mcp-security-scanner 1.0.0

package/dist/report/index.js

@@ -0,0 +1,259 @@
+import { z } from "zod";
+import { join, resolve } from "node:path";
+import { text, json } from "../types/index.js";
+import { generateMarkdownReport } from "./markdown.js";
+import { generateSarifReport } from "./sarif.js";
+import { buildScanReport, buildOwaspCompliance } from "./json-report.js";
+import { safeReadJson, fileExists } from "../utils/fs-helpers.js";
+// SAST imports
+import { initProject } from "../static/ast-engine.js";
+import { analyzeCommandInjection } from "../static/analyzers/command-injection.js";
+import { analyzeSsrf } from "../static/analyzers/ssrf.js";
+import { analyzePathTraversal } from "../static/analyzers/path-traversal.js";
+import { analyzeCodeExecution } from "../static/analyzers/code-execution.js";
+import { analyzeHardcodedSecrets } from "../static/analyzers/secret-hardcoded.js";
+import { analyzeLogging } from "../static/analyzers/logging-audit.js";
+import { analyzeInsecureCrypto } from "../static/analyzers/insecure-crypto.js";
+import { analyzePrototypePollution } from "../static/analyzers/prototype-pollution.js";
+import { analyzeRegexDos } from "../static/analyzers/regex-dos.js";
+import { analyzeUnsafeRegex } from "../static/analyzers/unsafe-regex.js";
+import { analyzeInfoDisclosure } from "../static/analyzers/info-disclosure.js";
+// Config imports
+import { scanEnvFiles } from "../config/env-scanner.js";
+import { parseConfigFile } from "../config/mcp-config-parser.js";
+import { auditServerEntry, checkContextOversharing } from "../config/server-verification.js";
+// Deps imports
+import { parseLockfile, parsePackageJson } from "../deps/lockfile-parser.js";
+import { checkTyposquatting, typosquatFindings } from "../deps/typosquat-checker.js";
+import { detectInstallScripts, installScriptFindings } from "../deps/install-script-detector.js";
+// Runtime imports
+import { connectAndInspect } from "../runtime/client.js";
+import { analyzePoisoning, analyzeAnsiInjection, analyzeUnicodeSteganography } from "../runtime/tool-analyzer.js";
+import { analyzeScope, analyzeToolShadowing, analyzeCrossOrigin, analyzeResourceExposure } from "../runtime/schema-analyzer.js";
+const allSastAnalyzers = [
+    analyzeCommandInjection, analyzeSsrf, analyzePathTraversal, analyzeCodeExecution,
+    analyzeHardcodedSecrets, analyzeLogging, analyzeInsecureCrypto, analyzePrototypePollution,
+    analyzeRegexDos, analyzeUnsafeRegex, analyzeInfoDisclosure,
+];
+const reportGenerate = {
+    name: "report_generate",
+    description: "Generate formatted security report from findings array. Supports JSON (structured), Markdown (human-readable with severity table, OWASP matrix, remediation checklist), and SARIF 2.1.0 (for GitHub Code Scanning).",
+    schema: {
+        findings: z.string().describe("JSON string of Finding[] array"),
+        format: z.enum(["json", "markdown", "sarif"]).optional().describe("Output format (default: json)"),
+        target: z.string().optional().describe("Target name for report header"),
+    },
+    async execute(args) {
+        let findings;
+        try {
+            findings = JSON.parse(args.findings);
+        }
+        catch {
+            return text("Invalid findings JSON. Provide a valid JSON array of Finding objects.");
+        }
+        const format = args.format ?? "json";
+        const report = buildScanReport(args.target ?? "unknown", findings, 0);
+        if (format === "markdown") {
+            return text(generateMarkdownReport(report));
+        }
+        else if (format === "sarif") {
+            return json(generateSarifReport(report));
+        }
+        else {
+            return json(report);
+        }
+    },
+};
+const reportOwaspCompliance = {
+    name: "report_owasp_compliance",
+    description: "Generate OWASP MCP Top 10 compliance matrix from findings. For each MCP01-MCP10: pass/fail/not_tested status, finding count, highest severity, overall compliance score (0-100).",
+    schema: {
+        findings: z.string().describe("JSON string of Finding[] array"),
+    },
+    async execute(args) {
+        let findings;
+        try {
+            findings = JSON.parse(args.findings);
+        }
+        catch {
+            return text("Invalid findings JSON.");
+        }
+        const compliance = buildOwaspCompliance(findings);
+        const passed = compliance.filter(e => e.status === "pass").length;
+        const failed = compliance.filter(e => e.status === "fail").length;
+        const notTested = compliance.filter(e => e.status === "not_tested").length;
+        const tested = passed + failed;
+        const score = tested > 0 ? Math.round((passed / tested) * 100) : 0;
+        let output = `OWASP MCP Top 10 Compliance Score: ${score}/100\n`;
+        output += `Passed: ${passed}, Failed: ${failed}, Not Tested: ${notTested}\n\n`;
+        for (const entry of compliance) {
+            const icon = entry.status === "pass" ? "PASS" : entry.status === "fail" ? "FAIL" : "N/T";
+            output += `[${icon}] ${entry.id}: ${entry.title}`;
+            if (entry.finding_count > 0) {
+                output += ` — ${entry.finding_count} findings (highest: ${entry.highest_severity})`;
+            }
+            output += "\n";
+        }
+        return text(output.trim());
+    },
+};
+const reportCompare = {
+    name: "report_compare",
+    description: "Compare two scan reports (JSON format). Shows new findings, resolved findings, unchanged findings, regression count, and OWASP category trends.",
+    schema: {
+        before_path: z.string().describe("Path to the earlier scan report (JSON)"),
+        after_path: z.string().describe("Path to the later scan report (JSON)"),
+    },
+    async execute(args) {
+        const before = await safeReadJson(args.before_path);
+        const after = await safeReadJson(args.after_path);
+        if (!before)
+            return text(`Could not read before report: ${args.before_path}`);
+        if (!after)
+            return text(`Could not read after report: ${args.after_path}`);
+        const beforeIds = new Set(before.findings.map(f => f.id));
+        const afterIds = new Set(after.findings.map(f => f.id));
+        const newFindings = after.findings.filter(f => !beforeIds.has(f.id));
+        const resolved = before.findings.filter(f => !afterIds.has(f.id));
+        const unchanged = after.findings.filter(f => beforeIds.has(f.id));
+        let output = `Report Comparison\n`;
+        output += `Before: ${before.findings.length} findings\n`;
+        output += `After: ${after.findings.length} findings\n\n`;
+        output += `New: ${newFindings.length}\n`;
+        output += `Resolved: ${resolved.length}\n`;
+        output += `Unchanged: ${unchanged.length}\n\n`;
+        if (newFindings.length > 0) {
+            output += `New Findings (regressions):\n`;
+            for (const f of newFindings) {
+                output += `  + [${f.severity.toUpperCase()}] ${f.id}: ${f.title}\n`;
+            }
+            output += "\n";
+        }
+        if (resolved.length > 0) {
+            output += `Resolved Findings (improvements):\n`;
+            for (const f of resolved) {
+                output += `  - [${f.severity.toUpperCase()}] ${f.id}: ${f.title}\n`;
+            }
+            output += "\n";
+        }
+        return text(output.trim());
+    },
+};
+const reportFullAudit = {
+    name: "report_full_audit",
+    description: "Orchestrator tool. Run ALL applicable checks on a project directory: static analysis on source, config audit, dependency audit, and optionally runtime inspection if command is provided. Generates combined report.",
+    schema: {
+        path: z.string().describe("Project directory to audit"),
+        command: z.string().optional().describe("Server command for runtime checks (e.g. 'bun', 'node')"),
+        args: z.array(z.string()).optional().describe("Server command arguments"),
+        report_format: z.enum(["json", "markdown", "sarif"]).optional().describe("Output format (default: json)"),
+    },
+    async execute(args, ctx) {
+        const projectPath = resolve(args.path);
+        const allFindings = [];
+        const startTime = Date.now();
+        const sections = [];
+        // 1. Static Analysis
+        try {
+            const srcDir = (await fileExists(join(projectPath, "src"))) ? join(projectPath, "src") : projectPath;
+            const { sourceFiles } = initProject(srcDir);
+            if (sourceFiles.length > 0) {
+                sections.push(`Static Analysis: scanning ${sourceFiles.length} files...`);
+                for (const analyzer of allSastAnalyzers) {
+                    try {
+                        allFindings.push(...analyzer(sourceFiles));
+                    }
+                    catch { /* skip failed analyzer */ }
+                }
+            }
+        }
+        catch { /* no source files */ }
+        // 2. Config Audit
+        try {
+            // Check for .env files
+            const envFindings = await scanEnvFiles(projectPath);
+            allFindings.push(...envFindings);
+            // Check for MCP config files in project
+            const mcpConfigPaths = [
+                join(projectPath, ".mcp.json"),
+                join(projectPath, "mcp.json"),
+            ];
+            for (const cfgPath of mcpConfigPaths) {
+                if (await fileExists(cfgPath)) {
+                    const config = await parseConfigFile(cfgPath);
+                    if (config) {
+                        for (const server of config.servers) {
+                            allFindings.push(...auditServerEntry(server, cfgPath));
+                        }
+                        allFindings.push(...checkContextOversharing(config.servers, cfgPath));
+                    }
+                }
+            }
+        }
+        catch { /* config scan failed */ }
+        // 3. Dependency Analysis
+        try {
+            const deps = await parsePackageJson(projectPath);
+            if (deps) {
+                // Typosquatting
+                const matches = checkTyposquatting(Object.keys(deps));
+                allFindings.push(...typosquatFindings(matches, join(projectPath, "package.json")));
+                // Install scripts
+                const scripts = await detectInstallScripts(projectPath);
+                const lockfile = await parseLockfile(projectPath);
+                allFindings.push(...installScriptFindings(scripts, lockfile?.lockfilePath ?? join(projectPath, "package.json")));
+                // Unpinned versions
+                for (const [name, version] of Object.entries(deps)) {
+                    if (version === "*" || version === "latest") {
+                        allFindings.push({
+                            id: `DEP-PIN-AUTO`,
+                            title: `Unpinned Version: ${name}`,
+                            severity: "high",
+                            owasp_mcp: "MCP04",
+                            owasp_mcp_title: "Supply Chain & Dependency Vulnerabilities",
+                            category: "deps",
+                            file: join(projectPath, "package.json"),
+                            evidence: `${name}: "${version}"`,
+                            remediation: "Pin to exact version.",
+                            cwe: "CWE-1357",
+                        });
+                    }
+                }
+            }
+        }
+        catch { /* deps scan failed */ }
+        // 4. Runtime Inspection (if command provided)
+        if (args.command) {
+            try {
+                const manifest = await connectAndInspect(args.command, args.args, {}, 30_000);
+                allFindings.push(...analyzePoisoning(manifest.tools));
+                allFindings.push(...analyzeAnsiInjection(manifest.tools));
+                allFindings.push(...analyzeUnicodeSteganography(manifest.tools));
+                allFindings.push(...analyzeScope(manifest.tools));
+                allFindings.push(...analyzeToolShadowing(manifest.tools));
+                allFindings.push(...analyzeCrossOrigin(manifest.tools));
+                allFindings.push(...analyzeResourceExposure(manifest.resources, manifest.prompts));
+            }
+            catch { /* runtime scan failed */ }
+        }
+        const durationMs = Date.now() - startTime;
+        const report = buildScanReport(projectPath, allFindings, durationMs);
+        const format = args.report_format ?? "json";
+        if (format === "markdown") {
+            return text(generateMarkdownReport(report));
+        }
+        else if (format === "sarif") {
+            return json(generateSarifReport(report));
+        }
+        else {
+            return json(report);
+        }
+    },
+};
+export const reportTools = [
+    reportGenerate,
+    reportOwaspCompliance,
+    reportCompare,
+    reportFullAudit,
+];
+//# sourceMappingURL=index.js.map

package/dist/report/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/report/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAElE,eAAe;AACf,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,iBAAiB;AACjB,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAE7F,eAAe;AACf,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEjG,kBAAkB;AAClB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAClH,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAEhI,MAAM,gBAAgB,GAAG;IACvB,uBAAuB,EAAE,WAAW,EAAE,oBAAoB,EAAE,oBAAoB;IAChF,uBAAuB,EAAE,cAAc,EAAE,qBAAqB,EAAE,yBAAyB;IACzF,eAAe,EAAE,kBAAkB,EAAE,qBAAqB;CAC3D,CAAC;AAEF,MAAM,cAAc,GAAY;IAC9B,IAAI,EAAE,iBAAiB;IACvB,WAAW,EACT,qNAAqN;IACvN,MAAM,EAAE;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QAC/D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAClG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KACxE;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,IAAI,QAAmB,CAAC;QACxB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAkB,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,MAAM,GAAI,IAAI,CAAC,MAAiB,IAAI,MAAM,CAAC;QACjD,MAAM,MAAM,GAAG,eAAe,CAC3B,IAAI,CAAC,MAAiB,IAAI,SAAS,EACpC,QAAQ,EACR,CAAC,CACF,CAAC;QAEF,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,qBAAqB,GAAY;IACrC,IAAI,EAAE,yBAAyB;IAC/B,WAAW,EACT,kLAAkL;IACpL,MAAM,EAAE;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;KAChE;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,IAAI,QAAmB,CAAC;QACxB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAkB,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAClE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAClE,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnE,IAAI,MAAM,GAAG,sCAAsC,KAAK,QAAQ,CAAC;QACjE,MAAM,IAAI,WAAW,MAAM,aAAa,MAAM,iBAAiB,SAAS,MAAM,CAAC;QAE/E,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACzF,MAAM,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,MAAM,KAAK,CAAC,aAAa,uBAAuB,KAAK,CAAC,gBAAgB,GAAG,CAAC;YACtF,CAAC;YACD,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAY;IAC7B,IAAI,EAAE,gBAAgB;IACtB,WAAW,EACT,iJAAiJ;IACnJ,MAAM,EAAE;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;QAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;KACxE;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,MAAM,YAAY,CAA0B,IAAI,CAAC,WAAqB,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,MAAM,YAAY,CAA0B,IAAI,CAAC,UAAoB,CAAC,CAAC;QAErF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,iCAAiC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,gCAAgC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAE3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAElE,IAAI,MAAM,GAAG,qBAAqB,CAAC;QACnC,MAAM,IAAI,WAAW,MAAM,CAAC,QAAQ,CAAC,MAAM,aAAa,CAAC;QACzD,MAAM,IAAI,UAAU,KAAK,CAAC,QAAQ,CAAC,MAAM,eAAe,CAAC;QACzD,MAAM,IAAI,QAAQ,WAAW,CAAC,MAAM,IAAI,CAAC;QACzC,MAAM,IAAI,aAAa,QAAQ,CAAC,MAAM,IAAI,CAAC;QAC3C,MAAM,IAAI,cAAc,SAAS,CAAC,MAAM,MAAM,CAAC;QAE/C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,+BAA+B,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC;YACtE,CAAC;YACD,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,qCAAqC,CAAC;YAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,IAAI,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC;YACtE,CAAC;YACD,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;CACF,CAAC;AAEF,MAAM,eAAe,GAAY;IAC/B,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACT,sNAAsN;IACxN,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QACvD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;QACjG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QACzE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KAC1G;IACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;QACrB,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;QACjD,MAAM,WAAW,GAAc,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,qBAAqB;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YACrG,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAE5C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,6BAA6B,WAAW,CAAC,MAAM,WAAW,CAAC,CAAC;gBAC1E,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;oBACxC,IAAI,CAAC;wBACH,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;oBAC7C,CAAC;oBAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAEjC,kBAAkB;QAClB,IAAI,CAAC;YACH,uBAAuB;YACvB,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;YACpD,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;YAEjC,wCAAwC;YACxC,MAAM,cAAc,GAAG;gBACrB,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;gBAC9B,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC;aAC9B,CAAC;YAEF,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;gBACrC,IAAI,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;oBAC9C,IAAI,MAAM,EAAE,CAAC;wBACX,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;4BACpC,WAAW,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;wBACzD,CAAC;wBACD,WAAW,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;oBACxE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAEpC,yBAAyB;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,IAAI,EAAE,CAAC;gBACT,gBAAgB;gBAChB,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACtD,WAAW,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;gBAEnF,kBAAkB;gBAClB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;gBACxD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;gBAClD,WAAW,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;gBAEjH,oBAAoB;gBACpB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAC5C,WAAW,CAAC,IAAI,CAAC;4BACf,EAAE,EAAE,cAAc;4BAClB,KAAK,EAAE,qBAAqB,IAAI,EAAE;4BAClC,QAAQ,EAAE,MAAM;4BAChB,SAAS,EAAE,OAAO;4BAClB,eAAe,EAAE,2CAA2C;4BAC5D,QAAQ,EAAE,MAAM;4BAChB,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC;4BACvC,QAAQ,EAAE,GAAG,IAAI,MAAM,OAAO,GAAG;4BACjC,WAAW,EAAE,uBAAuB;4BACpC,GAAG,EAAE,UAAU;yBAChB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAElC,8CAA8C;QAC9C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACtC,IAAI,CAAC,OAAiB,EACtB,IAAI,CAAC,IAA4B,EACjC,EAAE,EACF,MAAM,CACP,CAAC;gBAEF,WAAW,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtD,WAAW,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1D,WAAW,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACjE,WAAW,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClD,WAAW,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1D,WAAW,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxD,WAAW,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACrF,CAAC;YAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QACrE,MAAM,MAAM,GAAI,IAAI,CAAC,aAAwB,IAAI,MAAM,CAAC;QAExD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,cAAc;IACd,qBAAqB;IACrB,aAAa;IACb,eAAe;CAChB,CAAC"}

package/dist/report/json-report.d.ts

@@ -0,0 +1,4 @@
+import type { Finding, ScanReport, OwaspComplianceEntry } from "../types/findings.js";
+export declare function buildScanReport(target: string, findings: Finding[], durationMs: number): ScanReport;
+export declare function buildOwaspCompliance(findings: Finding[]): OwaspComplianceEntry[];
+//# sourceMappingURL=json-report.d.ts.map

package/dist/report/json-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-report.d.ts","sourceRoot":"","sources":["../../src/report/json-report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAK5G,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,EAAE,EACnB,UAAU,EAAE,MAAM,GACjB,UAAU,CA2CZ;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,oBAAoB,EAAE,CAsBhF"}

package/dist/report/json-report.js

@@ -0,0 +1,61 @@
+import { OWASP_MCP_TOP10 } from "../data/owasp-mcp-top10.js";
+const SEVERITY_ORDER = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+export function buildScanReport(target, findings, durationMs) {
+    const summary = { total: 0, critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const f of findings) {
+        summary.total++;
+        summary[f.severity]++;
+    }
+    // Build OWASP compliance
+    const owasp_compliance = OWASP_MCP_TOP10.map(cat => {
+        const catFindings = findings.filter(f => f.owasp_mcp === cat.id);
+        let highest = null;
+        for (const f of catFindings) {
+            if (!highest || SEVERITY_ORDER[f.severity] < SEVERITY_ORDER[highest]) {
+                highest = f.severity;
+            }
+        }
+        const tested = catFindings.length > 0;
+        const failed = catFindings.some(f => f.severity === "critical" || f.severity === "high" || f.severity === "medium");
+        return {
+            id: cat.id,
+            title: cat.title,
+            status: tested ? (failed ? "fail" : "pass") : "not_tested",
+            finding_count: catFindings.length,
+            highest_severity: highest,
+        };
+    });
+    // Sort findings by severity
+    findings.sort((a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity]);
+    return {
+        scanner: "mcp-security-scanner",
+        version: "0.1.0",
+        timestamp: new Date().toISOString(),
+        target,
+        duration_ms: durationMs,
+        summary,
+        owasp_compliance,
+        findings,
+    };
+}
+export function buildOwaspCompliance(findings) {
+    return OWASP_MCP_TOP10.map(cat => {
+        const catFindings = findings.filter(f => f.owasp_mcp === cat.id);
+        let highest = null;
+        for (const f of catFindings) {
+            if (!highest || SEVERITY_ORDER[f.severity] < SEVERITY_ORDER[highest]) {
+                highest = f.severity;
+            }
+        }
+        const tested = catFindings.length > 0;
+        const failed = catFindings.some(f => f.severity === "critical" || f.severity === "high" || f.severity === "medium");
+        return {
+            id: cat.id,
+            title: cat.title,
+            status: tested ? (failed ? "fail" : "pass") : "not_tested",
+            finding_count: catFindings.length,
+            highest_severity: highest,
+        };
+    });
+}
+//# sourceMappingURL=json-report.js.map

package/dist/report/json-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-report.js","sourceRoot":"","sources":["../../src/report/json-report.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,MAAM,cAAc,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEpG,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,QAAmB,EACnB,UAAkB;IAElB,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxB,CAAC;IAED,yBAAyB;IACzB,MAAM,gBAAgB,GAA2B,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QACzE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,OAAO,GAAoB,IAAI,CAAC;QAEpC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrE,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC;YACvB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAEpH,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAgB;YACxB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,CAAC,YAAqB;YACrF,aAAa,EAAE,WAAW,CAAC,MAAM;YACjC,gBAAgB,EAAE,OAAO;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjF,OAAO;QACL,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM;QACN,WAAW,EAAE,UAAU;QACvB,OAAO;QACP,gBAAgB;QAChB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAmB;IACtD,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QAC/B,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,OAAO,GAAoB,IAAI,CAAC;QAEpC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrE,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC;YACvB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAEpH,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAgB;YACxB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,CAAC,YAAqB;YACrF,aAAa,EAAE,WAAW,CAAC,MAAM;YACjC,gBAAgB,EAAE,OAAO;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/report/markdown.d.ts

@@ -0,0 +1,3 @@
+import type { ScanReport } from "../types/findings.js";
+export declare function generateMarkdownReport(report: ScanReport): string;
+//# sourceMappingURL=markdown.d.ts.map

package/dist/report/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/report/markdown.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAwB,MAAM,sBAAsB,CAAC;AAE7E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAkGjE"}

package/dist/report/markdown.js

@@ -0,0 +1,89 @@
+export function generateMarkdownReport(report) {
+    const lines = [];
+    lines.push("# MCP Security Scan Report");
+    lines.push("");
+    lines.push(`**Target:** ${report.target}`);
+    lines.push(`**Scanner:** ${report.scanner} v${report.version}`);
+    lines.push(`**Date:** ${report.timestamp}`);
+    lines.push(`**Duration:** ${report.duration_ms}ms`);
+    lines.push("");
+    // Executive Summary
+    lines.push("## Executive Summary");
+    lines.push("");
+    lines.push(`| Severity | Count |`);
+    lines.push(`|----------|-------|`);
+    lines.push(`| Critical | ${report.summary.critical} |`);
+    lines.push(`| High | ${report.summary.high} |`);
+    lines.push(`| Medium | ${report.summary.medium} |`);
+    lines.push(`| Low | ${report.summary.low} |`);
+    lines.push(`| Info | ${report.summary.info} |`);
+    lines.push(`| **Total** | **${report.summary.total}** |`);
+    lines.push("");
+    // OWASP Compliance
+    lines.push("## OWASP MCP Top 10 Compliance");
+    lines.push("");
+    lines.push("| ID | Category | Status | Findings | Highest Severity |");
+    lines.push("|-----|----------|--------|----------|------------------|");
+    for (const entry of report.owasp_compliance) {
+        const status = entry.status === "pass" ? "PASS" : entry.status === "fail" ? "FAIL" : "N/T";
+        lines.push(`| ${entry.id} | ${entry.title} | ${status} | ${entry.finding_count} | ${entry.highest_severity ?? "-"} |`);
+    }
+    lines.push("");
+    // Score
+    const passed = report.owasp_compliance.filter(e => e.status === "pass").length;
+    const tested = report.owasp_compliance.filter(e => e.status !== "not_tested").length;
+    const score = tested > 0 ? Math.round((passed / tested) * 100) : 0;
+    lines.push(`**Compliance Score:** ${score}/100 (${passed}/${tested} categories passed)`);
+    lines.push("");
+    // Detailed Findings
+    if (report.findings.length > 0) {
+        lines.push("## Detailed Findings");
+        lines.push("");
+        const byCategory = {};
+        for (const f of report.findings) {
+            const key = `${f.owasp_mcp} — ${f.owasp_mcp_title}`;
+            if (!byCategory[key])
+                byCategory[key] = [];
+            byCategory[key].push(f);
+        }
+        for (const [category, findings] of Object.entries(byCategory)) {
+            lines.push(`### ${category}`);
+            lines.push("");
+            for (const f of findings) {
+                lines.push(`#### ${f.severity.toUpperCase()}: ${f.id} — ${f.title}`);
+                lines.push("");
+                if (f.file) {
+                    lines.push(`- **Location:** \`${f.file}${f.line ? `:${f.line}` : ""}${f.column ? `:${f.column}` : ""}\``);
+                }
+                if (f.cwe)
+                    lines.push(`- **CWE:** ${f.cwe}`);
+                lines.push(`- **Evidence:** ${f.evidence}`);
+                lines.push(`- **Remediation:** ${f.remediation}`);
+                lines.push("");
+            }
+        }
+    }
+    // Remediation Checklist
+    lines.push("## Remediation Checklist");
+    lines.push("");
+    const criticals = report.findings.filter(f => f.severity === "critical");
+    const highs = report.findings.filter(f => f.severity === "high");
+    if (criticals.length > 0) {
+        lines.push("### Critical (Fix Immediately)");
+        for (const f of criticals) {
+            lines.push(`- [ ] ${f.id}: ${f.title}`);
+        }
+        lines.push("");
+    }
+    if (highs.length > 0) {
+        lines.push("### High (Fix Soon)");
+        for (const f of highs) {
+            lines.push(`- [ ] ${f.id}: ${f.title}`);
+        }
+        lines.push("");
+    }
+    lines.push("---");
+    lines.push(`*Generated by mcp-security-scanner v${report.version}*`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=markdown.js.map

package/dist/report/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../../src/report/markdown.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,oBAAoB;IACpB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,mBAAmB;IACnB,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IACxE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3F,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,MAAM,KAAK,CAAC,KAAK,MAAM,MAAM,MAAM,KAAK,CAAC,aAAa,MAAM,KAAK,CAAC,gBAAgB,IAAI,GAAG,IAAI,CAAC,CAAC;IACzH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,QAAQ;IACR,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC;IACrF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,yBAAyB,KAAK,SAAS,MAAM,IAAI,MAAM,qBAAqB,CAAC,CAAC;IACzF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,oBAAoB;IACpB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,MAAM,UAAU,GAA8B,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,eAAe,EAAE,CAAC;YACpD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAC3C,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEf,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACrE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBACX,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC5G,CAAC;gBACD,IAAI,CAAC,CAAC,GAAG;oBAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAEjE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAErE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/report/sarif.d.ts

@@ -0,0 +1,3 @@
+import type { ScanReport } from "../types/findings.js";
+export declare function generateSarifReport(report: ScanReport): object;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/report/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../src/report/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAW,MAAM,sBAAsB,CAAC;AAkChE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAkD9D"}

package/dist/report/sarif.js

@@ -0,0 +1,56 @@
+function severityToLevel(severity) {
+    switch (severity) {
+        case "critical": return "error";
+        case "high": return "error";
+        case "medium": return "warning";
+        case "low": return "note";
+        case "info": return "note";
+        default: return "note";
+    }
+}
+export function generateSarifReport(report) {
+    const rulesMap = new Map();
+    const results = [];
+    for (const finding of report.findings) {
+        // Create rule if not exists
+        if (!rulesMap.has(finding.id)) {
+            rulesMap.set(finding.id, {
+                id: finding.id,
+                shortDescription: { text: finding.title },
+                fullDescription: { text: `[${finding.owasp_mcp}] ${finding.owasp_mcp_title}: ${finding.title}` },
+                defaultConfiguration: { level: severityToLevel(finding.severity) },
+                helpUri: finding.references?.[0],
+            });
+        }
+        const result = {
+            ruleId: finding.id,
+            level: severityToLevel(finding.severity),
+            message: { text: `${finding.evidence}\n\nRemediation: ${finding.remediation}` },
+        };
+        if (finding.file) {
+            result.locations = [{
+                    physicalLocation: {
+                        artifactLocation: { uri: finding.file },
+                        region: finding.line ? { startLine: finding.line, startColumn: finding.column } : undefined,
+                    },
+                }];
+        }
+        results.push(result);
+    }
+    const sarif = {
+        $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+        version: "2.1.0",
+        runs: [{
+                tool: {
+                    driver: {
+                        name: report.scanner,
+                        version: report.version,
+                        rules: Array.from(rulesMap.values()),
+                    },
+                },
+                results,
+            }],
+    };
+    return sarif;
+}
+//# sourceMappingURL=sarif.js.map

package/dist/report/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/report/sarif.ts"],"names":[],"mappings":"AAuBA,SAAS,eAAe,CAAC,QAAgB;IACvC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC,CAAC,OAAO,OAAO,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC;QAC5B,KAAK,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC;QAChC,KAAK,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC;QAC1B,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC;QAC3B,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAkB;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,4BAA4B;QAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;gBACvB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE;gBACzC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,eAAe,KAAK,OAAO,CAAC,KAAK,EAAE,EAAE;gBAChG,oBAAoB,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAClE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,QAAQ,oBAAoB,OAAO,CAAC,WAAW,EAAE,EAAE;SAChF,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,SAAS,GAAG,CAAC;oBAClB,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE;wBACvC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;qBAC5F;iBACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,OAAO,EAAE,sGAAsG;QAC/G,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC;gBACL,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,MAAM,CAAC,OAAO;wBACpB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;qBACrC;iBACF;gBACD,OAAO;aACR,CAAC;KACH,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/runtime/client.d.ts

@@ -0,0 +1,31 @@
+export interface ServerManifest {
+    tools: ServerTool[];
+    resources: ServerResource[];
+    prompts: ServerPrompt[];
+    serverInfo?: {
+        name?: string;
+        version?: string;
+    };
+}
+export interface ServerTool {
+    name: string;
+    description?: string;
+    inputSchema?: Record<string, unknown>;
+}
+export interface ServerResource {
+    uri: string;
+    name?: string;
+    description?: string;
+    mimeType?: string;
+}
+export interface ServerPrompt {
+    name: string;
+    description?: string;
+    arguments?: {
+        name: string;
+        description?: string;
+        required?: boolean;
+    }[];
+}
+export declare function connectAndInspect(command: string, args?: string[], env?: Record<string, string>, timeoutMs?: number): Promise<ServerManifest>;
+//# sourceMappingURL=client.d.ts.map

package/dist/runtime/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/runtime/client.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC1E;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,SAAS,SAAS,GACjB,OAAO,CAAC,cAAc,CAAC,CA0DzB"}

package/dist/runtime/client.js

@@ -0,0 +1,53 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+export async function connectAndInspect(command, args = [], env, timeoutMs = 30_000) {
+    const transport = new StdioClientTransport({
+        command,
+        args,
+        env: env ? { ...process.env, ...env } : undefined,
+    });
+    const client = new Client({ name: "mcp-security-scanner", version: "0.1.0" });
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), timeoutMs);
+    try {
+        await client.connect(transport);
+        const [toolsResult, resourcesResult, promptsResult] = await Promise.allSettled([
+            client.listTools(),
+            client.listResources(),
+            client.listPrompts(),
+        ]);
+        const tools = toolsResult.status === "fulfilled"
+            ? (toolsResult.value.tools ?? []).map((t) => ({
+                name: t.name,
+                description: t.description,
+                inputSchema: t.inputSchema,
+            }))
+            : [];
+        const resources = resourcesResult.status === "fulfilled"
+            ? (resourcesResult.value.resources ?? []).map((r) => ({
+                uri: r.uri,
+                name: r.name,
+                description: r.description,
+                mimeType: r.mimeType,
+            }))
+            : [];
+        const prompts = promptsResult.status === "fulfilled"
+            ? (promptsResult.value.prompts ?? []).map((p) => ({
+                name: p.name,
+                description: p.description,
+                arguments: p.arguments,
+            }))
+            : [];
+        return { tools, resources, prompts };
+    }
+    finally {
+        clearTimeout(timer);
+        try {
+            await client.close();
+        }
+        catch {
+            // ignore close errors
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/runtime/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/runtime/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AA4BjF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,OAAiB,EAAE,EACnB,GAA4B,EAC5B,SAAS,GAAG,MAAM;IAElB,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;QACzC,OAAO;QACP,IAAI;QACJ,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAA4B,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAE9E,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YAC7E,MAAM,CAAC,SAAS,EAAE;YAClB,MAAM,CAAC,aAAa,EAAE;YACtB,MAAM,CAAC,WAAW,EAAE;SACrB,CAAC,CAAC;QAEH,MAAM,KAAK,GACT,WAAW,CAAC,MAAM,KAAK,WAAW;YAChC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBAC/C,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,SAAS,GACb,eAAe,CAAC,MAAM,KAAK,WAAW;YACpC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBACvD,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,OAAO,GACX,aAAa,CAAC,MAAM,KAAK,WAAW;YAClC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBACnD,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QAET,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/runtime/index.d.ts

@@ -0,0 +1,3 @@
+import type { ToolDef } from "../types/index.js";
+export declare const runtimeTools: ToolDef[];
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAmVjD,eAAO,MAAM,YAAY,EAAE,OAAO,EAYjC,CAAC"}