toolstile 0.0.0-stage → 0.1.1

package/dist/cli.js

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+import { renderCard, shareText, shareUrl } from "./card.js";
+import { audit } from "./index.js";
+import { redact, renderJson, renderReport, style } from "./report.js";
+const HELP = `toolstile: audit the MCP server configs your AI agents use
+
+Usage
+  npx toolstile audit [options]
+
+Checks Claude Code, Claude Desktop, Cursor, Codex, VS Code, Windsurf,
+Gemini CLI and Cline configs for plaintext secrets, credentials copied
+between clients, unpinned packages, auto-approved tools, broad
+filesystem access and unencrypted remote servers.
+
+It only reads files. It sends nothing over the network and never
+prints secret values.
+
+Options
+  --json              Print results as JSON
+  --card [file]       Write a shareable grade card (default toolstile-audit.png;
+                      use a .svg name for SVG). Contains only the grade and counts.
+  --redact            Hide your home folder and project paths, for posting the output
+  --project <dir>     Also scan project configs in <dir> (default: current directory)
+  --no-project        Scan only user-level configs
+  --fail-on <level>   Exit with code 1 if any finding is at or above high, medium or low
+  -h, --help          Show this help
+  -v, --version       Show the version
+`;
+function version() {
+    const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    return pkg.version;
+}
+function parseArgs(argv) {
+    const args = { json: false, redact: false, card: null, project: process.cwd(), failOn: null };
+    const rest = [...argv];
+    if (rest[0] === "audit")
+        rest.shift();
+    for (let i = 0; i < rest.length; i++) {
+        const a = rest[i];
+        const [flag, inline] = a.startsWith("--") && a.includes("=") ? [a.slice(0, a.indexOf("=")), a.slice(a.indexOf("=") + 1)] : [a, undefined];
+        const value = () => {
+            const v = inline ?? rest[++i];
+            if (v === undefined || v.startsWith("-"))
+                throw new Error(`${flag} needs a value`);
+            return v;
+        };
+        switch (flag) {
+            case "-h":
+            case "--help":
+            case "help":
+                return "help";
+            case "-v":
+            case "--version":
+                return "version";
+            case "--json":
+                args.json = true;
+                break;
+            case "--redact":
+                args.redact = true;
+                break;
+            case "--card": {
+                const next = inline ?? rest[i + 1];
+                if (next !== undefined && !next.startsWith("-")) {
+                    args.card = next;
+                    if (inline === undefined)
+                        i++;
+                }
+                else {
+                    args.card = "toolstile-audit.png";
+                }
+                break;
+            }
+            case "--project":
+                args.project = resolve(value());
+                break;
+            case "--no-project":
+                args.project = null;
+                break;
+            case "--fail-on": {
+                const v = value();
+                if (v !== "high" && v !== "medium" && v !== "low")
+                    throw new Error("--fail-on must be high, medium or low");
+                args.failOn = v;
+                break;
+            }
+            default:
+                throw new Error(`Unknown option: ${a}`);
+        }
+    }
+    return args;
+}
+async function writeCard(path, svg) {
+    if (path.toLowerCase().endsWith(".svg")) {
+        writeFileSync(path, svg);
+        return path;
+    }
+    try {
+        const { Resvg } = await import("@resvg/resvg-js");
+        const png = new Resvg(svg, { font: { loadSystemFonts: true, defaultFontFamily: "Helvetica" } }).render().asPng();
+        writeFileSync(path, png);
+        return path;
+    }
+    catch {
+        // The optional PNG renderer is unavailable on this platform; fall back to SVG.
+        const fallback = path.replace(/\.[^./\\]+$/, "") + ".svg";
+        writeFileSync(fallback, svg);
+        return fallback;
+    }
+}
+const RANK = { high: 3, medium: 2, low: 1, info: 0 };
+async function main() {
+    let args;
+    try {
+        args = parseArgs(process.argv.slice(2));
+    }
+    catch (error) {
+        process.stderr.write(`${error.message}\n\n${HELP}`);
+        return 2;
+    }
+    if (args === "help") {
+        process.stdout.write(HELP);
+        return 0;
+    }
+    if (args === "version") {
+        process.stdout.write(`${version()}\n`);
+        return 0;
+    }
+    const home = homedir();
+    const raw = audit({ home, cwd: args.project });
+    const result = args.redact ? redact(raw, home, args.project) : raw;
+    const color = !args.json && process.stdout.isTTY === true && !process.env.NO_COLOR;
+    const s = style(color);
+    if (args.json)
+        process.stdout.write(renderJson(result));
+    else
+        process.stdout.write(renderReport(result, home, s, args.redact));
+    if (args.card) {
+        if (result.grade === null) {
+            process.stderr.write("No MCP servers found, so there is no grade to put on a card.\n");
+        }
+        else {
+            const written = await writeCard(resolve(args.card), renderCard(result));
+            const out = args.json ? process.stderr : process.stdout;
+            out.write(`Card written to ${written}\n\n${shareText(result)}\n\nPost it: ${shareUrl(result)}\n`);
+        }
+    }
+    if (args.failOn) {
+        const threshold = RANK[args.failOn];
+        if (result.findings.some((f) => RANK[f.severity] >= threshold))
+            return 1;
+    }
+    return 0;
+}
+main().then((code) => process.exit(code), (error) => {
+    process.stderr.write(`toolstile: ${error.stack ?? String(error)}\n`);
+    process.exit(2);
+});

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+import { type ScanOptions } from "./sources.js";
+import type { AuditResult } from "./types.js";
+export type { AuditResult, ClientId, Finding, Location, Severity } from "./types.js";
+export type { ScanOptions } from "./sources.js";
+/** Scans local MCP client configs and returns findings. Reads files only; never writes or sends anything. */
+export declare function audit(options?: Partial<ScanOptions>): AuditResult;

package/dist/index.js

@@ -0,0 +1,25 @@
+import { homedir } from "node:os";
+import { runChecks, score } from "./checks.js";
+import { discover } from "./sources.js";
+/** Scans local MCP client configs and returns findings. Reads files only; never writes or sends anything. */
+export function audit(options = {}) {
+    const opts = {
+        home: options.home ?? homedir(),
+        cwd: options.cwd === undefined ? process.cwd() : options.cwd,
+        platform: options.platform ?? process.platform,
+        env: options.env ?? process.env,
+    };
+    const d = discover(opts);
+    const findings = runChecks(d, opts.home);
+    const clients = [...new Set(d.files.map((f) => f.client))];
+    const graded = d.servers.length > 0 || findings.length > 0 ? score(findings) : null;
+    return {
+        files: d.files.map((f) => ({ client: f.client, path: f.path })),
+        unreadable: d.unreadable,
+        servers: d.servers.length,
+        clients,
+        findings,
+        score: graded?.score ?? null,
+        grade: graded?.grade ?? null,
+    };
+}

package/dist/parse.d.ts

@@ -0,0 +1,3 @@
+/** Parses JSON that may contain comments and trailing commas (VS Code style). */
+export declare function parseJsonc(text: string): unknown;
+export declare function parseConfig(path: string, text: string): unknown;

package/dist/parse.js

@@ -0,0 +1,76 @@
+import { parse as parseToml } from "smol-toml";
+/** Parses JSON that may contain comments and trailing commas (VS Code style). */
+export function parseJsonc(text) {
+    let out = "";
+    let inString = false;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        const next = text[i + 1];
+        if (inString) {
+            out += ch;
+            if (ch === "\\") {
+                out += next ?? "";
+                i++;
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            out += ch;
+        }
+        else if (ch === "/" && next === "/") {
+            while (i < text.length && text[i] !== "\n")
+                i++;
+            out += "\n";
+        }
+        else if (ch === "/" && next === "*") {
+            i += 2;
+            while (i < text.length && !(text[i] === "*" && text[i + 1] === "/"))
+                i++;
+            i++;
+        }
+        else {
+            out += ch;
+        }
+    }
+    return JSON.parse(stripTrailingCommas(out));
+}
+function stripTrailingCommas(text) {
+    let out = "";
+    let inString = false;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (inString) {
+            out += ch;
+            if (ch === "\\") {
+                out += text[i + 1] ?? "";
+                i++;
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        if (ch === ",") {
+            let j = i + 1;
+            while (j < text.length && /\s/.test(text[j]))
+                j++;
+            if (text[j] === "}" || text[j] === "]")
+                continue;
+        }
+        out += ch;
+    }
+    return out;
+}
+export function parseConfig(path, text) {
+    if (path.endsWith(".toml"))
+        return parseToml(text);
+    if (text.trim() === "")
+        return {};
+    return parseJsonc(text);
+}

package/dist/report.d.ts

@@ -0,0 +1,24 @@
+import type { AuditResult, Finding, Severity } from "./types.js";
+export interface Style {
+    bold(s: string): string;
+    dim(s: string): string;
+    sev(sev: Severity, s: string): string;
+    grade(grade: string, s: string): string;
+}
+export declare function style(color: boolean): Style;
+export declare const tildify: (path: string, home: string) => string;
+export declare function counts(findings: Finding[]): {
+    high: number;
+    medium: number;
+    low: number;
+    info: number;
+    secrets: number;
+};
+/**
+ * Returns a copy safe to post publicly: the home folder becomes `~`, the scanned project folder
+ * becomes `<project>`, and project paths inside pointers (Claude Code's `projects["/path"]`) are hidden.
+ */
+export declare function redact(r: AuditResult, home: string, project: string | null): AuditResult;
+export declare function renderReport(r: AuditResult, home: string, s: Style, redacted?: boolean): string;
+/** JSON output for scripts. Paths are included unless redacted; secret values never are. */
+export declare function renderJson(r: AuditResult): string;

package/dist/report.js

@@ -0,0 +1,106 @@
+import { CLIENT_NAMES } from "./sources.js";
+export function style(color) {
+    const wrap = (open, close) => (s) => (color ? `\x1b[${open}m${s}\x1b[${close}m` : s);
+    const red = wrap(31, 39);
+    const yellow = wrap(33, 39);
+    const blue = wrap(34, 39);
+    const green = wrap(32, 39);
+    const dim = wrap(2, 22);
+    return {
+        bold: wrap(1, 22),
+        dim,
+        sev: (sev, s) => (sev === "high" ? red(s) : sev === "medium" ? yellow(s) : sev === "low" ? blue(s) : dim(s)),
+        grade: (g, s) => (g === "A" || g === "B" ? green(s) : g === "C" ? yellow(s) : red(s)),
+    };
+}
+export const tildify = (path, home) => home && (path === home || path.startsWith(home + "/") || path.startsWith(home + "\\")) ? "~" + path.slice(home.length) : path;
+const plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+export function counts(findings) {
+    return {
+        high: findings.filter((f) => f.severity === "high").length,
+        medium: findings.filter((f) => f.severity === "medium").length,
+        low: findings.filter((f) => f.severity === "low").length,
+        info: findings.filter((f) => f.severity === "info").length,
+        secrets: findings.filter((f) => f.rule === "plaintext-secret").reduce((n, f) => n + f.locations.length, 0),
+    };
+}
+/**
+ * Returns a copy safe to post publicly: the home folder becomes `~`, the scanned project folder
+ * becomes `<project>`, and project paths inside pointers (Claude Code's `projects["/path"]`) are hidden.
+ */
+export function redact(r, home, project) {
+    const scrub = (text) => {
+        let out = text.replace(/projects\["(?:[^"\\]|\\.)*"\]/g, 'projects["…"]');
+        if (project)
+            out = out.split(project).join("<project>");
+        if (home)
+            out = out.split(home).join("~");
+        return out;
+    };
+    return {
+        ...r,
+        files: r.files.map((f) => ({ ...f, path: scrub(f.path) })),
+        unreadable: r.unreadable.map((u) => ({ ...u, path: scrub(u.path), error: scrub(u.error) })),
+        findings: r.findings.map((f) => ({
+            ...f,
+            title: scrub(f.title),
+            detail: scrub(f.detail),
+            fix: scrub(f.fix),
+            locations: f.locations.map((l) => ({ file: scrub(l.file), pointer: scrub(l.pointer) })),
+        })),
+    };
+}
+export function renderReport(r, home, s, redacted = false) {
+    const lines = [];
+    lines.push("", `${s.bold("toolstile audit")} ${s.dim("· local MCP config check · nothing leaves this machine")}`, "");
+    if (r.files.length === 0 && r.unreadable.length === 0) {
+        lines.push("No MCP client configs found.", s.dim("Looked for Claude Code, Claude Desktop, Cursor, Codex, VS Code, Windsurf, Gemini CLI and Cline."), "");
+        return lines.join("\n");
+    }
+    const clientList = r.clients.map((c) => CLIENT_NAMES[c]).join(", ");
+    lines.push(`Scanned ${plural(r.files.length, "file")} from ${clientList}: ${plural(r.servers, "MCP server")}.`);
+    for (const u of r.unreadable) {
+        lines.push(s.dim(`Skipped ${tildify(u.path, home)} (${CLIENT_NAMES[u.client]}): could not parse it.`));
+    }
+    lines.push("");
+    if (r.grade !== null) {
+        const c = counts(r.findings);
+        const parts = [
+            c.high && s.sev("high", `${c.high} high`),
+            c.medium && s.sev("medium", `${c.medium} medium`),
+            c.low && s.sev("low", `${c.low} low`),
+        ].filter(Boolean);
+        const summary = parts.length ? parts.join(s.dim(" · ")) : "no issues found";
+        lines.push(`  ${s.bold(s.grade(r.grade, `Grade ${r.grade}`))}  ${s.dim(`${r.score}/100`)}   ${summary}`, "");
+    }
+    const issues = r.findings.filter((f) => f.severity !== "info");
+    const info = r.findings.filter((f) => f.severity === "info");
+    for (const f of issues) {
+        const tag = s.sev(f.severity, f.severity.toUpperCase().padEnd(6));
+        lines.push(`${tag} ${s.bold(f.title)}`);
+        lines.push(`       ${f.detail}`);
+        const shown = f.locations.slice(0, 5);
+        for (const l of shown)
+            lines.push(s.dim(`       ${tildify(l.file, home)}  ${l.pointer}`));
+        if (f.locations.length > shown.length)
+            lines.push(s.dim(`       … and ${f.locations.length - shown.length} more`));
+        lines.push(`       ${s.dim("Fix:")} ${f.fix}`, "");
+    }
+    if (info.length) {
+        lines.push(s.dim("Also set up in more than one client (not scored):"));
+        for (const f of info)
+            lines.push(s.dim(`  ${f.title.replace(/ is set up separately in (\d+) clients$/, "")}: ${f.detail.split(".")[0].replace(/^Configured in /, "")}`));
+        lines.push("");
+    }
+    lines.push(s.dim("Secret values are never printed."));
+    if (!redacted)
+        lines.push(s.dim("Posting this? Run with --redact to hide your paths, or --card for an image with only the grade."));
+    else
+        lines.push(s.dim("Share an image with only the grade: npx toolstile audit --card"));
+    lines.push(s.dim("Keep credentials off your machines and control each agent's tools: https://toolstile.com/?ref=cli"), "");
+    return lines.join("\n");
+}
+/** JSON output for scripts. Paths are included unless redacted; secret values never are. */
+export function renderJson(r) {
+    return JSON.stringify(r, null, 2) + "\n";
+}

package/dist/secrets.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Secret detection. Values are only classified here; callers never print them.
+ */
+/** True for `${VAR}`, `${env:VAR}`, `$VAR`, `%VAR%` and `{env:VAR}` references. */
+export declare function isReference(value: string): boolean;
+/** Returns a label for a known secret format in `value`, or null. */
+export declare function matchPattern(value: string): string | null;
+/**
+ * Classifies a literal value stored under `key`. Returns a label such as "GitHub token"
+ * when it looks like a credential written into the file, or null.
+ */
+export declare function classify(key: string, value: string): string | null;
+export declare function urlSecret(url: string): string | null;
+/** Finds credentials passed as command-line arguments, e.g. `--api-key VALUE` or `--token=VALUE`. */
+export declare function argSecrets(args: string[]): {
+    index: number;
+    label: string;
+}[];

package/dist/secrets.js

@@ -0,0 +1,122 @@
+/**
+ * Secret detection. Values are only classified here; callers never print them.
+ */
+const PATTERNS = [
+    [/\bgithub_pat_[A-Za-z0-9_]{40,}/, "GitHub token"],
+    [/\bgh[pousr]_[A-Za-z0-9]{30,}/, "GitHub token"],
+    [/\bglpat-[A-Za-z0-9_-]{20,}/, "GitLab token"],
+    [/\bsk-ant-[A-Za-z0-9_-]{20,}/, "Anthropic API key"],
+    [/\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{32,}/, "OpenAI API key"],
+    [/\bxox[abposr]-[A-Za-z0-9-]{10,}/, "Slack token"],
+    [/\bxapp-[A-Za-z0-9-]{10,}/, "Slack token"],
+    [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/, "AWS access key"],
+    [/\bAIza[0-9A-Za-z_-]{35}/, "Google API key"],
+    [/\blin_(?:api|oauth)_[A-Za-z0-9]{30,}/, "Linear API key"],
+    [/\b(?:ntn_[A-Za-z0-9]{40,}|secret_[A-Za-z0-9]{40,})/, "Notion token"],
+    [/\b[sr]k_(?:live|test)_[A-Za-z0-9]{20,}/, "Stripe key"],
+    [/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/, "SendGrid key"],
+    [/\bnpm_[A-Za-z0-9]{36}\b/, "npm token"],
+    [/\bsntr[ysu]_[A-Za-z0-9_=-]{30,}/, "Sentry token"],
+    [/\bdop_v1_[a-f0-9]{64}\b/, "DigitalOcean token"],
+    [/\bhf_[A-Za-z0-9]{30,}/, "Hugging Face token"],
+    [/\bfig[dhu]_[A-Za-z0-9_-]{30,}/, "Figma token"],
+    [/\bpplx-[A-Za-z0-9]{40,}/, "Perplexity API key"],
+    [/\bgsk_[A-Za-z0-9]{40,}/, "Groq API key"],
+    [/\bATATT3[A-Za-z0-9_=-]{40,}/, "Atlassian API token"],
+    [/\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}\b/, "Shopify token"],
+    [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "private key"],
+    [/\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/, "JWT"],
+    [/\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s@/]{3,}@/i, "password in connection string"],
+];
+const SECRET_KEY = /(token|secret|passw(or)?d|passwd|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret|credential|auth|bearer|session|cookie|\bpat\b|_pat$|^pat_)/i;
+/** Key suffixes that name configuration about a secret rather than the secret itself. */
+const NOT_SECRET_KEY = /(url|uri|endpoint|host|port|path|file|dir|type|mode|enabled|header|name|user(name)?|id|region|scope|scopes|method|env_var|_var)$/i;
+const PLACEHOLDER = /^(<.*>|\{.*\}|\[.*\]|x{4,}|\*{3,}|\.{3,}|your[-_ ].*|change[-_ ]?me|todo|placeholder|example|redacted|none|null|undefined|true|false|test|secret|token)$/i;
+/** True for `${VAR}`, `${env:VAR}`, `$VAR`, `%VAR%` and `{env:VAR}` references. */
+export function isReference(value) {
+    const v = value.trim();
+    return /^(Bearer\s+|Basic\s+|token\s+)?(\$\{[^}]+\}|\$[A-Za-z_][A-Za-z0-9_]*|%[A-Za-z_][A-Za-z0-9_]*%|\{env:[^}]+\})$/.test(v);
+}
+/** Returns a label for a known secret format in `value`, or null. */
+export function matchPattern(value) {
+    for (const [re, label] of PATTERNS)
+        if (re.test(value))
+            return label;
+    return null;
+}
+/**
+ * Classifies a literal value stored under `key`. Returns a label such as "GitHub token"
+ * when it looks like a credential written into the file, or null.
+ */
+export function classify(key, value) {
+    const v = value.trim();
+    if (!v || isReference(v))
+        return null;
+    const known = matchPattern(v);
+    if (known)
+        return known;
+    if (/^authorization$/i.test(key) || /^(Bearer|Basic|token)\s+\S{8,}$/i.test(v)) {
+        return isReference(v) ? null : "authorization header";
+    }
+    if (!SECRET_KEY.test(key) || NOT_SECRET_KEY.test(key))
+        return null;
+    if (v.length < 8 || PLACEHOLDER.test(v) || /\s/.test(v) || /^https?:\/\//i.test(v))
+        return null;
+    if (/^\d+$/.test(v) || /^(\/|~\/|\.\/|[A-Za-z]:\\)/.test(v))
+        return null;
+    return "credential";
+}
+/** URL query parameters that carry credentials. */
+const URL_SECRET_PARAM = /^(token|access_token|api[_-]?key|apikey|key|secret|auth|password|pat|sig|signature)$/i;
+export function urlSecret(url) {
+    const known = matchPattern(url);
+    if (known)
+        return known;
+    try {
+        const parsed = new URL(url);
+        if (parsed.password)
+            return "password in URL";
+        for (const [k, v] of parsed.searchParams) {
+            if (URL_SECRET_PARAM.test(k) && v.length >= 8 && !isReference(v))
+                return "credential in URL query";
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+/** Finds credentials passed as command-line arguments, e.g. `--api-key VALUE` or `--token=VALUE`. */
+export function argSecrets(args) {
+    const out = [];
+    args.forEach((arg, i) => {
+        const eq = /^--?([A-Za-z0-9_-]+)=(.+)$/.exec(arg);
+        if (eq) {
+            const label = classify(eq[1], eq[2]);
+            if (label)
+                out.push({ index: i, label });
+            return;
+        }
+        // `docker run -e KEY=VALUE` and similar.
+        const assign = /^([A-Za-z_][A-Za-z0-9_]*)=(.+)$/.exec(arg);
+        if (assign) {
+            const label = classify(assign[1], assign[2]);
+            if (label)
+                out.push({ index: i, label });
+            return;
+        }
+        const prev = args[i - 1];
+        const flag = prev && /^--?([A-Za-z0-9_-]+)$/.exec(prev);
+        if (flag) {
+            const label = classify(flag[1], arg);
+            if (label) {
+                out.push({ index: i, label });
+                return;
+            }
+        }
+        const known = matchPattern(arg);
+        if (known)
+            out.push({ index: i, label: known });
+    });
+    return out;
+}

package/dist/sources.d.ts

@@ -0,0 +1,27 @@
+import type { ApprovalSetting, ClientId, ConfigFile, ServerEntry } from "./types.js";
+export interface ScanOptions {
+    home: string;
+    /** Project directory whose checked-in configs are also scanned; `null` skips it. */
+    cwd: string | null;
+    platform: NodeJS.Platform;
+    env: Record<string, string | undefined>;
+}
+export declare const CLIENT_NAMES: Record<ClientId, string>;
+/** Appends a key to a pointer, quoting keys that are not plain identifiers. */
+export declare function pointerJoin(base: string, key: string): string;
+/**
+ * Who besides the owner can read a file, given its mode and the modes of every folder above it.
+ * A group or other user needs read on the file and execute (traverse) on each folder.
+ */
+export declare function exposureOf(fileMode: number, ancestorModes: number[]): "group" | "others" | null;
+export interface Discovery {
+    files: ConfigFile[];
+    unreadable: {
+        client: ClientId;
+        path: string;
+        error: string;
+    }[];
+    servers: ServerEntry[];
+    approvals: ApprovalSetting[];
+}
+export declare function discover(opts: ScanOptions): Discovery;