mcp-scorecard 0.5.2 → 0.5.3

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 0.5.3 - 2026-07-30
+
+### Fixed
+
+- Mutation-name patterns now include nutrition/alarm write verbs (`log_intake`, `log_water`, `bulk_log`, `remember`, `undo`, `snooze`, `dismiss`) so those tools are gated and not mis-scored as unannotated reads — without treating coach tools like `after_log_review` as mutations.
+- Gate hints also match the common field name `explicit_user_intent`.
+
 ## 0.5.2 - 2026-07-30
 
 ### Fixed

package/dist/constants.d.ts

@@ -3,7 +3,7 @@
  * same string. Bumping this without updating package.json is intentional during
  * dev (keep src as source of truth); a release script can sync them.
  */
-export declare const SERVER_VERSION = "0.5.2";
+export declare const SERVER_VERSION = "0.5.3";
 /** Identifier used when the probe connects to a target MCP server. */
 export declare const PROBE_CLIENT_NAME = "mcp-scorecard";
 /** Env var set on the spawned target so MCP authors can detect we are probing
@@ -13,6 +13,9 @@ export declare const PROBE_ENV_FLAG = "MCP_PROBE";
  * Patterns that imply a tool MUTATES state on the target system. We use these
  * to score mutation gating — if a tool name matches and the description does
  * not mention an explicit gate, it loses points.
+ *
+ * Nutrition/alarm write verbs use compound tokens (`log_intake`, `bulk_log`)
+ * so read tools like `after_log_review` are not misclassified as mutations.
  */
 export declare const MUTATION_PATTERNS: RegExp[];
 /**

package/dist/constants.js

@@ -3,7 +3,7 @@
  * same string. Bumping this without updating package.json is intentional during
  * dev (keep src as source of truth); a release script can sync them.
  */
-export const SERVER_VERSION = '0.5.2';
+export const SERVER_VERSION = '0.5.3';
 /** Identifier used when the probe connects to a target MCP server. */
 export const PROBE_CLIENT_NAME = 'mcp-scorecard';
 /** Env var set on the spawned target so MCP authors can detect we are probing
@@ -13,9 +13,12 @@ export const PROBE_ENV_FLAG = 'MCP_PROBE';
  * Patterns that imply a tool MUTATES state on the target system. We use these
  * to score mutation gating — if a tool name matches and the description does
  * not mention an explicit gate, it loses points.
+ *
+ * Nutrition/alarm write verbs use compound tokens (`log_intake`, `bulk_log`)
+ * so read tools like `after_log_review` are not misclassified as mutations.
  */
 export const MUTATION_PATTERNS = [
-    /(^|_)(set|update|delete|create|pause|resume|enable|disable|cancel|publish|send|remove|add|insert|patch|put|post|exchange|revoke|grant|authorize|reset|clear|forget|destroy|wipe|logout|signout|sign_out)(_|$)/i
+    /(^|_)(set|update|delete|create|pause|resume|enable|disable|cancel|publish|send|remove|add|insert|patch|put|post|exchange|revoke|grant|authorize|reset|clear|forget|destroy|wipe|logout|signout|sign_out|log_intake|log_water|bulk_log|remember|undo|snooze|dismiss)(_|$)/i
 ];
 /**
  * Words that, when present in a mutation tool's description, signal the author
@@ -25,6 +28,7 @@ export const MUTATION_GATE_HINTS = [
     'gated by',
     'requires explicit',
     'explicit user intent',
+    'explicit_user_intent',
     'allow_mutations',
     'dry-run',
     'dry_run',

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;iEACiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAa;IACzC,gNAAgN;CACjN,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,UAAU;IACV,mBAAmB;IACnB,sBAAsB;IACtB,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;CACV,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,gBAAgB;IAChB,gBAAgB;IAChB,cAAc;IACd,mBAAmB;CACpB,CAAC;AAEF;;cAEc;AACd,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,aAAa;IACb,OAAO;IACP,OAAO;IACP,cAAc;IACd,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,SAAS;CACV,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;iEACiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAa;IACzC,2QAA2Q;CAC5Q,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,UAAU;IACV,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;CACV,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,gBAAgB;IAChB,gBAAgB;IAChB,cAAc;IACd,mBAAmB;CACpB,CAAC;AAEF;;cAEc;AACd,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,aAAa;IACb,OAAO;IACP,OAAO;IACP,cAAc;IACd,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,SAAS;CACV,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-scorecard",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "mcpName": "io.github.davidmosiah/mcp-scorecard",
   "description": "Grade any MCP server's agent-readiness in one command \u2014 stdio (10 protocol checks) AND hosted/remote servers (10 security + web agent-readiness checks). Open source, local-first, no credentials.",
   "type": "module",