agentcheckup 0.4.0__tar.gz → 0.4.2__tar.gz

{agentcheckup-0.4.0 → agentcheckup-0.4.2}/.github/workflows/publish.yml

@@ -13,10 +13,8 @@ name: Publish
 #     Environment       : pypi
 
 on:
-  # Re-enable the release trigger once the PyPI pending publisher exists:
-  #   on: release: types: [published]
-  # Until then a release would run this and fail with "environment: MISSING",
-  # which is noise on the repository home page.
+  release:
+    types: [published]
   workflow_dispatch:
 
 permissions:

{agentcheckup-0.4.0 → agentcheckup-0.4.2}/CHANGELOG.md

@@ -9,6 +9,49 @@ new ids, and removing a rule is a breaking change.
 
 ## [Unreleased]
 
+## [0.4.2] - 2026-11-07
+
+Three claims the tool made that it had not earned. All were found by an external
+review of the README and the report text, not by a bug report.
+
+### Fixed
+
+- **`AGT201` no longer asserts what the client does.** The hint said "the client
+  keeps one and the other is unreachable". No client was ever tested; the
+  behaviour differs between clients and some namespace the tools instead. The
+  message now says the call can reach either one and that clients resolve it
+  differently, which is true without a test.
+- **README no longer claims "No network calls, ever."** agentcheckup makes none
+  of its own, but `audit` starts every server in your config, and those processes
+  can do whatever they were written to do. The claim now names that boundary and
+  points at `--no-spawn`.
+- **README said 27 config locations; there are 26.** Both languages.
+
+## [0.4.1] - 2026-11-07
+
+Both fixes came out of an external fact-check of the project, not from a bug
+report: the repository has no users yet, so nothing surfaced them in the field.
+
+### Fixed
+
+- **`AGT105` was used by two unrelated rules.** "Server did not return a tool
+  list" (suite) and "Remote server uses plain HTTP" (config) shared the id, with
+  different severities. Rule ids are the tool's public API — people put them in
+  suppression lists — so two checks under one name is worse than either check
+  being wrong. The config rule is now `AGT108`; `AGT105` keeps the meaning every
+  document and the README already gave it.
+- **README pointed the GitHub Action at `@v0.3.0`**, a tag that no longer exists.
+  Anyone copying the snippet got a resolution failure. Now `@v0.4.1`.
+- `docs/rules.md` listed `AGT105` twice and described the suite rule as a
+  warning when it had been downgraded to info.
+
+### Added
+
+- `tests/test_registry.py`: ids are unique across all three registries, well
+  formed, and — for every rule that constructs its own `Finding` — the severity
+  emitted matches the severity registered. That last check is the one that would
+  have caught the duplicate before it shipped.
+
 ## [0.4.0] - 2026-11-07
 
 Calibration release, driven by the first run against real servers rather than

{agentcheckup-0.4.0 → agentcheckup-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentcheckup
-Version: 0.4.0
+Version: 0.4.2
 Summary: Diagnose your agent setup: tool conflicts, risky config, context budget.
 Project-URL: Homepage, https://github.com/wanjiaqing/agentcheckup
 Project-URL: Issues, https://github.com/wanjiaqing/agentcheckup/issues
@@ -114,7 +114,7 @@ no network calls. It reads JSON, starts processes, prints text.
 agentcheckup
 ```
 
-Finds your configs automatically — 27 known locations across Claude Desktop,
+Finds your configs automatically — 26 known locations across Claude Desktop,
 Claude Code (including its per-project `mcpServers`), Cursor, VS Code, Cline,
 Roo Code, Kilo Code, Windsurf, Zed, Codex CLI and Continue, plus project-local
 `.mcp.json` / `.cursor/mcp.json` / `.vscode/mcp.json` — starts each server,
@@ -149,7 +149,7 @@ The fastest way to keep a manifest from regressing, and the version you pin is
 the version you run — the action installs from its own checkout.
 
 ```yaml
-- uses: wanjiaqing/agentcheckup@v0.3.0
+- uses: wanjiaqing/agentcheckup@v0.4.2
   with:
     config: .mcp.json
     fail-on: warning
@@ -238,8 +238,9 @@ rule. A report nobody can read is a report nobody acts on.
   to ignore the output.
 - **Degrade, don't die.** A server that will not start is one finding, not an
   aborted run.
-- **No network calls, ever.** Your config never leaves the machine. This is the
-  one thing a commercial scanner structurally cannot promise.
+- **No network calls of its own.** No telemetry, no API, no upload; your config
+  never leaves the machine. It does *start* the servers you configured, and those
+  can do whatever they were written to do — `--no-spawn` skips that entirely.
 - **Heuristics are labelled as heuristics.** `info` means "a human should
   decide". The score is a conversation starter, not a certification.
 

{agentcheckup-0.4.0 → agentcheckup-0.4.2}/README.md

@@ -86,7 +86,7 @@ no network calls. It reads JSON, starts processes, prints text.
 agentcheckup
 ```
 
-Finds your configs automatically — 27 known locations across Claude Desktop,
+Finds your configs automatically — 26 known locations across Claude Desktop,
 Claude Code (including its per-project `mcpServers`), Cursor, VS Code, Cline,
 Roo Code, Kilo Code, Windsurf, Zed, Codex CLI and Continue, plus project-local
 `.mcp.json` / `.cursor/mcp.json` / `.vscode/mcp.json` — starts each server,
@@ -121,7 +121,7 @@ The fastest way to keep a manifest from regressing, and the version you pin is
 the version you run — the action installs from its own checkout.
 
 ```yaml
-- uses: wanjiaqing/agentcheckup@v0.3.0
+- uses: wanjiaqing/agentcheckup@v0.4.2
   with:
     config: .mcp.json
     fail-on: warning
@@ -210,8 +210,9 @@ rule. A report nobody can read is a report nobody acts on.
   to ignore the output.
 - **Degrade, don't die.** A server that will not start is one finding, not an
   aborted run.
-- **No network calls, ever.** Your config never leaves the machine. This is the
-  one thing a commercial scanner structurally cannot promise.
+- **No network calls of its own.** No telemetry, no API, no upload; your config
+  never leaves the machine. It does *start* the servers you configured, and those
+  can do whatever they were written to do — `--no-spawn` skips that entirely.
 - **Heuristics are labelled as heuristics.** `info` means "a human should
   decide". The score is a conversation starter, not a certification.
 

{agentcheckup-0.4.0 → agentcheckup-0.4.2}/README.zh-CN.md

@@ -155,7 +155,8 @@ agentcheckup rules                              # 列出全部规则
 - **规则编号永久不变。** `AGT201` 的含义永远不变。
 - **每条发现都带修法。** 只说「这不好」的规则，训练用户忽略输出。
 - **降级而不是崩溃。** 起不来的 server 是一条发现，不是中断。
-- **永不联网。** 你的配置不会离开本机。这是商业扫描器结构上给不了的承诺。
+- **自己不联网。** 没有遥测、没有 API、不上传任何东西，配置不会离开本机。
+  但它会**启动你配置的 server**，那些进程会做什么取决于它们自己——`--no-spawn` 可完全跳过。
 - **启发式要标明是启发式。** `info` 的意思是「人来判断」。分数是讨论起点，不是认证。
 
 ## 这不是什么

{agentcheckup-0.4.0 → agentcheckup-0.4.2}/docs/rules.md

@@ -163,9 +163,6 @@ also defeats the escaping the client already did.
 Granting the filesystem root gives the agent read-write access to everything. One
 prompt injection is then enough to reach SSH keys and browser profiles.
 
-### AGT105 · warning · Remote server uses plain HTTP
-Tool calls carry your data, often your credentials.
-
 ### AGT106 · error · Config passes a permission-bypass flag
 `--dangerously-skip-permissions`, `--yolo`, `--allow-all`, `--no-sandbox`. These
 disable the only confirmation step between the model and your disk.
@@ -174,11 +171,14 @@ disable the only confirmation step between the model and your disk.
 Config files get committed, screenshotted and pasted into issues. Reference an
 env var instead.
 
+### AGT108 · warning · Remote server uses plain HTTP
+Tool calls carry your data, often your credentials, over an unencrypted link.
+
 ### AGT105 · info · Server did not return a tool list
 The server failed to start, timed out, or is a remote `url` endpoint that cannot
 be introspected over stdio.
 
-This is a warning rather than an error on purpose: one broken server must not
+This is info rather than an error on purpose: one broken server must not
 stop you auditing the other four. But an unreachable server is also an unaudited
 one — its tools were never checked for conflicts.
 

{agentcheckup-0.4.0 → agentcheckup-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentcheckup"
-version = "0.4.0"
+version = "0.4.2"
 description = "Diagnose your agent setup: tool conflicts, risky config, context budget."
 readme = "README.md"
 requires-python = ">=3.10"

{agentcheckup-0.4.0 → agentcheckup-0.4.2}/src/agentcheckup/conflicts.py

@@ -187,7 +187,8 @@ def detect_conflicts(
         name_a = a.tool.name.lower()
         name_b = b.tool.name.lower()
 
-        # Hard collision: identical names, different servers. One is unreachable.
+        # Hard collision: identical names, different servers. What the client
+        # does about it varies, so the message must not promise a specific outcome.
         if name_a == name_b:
             conflicts.append(
                 Conflict(
@@ -201,8 +202,9 @@ def detect_conflicts(
                         f"'{a.server}' and '{b.server}'."
                     ),
                     hint=(
-                        "Hard collision: the client keeps one and the other is "
-                        "unreachable. Rename one, or use a gateway that prefixes."
+                        "Two servers expose the same name and clients resolve that "
+                        "differently, so the same call can reach either one. Rename "
+                        "one, or use a gateway that prefixes."
                     ),
                 )
             )

{agentcheckup-0.4.0 → agentcheckup-0.4.2}/src/agentcheckup/report.py

@@ -10,7 +10,7 @@ from . import rules as _rules
 from .engine import Report
 from .models import Finding, Severity
 
-__version__ = "0.4.0"
+__version__ = "0.4.2"
 
 SARIF_LEVEL = {
     Severity.ERROR: "error",

{agentcheckup-0.4.0 → agentcheckup-0.4.2}/src/agentcheckup/rules/config_rules.py

@@ -132,12 +132,12 @@ def broad_fs_root(server: ServerConfig):
     return None
 
 
-@config_rule("AGT105", Severity.WARNING, "Remote server uses plain HTTP")
+@config_rule("AGT108", Severity.WARNING, "Remote server uses plain HTTP")
 def insecure_url(server: ServerConfig):
     """Tool calls carry your data and often your credentials."""
     if server.url and server.url.lower().startswith("http://"):
         return Finding(
-            rule="AGT105",
+            rule="AGT108",
             severity=Severity.WARNING,
             message=f"Server {server.name!r} uses an unencrypted http:// endpoint.",
             tool=server.name,

agentcheckup-0.4.2/tests/test_registry.py

@@ -0,0 +1,77 @@
+"""Guards on the rule registry itself.
+
+Rule ids are the public API of this tool: people put them in suppression lists,
+CI thresholds and issue reports. A duplicate id silently gives two unrelated
+checks the same name, which is worse than either check being wrong.
+
+This file exists because that happened: `AGT105` was used for both "server did
+not return a tool list" (suite) and "remote server uses plain HTTP" (config).
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import pytest
+
+from agentcheckup.rules import CONFIG_RULES, SUITE_RULES, TOOL_RULES
+
+SRC = Path(__file__).resolve().parents[1] / "src" / "agentcheckup"
+
+ALL_RULES = [*TOOL_RULES, *SUITE_RULES, *CONFIG_RULES]
+
+
+def test_rule_ids_are_unique():
+    ids = [rule.id for rule in ALL_RULES]
+    duplicates = {rule_id for rule_id in ids if ids.count(rule_id) > 1}
+    assert not duplicates, f"duplicate rule ids: {sorted(duplicates)}"
+
+
+def test_rule_ids_are_well_formed():
+    for rule in ALL_RULES:
+        assert re.fullmatch(r"AGT\d{3}", rule.id), rule.id
+
+
+def test_every_rule_has_a_title():
+    for rule in ALL_RULES:
+        assert rule.title.strip(), f"{rule.id} has no title"
+
+
+def test_no_rule_is_registered_twice_across_groups():
+    """A tool rule and a config rule must not share an id either."""
+    groups = {
+        "tool": {r.id for r in TOOL_RULES},
+        "suite": {r.id for r in SUITE_RULES},
+        "config": {r.id for r in CONFIG_RULES},
+    }
+    for a, left in groups.items():
+        for b, right in groups.items():
+            if a >= b:
+                continue
+            overlap = left & right
+            assert not overlap, f"{a} and {b} share {sorted(overlap)}"
+
+
+@pytest.mark.parametrize("rule", ALL_RULES, ids=lambda r: r.id)
+def test_emitted_severity_matches_the_registry(rule):
+    """Catch a rule whose Finding says WARNING while the registry says INFO.
+
+    Without this, a severity change in one place silently disagrees with the
+    other, and the report and the score stop matching the docs.
+    """
+    pattern = re.compile(
+        r'rule="' + re.escape(rule.id) + r'",\s*severity=Severity\.(\w+)'
+    )
+    emitted: set[str] = set()
+    for path in SRC.rglob("*.py"):
+        for match in pattern.finditer(path.read_text(encoding="utf-8")):
+            emitted.add(match.group(1))
+
+    if not emitted:
+        pytest.skip("severity is passed indirectly for this rule")
+
+    expected = rule.severity.name
+    assert emitted == {expected}, (
+        f"{rule.id} is registered as {expected} but emits {sorted(emitted)}"
+    )

{agentcheckup-0.4.0 → agentcheckup-0.4.2}/tests/test_rules.py

@@ -165,7 +165,7 @@ def test_invisible_characters_detected():
 def test_config_fixture_flags_expected_rules():
     report = lint_servers(servers_from_config(FIXTURES / "claude_desktop_config.json"))
     ids = rule_ids(report)
-    for expected in ("AGT101", "AGT103", "AGT104", "AGT105", "AGT106", "AGT107"):
+    for expected in ("AGT101", "AGT103", "AGT104", "AGT106", "AGT107", "AGT108"):
         assert expected in ids, f"{expected} did not fire; got {sorted(ids)}"