export function parseArgs(argv) {
             }
             args.timeoutMs = parsed;
         }
+        else if (arg === '--protocol-version') {
+            const val = argv[++i];
+            if (!val) {
+                throw new Error(`--protocol-version requires a value: "auto" or an explicit version (e.g. ${SUPPORTED_PROTOCOL_VERSIONS[0]})`);
+            }
+            args.protocolVersion = val;
+        }
         else {
             positional.push(arg);
         }
@@ -182,14 +195,23 @@ OPTIONS
   --update-snapshot <p> Save diagnostic report as new baseline snapshot
   --export-junit <file> Export report in JUnit XML format
   --export-json <file>  Export report in JSON format
+  --export-sarif <file> Export report in SARIF 2.1.0 format (GitHub Code Scanning, etc.)
   --show-fixes          Print actionable suggested fixes under diagnostics
   --fail-on <severity>  Exit with code 1 on 'error' (default) or 'warning'
   --verbose, -v         Print raw JSON-RPC traffic and debug messages
   --json                Output report in JSON format
   --timeout <ms>        Per-server handshake timeout in milliseconds (default: 5000)
+  --protocol-version <v> MCP protocolVersion to request: "auto" (default, latest supported)
+                        or an explicit version, e.g. ${SUPPORTED_PROTOCOL_VERSIONS[SUPPORTED_PROTOCOL_VERSIONS.length - 1]}
   --help, -h            Show help
   --version, -V         Print the installed mcp-medic version
 
+PROTOCOL VERSIONS
+  This client supports: ${SUPPORTED_PROTOCOL_VERSIONS.join(', ')}
+  "auto" requests ${SUPPORTED_PROTOCOL_VERSIONS[0]} (the newest). The server may negotiate an
+  older version instead; mcp-medic reports both and fails cleanly if the
+  negotiated version isn't one this client supports.
+
 FIX OPTIONS (mcp-medic fix)
   --check <id>          Only offer fixes from this check id (e.g. security.untrusted-remote)
   --dry-run             Show every available fix as a diff; apply nothing, prompt for nothing
@@ -222,6 +244,10 @@ function colorizeHumanReport(text) {
             return pc.yellow(line);
         if (/Suggested fix:/.test(line))
             return pc.cyan(line);
+        if (/^\s*Protocol:.*✗ incompatible/.test(line))
+            return pc.red(line);
+        if (/^\s*Protocol:/.test(line))
+            return pc.dim(line);
         return line;
     })
         .join('\n');
@@ -232,6 +258,7 @@ async function executeCheck(config, args) {
         timeoutMs: args.timeoutMs,
         checks,
         verbose: args.verbose,
+        protocolVersion: args.protocolVersion,
     });
     // Handle baseline snapshot comparison
     if (args.snapshotPath) {
@@ -275,6 +302,15 @@ async function executeCheck(config, args) {
             console.error(pc.red(`Failed to write JSON export: ${String(err)}`));
         }
     }
+    // Handle SARIF export
+    if (args.exportSarif) {
+        try {
+            writeFileSync(resolve(args.exportSarif), formatReportSarif(report));
+        }
+        catch (err) {
+            console.error(pc.red(`Failed to write SARIF export: ${String(err)}`));
+        }
+    }
     if (args.json) {
         console.log(formatReportJSON(report));
     }
@@ -338,7 +374,12 @@ async function defaultConfirm(question) {
  */
 async function executeFix(configPath, rawText, rawJson, config, args, confirm) {
     const [checks] = await Promise.all([loadChecks(args.policyPath), loadProtocol()]);
-    const report = await runChecks(config, { timeoutMs: args.timeoutMs, checks, verbose: args.verbose });
+    const report = await runChecks(config, {
+        timeoutMs: args.timeoutMs,
+        checks,
+        verbose: args.verbose,
+        protocolVersion: args.protocolVersion,
+    });
     let fixable = report.diagnostics.filter((d) => isConfigPatch(d.suggestedFix?.patch));
     if (args.checkFilter) {
         fixable = fixable.filter((d) => d.checkId === args.checkFilter);
@@ -496,6 +537,7 @@ export async function main(argv = process.argv.slice(2), deps = {}) {
             checks,
             timeoutMs: args.timeoutMs,
             verbose: args.verbose,
+            protocolVersion: args.protocolVersion,
         });
         if (args.exportJunit) {
             try {

package/dist/fleet.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { loadConfig } from './config-loader.js';
 import { runChecks } from './orchestrator.js';
 import { allChecks } from './checks/index.js';
+import { redactRecord } from './redact.js';
 function findFilesMatching(dir, pattern, results = []) {
     if (!existsSync(dir))
         return results;
@@ -114,7 +115,10 @@ export function diffConfigs(configA, configB) {
                 changes.push({ field: 'url', from: serverA.url, to: serverB.url });
             }
             if (JSON.stringify(serverA.env) !== JSON.stringify(serverB.env)) {
-                changes.push({ field: 'env', from: serverA.env, to: serverB.env });
+                // Report that env changed and which keys, but never raw values —
+                // env vars routinely carry API keys/tokens and diff output gets
+                // pasted into PRs and CI logs.
+                changes.push({ field: 'env', from: redactRecord(serverA.env), to: redactRecord(serverB.env) });
             }
             if (changes.length > 0) {
                 entries.push({ serverName: name, kind: 'modified', changes });

package/dist/index.d.ts

@@ -16,5 +16,9 @@ export type { MCPDoctorPolicy } from './policy.js';
 export { runFleetChecks, diffConfigs, filterDiagnosticsByBaseline, findConfigFiles, } from './fleet.js';
 export type { FleetReport, ConfigDiffResult, ConfigDiffEntry, FileRunResult } from './fleet.js';
 export { formatReportJUnit, formatFleetReportJUnit } from './junit.js';
+export { formatReportSarif } from './sarif.js';
 export { allChecks } from './checks/index.js';
+export { SUPPORTED_PROTOCOL_VERSIONS, LATEST_SUPPORTED_PROTOCOL_VERSION, KNOWN_UNSUPPORTED_PROTOCOL_VERSIONS, isSupportedProtocolVersion, resolveRequestedProtocolVersion, } from './protocol/versions.js';
+export type { SupportedProtocolVersion, ProtocolVersionNegotiation } from './protocol/versions.js';
+export { isSecretKey, redactRecord, redactDeep, sanitizeServerConfig } from './redact.js';
 export * from './types.js';

package/dist/index.js

@@ -9,5 +9,8 @@ export { isMCPConfigFile, validateMCPDocument, activateExtension } from './exten
 export { loadPolicy, createPolicyChecks } from './policy.js';
 export { runFleetChecks, diffConfigs, filterDiagnosticsByBaseline, findConfigFiles, } from './fleet.js';
 export { formatReportJUnit, formatFleetReportJUnit } from './junit.js';
+export { formatReportSarif } from './sarif.js';
 export { allChecks } from './checks/index.js';
+export { SUPPORTED_PROTOCOL_VERSIONS, LATEST_SUPPORTED_PROTOCOL_VERSION, KNOWN_UNSUPPORTED_PROTOCOL_VERSIONS, isSupportedProtocolVersion, resolveRequestedProtocolVersion, } from './protocol/versions.js';
+export { isSecretKey, redactRecord, redactDeep, sanitizeServerConfig } from './redact.js';
 export * from './types.js';

package/dist/orchestrator.js

@@ -1,3 +1,4 @@
+import { sanitizeServerConfig } from './redact.js';
 async function connectStub(config) {
     return {
         server: config,
@@ -21,7 +22,12 @@ export async function runChecks(config, options = {}) {
     const connections = [];
     const diagnostics = [];
     for (const server of config.servers) {
-        const connection = await connectImpl(server, timeoutMs, options);
+        const rawConnection = await connectImpl(server, timeoutMs, options);
+        // Redact secret-looking header/env/token-body values before this ever
+        // reaches a report, JSON export, or JUnit output — checks only read
+        // `server.name`/`transport`/`url`, never header or env *values*, so
+        // this can't change diagnostic behavior.
+        const connection = { ...rawConnection, server: sanitizeServerConfig(server) };
         connections.push(connection);
         if (connection.status !== 'connected') {
             continue; // checks require a live connection; connection failure is its own signal in the report

package/dist/protocol/connect.js

@@ -1,6 +1,18 @@
 import { spawn } from 'node:child_process';
-const PROTOCOL_VERSION = '2024-11-05';
-const CLIENT_INFO = { name: 'mcp-medic', version: '1.0.0' };
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { KNOWN_UNSUPPORTED_PROTOCOL_VERSIONS, SUPPORTED_PROTOCOL_VERSIONS, isSupportedProtocolVersion, resolveRequestedProtocolVersion, } from './versions.js';
+function readOwnVersion() {
+    try {
+        const pkgPath = fileURLToPath(new URL('../../package.json', import.meta.url));
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+const CLIENT_INFO = { name: 'mcp-medic', version: readOwnVersion() };
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -12,8 +24,24 @@ function logVerbose(options, message) {
         console.error(`[debug] ${message}`);
     }
 }
-function failed(config, status, stage, message, raw) {
-    return { server: config, status, error: { stage, message, ...(raw === undefined ? {} : { raw }) } };
+function failed(config, status, stage, message, raw, extra) {
+    return {
+        server: config,
+        status,
+        error: { stage, message, ...(raw === undefined ? {} : { raw }) },
+        ...extra,
+    };
+}
+function normalizeServerInfo(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const record = value;
+    const info = {};
+    if (typeof record.name === 'string')
+        info.name = record.name;
+    if (typeof record.version === 'string')
+        info.version = record.version;
+    return info.name || info.version ? info : undefined;
 }
 function withTimeout(promise, timeoutMs, label) {
     return new Promise((resolve, reject) => {
@@ -54,6 +82,37 @@ function normalizeTools(result) {
         };
     });
 }
+function normalizeResources(result) {
+    if (!Array.isArray(result.resources))
+        throw new Error('resources/list response has no resources array');
+    return result.resources.map((resource, index) => {
+        if (!resource || typeof resource !== 'object' || typeof resource.uri !== 'string') {
+            throw new Error(`resources/list returned an invalid resource at index ${index}`);
+        }
+        const value = resource;
+        return {
+            uri: value.uri,
+            ...(typeof value.name === 'string' ? { name: value.name } : {}),
+            ...(typeof value.description === 'string' ? { description: value.description } : {}),
+            ...(typeof value.mimeType === 'string' ? { mimeType: value.mimeType } : {}),
+        };
+    });
+}
+function normalizePrompts(result) {
+    if (!Array.isArray(result.prompts))
+        throw new Error('prompts/list response has no prompts array');
+    return result.prompts.map((prompt, index) => {
+        if (!prompt || typeof prompt !== 'object' || typeof prompt.name !== 'string') {
+            throw new Error(`prompts/list returned an invalid prompt at index ${index}`);
+        }
+        const value = prompt;
+        return {
+            name: value.name,
+            ...(typeof value.description === 'string' ? { description: value.description } : {}),
+            ...(Array.isArray(value.arguments) ? { arguments: value.arguments } : {}),
+        };
+    });
+}
 async function refreshTokenIfNeeded(config, options) {
     const headers = { ...(config.headers ?? {}) };
     if (!config.tokenRefreshUrl) {
@@ -347,6 +406,16 @@ class SseTransport {
 }
 export async function connect(config, timeoutMs, options) {
     const started = Date.now();
+    const requestedVersion = resolveRequestedProtocolVersion(options?.protocolVersion);
+    // Some real MCP protocol versions use a wire shape this client doesn't
+    // implement (e.g. 2026-07-28 drops the initialize handshake entirely).
+    // Fail fast on those, before spawning a process or opening a connection,
+    // rather than attempting a handshake that was never going to work.
+    const unsupportedReason = KNOWN_UNSUPPORTED_PROTOCOL_VERSIONS[requestedVersion];
+    if (unsupportedReason) {
+        return failed(config, 'failed', 'handshake', `cannot request protocol version ${requestedVersion}: ${unsupportedReason}. ` +
+            `This client supports: ${SUPPORTED_PROTOCOL_VERSIONS.join(', ')}.`);
+    }
     let transport;
     try {
         if (config.transport === 'stdio') {
@@ -371,42 +440,97 @@ export async function connect(config, timeoutMs, options) {
         else {
             return failed(config, 'failed', 'spawn', `unsupported transport: ${String(config.transport)}`);
         }
+        // Requests are numbered sequentially in the order they're actually sent
+        // (notifications don't consume an id) — tracked locally rather than
+        // hardcoded, since which optional capability calls happen below depends
+        // on what the server declares.
+        let nextExpectedId = 1;
         let initialize;
         try {
             const response = await withTimeout(transport.request('initialize', {
-                protocolVersion: PROTOCOL_VERSION,
+                protocolVersion: requestedVersion,
                 capabilities: {},
                 clientInfo: CLIENT_INFO,
             }), timeoutMs, 'initialize handshake');
-            initialize = validateResponse(response, 1);
+            initialize = validateResponse(response, nextExpectedId++);
             if (!initialize.capabilities || typeof initialize.capabilities !== 'object') {
                 throw new Error('initialize response has no capabilities object');
             }
+            if (typeof initialize.protocolVersion !== 'string' || !initialize.protocolVersion) {
+                throw new Error('initialize response is missing a protocolVersion string (protocol violation — ' +
+                    'the server MUST report the version it negotiated)');
+            }
         }
         catch (error) {
             const timedOut = messageOf(error).includes('timed out');
             const message = messageOf(error);
             return failed(config, timedOut ? 'timeout' : 'failed', message.startsWith('failed to start') ? 'spawn' : 'handshake', message, error);
         }
+        const negotiatedVersion = initialize.protocolVersion;
+        const compatible = isSupportedProtocolVersion(negotiatedVersion);
+        const protocolVersion = { requested: requestedVersion, negotiated: negotiatedVersion, compatible };
+        const serverInfo = normalizeServerInfo(initialize.serverInfo);
+        const capabilities = initialize.capabilities;
+        if (!compatible) {
+            // Per spec: if the client doesn't support the version the server
+            // negotiated, it SHOULD disconnect rather than proceed — don't send
+            // notifications/initialized or tools/list against a protocol version
+            // this client can't actually speak.
+            return failed(config, 'failed', 'handshake', `protocol version mismatch: requested ${requestedVersion}, server negotiated ` +
+                `${negotiatedVersion}, which this client does not support. ` +
+                `This client supports: ${SUPPORTED_PROTOCOL_VERSIONS.join(', ')}.`, undefined, { protocolVersion, serverInfo, latencyMs: Date.now() - started });
+        }
         try {
             await withTimeout(transport.notify('notifications/initialized'), timeoutMs, 'initialized notification');
         }
         catch (error) {
-            return failed(config, messageOf(error).includes('timed out') ? 'timeout' : 'failed', 'capability-negotiation', messageOf(error), error);
+            return failed(config, messageOf(error).includes('timed out') ? 'timeout' : 'failed', 'capability-negotiation', messageOf(error), error, { protocolVersion, serverInfo });
         }
+        let tools;
         try {
-            const tools = normalizeTools(validateResponse(await withTimeout(transport.request('tools/list'), timeoutMs, 'tools/list'), 2));
-            return {
-                server: config,
-                status: 'connected',
-                capabilities: initialize.capabilities,
-                tools,
-                latencyMs: Date.now() - started,
-            };
+            tools = normalizeTools(validateResponse(await withTimeout(transport.request('tools/list'), timeoutMs, 'tools/list'), nextExpectedId++));
         }
         catch (error) {
-            return failed(config, messageOf(error).includes('timed out') ? 'timeout' : 'failed', 'list-tools', messageOf(error), error);
+            return failed(config, messageOf(error).includes('timed out') ? 'timeout' : 'failed', 'list-tools', messageOf(error), error, { protocolVersion, serverInfo });
+        }
+        // Resources and prompts are optional MCP capabilities: only inspect them
+        // if the server actually declared support in its initialize response.
+        // Passive enumeration only (resources/list, prompts/list) — never
+        // resources/read or prompts/get, which would be real invocation.
+        // A failure here is never fatal to the connection: tools is the one
+        // capability mcp-medic requires, so a broken resources/prompts listing
+        // is reported alongside a still-successful connection.
+        let resources;
+        let prompts;
+        const capabilityErrors = {};
+        if (capabilities.resources && typeof capabilities.resources === 'object') {
+            try {
+                resources = normalizeResources(validateResponse(await withTimeout(transport.request('resources/list'), timeoutMs, 'resources/list'), nextExpectedId++));
+            }
+            catch (error) {
+                capabilityErrors.resources = messageOf(error);
+            }
+        }
+        if (capabilities.prompts && typeof capabilities.prompts === 'object') {
+            try {
+                prompts = normalizePrompts(validateResponse(await withTimeout(transport.request('prompts/list'), timeoutMs, 'prompts/list'), nextExpectedId++));
+            }
+            catch (error) {
+                capabilityErrors.prompts = messageOf(error);
+            }
         }
+        return {
+            server: config,
+            status: 'connected',
+            capabilities,
+            tools,
+            ...(resources !== undefined ? { resources } : {}),
+            ...(prompts !== undefined ? { prompts } : {}),
+            ...(Object.keys(capabilityErrors).length > 0 ? { capabilityErrors } : {}),
+            protocolVersion,
+            serverInfo,
+            latencyMs: Date.now() - started,
+        };
     }
     catch (error) {
         return failed(config, 'failed', 'handshake', messageOf(error), error);

package/dist/protocol/index.d.ts

@@ -1,3 +1,4 @@
 import { connect } from './connect.js';
 export declare function registerProtocol(): void;
 export { connect };
+export * from './versions.js';

package/dist/protocol/index.js

@@ -4,3 +4,4 @@ export function registerProtocol() {
     registerConnectImpl(connect);
 }
 export { connect };
+export * from './versions.js';

package/dist/protocol/versions.d.ts

@@ -0,0 +1,43 @@
+/**
+ * MCP protocol version support, centralized so it isn't scattered across
+ * the transport implementation.
+ *
+ * Source of truth: the official MCP specification's versioned schema
+ * directories, https://github.com/modelcontextprotocol/modelcontextprotocol/tree/main/schema
+ * (checked directly rather than assumed — do not add a version here
+ * without confirming it against that list).
+ *
+ * `SUPPORTED_PROTOCOL_VERSIONS` lists every version whose wire shape this
+ * client's transport (an `initialize` request, a `notifications/initialized`
+ * notification, then `tools/list`) can correctly speak. `2024-11-05`
+ * through `2025-11-25` are additive on top of that same handshake model —
+ * this client doesn't implement every feature each of them adds (OAuth
+ * flows, icons, elicitation, tasks, ...), but it doesn't need to: it only
+ * ever sends `initialize`/`notifications/initialized`/`tools/list`, and a
+ * spec-compliant server response to those three calls has the same shape
+ * across all four versions (any additive fields in between are safely
+ * ignored by a client that never reads them).
+ */
+export declare const SUPPORTED_PROTOCOL_VERSIONS: readonly ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
+export type SupportedProtocolVersion = (typeof SUPPORTED_PROTOCOL_VERSIONS)[number];
+/** The version requested when the caller asks for "auto" (or specifies nothing). */
+export declare const LATEST_SUPPORTED_PROTOCOL_VERSION: SupportedProtocolVersion;
+/**
+ * Real MCP protocol versions that exist but use a wire shape this client
+ * does not implement, keyed by version string, valued by why. Requesting
+ * one of these fails fast with an explicit reason instead of attempting
+ * (and inevitably failing) an `initialize` call the server was never going
+ * to understand the way this client sends it.
+ */
+export declare const KNOWN_UNSUPPORTED_PROTOCOL_VERSIONS: Readonly<Record<string, string>>;
+export declare function isSupportedProtocolVersion(version: string): version is SupportedProtocolVersion;
+/** Resolves a user-facing `--protocol-version` value ("auto" or a literal version) to the version to request. */
+export declare function resolveRequestedProtocolVersion(preference: string | undefined): string;
+export interface ProtocolVersionNegotiation {
+    /** The protocolVersion this client sent in `initialize`. */
+    requested: string;
+    /** The protocolVersion the server returned in its `initialize` response, if it sent a valid one. */
+    negotiated?: string;
+    /** Whether `negotiated` is a version this client's transport can actually speak. */
+    compatible: boolean;
+}

package/dist/protocol/versions.js

@@ -0,0 +1,51 @@
+/**
+ * MCP protocol version support, centralized so it isn't scattered across
+ * the transport implementation.
+ *
+ * Source of truth: the official MCP specification's versioned schema
+ * directories, https://github.com/modelcontextprotocol/modelcontextprotocol/tree/main/schema
+ * (checked directly rather than assumed — do not add a version here
+ * without confirming it against that list).
+ *
+ * `SUPPORTED_PROTOCOL_VERSIONS` lists every version whose wire shape this
+ * client's transport (an `initialize` request, a `notifications/initialized`
+ * notification, then `tools/list`) can correctly speak. `2024-11-05`
+ * through `2025-11-25` are additive on top of that same handshake model —
+ * this client doesn't implement every feature each of them adds (OAuth
+ * flows, icons, elicitation, tasks, ...), but it doesn't need to: it only
+ * ever sends `initialize`/`notifications/initialized`/`tools/list`, and a
+ * spec-compliant server response to those three calls has the same shape
+ * across all four versions (any additive fields in between are safely
+ * ignored by a client that never reads them).
+ */
+export const SUPPORTED_PROTOCOL_VERSIONS = [
+    '2025-11-25',
+    '2025-06-18',
+    '2025-03-26',
+    '2024-11-05',
+];
+/** The version requested when the caller asks for "auto" (or specifies nothing). */
+export const LATEST_SUPPORTED_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0];
+/**
+ * Real MCP protocol versions that exist but use a wire shape this client
+ * does not implement, keyed by version string, valued by why. Requesting
+ * one of these fails fast with an explicit reason instead of attempting
+ * (and inevitably failing) an `initialize` call the server was never going
+ * to understand the way this client sends it.
+ */
+export const KNOWN_UNSUPPORTED_PROTOCOL_VERSIONS = {
+    '2026-07-28': "removes the initialize/notifications-initialized handshake entirely in favor of a stateless " +
+        "per-request model (a server/discover RPC, protocol version and capabilities carried per-request " +
+        "in _meta fields) — a different wire protocol this client doesn't implement yet",
+};
+export function isSupportedProtocolVersion(version) {
+    return SUPPORTED_PROTOCOL_VERSIONS.includes(version);
+}
+/** Resolves a user-facing `--protocol-version` value ("auto" or a literal version) to the version to request. */
+export function resolveRequestedProtocolVersion(preference) {
+    const trimmed = preference?.trim();
+    if (!trimmed || trimmed === 'auto') {
+        return LATEST_SUPPORTED_PROTOCOL_VERSION;
+    }
+    return trimmed;
+}

package/dist/redact.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Secret redaction for anything that ends up in a report, diff, or log line.
+ *
+ * mcp-medic's `MCPServerConfig` can carry live credentials — HTTP headers
+ * (`Authorization: Bearer ...`), stdio process env vars (`API_KEY=...`),
+ * and OAuth `tokenRefreshBody` fields (`client_secret`, ...). None of that
+ * should ever reach `--json`/`--export-json` output, `diff` output, or
+ * `--verbose` logs verbatim — those are routinely pasted into CI logs,
+ * issue trackers, and Slack.
+ */
+export declare function isSecretKey(key: string): boolean;
+/** Redacts values of secret-looking keys in a flat string-keyed record.
+ * Non-secret keys (e.g. `Content-Type`, `NODE_ENV`) are left untouched so
+ * the output stays useful for debugging. */
+export declare function redactRecord(record: Record<string, string> | undefined): Record<string, string> | undefined;
+/** Redacts secret-looking keys anywhere in an arbitrary JSON-like value
+ * (objects/arrays nested to any depth). Used for loosely-typed structures
+ * such as `tokenRefreshBody`. */
+export declare function redactDeep(value: unknown): unknown;
+/** Shape-preserving subset of `MCPServerConfig`'s secret-carrying fields —
+ * kept local (rather than importing the real type) so this module has no
+ * dependency on `types.ts` and can't accidentally widen what it touches. */
+interface SanitizableServerConfig {
+    headers?: Record<string, string>;
+    env?: Record<string, string>;
+    tokenRefreshBody?: Record<string, unknown>;
+}
+/** Returns a shallow copy of a server config with `headers`, `env`, and
+ * `tokenRefreshBody` secret-looking values redacted. Safe to call before
+ * a connection result is stored in a report or diff — no built-in check
+ * reads these fields' values (only `name`/`transport`/`url`), so redacting
+ * them here doesn't change diagnostic behavior. */
+export declare function sanitizeServerConfig<T extends SanitizableServerConfig>(server: T): T;
+export {};

package/dist/redact.js

@@ -0,0 +1,61 @@
+/**
+ * Secret redaction for anything that ends up in a report, diff, or log line.
+ *
+ * mcp-medic's `MCPServerConfig` can carry live credentials — HTTP headers
+ * (`Authorization: Bearer ...`), stdio process env vars (`API_KEY=...`),
+ * and OAuth `tokenRefreshBody` fields (`client_secret`, ...). None of that
+ * should ever reach `--json`/`--export-json` output, `diff` output, or
+ * `--verbose` logs verbatim — those are routinely pasted into CI logs,
+ * issue trackers, and Slack.
+ */
+const REDACTED = '[REDACTED]';
+/** Matches key names that conventionally carry secret values. Intentionally
+ * broad — false positives (redacting a harmless key) are safe; false
+ * negatives (leaking a secret) are not. */
+const SECRET_KEY_PATTERN = /(authorization|auth|token|secret|password|passwd|pwd|api[-_]?key|apikey|cookie|credential|bearer|session|private[-_]?key|client[-_]?secret)/i;
+export function isSecretKey(key) {
+    return SECRET_KEY_PATTERN.test(key);
+}
+/** Redacts values of secret-looking keys in a flat string-keyed record.
+ * Non-secret keys (e.g. `Content-Type`, `NODE_ENV`) are left untouched so
+ * the output stays useful for debugging. */
+export function redactRecord(record) {
+    if (!record)
+        return record;
+    const result = {};
+    for (const [key, value] of Object.entries(record)) {
+        result[key] = isSecretKey(key) ? REDACTED : value;
+    }
+    return result;
+}
+/** Redacts secret-looking keys anywhere in an arbitrary JSON-like value
+ * (objects/arrays nested to any depth). Used for loosely-typed structures
+ * such as `tokenRefreshBody`. */
+export function redactDeep(value) {
+    if (Array.isArray(value)) {
+        return value.map(redactDeep);
+    }
+    if (value && typeof value === 'object') {
+        const result = {};
+        for (const [key, v] of Object.entries(value)) {
+            result[key] = isSecretKey(key) ? REDACTED : redactDeep(v);
+        }
+        return result;
+    }
+    return value;
+}
+/** Returns a shallow copy of a server config with `headers`, `env`, and
+ * `tokenRefreshBody` secret-looking values redacted. Safe to call before
+ * a connection result is stored in a report or diff — no built-in check
+ * reads these fields' values (only `name`/`transport`/`url`), so redacting
+ * them here doesn't change diagnostic behavior. */
+export function sanitizeServerConfig(server) {
+    return {
+        ...server,
+        ...(server.headers !== undefined ? { headers: redactRecord(server.headers) } : {}),
+        ...(server.env !== undefined ? { env: redactRecord(server.env) } : {}),
+        ...(server.tokenRefreshBody !== undefined
+            ? { tokenRefreshBody: redactDeep(server.tokenRefreshBody) }
+            : {}),
+    };
+}

package/dist/report.js

@@ -8,6 +8,25 @@ export function formatReportHuman(report, options = {}) {
     for (const conn of report.connections) {
         const status = conn.status === 'connected' ? 'OK' : conn.status.toUpperCase();
         lines.push(`[${status}] ${conn.server.name} (${conn.server.transport})`);
+        if (conn.protocolVersion) {
+            const { requested, negotiated, compatible } = conn.protocolVersion;
+            const statusText = compatible ? '✓ compatible' : '✗ incompatible';
+            lines.push(`  Protocol: requested ${requested}, server negotiated ${negotiated ?? '(none)'} — ${statusText}`);
+        }
+        if (conn.tools) {
+            const parts = [`${conn.tools.length} tool(s)`];
+            if (conn.resources)
+                parts.push(`${conn.resources.length} resource(s)`);
+            if (conn.prompts)
+                parts.push(`${conn.prompts.length} prompt(s)`);
+            lines.push(`  Capabilities: ${parts.join(', ')}`);
+        }
+        if (conn.capabilityErrors?.resources) {
+            lines.push(`  resources/list: ${conn.capabilityErrors.resources}`);
+        }
+        if (conn.capabilityErrors?.prompts) {
+            lines.push(`  prompts/list: ${conn.capabilityErrors.prompts}`);
+        }
         if (conn.error) {
             lines.push(`  ${conn.error.stage}: ${conn.error.message}`);
         }

package/dist/sarif.d.ts

@@ -0,0 +1,11 @@
+import type { RunReport } from './types.js';
+/**
+ * Formats a RunReport as SARIF 2.1.0 (https://sarifweb.azurewebsites.net/),
+ * consumable by GitHub Code Scanning (`upload-sarif`) and other SARIF
+ * viewers. mcp-medic's diagnostics have no source line/column — they're
+ * about a *running server's* declared tools/capabilities, not source code —
+ * so each result's physicalLocation points at the config file the server
+ * was declared in, with the server (and tool, if any) named as a logical
+ * location instead of a line range.
+ */
+export declare function formatReportSarif(report: RunReport): string;

package/dist/sarif.js

@@ -0,0 +1,77 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+function readOwnVersion() {
+    try {
+        const pkgPath = fileURLToPath(new URL('../package.json', import.meta.url));
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+function sarifLevel(severity) {
+    if (severity === 'error')
+        return 'error';
+    if (severity === 'warning')
+        return 'warning';
+    return 'note';
+}
+/**
+ * Formats a RunReport as SARIF 2.1.0 (https://sarifweb.azurewebsites.net/),
+ * consumable by GitHub Code Scanning (`upload-sarif`) and other SARIF
+ * viewers. mcp-medic's diagnostics have no source line/column — they're
+ * about a *running server's* declared tools/capabilities, not source code —
+ * so each result's physicalLocation points at the config file the server
+ * was declared in, with the server (and tool, if any) named as a logical
+ * location instead of a line range.
+ */
+export function formatReportSarif(report) {
+    const artifactUri = report.configSource || 'mcp-config.json';
+    const rules = new Map();
+    const results = [];
+    for (const d of report.diagnostics) {
+        if (!rules.has(d.checkId)) {
+            rules.set(d.checkId, {
+                id: d.checkId,
+                shortDescription: { text: d.checkId },
+                defaultConfiguration: { level: sarifLevel(d.severity) },
+            });
+        }
+        const logicalLocations = [{ name: d.serverName, kind: 'module' }];
+        if (d.toolName) {
+            logicalLocations.push({ name: d.toolName, kind: 'member' });
+        }
+        results.push({
+            ruleId: d.checkId,
+            level: sarifLevel(d.severity),
+            message: {
+                text: d.suggestedFix?.description ? `${d.message} Suggested fix: ${d.suggestedFix.description}` : d.message,
+            },
+            locations: [
+                {
+                    physicalLocation: { artifactLocation: { uri: artifactUri } },
+                    logicalLocations,
+                },
+            ],
+        });
+    }
+    const sarif = {
+        $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'mcp-medic',
+                        informationUri: 'https://github.com/shivam039/mcp-doctor',
+                        version: readOwnVersion(),
+                        rules: [...rules.values()],
+                    },
+                },
+                results,
+            },
+        ],
+    };
+    return JSON.stringify(sarif, null, 2);
+}

package/dist/types.d.ts

@@ -19,11 +19,47 @@ export interface MCPToolDefinition {
     description?: string;
     inputSchema: unknown;
 }
+export interface MCPResourceDefinition {
+    uri: string;
+    name?: string;
+    description?: string;
+    mimeType?: string;
+}
+export interface MCPPromptDefinition {
+    name: string;
+    description?: string;
+    arguments?: unknown[];
+}
+export interface ProtocolVersionInfo {
+    /** The protocolVersion this client sent in `initialize`. */
+    requested: string;
+    /** The protocolVersion the server returned in its `initialize` response, if valid. */
+    negotiated?: string;
+    /** Whether `negotiated` is a version this client's transport can actually speak. */
+    compatible: boolean;
+}
+export interface MCPServerInfo {
+    name?: string;
+    version?: string;
+}
 export interface MCPConnection {
     server: MCPServerConfig;
     status: 'connected' | 'failed' | 'timeout';
     capabilities?: Record<string, unknown>;
     tools?: MCPToolDefinition[];
+    /** Populated only if the server's `initialize` response declared a `resources` capability. */
+    resources?: MCPResourceDefinition[];
+    /** Populated only if the server's `initialize` response declared a `prompts` capability. */
+    prompts?: MCPPromptDefinition[];
+    /** Best-effort failures from optional capability inspection (resources/prompts) — these
+     * never fail the overall connection, since `tools` is the one capability mcp-medic requires. */
+    capabilityErrors?: {
+        resources?: string;
+        prompts?: string;
+    };
+    /** Set once an `initialize` response was received, even if negotiation was incompatible or a later stage failed. */
+    protocolVersion?: ProtocolVersionInfo;
+    serverInfo?: MCPServerInfo;
     error?: {
         stage: 'spawn' | 'handshake' | 'capability-negotiation' | 'list-tools';
         message: string;
@@ -55,6 +91,8 @@ export interface RunOptions {
     checks?: Check[];
     verbose?: boolean;
     onLog?: (message: string) => void;
+    /** "auto" (default) requests the newest protocol version this client supports; an explicit version string requests that version instead. */
+    protocolVersion?: string;
 }
 export interface RunReport {
     configSource?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-medic",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Diagnose broken MCP (Model Context Protocol) server configs before they break your agent silently.",
   "type": "module",
   "main": "dist/index.js",