mcp-scorecard 0.5.4 → 0.5.6

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.5.6 - 2026-08-06
+
+### Changed
+- `dense_series_caps` requires **schema** `max_points`/`maxPoints` (hard cap) separate from contract markers (`contract_version` and/or `agent-safe-series/v1` in description/schema). Contract description alone no longer scores as a hard cap.
+
+## 0.5.5 - 2026-08-05
+
+### Added
+- `dense_series_caps` agent-ready check: stream/series/intraday tools must document max_points/resolution (agent-safe-series/v1).
+
+
 ## 0.5.4 - 2026-07-30
 
 ### Fixed

package/dist/audit/checks/dense-series-caps.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Check — Dense/stream-like tools must advertise hard caps and series contract
+ * (agent-safe-series/v1 discipline).
+ *
+ * Hard cap (inventory #19): `max_points` / `maxPoints` must appear in
+ * **inputSchema.properties**. Description-only contract text does NOT count as a cap.
+ *
+ * Contract marker (inventory #18): `contract_version` in schema and/or
+ * `agent-safe-series` (incl. /vN) in description or schema — separate from hard cap.
+ */
+import type { CheckResult, ProbeSnapshot } from '../../types.js';
+export declare function checkDenseSeriesCaps(snapshot: ProbeSnapshot): CheckResult;
+export declare const _denseSeriesCapHintForTests: RegExp;

package/dist/audit/checks/dense-series-caps.js

@@ -0,0 +1,77 @@
+const DENSE_NAME = /(stream|series|intraday|continuous|sample|samples|ppi)/i;
+/** Cap signals only — never agent-safe-series (that is the contract marker). */
+const CAP_HINT = /(max_points|maxPoints|resolution_seconds|point budget|hard cap|downsample)/i;
+const CONTRACT_HINT = /(contract_version|agent-safe-series\/v\d+|agent-safe-series)/i;
+function schemaProps(tool) {
+    const schema = tool.inputSchema;
+    return schema?.properties ?? {};
+}
+/** Hard cap requires max_points/maxPoints on the input schema properties. */
+function hasHardCap(tool) {
+    const props = schemaProps(tool);
+    return props.max_points != null || props.maxPoints != null;
+}
+function hasContractMarker(tool) {
+    const props = schemaProps(tool);
+    if (props.contract_version != null || props.contractVersion != null)
+        return true;
+    const desc = tool.description ?? '';
+    const schemaText = JSON.stringify(tool.inputSchema ?? {});
+    return CONTRACT_HINT.test(desc) || CONTRACT_HINT.test(schemaText);
+}
+export function checkDenseSeriesCaps(snapshot) {
+    const dense = snapshot.tools.filter((t) => DENSE_NAME.test(t.name));
+    if (dense.length === 0) {
+        return {
+            id: 'dense_series_caps',
+            label: 'Dense series caps',
+            score: 10,
+            status: 'pass',
+            summary: 'no dense/stream tools detected',
+            details: [],
+            fixes: []
+        };
+    }
+    const missingCap = [];
+    const missingContract = [];
+    for (const tool of dense) {
+        if (!hasHardCap(tool))
+            missingCap.push(tool.name);
+        if (!hasContractMarker(tool))
+            missingContract.push(tool.name);
+    }
+    if (missingCap.length === 0 && missingContract.length === 0) {
+        return {
+            id: 'dense_series_caps',
+            label: 'Dense series caps',
+            score: 10,
+            status: 'pass',
+            summary: `${dense.length} dense tool(s) have schema max_points + series contract markers`,
+            details: dense.map((t) => t.name),
+            fixes: []
+        };
+    }
+    const issues = dense.length * 2;
+    const failed = missingCap.length + missingContract.length;
+    const ratio = (issues - failed) / issues;
+    const score = ratio >= 0.75 ? 7 : ratio >= 0.5 ? 5 : 0;
+    const details = [
+        ...missingCap.map((n) => `missing hard cap (max_points in inputSchema.properties): ${n}`),
+        ...missingContract.map((n) => `missing contract_version / agent-safe-series marker: ${n}`)
+    ];
+    return {
+        id: 'dense_series_caps',
+        label: 'Dense series caps',
+        score,
+        status: score === 0 ? 'fail' : 'warn',
+        summary: `${failed} dense-series gaps across ${dense.length} tool(s)`,
+        details,
+        fixes: [
+            'For stream/series tools: put max_points in inputSchema.properties (required hard cap).',
+            'Advertise agent-safe-series/v1 and/or contract_version in description or schema (separate from the hard cap).'
+        ]
+    };
+}
+// CAP_HINT kept for documentation/tests that assert cap language is distinct from contract.
+export const _denseSeriesCapHintForTests = CAP_HINT;
+//# sourceMappingURL=dense-series-caps.js.map

package/dist/audit/checks/dense-series-caps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dense-series-caps.js","sourceRoot":"","sources":["../../../src/audit/checks/dense-series-caps.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,GAAG,yDAAyD,CAAC;AAC7E,gFAAgF;AAChF,MAAM,QAAQ,GAAG,6EAA6E,CAAC;AAC/F,MAAM,aAAa,GAAG,+DAA+D,CAAC;AAEtF,SAAS,WAAW,CAAC,IAA+B;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAmE,CAAC;IACxF,OAAO,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,IAAqD;IACvE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,UAAU,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAqD;IAC9E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAI,IAAI,KAAK,CAAC,eAAe,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC1D,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAuB;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,mBAAmB;YAC1B,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gCAAgC;YACzC,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,mBAAmB;YAC1B,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,iEAAiE;YACzF,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACjC,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;IAC1D,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG;QACd,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,4DAA4D,CAAC,EAAE,CAAC;QACzF,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wDAAwD,CAAC,EAAE,CAAC;KAC3F,CAAC;IACF,OAAO;QACL,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,KAAK;QACL,MAAM,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACrC,OAAO,EAAE,GAAG,MAAM,6BAA6B,KAAK,CAAC,MAAM,UAAU;QACrE,OAAO;QACP,KAAK,EAAE;YACL,wFAAwF;YACxF,+GAA+G;SAChH;KACF,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC"}

package/dist/audit/runner.js

@@ -17,6 +17,7 @@ import { checkSchemaValidity } from './checks/schema-validity.js';
 import { checkSmokeTest } from './checks/smoke-test.js';
 import { checkToolDescriptions } from './checks/tool-descriptions.js';
 import { checkToolNaming } from './checks/tool-naming.js';
+import { checkDenseSeriesCaps } from './checks/dense-series-caps.js';
 import { probeTarget } from './probe.js';
 import { aggregateScore } from './scorer.js';
 const CHECK_LABELS = {
@@ -53,6 +54,7 @@ export async function runAudit(target) {
     const checks = [
         safeRun('schema_validity', () => checkSchemaValidity(snapshot)),
         safeRun('tool_naming', () => checkToolNaming(snapshot)),
+        safeRun('dense_series_caps', () => checkDenseSeriesCaps(snapshot)),
         safeRun('privacy_modes', () => checkPrivacyModes(snapshot)),
         safeRun('mutation_gating', () => checkMutationGating(snapshot)),
         safeRun('agent_manifest', () => checkAgentManifest(snapshot)),

package/dist/audit/runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/audit/runner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7C,MAAM,YAAY,GAAqC;IACrD,eAAe,EAAE,iBAAiB;IAClC,WAAW,EAAE,wBAAwB;IACrC,aAAa,EAAE,0BAA0B;IACzC,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,sBAAsB;IACjC,iBAAiB,EAAE,mBAAmB;IACtC,WAAW,EAAE,aAAa;IAC1B,wBAAwB,EAAE,0BAA0B;CACrD,CAAC;AAEF,SAAS,OAAO,CAAC,EAAW,EAAE,EAAqB;IACjD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,EAAE;YACF,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;YAC7B,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sBAAsB;YAC/B,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5B,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAsB;IACnD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAkB;QAC5B,OAAO,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvD,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7D,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACnE,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;KAClF,CAAC;IAEF,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,MAAM,EAAE;YACN,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;YACpC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO;SAC3C;QACD,UAAU;QACV,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;QAC1B,IAAI,EAAE,OAAO;QACb,MAAM;QACN,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,gBAAgB,EAAE,cAAc;KACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/audit/runner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7C,MAAM,YAAY,GAAqC;IACrD,eAAe,EAAE,iBAAiB;IAClC,WAAW,EAAE,wBAAwB;IACrC,aAAa,EAAE,0BAA0B;IACzC,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,sBAAsB;IACjC,iBAAiB,EAAE,mBAAmB;IACtC,WAAW,EAAE,aAAa;IAC1B,wBAAwB,EAAE,0BAA0B;CACrD,CAAC;AAEF,SAAS,OAAO,CAAC,EAAW,EAAE,EAAqB;IACjD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,EAAE;YACF,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;YAC7B,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sBAAsB;YAC/B,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5B,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAsB;IACnD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAkB;QAC5B,OAAO,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvD,OAAO,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7D,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACnE,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;KAClF,CAAC;IAEF,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,MAAM,EAAE;YACN,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;YACpC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO;SAC3C;QACD,UAAU;QACV,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;QAC1B,IAAI,EAAE,OAAO;QACb,MAAM;QACN,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,gBAAgB,EAAE,cAAc;KACjC,CAAC;AACJ,CAAC"}

package/dist/checks-catalog.js

@@ -1,6 +1,7 @@
 export const CHECK_META = {
     // --- stdio: protocol quality ---
     schema_validity: { label: 'Schema validity', category: 'quality', why: 'Agents reject or mis-call tools whose input schemas are invalid or missing.' },
+    dense_series_caps: { label: 'Dense series caps', category: 'agent-ready', why: 'Stream/series tools must advertise max_points/resolution caps (agent-safe-series/v1).' },
     tool_naming: { label: 'Tool naming', category: 'quality', why: 'Consistent snake_case verb_noun names make tools predictable for models to select.' },
     tool_descriptions: { label: 'Tool descriptions', category: 'quality', why: 'Rich descriptions are the only thing a model has to decide when/how to call a tool.' },
     annotations: { label: 'Annotations', category: 'quality', why: 'readOnly/destructive hints let agents reason about safety before calling.' },

package/dist/checks-catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"checks-catalog.js","sourceRoot":"","sources":["../src/checks-catalog.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,UAAU,GAA+B;IACpD,kCAAkC;IAClC,eAAe,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,6EAA6E,EAAE;IACtJ,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,oFAAoF,EAAE;IACrJ,iBAAiB,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,qFAAqF,EAAE;IAClK,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,2EAA2E,EAAE;IAC5I,SAAS,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,yEAAyE,EAAE;IACjJ,UAAU,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,0EAA0E,EAAE;IACzI,eAAe,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,wFAAwF,EAAE;IAClK,aAAa,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,uEAAuE,EAAE;IAC7I,cAAc,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,gFAAgF,EAAE;IAC3J,wBAAwB,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,4EAA4E,EAAE;IAC3K,6BAA6B;IAC7B,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,iEAAiE,EAAE;IACjI,oBAAoB,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,+EAA+E,EAAE;IAC/J,gBAAgB,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,+EAA+E,EAAE;IAChK,mBAAmB,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,qEAAqE,EAAE;IACnJ,iBAAiB,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,+EAA+E,EAAE;IAC9J,gBAAgB,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,8EAA8E,EAAE;IACtJ,YAAY,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,4EAA4E,EAAE;IAC/I,mBAAmB,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,+EAA+E,EAAE;IAChK,gBAAgB,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,2EAA2E,EAAE;IAC5J,eAAe,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,oEAAoE,EAAE;IACxJ,kBAAkB,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,iFAAiF,EAAE;IACrK,mBAAmB,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,2EAA2E,EAAE;CACjK,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAA8D;IACjF,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE;IAChF,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE;IACzD,OAAO,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE;IAC/D,aAAa,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE;CACzE,CAAC"}
+{"version":3,"file":"checks-catalog.js","sourceRoot":"","sources":["../src/checks-catalog.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,UAAU,GAA+B;IACpD,kCAAkC;IAClC,eAAe,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,6EAA6E,EAAE;IACtJ,iBAAiB,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,uFAAuF,EAAE;IACxK,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,oFAAoF,EAAE;IACrJ,iBAAiB,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,qFAAqF,EAAE;IAClK,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,2EAA2E,EAAE;IAC5I,SAAS,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,yEAAyE,EAAE;IACjJ,UAAU,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,0EAA0E,EAAE;IACzI,eAAe,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,wFAAwF,EAAE;IAClK,aAAa,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,uEAAuE,EAAE;IAC7I,cAAc,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,gFAAgF,EAAE;IAC3J,wBAAwB,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,4EAA4E,EAAE;IAC3K,6BAA6B;IAC7B,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,iEAAiE,EAAE;IACjI,oBAAoB,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,+EAA+E,EAAE;IAC/J,gBAAgB,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,+EAA+E,EAAE;IAChK,mBAAmB,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,qEAAqE,EAAE;IACnJ,iBAAiB,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,+EAA+E,EAAE;IAC9J,gBAAgB,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,8EAA8E,EAAE;IACtJ,YAAY,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,4EAA4E,EAAE;IAC/I,mBAAmB,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,+EAA+E,EAAE;IAChK,gBAAgB,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,2EAA2E,EAAE;IAC5J,eAAe,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,oEAAoE,EAAE;IACxJ,kBAAkB,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,iFAAiF,EAAE;IACrK,mBAAmB,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,2EAA2E,EAAE;CACjK,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAA8D;IACjF,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE;IAChF,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE;IACzD,OAAO,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE;IAC/D,aAAa,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE;CACzE,CAAC"}

package/dist/constants.d.ts

@@ -3,7 +3,7 @@
  * same string. Bumping this without updating package.json is intentional during
  * dev (keep src as source of truth); a release script can sync them.
  */
-export declare const SERVER_VERSION = "0.5.4";
+export declare const SERVER_VERSION = "0.5.6";
 /** Identifier used when the probe connects to a target MCP server. */
 export declare const PROBE_CLIENT_NAME = "mcp-scorecard";
 /** Env var set on the spawned target so MCP authors can detect we are probing

package/dist/constants.js

@@ -3,7 +3,7 @@
  * same string. Bumping this without updating package.json is intentional during
  * dev (keep src as source of truth); a release script can sync them.
  */
-export const SERVER_VERSION = "0.5.4";
+export const SERVER_VERSION = "0.5.6";
 /** Identifier used when the probe connects to a target MCP server. */
 export const PROBE_CLIENT_NAME = 'mcp-scorecard';
 /** Env var set on the spawned target so MCP authors can detect we are probing

package/dist/types.d.ts

@@ -57,7 +57,7 @@ export interface ResolvedTarget {
     /** package.json contents, if any. */
     packageJson?: Record<string, unknown>;
 }
-export type CheckId = 'schema_validity' | 'tool_naming' | 'privacy_modes' | 'mutation_gating' | 'agent_manifest' | 'smoke_test' | 'resources' | 'tool_descriptions' | 'annotations' | 'manifest_discoverability' | 'web_https' | 'web_security_headers' | 'web_auth_posture' | 'web_oauth_discovery' | 'web_llms_txt' | 'web_mcp_server_card' | 'web_agent_skills' | 'web_api_catalog' | 'web_robots_signals' | 'web_structured_data' | 'web_exposed_paths' | 'web_cors_posture';
+export type CheckId = 'schema_validity' | 'tool_naming' | 'dense_series_caps' | 'privacy_modes' | 'mutation_gating' | 'agent_manifest' | 'smoke_test' | 'resources' | 'tool_descriptions' | 'annotations' | 'manifest_discoverability' | 'web_https' | 'web_security_headers' | 'web_auth_posture' | 'web_oauth_discovery' | 'web_llms_txt' | 'web_mcp_server_card' | 'web_agent_skills' | 'web_api_catalog' | 'web_robots_signals' | 'web_structured_data' | 'web_exposed_paths' | 'web_cors_posture';
 /**
  * Snapshot captured from a hosted/remote target over HTTP — the parallel of
  * ProbeSnapshot for the web/security audit path. Pure scorers read this.

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkJH,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC7F,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmJH,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC7F,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-scorecard",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "mcpName": "io.github.davidmosiah/mcp-scorecard",
   "description": "Grade any MCP server's agent-readiness in one command \u2014 stdio (10 protocol checks) AND hosted/remote servers (10 security + web agent-readiness checks). Open source, local-first, no credentials.",
   "type": "module",
@@ -24,11 +24,12 @@
     "dev": "tsx src/index.ts",
     "test:checks": "node scripts/test-checks.mjs",
     "test:self": "node scripts/smoke-self.mjs",
-    "test": "npm run typecheck && npm run build && npm run test:checks && npm run test:self && npm run test:web && npm run test:features",
+    "test": "npm run typecheck && npm run build && npm run test:dense-series && npm run test:checks && npm run test:self && npm run test:web && npm run test:features",
     "prepublishOnly": "npm test",
     "test:web": "node scripts/test-web.mjs",
     "test:features": "node scripts/test-features.mjs",
-    "gen:checks": "node scripts/gen-checks-page.mjs"
+    "gen:checks": "node scripts/gen-checks-page.mjs",
+    "test:dense-series": "node scripts/dense-series-caps-test.mjs"
   },
   "keywords": [
     "mcp",