mcpgawk 0.1.65__tar.gz → 0.1.67__tar.gz

{mcpgawk-0.1.65 → mcpgawk-0.1.67}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpgawk
-Version: 0.1.65
+Version: 0.1.67
 Summary: One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine.
 Project-URL: Homepage, https://mcp.gawk.dev
 Project-URL: Documentation, https://mcp.gawk.dev/docs
@@ -66,6 +66,12 @@ person per month for up to 3 machines: start a free 7-day trial at https://mcp.g
 (no card) or subscribe at https://mcp.gawk.dev/subscribe. Then `mcpgawk login <key>` on this same
 install fetches the paid engine and turns those on — one more command, nothing else to set up.
 
+<p align="center">
+  <a href="https://mcp.gawk.dev/#watch"><img src="https://mcp.gawk.dev/assets/video/mcpgawk-launch-poster.jpg" width="720"
+       alt="mcpgawk in 64 seconds: a tool you approved changes in an update, and mcpgawk refuses the call until you decide. Watch the video."></a>
+</p>
+<p align="center"><sub><b>Watch: mcpgawk in 64 seconds.</b> A tool you approved changes in an update; mcpgawk refuses the call until you decide.</sub></p>
+
 <p align="center">
   <img src="https://raw.githubusercontent.com/gawk-dev/mcpgawk/main/assets/brand/demo.gif"
        alt="mcpgawk demo: a server is approved, changes afterwards, and the guard blocks the tool that appeared">

{mcpgawk-0.1.65 → mcpgawk-0.1.67}/README.md

@@ -29,6 +29,12 @@ person per month for up to 3 machines: start a free 7-day trial at https://mcp.g
 (no card) or subscribe at https://mcp.gawk.dev/subscribe. Then `mcpgawk login <key>` on this same
 install fetches the paid engine and turns those on — one more command, nothing else to set up.
 
+<p align="center">
+  <a href="https://mcp.gawk.dev/#watch"><img src="https://mcp.gawk.dev/assets/video/mcpgawk-launch-poster.jpg" width="720"
+       alt="mcpgawk in 64 seconds: a tool you approved changes in an update, and mcpgawk refuses the call until you decide. Watch the video."></a>
+</p>
+<p align="center"><sub><b>Watch: mcpgawk in 64 seconds.</b> A tool you approved changes in an update; mcpgawk refuses the call until you decide.</sub></p>
+
 <p align="center">
   <img src="https://raw.githubusercontent.com/gawk-dev/mcpgawk/main/assets/brand/demo.gif"
        alt="mcpgawk demo: a server is approved, changes afterwards, and the guard blocks the tool that appeared">

{mcpgawk-0.1.65 → mcpgawk-0.1.67}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mcpgawk"
-version = "0.1.65"
+version = "0.1.67"
 description = "One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine."
 readme = "README.md"
 requires-python = ">=3.10"

{mcpgawk-0.1.65 → mcpgawk-0.1.67}/src/mcpgawk/cli.py

@@ -189,6 +189,13 @@ async def _run(args) -> tuple[list[ServerSnapshot], dict[str, dict], list[tuple[
         # variable and the same shape, rather than mypy inferring `Sequence[str]` from whichever
         # branch it saw first and then rejecting the other one's headers dict.
         entry: dict[str, Any] = {"command": parts[0], "args": parts[1:]}
+        if getattr(args, "supply_chain", False):
+            # The "check a server before you add it" flow the empty-fleet message recommends:
+            # the same pre-launch registry gate as the config path below, not a label added after
+            # the server already ran.
+            entry, refused_snap = _registry_gate("cli-stdio", entry)
+            if refused_snap is not None:
+                return [refused_snap], {"cli-stdio": entry}, []
         return [await probe_stdio("cli-stdio", parts[0], parts[1:])], {"cli-stdio": entry}, []
     if (args.http or args.sse) and (routed := _configured_as(args.http or args.sse, args)):
         # Scanning a configured server BY URL is still scanning that server. Say so, then let the
@@ -307,6 +314,24 @@ async def _run(args) -> tuple[list[ServerSnapshot], dict[str, dict], list[tuple[
     if is_discovery:
         for line in _discovery_problems(sources):
             print(f"mcpgawk: ⚠ {line}", file=sys.stderr)
+    # THE REGISTRY CHECK GATES THE LAUNCH. It ran in `_label_for`, AFTER probe() had started the
+    # server — so `npx -y <a hallucinated name>` fetched and ran whatever squatted that name, then
+    # printed "Do not launch it." Asked first, and a name the registry says does not exist is never
+    # launched, never even offered at the consent prompt: there is nothing to consent to. Only with
+    # --supply-chain (opt-in egress; name + pinned version only). Could-not-check and young names
+    # go on to consent exactly as before — the check only moved earlier. The answer rides on the
+    # entry so `_label_for` reuses it instead of asking the registry twice.
+    refused: dict[str, tuple[ServerSnapshot, dict]] = {}
+    if getattr(args, "supply_chain", False):
+        checked_targets = []
+        for n, e in targets:
+            if e.get("command"):
+                e, refused_snap = _registry_gate(n, e)
+                if refused_snap is not None:
+                    refused[n] = (refused_snap, e)
+                    continue
+            checked_targets.append((n, e))
+        targets = checked_targets
     # Default-deny consent before LAUNCHING any discovered/configured stdio server (spawning runs its
     # code). Explicit --stdio never reaches here; remote servers aren't spawned so they always pass.
     approved = gate_stdio_consent(targets, assume_yes=getattr(args, "yes", False))
@@ -326,7 +351,39 @@ async def _run(args) -> tuple[list[ServerSnapshot], dict[str, dict], list[tuple[
         held_snaps = _measure_through_signin(approved)
     snaps = await asyncio.gather(*(probe(e, n) for n, e in approved if n not in held_snaps))
     out = list(snaps) + [held_snaps[n] for n, _ in approved if n in held_snaps]
-    return out, {n: e for n, e in approved}, skipped
+    out += [snap for snap, _ in refused.values()]
+    return out, {**{n: e for n, e in approved}, **{n: e for n, (_, e) in refused.items()}}, skipped
+
+
+def _registry_gate(name: str, entry: dict) -> tuple[dict, ServerSnapshot | None]:
+    """Ask the registry about a stdio entry BEFORE it is launched — ONE gate for the config path
+    and `--stdio`. Returns the entry carrying the answer (so `_label_for` reuses it rather than
+    asking twice) and, when the registry says the package does not exist, the not-launched
+    snapshot that replaces the launch. Could-not-check, young and thin names return None: they go
+    on to launch (and, on the config path, to consent) exactly as before."""
+    finding = check_supply_chain(entry["command"], entry.get("args") or [])
+    entry = {**entry, "_supply_chain": _supply_chain_record(finding)}
+    if finding is not None and finding.missing:
+        return entry, _not_launched_snapshot(name, finding)
+    return entry, None
+
+
+def _supply_chain_record(finding) -> dict:
+    """The supply-chain field as the label carries it — ONE definition for the pre-launch gate and
+    `_label_for`, so the reused answer and a fresh one cannot drift apart."""
+    return (asdict(finding) if finding else
+            {"checked": False, "reason": "package not recognised from the launch command"})
+
+
+def _not_launched_snapshot(name: str, finding) -> ServerSnapshot:
+    """A server we REFUSED to launch because its registry says the package does not exist. A
+    failure snapshot (never CLEAN, never recorded as a baseline) with its own kind, so no renderer
+    calls it "could not scan" or "launch failed": nothing was run, by design."""
+    registry = {"npm": "npm", "pypi": "PyPI"}.get(finding.ecosystem, finding.ecosystem)
+    return ServerSnapshot(
+        name=name, transport="stdio", protocol_version=None, tools=[],
+        error=f"not launched — `{finding.package}` is not on {registry}",
+        error_kind="not-launched")
 
 
 def _measure_through_signin(approved: list[tuple[str, dict]]) -> dict[str, ServerSnapshot]:
@@ -447,10 +504,11 @@ def _label_for(sn: ServerSnapshot, m, entry: dict, args, shadow: dict | None = N
     # Both opt-in: supply-chain hits a public registry (egress), oauth-scopes reads a credential the
     # user already supplied (no egress, but still consent-gated).
     if args.supply_chain and entry.get("command"):
-        finding = check_supply_chain(entry["command"], entry.get("args") or [])
+        # Already asked before the launch (see `_run`) on the config path: reuse that answer — one
+        # registry call per server. The explicit --stdio path and the sign-in re-scan still ask here.
         label["x-mcpgawk"]["supply_chain"] = (
-            asdict(finding) if finding else {"checked": False,
-                                             "reason": "package not recognised from the launch command"})
+            entry["_supply_chain"] if "_supply_chain" in entry else
+            _supply_chain_record(check_supply_chain(entry["command"], entry.get("args") or [])))
     if args.oauth_scopes:
         label["x-mcpgawk"]["oauth_scopes"] = inspect_oauth_scopes(entry.get("headers"))
     return label
@@ -573,8 +631,10 @@ def build_parser() -> argparse.ArgumentParser:
                    help="print the full narrative report for EVERY server instead of the fleet "
                         "status list (the list is the default when more than one server is scanned)")
     s.add_argument("--supply-chain", action="store_true",
-                   help="opt-in: query the public npm/PyPI registry for the launched package's "
-                        "deprecation/yank status (network egress — package name+version only)")
+                   help="opt-in: looks up the package name (and pinned version) of every stdio "
+                        "server on npm/PyPI before anything launches — including servers you then "
+                        "decline — so a made-up or brand-new name is caught, and one the registry "
+                        "does not have is never launched; nothing else is sent")
     s.add_argument("--oauth-scopes", action="store_true",
                    help="opt-in: locally decode a supplied Bearer JWT's scope claim (no network; "
                         "reads a credential you already provided)")
@@ -2424,10 +2484,13 @@ def _dispatch(argv: list[str] | None = None) -> int:
     unlabelled = [r for r in rows if r.name not in {lab["name"] for lab in labels}]
     if unlabelled:
         print("\n" + fleet.render_fleet(unlabelled))
-    # Local (stdio) servers — launched this run or merely configured. Both inherit the same
-    # ambient credentials the moment anything starts them, so both count towards that warning.
-    local_servers = (sum(1 for e in entries.values() if e.get("command"))
-                     + sum(1 for _, e in skipped if e.get("command")))
+    # Local (stdio) servers — launched this run or merely configured. Both inherit the same ambient
+    # credentials the moment anything starts them (your IDE starts a server you declined HERE), so
+    # both count, as 4dd441f decided. The one exception is a package the registry says does not
+    # exist (error_kind "not-launched"): nothing can start it anywhere, so it inherits nothing.
+    not_run = {s.name for s in snaps if s.error_kind == "not-launched"}
+    local_servers = (sum(1 for n, e in entries.items() if e.get("command") and n not in not_run)
+                     + sum(1 for n, e in skipped if e.get("command") and n not in not_run))
     # A first sighting renders in full, so its summary does too: the first successful scan of a
     # local server is exactly when a new developer needs to see what it inherits (walk, 2026-09-26).
     first_sighting = any(lab["name"] in new_baselines or lab["name"] in reidentified
@@ -2439,7 +2502,10 @@ def _dispatch(argv: list[str] | None = None) -> int:
     # Only with servers to check: with none, "these servers" named nothing and "`mcpgawk` turns
     # that on" told a user who had just run `mcpgawk` to run it again (new-developer walk,
     # 2026-09-26). The empty case already printed how to check a server before adding it.
-    _protection_nudge(bool(labels or unlabelled or skipped))
+    # ...and never when every server was refused as non-existent: "turn checking on for these
+    # servers" is wrong advice about a package that does not exist (gate slice, 2026-09-28).
+    _named = ({lab["name"] for lab in labels} | {r.name for r in unlabelled} | {n for n, _ in skipped})
+    _protection_nudge(bool(_named - not_run))
     _behavioural_capability_note()
     return 1 if (any_error or failed) else 0
 

{mcpgawk-0.1.65 → mcpgawk-0.1.67}/src/mcpgawk/configcheck.py

@@ -35,7 +35,7 @@ from typing import Any
 
 from .ambient import _CREDENTIAL_NAME
 from .signals import Finding, _credential_line
-from .supplychain import _split_npm_spec, extract_package
+from .supplychain import _split_npm_spec, registry_target
 
 #: Registry of every kind this module may emit — the canary test walks it both ways (every kind
 #: literal below is registered; every registered kind has a firing fixture).
@@ -64,9 +64,9 @@ def _unpinned_package(name: str, entry: dict[str, Any]) -> list[Finding]:
     command = entry.get("command") or ""
     if not command:
         return []                                   # remote servers have no launch spec
-    pkg = extract_package(command, entry.get("args") or [])
+    pkg = registry_target(command, entry.get("args") or [])
     if not pkg:
-        return []                                   # bare local binary — supplychain's own rule: skip, never guess
+        return []                                   # not a registry package (a path, a script, `uv run`, a git URL) — skip, never guess
     eco, spec = pkg
     if eco == "npm":
         _, pin = _split_npm_spec(spec)

{mcpgawk-0.1.65 → mcpgawk-0.1.67}/src/mcpgawk/decide.py

@@ -370,7 +370,7 @@ def serve(port: int = DEFAULT_PORT, open_browser: bool = True, log=print) -> int
     Refuses in an agent session for the same reason `approve` does: this screen exists to put a
     HUMAN in front of the decision, and an agent that can start it can drive it."""
     blocked = baseline.approval_blocked_reason()
-    if blocked and os.environ.get(baseline.APPROVE_OVERRIDE_ENV) != "1":
+    if blocked:
         log(f"mcpgawk decide: refusing — {blocked}")
         return 4
 

{mcpgawk-0.1.65 → mcpgawk-0.1.67}/src/mcpgawk/demo.py

@@ -163,7 +163,9 @@ class _Sandbox:
         self.mode.write_text(mode)
 
     def env(self) -> dict[str, str]:
-        env = dict(os.environ)
+        # The sandbox's own children are not the caller's agent: the CI hatch below no longer
+        # waives an agent-session marker, and the demo must still run from inside Claude Code.
+        env = {k: v for k, v in os.environ.items() if k not in history.AGENT_ENV_MARKERS}
         env.update({
             "HOME": str(self.home),
             history.STORE_ENV: str(self.history),

{mcpgawk-0.1.65 → mcpgawk-0.1.67}/src/mcpgawk/fleet.py

@@ -63,6 +63,10 @@ class FleetRow:
     # from the user's own config (an `env` API key), so it is never in the default fleet-json — see
     # `--with-spec`, which only the local web UI requests, in-process, over loopback.
     spec: dict[str, Any] | None = None
+    # SKIPPED by refusal (the registry says its package does not exist), not by withheld consent —
+    # so the "re-run with --yes" next step, which would not launch it, is never offered for it.
+    # Terminal-only: not part of the fleet-json payload (its `detail` already says why).
+    refused: bool = False
 
     @property
     def needs_auth(self) -> bool:
@@ -102,6 +106,13 @@ def state_of(label: dict[str, Any]) -> tuple[str, str]:
             return "AUTH", "stored sign-in can't be decrypted (its key changed) — sign in again"
         if x.get("error_kind") == "registration-refused":
             return "AUTH", "refuses automatic registration — sign in with --oauth-client-id"
+        if x.get("error_kind") == "not-launched":
+            # SKIPPED, not a new state: STATES is pinned by the IDE extension (FLEET_SCHEMA). It WAS
+            # skipped — deliberately — and the detail says why, which --yes does not change.
+            sc = x.get("supply_chain") or {}
+            registry = {"npm": "npm", "pypi": "PyPI"}.get(sc.get("ecosystem"), "its registry")
+            return "SKIPPED", (f"not launched — `{sc.get('package', '?')}` is not on {registry} "
+                               f"(hallucinated or not yet registered)")
         if x.get("error_kind") == "misconfigured":
             return "UNREACHABLE", "config entry is not usable"
         if x.get("error_kind") == "not-an-mcp-endpoint":
@@ -244,7 +255,8 @@ def build_rows(labels: list[dict[str, Any]], entries: dict[str, dict[str, Any]]
         entry = entries.get(lab["name"]) or {}
         rows.append(FleetRow(name=lab["name"], state=state, detail=detail, url=entry.get("url"),
                              clients=tuple(entry.get("_clients") or ()), names=dict(entry.get("_names") or {}),
-                             spec=_spec_of(entry) if with_spec else None))
+                             spec=_spec_of(entry) if with_spec else None,
+                             refused=lab["x-mcpgawk"].get("error_kind") == "not-launched"))
     for n, e in (skipped or []):
         row = skipped_row(n, e)
         if with_spec:
@@ -365,8 +377,12 @@ def render_fleet(rows: list[FleetRow], scanned_at: str | None = None) -> str:
         # follow-up that is actually true for the run it's in.
         out.append(f"  {n_auth} {'needs' if n_auth == 1 else 'need'} credentials before "
                    f"{'it' if n_auth == 1 else 'they'} can be scanned.")
-    elif counts["SKIPPED"]:
+    elif any(r.state == "SKIPPED" and not r.refused for r in rows):
         out.append("  Local servers were not launched. Re-run with --yes to scan them too.")
+    elif counts["SKIPPED"]:
+        # Only refusals are skipped: --yes would not launch them, so never suggest it.
+        out.append("  A server names a package its registry does not have — it was not launched. "
+                   "Check the name before you trust it.")
     elif counts["REVIEW"] or counts["INCOMPLETE"]:
         out.append("  Look closer at one:  mcpgawk scan --only <name> --detail")
     return "\n".join(out)

{mcpgawk-0.1.65 → mcpgawk-0.1.67}/src/mcpgawk/history.py

@@ -103,7 +103,8 @@ AGENT_ENV_MARKERS = ("CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "AI_AGENT", "CURSOR
 
 #: The deliberate escape hatch for CI, which legitimately has no TTY and no human. Deliberately NOT
 #: mentioned in any blocked-call message: the whole point is that an agent reading a denial cannot
-#: learn the bypass from it.
+#: learn the bypass from it. It waives ONLY the missing terminal, never an agent-session marker:
+#: an agent with a shell can set an env var as easily as a pipeline can (founder 2026-09-27).
 APPROVE_OVERRIDE_ENV = "MCPGAWK_APPROVE_NONINTERACTIVE"
 
 
@@ -140,13 +141,16 @@ def approval_blocked_reason() -> str | None:
     same write without it.
     """
     agent = [m for m in AGENT_ENV_MARKERS if os.environ.get(m)]
-    if os.environ.get(APPROVE_OVERRIDE_ENV) == "1":
-        return None
+    # The agent check comes FIRST and the CI hatch cannot waive it. Until 2026-09-27 the hatch was
+    # read first, so `MCPGAWK_APPROVE_NONINTERACTIVE=1 mcpgawk approve` from inside an agent
+    # session moved the baseline — one env var, settable by the very agent this gate exists to stop.
     if agent:
         return (f"this looks like an agent session ({', '.join(agent)} set). Moving the trusted "
                 f"baseline is a decision for the person at the keyboard, not for the assistant — "
                 f"a blocked tool call is exactly when an agent would be asked to approve its way "
                 f"past one. Run this yourself in your own terminal.")
+    if os.environ.get(APPROVE_OVERRIDE_ENV) == "1":
+        return None
     if not sys.stdin.isatty():
         return ("no interactive terminal. Approving a changed server is a trust decision and needs "
                 "a human present; refusing rather than assuming consent.")

{mcpgawk-0.1.65 → mcpgawk-0.1.67}/src/mcpgawk/label.py

@@ -16,6 +16,7 @@ from .measure import Measurement, is_structural_basis
 from .signals import is_instruction_finding
 from .probe import ServerSnapshot
 from .servercard import compare_to_reality
+from .supplychain import YOUNG_DAYS as _YOUNG_DAYS
 
 LABEL_SCHEMA = "mcpgawk/label@0.1"
 
@@ -542,13 +543,17 @@ def build_narrative(label: dict[str, Any]) -> dict[str, Any]:
         state = "auth-required" if kind in ("auth-required", "sign-in-failed", "registration-refused",
                                             "login-unreadable", "sign-in-incomplete",
                                             "access-denied") else "unreachable"
+        if kind == "not-launched":
+            state = "not-launched"      # refused before launch — nothing was tried, so not "unreachable"
         verdict = {"sign-in-failed": "AUTH — SIGN-IN FAILED (may be mcpgawk's fault)",
                    "sign-in-incomplete": "AUTH — SIGN-IN NOT COMPLETED (run again and approve)",
                    "access-denied": "AUTH — SIGNED IN, ACCESS REFUSED (HTTP 403)",
                    "login-unreadable": "AUTH — STORED SIGN-IN UNREADABLE (sign in again)",
                    "registration-refused": "AUTH — REFUSES AUTOMATIC REGISTRATION",
                    # It answered — "UNREACHABLE" was false for a web page (T1, 2026-09-25).
-                   "not-an-mcp-endpoint": "NOT AN MCP ENDPOINT"}.get(
+                   "not-an-mcp-endpoint": "NOT AN MCP ENDPOINT",
+                   # Refused before launch: the registry says the package does not exist.
+                   "not-launched": "NOT LAUNCHED — PACKAGE DOES NOT EXIST"}.get(
             kind, "AUTH REQUIRED" if state == "auth-required" else "UNREACHABLE")
     elif empty:
         # Zoho, 2026-09-24: 0 tools rendered CLEAN. Nothing measured is not a clean bill.
@@ -694,6 +699,44 @@ def _tool_list(tools: list[dict[str, Any]], n: int, visible_only: bool = False)
     return out
 
 
+_ECOSYSTEM_NAME = {"npm": "npm", "pypi": "PyPI"}
+
+
+def _supply_chain_lines(sc: dict[str, Any] | None) -> list[str]:
+    """The opt-in `--supply-chain` result. Four outcomes that must never be confused: not checked,
+    could not check (no answer), MISSING (the registry answered: no such name) and checked."""
+    if sc is None:
+        return []
+    if sc.get("checked") is False:
+        return [f"    supply-chain: {sc['reason']}"]
+    eco, pkg = sc.get("ecosystem", "?"), sc.get("package", "?")
+    registry = _ECOSYSTEM_NAME.get(eco, eco)
+    if sc.get("error"):
+        return [f"    supply-chain: {eco}:{pkg} — could not check the {registry} registry "
+                f"({sc['error']}). Not checked is not clean."]
+    if sc.get("missing"):
+        return [f"    supply-chain: {eco}:{pkg}  ✗ NOT ON {registry.upper()} — hallucinated or not "
+                f"yet registered; nothing to trust yet. Do not launch it."]
+    flags = []
+    if sc.get("deprecated"):
+        flags.append("⚠ DEPRECATED/YANKED" + (f" — {sc['detail']}" if sc.get("detail") else ""))
+    if sc.get("young"):
+        age, n = sc.get("age_days"), sc.get("release_count")
+        releases = f"{n} release{'' if n == 1 else 's'}" if n is not None else None
+        if age is not None and age < _YOUNG_DAYS:
+            flags.append(f"⚠ young name — first published {sc['first_published']} "
+                         f"({age} day{'' if age == 1 else 's'} ago)"
+                         + (f", {releases}" if releases else "")
+                         + " — a young name is exactly what a squatter registers")
+        else:
+            flags.append(f"⚠ thin history — only {releases} since {sc.get('first_published')} "
+                         f"— a thin history is exactly what a squatter registers")
+    head = f"    supply-chain: {eco}:{pkg}@{sc.get('version')}  "
+    if not flags:
+        return [head + "ok"]
+    return [head + flags[0], *(f"      {f}" for f in flags[1:])]
+
+
 def render_cli(label: dict[str, Any], verbose: bool = False, shown: str | None = None) -> str:
     x = label["x-mcpgawk"]
     ts = x["trust_surface"]
@@ -710,13 +753,19 @@ def render_cli(label: dict[str, Any], verbose: bool = False, shown: str | None =
     nar = x.get("narrative") or build_narrative(label)
     concerns = [(c["title"], c["body"]) for c in nar["concerns"]]
     verdict = nar["verdict"]
-    failed = nar["state"] in ("unreachable", "auth-required")
+    failed = nar["state"] in ("unreachable", "auth-required", "not-launched")
     has_dispatch = nar["dispatch"]
 
     lines = [f"● {shown or display_name(label)}   [{label['transport']}]   {verdict}"]
 
     if failed:
         detail = nar["failure"]["detail"]
+        if x.get("error_kind") == "not-launched":
+            # Not a failure to scan: a refusal to RUN. "could not scan" would read as something to
+            # retry; the registry line below says why it must not be.
+            lines.append(f"    ✗ {detail}. Nothing was run; this did NOT pass.")
+            lines.extend(_supply_chain_lines(x.get("supply_chain")))
+            return "\n".join(lines)
         lines.append(f"    ✗ could not scan — {detail}. This did NOT pass; it was not measured.")
         # The next-step hint must match the KIND of failure. Telling someone whose endpoint answered
         # 401 that "a docs URL is not an MCP endpoint" sends them to debug a URL that was right.
@@ -763,6 +812,9 @@ def render_cli(label: dict[str, Any], verbose: bool = False, shown: str | None =
             lines.append("      Is it a live MCP endpoint? A docs / repo / package URL is not one.")
             lines.append("      A local server needs:  mcpgawk scan --stdio \"<launch command>\"")
         # Any other kind: its headline already says what happened; a guessed hint would mislead.
+        # The supply-chain line still prints: `npx -y <a name that does not exist>` FAILS to launch,
+        # and the registry's answer is the one line that says why.
+        lines.extend(_supply_chain_lines(x.get("supply_chain")))
         return "\n".join(lines)
 
     if has_dispatch:
@@ -868,16 +920,7 @@ def render_cli(label: dict[str, Any], verbose: bool = False, shown: str | None =
 
     if verbose:
         lines.append(f"    coverage: {x['tool_count']} tools, {x['prompt_count']} prompts, {x['resource_count']} resources")
-    sc = x.get("supply_chain")
-    if sc is not None:
-        if sc.get("error"):
-            lines.append(f"    supply-chain: {sc['ecosystem']}:{sc['package']} — lookup failed ({sc['error']})")
-        elif sc.get("checked") is False:
-            lines.append(f"    supply-chain: {sc['reason']}")
-        else:
-            flag = "⚠ DEPRECATED/YANKED" if sc["deprecated"] else "ok"
-            lines.append(f"    supply-chain: {sc['ecosystem']}:{sc['package']}@{sc['version']}  {flag}"
-                         + (f" — {sc['detail']}" if sc.get("detail") else ""))
+    lines.extend(_supply_chain_lines(x.get("supply_chain")))
     if "oauth_scopes" in x:
         os_ = x["oauth_scopes"]
         if os_ is None:
@@ -917,8 +960,14 @@ def render_summary(labels: list[dict[str, Any]], local_servers: int = 0) -> str:
     else:
         body = (f"{servers}{f' ({failed} not measured)' if failed else ''} · {tools} tool{'s' if tools != 1 else ''} · "
                 f"{toks:,} tokens loaded into every session · {flagged} can change or send data.")
-    out = ("─" * 64 + f"\n{body}\n"
-           "Scanned locally — your server inventory never left this machine.")
+    # The local-only line must stay TRUE. With --supply-chain, package names went to the npm/PyPI
+    # registry, and "never left this machine" beside that would be the one claim a sceptical reader
+    # can disprove by watching the network (found by the pre-launch gate slice, 2026-09-28).
+    _sent = any((lab.get("x-mcpgawk") or {}).get("supply_chain") for lab in all_labels)
+    _local = ("Scanned locally. --supply-chain sent only package names and pinned versions to the npm/PyPI "
+              "registry — never your tools or configs." if _sent
+              else "Scanned locally — your server inventory never left this machine.")
+    out = ("─" * 64 + f"\n{body}\n" + _local)
     # What those local servers inherit but no config declares. Only ever printed when there is both
     # something to inherit and something to inherit it — see ambient.summarize.
     ambient_lines = summarize(detect_ambient(), local_servers, exfil)