audit-mcp 0.5.0__tar.gz

audit_mcp-0.5.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CheckMCP
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

audit_mcp-0.5.0/PKG-INFO

@@ -0,0 +1,140 @@
+Metadata-Version: 2.4
+Name: audit-mcp
+Version: 0.5.0
+Summary: CheckMCP — vendor-neutral quality/security/context-cost audit & score for any MCP server.
+Author: Hugo
+License: MIT
+Project-URL: Homepage, https://checkmcp.dev
+Project-URL: Repository, https://github.com/H129hj/checkmcp
+Keywords: mcp,model-context-protocol,audit,score,lint,security,gateway,guardrail
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: exact-tokens
+Requires-Dist: tiktoken>=0.7; extra == "exact-tokens"
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Dynamic: license-file
+
+<!-- mcp-name: io.github.H129hj/checkmcp -->
+
+# CheckMCP
+
+[![PyPI](https://img.shields.io/pypi/v/audit-mcp)](https://pypi.org/project/audit-mcp/) [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE) [![GitHub Action](https://img.shields.io/badge/CI-GitHub%20Action-2088FF?logo=githubactions&logoColor=white)](action.yml) [![Web audit](https://img.shields.io/badge/web-checkmcp.dev-blue)](https://checkmcp.dev)
+
+**Vendor-neutral quality / security / context-cost audit & score for any MCP server.**
+One `uvx`/`pipx` command → an **MCP Score /100** + **causal opportunities** (why the score), Lighthouse-style.
+
+> Installed from PyPI as **`audit-mcp`** (the name `checkmcp` was already taken); the command is `audit-mcp`. Brand, site and repo remain **CheckMCP** / checkmcp.dev.
+
+```bash
+uvx audit-mcp https://mcp.deepwiki.com/mcp
+# or
+pipx run audit-mcp https://mcp.context7.com/mcp --json
+audit-mcp https://my-mcp.example.com/mcp --token "$TOKEN"
+```
+
+## Use it as an MCP server
+
+`audit-mcp mcp` turns the auditor itself into an MCP server (stdio) exposing one tool,
+`audit_mcp_server` — so your agent can answer *"is this MCP server safe?"* mid-conversation.
+
+```bash
+# Claude Code
+claude mcp add audit-mcp -- uvx audit-mcp mcp
+```
+
+```json
+// Cursor (.cursor/mcp.json) / Claude Desktop (claude_desktop_config.json)
+{ "mcpServers": { "audit-mcp": { "command": "uvx", "args": ["audit-mcp", "mcp"] } } }
+```
+
+Registry name: `io.github.H129hj/checkmcp` <!-- mcp-name: io.github.H129hj/checkmcp -->
+
+
+No dependencies (stdlib only). `tiktoken` optional for exact token counts.
+
+## What it measures (7 pillars)
+- **Security** — OWASP MCP Top 10 (tool poisoning, hardcoded secrets, command injection), lethal-trifecta.
+- **Tool design** — sprawl/consolidation (percentile-calibrated on real servers: median ~7 tools, p95 ~42).
+- **Schemas / desc** — descriptions + `inputSchema`/`outputSchema` completeness.
+- **Context-cost** — tokens spent on `tools/list`, paid on every request (the #1 pain of 2026).
+- **Compliance** — protocol-version gap, annotations, JSON-RPC error conformance, OAuth discovery.
+- **Reliability** — single-shot today (not credited; continuous T3 monitoring on checkmcp.dev).
+- **Coverage** — the 3 primitives (tools **+ resources + prompts**).
+
+Hard floors: secret-in-schema → cap D, failed handshake → cap F. Every penalty is attributed: `measure → mechanism → effect → Δscore`.
+
+## CLI flags
+| flag | what |
+|---|---|
+| `--json` | machine-readable report |
+| `--badge` | SVG badge + README embed snippets |
+| `--html` | standalone SEO/GEO page (JSON-LD `SoftwareApplication` + FAQ) |
+| `--repo owner/name` | add maintenance/license/provenance signal from GitHub |
+| `--token <bearer>` | audit an OAuth-protected server |
+| `--min-score N` | CI: exit 1 if MCP Score < N |
+| `--baseline file` | CI: pin tool definitions; fail on regression (rug-pull) |
+| `--gh-summary` | CI: write a Markdown summary to `$GITHUB_STEP_SUMMARY` |
+| `--deep` | runtime depth via an external scanner (mcp-scan/snyk) if present |
+| `--evals` | behavioral sandbox: actually invokes read-only tools with canary inputs to catch tool-output prompt-injection, exfiltration vectors, secret/PII leakage and context bombs (sends real traffic; CI-fails on a malicious verdict) |
+
+## GitHub Action
+
+```yaml
+# .github/workflows/mcp-audit.yml
+name: MCP audit
+on: [push, pull_request]
+jobs:
+  checkmcp:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: H129hj/checkmcp@v1
+        with:
+          url: https://my-mcp.example.com/mcp
+          min-score: "70"
+          baseline: .checkmcp-baseline.json   # commit it → fails on rug-pull
+```
+
+## Behavioral evals (`--evals`)
+Static analysis catches *declared* danger; `--evals` catches *runtime* danger by actually invoking
+read-only tools with canary inputs and inspecting the **responses** for tool-output prompt-injection,
+exfiltration vectors and secret/PII leakage (multilingual; optional callback-canary confirms exfil).
+CI-fails on a malicious verdict.
+
+## Self-hosted security gateway
+Beyond auditing, CheckMCP ships an **in-band MCP gateway** — a proxy you put between your agent and an
+MCP server. It inspects every call, and in *active* mode **blocks/strips** tool-poisoning & exfiltration
+before they reach the agent. Run it in your own infra (tool traffic never leaves your network):
+
+```bash
+docker pull ghcr.io/h129hj/checkmcp-gateway:latest   # or build from source
+docker run -p 8080:8080 -e GATEWAY_BACKEND_URL=https://mcp.example.com/mcp \
+  -e GATEWAY_MODE=active -e GATEWAY_SECRET=$(openssl rand -hex 16) \
+  ghcr.io/h129hj/checkmcp-gateway:latest
+```
+
+See **[GATEWAY.md](GATEWAY.md)** for config (passive/active, OAuth backends, policy, logs).
+
+## Hosted
+Full reports, public directory, live badges, continuous drift monitoring, a governance policy API and a
+hosted gateway at **[checkmcp.dev](https://checkmcp.dev)**.
+
+## Honest limitations
+- Percentile bands come from a growing corpus (one+ registries) — widening over time.
+- Exact tokens with `pipx install "audit-mcp[exact-tokens]"` (cl100k_base); otherwise chars/4 approximation.
+- Pillar weights are expert priors. `python -m checkmcp.calibrate samples.json` validates them against a labeled agent-success sample (per-pillar correlation + OLS-suggested weights + construct-validity R²) — supply real outcomes to close the loop.
+
+MIT.

audit_mcp-0.5.0/README.md

@@ -0,0 +1,111 @@
+<!-- mcp-name: io.github.H129hj/checkmcp -->
+
+# CheckMCP
+
+[![PyPI](https://img.shields.io/pypi/v/audit-mcp)](https://pypi.org/project/audit-mcp/) [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE) [![GitHub Action](https://img.shields.io/badge/CI-GitHub%20Action-2088FF?logo=githubactions&logoColor=white)](action.yml) [![Web audit](https://img.shields.io/badge/web-checkmcp.dev-blue)](https://checkmcp.dev)
+
+**Vendor-neutral quality / security / context-cost audit & score for any MCP server.**
+One `uvx`/`pipx` command → an **MCP Score /100** + **causal opportunities** (why the score), Lighthouse-style.
+
+> Installed from PyPI as **`audit-mcp`** (the name `checkmcp` was already taken); the command is `audit-mcp`. Brand, site and repo remain **CheckMCP** / checkmcp.dev.
+
+```bash
+uvx audit-mcp https://mcp.deepwiki.com/mcp
+# or
+pipx run audit-mcp https://mcp.context7.com/mcp --json
+audit-mcp https://my-mcp.example.com/mcp --token "$TOKEN"
+```
+
+## Use it as an MCP server
+
+`audit-mcp mcp` turns the auditor itself into an MCP server (stdio) exposing one tool,
+`audit_mcp_server` — so your agent can answer *"is this MCP server safe?"* mid-conversation.
+
+```bash
+# Claude Code
+claude mcp add audit-mcp -- uvx audit-mcp mcp
+```
+
+```json
+// Cursor (.cursor/mcp.json) / Claude Desktop (claude_desktop_config.json)
+{ "mcpServers": { "audit-mcp": { "command": "uvx", "args": ["audit-mcp", "mcp"] } } }
+```
+
+Registry name: `io.github.H129hj/checkmcp` <!-- mcp-name: io.github.H129hj/checkmcp -->
+
+
+No dependencies (stdlib only). `tiktoken` optional for exact token counts.
+
+## What it measures (7 pillars)
+- **Security** — OWASP MCP Top 10 (tool poisoning, hardcoded secrets, command injection), lethal-trifecta.
+- **Tool design** — sprawl/consolidation (percentile-calibrated on real servers: median ~7 tools, p95 ~42).
+- **Schemas / desc** — descriptions + `inputSchema`/`outputSchema` completeness.
+- **Context-cost** — tokens spent on `tools/list`, paid on every request (the #1 pain of 2026).
+- **Compliance** — protocol-version gap, annotations, JSON-RPC error conformance, OAuth discovery.
+- **Reliability** — single-shot today (not credited; continuous T3 monitoring on checkmcp.dev).
+- **Coverage** — the 3 primitives (tools **+ resources + prompts**).
+
+Hard floors: secret-in-schema → cap D, failed handshake → cap F. Every penalty is attributed: `measure → mechanism → effect → Δscore`.
+
+## CLI flags
+| flag | what |
+|---|---|
+| `--json` | machine-readable report |
+| `--badge` | SVG badge + README embed snippets |
+| `--html` | standalone SEO/GEO page (JSON-LD `SoftwareApplication` + FAQ) |
+| `--repo owner/name` | add maintenance/license/provenance signal from GitHub |
+| `--token <bearer>` | audit an OAuth-protected server |
+| `--min-score N` | CI: exit 1 if MCP Score < N |
+| `--baseline file` | CI: pin tool definitions; fail on regression (rug-pull) |
+| `--gh-summary` | CI: write a Markdown summary to `$GITHUB_STEP_SUMMARY` |
+| `--deep` | runtime depth via an external scanner (mcp-scan/snyk) if present |
+| `--evals` | behavioral sandbox: actually invokes read-only tools with canary inputs to catch tool-output prompt-injection, exfiltration vectors, secret/PII leakage and context bombs (sends real traffic; CI-fails on a malicious verdict) |
+
+## GitHub Action
+
+```yaml
+# .github/workflows/mcp-audit.yml
+name: MCP audit
+on: [push, pull_request]
+jobs:
+  checkmcp:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: H129hj/checkmcp@v1
+        with:
+          url: https://my-mcp.example.com/mcp
+          min-score: "70"
+          baseline: .checkmcp-baseline.json   # commit it → fails on rug-pull
+```
+
+## Behavioral evals (`--evals`)
+Static analysis catches *declared* danger; `--evals` catches *runtime* danger by actually invoking
+read-only tools with canary inputs and inspecting the **responses** for tool-output prompt-injection,
+exfiltration vectors and secret/PII leakage (multilingual; optional callback-canary confirms exfil).
+CI-fails on a malicious verdict.
+
+## Self-hosted security gateway
+Beyond auditing, CheckMCP ships an **in-band MCP gateway** — a proxy you put between your agent and an
+MCP server. It inspects every call, and in *active* mode **blocks/strips** tool-poisoning & exfiltration
+before they reach the agent. Run it in your own infra (tool traffic never leaves your network):
+
+```bash
+docker pull ghcr.io/h129hj/checkmcp-gateway:latest   # or build from source
+docker run -p 8080:8080 -e GATEWAY_BACKEND_URL=https://mcp.example.com/mcp \
+  -e GATEWAY_MODE=active -e GATEWAY_SECRET=$(openssl rand -hex 16) \
+  ghcr.io/h129hj/checkmcp-gateway:latest
+```
+
+See **[GATEWAY.md](GATEWAY.md)** for config (passive/active, OAuth backends, policy, logs).
+
+## Hosted
+Full reports, public directory, live badges, continuous drift monitoring, a governance policy API and a
+hosted gateway at **[checkmcp.dev](https://checkmcp.dev)**.
+
+## Honest limitations
+- Percentile bands come from a growing corpus (one+ registries) — widening over time.
+- Exact tokens with `pipx install "audit-mcp[exact-tokens]"` (cl100k_base); otherwise chars/4 approximation.
+- Pillar weights are expert priors. `python -m checkmcp.calibrate samples.json` validates them against a labeled agent-success sample (per-pillar correlation + OLS-suggested weights + construct-validity R²) — supply real outcomes to close the loop.
+
+MIT.

audit_mcp-0.5.0/audit_mcp.egg-info/PKG-INFO

@@ -0,0 +1,140 @@
+Metadata-Version: 2.4
+Name: audit-mcp
+Version: 0.5.0
+Summary: CheckMCP — vendor-neutral quality/security/context-cost audit & score for any MCP server.
+Author: Hugo
+License: MIT
+Project-URL: Homepage, https://checkmcp.dev
+Project-URL: Repository, https://github.com/H129hj/checkmcp
+Keywords: mcp,model-context-protocol,audit,score,lint,security,gateway,guardrail
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: exact-tokens
+Requires-Dist: tiktoken>=0.7; extra == "exact-tokens"
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Dynamic: license-file
+
+<!-- mcp-name: io.github.H129hj/checkmcp -->
+
+# CheckMCP
+
+[![PyPI](https://img.shields.io/pypi/v/audit-mcp)](https://pypi.org/project/audit-mcp/) [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE) [![GitHub Action](https://img.shields.io/badge/CI-GitHub%20Action-2088FF?logo=githubactions&logoColor=white)](action.yml) [![Web audit](https://img.shields.io/badge/web-checkmcp.dev-blue)](https://checkmcp.dev)
+
+**Vendor-neutral quality / security / context-cost audit & score for any MCP server.**
+One `uvx`/`pipx` command → an **MCP Score /100** + **causal opportunities** (why the score), Lighthouse-style.
+
+> Installed from PyPI as **`audit-mcp`** (the name `checkmcp` was already taken); the command is `audit-mcp`. Brand, site and repo remain **CheckMCP** / checkmcp.dev.
+
+```bash
+uvx audit-mcp https://mcp.deepwiki.com/mcp
+# or
+pipx run audit-mcp https://mcp.context7.com/mcp --json
+audit-mcp https://my-mcp.example.com/mcp --token "$TOKEN"
+```
+
+## Use it as an MCP server
+
+`audit-mcp mcp` turns the auditor itself into an MCP server (stdio) exposing one tool,
+`audit_mcp_server` — so your agent can answer *"is this MCP server safe?"* mid-conversation.
+
+```bash
+# Claude Code
+claude mcp add audit-mcp -- uvx audit-mcp mcp
+```
+
+```json
+// Cursor (.cursor/mcp.json) / Claude Desktop (claude_desktop_config.json)
+{ "mcpServers": { "audit-mcp": { "command": "uvx", "args": ["audit-mcp", "mcp"] } } }
+```
+
+Registry name: `io.github.H129hj/checkmcp` <!-- mcp-name: io.github.H129hj/checkmcp -->
+
+
+No dependencies (stdlib only). `tiktoken` optional for exact token counts.
+
+## What it measures (7 pillars)
+- **Security** — OWASP MCP Top 10 (tool poisoning, hardcoded secrets, command injection), lethal-trifecta.
+- **Tool design** — sprawl/consolidation (percentile-calibrated on real servers: median ~7 tools, p95 ~42).
+- **Schemas / desc** — descriptions + `inputSchema`/`outputSchema` completeness.
+- **Context-cost** — tokens spent on `tools/list`, paid on every request (the #1 pain of 2026).
+- **Compliance** — protocol-version gap, annotations, JSON-RPC error conformance, OAuth discovery.
+- **Reliability** — single-shot today (not credited; continuous T3 monitoring on checkmcp.dev).
+- **Coverage** — the 3 primitives (tools **+ resources + prompts**).
+
+Hard floors: secret-in-schema → cap D, failed handshake → cap F. Every penalty is attributed: `measure → mechanism → effect → Δscore`.
+
+## CLI flags
+| flag | what |
+|---|---|
+| `--json` | machine-readable report |
+| `--badge` | SVG badge + README embed snippets |
+| `--html` | standalone SEO/GEO page (JSON-LD `SoftwareApplication` + FAQ) |
+| `--repo owner/name` | add maintenance/license/provenance signal from GitHub |
+| `--token <bearer>` | audit an OAuth-protected server |
+| `--min-score N` | CI: exit 1 if MCP Score < N |
+| `--baseline file` | CI: pin tool definitions; fail on regression (rug-pull) |
+| `--gh-summary` | CI: write a Markdown summary to `$GITHUB_STEP_SUMMARY` |
+| `--deep` | runtime depth via an external scanner (mcp-scan/snyk) if present |
+| `--evals` | behavioral sandbox: actually invokes read-only tools with canary inputs to catch tool-output prompt-injection, exfiltration vectors, secret/PII leakage and context bombs (sends real traffic; CI-fails on a malicious verdict) |
+
+## GitHub Action
+
+```yaml
+# .github/workflows/mcp-audit.yml
+name: MCP audit
+on: [push, pull_request]
+jobs:
+  checkmcp:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: H129hj/checkmcp@v1
+        with:
+          url: https://my-mcp.example.com/mcp
+          min-score: "70"
+          baseline: .checkmcp-baseline.json   # commit it → fails on rug-pull
+```
+
+## Behavioral evals (`--evals`)
+Static analysis catches *declared* danger; `--evals` catches *runtime* danger by actually invoking
+read-only tools with canary inputs and inspecting the **responses** for tool-output prompt-injection,
+exfiltration vectors and secret/PII leakage (multilingual; optional callback-canary confirms exfil).
+CI-fails on a malicious verdict.
+
+## Self-hosted security gateway
+Beyond auditing, CheckMCP ships an **in-band MCP gateway** — a proxy you put between your agent and an
+MCP server. It inspects every call, and in *active* mode **blocks/strips** tool-poisoning & exfiltration
+before they reach the agent. Run it in your own infra (tool traffic never leaves your network):
+
+```bash
+docker pull ghcr.io/h129hj/checkmcp-gateway:latest   # or build from source
+docker run -p 8080:8080 -e GATEWAY_BACKEND_URL=https://mcp.example.com/mcp \
+  -e GATEWAY_MODE=active -e GATEWAY_SECRET=$(openssl rand -hex 16) \
+  ghcr.io/h129hj/checkmcp-gateway:latest
+```
+
+See **[GATEWAY.md](GATEWAY.md)** for config (passive/active, OAuth backends, policy, logs).
+
+## Hosted
+Full reports, public directory, live badges, continuous drift monitoring, a governance policy API and a
+hosted gateway at **[checkmcp.dev](https://checkmcp.dev)**.
+
+## Honest limitations
+- Percentile bands come from a growing corpus (one+ registries) — widening over time.
+- Exact tokens with `pipx install "audit-mcp[exact-tokens]"` (cl100k_base); otherwise chars/4 approximation.
+- Pillar weights are expert priors. `python -m checkmcp.calibrate samples.json` validates them against a labeled agent-success sample (per-pillar correlation + OLS-suggested weights + construct-validity R²) — supply real outcomes to close the loop.
+
+MIT.

audit_mcp-0.5.0/audit_mcp.egg-info/SOURCES.txt

@@ -0,0 +1,32 @@
+LICENSE
+README.md
+pyproject.toml
+audit_mcp.egg-info/PKG-INFO
+audit_mcp.egg-info/SOURCES.txt
+audit_mcp.egg-info/dependency_links.txt
+audit_mcp.egg-info/entry_points.txt
+audit_mcp.egg-info/requires.txt
+audit_mcp.egg-info/top_level.txt
+checkmcp/__init__.py
+checkmcp/badge.py
+checkmcp/calibrate.py
+checkmcp/cli.py
+checkmcp/evals.py
+checkmcp/gateway.py
+checkmcp/mcp_server.py
+checkmcp/monitor.py
+checkmcp/optimize.py
+checkmcp/page.py
+checkmcp/plans.py
+checkmcp/probe.py
+checkmcp/repo.py
+checkmcp/scanners.py
+checkmcp/score.py
+checkmcp/security.py
+checkmcp/store.py
+tests/test_calibrate.py
+tests/test_evals.py
+tests/test_mcp_server.py
+tests/test_misc.py
+tests/test_monitor.py
+tests/test_score.py

audit_mcp-0.5.0/audit_mcp.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

audit_mcp-0.5.0/audit_mcp.egg-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+audit-mcp = checkmcp.cli:main
+audit-mcp-mcp = checkmcp.mcp_server:main

audit_mcp-0.5.0/audit_mcp.egg-info/requires.txt

@@ -0,0 +1,6 @@
+
+[exact-tokens]
+tiktoken>=0.7
+
+[test]
+pytest>=7

audit_mcp-0.5.0/audit_mcp.egg-info/top_level.txt

@@ -0,0 +1 @@
+checkmcp

audit_mcp-0.5.0/checkmcp/__init__.py

@@ -0,0 +1,2 @@
+"""CheckMCP — audit & score de qualité/sécurité/context-cost pour serveurs MCP."""
+__version__ = "0.5.0"

audit_mcp-0.5.0/checkmcp/badge.py

@@ -0,0 +1,38 @@
+"""Badge SVG "MCP Score" (style shields) + snippet d'embed. Mécanisme viral de CheckMCP."""
+
+GRADE_COLOR = {"A": "#2ea44f", "B": "#7fbf3f", "C": "#dfb317", "D": "#fe7d37", "F": "#e05d44"}
+
+
+def _w(text, px=7):
+    return max(20, int(len(text) * px) + 10)
+
+
+def badge_svg(score, grade, label="MCP Score"):
+    val = f"{score} · {grade}"
+    color = GRADE_COLOR.get(grade, "#9f9f9f")
+    lw, vw = _w(label), _w(val)
+    total = lw + vw
+    return f'''<svg xmlns="http://www.w3.org/2000/svg" width="{total}" height="20" role="img" aria-label="{label}: {val}">
+<linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient>
+<clipPath id="r"><rect width="{total}" height="20" rx="3" fill="#fff"/></clipPath>
+<g clip-path="url(#r)">
+<rect width="{lw}" height="20" fill="#555"/>
+<rect x="{lw}" width="{vw}" height="20" fill="{color}"/>
+<rect width="{total}" height="20" fill="url(#s)"/>
+</g>
+<g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="11">
+<text x="{lw/2*10}" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="{(lw-10)*10}">{label}</text>
+<text x="{lw/2*10}" y="140" transform="scale(.1)" textLength="{(lw-10)*10}">{label}</text>
+<text x="{(lw+vw/2)*10}" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="{(vw-10)*10}">{val}</text>
+<text x="{(lw+vw/2)*10}" y="140" transform="scale(.1)" textLength="{(vw-10)*10}">{val}</text>
+</g></svg>'''
+
+
+def embed_snippets(slug, score, grade):
+    base = f"https://checkmcp.com/badge/{slug}.svg"
+    page = f"https://checkmcp.com/mcp/{slug}"
+    return {
+        "markdown": f"[![MCP Score {score} {grade}]({base})]({page})",
+        "html": f'<a href="{page}"><img src="{base}" alt="MCP Score {score} {grade}"></a>',
+        "url": base,
+    }