agentcheckup 0.4.1__tar.gz → 0.4.2__tar.gz

{agentcheckup-0.4.1 → agentcheckup-0.4.2}/CHANGELOG.md

@@ -9,6 +9,24 @@ new ids, and removing a rule is a breaking change.
 
 ## [Unreleased]
 
+## [0.4.2] - 2026-11-07
+
+Three claims the tool made that it had not earned. All were found by an external
+review of the README and the report text, not by a bug report.
+
+### Fixed
+
+- **`AGT201` no longer asserts what the client does.** The hint said "the client
+  keeps one and the other is unreachable". No client was ever tested; the
+  behaviour differs between clients and some namespace the tools instead. The
+  message now says the call can reach either one and that clients resolve it
+  differently, which is true without a test.
+- **README no longer claims "No network calls, ever."** agentcheckup makes none
+  of its own, but `audit` starts every server in your config, and those processes
+  can do whatever they were written to do. The claim now names that boundary and
+  points at `--no-spawn`.
+- **README said 27 config locations; there are 26.** Both languages.
+
 ## [0.4.1] - 2026-11-07
 
 Both fixes came out of an external fact-check of the project, not from a bug

{agentcheckup-0.4.1 → agentcheckup-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentcheckup
-Version: 0.4.1
+Version: 0.4.2
 Summary: Diagnose your agent setup: tool conflicts, risky config, context budget.
 Project-URL: Homepage, https://github.com/wanjiaqing/agentcheckup
 Project-URL: Issues, https://github.com/wanjiaqing/agentcheckup/issues
@@ -114,7 +114,7 @@ no network calls. It reads JSON, starts processes, prints text.
 agentcheckup
 ```
 
-Finds your configs automatically — 27 known locations across Claude Desktop,
+Finds your configs automatically — 26 known locations across Claude Desktop,
 Claude Code (including its per-project `mcpServers`), Cursor, VS Code, Cline,
 Roo Code, Kilo Code, Windsurf, Zed, Codex CLI and Continue, plus project-local
 `.mcp.json` / `.cursor/mcp.json` / `.vscode/mcp.json` — starts each server,
@@ -149,7 +149,7 @@ The fastest way to keep a manifest from regressing, and the version you pin is
 the version you run — the action installs from its own checkout.
 
 ```yaml
-- uses: wanjiaqing/agentcheckup@v0.4.1
+- uses: wanjiaqing/agentcheckup@v0.4.2
   with:
     config: .mcp.json
     fail-on: warning
@@ -238,8 +238,9 @@ rule. A report nobody can read is a report nobody acts on.
   to ignore the output.
 - **Degrade, don't die.** A server that will not start is one finding, not an
   aborted run.
-- **No network calls, ever.** Your config never leaves the machine. This is the
-  one thing a commercial scanner structurally cannot promise.
+- **No network calls of its own.** No telemetry, no API, no upload; your config
+  never leaves the machine. It does *start* the servers you configured, and those
+  can do whatever they were written to do — `--no-spawn` skips that entirely.
 - **Heuristics are labelled as heuristics.** `info` means "a human should
   decide". The score is a conversation starter, not a certification.
 

{agentcheckup-0.4.1 → agentcheckup-0.4.2}/README.md

@@ -86,7 +86,7 @@ no network calls. It reads JSON, starts processes, prints text.
 agentcheckup
 ```
 
-Finds your configs automatically — 27 known locations across Claude Desktop,
+Finds your configs automatically — 26 known locations across Claude Desktop,
 Claude Code (including its per-project `mcpServers`), Cursor, VS Code, Cline,
 Roo Code, Kilo Code, Windsurf, Zed, Codex CLI and Continue, plus project-local
 `.mcp.json` / `.cursor/mcp.json` / `.vscode/mcp.json` — starts each server,
@@ -121,7 +121,7 @@ The fastest way to keep a manifest from regressing, and the version you pin is
 the version you run — the action installs from its own checkout.
 
 ```yaml
-- uses: wanjiaqing/agentcheckup@v0.4.1
+- uses: wanjiaqing/agentcheckup@v0.4.2
   with:
     config: .mcp.json
     fail-on: warning
@@ -210,8 +210,9 @@ rule. A report nobody can read is a report nobody acts on.
   to ignore the output.
 - **Degrade, don't die.** A server that will not start is one finding, not an
   aborted run.
-- **No network calls, ever.** Your config never leaves the machine. This is the
-  one thing a commercial scanner structurally cannot promise.
+- **No network calls of its own.** No telemetry, no API, no upload; your config
+  never leaves the machine. It does *start* the servers you configured, and those
+  can do whatever they were written to do — `--no-spawn` skips that entirely.
 - **Heuristics are labelled as heuristics.** `info` means "a human should
   decide". The score is a conversation starter, not a certification.
 

{agentcheckup-0.4.1 → agentcheckup-0.4.2}/README.zh-CN.md

@@ -155,7 +155,8 @@ agentcheckup rules                              # 列出全部规则
 - **规则编号永久不变。** `AGT201` 的含义永远不变。
 - **每条发现都带修法。** 只说「这不好」的规则，训练用户忽略输出。
 - **降级而不是崩溃。** 起不来的 server 是一条发现，不是中断。
-- **永不联网。** 你的配置不会离开本机。这是商业扫描器结构上给不了的承诺。
+- **自己不联网。** 没有遥测、没有 API、不上传任何东西，配置不会离开本机。
+  但它会**启动你配置的 server**，那些进程会做什么取决于它们自己——`--no-spawn` 可完全跳过。
 - **启发式要标明是启发式。** `info` 的意思是「人来判断」。分数是讨论起点，不是认证。
 
 ## 这不是什么

{agentcheckup-0.4.1 → agentcheckup-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentcheckup"
-version = "0.4.1"
+version = "0.4.2"
 description = "Diagnose your agent setup: tool conflicts, risky config, context budget."
 readme = "README.md"
 requires-python = ">=3.10"

{agentcheckup-0.4.1 → agentcheckup-0.4.2}/src/agentcheckup/conflicts.py

@@ -187,7 +187,8 @@ def detect_conflicts(
         name_a = a.tool.name.lower()
         name_b = b.tool.name.lower()
 
-        # Hard collision: identical names, different servers. One is unreachable.
+        # Hard collision: identical names, different servers. What the client
+        # does about it varies, so the message must not promise a specific outcome.
         if name_a == name_b:
             conflicts.append(
                 Conflict(
@@ -201,8 +202,9 @@ def detect_conflicts(
                         f"'{a.server}' and '{b.server}'."
                     ),
                     hint=(
-                        "Hard collision: the client keeps one and the other is "
-                        "unreachable. Rename one, or use a gateway that prefixes."
+                        "Two servers expose the same name and clients resolve that "
+                        "differently, so the same call can reach either one. Rename "
+                        "one, or use a gateway that prefixes."
                     ),
                 )
             )

{agentcheckup-0.4.1 → agentcheckup-0.4.2}/src/agentcheckup/report.py

@@ -10,7 +10,7 @@ from . import rules as _rules
 from .engine import Report
 from .models import Finding, Severity
 
-__version__ = "0.4.1"
+__version__ = "0.4.2"
 
 SARIF_LEVEL = {
     Severity.ERROR: "error",