mcp-scorecard 0.5.7 → 0.5.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +5 -0
- package/README.md +1 -1
- package/dist/audit/checks/dense-series-caps.d.ts +3 -2
- package/dist/audit/checks/dense-series-caps.js +12 -12
- package/dist/audit/checks/dense-series-caps.js.map +1 -1
- package/dist/constants.d.ts +1 -1
- package/dist/constants.js +1 -1
- package/dist/types.d.ts +1 -0
- package/dist/types.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
package/README.md
CHANGED
|
@@ -5,8 +5,9 @@
|
|
|
5
5
|
* Hard cap (inventory #19): `max_points` / `maxPoints` must appear in
|
|
6
6
|
* **inputSchema.properties**. Description-only contract text does NOT count as a cap.
|
|
7
7
|
*
|
|
8
|
-
* Contract marker (
|
|
9
|
-
*
|
|
8
|
+
* Contract marker (OSS-300 #13): `contract_version` must appear as a **schema
|
|
9
|
+
* property** on inputSchema or outputSchema. Description-only
|
|
10
|
+
* `agent-safe-series/v1` text does not count.
|
|
10
11
|
*/
|
|
11
12
|
import type { CheckResult, ProbeSnapshot } from '../../types.js';
|
|
12
13
|
export declare function checkDenseSeriesCaps(snapshot: ProbeSnapshot): CheckResult;
|
|
@@ -1,23 +1,23 @@
|
|
|
1
1
|
const DENSE_NAME = /(stream|series|intraday|continuous|sample|samples|ppi)/i;
|
|
2
2
|
/** Cap signals only — never agent-safe-series (that is the contract marker). */
|
|
3
3
|
const CAP_HINT = /(max_points|maxPoints|resolution_seconds|point budget|hard cap|downsample)/i;
|
|
4
|
-
|
|
5
|
-
function schemaProps(tool) {
|
|
6
|
-
const schema = tool.inputSchema;
|
|
4
|
+
function schemaProps(schema) {
|
|
7
5
|
return schema?.properties ?? {};
|
|
8
6
|
}
|
|
7
|
+
function toolInputProps(tool) {
|
|
8
|
+
return schemaProps(tool.inputSchema);
|
|
9
|
+
}
|
|
9
10
|
/** Hard cap requires max_points/maxPoints on the input schema properties. */
|
|
10
11
|
function hasHardCap(tool) {
|
|
11
|
-
const props =
|
|
12
|
+
const props = toolInputProps(tool);
|
|
12
13
|
return props.max_points != null || props.maxPoints != null;
|
|
13
14
|
}
|
|
15
|
+
function hasContractVersionProp(schema) {
|
|
16
|
+
const props = schemaProps(schema);
|
|
17
|
+
return props.contract_version != null || props.contractVersion != null;
|
|
18
|
+
}
|
|
14
19
|
function hasContractMarker(tool) {
|
|
15
|
-
|
|
16
|
-
if (props.contract_version != null || props.contractVersion != null)
|
|
17
|
-
return true;
|
|
18
|
-
const desc = tool.description ?? '';
|
|
19
|
-
const schemaText = JSON.stringify(tool.inputSchema ?? {});
|
|
20
|
-
return CONTRACT_HINT.test(desc) || CONTRACT_HINT.test(schemaText);
|
|
20
|
+
return hasContractVersionProp(tool.outputSchema) || hasContractVersionProp(tool.inputSchema);
|
|
21
21
|
}
|
|
22
22
|
export function checkDenseSeriesCaps(snapshot) {
|
|
23
23
|
const dense = snapshot.tools.filter((t) => DENSE_NAME.test(t.name));
|
|
@@ -57,7 +57,7 @@ export function checkDenseSeriesCaps(snapshot) {
|
|
|
57
57
|
const score = ratio >= 0.75 ? 7 : ratio >= 0.5 ? 5 : 0;
|
|
58
58
|
const details = [
|
|
59
59
|
...missingCap.map((n) => `missing hard cap (max_points in inputSchema.properties): ${n}`),
|
|
60
|
-
...missingContract.map((n) => `missing contract_version
|
|
60
|
+
...missingContract.map((n) => `missing schema property contract_version (outputSchema or inputSchema): ${n}`)
|
|
61
61
|
];
|
|
62
62
|
return {
|
|
63
63
|
id: 'dense_series_caps',
|
|
@@ -68,7 +68,7 @@ export function checkDenseSeriesCaps(snapshot) {
|
|
|
68
68
|
details,
|
|
69
69
|
fixes: [
|
|
70
70
|
'For stream/series tools: put max_points in inputSchema.properties (required hard cap).',
|
|
71
|
-
'
|
|
71
|
+
'Put contract_version on outputSchema.properties (envelope) or inputSchema.properties. Description-only agent-safe-series text is not enough.'
|
|
72
72
|
]
|
|
73
73
|
};
|
|
74
74
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dense-series-caps.js","sourceRoot":"","sources":["../../../src/audit/checks/dense-series-caps.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"dense-series-caps.js","sourceRoot":"","sources":["../../../src/audit/checks/dense-series-caps.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,GAAG,yDAAyD,CAAC;AAC7E,gFAAgF;AAChF,MAAM,QAAQ,GAAG,6EAA6E,CAAC;AAE/F,SAAS,WAAW,CAAC,MAAe;IAClC,OAAQ,MAA+D,EAAE,UAAU,IAAI,EAAE,CAAC;AAC5F,CAAC;AAED,SAAS,cAAc,CAAC,IAA+B;IACrD,OAAO,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,IAAqD;IACvE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,UAAU,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC;AAC7D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAe;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,gBAAgB,IAAI,IAAI,IAAI,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC;AACzE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAI1B;IACC,OAAO,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAuB;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,mBAAmB;YAC1B,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gCAAgC;YACzC,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,mBAAmB;YAC1B,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,iEAAiE;YACzF,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACjC,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;IAC1D,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG;QACd,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,4DAA4D,CAAC,EAAE,CAAC;QACzF,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2EAA2E,CAAC,EAAE,CAAC;KAC9G,CAAC;IACF,OAAO;QACL,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,KAAK;QACL,MAAM,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACrC,OAAO,EAAE,GAAG,MAAM,6BAA6B,KAAK,CAAC,MAAM,UAAU;QACrE,OAAO;QACP,KAAK,EAAE;YACL,wFAAwF;YACxF,8IAA8I;SAC/I;KACF,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC"}
|
package/dist/constants.d.ts
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* same string. Bumping this without updating package.json is intentional during
|
|
4
4
|
* dev (keep src as source of truth); a release script can sync them.
|
|
5
5
|
*/
|
|
6
|
-
export declare const SERVER_VERSION = "0.5.
|
|
6
|
+
export declare const SERVER_VERSION = "0.5.8";
|
|
7
7
|
/** Identifier used when the probe connects to a target MCP server. */
|
|
8
8
|
export declare const PROBE_CLIENT_NAME = "mcp-scorecard";
|
|
9
9
|
/** Env var set on the spawned target so MCP authors can detect we are probing
|
package/dist/constants.js
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* same string. Bumping this without updating package.json is intentional during
|
|
4
4
|
* dev (keep src as source of truth); a release script can sync them.
|
|
5
5
|
*/
|
|
6
|
-
export const SERVER_VERSION = "0.5.
|
|
6
|
+
export const SERVER_VERSION = "0.5.8";
|
|
7
7
|
/** Identifier used when the probe connects to a target MCP server. */
|
|
8
8
|
export const PROBE_CLIENT_NAME = 'mcp-scorecard';
|
|
9
9
|
/** Env var set on the spawned target so MCP authors can detect we are probing
|
package/dist/types.d.ts
CHANGED
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoJH,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC7F,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mcp-scorecard",
|
|
3
|
-
"version": "0.5.
|
|
3
|
+
"version": "0.5.8",
|
|
4
4
|
"mcpName": "io.github.davidmosiah/mcp-scorecard",
|
|
5
5
|
"description": "Grade any MCP server's agent-readiness in one command \u2014 stdio (10 protocol checks) AND hosted/remote servers (10 security + web agent-readiness checks). Open source, local-first, no credentials.",
|
|
6
6
|
"type": "module",
|