mcp-wtf 0.1.0 → 0.2.0

package/README.md

@@ -12,7 +12,7 @@ npx mcp-wtf
 
 The host says *"MCP server failed to connect"*, or *"disconnected"*, or nothing at all — the server just isn't there. There are **17,000 GitHub issues** with that exact complaint, because the host throws away the one thing that would explain it: the server's dying words.
 
-mcp-wtf finds every MCP server configured in Claude Desktop, Claude Code, Cursor, Windsurf and VS Code, actually launches each one the way the host would, keeps everything the host discards, and tells you exactly what is wrong — with the fix:
+mcp-wtf finds every MCP server configured in Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, Cline, Roo Code, Gemini CLI and Zed, actually launches each one the way the host would — or opens a real connection to it, if it is a remote server — keeps everything the host discards, and tells you exactly what is wrong, with the fix:
 
 ```
   mcp-wtf  5 of 7 MCP servers are broken -- here is exactly why
@@ -39,6 +39,11 @@ mcp-wtf finds every MCP server configured in Claude Desktop, Claude Code, Cursor
           fix: uv is not on the PATH this process sees. Use the absolute path to uvx
                (run `which uvx` / `where uvx`), or install uv system-wide.
 
+  DEAD  linear  Cursor
+        x The endpoint returned 401 Unauthorized and points at OAuth protected-resource
+          metadata (https://mcp.linear.app/.well-known/oauth-protected-resource).
+          fix: This server wants a full OAuth flow, not a token pasted into a config.
+
   WARN  noisy  Claude Desktop, 1 tool, 1ms
         ! The handshake succeeded, but the server wrote 2 non-JSON lines to stdout.
           Some hosts survive this; others disconnect at random.
@@ -70,6 +75,65 @@ No install, no config, no account, zero dependencies.
 
 **Not-actually-MCP** — the command starts an HTTP server, or the wrong entrypoint, or something that waits forever on input. Diagnosed instead of hanging.
 
+**Remote servers** — DNS that doesn't resolve, refused connections, expired certificates, `401 Unauthorized`, OAuth-protected resources, 404 paths, an SSE URL given to a streamable-HTTP client, redirects nobody follows, and web pages pretending to be endpoints. See below.
+
+**What already went wrong** — the failures sitting in your host's log files, classified, with the line quoted. See below.
+
+## Remote servers
+
+```bash
+npx mcp-wtf --url https://mcp.example.com/mcp
+npx mcp-wtf --url https://mcp.example.com/mcp --header "Authorization: Bearer $TOKEN"
+```
+
+A remote server gives a client exactly one HTTP response and nothing else, so the host's *"failed to connect"* covers a dozen unrelated causes. mcp-wtf performs a real MCP `initialize` over the wire and reads the status line, the headers and the body:
+
+```
+  DEAD  https://mcp.example.com/sse  command line
+        x The endpoint returned 405 Method Not Allowed to the handshake POST -- something
+          is there, but it does not accept the POST that streamable HTTP is made of.
+          fix: A GET to this same URL returns text/event-stream, so this is the older
+               HTTP+SSE transport. Configure it as an SSE server ("type": "sse") rather
+               than streamable HTTP, or ask the operator for the streamable-HTTP path.
+          HTTP 405 Method Not Allowed  |  content-type: text/plain
+```
+
+It separates, by name: **DNS resolution failure**, **connection refused**, **connect timeout**, **`certificate has expired`**, self-signed and untrusted-issuer certificates, hostname mismatch, `https://` pointed at a plain-HTTP port, **`401 Unauthorized`** with and without credentials, **OAuth protected-resource metadata** (`/.well-known/oauth-protected-resource` — the client has to run the OAuth flow; no token pasted into a config will do), **403 Forbidden**, **404** (wrong path — try a `/mcp` or `/sse` suffix), **405/406** (right server, wrong transport kind), **3xx redirects** (reported with the `Location`, because most MCP clients do not follow them on the handshake POST), **429**, **5xx**, **HTML pages**, JSON that isn't JSON-RPC, and JSON-RPC that isn't MCP.
+
+And when the endpoint is fine, it says so — with the server's name and version — because that is also an answer: the problem is on the client side.
+
+Header values are never printed. A `--header` you pass, and a token a 401 body echoes back at you, are both redacted before anything is written out.
+
+## Log-file mode
+
+```bash
+npx mcp-wtf --logs                       # find the host's logs and read them
+npx mcp-wtf --logs ~/Library/Logs/Claude/mcp-server-github.log
+```
+
+Relaunching a server explains why it is broken *now*. It cannot explain why it dropped out at 4pm yesterday, and it cannot help when the failure only happens inside the host — a different `PATH`, a different working directory, a token the GUI has and your terminal does not. The host wrote all of that down and then never showed it to anyone.
+
+mcp-wtf reads the last 200 lines of every MCP log it can find (`%APPDATA%\Claude\logs` on Windows, `~/Library/Logs/Claude` on macOS, `~/.config/Claude/logs` on Linux), runs the same signatures over them, attributes every line to the server it names — including the interleaved shared `mcp.log` — and folds rotated files back into one entry per server:
+
+```
+  mcp-wtf  2 of 8 servers failed in the logs -- here is what the host wrote down
+  11 log files read
+
+  DEAD  postgres  Claude Desktop log
+        x The server is launched through Docker, and the Docker daemon was not running.
+          fix: Start Docker Desktop before the host, or the server dies on every launch.
+          > docker: error during connect: open //./pipe/dockerDesktopLinuxEngine: The
+            system cannot find the file specified.
+
+  DEAD  mermaid  Claude Desktop log
+        x The host failed to parse what the server sent on stdout -- the server is
+          printing non-JSON onto the protocol channel.
+          fix: Logs belong on stderr. On stdio transport stdout IS the protocol.
+          > [error] [mermaid] Unexpected token 'S', "STDIO MCP "... is not valid JSON
+```
+
+Repeated identical findings are collapsed, the mirrored JSON-RPC traffic is skipped (tool arguments are not evidence), and *"and then it disconnected"* is dropped as soon as something explains why. Quoted lines are redacted: anything token-shaped, anything after `Authorization:`, `api_key=` and friends.
+
 ## Usage
 
 ```bash
@@ -78,14 +142,53 @@ npx mcp-wtf --server github      # just one server
 npx mcp-wtf --config ./mcp.json  # one specific config file
 npx mcp-wtf -- node build/index.js       # a server not configured anywhere yet
 npx mcp-wtf --url http://localhost:3000/mcp
+npx mcp-wtf --url https://mcp.example.com/mcp --header "Authorization: Bearer $TOKEN"
+npx mcp-wtf --logs               # classify what already failed, from the host's logs
 ```
 
 `--json` for scripts. Exit codes: `0` all healthy, `1` something is broken, `2` could not run.
 
+## Where it looks
+
+| Host | Config |
+| --- | --- |
+| Claude Desktop | `claude_desktop_config.json` |
+| Claude Code | `~/.claude.json`, `./.mcp.json` |
+| Cursor | `~/.cursor/mcp.json`, `./.cursor/mcp.json` |
+| Windsurf | `~/.codeium/windsurf/mcp_config.json` |
+| VS Code | `mcp.json` (user and workspace) |
+| Cline | `globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json` |
+| Roo Code | `globalStorage/rooveterinaryinc.roo-cline/settings/mcp_settings.json` |
+| Gemini CLI | `~/.gemini/settings.json`, `./.gemini/settings.json` |
+| Zed | `settings.json` (`context_servers`, including the `{path, args, env}` command form) |
+
+All three OS layouts, and the JSONC these files are actually written in — comments and trailing commas are not a broken config, whatever `JSON.parse` thinks.
+
+## The errors this explains
+
+If you searched for one of these and landed here, that is the point:
+
+`MCP server failed to connect` · `Server disconnected` · `MCP error -32000: Connection closed` ·
+`Server transport closed unexpectedly, this is likely due to the process exiting early` ·
+`spawn npx ENOENT` · `spawn uvx ENOENT` · `spawn docker ENOENT` ·
+`Error: Cannot find module` · `ERR_MODULE_NOT_FOUND` · `ModuleNotFoundError: No module named` ·
+`Unexpected token < in JSON at position 0` · `Unexpected token 'I', "[INFO]..." is not valid JSON` ·
+`Unexpected non-whitespace character after JSON` ·
+`401 Unauthorized MCP` · `403 Forbidden` · `WWW-Authenticate` · `oauth-protected-resource` ·
+`405 Method Not Allowed` · `406 Not Acceptable` · `404 Not Found` ·
+`fetch failed` · `ECONNREFUSED` · `ENOTFOUND` · `ETIMEDOUT` ·
+`certificate has expired` · `self signed certificate in certificate chain` ·
+`unable to verify the first certificate` · `ERR_TLS_CERT_ALTNAME_INVALID` ·
+`EADDRINUSE: address already in use` ·
+`docker: error during connect` · `Cannot connect to the Docker daemon` ·
+`MCP error -32001: Request timed out` · `it works in my terminal but not in Claude`
+
 ## Safety
 
 - mcp-wtf launches your servers exactly as configured, performs the MCP handshake, lists their tools, and shuts them down. **It never invokes a tool.**
-- Env values from your configs are passed to the servers they belong to and are **never printed** — reports name the offending *key*, never the value.
+- Env values from your configs are passed to the servers they belong to and are **never printed** — reports name the offending *key*, never the value. The same goes for `headers` on a remote server, in `--json` output too.
+- Log lines and HTTP response bodies are quoted back at you **redacted**: values after `Authorization:` / `api_key=` / `*_TOKEN=`, and anything shaped like a token (`ghp_…`, `sk-…`, `xox…`, JWTs, long hex and base64 runs). A report is safe to paste into a bug report without reading it first.
+- Nothing is uploaded anywhere. The only network traffic is to the MCP endpoints you asked it to check.
 
 ## See also
 

package/dist/cli.d.ts

@@ -1,2 +1,16 @@
 #!/usr/bin/env node
+import type { ServerSpec, WtfOptions } from './types.js';
+interface Parsed {
+    options: WtfOptions;
+    json: boolean;
+    config?: string;
+    serverFilter: string[];
+    direct?: ServerSpec;
+    logs: boolean;
+    logFiles: string[];
+    help: boolean;
+    version: boolean;
+    error?: string;
+}
+export declare function parseArgs(argv: string[]): Parsed;
 export {};

package/dist/cli.js

@@ -2,8 +2,10 @@
 import { existsSync } from 'node:fs';
 import { discover } from './discover.js';
 import { diagnoseAll } from './diagnose.js';
+import { diagnoseLogs } from './logs.js';
+import { redactSpecSecrets } from './redact.js';
 import { renderTerminal } from './report/terminal.js';
-const VERSION = '0.1.0';
+import { VERSION } from './version.js';
 const HELP = `
   mcp-wtf ${VERSION}
   Your MCP server won't connect. Find out why in 10 seconds.
@@ -13,9 +15,12 @@ const HELP = `
     mcp-wtf --config <file>         diagnose the servers in one config file
     mcp-wtf --server <name>         only the named server(s); repeatable
     mcp-wtf -- <command> [...]      diagnose one stdio server directly
-    mcp-wtf --url <url>             diagnose one streamable-HTTP server
+    mcp-wtf --url <url>             diagnose one remote (HTTP/SSE) server
+    mcp-wtf --logs [file]           classify failures in the host's log files
+                                    (auto-discovered when no file is given)
 
   OPTIONS
+    --header "Name: value"  sent with --url; repeatable
     --json                  machine-readable report
     --timeout <ms>          per-server handshake timeout (default 15000)
     --concurrency <n>       servers checked at once (default 4)
@@ -30,18 +35,27 @@ const HELP = `
                             packages, ports already in use, rejected keys
     the protocol            handshake completes, stdout carries only JSON
                             (stdout pollution = "disconnects randomly")
+    remote endpoints        DNS, refused connections, expired certificates,
+                            401/403 (including OAuth-protected resources),
+                            404 paths, SSE-vs-streamable mismatches,
+                            redirects, and HTML pages pretending to be MCP
+    host logs               the same signatures, read out of the log files
+                            Claude Desktop already wrote
 
   Exit codes: 0 all healthy, 1 something is broken, 2 could not run.
 
   Configs searched: Claude Desktop, Claude Code (~/.claude.json, ./.mcp.json),
-  Cursor, Windsurf, VS Code. mcp-wtf never invokes your tools, and never
-  prints the values of env secrets.
+  Cursor, Windsurf, VS Code, Cline, Roo Code, Gemini CLI, Zed. mcp-wtf never
+  invokes your tools, never prints the values of env secrets, and redacts
+  anything token-shaped out of the log lines it quotes.
 `;
-function parseArgs(argv) {
+export function parseArgs(argv) {
     const out = {
         options: { timeoutMs: 15_000, concurrency: 4 },
         json: false,
         serverFilter: [],
+        logs: false,
+        logFiles: [],
         help: false,
         version: false,
     };
@@ -78,6 +92,14 @@ function parseArgs(argv) {
             case '--url':
                 url = next() ?? null;
                 break;
+            case '--logs': {
+                // The file is optional: `--logs` alone means "find them yourself".
+                out.logs = true;
+                const peek = argv[i + 1];
+                if (peek !== undefined && !peek.startsWith('-'))
+                    out.logFiles.push(argv[++i]);
+                break;
+            }
             case '--header': {
                 const raw = next() ?? '';
                 const idx = raw.indexOf(':');
@@ -122,6 +144,40 @@ async function main() {
         process.stderr.write(`mcp-wtf: ${parsed.error}\n`);
         process.exit(2);
     }
+    const emit = (report) => {
+        // Whatever leaves this process is safe to paste into a bug report.
+        const safe = { ...report, diagnoses: report.diagnoses.map(redactSpecSecrets) };
+        if (parsed.json)
+            process.stdout.write(JSON.stringify(safe, null, 2) + '\n');
+        else
+            process.stdout.write(renderTerminal(safe));
+        process.exit(safe.broken > 0 || safe.configErrors.length > 0 ? 1 : 0);
+    };
+    if (parsed.logs) {
+        const missing = parsed.logFiles.filter((f) => !existsSync(f));
+        if (missing.length > 0) {
+            process.stderr.write(`mcp-wtf: no such log file: ${missing.join(', ')}\n`);
+            process.exit(2);
+        }
+        const t0 = Date.now();
+        const { diagnoses, scanned } = diagnoseLogs(parsed.logFiles);
+        if (scanned.length === 0) {
+            process.stderr.write('mcp-wtf: no MCP log files found. Claude Desktop writes them to %APPDATA%\\Claude\\logs (Windows), ~/Library/Logs/Claude (macOS) or ~/.config/Claude/logs (Linux). Point at one with `mcp-wtf --logs <file>`.\n');
+            process.exit(2);
+        }
+        emit({
+            diagnoses,
+            mode: 'logs',
+            logsScanned: scanned,
+            configsSearched: [],
+            configErrors: [],
+            healthy: diagnoses.filter((d) => d.verdict === 'healthy').length,
+            broken: diagnoses.filter((d) => d.verdict === 'broken').length,
+            warnings: diagnoses.filter((d) => d.verdict === 'warning').length,
+            durationMs: Date.now() - t0,
+        });
+        return;
+    }
     let specs;
     let configsSearched = [];
     let configErrors = [];
@@ -154,20 +210,16 @@ async function main() {
     }
     const t0 = Date.now();
     const diagnoses = await diagnoseAll(specs, parsed.options);
-    const report = {
+    emit({
         diagnoses,
+        mode: 'config',
         configsSearched,
         configErrors,
         healthy: diagnoses.filter((d) => d.verdict === 'healthy').length,
         broken: diagnoses.filter((d) => d.verdict === 'broken').length,
         warnings: diagnoses.filter((d) => d.verdict === 'warning').length,
         durationMs: Date.now() - t0,
-    };
-    if (parsed.json)
-        process.stdout.write(JSON.stringify(report, null, 2) + '\n');
-    else
-        process.stdout.write(renderTerminal(report));
-    process.exit(report.broken > 0 || configErrors.length > 0 ? 1 : 0);
+    });
 }
 main().catch((e) => {
     process.stderr.write(`mcp-wtf: internal error: ${e.stack ?? String(e)}\n`);

package/dist/client/index.js

@@ -1,3 +1,4 @@
+import { VERSION } from '../version.js';
 export { StdioTransport } from './stdio.js';
 export { HttpTransport } from './http.js';
 /** Versions we will negotiate, newest first. */
@@ -25,7 +26,7 @@ export class McpClient {
         const raw = await this.transport.request('initialize', {
             protocolVersion,
             capabilities: { roots: { listChanged: true }, sampling: {}, elicitation: {} },
-            clientInfo: { name: 'mcp-wtf', version: '0.1.0' },
+            clientInfo: { name: 'mcp-wtf', version: VERSION },
         }, this.timeoutMs);
         const ms = Date.now() - t0;
         const result = (raw.result ?? {});

package/dist/diagnose.d.ts

@@ -7,5 +7,7 @@ import type { Diagnosis, Finding, ServerSpec, WtfOptions } from './types.js';
  */
 export declare function resolveCommand(command: string, env?: NodeJS.ProcessEnv): string | null;
 export declare function staticChecks(spec: ServerSpec): Finding[];
+/** Exported so log-file mode can run the same signatures over host logs. */
+export declare function classifyStderr(stderr: string[], cfg: string, command: string): Finding | null;
 export declare function diagnoseServer(spec: ServerSpec, options: WtfOptions): Promise<Diagnosis>;
 export declare function diagnoseAll(specs: ServerSpec[], options: WtfOptions): Promise<Diagnosis[]>;

package/dist/diagnose.js

@@ -1,6 +1,7 @@
 import { existsSync, statSync } from 'node:fs';
 import { delimiter, isAbsolute, join } from 'node:path';
-import { McpClient, StdioTransport, HttpTransport } from './client/index.js';
+import { McpClient, StdioTransport } from './client/index.js';
+import { probeRemote } from './remote.js';
 // ---------------------------------------------------------------------------
 // Static checks: everything knowable without starting the server. Most broken
 // setups are broken right here, and these diagnoses are exact.
@@ -51,6 +52,60 @@ function configFileOf(spec) {
     const m = spec.sources[0]?.match(/\((.+)\)$/);
     return m?.[1] ?? 'your MCP config file';
 }
+/**
+ * What can be decided about a remote server without opening a socket. The
+ * headers block is the remote equivalent of `env`: the same pasted-and-never-
+ * replaced placeholders end up in it, and the same rule applies -- name the
+ * header, never the value.
+ */
+function remoteStaticChecks(spec, cfg) {
+    const findings = [];
+    const url = spec.url ?? '';
+    let parsed = null;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        /* Reported below; `fetch` would fail with an opaque TypeError. */
+    }
+    if (!parsed) {
+        findings.push({
+            code: 'config.url_invalid',
+            severity: 'fatal',
+            message: `"${url}" is not a usable URL.`,
+            fix: `A remote MCP server needs the scheme too: "url": "https://example.com/mcp", not "example.com/mcp". (Config: ${cfg})`,
+        });
+        return findings;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        findings.push({
+            code: 'config.url_invalid',
+            severity: 'fatal',
+            message: `The URL uses the "${parsed.protocol.replace(':', '')}" scheme, which no MCP transport speaks.`,
+            fix: `Remote MCP is http:// or https:// only. Fix the "url" for this server in ${cfg}.`,
+        });
+    }
+    for (const [key, value] of Object.entries(spec.headers ?? {})) {
+        const bare = value.replace(/^(bearer|basic|token)\s+/i, '');
+        if (PLACEHOLDER.test(bare)) {
+            findings.push({
+                code: 'header.placeholder',
+                severity: 'fatal',
+                message: `The "${key}" header is still the placeholder value from the instructions.`,
+                fix: `Put the real credential into the "headers" block of this server in ${cfg}. As configured, the server will answer 401.`,
+            });
+        }
+        else if (SECRET_KEY.test(key) && bare.trim() === '') {
+            findings.push({
+                code: 'header.empty_secret',
+                severity: 'fatal',
+                message: `The "${key}" header is empty.`,
+                fix: `Set it in ${cfg}, or remove the header entirely so the server can answer with a proper auth challenge.`,
+            });
+        }
+    }
+    return findings;
+}
 export function staticChecks(spec) {
     const findings = [];
     const cfg = configFileOf(spec);
@@ -64,6 +119,8 @@ export function staticChecks(spec) {
         return findings;
     }
     if (spec.kind === 'http')
+        return remoteStaticChecks(spec, cfg);
+    if (spec.kind !== 'stdio')
         return findings;
     const command = spec.command;
     // "command": "npx -y some-server" -- the whole line pasted into `command`.
@@ -129,12 +186,12 @@ export function staticChecks(spec) {
 /** Known stderr signatures, most specific first. */
 const STDERR_SIGNATURES = [
     [
-        /Cannot find module '([^']+)'|ERR_MODULE_NOT_FOUND.*?'([^']+)'/,
+        /Cannot find module '([^']+)'|ERR_MODULE_NOT_FOUND.*?'([^']+)'|ModuleNotFoundError: No module named '([^']+)'/,
         (m, cfg) => ({
             code: 'deps.module_missing',
             severity: 'fatal',
-            message: `The server crashed because a module is missing: ${m[1] ?? m[2]}.`,
-            fix: `Its dependencies are not installed. If this is your own server, run npm install in its directory; if it is configured with a path into someone's repo, that checkout was never built. (Config: ${cfg})`,
+            message: `The server crashed because a module is missing: ${m[1] ?? m[2] ?? m[3]}.`,
+            fix: `Its dependencies are not installed. If this is your own server, run npm install (or pip install / uv sync) in its directory; if it is configured with a path into someone's repo, that checkout was never built. (Config: ${cfg})`,
         }),
     ],
     [
@@ -186,7 +243,8 @@ const STDERR_SIGNATURES = [
         }),
     ],
 ];
-function classifyStderr(stderr, cfg, command) {
+/** Exported so log-file mode can run the same signatures over host logs. */
+export function classifyStderr(stderr, cfg, command) {
     const text = stderr.join('\n');
     for (const [pattern, build] of STDERR_SIGNATURES) {
         const m = text.match(pattern);
@@ -196,11 +254,18 @@ function classifyStderr(stderr, cfg, command) {
     return null;
 }
 async function liveCheck(spec, options) {
+    // A remote server has no process to watch: its whole story is one HTTP
+    // response, so it gets its own reader.
+    if (spec.kind === 'http')
+        return probeRemote(spec, options);
     const cfg = configFileOf(spec);
     const findings = [];
-    const transport = spec.kind === 'http'
-        ? new HttpTransport({ url: spec.url, headers: spec.headers })
-        : new StdioTransport({ command: spec.command, args: spec.args ?? [], env: spec.env, cwd: spec.cwd });
+    const transport = new StdioTransport({
+        command: spec.command,
+        args: spec.args ?? [],
+        env: spec.env,
+        cwd: spec.cwd,
+    });
     const client = new McpClient(transport, options.timeoutMs);
     const stderrTail = () => transport.stderr.slice(-12).join('\n');
     try {
@@ -304,6 +369,16 @@ async function liveCheck(spec, options) {
     return { findings, serverInfo, toolCount: tools.length, connectMs };
 }
 // ---------------------------------------------------------------------------
+/**
+ * `info` findings are notes on a server that works -- "the handshake took 12s",
+ * "this endpoint is fine, so your client is not". They print, but they must not
+ * downgrade a healthy verdict, or the summary line starts lying.
+ */
+function verdictOf(findings) {
+    if (findings.some((f) => f.severity === 'fatal'))
+        return 'broken';
+    return findings.some((f) => f.severity === 'warn') ? 'warning' : 'healthy';
+}
 export async function diagnoseServer(spec, options) {
     const findings = staticChecks(spec);
     const fatalAlready = findings.some((f) => f.severity === 'fatal');
@@ -316,17 +391,18 @@ export async function diagnoseServer(spec, options) {
             const filtered = fatalAlready ? live.findings.filter((f) => f.code !== 'spawn.failed') : live.findings;
             findings.push(...filtered);
             if (live.serverInfo !== undefined) {
-                const verdict = findings.some((f) => f.severity === 'fatal') ? 'broken' : findings.length > 0 ? 'warning' : 'healthy';
-                return { spec, verdict, findings, serverInfo: live.serverInfo, toolCount: live.toolCount, connectMs: live.connectMs };
+                return {
+                    spec,
+                    verdict: verdictOf(findings),
+                    findings,
+                    serverInfo: live.serverInfo,
+                    toolCount: live.toolCount,
+                    connectMs: live.connectMs,
+                };
             }
         }
     }
-    const verdict = findings.some((f) => f.severity === 'fatal')
-        ? 'broken'
-        : findings.length > 0
-            ? 'warning'
-            : 'healthy';
-    return { spec, verdict, findings };
+    return { spec, verdict: verdictOf(findings), findings };
 }
 export async function diagnoseAll(specs, options) {
     const results = new Array(specs.length);

package/dist/discover.d.ts

@@ -1,13 +1,22 @@
 import type { ServerSpec } from './types.js';
 /**
- * Every place the well-known hosts keep their MCP configuration. Two shapes
+ * Every place the well-known hosts keep their MCP configuration. Three shapes
  * exist in the wild: `mcpServers` (Claude Desktop, Claude Code, Cursor,
- * Windsurf) and `servers` (VS Code).
+ * Windsurf, Gemini CLI, Cline, Roo Code), `servers` (VS Code) and
+ * `context_servers` (Zed).
  */
 export declare function knownConfigPaths(platform?: NodeJS.Platform, home?: string, cwd?: string): Array<{
     path: string;
     host: string;
 }>;
+/**
+ * JSON.parse, but tolerant of what these files actually contain. VS Code's
+ * mcp.json and Zed's settings.json are JSONC -- Zed ships a default settings
+ * file that is nothing but comments -- and calling those "not valid JSON"
+ * would be a confident, wrong diagnosis. Comments and trailing commas are
+ * stripped; anything still broken is genuinely broken.
+ */
+export declare function parseJsonc(text: string): unknown;
 /** Pull every server out of one config file. Returns [] when unreadable. */
 export declare function readConfigFile(path: string, host: string): ServerSpec[];
 /**