toolstile 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Akshit Kr Nagpal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,126 @@
-# Temporary Holding Version
+# toolstile
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Check the MCP server configs your AI agents use, in one command:
+
+```sh
+npx toolstile audit
+```
+
+The same package is also published as `@toolstile/cli` (`npx @toolstile/cli audit`).
+
+It reads the configs of Claude Code, Claude Desktop, Cursor, Codex, VS Code,
+Windsurf, Gemini CLI and Cline and grades them for:
+
+| Check | Severity |
+| --- | --- |
+| API keys, tokens and passwords written into config files, URLs or arguments | high |
+| Remote servers reached over plain `http://` | high |
+| Containers run with `--privileged` or the Docker socket | high |
+| The same credential pasted into several clients' configs | medium |
+| Config files holding secrets that other accounts can reach (file and folder permissions) | medium |
+| `npx`, `uvx` and `docker` servers that run whatever version is newest | medium |
+| Filesystem servers that can read your whole home folder or disk | medium |
+| Permission rules that approve every tool of a server without asking | medium |
+| Tools on a client's auto-approve list | low |
+
+It also lists servers set up separately in several clients. That is context, not
+scored: remote servers need an entry per client.
+
+```text
+toolstile audit · local MCP config check · nothing leaves this machine
+
+Scanned 4 files from Claude Code, Cursor, Codex: 10 MCP servers.
+
+  Grade B  77/100   1 high · 1 medium · 1 low
+
+HIGH   Plaintext secret in github (Cursor)
+       A GitHub token is written directly into the config file. Anything that can
+       read the file, including backups, dotfile syncs and other tools, can use it.
+       ~/.cursor/mcp.json  mcpServers.github.env.GITHUB_PERSONAL_ACCESS_TOKEN
+       Fix: Reference an environment variable instead (for example ${API_TOKEN}) …
+```
+
+## It only reads
+
+- Reads config files on your machine. Writes nothing unless you ask for a card.
+- Makes no network requests and collects no telemetry.
+- Never prints, stores or sends secret values. Findings name the file and key,
+  for example `mcpServers.github.env.GITHUB_TOKEN`, and the kind of secret.
+- About 1,100 lines of TypeScript with one runtime dependency
+  ([smol-toml](https://github.com/squirrelchat/smol-toml), for Codex's TOML
+  config) and an optional one ([resvg-js](https://github.com/thx/resvg-js), only
+  to render `--card` as PNG). Read it before you run it.
+
+## Options
+
+```text
+--json              Print results as JSON
+--card [file]       Write a shareable grade card (default toolstile-audit.png;
+                    use a .svg name for SVG). Contains only the grade and counts.
+--redact            Hide your home folder and project paths, for posting the output
+--project <dir>     Also scan project configs in <dir> (default: current directory)
+--no-project        Scan only user-level configs
+--fail-on <level>   Exit with code 1 if any finding is at or above high, medium or low
+```
+
+`--fail-on high` makes it usable in CI or a pre-commit hook for repositories that
+check in `.mcp.json`, `.cursor/mcp.json` or `.vscode/mcp.json`.
+
+## Scoring
+
+Each distinct problem has a weight: 10 for a leaked secret, plain-http remote or
+privileged container; 4 for readable secret files, unpinned packages, broad
+filesystem access and whole-server auto-approval; 2 for each copied secret; 1 for
+auto-approved tools. A secret pasted into several files counts as one leak. The
+score is `100 / (1 + weight / 50)`: one leaked secret scores 83 (B), four score
+about 56 (D). Grades: A 90+, B 75+, C 60+, D 40+, F below 40.
+
+## Share your grade
+
+```sh
+npx toolstile audit --card
+```
+
+writes a 1200×630 image with your grade and counts (no server names, paths or
+values) and prints a ready-to-post link. To post the text report instead, add
+`--redact` so it shows `~` and `<project>` in place of your folders.
+
+## Files it reads
+
+| Client | User config | Project config |
+| --- | --- | --- |
+| Claude Code | `~/.claude.json`, `~/.claude/settings.json` | `.mcp.json`, `.claude/settings*.json` |
+| Claude Desktop | `claude_desktop_config.json` in the app's config folder | |
+| Cursor | `~/.cursor/mcp.json` | `.cursor/mcp.json` |
+| Codex | `$CODEX_HOME/config.toml` (default `~/.codex`) | `.codex/config.toml` |
+| VS Code | user `settings.json` and `mcp.json` | `.vscode/mcp.json` |
+| Windsurf | `~/.codeium/windsurf/mcp_config.json` | |
+| Gemini CLI | `~/.gemini/settings.json` | `.gemini/settings.json` |
+| Cline | `cline_mcp_settings.json` in VS Code or Cursor storage | |
+
+## Use it from code
+
+```ts
+import { audit } from "toolstile";
+
+const { grade, findings } = audit();
+```
+
+## About
+
+Built by [Akshit Kr Nagpal](https://akshit.io) as part of
+[Toolstile](https://toolstile.com), an MCP gateway that keeps upstream
+credentials off your machines and lets you choose which tools each agent can use.
+The audit works on its own and does not require a Toolstile account.
+
+Questions and reports: support@toolstile.com.
+
+## Releases
+
+Both npm packages are published by [GitHub Actions](.github/workflows/publish.yml)
+with npm trusted publishing and provenance, so each release links back to the
+commit and workflow that built it. No npm token is stored anywhere.
+
+## License
+
+[MIT](LICENSE)

package/dist/card.d.ts

@@ -0,0 +1,6 @@
+import type { AuditResult } from "./types.js";
+/** One line for posting. Contains only counts, never names, paths or values. */
+export declare function shareText(r: AuditResult): string;
+export declare const shareUrl: (r: AuditResult) => string;
+/** A 1200x630 social card. Contains only the grade and counts. */
+export declare function renderCard(r: AuditResult): string;

package/dist/card.js

@@ -0,0 +1,51 @@
+import { counts } from "./report.js";
+const GRADE_COLOR = {
+    A: "#69D5A0",
+    B: "#69D5A0",
+    C: "#F0BA7F",
+    D: "#FF92A5",
+    F: "#FF92A5",
+};
+const escape = (s) => s.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
+/** One line for posting. Contains only counts, never names, paths or values. */
+export function shareText(r) {
+    const c = counts(r.findings);
+    const parts = [
+        c.secrets && `${c.secrets} plaintext secret${c.secrets === 1 ? "" : "s"}`,
+        `${r.servers} MCP server${r.servers === 1 ? "" : "s"} across ${r.clients.length} client${r.clients.length === 1 ? "" : "s"}`,
+    ].filter(Boolean);
+    return `My AI agents' MCP setup scored ${r.grade} (${r.score}/100): ${parts.join(", ")}. Check yours: npx toolstile audit`;
+}
+export const shareUrl = (r) => `https://x.com/intent/post?text=${encodeURIComponent(shareText(r))}`;
+/** A 1200x630 social card. Contains only the grade and counts. */
+export function renderCard(r) {
+    const c = counts(r.findings);
+    const grade = r.grade ?? "–";
+    const color = GRADE_COLOR[grade] ?? "#B2BDD1";
+    const stats = [
+        [String(c.secrets), c.secrets === 1 ? "plaintext secret" : "plaintext secrets"],
+        [String(c.high), "high-risk issues"],
+        [String(r.servers), r.servers === 1 ? "MCP server" : "MCP servers"],
+        [String(r.clients.length), r.clients.length === 1 ? "AI client" : "AI clients"],
+    ];
+    const font = "'IBM Plex Sans', 'Inter', 'Helvetica Neue', Arial, sans-serif";
+    const mono = "'IBM Plex Mono', 'SFMono-Regular', Menlo, Consolas, monospace";
+    const statSvg = stats
+        .map(([value, label], i) => `
+  <g transform="translate(${560 + (i % 2) * 300}, ${250 + Math.floor(i / 2) * 150})">
+    <text font-family="${font}" font-size="64" font-weight="600" fill="#EEF2FA">${escape(value)}</text>
+    <text y="40" font-family="${font}" font-size="24" fill="#B2BDD1">${escape(label)}</text>
+  </g>`)
+        .join("");
+    return `<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="630" viewBox="0 0 1200 630">
+  <rect width="1200" height="630" fill="#0E1320"/>
+  <rect x="40" y="40" width="1120" height="550" rx="12" fill="#161D2D"/>
+  <text x="96" y="130" font-family="${font}" font-size="30" font-weight="600" fill="#EEF2FA">My AI agents' MCP config</text>
+  <text x="96" y="168" font-family="${font}" font-size="22" fill="#B2BDD1">Score ${r.score ?? "–"}/100</text>
+  <text x="96" y="470" font-family="${font}" font-size="320" font-weight="700" fill="${color}">${escape(grade)}</text>${statSvg}
+  <line x1="96" y1="520" x2="1104" y2="520" stroke="#364158"/>
+  <text x="96" y="560" font-family="${mono}" font-size="26" fill="#7D97FF">npx toolstile audit</text>
+  <text x="1104" y="560" text-anchor="end" font-family="${font}" font-size="22" fill="#B2BDD1">toolstile.com</text>
+</svg>
+`;
+}

package/dist/checks.d.ts

@@ -0,0 +1,24 @@
+import { type Discovery } from "./sources.js";
+import type { Finding, ServerEntry } from "./types.js";
+interface Package {
+    registry: "npm" | "pypi" | "docker";
+    name: string;
+    version: string | null;
+    argIndex: number;
+}
+/** Finds the package a launcher such as npx, uvx or docker runs. */
+export declare function packageOf(s: ServerEntry): Package | null;
+/** A stable identity for the same server configured in several places. */
+export declare function identityOf(s: ServerEntry): string | null;
+/** A path for a shell command: `~/...` under the home folder, single-quoted when needed. */
+export declare function shellPath(path: string, home: string): string;
+export declare function runChecks(d: Discovery, home: string): Finding[];
+/**
+ * 100 / (1 + weight / 50): one leaked secret (10) scores 83, four score about 50, and the score
+ * keeps separating bad setups from worse ones instead of bottoming out at zero.
+ */
+export declare function score(findings: Finding[]): {
+    score: number;
+    grade: string;
+};
+export {};

package/dist/checks.js

@@ -0,0 +1,343 @@
+import { createHash } from "node:crypto";
+import { posix, win32 } from "node:path";
+import { argSecrets, classify, urlSecret } from "./secrets.js";
+import { CLIENT_NAMES, pointerJoin } from "./sources.js";
+const label = (s) => `${s.name} (${CLIENT_NAMES[s.client]})`;
+const at = (s, ...keys) => ({
+    file: s.file,
+    pointer: keys.reduce(pointerJoin, s.pointer),
+});
+const hash = (v) => createHash("sha256").update(v.trim()).digest("hex");
+function secretsOf(s) {
+    const out = [];
+    const add = (value, kind, ...keys) => out.push({ server: s, location: at(s, ...keys), kind, hash: hash(value) });
+    for (const [k, v] of Object.entries(s.env)) {
+        const kind = classify(k, v);
+        if (kind)
+            add(v, kind, "env", k);
+    }
+    for (const [k, v] of Object.entries(s.headers)) {
+        const kind = classify(k, v);
+        if (kind)
+            add(v, kind, "headers", k);
+    }
+    for (const [k, v] of Object.entries(s.extraSecrets)) {
+        const kind = classify(k, v);
+        if (kind)
+            add(v, kind, k);
+    }
+    for (const { index, label: kind } of argSecrets(s.args))
+        add(s.args[index], kind, "args", String(index));
+    if (s.url) {
+        const kind = urlSecret(s.url);
+        if (kind)
+            add(s.url, kind, "url");
+    }
+    return out;
+}
+const LAUNCHERS = {
+    npx: "npm",
+    bunx: "npm",
+    pnpx: "npm",
+    uvx: "pypi",
+};
+/** Splits `command` and `args` into words, handling configs that put the whole command in one string. */
+function words(s) {
+    if (!s.command)
+        return [];
+    const command = s.args.length === 0 && /\s/.test(s.command.trim()) ? s.command.trim().split(/\s+/) : [s.command];
+    return [...command, ...s.args];
+}
+const base = (p) => win32.basename(posix.basename(p)).replace(/\.(cmd|exe)$/i, "");
+/** Finds the package a launcher such as npx, uvx or docker runs. */
+export function packageOf(s) {
+    const w = words(s);
+    if (w.length === 0)
+        return null;
+    const cmd = base(w[0]);
+    const sub = w.slice(1);
+    let registry = LAUNCHERS[cmd];
+    let skip = 0;
+    if (!registry) {
+        if (cmd === "pipx" && sub[0] === "run")
+            [registry, skip] = ["pypi", 1];
+        else if ((cmd === "pnpm" || cmd === "yarn" || cmd === "bun") && sub[0] === "dlx")
+            [registry, skip] = ["npm", 1];
+        else if (cmd === "bun" && sub[0] === "x")
+            [registry, skip] = ["npm", 1];
+        else if (cmd === "uv" && sub[0] === "tool" && sub[1] === "run")
+            [registry, skip] = ["pypi", 2];
+        else if (cmd === "docker" && sub[0] === "run")
+            [registry, skip] = ["docker", 1];
+    }
+    if (!registry)
+        return null;
+    const rest = sub.slice(skip);
+    const offset = 1 + skip;
+    // Flags that take a value; their value is not the package.
+    const valued = new Set(["-p", "--package", "--from", "--with", "-e", "--env", "-v", "--volume", "--name", "--network", "--mount", "--env-file", "-w", "--workdir", "--entrypoint", "-u", "--user", "--python"]);
+    for (let i = 0; i < rest.length; i++) {
+        const a = rest[i];
+        if (a === "--")
+            continue;
+        if (a.startsWith("-")) {
+            if (valued.has(a)) {
+                if ((a === "--package" || a === "-p" || a === "--from") && registry !== "docker") {
+                    return parsePackage(registry, rest[i + 1] ?? "", offset + i + 1);
+                }
+                i++;
+            }
+            continue;
+        }
+        return parsePackage(registry, a, offset + i);
+    }
+    return null;
+}
+function parsePackage(registry, spec, argIndex) {
+    if (!spec)
+        return null;
+    if (registry === "docker") {
+        const at = spec.indexOf("@sha256:");
+        if (at > 0)
+            return { registry, name: spec.slice(0, at), version: spec.slice(at + 1), argIndex };
+        const slash = spec.lastIndexOf("/");
+        const colon = spec.lastIndexOf(":");
+        return colon > slash
+            ? { registry, name: spec.slice(0, colon), version: spec.slice(colon + 1), argIndex }
+            : { registry, name: spec, version: null, argIndex };
+    }
+    if (registry === "pypi") {
+        const m = /^([A-Za-z0-9._\-[\],]+?)(?:(==|@|>=|~=)(.+))?$/.exec(spec);
+        if (!m)
+            return null;
+        return { registry, name: m[1], version: m[2] === "==" || m[2] === "@" ? m[3] : null, argIndex };
+    }
+    if (/^(https?:|git\+|file:|\.|\/)/.test(spec))
+        return null;
+    const at = spec.indexOf("@", spec.startsWith("@") ? 1 : 0);
+    return at > 0
+        ? { registry, name: spec.slice(0, at), version: spec.slice(at + 1), argIndex }
+        : { registry, name: spec, version: null, argIndex };
+}
+const isPinned = (p) => p.version !== null &&
+    p.version !== "latest" &&
+    p.version !== "next" &&
+    !/[\^~*xX><]/.test(p.version) &&
+    (p.registry !== "npm" || /^\d+\.\d+\.\d+/.test(p.version) || p.version.startsWith("sha"));
+/** A stable identity for the same server configured in several places. */
+export function identityOf(s) {
+    if (s.url) {
+        try {
+            const u = new URL(s.url);
+            return `url:${u.host}${u.pathname.replace(/\/+$/, "")}`;
+        }
+        catch {
+            return `url:${s.url}`;
+        }
+    }
+    const pkg = packageOf(s);
+    if (pkg)
+        return `${pkg.registry}:${pkg.name.toLowerCase()}`;
+    const w = words(s);
+    return w.length ? `cmd:${w.join(" ")}` : null;
+}
+const LOOPBACK = /^(localhost|127\.\d+\.\d+\.\d+|\[::1\]|0\.0\.0\.0)$/i;
+function broadRoots(s, home) {
+    const pkg = packageOf(s);
+    const isFs = pkg ? /server-filesystem|mcp-server-filesystem|filesystem-mcp/i.test(pkg.name) : false;
+    if (!isFs || !pkg)
+        return [];
+    const homes = new Set([home, home.replace(/\/+$/, ""), "~", "~/", "$HOME", "${HOME}", "%USERPROFILE%"]);
+    return words(s)
+        .slice(pkg.argIndex + 1)
+        .filter((a) => a === "/" || /^[A-Za-z]:\\?$/.test(a) || homes.has(a) || homes.has(a.replace(/\/+$/, "")));
+}
+const SEVERITY_ORDER = { high: 0, medium: 1, low: 2, info: 3 };
+/** Toolstile's own gateway is meant to be added to every client. */
+const TOOLSTILE = /^url:([a-z0-9-]+\.)*toolstile\.com\//i;
+/** A path for a shell command: `~/...` under the home folder, single-quoted when needed. */
+export function shellPath(path, home) {
+    const quote = (p) => (/^[\w@%+=:,./-]+$/.test(p) ? p : `'${p.replace(/'/g, "'\\''")}'`);
+    return home && path.startsWith(home + "/") ? `~/${quote(path.slice(home.length + 1))}` : quote(path);
+}
+export function runChecks(d, home) {
+    const findings = [];
+    const secrets = d.servers.flatMap(secretsOf);
+    // Plaintext secrets, grouped per server.
+    const byServer = new Map();
+    for (const s of secrets)
+        byServer.set(s.server, [...(byServer.get(s.server) ?? []), s]);
+    const counted = new Set();
+    for (const [server, list] of byServer) {
+        const fresh = new Set(list.map((s) => s.hash).filter((h) => !counted.has(h)));
+        fresh.forEach((h) => counted.add(h));
+        const kinds = [...new Set(list.map((s) => s.kind))].join(", ");
+        const one = list.length === 1;
+        const what = one ? `${/^[aeiou]/i.test(kinds) ? "An" : "A"} ${kinds} is` : `${list.length} secrets (${kinds}) are`;
+        findings.push({
+            rule: "plaintext-secret",
+            severity: "high",
+            title: `Plaintext secret in ${label(server)}`,
+            detail: `${what} written directly into the config file. Anything that can read the file, including backups, dotfile syncs and other tools, can use ${one ? "it" : "them"}.`,
+            fix: "Reference an environment variable instead (for example ${API_TOKEN}, or \"Bearer ${API_TOKEN}\" in a header), or use the server's OAuth sign-in. Rotate the secret if the file was ever shared or synced.",
+            locations: list.map((s) => s.location),
+            // A secret pasted into several files is one leak; the copies are scored by copied-secret.
+            weight: 10 * fresh.size,
+        });
+    }
+    // The same secret copied into several files.
+    const byHash = new Map();
+    for (const s of secrets)
+        byHash.set(s.hash, [...(byHash.get(s.hash) ?? []), s]);
+    for (const list of byHash.values()) {
+        const files = new Set(list.map((s) => s.location.file));
+        if (files.size < 2)
+            continue;
+        findings.push({
+            rule: "copied-secret",
+            severity: "medium",
+            title: `Same ${list[0].kind} copied into ${files.size} files`,
+            detail: `One credential is pasted into ${files.size} separate config files (${[...new Set(list.map((s) => CLIENT_NAMES[s.server.client]))].join(", ")}). Rotating or revoking it means finding every copy.`,
+            fix: "Keep one copy in your environment or keychain and reference it from each client, or route the clients through one gateway.",
+            locations: list.map((s) => s.location),
+            weight: 2,
+        });
+    }
+    // Config files that hold secrets and that other accounts on the machine can actually reach.
+    const secretFiles = new Set(secrets.map((s) => s.location.file));
+    for (const f of d.files) {
+        if (f.mode === undefined || !f.exposure || !secretFiles.has(f.path))
+            continue;
+        const [open, who] = f.exposure === "others" ? ["everyone", "every account on this machine"] : ["its group", "other accounts in that group"];
+        findings.push({
+            rule: "readable-config",
+            severity: "medium",
+            title: "Config file with secrets is readable by other accounts",
+            detail: `This file holds plaintext secrets and has permissions ${f.mode.toString(8).padStart(3, "0")}, and every folder above it is open to ${open}, so ${who} can read it.`,
+            fix: `Restrict it to your user: chmod 600 ${shellPath(f.path, home)}`,
+            locations: [{ file: f.path, pointer: "(file permissions)" }],
+            weight: 4,
+        });
+    }
+    for (const s of d.servers) {
+        if (s.url) {
+            try {
+                const u = new URL(s.url);
+                if (u.protocol === "http:" && !LOOPBACK.test(u.hostname)) {
+                    findings.push({
+                        rule: "insecure-transport",
+                        severity: "high",
+                        title: `Unencrypted remote server: ${label(s)}`,
+                        detail: `${u.host} is reached over plain http://, so requests, tool results and any credentials travel unencrypted.`,
+                        fix: "Use the server's https:// endpoint.",
+                        locations: [at(s, "url")],
+                        weight: 10,
+                    });
+                }
+            }
+            catch {
+                // Not a URL; nothing to check.
+            }
+        }
+        const pkg = packageOf(s);
+        if (pkg && !isPinned(pkg)) {
+            const where = pkg.registry === "docker" ? "image" : "package";
+            findings.push({
+                rule: "unpinned-package",
+                severity: "medium",
+                title: `Unpinned ${where}: ${label(s)}`,
+                detail: `${pkg.name}${pkg.version ? `@${pkg.version}` : ""} resolves to whatever version is newest each time the server starts, so a compromised or broken release runs with this server's access.`,
+                fix: pkg.registry === "docker"
+                    ? `Pin an image digest or exact tag, for example ${pkg.name}:<version>.`
+                    : `Pin an exact version, for example ${pkg.name}${pkg.registry === "pypi" ? "==" : "@"}<version>.`,
+                locations: [at(s, "args", String(Math.max(0, pkg.argIndex - 1)))],
+                weight: 4,
+            });
+        }
+        const w = words(s);
+        if (pkg?.registry === "docker") {
+            const risky = w.filter((a) => a === "--privileged" || /\/var\/run\/docker\.sock/.test(a) || a === "--net=host" || a === "--network=host");
+            if (risky.length) {
+                findings.push({
+                    rule: "privileged-container",
+                    severity: "high",
+                    title: `Container with host-level access: ${label(s)}`,
+                    detail: `The server runs with ${[...new Set(risky)].join(", ")}, which gives it effective control of the host.`,
+                    fix: "Remove --privileged and the Docker socket mount unless the server truly needs them.",
+                    locations: [at(s, "args")],
+                    weight: 10,
+                });
+            }
+        }
+        const roots = broadRoots(s, home);
+        if (roots.length) {
+            findings.push({
+                rule: "broad-filesystem",
+                severity: "medium",
+                title: `Filesystem server can read ${roots.includes("/") ? "the whole disk" : "your whole home folder"}: ${label(s)}`,
+                detail: `Allowed root ${roots.join(", ")} includes SSH keys, cloud credentials and every other config file.`,
+                fix: "Allow only the project folders the agent needs.",
+                locations: [at(s, "args")],
+                weight: 4,
+            });
+        }
+        if (s.autoApproved.length) {
+            findings.push({
+                rule: "auto-approved-tools",
+                severity: "low",
+                title: `${s.autoApproved.length} tool${s.autoApproved.length === 1 ? "" : "s"} run without asking: ${label(s)}`,
+                detail: `Auto-approved: ${s.autoApproved.slice(0, 6).join(", ")}${s.autoApproved.length > 6 ? ", …" : ""}. A prompt injection in any content the agent reads can call these.`,
+                fix: "Keep auto-approval to read-only tools.",
+                locations: [at(s)],
+                weight: 1,
+            });
+        }
+    }
+    for (const a of d.approvals) {
+        const all = a.subject === "mcp__*" || a.subject.startsWith("every");
+        findings.push({
+            rule: "auto-approved-tools",
+            severity: "medium",
+            title: all
+                ? `${CLIENT_NAMES[a.client]} approves ${a.subject === "mcp__*" ? "every MCP tool" : a.subject} without asking`
+                : `${CLIENT_NAMES[a.client]} runs every tool of ${a.subject.replace(/^mcp__/, "").replace(/__\*$/, "")} without asking`,
+            detail: `Permission rule ${a.subject} skips the confirmation prompt, including for write and delete tools. A prompt injection in a web page, issue or email the agent reads can call them.`,
+            fix: "Allow specific read-only tools (mcp__server__tool) instead of whole servers.",
+            locations: [a.location],
+            weight: 4,
+        });
+    }
+    // The same server configured separately in several clients. Context only: remote servers need an
+    // entry per client, and copies that carry credentials are already scored by copied-secret.
+    const byIdentity = new Map();
+    for (const s of d.servers) {
+        const id = identityOf(s);
+        if (id && !TOOLSTILE.test(id))
+            byIdentity.set(id, [...(byIdentity.get(id) ?? []), s]);
+    }
+    for (const list of byIdentity.values()) {
+        const clients = [...new Set(list.map((s) => s.client))];
+        if (clients.length < 2)
+            continue;
+        findings.push({
+            rule: "duplicated-server",
+            severity: "info",
+            title: `${list[0].name} is set up separately in ${clients.length} clients`,
+            detail: `Configured in ${clients.map((c) => CLIENT_NAMES[c]).join(", ")}. Each copy has its own settings and sign-in to keep in sync and revoke.`,
+            fix: "Nothing to fix; listed so you know where each copy lives.",
+            locations: list.map((s) => at(s)),
+            weight: 0,
+        });
+    }
+    return findings.sort((a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity]);
+}
+/**
+ * 100 / (1 + weight / 50): one leaked secret (10) scores 83, four score about 50, and the score
+ * keeps separating bad setups from worse ones instead of bottoming out at zero.
+ */
+export function score(findings) {
+    const weight = findings.reduce((n, f) => n + f.weight, 0);
+    const total = Math.round(100 / (1 + weight / 50));
+    const grade = total >= 90 ? "A" : total >= 75 ? "B" : total >= 60 ? "C" : total >= 40 ? "D" : "F";
+    return { score: total, grade };
+}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};