mcpgawk 0.1.40__tar.gz → 0.1.41__tar.gz

mcpgawk-0.1.41/.github/workflows/mcpgawk-gate-selftest.yml

@@ -0,0 +1,26 @@
+name: MCP hygiene gate (self-test)
+
+# Dogfoods the mcpgawk Action against a real open server, so the marketplace
+# listing has a live, passing example.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: MCP hygiene gate
+        uses: ./
+        with:
+          # PINNED, and that is the point. Unpinned, mcpgawk correctly raises
+          # config:unpinned-package on this very example — every launch installs whatever
+          # upstream publishes next (postmark-mcp shipped 15 clean versions, then v1.0.16
+          # exfiltrated mail). With fail-on-flagged the gate then failed on EVERY release
+          # from 0.1.35 to 0.1.40: the showcase demonstrated the mistake the product
+          # detects. Pinning fixes the example and the gate at once.
+          stdio: 'npx -y @modelcontextprotocol/server-filesystem@2026.8.31 /tmp'
+          max-tokens: 5000
+          fail-on-flagged: true

{mcpgawk-0.1.40 → mcpgawk-0.1.41}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpgawk
-Version: 0.1.40
+Version: 0.1.41
 Summary: One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine.
 Project-URL: Homepage, https://mcp.gawk.dev
 Project-URL: Documentation, https://mcp.gawk.dev
@@ -150,7 +150,7 @@ Scanning on its own, if that is all you want:
 
 ```bash
 mcpgawk scan mcp.json                                              # a whole config
-mcpgawk scan --stdio "npx -y @modelcontextprotocol/server-filesystem /tmp"
+mcpgawk scan --stdio "npx -y @modelcontextprotocol/server-filesystem@2026.8.31 /tmp"
 mcpgawk scan --http https://host/mcp --header "Authorization: Bearer $TOKEN"
 mcpgawk scan --sse  https://host/sse
 mcpgawk scan mcp.json --track                                     # record + detect rug-pulls over time

{mcpgawk-0.1.40 → mcpgawk-0.1.41}/README.md

@@ -115,7 +115,7 @@ Scanning on its own, if that is all you want:
 
 ```bash
 mcpgawk scan mcp.json                                              # a whole config
-mcpgawk scan --stdio "npx -y @modelcontextprotocol/server-filesystem /tmp"
+mcpgawk scan --stdio "npx -y @modelcontextprotocol/server-filesystem@2026.8.31 /tmp"
 mcpgawk scan --http https://host/mcp --header "Authorization: Bearer $TOKEN"
 mcpgawk scan --sse  https://host/sse
 mcpgawk scan mcp.json --track                                     # record + detect rug-pulls over time

{mcpgawk-0.1.40 → mcpgawk-0.1.41}/action.yml

@@ -11,7 +11,7 @@ inputs:
     required: false
     default: 'mcp.json'
   stdio:
-    description: 'A single stdio server command to scan instead of a config (e.g. "npx -y @modelcontextprotocol/server-filesystem /tmp").'
+    description: 'A single stdio server command to scan instead of a config (e.g. "npx -y @modelcontextprotocol/server-filesystem@2026.8.31 /tmp" — pin the version, an unpinned npx installs whatever upstream publishes next and mcpgawk flags it).'
     required: false
     default: ''
   http:

{mcpgawk-0.1.40 → mcpgawk-0.1.41}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mcpgawk"
-version = "0.1.40"
+version = "0.1.41"
 description = "One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine."
 readme = "README.md"
 requires-python = ">=3.10"

{mcpgawk-0.1.40 → mcpgawk-0.1.41}/scripts/verify_public_artifact.py

@@ -28,6 +28,7 @@ from __future__ import annotations
 
 import argparse
 import re
+import shutil
 import subprocess
 import sys
 import tarfile
@@ -144,12 +145,29 @@ def check(path: Path) -> list[str]:
     return problems
 
 
-def build_public(repo: Path) -> list[Path]:
-    """Build sdist AND wheel from the public repo. Both are published, so both are checked."""
-    out = Path(tempfile.mkdtemp(prefix="gawk-public-dist-"))
-    subprocess.run([sys.executable, "-m", "build", "--outdir", str(out), str(repo)],
+def build_public(repo: Path, outdir: Path | None = None) -> list[Path]:
+    """Build sdist AND wheel from the public repo. Both are published, so both are checked.
+
+    `outdir` exists because a temp directory made this gate check a different file from the one
+    that ships. Building into `mktemp` left `dist/` untouched, so `preflight_release.sh`'s
+    self-test picked the newest wheel THERE — `mcpgawk-0.1.22`, four weeks stale — planted a paid
+    module in that, and reported the gate live for a release it had never seen (found 2026-09-09,
+    while cutting 0.1.40). The verifier was working; it was pointed at the wrong artefact. A gate
+    must watch the shipped copy.
+    """
+    # ALWAYS build into a fresh temp dir, then copy out. Building straight into `dist/` and
+    # globbing it returned every artefact ever built there — 0.1.0's sdist among them, which fails
+    # today's completeness rules — so the gate refused a perfectly good release. What is built and
+    # what happens to be lying in the directory are different sets, and only the first is ours.
+    staging = Path(tempfile.mkdtemp(prefix="gawk-public-dist-"))
+    subprocess.run([sys.executable, "-m", "build", "--outdir", str(staging), str(repo)],
                    check=True, capture_output=True)
-    return sorted(out.glob("*.whl")) + sorted(out.glob("*.tar.gz"))
+    built = sorted(staging.glob("*.whl")) + sorted(staging.glob("*.tar.gz"))
+    if outdir is None:
+        return built
+    dest = Path(outdir)
+    dest.mkdir(parents=True, exist_ok=True)
+    return [Path(shutil.copy2(b, dest / b.name)) for b in built]
 
 
 def main(argv: list[str] | None = None) -> int:
@@ -157,12 +175,18 @@ def main(argv: list[str] | None = None) -> int:
     ap.add_argument("artifacts", nargs="*", type=Path)
     ap.add_argument("--build", type=Path, metavar="PUBLIC_REPO",
                     help="build sdist+wheel from this repo and check both")
+    ap.add_argument("--outdir", type=Path, default=None,
+                    help="write the built artefacts here instead of a temp dir, so the caller can "
+                         "verify and publish THE SAME files (see build_public)")
+    ap.add_argument("--print-built", action="store_true",
+                    help="print each built artefact path on stdout, one per line, after the checks")
     args = ap.parse_args(argv)
 
     paths = list(args.artifacts)
     if args.build:
         try:
-            paths += build_public(args.build)
+            built = build_public(args.build, args.outdir)
+            paths += built
         except subprocess.CalledProcessError as exc:
             print(f"verify-public-artifact: BUILD FAILED — cannot verify what was not built\n"
                   f"{(exc.stderr or b'').decode(errors='replace')[-2000:]}", file=sys.stderr)
@@ -187,6 +211,12 @@ def main(argv: list[str] | None = None) -> int:
         else:
             print(f"verify-public-artifact: {p.name}: clean "
                   f"({len(_members(p))} members checked)")
+    # Hand the caller the EXACT paths that were checked, so a self-test or an upload cannot drift
+    # onto a different file. Only on success: naming artefacts that failed would invite publishing
+    # them. Printed last so the human-readable lines above stay first.
+    if args.print_built and not failed:
+        for p in paths:
+            print(p)
     return 1 if failed else 0
 
 

mcpgawk-0.1.41/src/mcpgawk/__init__.py

@@ -0,0 +1,73 @@
+"""mcpgawk — local-first MCP measurement.
+
+gawk at an MCP server before you trust it: measure what it costs and exposes,
+without the server's inventory ever leaving your machine.
+
+Pipeline: Observe (probe) -> Bound (measure) -> Attest (label).
+"""
+from .probe import ServerSnapshot, probe_stdio, probe_http, probe_sse, probe_url
+from .measure import Measurement, measure
+from .label import build_label
+
+# Single source of truth: the version is whatever the installed package metadata says (which comes
+# from `[project] version` in pyproject.toml at build time). No hand-maintained literal to go stale
+# — the prior `__version__ = "0.1.0"` disagreed with the published 0.1.3 and with pyproject. In a
+# raw source tree with no install at all, metadata is absent; report an honest non-version sentinel
+# rather than assert a number that could be wrong.
+# METADATA DESCRIBES THE INSTALLED DISTRIBUTION, NOT THE CODE THAT WAS IMPORTED. Those are the
+# same thing right up until they are not: with this repo's `src/` ahead of an older install on
+# sys.path, `python -m mcpgawk --version` printed "0.1.34 — OUT OF DATE" while executing 0.1.40
+# (measured 2026-09-09). Every word of that was wrong, and it is the one banner a person reads to
+# find out what they are running. An editable install fails the same way the moment pyproject is
+# bumped, because its recorded version is fixed at install time.
+#
+# So: if a pyproject.toml sits above this package, we are running from a source tree and IT is the
+# truth. Otherwise metadata is. Installed users pay one `is_file()` check and nothing else.
+
+
+def _source_tree_version() -> str | None:
+    """`[project] version` from a pyproject.toml above this package, or None if there isn't one."""
+    from pathlib import Path
+    here = Path(__file__).resolve().parent
+    for root in (here.parent.parent, here.parent):      # src/mcpgawk/.. -> src/.. and src/..
+        pp = root / "pyproject.toml"
+        if not pp.is_file():
+            continue
+        try:
+            raw = pp.read_text(encoding="utf-8")
+        except OSError:
+            return None
+        try:
+            import tomllib                              # 3.11+; regex fallback keeps 3.10 working
+            return str(tomllib.loads(raw)["project"]["version"])
+        except Exception:                               # noqa: BLE001 — never fail an import
+            import re
+            m = re.search(r'^\s*version\s*=\s*["\']([^"\']+)["\']', raw, re.M)
+            return m.group(1) if m else None
+    return None
+
+
+def _resolve_version() -> str:
+    # Imported INSIDE, not at module scope. The names used to be module-level and `del`d right
+    # after the first call, so a second call raised NameError — a resolver that works once and is
+    # broken forever after. Found by its own test, which is the only thing that ever calls it twice.
+    from importlib.metadata import PackageNotFoundError
+    from importlib.metadata import version as _pkg_version
+    try:
+        meta: str | None = _pkg_version("mcpgawk")
+    except PackageNotFoundError:                        # raw source tree, no install at all
+        meta = None
+    try:
+        src = _source_tree_version()
+    except Exception:                                   # noqa: BLE001 — a version must never raise
+        src = None
+    if src:
+        return src
+    return meta or "0+unknown"
+
+
+__version__ = _resolve_version()
+__all__ = [
+    "ServerSnapshot", "probe_stdio", "probe_http", "probe_sse", "probe_url",
+    "Measurement", "measure", "build_label", "__version__",
+]

{mcpgawk-0.1.40 → mcpgawk-0.1.41}/src/mcpgawk/cli.py

@@ -1087,14 +1087,17 @@ def _wrong(args) -> int:
 # They are listed in `--help` even when unavailable: a free user should be able to SEE what the
 # subscription adds without installing anything, and get one honest line if they try it.
 def _installed_version() -> str:
-    """The version of the DISTRIBUTION actually installed — read from package metadata, never a
-    hand-maintained constant. A literal here drifted from pyproject before and reported 0.1.0 on a
-    0.1.3 install; metadata cannot disagree with what pip resolved."""
-    try:
-        from importlib.metadata import version
-        return version("mcpgawk")
-    except Exception:                              # noqa: BLE001 - a source checkout, not an error
-        return "0+unknown (not installed as a distribution)"
+    """The version of the code that is RUNNING. One definition, imported — see `mcpgawk.__init__`.
+
+    This used to read package metadata itself, which answers a DIFFERENT question: what
+    distribution is installed, not which copy got imported. With this repo's `src/` ahead of an
+    older install, `--version` printed "0.1.34 — OUT OF DATE" while executing 0.1.40 (2026-09-09).
+    That was the fourth separate answer to "what version am I" in this codebase; there is now one,
+    and every surface asks it rather than re-deriving it. A version banner that lies erodes trust
+    in a measurement tool faster than any missing feature.
+    """
+    from . import __version__
+    return __version__ if __version__ != "0+unknown" else "0+unknown (not installed as a distribution)"
 
 
 #: ACCOUNT commands — about the subscription, not about a server. Separate from the capabilities

{mcpgawk-0.1.40 → mcpgawk-0.1.41}/src/mcpgawk/label.py

@@ -465,7 +465,14 @@ def render_cli(label: dict[str, Any], verbose: bool = False) -> str:
         for t in sorted(tools, key=lambda t: -t["tokens"]):
             tags = [c for c, on in (("write", t["write"]), ("exfil", t["exfil_capable"]),
                                     ("no-annotation", not (t.get("annotations") or {}))) if on]
-            lines.append(f"      · {t['name']:<32} {t['tokens']:>5} tok   {', '.join(tags) or 'read-only'}")
+            # NO TAG IS NOT A CLEAN BILL. Untagged means our heuristics stayed quiet, which is a
+            # fact about us, not about the tool. Only the server's own readOnlyHint earns the words
+            # "read-only" — three tools on a real fleet ("restore_folder", "restore_video",
+            # "translate_video") declared nothing, matched no write verb, and were printed read-only
+            # on the strength of our own silence.
+            quiet = ("read-only (declared)" if (t.get("annotations") or {}).get("readOnlyHint") is True
+                     else "no signal")
+            lines.append(f"      · {t['name']:<32} {t['tokens']:>5} tok   {', '.join(tags) or quiet}")
 
     # Bounded heuristic signals — one actionable line each. Each KIND is a DISTINCT finding and must
     # be named as itself: filing dynamic-dispatch, tool-shadowing and server-card-mismatch under

{mcpgawk-0.1.40 → mcpgawk-0.1.41}/src/mcpgawk/measure.py

@@ -78,8 +78,11 @@ _EXFIL_NAME = re.compile(r"\b(fetch|http|request|download|browse|scrape|curl|web
 class ToolMeasure:
     name: str
     tokens: int                      # INDEX
-    write: bool                      # EXACT (structural)
-    exfil_capable: bool              # EXACT (structural)
+    write: bool                      # BOUNDED (declaration first, then a verb heuristic)
+    # BOUNDED, and it was mis-annotated EXACT until 2026-09-10 — which is how a regex over the tool
+    # name came to headline a report as though it were a structural fact. It reads readOnlyHint
+    # first; absent that, it pattern-matches. Both arms can be wrong, and the report must say so.
+    exfil_capable: bool
     annotations: dict[str, Any]      # EXACT (declared)
     # Both EXACT counts, not judgements. They exist so grade.py can ask whether a tool is described
     # in proportion to what it does; the judgement lives there, the facts live here. Kept on this
@@ -116,7 +119,14 @@ def _count(enc, text: str) -> int:
     return len(enc.encode(text)) if enc is not None else max(1, len(text) // 4)
 
 
-def _exfil_capable(tool: dict[str, Any]) -> bool:
+def _exfil_capable(tool: dict[str, Any], ann: dict[str, Any] | None = None) -> bool:
+    # A DECLARATION OUTRANKS THE REGEX, exactly as it does in `_is_write` one function below. This
+    # arm was missing until 2026-09-10 and the two classifiers disagreed about the same annotation:
+    # four tools on a live 70-tool server matched `_EXFIL_NAME` on the bare word "request" sitting
+    # inside the product's own noun ("recording request"), and two of those were declared
+    # readOnlyHint=true. A server that annotated honestly was reported as the leak path for it.
+    if (ann or tool.get("annotations") or {}).get("readOnlyHint") is True:
+        return False
     if _EXFIL_NAME.search(tool.get("name", "") + " " + (tool.get("description") or "")):
         return True
     props = ((tool.get("inputSchema") or {}).get("properties") or {})
@@ -150,7 +160,7 @@ def measure(snap: ServerSnapshot, enc=None, tokenizer_name: str | None = None) -
         props = ((t.get("inputSchema") or {}).get("properties") or {})
         tools.append(ToolMeasure(
             name=t.get("name", "?"), tokens=tk,
-            write=_is_write(t, ann), exfil_capable=_exfil_capable(t), annotations=ann,
+            write=_is_write(t, ann), exfil_capable=_exfil_capable(t, ann), annotations=ann,
             param_count=len(props),
             description_words=len((t.get("description") or "").split())))
     # Integrity pin over the WHOLE tool surface — name + description + canonical input schema +

{mcpgawk-0.1.40 → mcpgawk-0.1.41}/src/mcpgawk/panel.py

@@ -7087,7 +7087,7 @@ def observed_only(d: dict[str, Any], now: str = "") -> list[dict[str, Any]]:
     no fleet listing, no store, no queue and had no baseline. mcpgawk watched an agent call it
     1605 times and said nothing anywhere. Pure over what `collect` already read; never raises.
     """
-    from datetime import datetime, timedelta, timezone
+    from datetime import datetime, timedelta
     entries = d.get("entries") or {}
     store_names = set()
     for k in ((d.get("store") or {}).get("servers") or {}):

{mcpgawk-0.1.40 → mcpgawk-0.1.41}/src/mcpgawk/staleness.py

@@ -24,7 +24,11 @@ import json
 import os
 import re
 import time
-from importlib.metadata import PackageNotFoundError, version
+# `version` is NOT imported: this module defines its own below, deliberately shadowing the
+# metadata one, because metadata answers 'what is installed' and every caller here needs
+# 'what is running'. Importing it too would be a second, wrong answer sitting in the same
+# namespace — and ruff F811 rightly refuses to let both exist.
+from importlib.metadata import PackageNotFoundError
 
 from . import history, supplychain
 
@@ -87,6 +91,27 @@ def _latest(fetch) -> str | None:
     return _fetch_and_cache(fetch)
 
 
+def version(_name: str = "mcpgawk") -> str:
+    """SHADOWS `importlib.metadata.version` ON PURPOSE, module-wide, and answers a better question.
+
+    Metadata says what DISTRIBUTION is installed. This module needs to know what CODE IS RUNNING,
+    and the two part company the moment a source tree sits ahead of an older install on sys.path:
+    on 2026-09-09 `--version` announced "0.1.34 — OUT OF DATE" while executing 0.1.40, and offered
+    an upgrade command that would have done nothing. An editable install goes wrong the same way as
+    soon as pyproject is bumped, since its recorded version is fixed at install time.
+
+    Shadowing rather than adding a new seam is deliberate: every caller and every existing test in
+    this module already routes through this name, so the correction reaches all of them at once
+    instead of leaving some readers on the old answer. The resolution itself has ONE definition, in
+    `mcpgawk.__init__`. Raises PackageNotFoundError for an uninstalled source tree so the callers'
+    existing handling is unchanged.
+    """
+    from . import __version__
+    if __version__ == "0+unknown":
+        raise PackageNotFoundError(_name)
+    return __version__
+
+
 def currency_line(fetch=supplychain._get_json) -> str:
     """The one line `--version` prints UNDER the version: is this build current, or not, or unknown.
 

{mcpgawk-0.1.40 → mcpgawk-0.1.41}/src/mcpgawk/wrap.py

@@ -82,6 +82,14 @@ def _snapshot(session: Session):
         protocol_version=session.protocol_version,
         tools=list(session.tools),
         server_info=dict(session.server_info),
+        # WHAT THIS CONNECTION ACTUALLY ASKED FOR, and no more. A wrap rides the client's own
+        # session and sees exactly the `tools/list` the client sent — never prompts/list or
+        # resources/list, because the client had no reason to send them. Leaving this empty is
+        # read downstream as "no recorded fact, do not restrict" (the right reading for records
+        # written before the field existed), which made the very next full scan report the first
+        # sighting of a resource as "changed since you approved it". Wrap knows better than that,
+        # so it says so.
+        enumerated=["tool"],
     )
 
 

mcpgawk-0.1.41/tests/test_a_wrap_baseline_says_what_it_looked_at.py

@@ -0,0 +1,75 @@
+"""The wrap baseline claimed to speak for kinds it never asked about.
+
+WHY THIS FILE EXISTS. 0.1.40 fixed the partial-enumeration false rug-pull at the comparison:
+`drift.comparable_kinds` restricts a diff to the kinds BOTH records actually enumerated. The fix
+was verified against records written by `scan` and called done. It was not done.
+
+`wrap._snapshot` builds a ServerSnapshot from what the wire said and never sets `enumerated`, so
+every wrap baseline stores an EMPTY list. Empty is deliberately read as "no recorded fact, so do
+not restrict" — the right reading for records written before the field existed, and exactly the
+wrong one here, because wrap knows precisely what it saw: one `tools/list` and nothing else.
+
+The result, reproduced on a live server the day after the first fix shipped: `wrap` recorded the
+baseline, the very next scan enumerated resources as well, and the report said the server had
+"changed since you approved it just now — resources added". Nothing on the server had moved. That
+is a false rug-pull alarm on a first-party surface, and it is the eleventh instance of a rule
+written in one file not being a rule: the comparison learned the rule, the second writer did not.
+
+So this test drives `record_baseline` — the real writer — not `comparable_kinds`.
+"""
+from __future__ import annotations
+
+from mcpgawk import drift
+from mcpgawk.probe import ServerSnapshot
+
+TOOL = {"name": "send", "description": "Send a thing.", "inputSchema": {"type": "object"}}
+
+
+def _wrap_record():
+    """What wrap stores, built through wrap's own snapshot so a change there is caught here."""
+    from mcpgawk.measure import measure
+    from mcpgawk.wrap import Session, _snapshot
+
+    s = Session("dadan")
+    s.tools = [TOOL]
+    s.protocol_version = "2025-06-18"
+    sn = _snapshot(s)
+    return sn, drift.build_record(sn, measure(sn), measured_at="2026-09-10T00:00:00+00:00")
+
+
+def test_the_wrap_baseline_records_that_it_only_saw_tools():
+    sn, rec = _wrap_record()
+    assert sn.enumerated == ["tool"], "wrap saw one tools/list; the record must say so"
+    assert rec["enumerated"] == ["tool"]
+
+
+def test_a_resource_the_wrap_baseline_never_asked_about_is_not_a_rug_pull():
+    """THE REPRODUCTION. wrap first, then a full scan that also lists resources."""
+    from mcpgawk.measure import measure
+
+    _, prev = _wrap_record()
+    full = ServerSnapshot(name="dadan", transport="stdio", protocol_version="2025-06-18",
+                          tools=[TOOL], resources=[{"uri": "dadan-video-card", "name": "card"}])
+    full.enumerated = ["tool", "resource"]
+    curr = drift.build_record(full, measure(full), measured_at="2026-09-10T00:01:00+00:00")
+
+    kinds = drift.comparable_kinds(prev, curr)
+    assert kinds == {"tool"}, kinds
+
+    d = drift.compare(prev, curr)
+    added = [a for a in ((d.added if d else []) or []) if "dadan-video-card" in str(a)]
+    assert not added, f"a first sighting is not an addition: {d.added}"
+
+
+def test_a_tool_really_added_after_a_wrap_baseline_is_still_reported():
+    """NARROWNESS. Restricting to `tool` must not blunt the surface wrap DID enumerate."""
+    from mcpgawk.measure import measure
+
+    _, prev = _wrap_record()
+    worse = ServerSnapshot(name="dadan", transport="stdio", protocol_version="2025-06-18",
+                           tools=[TOOL, {"name": "exfiltrate", "description": "New.",
+                                         "inputSchema": {"type": "object"}}])
+    worse.enumerated = ["tool"]
+    curr = drift.build_record(worse, measure(worse), measured_at="2026-09-10T00:01:00+00:00")
+    d = drift.compare(prev, curr)
+    assert d is not None and any("exfiltrate" in str(a) for a in (d.added or [])), d

mcpgawk-0.1.41/tests/test_the_classifier_reads_declarations_before_guessing.py

@@ -0,0 +1,89 @@
+"""Two classifier defects found by re-checking every number mcpgawk printed about a REAL server.
+
+WHY THIS FILE EXISTS. On 2026-09-10 the scan of a reviewer's live MCP server (70 tools) was
+re-verified claim by claim before the numbers went into a deck. Two of them did not survive.
+
+  1. `_exfil_capable` never read `readOnlyHint`. `_is_write` has read it since it was written
+     ("declared read-only wins over the verb heuristic") — the sibling classifier, in the same
+     file, one function above, did not. So four tools whose product noun is "recording request"
+     matched the bare word `request` in `_EXFIL_NAME` and were reported as leak paths; two of
+     them were DECLARED readOnlyHint=true by the server. The headline read "7 of 70 tools can
+     read your content AND reach the network" when the defensible figure was 3. A server that
+     did the right thing and annotated its tools got punished for it.
+
+  2. The verbose detail printed `read-only` whenever a tool had no tags. No tags means the write
+     heuristic did not fire — NOT that the server declared the tool read-only. `restore_folder`,
+     `restore_video` and `translate_video` declared no hint at all and none of "restore" or
+     "translate" is a write verb, so all three rendered as "read-only" on the strength of our own
+     silence. That is "availability yes, ambiguity no" inverted, on the safe-looking side: a
+     mutating tool shown as harmless is the exact failure this product exists to prevent.
+
+Both are the same root error — treating the absence of a signal as a positive finding — and both
+are pinned here against the real tool shapes that exposed them.
+"""
+from __future__ import annotations
+
+from mcpgawk import build_label, measure
+from mcpgawk.label import render_cli
+from mcpgawk.probe import ServerSnapshot
+
+
+def _snap(tools):
+    return ServerSnapshot(name="t", transport="stdio", protocol_version="x", tools=tools)
+
+
+def _verbose(tools) -> str:
+    snap = _snap(tools)
+    return render_cli(build_label(snap, measure(snap)), verbose=True)
+
+
+def test_a_declared_readonly_tool_is_not_a_leak_path():
+    """The reproduction, with the real tool. `get_recording_request` is declared read-only and
+    reaches nothing; it matched `_EXFIL_NAME` on the word "request" inside the product's own noun."""
+    m = measure(_snap([{
+        "name": "get_recording_request",
+        "description": "Get a single recording request by id.",
+        "annotations": {"readOnlyHint": True}}]))
+    assert m.tools[0].exfil_capable is False, "a declared read-only tool cannot be the leak half"
+    assert m.tools[0].write is False
+
+
+def test_a_declared_readonly_tool_with_a_url_parameter_is_still_not_a_leak_path():
+    """The parameter arm of the same function. A read-only tool that takes a `url` is fetching, and
+    the declaration is the server's answer about what it does with what it reads."""
+    m = measure(_snap([{
+        "name": "get_page", "description": "Read a page.",
+        "inputSchema": {"type": "object", "properties": {"url": {"type": "string"}}},
+        "annotations": {"readOnlyHint": True}}]))
+    assert m.tools[0].exfil_capable is False
+
+
+def test_an_undeclared_tool_that_reaches_the_network_still_flags():
+    """NARROWNESS. The fix must not disarm the detector. `add_background_music` declares no hint and
+    its description hands the server an http(s) URL to fetch — that one survived the recheck and
+    must keep firing."""
+    m = measure(_snap([{
+        "name": "add_background_music",
+        "description": "audio_url must be a PUBLIC http(s) URL; the editor downloads it."}]))
+    assert m.tools[0].exfil_capable is True
+
+
+def test_no_signal_is_never_rendered_as_read_only():
+    """`restore_folder`: no annotations at all, and "restore" is in no verb list. Untagged is
+    UNKNOWN, and the detail line must not upgrade our silence into the server's assurance."""
+    # It DOES carry annotations — just not readOnlyHint — so the existing "no-annotation" tag
+    # cannot rescue the line. Silence about the hint is the whole point of the case.
+    out = _verbose([{"name": "restore_folder", "description": "Restore a folder.",
+                     "annotations": {"title": "Restore folder"}}])
+    assert "restore_folder" in out
+    line = next(ln for ln in out.splitlines() if "restore_folder" in ln)
+    assert "read-only" not in line, line
+    assert "no signal" in line, line
+
+
+def test_a_declared_read_only_tool_still_says_read_only():
+    """The other half: when the server DID declare it, saying so is reporting a fact, not guessing."""
+    out = _verbose([{"name": "get_profile", "description": "Fetch the profile.",
+                     "annotations": {"readOnlyHint": True}}])
+    line = next(ln for ln in out.splitlines() if "get_profile" in ln)
+    assert "read-only (declared)" in line, line

mcpgawk-0.1.41/tests/test_version_banner_names_the_running_code.py

@@ -0,0 +1,90 @@
+"""The version banner must name the code that is RUNNING, not a distribution beside it.
+
+WHY THIS FILE EXISTS. On 2026-09-09 `python -m mcpgawk --version` printed
+`0.1.34 — OUT OF DATE. Upgrade: uv tool install --force mcpgawk` while executing 0.1.40 source.
+Every word was wrong, on the one command a person runs to find out what they are running.
+
+`importlib.metadata` answers "what distribution is installed", which is a DIFFERENT question from
+"which copy did Python import". They agree right up until a source tree is ahead of an older
+install on sys.path — or until an editable install's pyproject is bumped, since its recorded
+version is fixed at install time. There were FOUR separate answers to "what version am I"
+(`__init__`, `cli._installed_version`, `staleness.currency_line`, and the scan banner). There is
+now one, and the others import it.
+"""
+from __future__ import annotations
+
+import subprocess
+import sys
+import textwrap
+
+
+def _run(code: str, cwd) -> str:
+    return subprocess.run([sys.executable, "-c", textwrap.dedent(code)], cwd=str(cwd),
+                          capture_output=True, text=True, timeout=90).stdout.strip()
+
+
+def test_a_source_tree_reports_its_own_pyproject_version(tmp_path):
+    """The reproduction. A package next to a pyproject.toml is a source tree, and that file is the
+    truth about the code — whatever some installed distribution's metadata says."""
+    root = tmp_path / "repo"
+    (root / "src" / "mcpgawk").mkdir(parents=True)
+    (root / "pyproject.toml").write_text('[project]\nname = "mcpgawk"\nversion = "9.9.9"\n')
+    import mcpgawk
+    src = (root / "src" / "mcpgawk" / "__init__.py")
+    src.write_text(open(mcpgawk.__file__, encoding="utf-8").read(), encoding="utf-8")
+    for mod in ("probe", "measure", "label"):        # the __init__ imports these eagerly
+        (root / "src" / "mcpgawk" / f"{mod}.py").write_text(
+            "ServerSnapshot=probe_stdio=probe_http=probe_sse=probe_url=None\n"
+            "Measurement=measure=build_label=None\n")
+    out = _run(f"""
+        import sys; sys.path.insert(0, {str(root / 'src')!r})
+        import mcpgawk; print(mcpgawk.__version__)
+    """, cwd=root)
+    assert out == "9.9.9", out
+
+
+def test_an_installed_copy_still_uses_metadata(tmp_path):
+    """NARROWNESS — the half that must not break. A wheel in site-packages has no pyproject above
+    it, so metadata stays the answer. If this ever reads a stray pyproject from a parent directory,
+    every installed user gets a version from someone else's repo."""
+    from importlib.metadata import version
+
+    import mcpgawk
+    # This checkout IS a source tree, so prove the fallback directly rather than faking site-packages.
+    assert mcpgawk._source_tree_version() is not None, "this repo has a pyproject; the test is wrong"
+    # And that the resolver prefers it over metadata, which is the whole point.
+    assert mcpgawk.__version__ == mcpgawk._source_tree_version()
+    assert version("mcpgawk"), "metadata must still be readable — it is the installed-user path"
+
+
+def test_the_staleness_line_compares_the_running_version():
+    """The second half of the same lie: `currency_line` read metadata itself, so it could announce
+    OUT OF DATE about a copy nobody ran, complete with an upgrade command that would do nothing."""
+    import inspect
+
+    from mcpgawk import staleness
+    # `staleness.version` deliberately SHADOWS importlib.metadata.version module-wide, so every
+    # caller and every pre-existing test in that module gets the corrected answer through the seam
+    # they already use. What matters is that it delegates rather than re-deriving.
+    assert "from . import __version__" in inspect.getsource(staleness.version)
+    import mcpgawk
+    assert staleness.version("mcpgawk") == mcpgawk.__version__
+
+
+def test_every_surface_asks_the_one_definition():
+    """A rule in one file is not a rule. `cli._installed_version` is what `--version` prints."""
+    import inspect
+
+    from mcpgawk import cli
+    src = inspect.getsource(cli._installed_version)
+    assert "from . import __version__" in src
+    assert 'version("mcpgawk")' not in src
+
+
+def test_a_version_resolver_never_raises(monkeypatch):
+    """It runs on every import. An unreadable pyproject must degrade, not break the whole CLI."""
+    import mcpgawk
+
+    monkeypatch.setattr(mcpgawk, "_source_tree_version",
+                        lambda: (_ for _ in ()).throw(OSError("disk gone")))
+    assert mcpgawk._resolve_version()          # falls back to metadata, does not raise