teppi-check 0.2.0 → 0.3.0

package/README.md

@@ -1,6 +1,7 @@
 # teppi-check
 
-Send one unpaid request to any paid endpoint and see what it actually advertises.
+Send one unpaid request to any paid endpoint and see what it actually advertises, and what is
+already broken about the listing before you pay anything.
 
 ```bash
 npx teppi-check https://some-seller.example/v1/extract
@@ -36,13 +37,16 @@ in the record something you can check rather than something you are asked to acc
   payment terms are not cached                        fail
      no cache-control, so a proxy may serve stale terms
 
+  prose_in_the_url                                    defect
+     a query value spells out what to put there instead of putting it
+
   advertised
      10000 0x2222...2222 on eip155:8453 via exact
 
   request  sha256:ba6f7ff0...0878
   response sha256:0a83a213...2496
 
-  2 checks failed
+  3 problems found
 ```
 
 ## Why this exists
@@ -71,6 +75,23 @@ takes a purchase, which the full prober does on a schedule.
 Terms are read from the `payment-required` header (base64 or plain JSON) or from the response
 body, because deployed servers use both.
 
+## What it finds wrong with the listing
+
+A check reads the answer. A defect reads the listing itself, and an endpoint can answer perfectly
+while being impossible to buy from.
+
+| Defect | Means |
+|---|---|
+| `prose_in_the_url` | a query value describes the parameter instead of filling it in, or a path segment is still `:id` or `{id}`, or an address is forty repeated characters |
+| `path_not_found` | the listed path answered 404 or 410, so there is nothing there to buy |
+
+These are the names the public record uses, with the same sentence beside them. A test runs this
+rule and the one the record is built from over the same list of urls and fails if they ever give
+different answers, so the id you read in a Teppi entry is the id you get here.
+
+Nothing our own bad request causes is a defect. A 400, a 422 or a 429 says something about the
+caller, not the seller, and none of them appear.
+
 ## Remote MCP servers
 
 `--mcp` runs the handshake instead: `initialize`, the initialized notification, then `tools/list`
@@ -97,14 +118,15 @@ which is what makes it useful for noticing that a server's instructions changed
 
 ```
   --mcp                handshake a remote mcp server instead of an x402 endpoint
-  --method <verb>      default POST
+  --method <verb>      tries GET then POST when not given
   --body <json|@file>  default {}
   --json               machine readable output
   --timeout <ms>       default 15000
   --user-agent <ua>    default node
 ```
 
-Exit codes: `0` every check passed, `1` a check failed, `2` the endpoint could not be reached.
+Exit codes: `0` nothing to report, `1` a check failed or a defect was found, `2` the endpoint
+could not be reached.
 
 Requests go over HTTPS only, apart from localhost.
 
@@ -123,7 +145,10 @@ the failure mode nobody notices until buyers quietly stop calling.
 import { probe } from 'teppi-check';
 
 const result = await probe({ url: 'https://some-seller.example/v1/extract' });
-console.log(result.verdict, result.checks);
+console.log(result.verdict, result.checks, result.defects);
 ```
 
+`urlHasPlaceholder(url)` and `defectsOf(url, httpStatus)` are exported on their own, for reading a
+list of urls without sending anything.
+
 MIT.

package/npm/checks.d.ts

@@ -1,4 +1,5 @@
 import { type PaymentTerms } from './terms.js';
+import type { Defect } from './defects.js';
 export type CheckStatus = 'pass' | 'fail' | 'skip';
 export type Check = {
     readonly id: string;
@@ -16,5 +17,5 @@ export type HandshakeInput = {
 };
 export declare function runHandshakeChecks(input: HandshakeInput): Check[];
 export declare function unreachable(reason: string): Check[];
-export declare function verdictOf(checks: readonly Check[]): 'pass' | 'fail';
+export declare function verdictOf(checks: readonly Check[], defects: readonly Defect[]): 'pass' | 'fail';
 //# sourceMappingURL=checks.d.ts.map

package/npm/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,YAAY,EAAsB,MAAM,mBAAmB,CAAC;AAGnG,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,MAAM,KAAK,GAAG;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAqBF,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,KAAK,CAa7E;AAED,MAAM,MAAM,cAAc,GAAG;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB,CAAC;AA+BF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,KAAK,EAAE,CA4CjE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,CAEnD;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,GAAG,MAAM,GAAG,MAAM,CAEnE"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,YAAY,EAAsB,MAAM,mBAAmB,CAAC;AAEnG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,MAAM,KAAK,GAAG;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAqBF,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,KAAK,CAa7E;AAED,MAAM,MAAM,cAAc,GAAG;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB,CAAC;AA+BF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,KAAK,EAAE,CA4CjE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,CAEnD;AAGD,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,MAAM,CAG/F"}

package/npm/cli.js

@@ -6955,7 +6955,8 @@ function toolsFrom(result) {
       {
         name,
         description: text(tool.description),
-        hasInputSchema: typeof tool.inputSchema === "object" && tool.inputSchema !== null
+        inputSchema: tool.inputSchema ?? null,
+        outputSchema: tool.outputSchema ?? null
       }
     ];
   });
@@ -6981,6 +6982,8 @@ async function turn(response, method) {
   };
 }
 var DEADLINE_MS = 45e3;
+var MAX_PAGES = 20;
+var MAX_TOOLS = 2e3;
 async function probeMcp(url, options = {}) {
   const clockFor = options.now ?? Date.now;
   const startedFor = clockFor();
@@ -6996,7 +6999,10 @@ async function probeMcp(url, options = {}) {
         protocolVersion: null,
         serverName: null,
         serverVersion: null,
+        instructions: null,
         tools: null,
+        pages: null,
+        truncated: false,
         note: "never answered and never gave up"
       }),
       options.deadlineMs ?? DEADLINE_MS
@@ -7008,6 +7014,36 @@ async function probeMcp(url, options = {}) {
     clearTimeout(timer);
   }
 }
+async function walkTools(send, session) {
+  const tools = [];
+  let cursor = null;
+  let pages = 0;
+  let status = 200;
+  for (; ; ) {
+    const asked = request(2 + pages, "tools/list", cursor === null ? void 0 : { cursor });
+    const listed = await turn(await send(asked, session), "tools/list");
+    if (listed.kind === "refused") {
+      return {
+        kind: "refused",
+        reach: listed.reach,
+        status: listed.status,
+        note: "it opened but would not list"
+      };
+    }
+    if (listed.kind === "broken")
+      return { kind: "broken", status: listed.status, note: listed.note };
+    tools.push(...toolsFrom(listed.value));
+    status = listed.status;
+    pages += 1;
+    const next = text(listed.value.nextCursor);
+    if (next === null || next === cursor)
+      return { kind: "listed", status, tools, pages, truncated: false };
+    if (pages >= MAX_PAGES || tools.length >= MAX_TOOLS) {
+      return { kind: "listed", status, tools, pages, truncated: true };
+    }
+    cursor = next;
+  }
+}
 async function handshake(url, options) {
   const doFetch = options.fetchImpl ?? fetch;
   const clock = options.now ?? Date.now;
@@ -7019,7 +7055,10 @@ async function handshake(url, options) {
     protocolVersion: null,
     serverName: null,
     serverVersion: null,
-    tools: null
+    instructions: null,
+    tools: null,
+    pages: null,
+    truncated: false
   };
   const send = (body, sessionId) => doFetch(url, {
     ...initFor(body, sessionId, userAgent),
@@ -7053,34 +7092,28 @@ async function handshake(url, options) {
       ...base,
       protocolVersion: text(hello.value.protocolVersion),
       serverName: text(info.name),
-      serverVersion: text(info.version)
+      serverVersion: text(info.version),
+      instructions: text(hello.value.instructions)
     };
     await send(notification("notifications/initialized"), session).catch(() => void 0);
-    const listed = await turn(await send(request(2, "tools/list"), session), "tools/list");
-    if (listed.kind === "refused") {
+    const walked = await walkTools(send, session);
+    if (walked.kind !== "listed") {
       return {
         ...said,
-        reach: listed.reach,
-        httpStatus: listed.status,
+        reach: walked.kind === "refused" ? walked.reach : "error",
+        httpStatus: walked.status,
         handshakeMs: took(),
-        note: "it opened but would not list"
-      };
-    }
-    if (listed.kind === "broken") {
-      return {
-        ...said,
-        reach: "error",
-        httpStatus: listed.status,
-        handshakeMs: took(),
-        note: listed.note
+        note: walked.note
       };
     }
     return {
       ...said,
       reach: "readable",
-      httpStatus: listed.status,
+      httpStatus: walked.status,
       handshakeMs: took(),
-      tools: toolsFrom(listed.value),
+      tools: walked.tools,
+      pages: walked.pages,
+      truncated: walked.truncated,
       note: null
     };
   } catch (err) {
@@ -7096,130 +7129,11 @@ async function handshake(url, options) {
 }
 function toolsDigest(tools) {
   const canonical = JSON.stringify(
-    [...tools].map((t) => [t.name, t.description ?? "", t.hasInputSchema]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0)
+    [...tools].map((t) => [t.name, t.description ?? "", t.inputSchema !== null]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0)
   );
   return createHash("sha256").update(canonical).digest("hex");
 }
 
-// src/mcp.ts
-function sha256(input) {
-  return `sha256:${createHash2("sha256").update(input).digest("hex")}`;
-}
-var pass = (id, label, detail) => detail === void 0 ? { id, label, status: "pass" } : { id, label, status: "pass", detail };
-var fail = (id, label, detail) => ({
-  id,
-  label,
-  status: "fail",
-  detail
-});
-var skip = (id, label, detail) => ({
-  id,
-  label,
-  status: "skip",
-  detail
-});
-var REACH_LABEL = {
-  readable: "listed its tools",
-  auth_required: "asked for credentials",
-  payment_required: "asked for payment",
-  dead: "did not answer",
-  error: "answered with something else"
-};
-function checksFor(seen) {
-  const checks = [];
-  checks.push(
-    seen.reach === "dead" ? fail("reachable", "server answered", seen.note ?? "no answer") : pass("reachable", "server answered", REACH_LABEL[seen.reach])
-  );
-  if (seen.reach === "dead") return checks;
-  checks.push(
-    seen.protocolVersion === null ? skip("protocol", "named a protocol version", "it never got as far as saying") : pass("protocol", "named a protocol version", seen.protocolVersion)
-  );
-  checks.push(
-    seen.serverName === null ? skip("identity", "named itself", "it never got as far as saying") : pass(
-      "identity",
-      "named itself",
-      `${seen.serverName}${seen.serverVersion === null ? "" : ` ${seen.serverVersion}`}`
-    )
-  );
-  if (seen.tools === null) {
-    checks.push(skip("tools", "listed its tools", REACH_LABEL[seen.reach]));
-    return checks;
-  }
-  checks.push(pass("tools", "listed its tools", `${seen.tools.length} tool(s)`));
-  const bare = seen.tools.filter((t) => !t.hasInputSchema).map((t) => t.name);
-  checks.push(
-    bare.length === 0 ? pass("input-schemas", "every tool declared an input schema") : fail(
-      "input-schemas",
-      "every tool declared an input schema",
-      `${bare.length} without one: ${bare.slice(0, 5).join(", ")}`
-    )
-  );
-  const unnamed = seen.tools.filter((t) => t.description === null).map((t) => t.name);
-  checks.push(
-    unnamed.length === 0 ? pass("descriptions", "every tool said what it does") : fail(
-      "descriptions",
-      "every tool said what it does",
-      `${unnamed.length} without one: ${unnamed.slice(0, 5).join(", ")}`
-    )
-  );
-  checks.push(pass("digest", "tool list digest", toolsDigest(seen.tools)));
-  return checks;
-}
-async function probeMcpEndpoint(options) {
-  const seen = await probeMcp(options.url, {
-    ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
-    ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
-    ...options.userAgent === void 0 ? {} : { userAgent: options.userAgent }
-  });
-  const checks = checksFor(seen);
-  return {
-    url: options.url,
-    method: "MCP",
-    observedAt: seen.observedAt,
-    reachable: seen.reach !== "dead",
-    httpStatus: seen.httpStatus,
-    handshakeMs: seen.handshakeMs,
-    termsSource: seen.reach === "payment_required" ? "mcp 402" : "none",
-    advertised: [],
-    requestHash: sha256(`MCP ${options.url}`),
-    responseHash: seen.tools === null ? null : `sha256:${toolsDigest(seen.tools)}`,
-    checks,
-    verdict: checks.some((c) => c.status === "fail") ? "fail" : "pass"
-  };
-}
-
-// src/probe.ts
-import { createHash as createHash3 } from "node:crypto";
-
-// ../x402/src/handshake.ts
-var HANDSHAKE_TIMEOUT_MS2 = 3e4;
-var sendsBody = (method) => method !== "GET" && method !== "HEAD";
-function handshakeInit(request2) {
-  const carries = sendsBody(request2.method);
-  const headers = { accept: "application/json" };
-  if (carries) headers["content-type"] = "application/json";
-  if (request2.userAgent !== void 0) headers["user-agent"] = request2.userAgent;
-  if (request2.payment) headers[request2.payment.header] = request2.payment.value;
-  return {
-    method: request2.method,
-    headers,
-    ...carries ? { body: JSON.stringify(request2.input ?? {}) } : {},
-    signal: AbortSignal.timeout(request2.timeoutMs ?? HANDSHAKE_TIMEOUT_MS2)
-  };
-}
-async function handshake2(request2, deps = {}) {
-  const doFetch = deps.fetchImpl ?? fetch;
-  const now = deps.now ?? Date.now;
-  const started = now();
-  const since = () => Math.max(0, now() - started);
-  try {
-    const response = await doFetch(request2.url, handshakeInit(request2));
-    return { ok: true, response, body: await response.text(), latencyMs: since() };
-  } catch (err) {
-    return { ok: false, reason: err.message, latencyMs: since() };
-  }
-}
-
 // ../x402/src/terms.ts
 var HEADER_NAMES = ["payment-required", "x-payment-required", "www-authenticate-payment"];
 function asTerms(value) {
@@ -7291,24 +7205,24 @@ var ajv = new import_ajv.Ajv({
   validateSchema: true,
   validateFormats: false
 });
-function pass2(id, label, detail) {
+function pass(id, label, detail) {
   return detail === void 0 ? { id, label, status: "pass" } : { id, label, status: "pass", detail };
 }
-function fail2(id, label, detail) {
+function fail(id, label, detail) {
   return { id, label, status: "fail", detail };
 }
 function schemaCheck(id, label, schema) {
   if (schema === null || schema === void 0) {
-    return fail2(id, label, "not declared, so no response can ever be checked against it");
+    return fail(id, label, "not declared, so no response can ever be checked against it");
   }
   if (typeof schema !== "object") {
-    return fail2(id, label, `declared as ${typeof schema}, not an object`);
+    return fail(id, label, `declared as ${typeof schema}, not an object`);
   }
   try {
     ajv.compile(schema);
-    return pass2(id, label);
+    return pass(id, label);
   } catch (err) {
-    return fail2(id, label, `declared but invalid: ${err.message.split("\n")[0]}`);
+    return fail(id, label, `declared but invalid: ${err.message.split("\n")[0]}`);
   }
 }
 function requirementChecks(terms) {
@@ -7316,7 +7230,7 @@ function requirementChecks(terms) {
   const report = (id, label, has) => {
     const gaps = terms.accepts.map((r, i) => has(r) ? -1 : i).filter((i) => i >= 0);
     out.push(
-      gaps.length === 0 ? pass2(id, label) : fail2(id, label, `absent from accepts[${gaps.join("], accepts[")}]`)
+      gaps.length === 0 ? pass(id, label) : fail(id, label, `absent from accepts[${gaps.join("], accepts[")}]`)
     );
   };
   report("price_declared", "price is stated", (r) => priceOf(r) !== null);
@@ -7333,29 +7247,29 @@ function requirementChecks(terms) {
   return out;
 }
 function runHandshakeChecks(input) {
-  const checks = [pass2("reachable", "endpoint answered")];
+  const checks = [pass("reachable", "endpoint answered")];
   checks.push(
-    input.status === 402 ? pass2("status_402", "asks for payment") : fail2("status_402", "asks for payment", `returned ${input.status}, not 402`)
+    input.status === 402 ? pass("status_402", "asks for payment") : fail("status_402", "asks for payment", `returned ${input.status}, not 402`)
   );
   if (input.terms === null) {
     checks.push(
-      fail2("terms_parseable", "payment terms parse", input.parseError ?? "no terms found")
+      fail("terms_parseable", "payment terms parse", input.parseError ?? "no terms found")
     );
     return checks;
   }
-  checks.push(pass2("terms_parseable", "payment terms parse", `read from the ${input.source}`));
+  checks.push(pass("terms_parseable", "payment terms parse", `read from the ${input.source}`));
   checks.push(
-    input.terms.accepts.length > 0 ? pass2(
+    input.terms.accepts.length > 0 ? pass(
       "accepts_present",
       "offers at least one way to pay",
       `${input.terms.accepts.length} option(s)`
-    ) : fail2("accepts_present", "offers at least one way to pay", "accepts is empty")
+    ) : fail("accepts_present", "offers at least one way to pay", "accepts is empty")
   );
   if (input.terms.accepts.length === 0) return checks;
   checks.push(...requirementChecks(input.terms));
   const cache = input.headers.get("cache-control") ?? "";
   checks.push(
-    /no-store|no-cache/i.test(cache) ? pass2("not_cacheable", "payment terms are not cached") : fail2(
+    /no-store|no-cache/i.test(cache) ? pass("not_cacheable", "payment terms are not cached") : fail(
       "not_cacheable",
       "payment terms are not cached",
       cache === "" ? "no cache-control, so a proxy may serve stale terms" : `cache-control: ${cache}`
@@ -7364,12 +7278,165 @@ function runHandshakeChecks(input) {
   return checks;
 }
 function unreachable(reason) {
-  return [fail2("reachable", "endpoint answered", reason)];
+  return [fail("reachable", "endpoint answered", reason)];
 }
-function verdictOf(checks) {
+function verdictOf(checks, defects) {
+  if (defects.length > 0) return "fail";
   return checks.some((c) => c.status === "fail") ? "fail" : "pass";
 }
 
+// src/defects.ts
+var PLACEHOLDER = [
+  /[?&][^=&]+=(?:string|integer|number|boolean|array|object)(?:&|$)/,
+  /=0x([0-9a-fA-F])\1{39}(?:&|$)/,
+  /\/:[A-Za-z_][A-Za-z0-9_]*(?:\/|[?]|$)/,
+  /\/[{][A-Za-z_][A-Za-z0-9_]*[}](?:\/|[?]|$)/,
+  // An em dash and an e.g. belong to a sentence, and a value is not one.
+  /[?&][^=&]+=[^&]*(?:%E2%80%94|—)/i,
+  /[?&][^=&]+=[^&]*e\.g\./i,
+  // Anchored at the start of the value, since a real one can mention these words later.
+  /[?&][^=&]+=(?:required|optional)(?:[^a-z]|$)/i,
+  // A value that spells out its own parameter name is describing it, not answering it.
+  /[?&]([a-z_]{3,})=[^&]*\1[^&]*(?:\+|%20)/i
+];
+function urlHasPlaceholder(url) {
+  return PLACEHOLDER.some((marker) => marker.test(url));
+}
+var PROSE_SAYS = "a query value spells out what to put there instead of putting it";
+var GONE = /* @__PURE__ */ new Set([404, 410]);
+function pathNotFoundSays(httpStatus) {
+  return `the listed path answered ${httpStatus}`;
+}
+function defectsOf(url, httpStatus) {
+  const found = [];
+  if (urlHasPlaceholder(url)) found.push({ defect: "prose_in_the_url", says: PROSE_SAYS });
+  if (httpStatus !== null && GONE.has(httpStatus)) {
+    found.push({ defect: "path_not_found", says: pathNotFoundSays(httpStatus) });
+  }
+  return found;
+}
+
+// src/mcp.ts
+function sha256(input) {
+  return `sha256:${createHash2("sha256").update(input).digest("hex")}`;
+}
+var pass2 = (id, label, detail) => detail === void 0 ? { id, label, status: "pass" } : { id, label, status: "pass", detail };
+var fail2 = (id, label, detail) => ({
+  id,
+  label,
+  status: "fail",
+  detail
+});
+var skip = (id, label, detail) => ({
+  id,
+  label,
+  status: "skip",
+  detail
+});
+var REACH_LABEL = {
+  readable: "listed its tools",
+  auth_required: "asked for credentials",
+  payment_required: "asked for payment",
+  dead: "did not answer",
+  error: "answered with something else"
+};
+function checksFor(seen) {
+  const checks = [];
+  checks.push(
+    seen.reach === "dead" ? fail2("reachable", "server answered", seen.note ?? "no answer") : pass2("reachable", "server answered", REACH_LABEL[seen.reach])
+  );
+  if (seen.reach === "dead") return checks;
+  checks.push(
+    seen.protocolVersion === null ? skip("protocol", "named a protocol version", "it never got as far as saying") : pass2("protocol", "named a protocol version", seen.protocolVersion)
+  );
+  checks.push(
+    seen.serverName === null ? skip("identity", "named itself", "it never got as far as saying") : pass2(
+      "identity",
+      "named itself",
+      `${seen.serverName}${seen.serverVersion === null ? "" : ` ${seen.serverVersion}`}`
+    )
+  );
+  if (seen.tools === null) {
+    checks.push(skip("tools", "listed its tools", REACH_LABEL[seen.reach]));
+    return checks;
+  }
+  checks.push(pass2("tools", "listed its tools", `${seen.tools.length} tool(s)`));
+  const bare = seen.tools.filter((t) => t.inputSchema === null).map((t) => t.name);
+  checks.push(
+    bare.length === 0 ? pass2("input-schemas", "every tool declared an input schema") : fail2(
+      "input-schemas",
+      "every tool declared an input schema",
+      `${bare.length} without one: ${bare.slice(0, 5).join(", ")}`
+    )
+  );
+  const unnamed = seen.tools.filter((t) => t.description === null).map((t) => t.name);
+  checks.push(
+    unnamed.length === 0 ? pass2("descriptions", "every tool said what it does") : fail2(
+      "descriptions",
+      "every tool said what it does",
+      `${unnamed.length} without one: ${unnamed.slice(0, 5).join(", ")}`
+    )
+  );
+  checks.push(pass2("digest", "tool list digest", toolsDigest(seen.tools)));
+  return checks;
+}
+async function probeMcpEndpoint(options) {
+  const seen = await probeMcp(options.url, {
+    ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
+    ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+    ...options.userAgent === void 0 ? {} : { userAgent: options.userAgent }
+  });
+  const checks = checksFor(seen);
+  const defects = defectsOf(options.url, seen.httpStatus);
+  return {
+    url: options.url,
+    method: "MCP",
+    observedAt: seen.observedAt,
+    reachable: seen.reach !== "dead",
+    httpStatus: seen.httpStatus,
+    handshakeMs: seen.handshakeMs,
+    termsSource: seen.reach === "payment_required" ? "mcp 402" : "none",
+    advertised: [],
+    requestHash: sha256(`MCP ${options.url}`),
+    responseHash: seen.tools === null ? null : `sha256:${toolsDigest(seen.tools)}`,
+    checks,
+    defects,
+    verdict: verdictOf(checks, defects)
+  };
+}
+
+// src/probe.ts
+import { createHash as createHash3 } from "node:crypto";
+
+// ../x402/src/handshake.ts
+var HANDSHAKE_TIMEOUT_MS2 = 3e4;
+var sendsBody = (method) => method !== "GET" && method !== "HEAD";
+function handshakeInit(request2) {
+  const carries = sendsBody(request2.method);
+  const headers = { accept: "application/json" };
+  if (carries) headers["content-type"] = "application/json";
+  if (request2.userAgent !== void 0) headers["user-agent"] = request2.userAgent;
+  if (request2.payment) headers[request2.payment.header] = request2.payment.value;
+  return {
+    method: request2.method,
+    headers,
+    ...carries ? { body: JSON.stringify(request2.input ?? {}) } : {},
+    signal: AbortSignal.timeout(request2.timeoutMs ?? HANDSHAKE_TIMEOUT_MS2)
+  };
+}
+async function handshake2(request2, deps = {}) {
+  const doFetch = deps.fetchImpl ?? fetch;
+  const now = deps.now ?? Date.now;
+  const started = now();
+  const since = () => Math.max(0, now() - started);
+  try {
+    const response = await doFetch(request2.url, handshakeInit(request2));
+    return { ok: true, response, body: await response.text(), latencyMs: since() };
+  } catch (err) {
+    return { ok: false, reason: err.message, latencyMs: since() };
+  }
+}
+
 // src/probe.ts
 function sha2562(input) {
   return `sha256:${createHash3("sha256").update(input).digest("hex")}`;
@@ -7416,6 +7483,7 @@ ${body}`);
       handshakeMs: answer.latencyMs,
       responseHash: null,
       checks: unreachable(answer.reason),
+      defects: defectsOf(options.url, null),
       verdict: "fail"
     };
   }
@@ -7429,6 +7497,7 @@ ${body}`);
     parseError: parsed.parseError,
     source: parsed.source
   });
+  const defects = defectsOf(options.url, response.status);
   return {
     ...base,
     reachable: true,
@@ -7438,9 +7507,23 @@ ${body}`);
     advertised: advertisedFrom(parsed.terms),
     responseHash: sha2562(text2),
     checks,
-    verdict: verdictOf(checks)
+    defects,
+    verdict: verdictOf(checks, defects)
   };
 }
+function askedForPayment(result) {
+  return result.checks.some((c) => c.id === "status_402" && c.status === "pass");
+}
+async function probeEitherVerb(run, explicit) {
+  const verbs = explicit === void 0 ? ["GET", "POST"] : [explicit.toUpperCase()];
+  let first;
+  for (const method of verbs) {
+    const attempt = await run(method);
+    if (askedForPayment(attempt)) return attempt;
+    first ??= attempt;
+  }
+  return first;
+}
 
 // src/report.ts
 var ANSI = {
@@ -7478,6 +7561,13 @@ function formatText(result, colour) {
     lines.push(`  ${check.label.padEnd(width)}${mark}`);
     if (check.detail) lines.push(`     ${paint("dim", check.detail, colour)}`);
   }
+  if (result.defects.length > 0) {
+    lines.push("");
+    for (const found of result.defects) {
+      lines.push(`  ${found.defect.padEnd(width)}${paint("red", "defect", colour)}`);
+      lines.push(`     ${paint("dim", found.says, colour)}`);
+    }
+  }
   if (result.advertised.length > 0) {
     lines.push("");
     lines.push(`  ${paint("dim", "advertised", colour)}`);
@@ -7490,9 +7580,9 @@ function formatText(result, colour) {
   if (result.responseHash)
     lines.push(`  ${paint("dim", "response ", colour)}${result.responseHash}`);
   lines.push("");
-  const failed = result.checks.filter((c) => c.status === "fail").length;
+  const failed = result.checks.filter((c) => c.status === "fail").length + result.defects.length;
   lines.push(
-    result.verdict === "pass" ? `  ${paint("green", "every handshake check passed", colour)}` : `  ${paint("red", `${failed} check${failed === 1 ? "" : "s"} failed`, colour)}`
+    result.verdict === "pass" ? `  ${paint("green", "every handshake check passed", colour)}` : `  ${paint("red", `${failed} problem${failed === 1 ? "" : "s"} found`, colour)}`
   );
   lines.push(`  ${paint("dim", "this is the unpaid half. correctness needs a purchase.", colour)}`);
   lines.push("");
@@ -7506,17 +7596,18 @@ function formatJson(result) {
 var USAGE = `
   teppi-check <url> [options]
 
-  Sends one unpaid request and reports what the endpoint advertises, in the
-  same form the public record uses.
+  Sends one unpaid request and reports what the endpoint advertises, plus
+  anything wrong with the listing itself, in the form the public record uses.
 
     --mcp               handshake a remote mcp server instead of an x402 endpoint
-    --method <verb>     default POST
+    --method <verb>     tries get then post when not given
     --body <json|@file> default {}
     --json              machine readable output
     --timeout <ms>      default 15000
     --user-agent <ua>   default node
 
-  Exit codes: 0 every check passed, 1 a check failed, 2 could not be reached.
+  Exit codes: 0 nothing to report, 1 a check failed or a defect was found,
+              2 could not be reached.
 `;
 function refuseUnlessUsable(url) {
   let parsed;
@@ -7559,17 +7650,18 @@ async function main() {
     ...values["user-agent"] ? { userAgent: values["user-agent"] } : {}
   };
   const rawBody = values.body ?? "{}";
-  const result = values.mcp ? await probeMcpEndpoint(shared) : await probe({
-    ...shared,
-    method: values.method?.toUpperCase() ?? "POST",
-    body: rawBody.startsWith("@") ? readFileSync(rawBody.slice(1), "utf8") : rawBody
-  });
+  const body = rawBody.startsWith("@") ? readFileSync(rawBody.slice(1), "utf8") : rawBody;
+  const found = await probeEitherVerb(
+    (method) => probe({ ...shared, method, body }),
+    values.method
+  );
+  const out = values.mcp ? await probeMcpEndpoint(shared) : found;
   stdout.write(
-    values.json ? `${formatJson(result)}
-` : formatText(result, shouldColour(env, stdout.isTTY === true))
+    values.json ? `${formatJson(out)}
+` : formatText(out, shouldColour(env, stdout.isTTY === true))
   );
-  if (!result.reachable) exit(2);
-  exit(result.verdict === "pass" ? 0 : 1);
+  if (!out.reachable) exit(2);
+  exit(out.verdict === "pass" ? 0 : 1);
 }
 main().catch((err) => {
   stdout.write(`${err.message}

package/npm/defects.d.ts

@@ -0,0 +1,9 @@
+export type Defect = {
+    readonly defect: string;
+    readonly says: string;
+};
+export declare function urlHasPlaceholder(url: string): boolean;
+export declare const PROSE_SAYS = "a query value spells out what to put there instead of putting it";
+export declare function pathNotFoundSays(httpStatus: number): string;
+export declare function defectsOf(url: string, httpStatus: number | null): Defect[];
+//# sourceMappingURL=defects.d.ts.map

package/npm/defects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defects.d.ts","sourceRoot":"","sources":["../src/defects.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,MAAM,GAAG;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB,CAAC;AAkBF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,eAAO,MAAM,UAAU,qEAAqE,CAAC;AAK7F,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAO1E"}

package/npm/index.d.ts

@@ -1,5 +1,6 @@
 export { type PaymentRequirement, type PaymentTerms, parseTerms, priceOf, schemasOf, } from './terms.js';
 export { type Check, type CheckStatus, runHandshakeChecks, schemaCheck, verdictOf, } from './checks.js';
+export { type Defect, defectsOf, PROSE_SAYS, pathNotFoundSays, urlHasPlaceholder, } from './defects.js';
 export { checksFor, type McpProbeOptions, probeMcpEndpoint, REACH_LABEL, } from './mcp.js';
 export { DEFAULT_USER_AGENT, type ProbeOptions, type ProbeResult, probe } from './probe.js';
 export { formatJson, formatText, shouldColour } from './report.js';

package/npm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,UAAU,EACV,OAAO,EACP,SAAS,GACT,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,kBAAkB,EAClB,WAAW,EACX,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,SAAS,EACT,KAAK,eAAe,EACpB,gBAAgB,EAChB,WAAW,GACX,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,UAAU,EACV,OAAO,EACP,SAAS,GACT,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,kBAAkB,EAClB,WAAW,EACX,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,MAAM,EACX,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,iBAAiB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,SAAS,EACT,KAAK,eAAe,EACpB,gBAAgB,EAChB,WAAW,GACX,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/npm/index.js

@@ -7011,10 +7011,42 @@ function runHandshakeChecks(input) {
 function unreachable(reason) {
   return [fail("reachable", "endpoint answered", reason)];
 }
-function verdictOf(checks) {
+function verdictOf(checks, defects) {
+  if (defects.length > 0) return "fail";
   return checks.some((c) => c.status === "fail") ? "fail" : "pass";
 }
 
+// src/defects.ts
+var PLACEHOLDER = [
+  /[?&][^=&]+=(?:string|integer|number|boolean|array|object)(?:&|$)/,
+  /=0x([0-9a-fA-F])\1{39}(?:&|$)/,
+  /\/:[A-Za-z_][A-Za-z0-9_]*(?:\/|[?]|$)/,
+  /\/[{][A-Za-z_][A-Za-z0-9_]*[}](?:\/|[?]|$)/,
+  // An em dash and an e.g. belong to a sentence, and a value is not one.
+  /[?&][^=&]+=[^&]*(?:%E2%80%94|—)/i,
+  /[?&][^=&]+=[^&]*e\.g\./i,
+  // Anchored at the start of the value, since a real one can mention these words later.
+  /[?&][^=&]+=(?:required|optional)(?:[^a-z]|$)/i,
+  // A value that spells out its own parameter name is describing it, not answering it.
+  /[?&]([a-z_]{3,})=[^&]*\1[^&]*(?:\+|%20)/i
+];
+function urlHasPlaceholder(url) {
+  return PLACEHOLDER.some((marker) => marker.test(url));
+}
+var PROSE_SAYS = "a query value spells out what to put there instead of putting it";
+var GONE = /* @__PURE__ */ new Set([404, 410]);
+function pathNotFoundSays(httpStatus) {
+  return `the listed path answered ${httpStatus}`;
+}
+function defectsOf(url, httpStatus) {
+  const found = [];
+  if (urlHasPlaceholder(url)) found.push({ defect: "prose_in_the_url", says: PROSE_SAYS });
+  if (httpStatus !== null && GONE.has(httpStatus)) {
+    found.push({ defect: "path_not_found", says: pathNotFoundSays(httpStatus) });
+  }
+  return found;
+}
+
 // src/mcp.ts
 import { createHash as createHash2 } from "node:crypto";
 
@@ -7099,7 +7131,8 @@ function toolsFrom(result) {
       {
         name,
         description: text(tool.description),
-        hasInputSchema: typeof tool.inputSchema === "object" && tool.inputSchema !== null
+        inputSchema: tool.inputSchema ?? null,
+        outputSchema: tool.outputSchema ?? null
       }
     ];
   });
@@ -7125,6 +7158,8 @@ async function turn(response, method) {
   };
 }
 var DEADLINE_MS = 45e3;
+var MAX_PAGES = 20;
+var MAX_TOOLS = 2e3;
 async function probeMcp(url, options = {}) {
   const clockFor = options.now ?? Date.now;
   const startedFor = clockFor();
@@ -7140,7 +7175,10 @@ async function probeMcp(url, options = {}) {
         protocolVersion: null,
         serverName: null,
         serverVersion: null,
+        instructions: null,
         tools: null,
+        pages: null,
+        truncated: false,
         note: "never answered and never gave up"
       }),
       options.deadlineMs ?? DEADLINE_MS
@@ -7152,6 +7190,36 @@ async function probeMcp(url, options = {}) {
     clearTimeout(timer);
   }
 }
+async function walkTools(send, session) {
+  const tools = [];
+  let cursor = null;
+  let pages = 0;
+  let status = 200;
+  for (; ; ) {
+    const asked = request(2 + pages, "tools/list", cursor === null ? void 0 : { cursor });
+    const listed = await turn(await send(asked, session), "tools/list");
+    if (listed.kind === "refused") {
+      return {
+        kind: "refused",
+        reach: listed.reach,
+        status: listed.status,
+        note: "it opened but would not list"
+      };
+    }
+    if (listed.kind === "broken")
+      return { kind: "broken", status: listed.status, note: listed.note };
+    tools.push(...toolsFrom(listed.value));
+    status = listed.status;
+    pages += 1;
+    const next = text(listed.value.nextCursor);
+    if (next === null || next === cursor)
+      return { kind: "listed", status, tools, pages, truncated: false };
+    if (pages >= MAX_PAGES || tools.length >= MAX_TOOLS) {
+      return { kind: "listed", status, tools, pages, truncated: true };
+    }
+    cursor = next;
+  }
+}
 async function handshake(url, options) {
   const doFetch = options.fetchImpl ?? fetch;
   const clock = options.now ?? Date.now;
@@ -7163,7 +7231,10 @@ async function handshake(url, options) {
     protocolVersion: null,
     serverName: null,
     serverVersion: null,
-    tools: null
+    instructions: null,
+    tools: null,
+    pages: null,
+    truncated: false
   };
   const send = (body, sessionId) => doFetch(url, {
     ...initFor(body, sessionId, userAgent),
@@ -7197,34 +7268,28 @@ async function handshake(url, options) {
       ...base,
       protocolVersion: text(hello.value.protocolVersion),
       serverName: text(info.name),
-      serverVersion: text(info.version)
+      serverVersion: text(info.version),
+      instructions: text(hello.value.instructions)
     };
     await send(notification("notifications/initialized"), session).catch(() => void 0);
-    const listed = await turn(await send(request(2, "tools/list"), session), "tools/list");
-    if (listed.kind === "refused") {
-      return {
-        ...said,
-        reach: listed.reach,
-        httpStatus: listed.status,
-        handshakeMs: took(),
-        note: "it opened but would not list"
-      };
-    }
-    if (listed.kind === "broken") {
+    const walked = await walkTools(send, session);
+    if (walked.kind !== "listed") {
       return {
         ...said,
-        reach: "error",
-        httpStatus: listed.status,
+        reach: walked.kind === "refused" ? walked.reach : "error",
+        httpStatus: walked.status,
         handshakeMs: took(),
-        note: listed.note
+        note: walked.note
       };
     }
     return {
       ...said,
       reach: "readable",
-      httpStatus: listed.status,
+      httpStatus: walked.status,
       handshakeMs: took(),
-      tools: toolsFrom(listed.value),
+      tools: walked.tools,
+      pages: walked.pages,
+      truncated: walked.truncated,
       note: null
     };
   } catch (err) {
@@ -7240,7 +7305,7 @@ async function handshake(url, options) {
 }
 function toolsDigest(tools) {
   const canonical = JSON.stringify(
-    [...tools].map((t) => [t.name, t.description ?? "", t.hasInputSchema]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0)
+    [...tools].map((t) => [t.name, t.description ?? "", t.inputSchema !== null]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0)
   );
   return createHash("sha256").update(canonical).digest("hex");
 }
@@ -7290,7 +7355,7 @@ function checksFor(seen) {
     return checks;
   }
   checks.push(pass2("tools", "listed its tools", `${seen.tools.length} tool(s)`));
-  const bare = seen.tools.filter((t) => !t.hasInputSchema).map((t) => t.name);
+  const bare = seen.tools.filter((t) => t.inputSchema === null).map((t) => t.name);
   checks.push(
     bare.length === 0 ? pass2("input-schemas", "every tool declared an input schema") : fail2(
       "input-schemas",
@@ -7316,6 +7381,7 @@ async function probeMcpEndpoint(options) {
     ...options.userAgent === void 0 ? {} : { userAgent: options.userAgent }
   });
   const checks = checksFor(seen);
+  const defects = defectsOf(options.url, seen.httpStatus);
   return {
     url: options.url,
     method: "MCP",
@@ -7328,7 +7394,8 @@ async function probeMcpEndpoint(options) {
     requestHash: sha256(`MCP ${options.url}`),
     responseHash: seen.tools === null ? null : `sha256:${toolsDigest(seen.tools)}`,
     checks,
-    verdict: checks.some((c) => c.status === "fail") ? "fail" : "pass"
+    defects,
+    verdict: verdictOf(checks, defects)
   };
 }
 
@@ -7411,6 +7478,7 @@ ${body}`);
       handshakeMs: answer.latencyMs,
       responseHash: null,
       checks: unreachable(answer.reason),
+      defects: defectsOf(options.url, null),
       verdict: "fail"
     };
   }
@@ -7424,6 +7492,7 @@ ${body}`);
     parseError: parsed.parseError,
     source: parsed.source
   });
+  const defects = defectsOf(options.url, response.status);
   return {
     ...base,
     reachable: true,
@@ -7433,7 +7502,8 @@ ${body}`);
     advertised: advertisedFrom(parsed.terms),
     responseHash: sha2562(text2),
     checks,
-    verdict: verdictOf(checks)
+    defects,
+    verdict: verdictOf(checks, defects)
   };
 }
 
@@ -7473,6 +7543,13 @@ function formatText(result, colour) {
     lines.push(`  ${check.label.padEnd(width)}${mark}`);
     if (check.detail) lines.push(`     ${paint("dim", check.detail, colour)}`);
   }
+  if (result.defects.length > 0) {
+    lines.push("");
+    for (const found of result.defects) {
+      lines.push(`  ${found.defect.padEnd(width)}${paint("red", "defect", colour)}`);
+      lines.push(`     ${paint("dim", found.says, colour)}`);
+    }
+  }
   if (result.advertised.length > 0) {
     lines.push("");
     lines.push(`  ${paint("dim", "advertised", colour)}`);
@@ -7485,9 +7562,9 @@ function formatText(result, colour) {
   if (result.responseHash)
     lines.push(`  ${paint("dim", "response ", colour)}${result.responseHash}`);
   lines.push("");
-  const failed = result.checks.filter((c) => c.status === "fail").length;
+  const failed = result.checks.filter((c) => c.status === "fail").length + result.defects.length;
   lines.push(
-    result.verdict === "pass" ? `  ${paint("green", "every handshake check passed", colour)}` : `  ${paint("red", `${failed} check${failed === 1 ? "" : "s"} failed`, colour)}`
+    result.verdict === "pass" ? `  ${paint("green", "every handshake check passed", colour)}` : `  ${paint("red", `${failed} problem${failed === 1 ? "" : "s"} found`, colour)}`
   );
   lines.push(`  ${paint("dim", "this is the unpaid half. correctness needs a purchase.", colour)}`);
   lines.push("");
@@ -7498,11 +7575,14 @@ function formatJson(result) {
 }
 export {
   DEFAULT_USER_AGENT,
+  PROSE_SAYS,
   REACH_LABEL,
   checksFor,
+  defectsOf,
   formatJson,
   formatText,
   parseTerms,
+  pathNotFoundSays,
   priceOf,
   probe,
   probeMcpEndpoint,
@@ -7510,5 +7590,6 @@ export {
   schemaCheck,
   schemasOf,
   shouldColour,
+  urlHasPlaceholder,
   verdictOf
 };

package/npm/mcp-probe/index.d.ts

@@ -1,2 +1,2 @@
 export { JSON_RPC, lastEventData, notification, PREFERRED_VERSION, PROTOCOL_VERSIONS, type RpcResult, readAnswer, request, } from './frame.js';
-export { CLIENT, HANDSHAKE_TIMEOUT_MS, INITIALIZE, initFor, type McpObservation, type ProbeOptions, probeMcp, type Reach, reachFor, type Tool, toolsDigest, toolsFrom, } from './probe.js';
+export { CLIENT, definitionDigest, definitionOf, HANDSHAKE_TIMEOUT_MS, INITIALIZE, initFor, MAX_PAGES, MAX_TOOLS, type McpObservation, type ProbeOptions, probeMcp, type Reach, reachFor, type Tool, toolsDigest, toolsFrom, } from './probe.js';

package/npm/mcp-probe/probe.d.ts

@@ -7,7 +7,8 @@ export type Reach = 'readable' | 'auth_required' | 'payment_required' | 'dead' |
 export type Tool = {
     readonly name: string;
     readonly description: string | null;
-    readonly hasInputSchema: boolean;
+    readonly inputSchema: unknown;
+    readonly outputSchema: unknown;
 };
 export type McpObservation = {
     readonly url: string;
@@ -18,7 +19,10 @@ export type McpObservation = {
     readonly protocolVersion: string | null;
     readonly serverName: string | null;
     readonly serverVersion: string | null;
+    readonly instructions: string | null;
     readonly tools: readonly Tool[] | null;
+    readonly pages: number | null;
+    readonly truncated: boolean;
     readonly note: string | null;
 };
 export type ProbeOptions = {
@@ -40,5 +44,9 @@ export declare const INITIALIZE: {
 export declare function toolsFrom(result: Record<string, unknown>): Tool[];
 export declare function reachFor(status: number): Reach | null;
 export declare const DEADLINE_MS = 45000;
+export declare const MAX_PAGES = 20;
+export declare const MAX_TOOLS = 2000;
 export declare function probeMcp(url: string, options?: ProbeOptions): Promise<McpObservation>;
 export declare function toolsDigest(tools: readonly Tool[]): string;
+export declare function definitionOf(seen: McpObservation): string;
+export declare function definitionDigest(seen: McpObservation): string;

package/npm/mcp.d.ts

@@ -1,5 +1,5 @@
 import { type McpObservation } from './mcp-probe/index.js';
-import type { Check } from './checks.js';
+import { type Check } from './checks.js';
 import type { ProbeResult } from './probe.js';
 export type McpProbeOptions = {
     readonly url: string;

package/npm/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAyB,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAClC,CAAC;AAwBF,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAMzE,CAAC;AAEF,wBAAgB,SAAS,CAAC,IAAI,EAAE,cAAc,GAAG,KAAK,EAAE,CA2DvD;AAGD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAsBrF"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAyB,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,KAAK,KAAK,EAAa,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAClC,CAAC;AAwBF,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAMzE,CAAC;AAEF,wBAAgB,SAAS,CAAC,IAAI,EAAE,cAAc,GAAG,KAAK,EAAE,CA2DvD;AAGD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAwBrF"}

package/npm/probe.d.ts

@@ -1,4 +1,5 @@
 import { type Check } from './checks.js';
+import { type Defect } from './defects.js';
 export declare const DEFAULT_USER_AGENT = "node";
 export type ProbeOptions = {
     readonly url: string;
@@ -25,7 +26,10 @@ export type ProbeResult = {
     readonly requestHash: string;
     readonly responseHash: string | null;
     readonly checks: readonly Check[];
+    readonly defects: readonly Defect[];
     readonly verdict: 'pass' | 'fail';
 };
 export declare function probe(options: ProbeOptions): Promise<ProbeResult>;
+export declare function askedForPayment(result: ProbeResult): boolean;
+export declare function probeEitherVerb(run: (method: string) => Promise<ProbeResult>, explicit?: string): Promise<ProbeResult>;
 //# sourceMappingURL=probe.d.ts.map

package/npm/probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../src/probe.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,KAAK,EAA8C,MAAM,aAAa,CAAC;AAGrF,eAAO,MAAM,kBAAkB,SAAS,CAAC;AAEzC,MAAM,MAAM,YAAY,GAAG;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAClC,CAAC;AAgBF,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+DvE"}
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../src/probe.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,KAAK,EAA8C,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,cAAc,CAAC;AAGtD,eAAO,MAAM,kBAAkB,SAAS,CAAC;AAEzC,MAAM,MAAM,YAAY,GAAG;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAClC,CAAC;AAgBF,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAmEvE;AAGD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAE5D;AAGD,wBAAsB,eAAe,CACpC,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,EAC7C,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,CAAC,CAStB"}

package/npm/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAW9C,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7F;AASD,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CA6CvE;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEtD"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAW9C,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7F;AASD,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAsDvE;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEtD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teppi-check",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Probe any paid endpoint and print what it actually returns for the money. Reproduces any entry in the Teppi record.",
   "keywords": [
     "x402",