mcp-triage 0.1.0 → 0.1.1

package/README.md

@@ -8,7 +8,7 @@ Why *triage*: a triage assesses severity fast and routes the case — a free che
 
 ## What it does
 
-- **Scans** (8 clients): Claude Desktop · Claude Code · Codex · Cursor · VS Code · Windsurf · OpenClaw · dsh
+- **Scans** (8 clients): Claude Desktop · Claude Code (incl. project-scoped servers from `~/.claude.json`) · Codex · Cursor · VS Code · Windsurf · OpenClaw · dsh
 - **Checks** (v0.1): JSON syntax (including the classic trailing comma), Codex-style TOML tables (basic), command resolvable on PATH, missing `${VAR}` / `process.env.VAR` references, relative-path arguments, plain `http://` remote URLs, transport/entry consistency (stdio needs a command, HTTP transports need a url, `serverName` required for dsh entries), cross-client drift for same-named servers
 - **Fixes** (opt-in `--fix`): mechanical repairs, only for files that fail to parse — strips JSON comments and trailing commas, re-verifies the result, keeps a `.mcp-triage.bak` backup. Everything else is escalated with a hint, never guessed at.
 - **JSON5-aware**: OpenClaw's `openclaw.json` is JSON5 (comments + trailing commas legal) and is parsed as such — no false syntax errors
@@ -80,7 +80,7 @@ Summary: 1 error(s), 1 warning(s), 1 info — 4 server(s) across 3 file(s).
 
 - All 8 client paths are verified against official docs and/or a real machine (verification log: `docs/verification-log.md` in the repo). OpenClaw paths additionally honor `OPENCLAW_CONFIG_PATH`; VS Code includes the remote/WSL user config (`~/.vscode-server/data/User/mcp.json`).
 - JSON clients: full parsing (OpenClaw: JSON5-light — comments and trailing commas; exotic JSON5 beyond that still fails). TOML (Codex): **basic** — `[mcp_servers.*]` tables only. YAML (dsh cordis profiles): **light** — per-entry extraction of `@deepseek-ai/dsh-mcp-client` patch entries (serverName, transport, command, args, env, cwd; `!!js` expressions kept as text for reference checks).
-- Claude Code project-scoped `mcpServers` inside `~/.claude.json` (`projects.*.mcpServers`) are **not yet scanned** (v0.1.1).
+- Claude Code project-scoped `mcpServers` inside `~/.claude.json` (`projects.*.mcpServers`) are scanned too — identical definitions across projects are merged into one entry whose context lists the projects, and findings carry the project path.
 - `--file` on a file we cannot attribute to a client: if it only parses as JSON5, you get an **info** saying so (not an error) — strict-JSON clients would reject such a file.
 
 ## When `--fix` is not enough
@@ -91,7 +91,7 @@ Summary: 1 error(s), 1 warning(s), 1 info — 4 server(s) across 3 file(s).
 
 ```bash
 npm install
-npm test          # node:test, 45 specs — dev/test scripts need Node 22.18+ (native type stripping)
+npm test          # node:test, 50 specs — dev/test scripts need Node 22.18+ (native type stripping)
 npm run build     # tsc → dist/
 node src/cli.ts scan
 node src/cli.ts scan --fix --dry-run

package/dist/checks.d.ts

@@ -8,5 +8,5 @@ export declare const DEFAULT_CHECK_CONTEXT: CheckContext;
 export declare function resolveCommandOnPath(cmd: string, ctx: CheckContext): string | null;
 export declare function findEnvRefs(s: string): string[];
 export declare function runChecks(parsed: ParsedConfig[], ctx?: CheckContext): Diagnostic[];
-/** Cross-file drift: same server name present in multiple clients but with different launch shape. */
+/** Cross-file drift: same server name present in multiple places but with a different launch shape. */
 export declare function checkCrossClientDrift(parsed: ParsedConfig[]): Diagnostic[];

package/dist/checks.js

@@ -66,7 +66,7 @@ function stringy(s) {
 }
 function checkServer(clientId, file, s, ctx) {
     const diags = [];
-    const base = { clientId, file, serverName: s.name };
+    const base = { clientId, file, serverName: s.name, ...(s.context !== undefined ? { context: s.context } : {}) };
     if (s.enabled === false) {
         diags.push({
             checkId: 'server.disabled',
@@ -178,14 +178,14 @@ export function runChecks(parsed, ctx = DEFAULT_CHECK_CONTEXT) {
     }
     return out;
 }
-/** Cross-file drift: same server name present in multiple clients but with different launch shape. */
+/** Cross-file drift: same server name present in multiple places but with a different launch shape. */
 export function checkCrossClientDrift(parsed) {
     const byName = new Map();
     for (const p of parsed) {
         for (const s of p.servers) {
             const shape = JSON.stringify([s.command ?? s.url ?? '', s.args ?? []]);
             const list = byName.get(s.name) ?? [];
-            list.push({ file: p.file, clientId: p.clientId, shape });
+            list.push({ file: p.file, clientId: p.clientId, context: s.context, shape });
             byName.set(s.name, list);
         }
     }
@@ -195,11 +195,13 @@ export function checkCrossClientDrift(parsed) {
             continue;
         const shapes = new Set(list.map((l) => l.shape));
         if (shapes.size > 1) {
+            const clients = new Set(list.map((l) => l.clientId));
+            const where = clients.size > 1 ? `across ${clients.size} clients (${list.length} places)` : `in ${list.length} places`;
             out.push({
                 checkId: 'config.cross-client-drift',
                 severity: 'info',
-                title: `Server "${name}" is configured differently across ${list.length} clients`,
-                detail: list.map((l) => `${l.clientId} → ${l.file}`).join('\n'),
+                title: `Server "${name}" is configured differently ${where}`,
+                detail: list.map((l) => `${l.clientId}${l.context ? ` (${l.context})` : ''} → ${l.file}`).join('\n'),
                 hint: 'Drift is not always wrong — but when one client works and another does not, this is where to look.',
                 clientId: list[0].clientId,
                 file: list[0].file,

package/dist/index.d.ts

@@ -2,7 +2,8 @@ export { VERSION } from './version.ts';
 export { CLIENTS, clientPathsForPlatform, defaultPathContext, expandPlaceholders } from './clients.ts';
 export type { PathContext } from './clients.ts';
 export { discoverFiles, expandGlob } from './discover.ts';
-export { parseConfigFile, parseJsonConfig, parseTomlConfig, parseYamlLight, normalizeJson5, extractServersFromJson, findTrailingComma, stripTrailingCommas, readFileSafe, } from './parse.ts';
+export { parseConfigFile, parseJsonConfig, parseTomlConfig, parseYamlLight, normalizeJson5, extractServersFromJson, extractClaudeProjectServers, findTrailingComma, stripTrailingCommas, readFileSafe, } from './parse.ts';
+export type { ClaudeProjectScope } from './parse.ts';
 export { runChecks, checkCrossClientDrift, resolveCommandOnPath, findEnvRefs, DEFAULT_CHECK_CONTEXT } from './checks.ts';
 export type { CheckContext } from './checks.ts';
 export { applyFixes, repairJsonText, stripJsonComments } from './fix.ts';

package/dist/index.js

@@ -5,7 +5,7 @@
 export { VERSION } from "./version.js";
 export { CLIENTS, clientPathsForPlatform, defaultPathContext, expandPlaceholders } from "./clients.js";
 export { discoverFiles, expandGlob } from "./discover.js";
-export { parseConfigFile, parseJsonConfig, parseTomlConfig, parseYamlLight, normalizeJson5, extractServersFromJson, findTrailingComma, stripTrailingCommas, readFileSafe, } from "./parse.js";
+export { parseConfigFile, parseJsonConfig, parseTomlConfig, parseYamlLight, normalizeJson5, extractServersFromJson, extractClaudeProjectServers, findTrailingComma, stripTrailingCommas, readFileSafe, } from "./parse.js";
 export { runChecks, checkCrossClientDrift, resolveCommandOnPath, findEnvRefs, DEFAULT_CHECK_CONTEXT } from "./checks.js";
 export { applyFixes, repairJsonText, stripJsonComments } from "./fix.js";
 export { renderHuman, renderJson } from "./report.js";

package/dist/parse.d.ts

@@ -16,15 +16,26 @@ export declare function findTrailingComma(text: string): {
 } | null;
 /** Recognized server container shapes: mcpServers | servers | mcp.servers (first match wins). */
 export declare function extractServersFromJson(data: unknown): ServerEntry[];
+export interface ClaudeProjectScope {
+    servers: ServerEntry[];
+    /** Number of projects that carry at least one server definition. */
+    projects: number;
+}
+/** Human label for the projects an entry was found in. */
+export declare function contextLabel(paths: string[]): string;
+export declare function extractClaudeProjectServers(data: unknown): ClaudeProjectScope;
 export interface ParseOutcome {
     ok: boolean;
     servers: ServerEntry[];
     diagnostics: Diagnostic[];
     caveat?: string;
+    /** Coverage note for non-obvious extractions (e.g. project-scoped servers folded in from ~/.claude.json). */
+    note?: string;
 }
 export declare function parseJsonConfig(text: string, file: string, clientId: string, opts?: {
     json5?: boolean;
     json5Fallback?: boolean;
+    projectScope?: boolean;
 }): ParseOutcome;
 export declare function parseTomlConfig(text: string, file: string, clientId: string): ParseOutcome;
 export declare function parseYamlLight(text: string, file: string, clientId: string): ParseOutcome;

package/dist/parse.js

@@ -253,6 +253,66 @@ export function extractServersFromJson(data) {
     }
     return [];
 }
+function entryShapeKey(s) {
+    const envKey = s.env ? Object.entries(s.env).sort(([a], [b]) => (a < b ? -1 : 1)) : null;
+    return JSON.stringify([
+        s.name,
+        s.command ?? null,
+        s.args ?? null,
+        envKey,
+        s.url ?? null,
+        s.transport ?? null,
+        s.cwd ?? null,
+        s.enabled ?? null,
+    ]);
+}
+/** Human label for the projects an entry was found in. */
+export function contextLabel(paths) {
+    if (paths.length === 1)
+        return `project: ${paths[0]}`;
+    const shown = paths.slice(0, 2).join(', ');
+    const more = paths.length > 2 ? ` +${paths.length - 2} more` : '';
+    return `projects: ${shown}${more}`;
+}
+export function extractClaudeProjectServers(data) {
+    const empty = { servers: [], projects: 0 };
+    if (!data || typeof data !== 'object')
+        return empty;
+    const projects = data.projects;
+    if (!projects || typeof projects !== 'object' || Array.isArray(projects))
+        return empty;
+    const byShape = new Map();
+    let projectsWithServers = 0;
+    for (const [projPath, projVal] of Object.entries(projects)) {
+        if (!projVal || typeof projVal !== 'object' || Array.isArray(projVal))
+            continue;
+        const bag = projVal.mcpServers;
+        if (!bag || typeof bag !== 'object' || Array.isArray(bag))
+            continue;
+        const names = Object.keys(bag);
+        if (names.length === 0)
+            continue;
+        projectsWithServers++;
+        for (const name of names) {
+            const entry = toServerEntry(name, bag[name]);
+            const key = entryShapeKey(entry);
+            const hit = byShape.get(key);
+            if (hit) {
+                if (!hit.paths.includes(projPath))
+                    hit.paths.push(projPath);
+            }
+            else {
+                byShape.set(key, { entry, paths: [projPath] });
+            }
+        }
+    }
+    const servers = [];
+    for (const { entry, paths } of byShape.values()) {
+        entry.context = contextLabel(paths);
+        servers.push(entry);
+    }
+    return { servers, projects: projectsWithServers };
+}
 export function parseJsonConfig(text, file, clientId, opts = {}) {
     const diagnostics = [];
     const clean = text.replace(/^\uFEFF/, '');
@@ -319,7 +379,15 @@ export function parseJsonConfig(text, file, clientId, opts = {}) {
         return { ok: false, servers: [], diagnostics };
     }
     const servers = extractServersFromJson(data);
-    return { ok: true, servers, diagnostics: [] };
+    let note;
+    if (opts.projectScope) {
+        const scope = extractClaudeProjectServers(data);
+        if (scope.servers.length > 0) {
+            servers.push(...scope.servers);
+            note = `${scope.servers.length} project-scoped server(s) from ${scope.projects} project(s)`;
+        }
+    }
+    return { ok: true, servers, diagnostics: [], note };
 }
 // ---------- TOML (minimal: [mcp_servers.*] tables) ----------
 function unquote(s) {
@@ -636,8 +704,19 @@ export function parseConfigFile(f) {
             ],
         };
     }
-    const r = f.format === 'json' ? parseJsonConfig(text, f.file, f.clientId, { json5: f.json5, json5Fallback: f.json5Fallback })
+    // Claude Code's ~/.claude.json also carries project-scoped server bags (projects.*.mcpServers).
+    const projectScope = f.clientId === 'claude-code' && f.scope === 'global';
+    const r = f.format === 'json' ? parseJsonConfig(text, f.file, f.clientId, { json5: f.json5, json5Fallback: f.json5Fallback, projectScope })
         : f.format === 'toml' ? parseTomlConfig(text, f.file, f.clientId)
             : parseYamlLight(text, f.file, f.clientId);
-    return { clientId: f.clientId, file: f.file, format: f.format, ok: r.ok, caveat: r.caveat, servers: r.servers, diagnostics: r.diagnostics };
+    return {
+        clientId: f.clientId,
+        file: f.file,
+        format: f.format,
+        ok: r.ok,
+        caveat: r.caveat,
+        note: r.note,
+        servers: r.servers,
+        diagnostics: r.diagnostics,
+    };
 }

package/dist/report.js

@@ -28,8 +28,8 @@ export function renderHuman(input, version, fixes) {
     for (const p of input.parsed) {
         const flag = p.ok ? '✓' : '✗';
         const n = p.servers.length;
-        const caveat = p.caveat ? `  (${p.caveat})` : '';
-        lines.push(`  ${flag} ${clientName(p.clientId)} — ${tilde(p.file)} — ${n} server(s)${caveat}`);
+        const note = [p.caveat, p.note].filter(Boolean).join('; ');
+        lines.push(`  ${flag} ${clientName(p.clientId)} — ${tilde(p.file)} — ${n} server(s)${note ? `  (${note})` : ''}`);
     }
     lines.push('');
     const sorted = [...input.diagnostics].sort((a, b) => ORDER.indexOf(a.severity) - ORDER.indexOf(b.severity));
@@ -39,7 +39,7 @@ export function renderHuman(input, version, fixes) {
     else {
         lines.push(`Findings (${sorted.length}):`);
         for (const d of sorted) {
-            const where = [clientName(d.clientId ?? ''), d.serverName ? `"${d.serverName}"` : ''].filter(Boolean).join(' · ');
+            const where = [clientName(d.clientId ?? ''), d.context ?? '', d.serverName ? `"${d.serverName}"` : ''].filter(Boolean).join(' · ');
             lines.push(`  [${LABEL[d.severity]}] ${d.checkId} — ${where ? where + ': ' : ''}${d.title}`);
             if (d.detail)
                 for (const l of d.detail.split('\n'))
@@ -90,7 +90,8 @@ export function renderJson(input, version, fixes) {
             format: p.format,
             ok: p.ok,
             caveat: p.caveat,
-            servers: p.servers.map((s) => ({ name: s.name, command: s.command, url: s.url, transport: s.transport })),
+            note: p.note,
+            servers: p.servers.map((s) => ({ name: s.name, command: s.command, url: s.url, transport: s.transport, context: s.context })),
         })),
         diagnostics: input.diagnostics,
         ...(fixes !== undefined ? { fixes } : {}),

package/dist/types.d.ts

@@ -11,6 +11,8 @@ export interface Diagnostic {
     clientId?: string;
     file?: string;
     serverName?: string;
+    /** Location detail for entries in shared files (e.g. the Claude Code project path in ~/.claude.json). */
+    context?: string;
     /** Whether `--fix` can address this in a future/current version */
     fixable?: boolean;
 }
@@ -24,6 +26,11 @@ export interface ServerEntry {
     cwd?: string;
     /** Explicitly disabled entries (OpenClaw `enabled: false`) — kept but not connected; runtime checks are skipped. */
     enabled?: boolean;
+    /**
+     * Where this entry lives when the file is shared and the location is not obvious —
+     * e.g. the project path for Claude Code project-scoped servers inside ~/.claude.json.
+     */
+    context?: string;
 }
 export interface ParsedConfig {
     clientId: string;
@@ -32,6 +39,8 @@ export interface ParsedConfig {
     ok: boolean;
     /** Set when parsing is intentionally partial, e.g. 'toml-minimal', 'yaml-light' */
     caveat?: string;
+    /** Coverage note about non-obvious extractions (e.g. project-scoped servers folded in from ~/.claude.json). */
+    note?: string;
     servers: ServerEntry[];
     diagnostics: Diagnostic[];
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.1.0";
+export declare const VERSION = "0.1.1";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.1.0';
+export const VERSION = '0.1.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-triage",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Triage broken MCP setups across 8 agent clients — find what is wrong, fix what is fixable, escalate the rest. Zero runtime dependencies.",
   "type": "module",
   "bin": {