mcp-medic 1.2.7 → 1.2.9

package/README.md

@@ -32,7 +32,7 @@ This is the whole point (a real handshake, not a schema guess) — but it means
 - 🔍 **Auto-Discovery**: Run `mcp-medic check` with no arguments to auto-discover Claude Desktop, `.mcp.json`, and VS Code/Cursor MCP configuration paths across macOS, Windows, and Linux.
 - 💡 **Auto-Fix Suggestions**: Diagnose issues with clear, actionable fix suggestions using `--show-fixes`.
 - 🌐 **Registry Validation**: Validate published registry entries directly using `mcp-medic check --registry <server-id>`.
-- 🧪 **Fleet Validation** (experimental): Scan and validate monorepos or multi-team configurations with `mcp-medic check-all "<glob>"`.
+- **Fleet Validation**: Scan and validate monorepos or multi-team configurations with deterministic `*`/`**` glob matching, bounded parallel checks, and CI-ready failure handling.
 - 🧪 **Drift Detection** (experimental): Catch environment divergence between staging and production configs with `mcp-medic diff <configA> <configB>`.
 - 📜 **Policy-as-Code**: Enforce organizational constraints (banned transports, domain allowlists, minimum description lengths, a minimum quality score, a max tool count, required tool descriptions) via `.mcp-medic-policy.json` / `--policy`.
 - 📸 **Snapshot Baseline Mode**: Filter out legacy diagnostics with `--snapshot <baseline.json>` to gate only on newly introduced regressions.
@@ -151,13 +151,16 @@ npx mcp-medic watch path/to/config.json
 | `--verbose`, `-v` | Output raw JSON-RPC traffic and debug messages |
 | `--json` | Output full diagnostic report in JSON |
 | `--timeout <ms>` | Per-server handshake timeout in milliseconds (default: `5000`) |
+| `--jobs <n>` | Maximum configs processed concurrently by `check-all` (positive integer; default: `1`) |
 | `--help`, `-h` | Show usage help |
 | `--version`, `-V` | Print the installed version |
 
+`check-all` interprets globs relative to the current working directory: `*` matches within one path segment, while `**` can cross directories. Results are sorted by path. It skips `node_modules`, `.git`, and `dist`, does not follow symlinked directories, and processes one config at a time unless `--jobs` is set. A zero-match pattern, invalid config, or failed server connection returns exit code `1`; with `--fail-on error`, warnings alone remain non-blocking. In `--json` mode the no-match guidance is written to stderr so stdout stays valid JSON. Like `check`, fleet validation launches the commands and makes the network requests declared by the configs, so only point it at configs you trust.
+
 ### Exit Codes
 
 - **`0`**: All checks passed cleanly.
-- **`1`**: Diagnostic failure (one or more errors, or warnings if `--fail-on warning` is set).
+- **`1`**: Diagnostic, config, or connection failure; warnings also fail if `--fail-on warning` is set. `check-all` also returns `1` when no files match.
 - **`2`**: Configuration or usage error (missing file, JSON parse error, invalid options).
 
 ---
@@ -303,7 +306,6 @@ The `security.*` checks are heuristic — they pattern-match on what a server *d
 - **Handshake timeout defaults to 5000ms** per server (`--timeout <ms>` to change it). A slow-starting stdio server or a server behind a slow network path can fail with `status: 'timeout'` even though it would eventually respond.
 - **`schema.sample-call-simulation`** builds synthetic payloads from a tool's declared JSON Schema and checks the schema is internally consistent (e.g. catches an empty `enum`, or conflicting `minimum`/`maximum`) — it does **not** actually invoke the tool, and it does not validate business logic, side effects, or whether the tool's real output matches its declared schema.
 - **`security.*` checks are heuristic pattern-matching**, not a security audit — see the note above. They can both miss real issues and flag benign configs (e.g. a legitimate local dev server on plain `http://`).
-- **Fleet commands (`check-all`, `diff`) are newer and less battle-tested** than `check`/`watch` — the core check pipeline they're built on is the same, but edge cases in glob matching or drift diffing are more likely.
 - **The VS Code extension and community check packages are not shipped/published** — see the sections above.
 - **The Reliability quality dimension is currently binary**: 100 if the server connected, 0 if it didn't (plus any future `reliability.*` diagnostics — none exist yet). Signals like latency trends, retry behavior, or flakiness across repeated runs aren't scored yet.
 - **`resources/list`/`prompts/list` pagination (`nextCursor`) is not followed** — mcp-medic inspects only the first page a server returns, matching the existing (also unpaginated) `tools/list` handling. A server with a very large resource/prompt catalog behind pagination will be under-inspected.

package/dist/cli.js

@@ -581,6 +581,10 @@ export async function main(argv = process.argv.slice(2), deps = {}) {
             verbose: args.verbose,
             protocolVersion: args.protocolVersion,
         });
+        const noMatches = fleetReport.totalFiles === 0;
+        if (noMatches) {
+            console.error(pc.red(`No configuration files matched "${glob}". Check the glob pattern and run from the intended project root.`));
+        }
         if (args.exportJunit) {
             try {
                 writeFileSync(resolve(args.exportJunit), formatFleetReportJUnit(fleetReport));
@@ -602,13 +606,17 @@ export async function main(argv = process.argv.slice(2), deps = {}) {
                     console.log(pc.red(`[FAIL] ${res.filePath} — ${res.error}`));
                 }
                 else if (res.report) {
-                    const status = res.report.summary.errors === 0 ? pc.green('[PASS]') : pc.red('[FAIL]');
-                    console.log(`${status} ${res.filePath} (${res.report.summary.servers} servers, ${res.report.summary.errors} errors, ${res.report.summary.warnings} warnings)`);
+                    const status = res.report.summary.errors === 0 && res.report.summary.failed === 0
+                        ? pc.green('[PASS]')
+                        : pc.red('[FAIL]');
+                    console.log(`${status} ${res.filePath} (${res.report.summary.servers} servers, ${res.report.summary.failed} connection failure(s), ${res.report.summary.errors} errors, ${res.report.summary.warnings} warnings)`);
                 }
             }
         }
         const hasErrors = fleetReport.totalErrors > 0;
         const hasWarnings = fleetReport.totalWarnings > 0;
+        if (noMatches)
+            return 1;
         if (args.failOn === 'warning') {
             return hasErrors || hasWarnings ? 1 : 0;
         }

package/dist/fleet.js

@@ -3,7 +3,7 @@ import { resolve, join } from 'node:path';
 import { loadConfig } from './config-loader.js';
 import { runChecks } from './orchestrator.js';
 import { allChecks } from './checks/index.js';
-import { redactRecord } from './redact.js';
+import { isSecretKey, redactDeep, redactRecord } from './redact.js';
 async function mapWithConcurrency(items, concurrency, worker) {
     const results = new Array(items.length);
     let nextIndex = 0;
@@ -18,6 +18,74 @@ async function mapWithConcurrency(items, concurrency, worker) {
     }));
     return results;
 }
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.keys(value)
+            .sort()
+            .map((key) => [key, canonicalize(value[key])]));
+    }
+    return value;
+}
+function stableStringify(value) {
+    return JSON.stringify(canonicalize(value)) ?? 'undefined';
+}
+function redactInlineSecrets(value) {
+    return value
+        .replace(/(\bBearer\s+)[^\s,;"']+/gi, '$1[REDACTED]')
+        .replace(/([a-z0-9_.-]*(?:authorization|token|secret|password|passwd|pwd|api[-_]?key|apikey|cookie|credential|bearer)[a-z0-9_.-]*\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi, '$1[REDACTED]');
+}
+function redactArgs(args) {
+    if (!args)
+        return args;
+    const result = [...args];
+    for (let i = 0; i < result.length; i += 1) {
+        const arg = result[i];
+        const equalsIndex = arg.indexOf('=');
+        if (equalsIndex >= 0 && isSecretKey(arg.slice(0, equalsIndex).replace(/^-+/, ''))) {
+            result[i] = `${arg.slice(0, equalsIndex + 1)}[REDACTED]`;
+        }
+        else if (isSecretKey(arg.replace(/^-+/, '')) && i + 1 < result.length) {
+            result[i + 1] = '[REDACTED]';
+            i += 1;
+        }
+    }
+    return result.map(redactInlineSecrets);
+}
+/** Removes URL credentials and secret-looking query/fragment values before a diff is displayed. */
+function redactUrl(value) {
+    if (value === undefined)
+        return undefined;
+    try {
+        const url = new URL(value);
+        if (url.username)
+            url.username = '[REDACTED]';
+        if (url.password)
+            url.password = '[REDACTED]';
+        for (const key of [...url.searchParams.keys()]) {
+            if (isSecretKey(key))
+                url.searchParams.set(key, '[REDACTED]');
+        }
+        if (url.hash)
+            url.hash = '[REDACTED]';
+        return url.toString();
+    }
+    catch {
+        // Invalid URL-like values still get a conservative pass over common credential forms.
+        return value
+            .replace(/([a-z][a-z0-9+.-]*:\/\/)[^/@?#]+@/i, '$1[REDACTED]@')
+            .replace(/([?&])([^=&#]+)=([^&#]*)/g, (match, separator, rawKey) => {
+            let key = rawKey;
+            try {
+                key = decodeURIComponent(rawKey.replace(/\+/g, ' '));
+            }
+            catch { /* retain raw key */ }
+            return isSecretKey(key) ? `${separator}${rawKey}=[REDACTED]` : match;
+        })
+            .replace(/#.*$/, '#[REDACTED]');
+    }
+}
 function findFilesMatching(dir, rootDir, pattern, results = []) {
     if (!existsSync(dir))
         return results;
@@ -103,7 +171,10 @@ export async function runFleetChecks(globPattern, options = {}) {
             }
             const checks = options.checks ?? allChecks;
             const report = await runChecks(config, { ...options, checks });
-            return { fileResult: { filePath, report }, errorCount: report.summary.errors };
+            return {
+                fileResult: { filePath, report },
+                errorCount: report.summary.errors + report.summary.failed,
+            };
         }
         catch (err) {
             return {
@@ -145,20 +216,41 @@ export function diffConfigs(configA, configB) {
                 changes.push({ field: 'transport', from: serverA.transport, to: serverB.transport });
             }
             if (serverA.command !== serverB.command) {
-                changes.push({ field: 'command', from: serverA.command, to: serverB.command });
+                changes.push({
+                    field: 'command',
+                    from: serverA.command === undefined ? undefined : redactInlineSecrets(serverA.command),
+                    to: serverB.command === undefined ? undefined : redactInlineSecrets(serverB.command),
+                });
             }
-            if (JSON.stringify(serverA.args) !== JSON.stringify(serverB.args)) {
-                changes.push({ field: 'args', from: serverA.args, to: serverB.args });
+            if (stableStringify(serverA.args) !== stableStringify(serverB.args)) {
+                changes.push({ field: 'args', from: redactArgs(serverA.args), to: redactArgs(serverB.args) });
             }
-            if (serverA.url !== serverB.url) {
-                changes.push({ field: 'url', from: serverA.url, to: serverB.url });
+            if (stableStringify(serverA.url) !== stableStringify(serverB.url)) {
+                changes.push({ field: 'url', from: redactUrl(serverA.url), to: redactUrl(serverB.url) });
             }
-            if (JSON.stringify(serverA.env) !== JSON.stringify(serverB.env)) {
+            if (stableStringify(serverA.env) !== stableStringify(serverB.env)) {
                 // Report that env changed and which keys, but never raw values —
                 // env vars routinely carry API keys/tokens and diff output gets
                 // pasted into PRs and CI logs.
                 changes.push({ field: 'env', from: redactRecord(serverA.env), to: redactRecord(serverB.env) });
             }
+            if (stableStringify(serverA.headers) !== stableStringify(serverB.headers)) {
+                changes.push({ field: 'headers', from: redactRecord(serverA.headers), to: redactRecord(serverB.headers) });
+            }
+            if (stableStringify(serverA.tokenRefreshUrl) !== stableStringify(serverB.tokenRefreshUrl)) {
+                changes.push({
+                    field: 'tokenRefreshUrl',
+                    from: redactUrl(serverA.tokenRefreshUrl),
+                    to: redactUrl(serverB.tokenRefreshUrl),
+                });
+            }
+            if (stableStringify(serverA.tokenRefreshBody) !== stableStringify(serverB.tokenRefreshBody)) {
+                changes.push({
+                    field: 'tokenRefreshBody',
+                    from: redactDeep(serverA.tokenRefreshBody),
+                    to: redactDeep(serverB.tokenRefreshBody),
+                });
+            }
             if (changes.length > 0) {
                 entries.push({ serverName: name, kind: 'modified', changes });
             }

package/dist/junit.js

@@ -1,5 +1,18 @@
 function escapeXml(unsafe) {
-    return unsafe
+    let validXml = '';
+    for (const character of unsafe) {
+        const codePoint = character.codePointAt(0);
+        const valid = codePoint === 0x9 ||
+            codePoint === 0xa ||
+            codePoint === 0xd ||
+            (codePoint >= 0x20 && codePoint <= 0xd7ff) ||
+            (codePoint >= 0xe000 && codePoint <= 0xfffd) ||
+            (codePoint >= 0x10000 && codePoint <= 0x10ffff);
+        if (valid) {
+            validXml += character;
+        }
+    }
+    return validXml
         .replace(/&/g, '&amp;')
         .replace(/</g, '&lt;')
         .replace(/>/g, '&gt;')
@@ -50,12 +63,28 @@ export function formatReportJUnit(report) {
  */
 export function formatFleetReportJUnit(fleetReport) {
     const lines = [];
+    let totalTestCases = 0;
+    let totalFailures = 0;
+    for (const fileResult of fleetReport.fileResults) {
+        if (fileResult.report) {
+            totalTestCases += fileResult.report.connections.length + fileResult.report.diagnostics.length;
+            totalFailures += fileResult.report.connections.filter((conn) => conn.status !== 'connected').length;
+            totalFailures += fileResult.report.diagnostics.filter((diagnostic) => diagnostic.severity === 'error').length;
+        }
+        else if (fileResult.error) {
+            totalTestCases += 1;
+            totalFailures += 1;
+        }
+    }
     lines.push('<?xml version="1.0" encoding="UTF-8"?>');
-    lines.push(`<testsuites name="mcp-medic-fleet" tests="${fleetReport.totalServers}" failures="${fleetReport.totalErrors}">`);
+    lines.push(`<testsuites name="mcp-medic-fleet" tests="${totalTestCases}" failures="${totalFailures}">`);
     for (const fileResult of fleetReport.fileResults) {
         if (fileResult.report) {
             const rep = fileResult.report;
-            lines.push(`  <testsuite name="${escapeXml(fileResult.filePath)}" tests="${rep.summary.servers + rep.diagnostics.length}" failures="${rep.summary.errors}">`);
+            const testCases = rep.connections.length + rep.diagnostics.length;
+            const failures = rep.connections.filter((conn) => conn.status !== 'connected').length +
+                rep.diagnostics.filter((diagnostic) => diagnostic.severity === 'error').length;
+            lines.push(`  <testsuite name="${escapeXml(fileResult.filePath)}" tests="${testCases}" failures="${failures}">`);
             for (const conn of rep.connections) {
                 if (conn.status === 'connected') {
                     lines.push(`    <testcase classname="${escapeXml(conn.server.name)}" name="connection.handshake" />`);
@@ -73,6 +102,9 @@ export function formatFleetReportJUnit(fleetReport) {
                     lines.push(`      <failure message="${escapeXml(d.message)}" type="CheckError">${escapeXml(d.message)}</failure>`);
                     lines.push('    </testcase>');
                 }
+                else {
+                    lines.push(`    <testcase classname="${escapeXml(scope)}" name="${escapeXml(d.checkId)}"><system-out>[${d.severity}] ${escapeXml(d.message)}</system-out></testcase>`);
+                }
             }
             lines.push('  </testsuite>');
         }

package/dist/redact.js

@@ -12,7 +12,7 @@ const REDACTED = '[REDACTED]';
 /** Matches key names that conventionally carry secret values. Intentionally
  * broad — false positives (redacting a harmless key) are safe; false
  * negatives (leaking a secret) are not. */
-const SECRET_KEY_PATTERN = /(authorization|auth|token|secret|password|passwd|pwd|api[-_]?key|apikey|cookie|credential|bearer|session|private[-_]?key|client[-_]?secret)/i;
+const SECRET_KEY_PATTERN = /(authorization|auth|token|secret|password|passwd|pwd|api[-_]?key|apikey|access[-_]?key|access[-_]?token|(?:^|[-_])key(?:$|[-_])|cookie|credential|bearer|session|private[-_]?key|client[-_]?secret)/i;
 export function isSecretKey(key) {
     return SECRET_KEY_PATTERN.test(key);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-medic",
-  "version": "1.2.7",
+  "version": "1.2.9",
   "description": "Diagnose broken MCP (Model Context Protocol) server configs before they break your agent silently.",
   "type": "module",
   "main": "dist/index.js",