mcpgawk 0.1.3__tar.gz → 0.1.4__tar.gz

{mcpgawk-0.1.3 → mcpgawk-0.1.4}/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to mcpgawk. Format: [Keep a Changelog](https://keepachangelog.com/); versioning: [SemVer](https://semver.org/).
 
+## [0.1.4] — 2026-07-20
+
+### Added
+- `--login`: scan a remote MCP server that requires OAuth. Opens the browser, signs in once via the
+  server's own OAuth flow, and scans it — the token is stored locally (`~/.gawk/oauth`) and never
+  leaves your machine.
+- Dynamic tool-dispatch detection: flags servers that hide a larger real tool catalog behind a
+  meta-tool (the Sentry / Docker mcp-gateway shape). A passive scan structurally can't see the hidden
+  tools, so this says "this scan is incomplete" rather than letting a clean-looking result be mistaken
+  for a clean server.
+
+### Changed / Fixed
+- A probe that errors (unreachable host, wrong URL, an HTML docs page that isn't an MCP endpoint,
+  a timeout) can no longer render as CLEAN — failures are now typed, not inferred from message text.
+- Remote (`--http`/`--sse`) scans fail fast (~20s) instead of hanging up to 90s on a non-MCP URL;
+  local stdio servers keep the generous cold-start budget.
+- Heuristic signals are labelled by what they are — dynamic-dispatch, tool-name shadowing and
+  server-card mismatch are no longer all reported as "possible prompt-injection".
+- Version is single-sourced from the installed package metadata (no more hand-maintained literal that
+  could go stale).
+
 ## [0.1.3] — 2026-07-12
 
 ### Added

{mcpgawk-0.1.3 → mcpgawk-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcpgawk
-Version: 0.1.3
+Version: 0.1.4
 Summary: A local-first CLI that measures what an MCP server costs and what it can do. Nothing leaves your machine.
 Project-URL: Homepage, https://mcp.gawk.dev
 Project-URL: Documentation, https://mcp.gawk.dev

{mcpgawk-0.1.3 → mcpgawk-0.1.4}/editors/vscode/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.1.4
+- Version sync with CLI 0.1.4 (`--login` OAuth scanning, dynamic tool-dispatch detection, typed
+  error handling so a failed probe never reads CLEAN, faster remote-scan timeout, corrected signal
+  labels). No extension code change — the panel reads `tool_count`, `cost_index_tokens`,
+  `tools[].write/exfil_capable`, and `bounded_signals`, all unchanged additive fields in the label schema.
+
 ## 0.1.3
 - Version sync with CLI 0.1.3 (5-axis report, `--verbose`, opt-in `--supply-chain`/`--oauth-scopes`). No
   extension code change — the panel reads `tool_count`, `cost_index_tokens`, `tools[].write/exfil_capable`,

{mcpgawk-0.1.3 → mcpgawk-0.1.4}/editors/vscode/package.json

@@ -2,7 +2,7 @@
   "name": "mcpgawk",
   "displayName": "mcpgawk — MCP cost & hygiene",
   "description": "See what your MCP servers cost and expose, right in your editor. Local — nothing leaves your machine.",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "publisher": "gawk-dev",
   "license": "Apache-2.0",
   "icon": "media/icon.png",

{mcpgawk-0.1.3 → mcpgawk-0.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mcpgawk"
-version = "0.1.3"
+version = "0.1.4"
 description = "A local-first CLI that measures what an MCP server costs and what it can do. Nothing leaves your machine."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -37,6 +37,7 @@ Issues = "https://github.com/gawk-dev/mcpgawk/issues"
 
 [project.scripts]
 mcpgawk = "mcpgawk.cli:main"
+mcpgawk-mcp = "mcpgawk.mcp_server:main"
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/mcpgawk"]

mcpgawk-0.1.4/src/mcpgawk/__init__.py

@@ -0,0 +1,26 @@
+"""mcpgawk — local-first MCP measurement.
+
+gawk at an MCP server before you trust it: measure what it costs and exposes,
+without the server's inventory ever leaving your machine.
+
+Pipeline: Observe (probe) -> Bound (measure) -> Attest (label).
+"""
+from .probe import ServerSnapshot, probe_stdio, probe_http, probe_sse, probe_url
+from .measure import Measurement, measure
+from .label import build_label
+
+# Single source of truth: the version is whatever the installed package metadata says (which comes
+# from `[project] version` in pyproject.toml at build time). No hand-maintained literal to go stale
+# — the prior `__version__ = "0.1.0"` disagreed with the published 0.1.3 and with pyproject. In a
+# raw source tree with no install at all, metadata is absent; report an honest non-version sentinel
+# rather than assert a number that could be wrong.
+from importlib.metadata import version as _pkg_version, PackageNotFoundError
+try:
+    __version__ = _pkg_version("mcpgawk")
+except PackageNotFoundError:  # running from source with no (editable) install
+    __version__ = "0+unknown"
+del _pkg_version, PackageNotFoundError
+__all__ = [
+    "ServerSnapshot", "probe_stdio", "probe_http", "probe_sse", "probe_url",
+    "Measurement", "measure", "build_label", "__version__",
+]

mcpgawk-0.1.4/src/mcpgawk/ambient.py

@@ -0,0 +1,120 @@
+"""AMBIENT CREDENTIALS — what a launched server inherits that nobody declared.
+
+Zero egress, zero execution: this only asks whether files EXIST and what environment variables are
+NAMED. It never opens a credential file, never reads a value, and never reports one. That is not
+politeness — a scanner that reads your secrets to tell you they exist has become the risk it
+describes.
+
+WHY THIS EXISTS. A config entry declares what a server needs: `env: { SOME_API_KEY: ... }`, and
+the report shows exactly that, values hidden. It reads like the server's credential surface. It is
+not. When the server is actually launched it inherits the whole environment plus every credential
+file the user can read. On a typical developer machine that includes package-registry tokens with
+publish rights — so an MCP server becomes a supply-chain path into whatever that developer ships.
+
+Two mechanisms, both real:
+  * the launcher hands the child its environment (this scanner does exactly that in probe.py, and so
+    does every MCP client that spawns a stdio server);
+  * launchers read their own credential files — `npx -y whatever` consults ~/.npmrc regardless of
+    what any MCP config says.
+
+So the DECLARED blast radius and the ACTUAL one are different numbers, and only the smaller one was
+ever reported. This module reports the gap.
+
+It is a FACT layer: presence and name only, no judgement, no score. Whether it matters depends on
+what the servers can do — which measure.py already knows — so the two are combined at the report
+level, never here.
+"""
+from __future__ import annotations
+
+import os
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+
+#: Credential files a launched process can read, and what holding one lets someone do. The wording
+#: is the CONSEQUENCE, not the file's name — "a token" means nothing to a reader deciding whether to
+#: care, whereas "publish packages as you" does.
+CREDENTIAL_FILES: list[tuple[str, str]] = [
+    (".npmrc", "publish npm packages as you"),
+    (".pypirc", "publish Python packages as you"),
+    (".netrc", "authenticate to hosts as you"),
+    (".git-credentials", "push to your git remotes"),
+    (".config/gh/hosts.yml", "act on GitHub as you"),
+    (".docker/config.json", "push images to your registries"),
+    (".aws/credentials", "use your AWS account"),
+    (".kube/config", "control your Kubernetes clusters"),
+    (".ssh/id_rsa", "log in wherever that key is trusted"),
+    (".ssh/id_ed25519", "log in wherever that key is trusted"),
+]
+
+#: Environment variable NAMES that look like credentials. Names only — the value is never touched.
+_CREDENTIAL_NAME = re.compile(
+    r"(^|_)(token|secret|password|passwd|apikey|api_key|access_key|private_key|credential)s?($|_)",
+    re.IGNORECASE)
+
+
+@dataclass
+class AmbientExposure:
+    """What a stdio server launched from here would inherit."""
+    files: list[tuple[str, str]] = field(default_factory=list)   # (path shown as ~/…, consequence)
+    env_names: list[str] = field(default_factory=list)           # NAMES only, never values
+
+    @property
+    def count(self) -> int:
+        return len(self.files) + len(self.env_names)
+
+    def as_dict(self) -> dict:
+        return {
+            "files": [{"path": p, "grants": g} for p, g in self.files],
+            "env_names": list(self.env_names),
+            "count": self.count,
+        }
+
+
+def detect_ambient(home: Path | None = None, environ: dict[str, str] | None = None) -> AmbientExposure:
+    """Enumerate inheritable credential sources. Pure and injectable, so it is testable without
+    touching the real home directory of whoever runs the tests."""
+    home = home or Path.home()
+    environ = os.environ if environ is None else environ
+
+    files: list[tuple[str, str]] = []
+    for rel, grants in CREDENTIAL_FILES:
+        path = home / rel
+        try:
+            if path.is_file():
+                files.append((f"~/{rel}", grants))
+        except OSError:                      # unreadable parent, permissions — treat as absent
+            continue
+
+    # Sorted so two runs of the same machine produce the same report; an inventory that reshuffles
+    # cannot be diffed, and diffing is the point.
+    env_names = sorted(k for k in environ if _CREDENTIAL_NAME.search(k))
+    return AmbientExposure(files=files, env_names=env_names)
+
+
+def summarize(exposure: AmbientExposure, launched: int, exfil_capable: int) -> list[str]:
+    """Report lines, or [] when there is nothing worth saying.
+
+    Deliberately conditional on there being something to inherit AND something to inherit it: this
+    is a property of the PAIRING. A machine full of credentials with no local servers is not a
+    finding, and a local server on a machine with no credentials is not one either.
+
+    Returns LINES, wrapped to fit a terminal. The fleet view holds an invariant that no row runs off
+    an 80-column screen — a warning that wraps into unreadable soup is a warning people skip, and
+    this one has to survive being read at a glance.
+    """
+    if not exposure.count or not launched:
+        return []
+
+    head = (f"{launched} local server{'s' if launched != 1 else ''} run as you, inheriting "
+            f"credentials no MCP config declares:")
+    lines = [head]
+
+    for path, grants in exposure.files:
+        lines.append(f"    {path} — {grants}")
+    if exposure.env_names:
+        n = len(exposure.env_names)
+        lines.append(f"    {n} credential-shaped environment variable{'s' if n != 1 else ''}")
+    if exfil_capable:
+        lines.append(f"    {exfil_capable} of their tools can send data outward.")
+    return lines

mcpgawk-0.1.4/src/mcpgawk/cli.py

@@ -0,0 +1,317 @@
+"""mcpgawk CLI — one command, zero config.
+
+    mcpgawk scan <mcp.json> [--only a,b] [--json]
+    mcpgawk scan --stdio "npx -y @modelcontextprotocol/server-filesystem /tmp"
+    mcpgawk scan --http https://host/mcp [--header "Authorization: Bearer ..."]
+    mcpgawk scan --sse  https://host/sse
+
+Local-first: the only network is the SDK talking to the server you point it at.
+"""
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import shlex
+import sys
+from dataclasses import asdict
+from datetime import datetime, timezone
+
+from . import drift, fleet, history
+from .fleet import FleetRow
+from .consent import gate_stdio_consent
+from .discover import detect_unscannable, discover_servers
+from .label import build_label, render_cli, render_summary
+from .measure import measure
+from .oauth_scopes import inspect as inspect_oauth_scopes
+from .probe import ServerSnapshot, probe, probe_stdio, probe_url
+from .signals import as_dicts, detect, detect_card_mismatch, detect_dynamic_dispatch, detect_shadowing
+from .supplychain import check as check_supply_chain
+
+
+def _load_config(path: str) -> dict:
+    with open(path, encoding="utf-8") as f:
+        data = json.load(f)
+    return data.get("mcpServers", data)
+
+
+def _headers(pairs: list[str] | None) -> dict[str, str]:
+    out = {}
+    for p in pairs or []:
+        k, _, v = p.partition(":")
+        out[k.strip()] = v.strip()
+    return out
+
+
+async def _run(args) -> tuple[list[ServerSnapshot], dict[str, dict], list[tuple[str, dict]]]:
+    """Returns snapshots, the raw entry (command/args/headers) each came from, and the targets we
+    deliberately did NOT scan (consent withheld). The entries feed the opt-in supply-chain/
+    oauth-scopes checks and the fleet view's auth step; the skipped list keeps unscanned servers
+    VISIBLE, so the summary can never imply coverage it doesn't have."""
+    if args.stdio:
+        parts = shlex.split(args.stdio)
+        entry = {"command": parts[0], "args": parts[1:]}
+        return [await probe_stdio("cli-stdio", parts[0], parts[1:])], {"cli-stdio": entry}, []
+    if args.http or args.sse:
+        url = args.http or args.sse
+        transport = "http" if args.http else "sse"
+        entry = {"url": url, "headers": _headers(args.header)}
+        auth = server = None
+        # A remote endpoint that isn't MCP (a pasted docs/repo URL) must fail fast, not hang — so
+        # the default here is the short HTTP budget, not the 90s stdio one. --login is the one case
+        # that legitimately waits: the user has 5 min to approve the OAuth flow in the browser.
+        from .probe import HTTP_TIMEOUT
+        timeout = HTTP_TIMEOUT
+        if getattr(args, "login", False):
+            from .oauth_login import build_login_provider
+            auth, server = build_login_provider(url)
+            timeout = 330.0
+        # `--http`/`--sse` orders the attempts; it does not decide what we believe. The one case we
+        # do NOT permute is --login: an OAuth provider would re-run its browser flow per candidate
+        # and offer the token to URLs the user never named (see probe_url).
+        try:
+            snap = await probe_url(f"cli-{transport}", url, entry["headers"], timeout, auth,
+                                   declared=transport, permute=auth is None)
+        finally:
+            if server is not None:
+                server.shutdown()
+        return [snap], {f"cli-{transport}": entry}, []
+    only = set(args.only.split(",")) if args.only else None
+    # Zero-config: with no path given, DISCOVER every MCP server configured across the machine's IDE
+    # clients (Claude Desktop/Code, Cursor, VS Code, Windsurf, …), deduped. `mcpgawk scan` just works.
+    is_discovery = not args.config
+    cfg = _load_config(args.config) if args.config else discover_servers()
+    targets = [(n, e) for n, e in cfg.items() if not only or n in only]
+    if is_discovery and not targets:
+        print("mcpgawk: no MCP servers found in your IDE configs "
+              "(Claude Desktop/Code, Cursor, VS Code, Windsurf, …).\n"
+              "  Point it at a config:  mcpgawk scan path/to/mcp.json\n"
+              "  Or scan one server:    mcpgawk scan --stdio \"npx -y <server>\"  |  --http <url>",
+              file=sys.stderr)
+        return [], {}, []
+    # Default-deny consent before LAUNCHING any discovered/configured stdio server (spawning runs its
+    # code). Explicit --stdio never reaches here; remote servers aren't spawned so they always pass.
+    approved = gate_stdio_consent(targets, assume_yes=getattr(args, "yes", False))
+    # A server we chose NOT to launch must stay VISIBLE in the fleet view. Dropping it silently
+    # would let the summary imply coverage we don't have.
+    ok_names = {n for n, _ in approved}
+    skipped = [(n, e) for n, e in targets if n not in ok_names]
+    snaps = await asyncio.gather(*(probe(e, n) for n, e in approved))
+    return list(snaps), {n: e for n, e in approved}, skipped
+
+
+def _label_for(sn: ServerSnapshot, m, entry: dict, args, shadow: dict | None = None) -> dict:
+    """Build one server's label. Extracted so the post-sign-in re-scan produces an IDENTICAL label
+    to the original pass — a second, drifting definition of "what a label is" is exactly how the
+    refreshed row would start disagreeing with the row it replaced."""
+    sigs = None
+    if not args.no_signals:
+        sigs = (as_dicts(detect(sn)) + as_dicts((shadow or {}).get(sn.name, []))
+                + as_dicts(detect_card_mismatch(sn)) + as_dicts(detect_dynamic_dispatch(sn)))
+    label = build_label(sn, m, bounded_signals=(sigs or None))
+    # Both opt-in: supply-chain hits a public registry (egress), oauth-scopes reads a credential the
+    # user already supplied (no egress, but still consent-gated).
+    if args.supply_chain and entry.get("command"):
+        finding = check_supply_chain(entry["command"], entry.get("args") or [])
+        label["x-mcpgawk"]["supply_chain"] = (
+            asdict(finding) if finding else {"checked": False,
+                                             "reason": "package not recognised from the launch command"})
+    if args.oauth_scopes:
+        label["x-mcpgawk"]["oauth_scopes"] = inspect_oauth_scopes(entry.get("headers"))
+    return label
+
+
+def main(argv: list[str] | None = None) -> int:
+    p = argparse.ArgumentParser(prog="mcpgawk", description="gawk at an MCP server before you trust it")
+    sub = p.add_subparsers(dest="cmd", required=True)
+    s = sub.add_parser("scan", help="measure MCP server(s) locally")
+    s.add_argument("config", nargs="?", help="path to an mcp.json config")
+    s.add_argument("--stdio", help='one stdio server, e.g. "npx -y @modelcontextprotocol/server-filesystem /tmp"')
+    s.add_argument("--http", help="one streamable-HTTP server URL")
+    s.add_argument("--sse", help="one SSE server URL")
+    s.add_argument("--header", action="append", help='HTTP header, e.g. "Authorization: Bearer XYZ" (repeatable)')
+    s.add_argument("--login", action="store_true",
+                   help="for a remote --http/--sse server that needs OAuth: open the browser, sign "
+                        "in once, and scan (token stored locally in ~/.gawk/oauth)")
+    s.add_argument("--only", help="comma-separated server names to scan from the config")
+    s.add_argument("--yes", "-y", action="store_true",
+                   help="launch discovered/configured local (stdio) servers WITHOUT the consent "
+                        "prompt (scanning a stdio server runs its code) — for CI / non-interactive use")
+    s.add_argument("--no-signals", action="store_true", help="skip BOUNDED heuristic signals (facts only)")
+    s.add_argument("--track", action="store_true",
+                   help="record this scan locally and report DRIFT vs the last sighting (rug-pull detection)")
+    s.add_argument("--json", action="store_true", help="emit JSON labels instead of a table")
+    s.add_argument("--fleet-json", action="store_true",
+                   help="emit the FLEET STATUS as JSON (one row per server, grouped by the tool it "
+                        "lives in) — what the IDE extension renders, so state is computed once here")
+    s.add_argument("--verbose", action="store_true", help="show the full per-tool table, not just flagged tools")
+    s.add_argument("--detail", action="store_true",
+                   help="print the full narrative report for EVERY server instead of the fleet "
+                        "status list (the list is the default when more than one server is scanned)")
+    s.add_argument("--supply-chain", action="store_true",
+                   help="opt-in: query the public npm/PyPI registry for the launched package's "
+                        "deprecation/yank status (network egress — package name+version only)")
+    s.add_argument("--oauth-scopes", action="store_true",
+                   help="opt-in: locally decode a supplied Bearer JWT's scope claim (no network; "
+                        "reads a credential you already provided)")
+    args = p.parse_args(argv)
+
+    # No args at all is VALID: it means "discover and scan everything on this machine". _run handles
+    # the nothing-found message and default-deny consent before launching any discovered stdio server.
+    snaps, entries, skipped = asyncio.run(_run(args))
+    measurements = [measure(sn) for sn in snaps]
+    # Cross-server shadowing needs all snapshots together; merge into each involved server's signals.
+    shadow = {} if args.no_signals else detect_shadowing(snaps)
+    labels = [_label_for(sn, m, entries.get(sn.name) or {}, args, shadow)
+              for sn, m in zip(snaps, measurements)]
+
+    # --track: record locally and diff against the last sighting (rug-pull detection).
+    drift_reports: dict[str, drift.DriftReport] = {}
+    if args.track:
+        now = datetime.now(timezone.utc).isoformat(timespec="seconds")
+        for sn, m in zip(snaps, measurements):
+            if sn.error:
+                continue
+            # Read-the-previous and write-the-current under ONE lock (history.record). Split across
+            # a load()/save() pair, two concurrent scans each diff against a baseline the other has
+            # already replaced, and one server's drift history is silently lost.
+            current = drift.build_record(sn, m, measured_at=now)
+            previous = history.record(history.key_for(sn), current)
+            rep = drift.compare(previous, current)
+            if rep and rep.any:
+                drift_reports[sn.name] = rep
+
+    # Drift must reach the MACHINE-READABLE output and the exit code, not only the pretty print.
+    # A rug-pull that a CI job can't see is a rug-pull that ships: `--json` consumers and pipeline
+    # gates were previously blind to it.
+    for lab in labels:
+        rep = drift_reports.get(lab["name"])
+        if rep:
+            d = asdict(rep)
+            d["rug_pull"] = bool(rep.changed)   # same item, rewritten description — the signature
+            lab["x-mcpgawk"]["drift"] = d
+
+    # ONE exit code for both output modes. `--json` used to `return 0` unconditionally — so a failed
+    # probe or a detected rug-pull reported success to CI, the same class of lie as a false CLEAN.
+    failed = any(lab["x-mcpgawk"].get("caveats") for lab in labels) or bool(drift_reports)
+
+    if args.json:
+        print(json.dumps(labels, indent=2))
+        return 1 if failed else 0
+
+    if getattr(args, "fleet_json", False):
+        # Front-ends get the SAME rows the terminal view renders — never raw labels to re-interpret.
+        unscannable = detect_unscannable() if not (args.stdio or args.http or args.sse) else []
+        payload = fleet.to_json(fleet.build_rows(labels, entries, skipped, unscannable))
+        print(json.dumps(payload, indent=2))
+        return 1 if failed else 0
+
+    # Show the REAL installed version, not a hardcoded string. `__version__` is now single-sourced
+    # from the installed package metadata in __init__ (see there), so this banner can no longer go
+    # stale or disagree with pyproject/PyPI. A version banner that lies erodes trust in a measurement
+    # tool.
+    from . import __version__ as _ver
+    print(f"\n{'='*70}\nmcpgawk {_ver} — LOCAL scan (no inventory uploaded)\n{'='*70}")
+
+    # THE FLEET VIEW. A machine has a fleet of MCP servers, not one — handing the reader seven
+    # full narrative reports in a row means the third onwards goes unread, which is the same as not
+    # scanning. So multiple servers get one status line each, needs-you-first, and the per-server
+    # narrative stays a deliberate `--detail` (or --only <name>) away. One server always renders in
+    # full: there is nothing to summarise.
+    # Capabilities that exist but no local scan can reach (account-hosted connectors, browser
+    # hosts) are LISTED, never silently omitted — see discover.detect_unscannable.
+    unscannable = detect_unscannable() if not (args.stdio or args.http or args.sse) else []
+    rows = fleet.build_rows(labels, entries, skipped, unscannable)
+    if len(rows) > 1 and not args.detail:
+        print()
+        print(fleet.render_fleet(rows))
+        for lab in labels:                       # drift is never summarised away — it's the alarm
+            rep = drift_reports.get(lab["name"])
+            if rep:
+                print("\n" + drift.render(lab["name"], rep))
+        print()
+        refreshed = _offer_batched_auth(rows, args, entries)
+        any_error = any(lab["x-mcpgawk"].get("caveats") for lab in labels)
+        if refreshed:
+            # Redraw with the signed-in servers now MEASURED, rather than sending the user back to
+            # the shell to run the same command again. The whole point of the batched step is that
+            # you finish where you started.
+            rows = [refreshed.get(r.name, r) for r in rows]
+            print("\n  Updated:\n")
+            print(fleet.render_fleet(fleet.sort_rows(rows)))
+            print()
+            # A server that only became measurable after sign-in can carry findings — those must
+            # count towards the exit code exactly as if the first pass had seen them.
+            any_error = any_error or any(r.state in ("REVIEW", "INCOMPLETE", "UNREACHABLE")
+                                         for r in refreshed.values())
+        return 1 if (any_error or failed) else 0
+
+    any_error = False
+    for lab in labels:
+        print("\n" + render_cli(lab, verbose=args.verbose))
+        rep = drift_reports.get(lab["name"])
+        if rep:
+            print(drift.render(lab["name"], rep))
+        any_error = any_error or bool(lab["x-mcpgawk"].get("caveats"))
+    # Local (stdio) servers — launched this run or merely configured. Both inherit the same
+    # ambient credentials the moment anything starts them, so both count towards that warning.
+    local_servers = (sum(1 for e in entries.values() if e.get("command"))
+                     + sum(1 for _, e in skipped if e.get("command")))
+    print("\n" + render_summary(labels, local_servers=local_servers) + "\n")
+    return 1 if (any_error or failed) else 0
+
+
+def _offer_batched_auth(rows: list, args, entries: dict) -> dict:
+    """ONE prompt for every server that needs credentials — never one prompt per server, which the
+    founder rejected outright as the painpoint this view exists to remove.
+
+    Returns {name: refreshed FleetRow} for servers that signed in successfully, so the caller can
+    redraw the list in place instead of telling the user to run the command again. Default-deny in
+    spirit: a blank or unparseable answer authenticates nothing, and a non-interactive run never
+    opens a browser at all."""
+    pending = [r for r in rows if r.needs_auth]
+    if not pending:
+        return {}
+    if not sys.stdin.isatty():
+        print(f"  {len(pending)} server(s) need credentials. Re-run in a terminal, or: "
+              f"mcpgawk scan --http <url> --login\n", file=sys.stderr)
+        return {}
+
+    print("  These need credentials:")
+    for i, r in enumerate(pending, 1):
+        print(f"    {i}. {r.name}  {r.url}")
+    sys.stderr.write("  Sign in to which? [all / 1,2 / N] ")
+    sys.stderr.flush()
+    picked = fleet.parse_auth_selection(input(), len(pending))
+    if not picked:
+        print("  → skipped. Nothing was authenticated.\n", file=sys.stderr)
+        return {}
+
+    from .oauth_login import build_login_provider
+    refreshed: dict[str, FleetRow] = {}
+    for i in picked:
+        row = pending[i]
+        print(f"\n  Signing in to {row.name} — approve in the browser…", file=sys.stderr)
+        auth, server = build_login_provider(row.url)
+        try:
+            snap = asyncio.run(probe_url(row.name, row.url, None, 330.0, auth,
+                                         declared="http", permute=False))
+        finally:
+            server.shutdown()               # always release the local callback port
+        if snap.is_failure:
+            print(f"  {row.name}: sign-in did not complete — {(snap.error or '')[:90]}", file=sys.stderr)
+            continue
+        # The row is replaced by a REAL measurement of the now-authenticated server, built through
+        # the same label path as the original pass — so the refreshed row cannot disagree with the
+        # one it replaces, and a server that turns out to be risky says so immediately.
+        entry = entries.get(row.name) or {}
+        label = _label_for(snap, measure(snap), entry, args)
+        state, detail = fleet.state_of(label)
+        refreshed[row.name] = FleetRow(name=row.name, state=state, detail=detail, url=row.url,
+                                       clients=row.clients)
+        print(f"  {row.name}: signed in — {detail}", file=sys.stderr)
+    return refreshed
+
+
+if __name__ == "__main__":
+    sys.exit(main())

mcpgawk-0.1.4/src/mcpgawk/consent.py

@@ -0,0 +1,75 @@
+"""CONSENT — default-deny before LAUNCHING a local (stdio) MCP server.
+
+Spawning a stdio server RUNS its code on your machine. Zero-config `mcpgawk scan` discovers servers
+across your IDE configs and would otherwise launch every one of them silently — so when servers come
+from discovery or a config file (NOT a command you just typed), gawk enumerates the launch plan,
+redacts env values, and asks before launching, defaulting to NO.
+
+Explicit `mcpgawk scan --stdio "<cmd>"` is your own typed command — implicit consent, never prompted
+(that path never reaches this gate). Remote (http/sse) servers are connected to, not spawned, so they
+run no local code and are never gated here.
+
+The plan and prompt go to STDERR so `--json` stdout stays clean; the reply is read from stdin.
+"""
+from __future__ import annotations
+
+import sys
+from typing import Any, Callable
+
+Target = tuple[str, dict[str, Any]]
+
+
+def _format(name: str, entry: dict[str, Any]) -> str:
+    cmd = str(entry.get("command", ""))
+    args = entry.get("args") or []
+    line = f"    • {name}: {cmd} {' '.join(map(str, args))}".rstrip()
+    env = entry.get("env") or {}
+    if isinstance(env, dict) and env:
+        # Show which env vars are passed, NEVER their values (they carry the secrets).
+        line += f"\n        env: {', '.join(sorted(env))}  (values hidden)"
+    return line
+
+
+def gate_stdio_consent(
+    targets: list[Target],
+    *,
+    assume_yes: bool = False,
+    stdin_isatty: bool | None = None,
+    ask: Callable[[], str] = input,
+    err=None,
+) -> list[Target]:
+    """Return the subset of `targets` approved to scan. Remote servers always pass (no code runs);
+    local (stdio) servers are launched only with consent — `--yes` (assume_yes), an interactive 'y',
+    and never by default. Non-interactive without `--yes` fails closed: remote-only.
+
+    Injectable (`ask`/`err`/`stdin_isatty`) so it's testable without a real TTY."""
+    stdio = [(n, e) for n, e in targets if e.get("command")]
+    remote = [(n, e) for n, e in targets if not e.get("command")]
+    if not stdio:
+        return list(targets)  # nothing to spawn — no consent needed
+
+    err = sys.stderr if err is None else err  # resolved at CALL time (so capsys/redirection works)
+    isatty = sys.stdin.isatty() if stdin_isatty is None else stdin_isatty
+    n = len(stdio)
+    print(f"\n⚠  {n} local server{'s' if n != 1 else ''} would be LAUNCHED to scan "
+          f"— this RUNS their code on your machine:", file=err)
+    for name, entry in stdio:
+        print(_format(name, entry), file=err)
+
+    if assume_yes:
+        print("→ launching (--yes given).", file=err)
+        return list(targets)
+
+    if not isatty:
+        print(f"→ NOT launched: default-deny in a non-interactive run. Re-run with --yes to launch "
+              f"them, or in a terminal to approve. Scanning {len(remote)} remote server(s) only.",
+              file=err)
+        return remote
+
+    err.write(f"Launch {'these' if n != 1 else 'this'} {n} local server{'s' if n != 1 else ''}? [y/N] ")
+    err.flush()
+    reply = (ask() or "").strip().lower()
+    if reply in ("y", "yes"):
+        return list(targets)
+    print(f"→ skipped. Scanning {len(remote)} remote server(s) only.", file=err)
+    return remote