teppi-check 0.1.0 → 0.2.1

package/README.md

@@ -4,6 +4,7 @@ Send one unpaid request to any paid endpoint and see what it actually advertises
 
 ```bash
 npx teppi-check https://some-seller.example/v1/extract
+npx teppi-check --mcp https://mcp.some-seller.example/mcp
 ```
 
 No install and no dependencies: the published package is a single bundled file, so the validator
@@ -70,9 +71,32 @@ takes a purchase, which the full prober does on a schedule.
 Terms are read from the `payment-required` header (base64 or plain JSON) or from the response
 body, because deployed servers use both.
 
+## Remote MCP servers
+
+`--mcp` runs the handshake instead: `initialize`, the initialized notification, then `tools/list`
+over Streamable HTTP.
+
+| Check | Fails when |
+|---|---|
+| server answered | connection refused, timeout, or a server that never replies |
+| named a protocol version | it never got that far |
+| named itself | it never got that far |
+| listed its tools | it never got that far |
+| every tool declared an input schema | a tool an agent would have to guess the arguments for |
+| every tool said what it does | a tool with no description |
+| tool list digest | never, it prints the digest so you can compare it against a record |
+
+A server asking for credentials or for payment is reported as such and does **not** fail: that is
+what a private or paid server is entitled to say. Only a server that did not answer fails.
+
+The digest is a sha256 over each tool's name, description and whether it declared an input
+schema, sorted by name. Reordering the list does not change it and rewording a description does,
+which is what makes it useful for noticing that a server's instructions changed under you.
+
 ## Options
 
 ```
+  --mcp                handshake a remote mcp server instead of an x402 endpoint
   --method <verb>      default POST
   --body <json|@file>  default {}
   --json               machine readable output

package/npm/cli.js

@@ -4609,7 +4609,7 @@ var require_core = __commonJS({
       errorsText(errors = this.errors, { separator = ", ", dataVar = "data" } = {}) {
         if (!errors || errors.length === 0)
           return "No errors";
-        return errors.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text, msg) => text + separator + msg);
+        return errors.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text2, msg) => text2 + separator + msg);
       }
       $dataMetaSchema(metaSchema, keywordsJsonPointers) {
         const rules = this.RULES.all;
@@ -6871,32 +6871,382 @@ import { readFileSync } from "node:fs";
 import { argv, env, exit, stdout } from "node:process";
 import { parseArgs } from "node:util";
 
-// src/probe.ts
+// src/mcp.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// ../mcp-probe/src/frame.ts
+var JSON_RPC = "2.0";
+var PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26"];
+var PREFERRED_VERSION = PROTOCOL_VERSIONS[0];
+function request(id, method, params) {
+  return JSON.stringify({ jsonrpc: JSON_RPC, id, method, ...params ? { params } : {} });
+}
+function notification(method) {
+  return JSON.stringify({ jsonrpc: JSON_RPC, method });
+}
+function lastEventData(body) {
+  const payloads = body.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trim()).filter((line) => line.length > 0);
+  return payloads.length === 0 ? null : payloads[payloads.length - 1];
+}
+function readOne(text2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch {
+    return { kind: "unreadable", why: "the answer is not json" };
+  }
+  const one = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (typeof one !== "object" || one === null) {
+    return { kind: "unreadable", why: "the answer is not a json rpc object" };
+  }
+  const message = one;
+  if (message.error !== void 0) {
+    const error = message.error;
+    return {
+      kind: "error",
+      code: typeof error.code === "number" ? error.code : 0,
+      message: typeof error.message === "string" ? error.message : "no message"
+    };
+  }
+  if (typeof message.result !== "object" || message.result === null) {
+    return { kind: "unreadable", why: "the answer carries neither a result nor an error" };
+  }
+  return { kind: "result", value: message.result };
+}
+function readAnswer(contentType, body) {
+  const streamed = (contentType ?? "").toLowerCase().includes("text/event-stream");
+  if (!streamed) return readOne(body);
+  const data = lastEventData(body);
+  return data === null ? { kind: "unreadable", why: "the stream carried no data line" } : readOne(data);
+}
+
+// ../mcp-probe/src/probe.ts
 import { createHash } from "node:crypto";
+var HANDSHAKE_TIMEOUT_MS = 2e4;
+var CLIENT = { name: "teppi-probe", version: "0.1.0" };
+function initFor(body, sessionId, userAgent) {
+  return {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+      "mcp-protocol-version": PREFERRED_VERSION,
+      "user-agent": userAgent,
+      ...sessionId === null ? {} : { "mcp-session-id": sessionId }
+    },
+    body
+  };
+}
+var INITIALIZE = {
+  protocolVersion: PREFERRED_VERSION,
+  capabilities: {},
+  clientInfo: CLIENT
+};
+var text = (value) => typeof value === "string" ? value : null;
+function toolsFrom(result) {
+  const raw = result.tools;
+  if (!Array.isArray(raw)) return [];
+  return raw.flatMap((value) => {
+    if (typeof value !== "object" || value === null) return [];
+    const tool = value;
+    const name = text(tool.name);
+    if (name === null) return [];
+    return [
+      {
+        name,
+        description: text(tool.description),
+        inputSchema: tool.inputSchema ?? null,
+        outputSchema: tool.outputSchema ?? null
+      }
+    ];
+  });
+}
+function reachFor(status) {
+  if (status === 401 || status === 403) return "auth_required";
+  if (status === 402) return "payment_required";
+  if (status >= 500 || status === 404 || status === 410) return "dead";
+  if (status >= 400) return "error";
+  return null;
+}
+async function turn(response, method) {
+  const refused = reachFor(response.status);
+  if (refused !== null) return { kind: "refused", reach: refused, status: response.status };
+  const answer = readAnswer(response.headers.get("content-type"), await response.text());
+  if (answer.kind === "result") {
+    return { kind: "read", status: response.status, value: answer.value };
+  }
+  return {
+    kind: "broken",
+    status: response.status,
+    note: answer.kind === "error" ? `${method}: ${answer.message}` : answer.why
+  };
+}
+var DEADLINE_MS = 45e3;
+var MAX_PAGES = 20;
+var MAX_TOOLS = 2e3;
+async function probeMcp(url, options = {}) {
+  const clockFor = options.now ?? Date.now;
+  const startedFor = clockFor();
+  let timer;
+  const gaveUp = new Promise((resolve) => {
+    timer = setTimeout(
+      () => resolve({
+        url,
+        observedAt: new Date(startedFor).toISOString(),
+        reach: "dead",
+        httpStatus: null,
+        handshakeMs: options.deadlineMs ?? DEADLINE_MS,
+        protocolVersion: null,
+        serverName: null,
+        serverVersion: null,
+        instructions: null,
+        tools: null,
+        pages: null,
+        truncated: false,
+        note: "never answered and never gave up"
+      }),
+      options.deadlineMs ?? DEADLINE_MS
+    );
+  });
+  try {
+    return await Promise.race([handshake(url, options), gaveUp]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function walkTools(send, session) {
+  const tools = [];
+  let cursor = null;
+  let pages = 0;
+  let status = 200;
+  for (; ; ) {
+    const asked = request(2 + pages, "tools/list", cursor === null ? void 0 : { cursor });
+    const listed = await turn(await send(asked, session), "tools/list");
+    if (listed.kind === "refused") {
+      return {
+        kind: "refused",
+        reach: listed.reach,
+        status: listed.status,
+        note: "it opened but would not list"
+      };
+    }
+    if (listed.kind === "broken")
+      return { kind: "broken", status: listed.status, note: listed.note };
+    tools.push(...toolsFrom(listed.value));
+    status = listed.status;
+    pages += 1;
+    const next = text(listed.value.nextCursor);
+    if (next === null || next === cursor)
+      return { kind: "listed", status, tools, pages, truncated: false };
+    if (pages >= MAX_PAGES || tools.length >= MAX_TOOLS) {
+      return { kind: "listed", status, tools, pages, truncated: true };
+    }
+    cursor = next;
+  }
+}
+async function handshake(url, options) {
+  const doFetch = options.fetchImpl ?? fetch;
+  const clock = options.now ?? Date.now;
+  const userAgent = options.userAgent ?? `${CLIENT.name}/${CLIENT.version}`;
+  const startedAt = clock();
+  const base = {
+    url,
+    observedAt: new Date(startedAt).toISOString(),
+    protocolVersion: null,
+    serverName: null,
+    serverVersion: null,
+    instructions: null,
+    tools: null,
+    pages: null,
+    truncated: false
+  };
+  const send = (body, sessionId) => doFetch(url, {
+    ...initFor(body, sessionId, userAgent),
+    signal: AbortSignal.timeout(options.timeoutMs ?? HANDSHAKE_TIMEOUT_MS)
+  });
+  const took = () => Math.max(0, clock() - startedAt);
+  try {
+    const opened = await send(request(1, "initialize", INITIALIZE), null);
+    const hello = await turn(opened, "initialize");
+    if (hello.kind === "refused") {
+      return {
+        ...base,
+        reach: hello.reach,
+        httpStatus: hello.status,
+        handshakeMs: took(),
+        note: null
+      };
+    }
+    if (hello.kind === "broken") {
+      return {
+        ...base,
+        reach: "error",
+        httpStatus: hello.status,
+        handshakeMs: took(),
+        note: hello.note
+      };
+    }
+    const info = hello.value.serverInfo ?? {};
+    const session = opened.headers.get("mcp-session-id");
+    const said = {
+      ...base,
+      protocolVersion: text(hello.value.protocolVersion),
+      serverName: text(info.name),
+      serverVersion: text(info.version),
+      instructions: text(hello.value.instructions)
+    };
+    await send(notification("notifications/initialized"), session).catch(() => void 0);
+    const walked = await walkTools(send, session);
+    if (walked.kind !== "listed") {
+      return {
+        ...said,
+        reach: walked.kind === "refused" ? walked.reach : "error",
+        httpStatus: walked.status,
+        handshakeMs: took(),
+        note: walked.note
+      };
+    }
+    return {
+      ...said,
+      reach: "readable",
+      httpStatus: walked.status,
+      handshakeMs: took(),
+      tools: walked.tools,
+      pages: walked.pages,
+      truncated: walked.truncated,
+      note: null
+    };
+  } catch (err) {
+    const name = err.name;
+    return {
+      ...base,
+      reach: "dead",
+      httpStatus: null,
+      handshakeMs: took(),
+      note: name === "TimeoutError" || name === "AbortError" ? "timed out" : "unreachable"
+    };
+  }
+}
+function toolsDigest(tools) {
+  const canonical = JSON.stringify(
+    [...tools].map((t) => [t.name, t.description ?? "", t.inputSchema !== null]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0)
+  );
+  return createHash("sha256").update(canonical).digest("hex");
+}
+
+// src/mcp.ts
+function sha256(input) {
+  return `sha256:${createHash2("sha256").update(input).digest("hex")}`;
+}
+var pass = (id, label, detail) => detail === void 0 ? { id, label, status: "pass" } : { id, label, status: "pass", detail };
+var fail = (id, label, detail) => ({
+  id,
+  label,
+  status: "fail",
+  detail
+});
+var skip = (id, label, detail) => ({
+  id,
+  label,
+  status: "skip",
+  detail
+});
+var REACH_LABEL = {
+  readable: "listed its tools",
+  auth_required: "asked for credentials",
+  payment_required: "asked for payment",
+  dead: "did not answer",
+  error: "answered with something else"
+};
+function checksFor(seen) {
+  const checks = [];
+  checks.push(
+    seen.reach === "dead" ? fail("reachable", "server answered", seen.note ?? "no answer") : pass("reachable", "server answered", REACH_LABEL[seen.reach])
+  );
+  if (seen.reach === "dead") return checks;
+  checks.push(
+    seen.protocolVersion === null ? skip("protocol", "named a protocol version", "it never got as far as saying") : pass("protocol", "named a protocol version", seen.protocolVersion)
+  );
+  checks.push(
+    seen.serverName === null ? skip("identity", "named itself", "it never got as far as saying") : pass(
+      "identity",
+      "named itself",
+      `${seen.serverName}${seen.serverVersion === null ? "" : ` ${seen.serverVersion}`}`
+    )
+  );
+  if (seen.tools === null) {
+    checks.push(skip("tools", "listed its tools", REACH_LABEL[seen.reach]));
+    return checks;
+  }
+  checks.push(pass("tools", "listed its tools", `${seen.tools.length} tool(s)`));
+  const bare = seen.tools.filter((t) => t.inputSchema === null).map((t) => t.name);
+  checks.push(
+    bare.length === 0 ? pass("input-schemas", "every tool declared an input schema") : fail(
+      "input-schemas",
+      "every tool declared an input schema",
+      `${bare.length} without one: ${bare.slice(0, 5).join(", ")}`
+    )
+  );
+  const unnamed = seen.tools.filter((t) => t.description === null).map((t) => t.name);
+  checks.push(
+    unnamed.length === 0 ? pass("descriptions", "every tool said what it does") : fail(
+      "descriptions",
+      "every tool said what it does",
+      `${unnamed.length} without one: ${unnamed.slice(0, 5).join(", ")}`
+    )
+  );
+  checks.push(pass("digest", "tool list digest", toolsDigest(seen.tools)));
+  return checks;
+}
+async function probeMcpEndpoint(options) {
+  const seen = await probeMcp(options.url, {
+    ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
+    ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+    ...options.userAgent === void 0 ? {} : { userAgent: options.userAgent }
+  });
+  const checks = checksFor(seen);
+  return {
+    url: options.url,
+    method: "MCP",
+    observedAt: seen.observedAt,
+    reachable: seen.reach !== "dead",
+    httpStatus: seen.httpStatus,
+    handshakeMs: seen.handshakeMs,
+    termsSource: seen.reach === "payment_required" ? "mcp 402" : "none",
+    advertised: [],
+    requestHash: sha256(`MCP ${options.url}`),
+    responseHash: seen.tools === null ? null : `sha256:${toolsDigest(seen.tools)}`,
+    checks,
+    verdict: checks.some((c) => c.status === "fail") ? "fail" : "pass"
+  };
+}
+
+// src/probe.ts
+import { createHash as createHash3 } from "node:crypto";
 
 // ../x402/src/handshake.ts
-var HANDSHAKE_TIMEOUT_MS = 3e4;
+var HANDSHAKE_TIMEOUT_MS2 = 3e4;
 var sendsBody = (method) => method !== "GET" && method !== "HEAD";
-function handshakeInit(request) {
-  const carries = sendsBody(request.method);
+function handshakeInit(request2) {
+  const carries = sendsBody(request2.method);
   const headers = { accept: "application/json" };
   if (carries) headers["content-type"] = "application/json";
-  if (request.userAgent !== void 0) headers["user-agent"] = request.userAgent;
-  if (request.payment) headers[request.payment.header] = request.payment.value;
+  if (request2.userAgent !== void 0) headers["user-agent"] = request2.userAgent;
+  if (request2.payment) headers[request2.payment.header] = request2.payment.value;
   return {
-    method: request.method,
+    method: request2.method,
     headers,
-    ...carries ? { body: JSON.stringify(request.input ?? {}) } : {},
-    signal: AbortSignal.timeout(request.timeoutMs ?? HANDSHAKE_TIMEOUT_MS)
+    ...carries ? { body: JSON.stringify(request2.input ?? {}) } : {},
+    signal: AbortSignal.timeout(request2.timeoutMs ?? HANDSHAKE_TIMEOUT_MS2)
   };
 }
-async function handshake(request, deps = {}) {
+async function handshake2(request2, deps = {}) {
   const doFetch = deps.fetchImpl ?? fetch;
   const now = deps.now ?? Date.now;
   const started = now();
   const since = () => Math.max(0, now() - started);
   try {
-    const response = await doFetch(request.url, handshakeInit(request));
+    const response = await doFetch(request2.url, handshakeInit(request2));
     return { ok: true, response, body: await response.text(), latencyMs: since() };
   } catch (err) {
     return { ok: false, reason: err.message, latencyMs: since() };
@@ -6974,24 +7324,24 @@ var ajv = new import_ajv.Ajv({
   validateSchema: true,
   validateFormats: false
 });
-function pass(id, label, detail) {
+function pass2(id, label, detail) {
   return detail === void 0 ? { id, label, status: "pass" } : { id, label, status: "pass", detail };
 }
-function fail(id, label, detail) {
+function fail2(id, label, detail) {
   return { id, label, status: "fail", detail };
 }
 function schemaCheck(id, label, schema) {
   if (schema === null || schema === void 0) {
-    return fail(id, label, "not declared, so no response can ever be checked against it");
+    return fail2(id, label, "not declared, so no response can ever be checked against it");
   }
   if (typeof schema !== "object") {
-    return fail(id, label, `declared as ${typeof schema}, not an object`);
+    return fail2(id, label, `declared as ${typeof schema}, not an object`);
   }
   try {
     ajv.compile(schema);
-    return pass(id, label);
+    return pass2(id, label);
   } catch (err) {
-    return fail(id, label, `declared but invalid: ${err.message.split("\n")[0]}`);
+    return fail2(id, label, `declared but invalid: ${err.message.split("\n")[0]}`);
   }
 }
 function requirementChecks(terms) {
@@ -6999,7 +7349,7 @@ function requirementChecks(terms) {
   const report = (id, label, has) => {
     const gaps = terms.accepts.map((r, i) => has(r) ? -1 : i).filter((i) => i >= 0);
     out.push(
-      gaps.length === 0 ? pass(id, label) : fail(id, label, `absent from accepts[${gaps.join("], accepts[")}]`)
+      gaps.length === 0 ? pass2(id, label) : fail2(id, label, `absent from accepts[${gaps.join("], accepts[")}]`)
     );
   };
   report("price_declared", "price is stated", (r) => priceOf(r) !== null);
@@ -7016,29 +7366,29 @@ function requirementChecks(terms) {
   return out;
 }
 function runHandshakeChecks(input) {
-  const checks = [pass("reachable", "endpoint answered")];
+  const checks = [pass2("reachable", "endpoint answered")];
   checks.push(
-    input.status === 402 ? pass("status_402", "asks for payment") : fail("status_402", "asks for payment", `returned ${input.status}, not 402`)
+    input.status === 402 ? pass2("status_402", "asks for payment") : fail2("status_402", "asks for payment", `returned ${input.status}, not 402`)
   );
   if (input.terms === null) {
     checks.push(
-      fail("terms_parseable", "payment terms parse", input.parseError ?? "no terms found")
+      fail2("terms_parseable", "payment terms parse", input.parseError ?? "no terms found")
     );
     return checks;
   }
-  checks.push(pass("terms_parseable", "payment terms parse", `read from the ${input.source}`));
+  checks.push(pass2("terms_parseable", "payment terms parse", `read from the ${input.source}`));
   checks.push(
-    input.terms.accepts.length > 0 ? pass(
+    input.terms.accepts.length > 0 ? pass2(
       "accepts_present",
       "offers at least one way to pay",
       `${input.terms.accepts.length} option(s)`
-    ) : fail("accepts_present", "offers at least one way to pay", "accepts is empty")
+    ) : fail2("accepts_present", "offers at least one way to pay", "accepts is empty")
   );
   if (input.terms.accepts.length === 0) return checks;
   checks.push(...requirementChecks(input.terms));
   const cache = input.headers.get("cache-control") ?? "";
   checks.push(
-    /no-store|no-cache/i.test(cache) ? pass("not_cacheable", "payment terms are not cached") : fail(
+    /no-store|no-cache/i.test(cache) ? pass2("not_cacheable", "payment terms are not cached") : fail2(
       "not_cacheable",
       "payment terms are not cached",
       cache === "" ? "no cache-control, so a proxy may serve stale terms" : `cache-control: ${cache}`
@@ -7047,15 +7397,15 @@ function runHandshakeChecks(input) {
   return checks;
 }
 function unreachable(reason) {
-  return [fail("reachable", "endpoint answered", reason)];
+  return [fail2("reachable", "endpoint answered", reason)];
 }
 function verdictOf(checks) {
   return checks.some((c) => c.status === "fail") ? "fail" : "pass";
 }
 
 // src/probe.ts
-function sha256(input) {
-  return `sha256:${createHash("sha256").update(input).digest("hex")}`;
+function sha2562(input) {
+  return `sha256:${createHash3("sha256").update(input).digest("hex")}`;
 }
 function advertisedFrom(terms) {
   if (!terms) return [];
@@ -7071,7 +7421,7 @@ async function probe(options) {
   const body = options.body ?? "{}";
   const doFetch = options.fetchImpl ?? fetch;
   const observedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const requestHash = sha256(`${method} ${options.url}
+  const requestHash = sha2562(`${method} ${options.url}
 ${body}`);
   const base = {
     url: options.url,
@@ -7081,7 +7431,7 @@ ${body}`);
     termsSource: "none",
     advertised: []
   };
-  const answer = await handshake(
+  const answer = await handshake2(
     {
       url: options.url,
       method,
@@ -7102,9 +7452,9 @@ ${body}`);
       verdict: "fail"
     };
   }
-  const { response, body: text } = answer;
+  const { response, body: text2 } = answer;
   const handshakeMs = answer.latencyMs;
-  const parsed = parseTerms(response.headers, text);
+  const parsed = parseTerms(response.headers, text2);
   const checks = runHandshakeChecks({
     status: response.status,
     headers: response.headers,
@@ -7119,11 +7469,24 @@ ${body}`);
     handshakeMs,
     termsSource: parsed.source,
     advertised: advertisedFrom(parsed.terms),
-    responseHash: sha256(text),
+    responseHash: sha2562(text2),
     checks,
     verdict: verdictOf(checks)
   };
 }
+function askedForPayment(result) {
+  return result.checks.some((c) => c.id === "status_402" && c.status === "pass");
+}
+async function probeEitherVerb(run, explicit) {
+  const verbs = explicit === void 0 ? ["GET", "POST"] : [explicit.toUpperCase()];
+  let first;
+  for (const method of verbs) {
+    const attempt = await run(method);
+    if (askedForPayment(attempt)) return attempt;
+    first ??= attempt;
+  }
+  return first;
+}
 
 // src/report.ts
 var ANSI = {
@@ -7139,8 +7502,8 @@ function shouldColour(env2, isTty) {
   if (env2.FORCE_COLOR !== void 0 && env2.FORCE_COLOR !== "0") return true;
   return isTty;
 }
-function paint(colour, text, on) {
-  return on ? `${ANSI[colour]}${text}${ANSI.reset}` : text;
+function paint(colour, text2, on) {
+  return on ? `${ANSI[colour]}${text2}${ANSI.reset}` : text2;
 }
 var MARK = { pass: "ok", fail: "fail", skip: "skip" };
 var COLOUR = { pass: "green", fail: "red", skip: "yellow" };
@@ -7192,7 +7555,8 @@ var USAGE = `
   Sends one unpaid request and reports what the endpoint advertises, in the
   same form the public record uses.
 
-    --method <verb>     default POST
+    --mcp               handshake a remote mcp server instead of an x402 endpoint
+    --method <verb>     tries get then post when not given
     --body <json|@file> default {}
     --json              machine readable output
     --timeout <ms>      default 15000
@@ -7200,11 +7564,26 @@ var USAGE = `
 
   Exit codes: 0 every check passed, 1 a check failed, 2 could not be reached.
 `;
+function refuseUnlessUsable(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    stdout.write(`not a url: ${url}
+`);
+    exit(2);
+  }
+  if (parsed.protocol !== "https:" && parsed.hostname !== "localhost") {
+    stdout.write("refusing to send a request over plain http\n");
+    exit(2);
+  }
+}
 async function main() {
   const { values, positionals } = parseArgs({
     args: argv.slice(2),
     allowPositionals: true,
     options: {
+      mcp: { type: "boolean", default: false },
       method: { type: "string" },
       body: { type: "string" },
       json: { type: "boolean", default: false },
@@ -7219,33 +7598,25 @@ async function main() {
 `);
     exit(values.help ? 0 : 2);
   }
-  let parsedUrl;
-  try {
-    parsedUrl = new URL(url);
-  } catch {
-    stdout.write(`not a url: ${url}
-`);
-    exit(2);
-  }
-  if (parsedUrl.protocol !== "https:" && parsedUrl.hostname !== "localhost") {
-    stdout.write("refusing to send a request over plain http\n");
-    exit(2);
-  }
-  const rawBody = values.body ?? "{}";
-  const body = rawBody.startsWith("@") ? readFileSync(rawBody.slice(1), "utf8") : rawBody;
-  const result = await probe({
+  refuseUnlessUsable(url);
+  const shared = {
     url,
-    method: values.method?.toUpperCase() ?? "POST",
-    body,
     ...values.timeout ? { timeoutMs: Number(values.timeout) } : {},
     ...values["user-agent"] ? { userAgent: values["user-agent"] } : {}
-  });
+  };
+  const rawBody = values.body ?? "{}";
+  const body = rawBody.startsWith("@") ? readFileSync(rawBody.slice(1), "utf8") : rawBody;
+  const found = await probeEitherVerb(
+    (method) => probe({ ...shared, method, body }),
+    values.method
+  );
+  const out = values.mcp ? await probeMcpEndpoint(shared) : found;
   stdout.write(
-    values.json ? `${formatJson(result)}
-` : formatText(result, shouldColour(env, stdout.isTTY === true))
+    values.json ? `${formatJson(out)}
+` : formatText(out, shouldColour(env, stdout.isTTY === true))
   );
-  if (!result.reachable) exit(2);
-  exit(result.verdict === "pass" ? 0 : 1);
+  if (!out.reachable) exit(2);
+  exit(out.verdict === "pass" ? 0 : 1);
 }
 main().catch((err) => {
   stdout.write(`${err.message}

package/npm/index.d.ts

@@ -1,5 +1,6 @@
 export { type PaymentRequirement, type PaymentTerms, parseTerms, priceOf, schemasOf, } from './terms.js';
-export { type Check, type CheckStatus, runHandshakeChecks, schemaCheck, verdictOf, } from './checks.ts';
-export { DEFAULT_USER_AGENT, type ProbeOptions, type ProbeResult, probe } from './probe.ts';
-export { formatJson, formatText, shouldColour } from './report.ts';
+export { type Check, type CheckStatus, runHandshakeChecks, schemaCheck, verdictOf, } from './checks.js';
+export { checksFor, type McpProbeOptions, probeMcpEndpoint, REACH_LABEL, } from './mcp.js';
+export { DEFAULT_USER_AGENT, type ProbeOptions, type ProbeResult, probe } from './probe.js';
+export { formatJson, formatText, shouldColour } from './report.js';
 //# sourceMappingURL=index.d.ts.map

package/npm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,UAAU,EACV,OAAO,EACP,SAAS,GACT,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,kBAAkB,EAClB,WAAW,EACX,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,UAAU,EACV,OAAO,EACP,SAAS,GACT,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,kBAAkB,EAClB,WAAW,EACX,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,SAAS,EACT,KAAK,eAAe,EACpB,gBAAgB,EAChB,WAAW,GACX,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/npm/index.js

@@ -4608,7 +4608,7 @@ var require_core = __commonJS({
       errorsText(errors = this.errors, { separator = ", ", dataVar = "data" } = {}) {
         if (!errors || errors.length === 0)
           return "No errors";
-        return errors.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text, msg) => text + separator + msg);
+        return errors.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text2, msg) => text2 + separator + msg);
       }
       $dataMetaSchema(metaSchema, keywordsJsonPointers) {
         const rules = this.RULES.all;
@@ -7015,32 +7015,382 @@ function verdictOf(checks) {
   return checks.some((c) => c.status === "fail") ? "fail" : "pass";
 }
 
-// src/probe.ts
+// src/mcp.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// ../mcp-probe/src/frame.ts
+var JSON_RPC = "2.0";
+var PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26"];
+var PREFERRED_VERSION = PROTOCOL_VERSIONS[0];
+function request(id, method, params) {
+  return JSON.stringify({ jsonrpc: JSON_RPC, id, method, ...params ? { params } : {} });
+}
+function notification(method) {
+  return JSON.stringify({ jsonrpc: JSON_RPC, method });
+}
+function lastEventData(body) {
+  const payloads = body.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trim()).filter((line) => line.length > 0);
+  return payloads.length === 0 ? null : payloads[payloads.length - 1];
+}
+function readOne(text2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch {
+    return { kind: "unreadable", why: "the answer is not json" };
+  }
+  const one = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (typeof one !== "object" || one === null) {
+    return { kind: "unreadable", why: "the answer is not a json rpc object" };
+  }
+  const message = one;
+  if (message.error !== void 0) {
+    const error = message.error;
+    return {
+      kind: "error",
+      code: typeof error.code === "number" ? error.code : 0,
+      message: typeof error.message === "string" ? error.message : "no message"
+    };
+  }
+  if (typeof message.result !== "object" || message.result === null) {
+    return { kind: "unreadable", why: "the answer carries neither a result nor an error" };
+  }
+  return { kind: "result", value: message.result };
+}
+function readAnswer(contentType, body) {
+  const streamed = (contentType ?? "").toLowerCase().includes("text/event-stream");
+  if (!streamed) return readOne(body);
+  const data = lastEventData(body);
+  return data === null ? { kind: "unreadable", why: "the stream carried no data line" } : readOne(data);
+}
+
+// ../mcp-probe/src/probe.ts
 import { createHash } from "node:crypto";
+var HANDSHAKE_TIMEOUT_MS = 2e4;
+var CLIENT = { name: "teppi-probe", version: "0.1.0" };
+function initFor(body, sessionId, userAgent) {
+  return {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+      "mcp-protocol-version": PREFERRED_VERSION,
+      "user-agent": userAgent,
+      ...sessionId === null ? {} : { "mcp-session-id": sessionId }
+    },
+    body
+  };
+}
+var INITIALIZE = {
+  protocolVersion: PREFERRED_VERSION,
+  capabilities: {},
+  clientInfo: CLIENT
+};
+var text = (value) => typeof value === "string" ? value : null;
+function toolsFrom(result) {
+  const raw = result.tools;
+  if (!Array.isArray(raw)) return [];
+  return raw.flatMap((value) => {
+    if (typeof value !== "object" || value === null) return [];
+    const tool = value;
+    const name = text(tool.name);
+    if (name === null) return [];
+    return [
+      {
+        name,
+        description: text(tool.description),
+        inputSchema: tool.inputSchema ?? null,
+        outputSchema: tool.outputSchema ?? null
+      }
+    ];
+  });
+}
+function reachFor(status) {
+  if (status === 401 || status === 403) return "auth_required";
+  if (status === 402) return "payment_required";
+  if (status >= 500 || status === 404 || status === 410) return "dead";
+  if (status >= 400) return "error";
+  return null;
+}
+async function turn(response, method) {
+  const refused = reachFor(response.status);
+  if (refused !== null) return { kind: "refused", reach: refused, status: response.status };
+  const answer = readAnswer(response.headers.get("content-type"), await response.text());
+  if (answer.kind === "result") {
+    return { kind: "read", status: response.status, value: answer.value };
+  }
+  return {
+    kind: "broken",
+    status: response.status,
+    note: answer.kind === "error" ? `${method}: ${answer.message}` : answer.why
+  };
+}
+var DEADLINE_MS = 45e3;
+var MAX_PAGES = 20;
+var MAX_TOOLS = 2e3;
+async function probeMcp(url, options = {}) {
+  const clockFor = options.now ?? Date.now;
+  const startedFor = clockFor();
+  let timer;
+  const gaveUp = new Promise((resolve) => {
+    timer = setTimeout(
+      () => resolve({
+        url,
+        observedAt: new Date(startedFor).toISOString(),
+        reach: "dead",
+        httpStatus: null,
+        handshakeMs: options.deadlineMs ?? DEADLINE_MS,
+        protocolVersion: null,
+        serverName: null,
+        serverVersion: null,
+        instructions: null,
+        tools: null,
+        pages: null,
+        truncated: false,
+        note: "never answered and never gave up"
+      }),
+      options.deadlineMs ?? DEADLINE_MS
+    );
+  });
+  try {
+    return await Promise.race([handshake(url, options), gaveUp]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function walkTools(send, session) {
+  const tools = [];
+  let cursor = null;
+  let pages = 0;
+  let status = 200;
+  for (; ; ) {
+    const asked = request(2 + pages, "tools/list", cursor === null ? void 0 : { cursor });
+    const listed = await turn(await send(asked, session), "tools/list");
+    if (listed.kind === "refused") {
+      return {
+        kind: "refused",
+        reach: listed.reach,
+        status: listed.status,
+        note: "it opened but would not list"
+      };
+    }
+    if (listed.kind === "broken")
+      return { kind: "broken", status: listed.status, note: listed.note };
+    tools.push(...toolsFrom(listed.value));
+    status = listed.status;
+    pages += 1;
+    const next = text(listed.value.nextCursor);
+    if (next === null || next === cursor)
+      return { kind: "listed", status, tools, pages, truncated: false };
+    if (pages >= MAX_PAGES || tools.length >= MAX_TOOLS) {
+      return { kind: "listed", status, tools, pages, truncated: true };
+    }
+    cursor = next;
+  }
+}
+async function handshake(url, options) {
+  const doFetch = options.fetchImpl ?? fetch;
+  const clock = options.now ?? Date.now;
+  const userAgent = options.userAgent ?? `${CLIENT.name}/${CLIENT.version}`;
+  const startedAt = clock();
+  const base = {
+    url,
+    observedAt: new Date(startedAt).toISOString(),
+    protocolVersion: null,
+    serverName: null,
+    serverVersion: null,
+    instructions: null,
+    tools: null,
+    pages: null,
+    truncated: false
+  };
+  const send = (body, sessionId) => doFetch(url, {
+    ...initFor(body, sessionId, userAgent),
+    signal: AbortSignal.timeout(options.timeoutMs ?? HANDSHAKE_TIMEOUT_MS)
+  });
+  const took = () => Math.max(0, clock() - startedAt);
+  try {
+    const opened = await send(request(1, "initialize", INITIALIZE), null);
+    const hello = await turn(opened, "initialize");
+    if (hello.kind === "refused") {
+      return {
+        ...base,
+        reach: hello.reach,
+        httpStatus: hello.status,
+        handshakeMs: took(),
+        note: null
+      };
+    }
+    if (hello.kind === "broken") {
+      return {
+        ...base,
+        reach: "error",
+        httpStatus: hello.status,
+        handshakeMs: took(),
+        note: hello.note
+      };
+    }
+    const info = hello.value.serverInfo ?? {};
+    const session = opened.headers.get("mcp-session-id");
+    const said = {
+      ...base,
+      protocolVersion: text(hello.value.protocolVersion),
+      serverName: text(info.name),
+      serverVersion: text(info.version),
+      instructions: text(hello.value.instructions)
+    };
+    await send(notification("notifications/initialized"), session).catch(() => void 0);
+    const walked = await walkTools(send, session);
+    if (walked.kind !== "listed") {
+      return {
+        ...said,
+        reach: walked.kind === "refused" ? walked.reach : "error",
+        httpStatus: walked.status,
+        handshakeMs: took(),
+        note: walked.note
+      };
+    }
+    return {
+      ...said,
+      reach: "readable",
+      httpStatus: walked.status,
+      handshakeMs: took(),
+      tools: walked.tools,
+      pages: walked.pages,
+      truncated: walked.truncated,
+      note: null
+    };
+  } catch (err) {
+    const name = err.name;
+    return {
+      ...base,
+      reach: "dead",
+      httpStatus: null,
+      handshakeMs: took(),
+      note: name === "TimeoutError" || name === "AbortError" ? "timed out" : "unreachable"
+    };
+  }
+}
+function toolsDigest(tools) {
+  const canonical = JSON.stringify(
+    [...tools].map((t) => [t.name, t.description ?? "", t.inputSchema !== null]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0)
+  );
+  return createHash("sha256").update(canonical).digest("hex");
+}
+
+// src/mcp.ts
+function sha256(input) {
+  return `sha256:${createHash2("sha256").update(input).digest("hex")}`;
+}
+var pass2 = (id, label, detail) => detail === void 0 ? { id, label, status: "pass" } : { id, label, status: "pass", detail };
+var fail2 = (id, label, detail) => ({
+  id,
+  label,
+  status: "fail",
+  detail
+});
+var skip = (id, label, detail) => ({
+  id,
+  label,
+  status: "skip",
+  detail
+});
+var REACH_LABEL = {
+  readable: "listed its tools",
+  auth_required: "asked for credentials",
+  payment_required: "asked for payment",
+  dead: "did not answer",
+  error: "answered with something else"
+};
+function checksFor(seen) {
+  const checks = [];
+  checks.push(
+    seen.reach === "dead" ? fail2("reachable", "server answered", seen.note ?? "no answer") : pass2("reachable", "server answered", REACH_LABEL[seen.reach])
+  );
+  if (seen.reach === "dead") return checks;
+  checks.push(
+    seen.protocolVersion === null ? skip("protocol", "named a protocol version", "it never got as far as saying") : pass2("protocol", "named a protocol version", seen.protocolVersion)
+  );
+  checks.push(
+    seen.serverName === null ? skip("identity", "named itself", "it never got as far as saying") : pass2(
+      "identity",
+      "named itself",
+      `${seen.serverName}${seen.serverVersion === null ? "" : ` ${seen.serverVersion}`}`
+    )
+  );
+  if (seen.tools === null) {
+    checks.push(skip("tools", "listed its tools", REACH_LABEL[seen.reach]));
+    return checks;
+  }
+  checks.push(pass2("tools", "listed its tools", `${seen.tools.length} tool(s)`));
+  const bare = seen.tools.filter((t) => t.inputSchema === null).map((t) => t.name);
+  checks.push(
+    bare.length === 0 ? pass2("input-schemas", "every tool declared an input schema") : fail2(
+      "input-schemas",
+      "every tool declared an input schema",
+      `${bare.length} without one: ${bare.slice(0, 5).join(", ")}`
+    )
+  );
+  const unnamed = seen.tools.filter((t) => t.description === null).map((t) => t.name);
+  checks.push(
+    unnamed.length === 0 ? pass2("descriptions", "every tool said what it does") : fail2(
+      "descriptions",
+      "every tool said what it does",
+      `${unnamed.length} without one: ${unnamed.slice(0, 5).join(", ")}`
+    )
+  );
+  checks.push(pass2("digest", "tool list digest", toolsDigest(seen.tools)));
+  return checks;
+}
+async function probeMcpEndpoint(options) {
+  const seen = await probeMcp(options.url, {
+    ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
+    ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+    ...options.userAgent === void 0 ? {} : { userAgent: options.userAgent }
+  });
+  const checks = checksFor(seen);
+  return {
+    url: options.url,
+    method: "MCP",
+    observedAt: seen.observedAt,
+    reachable: seen.reach !== "dead",
+    httpStatus: seen.httpStatus,
+    handshakeMs: seen.handshakeMs,
+    termsSource: seen.reach === "payment_required" ? "mcp 402" : "none",
+    advertised: [],
+    requestHash: sha256(`MCP ${options.url}`),
+    responseHash: seen.tools === null ? null : `sha256:${toolsDigest(seen.tools)}`,
+    checks,
+    verdict: checks.some((c) => c.status === "fail") ? "fail" : "pass"
+  };
+}
+
+// src/probe.ts
+import { createHash as createHash3 } from "node:crypto";
 
 // ../x402/src/handshake.ts
-var HANDSHAKE_TIMEOUT_MS = 3e4;
+var HANDSHAKE_TIMEOUT_MS2 = 3e4;
 var sendsBody = (method) => method !== "GET" && method !== "HEAD";
-function handshakeInit(request) {
-  const carries = sendsBody(request.method);
+function handshakeInit(request2) {
+  const carries = sendsBody(request2.method);
   const headers = { accept: "application/json" };
   if (carries) headers["content-type"] = "application/json";
-  if (request.userAgent !== void 0) headers["user-agent"] = request.userAgent;
-  if (request.payment) headers[request.payment.header] = request.payment.value;
+  if (request2.userAgent !== void 0) headers["user-agent"] = request2.userAgent;
+  if (request2.payment) headers[request2.payment.header] = request2.payment.value;
   return {
-    method: request.method,
+    method: request2.method,
     headers,
-    ...carries ? { body: JSON.stringify(request.input ?? {}) } : {},
-    signal: AbortSignal.timeout(request.timeoutMs ?? HANDSHAKE_TIMEOUT_MS)
+    ...carries ? { body: JSON.stringify(request2.input ?? {}) } : {},
+    signal: AbortSignal.timeout(request2.timeoutMs ?? HANDSHAKE_TIMEOUT_MS2)
   };
 }
-async function handshake(request, deps = {}) {
+async function handshake2(request2, deps = {}) {
   const doFetch = deps.fetchImpl ?? fetch;
   const now = deps.now ?? Date.now;
   const started = now();
   const since = () => Math.max(0, now() - started);
   try {
-    const response = await doFetch(request.url, handshakeInit(request));
+    const response = await doFetch(request2.url, handshakeInit(request2));
     return { ok: true, response, body: await response.text(), latencyMs: since() };
   } catch (err) {
     return { ok: false, reason: err.message, latencyMs: since() };
@@ -7049,8 +7399,8 @@ async function handshake(request, deps = {}) {
 
 // src/probe.ts
 var DEFAULT_USER_AGENT = "node";
-function sha256(input) {
-  return `sha256:${createHash("sha256").update(input).digest("hex")}`;
+function sha2562(input) {
+  return `sha256:${createHash3("sha256").update(input).digest("hex")}`;
 }
 function advertisedFrom(terms) {
   if (!terms) return [];
@@ -7066,7 +7416,7 @@ async function probe(options) {
   const body = options.body ?? "{}";
   const doFetch = options.fetchImpl ?? fetch;
   const observedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const requestHash = sha256(`${method} ${options.url}
+  const requestHash = sha2562(`${method} ${options.url}
 ${body}`);
   const base = {
     url: options.url,
@@ -7076,7 +7426,7 @@ ${body}`);
     termsSource: "none",
     advertised: []
   };
-  const answer = await handshake(
+  const answer = await handshake2(
     {
       url: options.url,
       method,
@@ -7097,9 +7447,9 @@ ${body}`);
       verdict: "fail"
     };
   }
-  const { response, body: text } = answer;
+  const { response, body: text2 } = answer;
   const handshakeMs = answer.latencyMs;
-  const parsed = parseTerms(response.headers, text);
+  const parsed = parseTerms(response.headers, text2);
   const checks = runHandshakeChecks({
     status: response.status,
     headers: response.headers,
@@ -7114,7 +7464,7 @@ ${body}`);
     handshakeMs,
     termsSource: parsed.source,
     advertised: advertisedFrom(parsed.terms),
-    responseHash: sha256(text),
+    responseHash: sha2562(text2),
     checks,
     verdict: verdictOf(checks)
   };
@@ -7134,8 +7484,8 @@ function shouldColour(env, isTty) {
   if (env.FORCE_COLOR !== void 0 && env.FORCE_COLOR !== "0") return true;
   return isTty;
 }
-function paint(colour, text, on) {
-  return on ? `${ANSI[colour]}${text}${ANSI.reset}` : text;
+function paint(colour, text2, on) {
+  return on ? `${ANSI[colour]}${text2}${ANSI.reset}` : text2;
 }
 var MARK = { pass: "ok", fail: "fail", skip: "skip" };
 var COLOUR = { pass: "green", fail: "red", skip: "yellow" };
@@ -7181,11 +7531,14 @@ function formatJson(result) {
 }
 export {
   DEFAULT_USER_AGENT,
+  REACH_LABEL,
+  checksFor,
   formatJson,
   formatText,
   parseTerms,
   priceOf,
   probe,
+  probeMcpEndpoint,
   runHandshakeChecks,
   schemaCheck,
   schemasOf,

package/npm/mcp-probe/frame.d.ts

@@ -0,0 +1,18 @@
+export declare const JSON_RPC = "2.0";
+export declare const PROTOCOL_VERSIONS: readonly ["2025-06-18", "2025-03-26"];
+export declare const PREFERRED_VERSION: "2025-06-18";
+export type RpcResult = {
+    readonly kind: 'result';
+    readonly value: Record<string, unknown>;
+} | {
+    readonly kind: 'error';
+    readonly code: number;
+    readonly message: string;
+} | {
+    readonly kind: 'unreadable';
+    readonly why: string;
+};
+export declare function request(id: number, method: string, params?: Record<string, unknown>): string;
+export declare function notification(method: string): string;
+export declare function lastEventData(body: string): string | null;
+export declare function readAnswer(contentType: string | null, body: string): RpcResult;

package/npm/mcp-probe/index.d.ts

@@ -0,0 +1,2 @@
+export { JSON_RPC, lastEventData, notification, PREFERRED_VERSION, PROTOCOL_VERSIONS, type RpcResult, readAnswer, request, } from './frame.js';
+export { CLIENT, definitionDigest, definitionOf, HANDSHAKE_TIMEOUT_MS, INITIALIZE, initFor, MAX_PAGES, MAX_TOOLS, type McpObservation, type ProbeOptions, probeMcp, type Reach, reachFor, type Tool, toolsDigest, toolsFrom, } from './probe.js';

package/npm/mcp-probe/probe.d.ts

@@ -0,0 +1,52 @@
+export declare const HANDSHAKE_TIMEOUT_MS = 20000;
+export declare const CLIENT: {
+    readonly name: "teppi-probe";
+    readonly version: "0.1.0";
+};
+export type Reach = 'readable' | 'auth_required' | 'payment_required' | 'dead' | 'error';
+export type Tool = {
+    readonly name: string;
+    readonly description: string | null;
+    readonly inputSchema: unknown;
+    readonly outputSchema: unknown;
+};
+export type McpObservation = {
+    readonly url: string;
+    readonly observedAt: string;
+    readonly reach: Reach;
+    readonly httpStatus: number | null;
+    readonly handshakeMs: number;
+    readonly protocolVersion: string | null;
+    readonly serverName: string | null;
+    readonly serverVersion: string | null;
+    readonly instructions: string | null;
+    readonly tools: readonly Tool[] | null;
+    readonly pages: number | null;
+    readonly truncated: boolean;
+    readonly note: string | null;
+};
+export type ProbeOptions = {
+    readonly timeoutMs?: number;
+    readonly deadlineMs?: number;
+    readonly fetchImpl?: typeof fetch;
+    readonly now?: () => number;
+    readonly userAgent?: string;
+};
+export declare function initFor(body: string, sessionId: string | null, userAgent: string): RequestInit;
+export declare const INITIALIZE: {
+    protocolVersion: "2025-06-18";
+    capabilities: {};
+    clientInfo: {
+        readonly name: "teppi-probe";
+        readonly version: "0.1.0";
+    };
+};
+export declare function toolsFrom(result: Record<string, unknown>): Tool[];
+export declare function reachFor(status: number): Reach | null;
+export declare const DEADLINE_MS = 45000;
+export declare const MAX_PAGES = 20;
+export declare const MAX_TOOLS = 2000;
+export declare function probeMcp(url: string, options?: ProbeOptions): Promise<McpObservation>;
+export declare function toolsDigest(tools: readonly Tool[]): string;
+export declare function definitionOf(seen: McpObservation): string;
+export declare function definitionDigest(seen: McpObservation): string;

package/npm/mcp.d.ts

@@ -0,0 +1,13 @@
+import { type McpObservation } from './mcp-probe/index.js';
+import type { Check } from './checks.js';
+import type { ProbeResult } from './probe.js';
+export type McpProbeOptions = {
+    readonly url: string;
+    readonly userAgent?: string;
+    readonly timeoutMs?: number;
+    readonly fetchImpl?: typeof fetch;
+};
+export declare const REACH_LABEL: Readonly<Record<McpObservation['reach'], string>>;
+export declare function checksFor(seen: McpObservation): Check[];
+export declare function probeMcpEndpoint(options: McpProbeOptions): Promise<ProbeResult>;
+//# sourceMappingURL=mcp.d.ts.map

package/npm/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAyB,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAClC,CAAC;AAwBF,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAMzE,CAAC;AAEF,wBAAgB,SAAS,CAAC,IAAI,EAAE,cAAc,GAAG,KAAK,EAAE,CA2DvD;AAGD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAsBrF"}

package/npm/probe.d.ts

@@ -1,4 +1,4 @@
-import { type Check } from './checks.ts';
+import { type Check } from './checks.js';
 export declare const DEFAULT_USER_AGENT = "node";
 export type ProbeOptions = {
     readonly url: string;
@@ -28,4 +28,6 @@ export type ProbeResult = {
     readonly verdict: 'pass' | 'fail';
 };
 export declare function probe(options: ProbeOptions): Promise<ProbeResult>;
+export declare function askedForPayment(result: ProbeResult): boolean;
+export declare function probeEitherVerb(run: (method: string) => Promise<ProbeResult>, explicit?: string): Promise<ProbeResult>;
 //# sourceMappingURL=probe.d.ts.map

package/npm/probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../src/probe.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,KAAK,EAA8C,MAAM,aAAa,CAAC;AAGrF,eAAO,MAAM,kBAAkB,SAAS,CAAC;AAEzC,MAAM,MAAM,YAAY,GAAG;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAClC,CAAC;AAgBF,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+DvE"}
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../src/probe.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,KAAK,EAA8C,MAAM,aAAa,CAAC;AAGrF,eAAO,MAAM,kBAAkB,SAAS,CAAC;AAEzC,MAAM,MAAM,YAAY,GAAG;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAClC,CAAC;AAgBF,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+DvE;AAGD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAE5D;AAGD,wBAAsB,eAAe,CACpC,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,EAC7C,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,CAAC,CAStB"}

package/npm/report.d.ts

@@ -1,4 +1,4 @@
-import type { ProbeResult } from './probe.ts';
+import type { ProbeResult } from './probe.js';
 export declare function shouldColour(env: Record<string, string | undefined>, isTty: boolean): boolean;
 export declare function formatText(result: ProbeResult, colour: boolean): string;
 export declare function formatJson(result: ProbeResult): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teppi-check",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Probe any paid endpoint and print what it actually returns for the money. Reproduces any entry in the Teppi record.",
   "keywords": [
     "x402",
@@ -20,6 +20,7 @@
     ".": "./npm/index.js"
   },
   "devDependencies": {
+    "@teppi/mcp-probe": "0.0.0",
     "@teppi/x402": "0.0.0",
     "ajv": "^8.17.1",
     "esbuild": "^0.28.2",