mcp-medic 1.2.6 → 1.2.8

package/dist/cli.d.ts

@@ -13,6 +13,7 @@ export interface ParsedArgs {
     updateSnapshotPath?: string;
     json: boolean;
     timeoutMs?: number;
+    jobs?: number;
     showFixes: boolean;
     verbose: boolean;
     failOn: 'error' | 'warning';

package/dist/cli.js

@@ -113,6 +113,14 @@ export function parseArgs(argv) {
             }
             args.protocolVersion = val;
         }
+        else if (arg === '--jobs') {
+            const value = argv[++i];
+            const parsed = value ? Number(value) : NaN;
+            if (!Number.isSafeInteger(parsed) || parsed < 1) {
+                throw new Error(`--jobs requires a positive safe integer, got: ${value ?? '(none)'}`);
+            }
+            args.jobs = parsed;
+        }
         else {
             positional.push(arg);
         }
@@ -213,6 +221,7 @@ OPTIONS
   --timeout <ms>        Per-server handshake timeout in milliseconds (default: 5000)
   --protocol-version <v> MCP protocolVersion to request: "auto" (default, latest supported)
                         or an explicit version, e.g. ${SUPPORTED_PROTOCOL_VERSIONS[SUPPORTED_PROTOCOL_VERSIONS.length - 1]}
+  --jobs <n>            Maximum config files processed at once in check-all (default: 1)
   --help, -h            Show help
   --version, -V         Print the installed mcp-medic version
 
@@ -568,6 +577,7 @@ export async function main(argv = process.argv.slice(2), deps = {}) {
         const fleetReport = await runFleetChecks(glob, {
             checks,
             timeoutMs: args.timeoutMs,
+            jobs: args.jobs,
             verbose: args.verbose,
             protocolVersion: args.protocolVersion,
         });

package/dist/fleet.d.ts

@@ -37,6 +37,7 @@ export declare function findConfigFiles(globOrPattern: string, rootDir?: string)
  */
 export declare function runFleetChecks(globPattern: string, options?: RunOptions & {
     cwd?: string;
+    jobs?: number;
 }): Promise<FleetReport>;
 /**
  * Compares two MCP configurations to identify server and attribute drift.

package/dist/fleet.js

@@ -3,7 +3,89 @@ import { resolve, join } from 'node:path';
 import { loadConfig } from './config-loader.js';
 import { runChecks } from './orchestrator.js';
 import { allChecks } from './checks/index.js';
-import { redactRecord } from './redact.js';
+import { isSecretKey, redactDeep, redactRecord } from './redact.js';
+async function mapWithConcurrency(items, concurrency, worker) {
+    const results = new Array(items.length);
+    let nextIndex = 0;
+    const workerCount = Math.min(concurrency, items.length);
+    await Promise.all(Array.from({ length: workerCount }, async () => {
+        while (true) {
+            const index = nextIndex++;
+            if (index >= items.length)
+                return;
+            results[index] = await worker(items[index]);
+        }
+    }));
+    return results;
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.keys(value)
+            .sort()
+            .map((key) => [key, canonicalize(value[key])]));
+    }
+    return value;
+}
+function stableStringify(value) {
+    return JSON.stringify(canonicalize(value)) ?? 'undefined';
+}
+function redactInlineSecrets(value) {
+    return value
+        .replace(/(\bBearer\s+)[^\s,;"']+/gi, '$1[REDACTED]')
+        .replace(/([a-z0-9_.-]*(?:authorization|token|secret|password|passwd|pwd|api[-_]?key|apikey|cookie|credential|bearer)[a-z0-9_.-]*\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi, '$1[REDACTED]');
+}
+function redactArgs(args) {
+    if (!args)
+        return args;
+    const result = [...args];
+    for (let i = 0; i < result.length; i += 1) {
+        const arg = result[i];
+        const equalsIndex = arg.indexOf('=');
+        if (equalsIndex >= 0 && isSecretKey(arg.slice(0, equalsIndex).replace(/^-+/, ''))) {
+            result[i] = `${arg.slice(0, equalsIndex + 1)}[REDACTED]`;
+        }
+        else if (isSecretKey(arg.replace(/^-+/, '')) && i + 1 < result.length) {
+            result[i + 1] = '[REDACTED]';
+            i += 1;
+        }
+    }
+    return result.map(redactInlineSecrets);
+}
+/** Removes URL credentials and secret-looking query/fragment values before a diff is displayed. */
+function redactUrl(value) {
+    if (value === undefined)
+        return undefined;
+    try {
+        const url = new URL(value);
+        if (url.username)
+            url.username = '[REDACTED]';
+        if (url.password)
+            url.password = '[REDACTED]';
+        for (const key of [...url.searchParams.keys()]) {
+            if (isSecretKey(key))
+                url.searchParams.set(key, '[REDACTED]');
+        }
+        if (url.hash)
+            url.hash = '[REDACTED]';
+        return url.toString();
+    }
+    catch {
+        // Invalid URL-like values still get a conservative pass over common credential forms.
+        return value
+            .replace(/([a-z][a-z0-9+.-]*:\/\/)[^/@?#]+@/i, '$1[REDACTED]@')
+            .replace(/([?&])([^=&#]+)=([^&#]*)/g, (match, separator, rawKey) => {
+            let key = rawKey;
+            try {
+                key = decodeURIComponent(rawKey.replace(/\+/g, ' '));
+            }
+            catch { /* retain raw key */ }
+            return isSecretKey(key) ? `${separator}${rawKey}=[REDACTED]` : match;
+        })
+            .replace(/#.*$/, '#[REDACTED]');
+    }
+}
 function findFilesMatching(dir, rootDir, pattern, results = []) {
     if (!existsSync(dir))
         return results;
@@ -72,38 +154,36 @@ export function findConfigFiles(globOrPattern, rootDir = process.cwd()) {
 export async function runFleetChecks(globPattern, options = {}) {
     const root = options.cwd ?? process.cwd();
     const filePaths = findConfigFiles(globPattern, root);
-    const fileResults = [];
-    let totalServers = 0;
-    let totalErrors = 0;
-    let totalWarnings = 0;
-    for (const filePath of filePaths) {
+    const jobs = options.jobs ?? 1;
+    if (!Number.isSafeInteger(jobs) || jobs < 1) {
+        throw new TypeError(`jobs must be a positive safe integer, got: ${jobs}`);
+    }
+    const processed = await mapWithConcurrency(filePaths, jobs, async (filePath) => {
         try {
             const rawText = readFileSync(filePath, 'utf-8');
             const rawJson = JSON.parse(rawText);
             const { config, errors } = loadConfig(rawJson, filePath);
             if (errors.length > 0 || !config) {
-                fileResults.push({
-                    filePath,
-                    error: `Config validation failed: ${errors.join(', ')}`,
-                });
-                totalErrors += errors.length;
-                continue;
+                return {
+                    fileResult: { filePath, error: `Config validation failed: ${errors.join(', ')}` },
+                    errorCount: errors.length,
+                };
             }
             const checks = options.checks ?? allChecks;
             const report = await runChecks(config, { ...options, checks });
-            fileResults.push({ filePath, report });
-            totalServers += report.summary.servers;
-            totalErrors += report.summary.errors;
-            totalWarnings += report.summary.warnings;
+            return { fileResult: { filePath, report }, errorCount: report.summary.errors };
         }
         catch (err) {
-            fileResults.push({
-                filePath,
-                error: `Could not process file: ${err instanceof Error ? err.message : String(err)}`,
-            });
-            totalErrors += 1;
+            return {
+                fileResult: { filePath, error: `Could not process file: ${err instanceof Error ? err.message : String(err)}` },
+                errorCount: 1,
+            };
         }
-    }
+    });
+    const fileResults = processed.map((item) => item.fileResult);
+    const totalServers = fileResults.reduce((sum, result) => sum + (result.report?.summary.servers ?? 0), 0);
+    const totalErrors = processed.reduce((sum, item) => sum + item.errorCount, 0);
+    const totalWarnings = fileResults.reduce((sum, result) => sum + (result.report?.summary.warnings ?? 0), 0);
     return {
         totalFiles: filePaths.length,
         successfulFiles: fileResults.filter((f) => !f.error).length,
@@ -133,20 +213,41 @@ export function diffConfigs(configA, configB) {
                 changes.push({ field: 'transport', from: serverA.transport, to: serverB.transport });
             }
             if (serverA.command !== serverB.command) {
-                changes.push({ field: 'command', from: serverA.command, to: serverB.command });
+                changes.push({
+                    field: 'command',
+                    from: serverA.command === undefined ? undefined : redactInlineSecrets(serverA.command),
+                    to: serverB.command === undefined ? undefined : redactInlineSecrets(serverB.command),
+                });
             }
-            if (JSON.stringify(serverA.args) !== JSON.stringify(serverB.args)) {
-                changes.push({ field: 'args', from: serverA.args, to: serverB.args });
+            if (stableStringify(serverA.args) !== stableStringify(serverB.args)) {
+                changes.push({ field: 'args', from: redactArgs(serverA.args), to: redactArgs(serverB.args) });
             }
-            if (serverA.url !== serverB.url) {
-                changes.push({ field: 'url', from: serverA.url, to: serverB.url });
+            if (stableStringify(serverA.url) !== stableStringify(serverB.url)) {
+                changes.push({ field: 'url', from: redactUrl(serverA.url), to: redactUrl(serverB.url) });
             }
-            if (JSON.stringify(serverA.env) !== JSON.stringify(serverB.env)) {
+            if (stableStringify(serverA.env) !== stableStringify(serverB.env)) {
                 // Report that env changed and which keys, but never raw values —
                 // env vars routinely carry API keys/tokens and diff output gets
                 // pasted into PRs and CI logs.
                 changes.push({ field: 'env', from: redactRecord(serverA.env), to: redactRecord(serverB.env) });
             }
+            if (stableStringify(serverA.headers) !== stableStringify(serverB.headers)) {
+                changes.push({ field: 'headers', from: redactRecord(serverA.headers), to: redactRecord(serverB.headers) });
+            }
+            if (stableStringify(serverA.tokenRefreshUrl) !== stableStringify(serverB.tokenRefreshUrl)) {
+                changes.push({
+                    field: 'tokenRefreshUrl',
+                    from: redactUrl(serverA.tokenRefreshUrl),
+                    to: redactUrl(serverB.tokenRefreshUrl),
+                });
+            }
+            if (stableStringify(serverA.tokenRefreshBody) !== stableStringify(serverB.tokenRefreshBody)) {
+                changes.push({
+                    field: 'tokenRefreshBody',
+                    from: redactDeep(serverA.tokenRefreshBody),
+                    to: redactDeep(serverB.tokenRefreshBody),
+                });
+            }
             if (changes.length > 0) {
                 entries.push({ serverName: name, kind: 'modified', changes });
             }

package/dist/redact.js

@@ -12,7 +12,7 @@ const REDACTED = '[REDACTED]';
 /** Matches key names that conventionally carry secret values. Intentionally
  * broad — false positives (redacting a harmless key) are safe; false
  * negatives (leaking a secret) are not. */
-const SECRET_KEY_PATTERN = /(authorization|auth|token|secret|password|passwd|pwd|api[-_]?key|apikey|cookie|credential|bearer|session|private[-_]?key|client[-_]?secret)/i;
+const SECRET_KEY_PATTERN = /(authorization|auth|token|secret|password|passwd|pwd|api[-_]?key|apikey|access[-_]?key|access[-_]?token|(?:^|[-_])key(?:$|[-_])|cookie|credential|bearer|session|private[-_]?key|client[-_]?secret)/i;
 export function isSecretKey(key) {
     return SECRET_KEY_PATTERN.test(key);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-medic",
-  "version": "1.2.6",
+  "version": "1.2.8",
   "description": "Diagnose broken MCP (Model Context Protocol) server configs before they break your agent silently.",
   "type": "module",
   "main": "dist/index.js",