mcp-medic 1.2.2 → 1.2.4

package/dist/cli.js

@@ -14,6 +14,7 @@ import { loadPolicy, createPolicyChecks } from './policy.js';
 import { runFleetChecks, diffConfigs, filterDiagnosticsByBaseline } from './fleet.js';
 import { formatReportJUnit, formatFleetReportJUnit } from './junit.js';
 import { formatReportSarif } from './sarif.js';
+import { computeReportQualityScore, checkMinimumScorePolicy } from './quality-score.js';
 import { SUPPORTED_PROTOCOL_VERSIONS } from './protocol/versions.js';
 import pc from 'picocolors';
 export function parseArgs(argv) {
@@ -25,6 +26,7 @@ export function parseArgs(argv) {
         failOn: 'error',
         dryRun: false,
         protocolVersion: 'auto',
+        showScore: false,
     };
     const positional = [];
     for (let i = 0; i < argv.length; i++) {
@@ -41,6 +43,9 @@ export function parseArgs(argv) {
         else if (arg === '--dry-run') {
             args.dryRun = true;
         }
+        else if (arg === '--score') {
+            args.showScore = true;
+        }
         else if (arg === '--help' || arg === '-h') {
             args.command = 'help';
         }
@@ -114,7 +119,7 @@ export function parseArgs(argv) {
     }
     if (args.command !== 'help' && args.command !== 'version') {
         const first = positional[0];
-        if (first === 'check' || first === 'watch' || first === 'check-all' || first === 'diff' || first === 'fix') {
+        if (first === 'check' || first === 'watch' || first === 'check-all' || first === 'diff' || first === 'fix' || first === 'score') {
             args.command = first;
             if (first === 'diff') {
                 args.configPath = positional[1];
@@ -128,6 +133,9 @@ export function parseArgs(argv) {
                     args.configPath = positional[1];
                 }
             }
+            if (first === 'score') {
+                args.showScore = true;
+            }
         }
         else if (first && !args.configPath) {
             args.configPath = first;
@@ -183,6 +191,7 @@ USAGE
   $ mcp-medic [check] [path/to/config.json] [options]
   $ mcp-medic check --registry <server-id> [options]
   $ mcp-medic check-all "<glob-pattern>" [options]
+  $ mcp-medic score <path/to/config.json> [options]
   $ mcp-medic diff <configA.json> <configB.json>
   $ mcp-medic watch <path/to/config.json> [options]
   $ mcp-medic fix <path/to/config.json> [--check <id>] [--dry-run]
@@ -196,10 +205,11 @@ OPTIONS
   --export-junit <file> Export report in JUnit XML format
   --export-json <file>  Export report in JSON format
   --export-sarif <file> Export report in SARIF 2.1.0 format (GitHub Code Scanning, etc.)
+  --score               Include the MCP quality score in the report (implied by the "score" command)
   --show-fixes          Print actionable suggested fixes under diagnostics
   --fail-on <severity>  Exit with code 1 on 'error' (default) or 'warning'
   --verbose, -v         Print raw JSON-RPC traffic and debug messages
-  --json                Output report in JSON format
+  --json                Output report in JSON format (always includes a "quality" field)
   --timeout <ms>        Per-server handshake timeout in milliseconds (default: 5000)
   --protocol-version <v> MCP protocolVersion to request: "auto" (default, latest supported)
                         or an explicit version, e.g. ${SUPPORTED_PROTOCOL_VERSIONS[SUPPORTED_PROTOCOL_VERSIONS.length - 1]}
@@ -212,6 +222,13 @@ PROTOCOL VERSIONS
   older version instead; mcp-medic reports both and fails cleanly if the
   negotiated version isn't one this client supports.
 
+MCP QUALITY SCORE
+  A deterministic 0-100 score (no LLM, no randomness) across five weighted
+  dimensions: Protocol (25%), Schema (20%), Agent usability (20%), Security
+  (20%), Reliability (15%). Every point deducted is derived from an actual
+  diagnostic and is explained in the report's "Deductions" list. Policy can
+  gate on it via "quality": { "minimumScore": N } in .mcp-medic-policy.json.
+
 FIX OPTIONS (mcp-medic fix)
   --check <id>          Only offer fixes from this check id (e.g. security.untrusted-remote)
   --dry-run             Show every available fix as a diff; apply nothing, prompt for nothing
@@ -266,12 +283,27 @@ async function executeCheck(config, args) {
             try {
                 const baseline = JSON.parse(readFileSync(args.snapshotPath, 'utf-8'));
                 report = filterDiagnosticsByBaseline(report, baseline);
+                // The quality score must reflect what's actually being reported —
+                // recompute it against the post-baseline-filter diagnostics rather
+                // than leaving the pre-filter score (computed by runChecks) stale.
+                report.quality = computeReportQualityScore(report, checks);
             }
             catch (err) {
                 console.error(pc.yellow(`Warning: Could not read snapshot baseline: ${String(err)}`));
             }
         }
     }
+    // Policy gate: fail if the computed quality score is below the configured
+    // minimum. This can't be a `Check` (it needs the score computed from every
+    // check's output, not a single connection), so it's enforced here instead.
+    const policy = loadPolicy(args.policyPath);
+    if (typeof policy?.quality?.minimumScore === 'number' && report.quality) {
+        const allServerNames = config.servers.map((s) => s.name).join(', ') || '(no servers)';
+        const policyDiagnostics = checkMinimumScorePolicy(report.quality, policy.quality.minimumScore, allServerNames);
+        report.diagnostics.push(...policyDiagnostics);
+        report.summary.errors += policyDiagnostics.filter((d) => d.severity === 'error').length;
+        report.summary.warnings += policyDiagnostics.filter((d) => d.severity === 'warning').length;
+    }
     // Handle update snapshot
     if (args.updateSnapshotPath) {
         try {
@@ -315,7 +347,7 @@ async function executeCheck(config, args) {
         console.log(formatReportJSON(report));
     }
     else {
-        console.log(colorizeHumanReport(formatReportHuman(report, { showFixes: args.showFixes })));
+        console.log(colorizeHumanReport(formatReportHuman(report, { showFixes: args.showFixes, showScore: args.showScore })));
     }
     const hasErrors = report.summary.errors > 0;
     const hasWarnings = report.summary.warnings > 0;

package/dist/diagnostics.d.ts

@@ -0,0 +1,11 @@
+import type { DiagnosticCategory, DiagnosticResult } from './types.js';
+/**
+ * Infers a stable category from a checkId's namespace prefix, for
+ * diagnostics that don't set `category` explicitly. This lets every
+ * existing check (schema.*, security.*, policy.*) participate in
+ * category-aware reporting/scoring without having to touch each one —
+ * only checks written after the taxonomy existed set `category` directly.
+ */
+export declare function inferDiagnosticCategory(checkId: string): DiagnosticCategory;
+/** The effective category of a diagnostic: its own `category` if set, else inferred from `checkId`. */
+export declare function categoryOf(diagnostic: DiagnosticResult): DiagnosticCategory;

package/dist/diagnostics.js

@@ -0,0 +1,28 @@
+/**
+ * Infers a stable category from a checkId's namespace prefix, for
+ * diagnostics that don't set `category` explicitly. This lets every
+ * existing check (schema.*, security.*, policy.*) participate in
+ * category-aware reporting/scoring without having to touch each one —
+ * only checks written after the taxonomy existed set `category` directly.
+ */
+export function inferDiagnosticCategory(checkId) {
+    if (checkId.startsWith('protocol.'))
+        return 'protocol';
+    if (checkId.startsWith('schema.'))
+        return 'schema';
+    if (checkId.startsWith('security.'))
+        return 'security';
+    if (checkId.startsWith('usability.'))
+        return 'usability';
+    if (checkId.startsWith('reliability.'))
+        return 'reliability';
+    if (checkId.startsWith('quality.'))
+        return 'quality';
+    if (checkId.startsWith('policy.') || checkId.startsWith('configuration.'))
+        return 'configuration';
+    return 'quality';
+}
+/** The effective category of a diagnostic: its own `category` if set, else inferred from `checkId`. */
+export function categoryOf(diagnostic) {
+    return diagnostic.category ?? inferDiagnosticCategory(diagnostic.checkId);
+}

package/dist/index.d.ts

@@ -21,4 +21,11 @@ export { allChecks } from './checks/index.js';
 export { SUPPORTED_PROTOCOL_VERSIONS, LATEST_SUPPORTED_PROTOCOL_VERSION, KNOWN_UNSUPPORTED_PROTOCOL_VERSIONS, isSupportedProtocolVersion, resolveRequestedProtocolVersion, } from './protocol/versions.js';
 export type { SupportedProtocolVersion, ProtocolVersionNegotiation } from './protocol/versions.js';
 export { isSecretKey, redactRecord, redactDeep, sanitizeServerConfig } from './redact.js';
+export { inferDiagnosticCategory, categoryOf } from './diagnostics.js';
+export { computeConnectionQualityScore, computeReportQualityScore, computeQualityCoverage, checkMinimumScorePolicy, QUALITY_DIMENSIONS, QUALITY_DIMENSION_WEIGHTS, QUALITY_SCORE_DISCLAIMER, } from './quality-score.js';
+export { getProtocolQualityRules } from './protocol/quality-rules.js';
+export type { ProtocolQualityRules, ToolNameProtocolRules } from './protocol/quality-rules.js';
+export { protocolConnectionHealthCheck } from './checks/protocol-connection-health.js';
+export { evaluateToolName } from './checks/quality-tool-names.js';
+export type { ToolNameFinding } from './checks/quality-tool-names.js';
 export * from './types.js';

package/dist/index.js

@@ -13,4 +13,9 @@ export { formatReportSarif } from './sarif.js';
 export { allChecks } from './checks/index.js';
 export { SUPPORTED_PROTOCOL_VERSIONS, LATEST_SUPPORTED_PROTOCOL_VERSION, KNOWN_UNSUPPORTED_PROTOCOL_VERSIONS, isSupportedProtocolVersion, resolveRequestedProtocolVersion, } from './protocol/versions.js';
 export { isSecretKey, redactRecord, redactDeep, sanitizeServerConfig } from './redact.js';
+export { inferDiagnosticCategory, categoryOf } from './diagnostics.js';
+export { computeConnectionQualityScore, computeReportQualityScore, computeQualityCoverage, checkMinimumScorePolicy, QUALITY_DIMENSIONS, QUALITY_DIMENSION_WEIGHTS, QUALITY_SCORE_DISCLAIMER, } from './quality-score.js';
+export { getProtocolQualityRules } from './protocol/quality-rules.js';
+export { protocolConnectionHealthCheck } from './checks/protocol-connection-health.js';
+export { evaluateToolName } from './checks/quality-tool-names.js';
 export * from './types.js';

package/dist/orchestrator.js

@@ -1,4 +1,5 @@
 import { sanitizeServerConfig } from './redact.js';
+import { computeReportQualityScore } from './quality-score.js';
 async function connectStub(config) {
     return {
         server: config,
@@ -57,10 +58,15 @@ export async function runChecks(config, options = {}) {
         errors: diagnostics.filter((d) => d.severity === 'error').length,
         warnings: diagnostics.filter((d) => d.severity === 'warning').length,
     };
-    return {
+    const report = {
         configSource: config.sourcePath,
         connections,
         diagnostics,
         summary,
     };
+    const quality = computeReportQualityScore(report, checks);
+    if (quality) {
+        report.quality = quality;
+    }
+    return report;
 }

package/dist/policy.d.ts

@@ -3,7 +3,16 @@ export interface MCPMedicPolicy {
     bannedTransports?: TransportType[];
     allowedDomains?: string[];
     minDescriptionLength?: number;
+    /** @deprecated use `quality.requireToolDescriptions` — kept for backward compatibility, same effect. */
     requireToolDescriptions?: boolean;
+    quality?: {
+        /** Gate: `check`/`check-all` fail (an error diagnostic is added) if the computed MCP quality score falls below this. */
+        minimumScore?: number;
+        /** Overrides quality.tool-surface's default 100-tool warning threshold with an org-enforced error threshold. */
+        maxTools?: number;
+        /** Same effect as the top-level (deprecated) `requireToolDescriptions`; this nested form takes precedence if both are set. */
+        requireToolDescriptions?: boolean;
+    };
 }
 export type MCPDoctorPolicy = MCPMedicPolicy;
 /**

package/dist/policy.js

@@ -145,5 +145,77 @@ export function createPolicyChecks(policy) {
             },
         });
     }
+    // 4. Require tool descriptions (nested quality.requireToolDescriptions takes
+    // precedence over the deprecated top-level field; either enables this).
+    const requireToolDescriptions = policy.quality?.requireToolDescriptions ?? policy.requireToolDescriptions;
+    if (requireToolDescriptions) {
+        checks.push({
+            id: 'policy.require-tool-descriptions',
+            description: 'Organizational policy: every tool must have a non-empty description.',
+            run(connection) {
+                const results = [];
+                try {
+                    if (!connection.tools)
+                        return results;
+                    for (const tool of connection.tools) {
+                        if (!tool.description || tool.description.trim() === '') {
+                            results.push({
+                                checkId: 'policy.require-tool-descriptions',
+                                severity: 'error',
+                                message: `Tool "${tool.name}" has no description — organizational policy requires one.`,
+                                serverName: connection.server.name,
+                                toolName: tool.name,
+                                category: 'configuration',
+                                suggestedFix: { description: `Add a description to tool "${tool.name}".` },
+                            });
+                        }
+                    }
+                }
+                catch (err) {
+                    results.push({
+                        checkId: 'policy.require-tool-descriptions',
+                        severity: 'error',
+                        message: `policy check failed internally: ${err instanceof Error ? err.message : String(err)}`,
+                        serverName: connection.server.name,
+                    });
+                }
+                return results;
+            },
+        });
+    }
+    // 5. Max tools (org-enforced hard limit; distinct from quality.tool-surface's
+    // default 100-tool *warning*, which stays a recommendation, not a policy gate).
+    if (typeof policy.quality?.maxTools === 'number' && policy.quality.maxTools > 0) {
+        const maxTools = policy.quality.maxTools;
+        checks.push({
+            id: 'policy.max-tools',
+            description: `Organizational policy: a server may expose at most ${maxTools} tools.`,
+            run(connection) {
+                const results = [];
+                try {
+                    const count = connection.tools?.length ?? 0;
+                    if (count > maxTools) {
+                        results.push({
+                            checkId: 'policy.max-tools',
+                            severity: 'error',
+                            message: `Server exposes ${count} tools, exceeding organizational policy limit of ${maxTools}.`,
+                            serverName: connection.server.name,
+                            category: 'configuration',
+                            details: { toolCount: count, maxTools },
+                        });
+                    }
+                }
+                catch (err) {
+                    results.push({
+                        checkId: 'policy.max-tools',
+                        severity: 'error',
+                        message: `policy check failed internally: ${err instanceof Error ? err.message : String(err)}`,
+                        serverName: connection.server.name,
+                    });
+                }
+                return results;
+            },
+        });
+    }
     return checks;
 }

package/dist/protocol/connect.js

@@ -67,6 +67,23 @@ function validateResponse(response, expectedId) {
     }
     return response.result;
 }
+function normalizeToolAnnotations(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const record = value;
+    const annotations = {};
+    if (typeof record.title === 'string')
+        annotations.title = record.title;
+    if (typeof record.readOnlyHint === 'boolean')
+        annotations.readOnlyHint = record.readOnlyHint;
+    if (typeof record.destructiveHint === 'boolean')
+        annotations.destructiveHint = record.destructiveHint;
+    if (typeof record.idempotentHint === 'boolean')
+        annotations.idempotentHint = record.idempotentHint;
+    if (typeof record.openWorldHint === 'boolean')
+        annotations.openWorldHint = record.openWorldHint;
+    return annotations;
+}
 function normalizeTools(result) {
     if (!Array.isArray(result.tools))
         throw new Error('tools/list response has no tools array');
@@ -77,8 +94,11 @@ function normalizeTools(result) {
         const value = tool;
         return {
             name: value.name,
+            ...(typeof value.title === 'string' ? { title: value.title } : {}),
             ...(typeof value.description === 'string' ? { description: value.description } : {}),
             inputSchema: value.inputSchema,
+            ...(value.outputSchema !== undefined ? { outputSchema: value.outputSchema } : {}),
+            ...(normalizeToolAnnotations(value.annotations) ? { annotations: normalizeToolAnnotations(value.annotations) } : {}),
         };
     });
 }
@@ -93,11 +113,29 @@ function normalizeResources(result) {
         return {
             uri: value.uri,
             ...(typeof value.name === 'string' ? { name: value.name } : {}),
+            ...(typeof value.title === 'string' ? { title: value.title } : {}),
             ...(typeof value.description === 'string' ? { description: value.description } : {}),
             ...(typeof value.mimeType === 'string' ? { mimeType: value.mimeType } : {}),
+            ...(typeof value.size === 'number' ? { size: value.size } : {}),
         };
     });
 }
+function normalizePromptArgument(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return {};
+    }
+    const record = value;
+    const arg = {};
+    if (typeof record.name === 'string')
+        arg.name = record.name;
+    if (typeof record.title === 'string')
+        arg.title = record.title;
+    if (typeof record.description === 'string')
+        arg.description = record.description;
+    if (typeof record.required === 'boolean')
+        arg.required = record.required;
+    return arg;
+}
 function normalizePrompts(result) {
     if (!Array.isArray(result.prompts))
         throw new Error('prompts/list response has no prompts array');
@@ -108,8 +146,11 @@ function normalizePrompts(result) {
         const value = prompt;
         return {
             name: value.name,
+            ...(typeof value.title === 'string' ? { title: value.title } : {}),
             ...(typeof value.description === 'string' ? { description: value.description } : {}),
-            ...(Array.isArray(value.arguments) ? { arguments: value.arguments } : {}),
+            ...(Array.isArray(value.arguments)
+                ? { arguments: value.arguments.map(normalizePromptArgument) }
+                : {}),
         };
     });
 }

package/dist/protocol/quality-rules.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Protocol-version-aware quality rules.
+ *
+ * Some things a quality check might flag are genuine protocol violations
+ * for a given negotiated MCP version (hard requirement/prohibition); others
+ * are ecosystem recommendations that happen to be entirely valid per spec.
+ * Mixing these up means a check can wrongly call a style preference a
+ * "protocol violation," or (worse) miss a real one because the version
+ * that defines it was never consulted.
+ *
+ * This module is the single place that answers "does this negotiated
+ * version define a hard constraint here?" so quality checks don't each
+ * have to know MCP spec history — and so a future protocol version that
+ * *does* add a constraint only needs a new entry here, not a rewrite of
+ * every check that uses it.
+ *
+ * Current state of research (see src/protocol/versions.ts for the same
+ * source): every version in SUPPORTED_PROTOCOL_VERSIONS (2024-11-05
+ * through 2025-11-25) defines `Tool.name` as a plain `string` with no
+ * documented length or character-pattern constraint. So today, every
+ * version returns the same (empty) rule set — this module exists for the
+ * abstraction, not because any current version actually differs from
+ * another.
+ */
+export interface ToolNameProtocolRules {
+    /** A hard maximum length the negotiated version's spec actually defines
+     * for `Tool.name`, if any. Exceeding it is a protocol violation, not a
+     * style recommendation. `undefined` = the spec defines no such limit for
+     * this version — length-based feedback should be a quality warning, not
+     * an error. */
+    maxLength?: number;
+    /** A hard character-pattern the negotiated version's spec actually
+     * requires `Tool.name` to match, if any. `undefined` = no such
+     * constraint — character-based feedback should be a quality warning. */
+    pattern?: RegExp;
+}
+export interface ProtocolQualityRules {
+    toolName: ToolNameProtocolRules;
+}
+/**
+ * Returns the protocol-defined (hard) quality rules for a negotiated MCP
+ * version. `version` is normally `MCPConnection.protocolVersion.negotiated`.
+ * An unknown or absent version gets the same "no hard constraints" rules
+ * as every currently-supported version, rather than guessing.
+ */
+export declare function getProtocolQualityRules(version: string | undefined): ProtocolQualityRules;

package/dist/protocol/quality-rules.js

@@ -0,0 +1,37 @@
+/**
+ * Protocol-version-aware quality rules.
+ *
+ * Some things a quality check might flag are genuine protocol violations
+ * for a given negotiated MCP version (hard requirement/prohibition); others
+ * are ecosystem recommendations that happen to be entirely valid per spec.
+ * Mixing these up means a check can wrongly call a style preference a
+ * "protocol violation," or (worse) miss a real one because the version
+ * that defines it was never consulted.
+ *
+ * This module is the single place that answers "does this negotiated
+ * version define a hard constraint here?" so quality checks don't each
+ * have to know MCP spec history — and so a future protocol version that
+ * *does* add a constraint only needs a new entry here, not a rewrite of
+ * every check that uses it.
+ *
+ * Current state of research (see src/protocol/versions.ts for the same
+ * source): every version in SUPPORTED_PROTOCOL_VERSIONS (2024-11-05
+ * through 2025-11-25) defines `Tool.name` as a plain `string` with no
+ * documented length or character-pattern constraint. So today, every
+ * version returns the same (empty) rule set — this module exists for the
+ * abstraction, not because any current version actually differs from
+ * another.
+ */
+/** No currently-supported MCP version defines a hard length/pattern
+ * constraint on Tool.name — see the module doc comment. */
+const NO_HARD_CONSTRAINTS = { toolName: {} };
+/**
+ * Returns the protocol-defined (hard) quality rules for a negotiated MCP
+ * version. `version` is normally `MCPConnection.protocolVersion.negotiated`.
+ * An unknown or absent version gets the same "no hard constraints" rules
+ * as every currently-supported version, rather than guessing.
+ */
+export function getProtocolQualityRules(version) {
+    void version; // reserved for when a supported version actually defines a constraint
+    return NO_HARD_CONSTRAINTS;
+}

package/dist/quality-score.d.ts

@@ -0,0 +1,76 @@
+import type { MCPConnection, DiagnosticResult, RunReport, QualityDimension, QualityDeduction, QualityScoreBreakdown, ReportQualityScore, QualityCoverage, Check } from './types.js';
+/**
+ * Deterministic MCP quality score. No LLM, no randomness, no network
+ * calls beyond the MCP inspection `connect()` already performed — the same
+ * report always produces the same score.
+ *
+ * Design: connection -> diagnostics -> normalized per-checkId deductions ->
+ * capped per-dimension score -> weighted overall score. Every deduction is
+ * derived from a visible `DiagnosticResult` — nothing is deducted directly
+ * from connection metadata that isn't also represented as a diagnostic
+ * (see .agent-room/DECISIONS.md, "v1.1 trust hardening" entry, for the
+ * `protocol.connection-health` check this replaced).
+ *
+ * (Result types — QualityDimension, QualityDeduction, QualityScoreBreakdown,
+ * ReportQualityScore, QualityCoverage, CoverageStatus — live in src/types.ts
+ * alongside RunReport, since RunReport.quality is one of them; this module
+ * just implements the math.)
+ */
+export type { QualityDimension, QualityDeduction, QualityScoreBreakdown, ReportQualityScore };
+export declare const QUALITY_DIMENSIONS: readonly QualityDimension[];
+/** Suggested weights from the product spec; documented here since every
+ * point deduction must be explainable in terms of these. Do not change
+ * without a documented reason — see .agent-room/DECISIONS.md. */
+export declare const QUALITY_DIMENSION_WEIGHTS: Record<QualityDimension, number>;
+/**
+ * The score is a measurement, not a certification: it reports what
+ * mcp-medic's passive checks actually found (or, per `coverage`, actually
+ * looked for) — never a formal audit of the server's real security or
+ * behavior. Surfaced in both JSON (`ReportQualityScore.disclaimer`) and the
+ * human report.
+ */
+export declare const QUALITY_SCORE_DISCLAIMER: string;
+/**
+ * Computes a quality score for one connection, purely from `diagnostics`
+ * (filtered to that server) — no connection metadata is consulted
+ * directly. Returns `undefined` for a connection that never connected —
+ * there's nothing meaningful to score (no tools/schema/capabilities were
+ * ever observed); see `computeReportQualityScore` for how the report-level
+ * score surfaces that instead of silently dropping it.
+ */
+export declare function computeConnectionQualityScore(connection: MCPConnection, diagnostics: DiagnosticResult[]): QualityScoreBreakdown | undefined;
+/**
+ * Coverage answers "was this dimension actually evaluated," independent of
+ * what score it got — a 100 from zero checks run means "nothing was
+ * looked for," not "nothing is wrong." Derived from the *ids* of the
+ * checks that actually ran (`executedChecks`), compared against the
+ * built-in `allChecks` reference set grouped by dimension. Reliability is
+ * special-cased to always 'covered': its signal (did the connection
+ * succeed) isn't produced by any optional `Check` — it's inherent to
+ * attempting a connection at all, so it's never "not covered."
+ */
+export declare function computeQualityCoverage(executedChecks: Check[]): QualityCoverage;
+/**
+ * Aggregate score across every connected server in a report (simple mean —
+ * deliberately not weighted by tool count, so one huge server can't drown
+ * out the rest of a fleet). `executedChecks` should be the exact list
+ * passed to `runChecks({ checks })` for this report, so `coverage` reflects
+ * what actually ran (defaults to the full built-in set if omitted, for
+ * callers that haven't been updated to pass it through).
+ * Returns `undefined` if no server connected — nothing to score at all.
+ */
+export declare function computeReportQualityScore(report: RunReport, executedChecks?: Check[]): ReportQualityScore | undefined;
+/**
+ * Enforces `.mcp-medic-policy.json`'s `quality.minimumScore` as a CI gate.
+ * Pure function so it's directly unit-testable without needing a real CLI
+ * invocation or a restricted check set — see PHASE 12 ("policy/CI") in
+ * .agent-room/DECISIONS.md.
+ *
+ * Returns diagnostics to append to the report (0, 1, or 2):
+ *  - an 'error' if the score is below `minimumScore` (fails the run).
+ *  - a 'warning' if the score was computed from a partial assessment
+ *    (incomplete coverage, or a server that couldn't be scored) — a
+ *    minimumScore gate must never silently "pass" as if a full check had
+ *    run when it didn't.
+ */
+export declare function checkMinimumScorePolicy(quality: ReportQualityScore, minimumScore: number, serverNamesLabel: string): DiagnosticResult[];