mcptrustchecker 1.0.0

package/dist/policy.js

@@ -0,0 +1,48 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Policy-as-code. A team declares what "acceptable" means once (in
+ * `mcptrustchecker.config.json` under `policy`) and every scan is gated against
+ * it in CI — beyond a single grade/score threshold. Pure and deterministic.
+ */
+import { GRADE_RANK } from './scoring/model.js';
+const CAP_ORDER = ['minimal', 'moderate', 'high', 'critical'];
+/** Evaluate a report against a policy; empty array means it passes. */
+export function evaluatePolicy(report, policy) {
+    if (!policy)
+        return [];
+    const violations = [];
+    // Normalize case so a miscased config value ("b", "Critical") can't silently
+    // fail OPEN (disabling the gate) or fail CLOSED (blocking every scan).
+    const minGrade = policy.minGrade ? String(policy.minGrade).toUpperCase() : undefined;
+    if (minGrade && minGrade in GRADE_RANK && GRADE_RANK[report.score.grade] < GRADE_RANK[minGrade]) {
+        violations.push({
+            policy: 'minGrade',
+            message: `Trust grade ${report.score.grade} is worse than the required minimum ${minGrade}.`,
+        });
+    }
+    const maxCapability = policy.maxCapability ? String(policy.maxCapability).toLowerCase() : undefined;
+    if (maxCapability && CAP_ORDER.includes(maxCapability)) {
+        const level = report.capabilityProfile.level;
+        if (CAP_ORDER.indexOf(level) > CAP_ORDER.indexOf(maxCapability)) {
+            violations.push({
+                policy: 'maxCapability',
+                message: `Capability level "${level}" exceeds the allowed maximum "${maxCapability}".`,
+            });
+        }
+    }
+    if (policy.denyRules?.length) {
+        const denied = new Set(policy.denyRules);
+        const hit = [...new Set(report.findings.map((f) => f.ruleId).filter((id) => denied.has(id)))];
+        if (hit.length) {
+            violations.push({ policy: 'denyRules', message: `Denied rule(s) fired: ${hit.join(', ')}.` });
+        }
+    }
+    if (policy.denyCapabilities?.length) {
+        const present = new Set(report.capabilityProfile.tags);
+        const hit = policy.denyCapabilities.filter((t) => present.has(t));
+        if (hit.length) {
+            violations.push({ policy: 'denyCapabilities', message: `Denied capability(ies) present: ${hit.join(', ')}.` });
+        }
+    }
+    return violations;
+}

package/dist/report/badge.d.ts

@@ -0,0 +1,14 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Shields.io "endpoint" badge JSON. Host the output somewhere and point a
+ * shields.io endpoint badge at it, or let the marketplace render it directly:
+ *   ![trust](https://img.shields.io/endpoint?url=<raw-json-url>)
+ */
+import type { ScanReport } from '../types.js';
+export interface ShieldsBadge {
+    schemaVersion: 1;
+    label: string;
+    message: string;
+    color: string;
+}
+export declare function renderBadge(report: ScanReport, label?: string): string;

package/dist/report/badge.js

@@ -0,0 +1,18 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Shields.io "endpoint" badge JSON. Host the output somewhere and point a
+ * shields.io endpoint badge at it, or let the marketplace render it directly:
+ *   ![trust](https://img.shields.io/endpoint?url=<raw-json-url>)
+ */
+function color(grade) {
+    return { A: 'brightgreen', B: 'green', C: 'yellow', D: 'orange', F: 'red' }[grade];
+}
+export function renderBadge(report, label = 'mcptrustchecker') {
+    const badge = {
+        schemaVersion: 1,
+        label,
+        message: `${report.score.grade} (${report.score.score})`,
+        color: color(report.score.grade),
+    };
+    return JSON.stringify(badge);
+}

package/dist/report/json.d.ts

@@ -0,0 +1,4 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+import type { ScanReport } from '../types.js';
+/** Pretty JSON report (the machine-readable canonical form). */
+export declare function renderJson(report: ScanReport): string;

package/dist/report/json.js

@@ -0,0 +1,4 @@
+/** Pretty JSON report (the machine-readable canonical form). */
+export function renderJson(report) {
+    return JSON.stringify(report, null, 2);
+}

package/dist/report/markdown.d.ts

@@ -0,0 +1,6 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Markdown report — for PR comments, job summaries, and README embeds.
+ */
+import type { ScanReport } from '../types.js';
+export declare function renderMarkdown(report: ScanReport): string;

package/dist/report/markdown.js

@@ -0,0 +1,110 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Markdown report — for PR comments, job summaries, and README embeds.
+ */
+import { ALL_CATEGORIES } from '../scoring/model.js';
+const SEV_EMOJI = {
+    critical: '🟥',
+    high: '🟧',
+    medium: '🟨',
+    low: '🟦',
+    info: '⬜',
+};
+function gradeEmoji(grade) {
+    return { A: '🟢', B: '🟢', C: '🟡', D: '🟠', F: '🔴' }[grade] ?? '⚪';
+}
+export function renderMarkdown(report) {
+    const s = report.score;
+    const md = [];
+    const capEmoji = { minimal: '🟢', moderate: '🔵', high: '🟠', critical: '🔴' }[report.capabilityProfile.level] ?? '⚪';
+    md.push(`## ${gradeEmoji(s.grade)} MCP Trust Checker — Trust ${s.grade} (${s.score}/100) · ${capEmoji} Capability ${report.capabilityProfile.level.toUpperCase()}`);
+    md.push('');
+    md.push(`> **Trust** = malice/negligence signals (drives the grade) · **Capability** = blast radius if the model is manipulated (not a verdict).`);
+    if (report.capabilityProfile.reasons.length) {
+        md.push('>');
+        md.push(`> Capability: ${report.capabilityProfile.reasons.join('; ')}.`);
+    }
+    md.push('');
+    md.push(`**Target:** \`${mdInline(report.target.id)}\` (${report.target.source.kind}) · ` +
+        `**Surface:** ${report.stats.tools} tools, ${report.stats.prompts} prompts, ${report.stats.resources} resources · ` +
+        `**Methodology:** \`${s.methodologyVersion}\``);
+    md.push('');
+    const bs = report.stats.findingsBySeverity;
+    md.push(`**Findings:** ${bs.critical} critical · ${bs.high} high · ${bs.medium} medium · ${bs.low} low · ${bs.info} info`);
+    md.push('');
+    if (s.gatesFired.length) {
+        md.push('> [!WARNING]');
+        for (const g of s.gatesFired)
+            md.push(`> ${g}`);
+        md.push('');
+    }
+    const cats = ALL_CATEGORIES.filter((c) => s.categorySubtotals[c] > 0);
+    if (cats.length) {
+        md.push('| Category | Penalty |');
+        md.push('| --- | ---: |');
+        for (const c of cats)
+            md.push(`| ${c} | -${s.categorySubtotals[c]} |`);
+        md.push('');
+    }
+    if (report.toxicFlows.length) {
+        md.push('### Toxic flows');
+        md.push('');
+        for (const f of report.toxicFlows) {
+            md.push(`- ${SEV_EMOJI[f.severity]} **${f.severity}** — ${mdInline(f.description)}`);
+        }
+        md.push('');
+    }
+    if (report.integrity && report.integrity.status === 'drift') {
+        md.push('### ⚠️ Integrity drift (possible rug pull)');
+        md.push('');
+        for (const ch of report.integrity.changes ?? [])
+            md.push(`- ${mdInline(ch.detail)}`);
+        md.push('');
+    }
+    if (report.findings.length) {
+        md.push('### Findings');
+        md.push('');
+        md.push('| Sev | Rule | Finding | Location |');
+        md.push('| --- | --- | --- | --- |');
+        for (const f of report.findings) {
+            const loc = f.location
+                ? `${f.location.kind}${f.location.name ? ` \`${cell(f.location.name)}\`` : ''}`
+                : '';
+            md.push(`| ${SEV_EMOJI[f.severity]} ${f.severity} | \`${cell(f.ruleId)}\` | ${cell(f.title)} | ${loc} |`);
+        }
+        md.push('');
+    }
+    else {
+        md.push('_No findings. This surface looks clean by the current ruleset._');
+        md.push('');
+    }
+    md.push(`<sub>Scanned with [MCP Trust Checker](https://github.com/illiahaidar/mcptrustchecker) ${report.tool.version} · digest \`${report.surfaceDigest.slice(0, 12)}…\`</sub>`);
+    return md.join('\n');
+}
+/**
+ * Make an untrusted string safe for inline Markdown prose (list items, code
+ * spans). Kills newlines/control (so it can't break out into a forged heading),
+ * neutralizes code spans and raw HTML, and escapes link brackets (so a
+ * `[approve](evil)` phishing link can't render). Tool names/descriptions reach
+ * these paths unfiltered, so this is a security boundary for PR-comment output.
+ */
+function mdInline(s) {
+    return String(s ?? '')
+        // eslint-disable-next-line no-control-regex
+        .replace(/[\u0000-\u001f\u007f-\u009f]+/g, ' ')
+        .replace(/`/g, '‘')
+        .replace(/[<>]/g, '')
+        .replace(/[[\]]/g, '\\$&')
+        .trim();
+}
+/** Make an untrusted string safe for a single Markdown table cell. */
+function cell(s) {
+    return String(s)
+        // eslint-disable-next-line no-control-regex
+        .replace(/[\u0000-\u001f\u007f-\u009f]+/g, ' ') // newlines & control chars break the row
+        .replace(/\|/g, '\\|')
+        .replace(/`/g, '‘')
+        .replace(/[<>]/g, '')
+        .replace(/[[\]]/g, '\\$&') // link brackets → no phishing link renders in a cell
+        .trim();
+}

package/dist/report/sarif.d.ts

@@ -0,0 +1,7 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * SARIF 2.1.0 output for GitHub code scanning ("Security" tab) and any SARIF
+ * consumer. Each unique rule becomes a reportingDescriptor; each finding a result.
+ */
+import type { ScanReport } from '../types.js';
+export declare function renderSarif(report: ScanReport): string;

package/dist/report/sarif.js

@@ -0,0 +1,105 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * SARIF 2.1.0 output for GitHub code scanning ("Security" tab) and any SARIF
+ * consumer. Each unique rule becomes a reportingDescriptor; each finding a result.
+ */
+import { TOOL_VERSION } from '../version.js';
+function level(sev) {
+    switch (sev) {
+        case 'critical':
+        case 'high':
+            return 'error';
+        case 'medium':
+            return 'warning';
+        case 'low':
+            return 'note';
+        case 'info':
+            return 'none';
+    }
+}
+function securitySeverity(sev) {
+    // GitHub uses a 0-10 scale to sort the Security tab.
+    switch (sev) {
+        case 'critical':
+            return '9.5';
+        case 'high':
+            return '8.0';
+        case 'medium':
+            return '5.0';
+        case 'low':
+            return '3.0';
+        case 'info':
+            return '0.0';
+    }
+}
+export function renderSarif(report) {
+    const rulesById = new Map();
+    for (const f of report.findings)
+        if (!rulesById.has(f.ruleId))
+            rulesById.set(f.ruleId, f);
+    const rules = [...rulesById.values()].map((f) => ({
+        id: f.ruleId,
+        name: f.ruleId,
+        shortDescription: { text: f.title },
+        fullDescription: { text: f.description.split('\n')[0] },
+        helpUri: f.references?.[0],
+        defaultConfiguration: { level: level(f.severity) },
+        properties: {
+            category: f.category,
+            'security-severity': securitySeverity(f.severity),
+            tags: ['security', 'mcp', f.category, ...(f.owasp ? [f.owasp] : [])],
+        },
+    }));
+    const results = report.findings.map((f) => ({
+        ruleId: f.ruleId,
+        level: level(f.severity),
+        message: {
+            text: `${f.title}. ${f.description.split('\n')[0]}` +
+                (f.evidence ? ` [evidence: ${f.evidence.slice(0, 120)}]` : '') +
+                (f.remediation ? ` Remediation: ${f.remediation}` : ''),
+        },
+        locations: [
+            {
+                logicalLocations: [
+                    {
+                        name: f.location?.name ?? report.target.id,
+                        kind: f.location?.kind ?? 'server',
+                        fullyQualifiedName: [report.target.id, f.location?.kind, f.location?.name, f.location?.field]
+                            .filter(Boolean)
+                            .join('/'),
+                    },
+                ],
+            },
+        ],
+        properties: {
+            confidence: f.confidence,
+            category: f.category,
+            owasp: f.owasp,
+        },
+    }));
+    const sarif = {
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'MCP Trust Checker',
+                        version: TOOL_VERSION,
+                        informationUri: 'https://github.com/illiahaidar/mcptrustchecker',
+                        rules,
+                    },
+                },
+                results,
+                properties: {
+                    trustScore: report.score.score,
+                    grade: report.score.grade,
+                    capabilityLevel: report.capabilityProfile.level,
+                    methodologyVersion: report.score.methodologyVersion,
+                    surfaceDigest: report.surfaceDigest,
+                },
+            },
+        ],
+    };
+    return JSON.stringify(sarif, null, 2);
+}

package/dist/report/terminal.d.ts

@@ -0,0 +1,15 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Human-facing terminal report. Zero-dependency ANSI, degrades to plain text
+ * when piped or under NO_COLOR.
+ */
+import type { ScanReport } from '../types.js';
+export declare function renderTerminal(report: ScanReport, opts?: {
+    details?: boolean;
+}): string;
+/**
+ * Strip control & escape sequences from attacker-controlled text before printing
+ * it. Tool metadata is untrusted; echoing its raw ANSI/OSC/control bytes would
+ * let a malicious server rewrite the terminal (consent phishing / title spoof).
+ */
+export declare function clean(s: unknown): string;

package/dist/report/terminal.js

@@ -0,0 +1,252 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Human-facing terminal report. Zero-dependency ANSI, degrades to plain text
+ * when piped or under NO_COLOR.
+ */
+import { c, padVisible } from '../util/ansi.js';
+import { ALL_CATEGORIES, isCapabilityRule } from '../scoring/model.js';
+const SEV_LABEL = {
+    critical: (s) => c.bold(c.red(s)),
+    high: (s) => c.red(s),
+    medium: (s) => c.yellow(s),
+    low: (s) => c.cyan(s),
+    info: (s) => c.gray(s),
+};
+const SEV_TAG = {
+    critical: 'CRIT',
+    high: 'HIGH',
+    medium: 'MED ',
+    low: 'LOW ',
+    info: 'INFO',
+};
+function gradeColor(grade, s) {
+    switch (grade) {
+        case 'A':
+            return c.bold(c.green(s));
+        case 'B':
+            return c.bold(c.green(s));
+        case 'C':
+            return c.bold(c.yellow(s));
+        case 'D':
+            return c.bold(c.yellow(s));
+        case 'F':
+            return c.bold(c.red(s));
+    }
+}
+function capColor(level, s) {
+    switch (level) {
+        case 'minimal':
+            return c.green(s);
+        case 'moderate':
+            return c.cyan(s);
+        case 'high':
+            return c.yellow(s);
+        case 'critical':
+            return c.bold(c.red(s));
+    }
+}
+/** Usable terminal width (clamped), for wrapping detailed descriptions. */
+const TERM = Math.max(64, Math.min(process.stdout.columns || 100, 118));
+function line(char = '─', width = Math.min(TERM, 72)) {
+    return c.gray(char.repeat(width));
+}
+/** Word-wrap a string to a width, preserving explicit newlines. */
+function wrap(text, width) {
+    const out = [];
+    for (const para of text.split('\n')) {
+        const words = para.replace(/\s+/g, ' ').trim().split(' ');
+        let cur = '';
+        for (const w of words) {
+            if (cur && (cur + ' ' + w).length > width) {
+                out.push(cur);
+                cur = w;
+            }
+            else {
+                cur = cur ? `${cur} ${w}` : w;
+            }
+        }
+        out.push(cur);
+    }
+    return out;
+}
+const LABEL_W = 9;
+/** A labeled, wrapped field with a hanging indent aligned under the text column. */
+function labeled(label, text, color) {
+    const head = `   ${c.gray(padVisible(label, LABEL_W))}`;
+    const cont = ' '.repeat(3 + LABEL_W);
+    const lines = wrap(text, TERM - 3 - LABEL_W);
+    return lines.map((ln, i) => (i === 0 ? head : cont) + color(ln)).join('\n');
+}
+export function renderTerminal(report, opts = {}) {
+    const out = [];
+    const { score } = report;
+    const threatFindings = report.findings.filter((f) => !isCapabilityRule(f.ruleId) && f.severity !== 'info');
+    const capabilityFindings = report.findings.filter((f) => isCapabilityRule(f.ruleId));
+    out.push('');
+    out.push(`${c.bold('MCP Trust Checker')} ${c.gray('· MCP security scan')}`);
+    out.push(line());
+    out.push(`${c.gray('Target ')} ${clean(report.target.id)}  ${c.gray(`(${report.target.source.kind})`)}`);
+    if (report.target.server?.name) {
+        out.push(`${c.gray('Server ')} ${clean(report.target.server.name)}${report.target.server.version ? ` v${clean(report.target.server.version)}` : ''}`);
+    }
+    out.push(`${c.gray('Surface')} ${report.stats.tools} tools · ${report.stats.prompts} prompts · ${report.stats.resources} resources`);
+    out.push('');
+    // Grade badge (TRUST) + capability level (BLAST RADIUS) — two axes.
+    const badge = `  GRADE  ${score.grade}  `;
+    const cap = report.capabilityProfile;
+    out.push(`   ${gradeColor(score.grade, `╭${'─'.repeat(badge.length)}╮`)}`);
+    out.push(`   ${gradeColor(score.grade, `│${badge}│`)}   ${c.bold(`Trust Score ${score.score}/100`)}   ${c.gray('(malice/negligence signals)')}`);
+    out.push(`   ${gradeColor(score.grade, `╰${'─'.repeat(badge.length)}╯`)}   ${capColor(cap.level, `Capability ${cap.level.toUpperCase()}`)}   ${c.gray('(blast radius)')}`);
+    if (cap.reasons.length) {
+        out.push(`   ${c.gray('methodology ' + score.methodologyVersion)} · ${c.gray(cap.reasons.slice(0, 2).join('; '))}`);
+    }
+    else {
+        out.push(`   ${c.gray('methodology ' + score.methodologyVersion)}`);
+    }
+    out.push('');
+    // Threat severity counts (what drives the grade) + capability count.
+    const tc = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const f of threatFindings)
+        tc[f.severity] += 1;
+    const counts = ['critical', 'high', 'medium', 'low']
+        .filter((s) => tc[s] > 0)
+        .map((s) => SEV_LABEL[s](`${tc[s]} ${s}`))
+        .join(c.gray(' · '));
+    out.push(`${c.gray('Threats   ')} ${counts || c.green('none')}`);
+    out.push(`${c.gray('Capability')} ${capColor(cap.level, cap.level)} ${c.gray(`(${capabilityFindings.length} observation${capabilityFindings.length === 1 ? '' : 's'})`)}`);
+    // Category penalties.
+    const cats = ALL_CATEGORIES.filter((cat) => score.categorySubtotals[cat] > 0);
+    if (cats.length) {
+        out.push('');
+        out.push(c.gray('Penalty by category'));
+        for (const cat of cats) {
+            const pts = score.categorySubtotals[cat];
+            out.push(`  ${padVisible(cat, 16)} ${c.red(`-${pts}`)}`);
+        }
+    }
+    // Gates.
+    if (score.gatesFired.length) {
+        out.push('');
+        out.push(c.gray('Hard gates'));
+        for (const g of score.gatesFired)
+            out.push(`  ${c.magenta('▸')} ${g}`);
+    }
+    // Toxic flows.
+    if (report.toxicFlows.length) {
+        out.push('');
+        out.push(`${c.bold('Toxic flows')} ${c.gray('(untrusted-input → sensitive-source → external-sink)')}`);
+        for (const f of report.toxicFlows) {
+            out.push(`  ${SEV_LABEL[f.severity](`[${f.severity}]`)} ${clean(f.description)}` +
+                (f.selfContained ? c.gray('  (single tool)') : ''));
+        }
+    }
+    // Integrity.
+    if (report.integrity) {
+        out.push('');
+        const st = report.integrity.status;
+        const label = st === 'drift'
+            ? c.bold(c.red('DRIFT — surface changed since pin'))
+            : st === 'unchanged'
+                ? c.green('unchanged (matches pin)')
+                : c.gray('first seen (not yet pinned)');
+        out.push(`${c.gray('Integrity')} ${label}`);
+        for (const ch of report.integrity.changes ?? [])
+            out.push(`  ${c.red('▸')} ${clean(ch.detail)}`);
+    }
+    // THREAT findings — drive the Trust grade. Detailed, most severe first.
+    if (report.findings.length) {
+        out.push('');
+        out.push(line());
+        out.push(`${c.bold('Threat findings')} ${c.gray('— affect the Trust grade (most severe first)')}`);
+        if (threatFindings.length === 0) {
+            out.push('');
+            out.push(`  ${c.green('none')} ${c.gray('— no malice/negligence signals detected')}`);
+        }
+        let lastSev = null;
+        for (const f of threatFindings) {
+            if (f.severity !== lastSev) {
+                out.push('');
+                out.push(c.gray(`── ${f.severity.toUpperCase()} ──`));
+                lastSev = f.severity;
+            }
+            out.push('');
+            out.push(renderFinding(f, opts.details ?? false));
+        }
+        // CAPABILITY observations — blast radius, NOT a verdict on trust.
+        if (capabilityFindings.length) {
+            out.push('');
+            out.push(line());
+            out.push(`${c.bold('Capability observations')} ${c.gray('— what this server can do; informational, not a trust verdict')}`);
+            if (opts.details) {
+                let last = null;
+                for (const f of capabilityFindings) {
+                    if (f.severity !== last) {
+                        out.push('');
+                        out.push(c.gray(`── ${f.severity.toUpperCase()} ──`));
+                        last = f.severity;
+                    }
+                    out.push('');
+                    out.push(renderFinding(f, true));
+                }
+            }
+            else {
+                out.push('');
+                for (const f of capabilityFindings) {
+                    out.push(`  ${SEV_LABEL[f.severity](`[${SEV_TAG[f.severity].trim()}]`)} ${c.gray(f.ruleId)}  ${clean(f.title)}`);
+                }
+                out.push('');
+                out.push(c.gray('   (run with --details for the full description of each)'));
+            }
+        }
+    }
+    else {
+        out.push('');
+        out.push(c.green('No findings. This surface looks clean by the current ruleset.'));
+    }
+    out.push('');
+    out.push(line());
+    out.push(c.gray(`${report.findings.length} finding(s) · digest ${report.surfaceDigest.slice(0, 12)}… · ` +
+        `${report.tool.name} ${report.tool.version}`));
+    out.push('');
+    return out.join('\n');
+}
+function locationString(f) {
+    if (!f.location)
+        return undefined;
+    const l = f.location;
+    return `${l.kind}${l.name ? ` "${l.name}"` : ''}${l.field ? ` → ${l.field}` : ''}`;
+}
+/**
+ * Strip control & escape sequences from attacker-controlled text before printing
+ * it. Tool metadata is untrusted; echoing its raw ANSI/OSC/control bytes would
+ * let a malicious server rewrite the terminal (consent phishing / title spoof).
+ */
+export function clean(s) {
+    // eslint-disable-next-line no-control-regex
+    return String(s ?? '').replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ');
+}
+function renderFinding(f, details) {
+    const lines = [];
+    // Header: [SEV · confidence]  RULE-ID  Title
+    lines.push(`${SEV_LABEL[f.severity](`[${SEV_TAG[f.severity].trim()} · ${f.confidence}]`)}  ` +
+        `${c.gray(f.ruleId)}  ${c.bold(clean(f.title))}`);
+    const loc = locationString(f);
+    if (loc)
+        lines.push(labeled('where', clean(loc), c.gray));
+    // Full (wrapped) description — the "more detail" the report is about.
+    lines.push(labeled('what', clean(f.description), c.white));
+    if (f.evidence)
+        lines.push(labeled('evidence', clean(details ? f.evidence : truncate(f.evidence, 200)), c.yellow));
+    if (f.remediation)
+        lines.push(labeled('fix', clean(f.remediation), c.green));
+    const maps = [f.owasp, `category: ${f.category}`].filter(Boolean).join(' · ');
+    if (maps)
+        lines.push(labeled('maps', maps, c.gray));
+    if (details && f.references?.length)
+        lines.push(labeled('refs', f.references.join('  '), c.blue));
+    return lines.join('\n');
+}
+function truncate(s, n) {
+    const flat = String(s).replace(/\s+/g, ' ').trim();
+    return flat.length > n ? `${flat.slice(0, n)}…` : flat;
+}

package/dist/scoring/capability.d.ts

@@ -0,0 +1,10 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Capability (blast-radius) rating — the second axis, independent of the trust
+ * grade. It answers "how much could this server do if the model driving it were
+ * prompt-injected?" A legitimate, well-behaved server can still be high- or
+ * critical-capability; that is not a mark against its trustworthiness, it is
+ * information for deciding how much access to grant.
+ */
+import type { CapabilityProfile, ToolCapability, ToxicFlow } from '../types.js';
+export declare function computeCapabilityProfile(capabilities: ToolCapability[], flows: ToxicFlow[]): CapabilityProfile;

package/dist/scoring/capability.js

@@ -0,0 +1,48 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Capability (blast-radius) rating — the second axis, independent of the trust
+ * grade. It answers "how much could this server do if the model driving it were
+ * prompt-injected?" A legitimate, well-behaved server can still be high- or
+ * critical-capability; that is not a mark against its trustworthiness, it is
+ * information for deciding how much access to grant.
+ */
+const ORDER = ['minimal', 'moderate', 'high', 'critical'];
+function atLeast(current, candidate) {
+    return ORDER.indexOf(candidate) > ORDER.indexOf(current) ? candidate : current;
+}
+export function computeCapabilityProfile(capabilities, flows) {
+    const tagSet = new Set(capabilities.flatMap((c) => c.tags));
+    const has = (t) => tagSet.has(t);
+    const reasons = [];
+    let level = 'minimal';
+    const bump = (candidate, reason) => {
+        level = atLeast(level, candidate);
+        reasons.push(reason);
+    };
+    if (has('untrusted-input'))
+        bump('moderate', 'ingests untrusted external content (a prompt-injection entry point)');
+    if (has('external-sink'))
+        bump('moderate', 'can send data / act on an external service');
+    if (has('file-write'))
+        bump('moderate', 'can create, modify or delete files');
+    if (has('sensitive-source'))
+        bump('moderate', 'reads sensitive or local data');
+    if (has('sensitive-source') && (has('external-sink') || has('code-exec'))) {
+        bump('high', 'has a read → egress path (a data-exfiltration surface)');
+    }
+    if (has('code-exec'))
+        bump('high', 'can execute shell commands or code');
+    const roleComplete = (f) => f.untrustedInput.length > 0 && f.sensitiveSource.length > 0 && f.externalSink.length > 0;
+    const selfContained = flows.some((f) => f.selfContained && roleComplete(f));
+    const crossTrifecta = flows.some((f) => !f.selfContained && roleComplete(f));
+    if (crossTrifecta)
+        bump('high', 'untrusted-input, sensitive-source and egress co-exist across tools (toxic-flow surface)');
+    if (selfContained)
+        bump('critical', 'a single tool completes the exfiltration trifecta by itself');
+    if (has('code-exec') && has('untrusted-input'))
+        bump('critical', 'untrusted input can reach code execution');
+    // De-duplicate reasons while preserving order.
+    const seen = new Set();
+    const uniqueReasons = reasons.filter((r) => (seen.has(r) ? false : (seen.add(r), true)));
+    return { level, reasons: uniqueReasons, tags: [...tagSet] };
+}

package/dist/scoring/index.d.ts

@@ -0,0 +1,10 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Deterministic scorer. Turns a set of findings into an auditable Trust Score:
+ * additive penalties from 100, diminishing returns per rule, per-category caps,
+ * then weakest-link hard gates. Same methodology version + same findings ⇒
+ * identical score, and every point is reconstructable from `vector`.
+ */
+import type { Finding, Score } from '../types.js';
+/** Compute the Trust Score for a set of findings (capability rules excluded). */
+export declare function computeScore(findings: Finding[]): Score;