mcpxray-cli 1.0.0__py3-none-any.whl

mcpxray/report/sarif.py

@@ -0,0 +1,76 @@
+"""SARIF 2.1.0 report for GitHub code scanning and other SARIF consumers."""
+
+from __future__ import annotations
+
+import json as _json
+from typing import TYPE_CHECKING
+
+from mcpxray import __version__
+from mcpxray.ir import SEVERITY_ERROR, SEVERITY_INFO, SEVERITY_WARNING
+
+if TYPE_CHECKING:
+    from mcpxray.ir import Diagnostic, McpServer
+    from mcpxray.score import ScoreResult
+
+# SARIF level mapping: error→error, warning→warning, info→note.
+_LEVEL = {
+    SEVERITY_ERROR: "error",
+    SEVERITY_WARNING: "warning",
+    SEVERITY_INFO: "note",
+}
+
+
+def render(
+    diags: list[Diagnostic],
+    doc: McpServer | None = None,
+    score_result: ScoreResult | None = None,
+) -> str:
+    rule_index: dict[str, int] = {}
+    rules: list[dict] = []
+    results: list[dict] = []
+
+    for d in diags:
+        if d.rule_id not in rule_index:
+            rule_index[d.rule_id] = len(rules)
+            rules.append(
+                {
+                    "id": d.rule_id,
+                    "defaultConfiguration": {"level": _LEVEL.get(d.severity, "warning")},
+                }
+            )
+        location: dict = {}
+        if d.file:
+            location = {
+                "physicalLocation": {
+                    "artifactLocation": {"uri": d.file},
+                    "region": {"startLine": d.line or 1},
+                }
+            }
+        result: dict = {
+            "ruleId": d.rule_id,
+            "level": _LEVEL.get(d.severity, "warning"),
+            "message": {"text": d.message},
+            "ruleIndex": rule_index[d.rule_id],
+        }
+        if location:
+            result["locations"] = [location]
+        results.append(result)
+
+    sarif = {
+        "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+        "version": "2.1.0",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "mcpxray",
+                        "version": __version__,
+                        "informationUri": "https://github.com/cloudroad-io/mcpxray",
+                        "rules": rules,
+                    }
+                },
+                "results": results,
+            }
+        ],
+    }
+    return _json.dumps(sarif, indent=2)

mcpxray/rules/__init__.py

@@ -0,0 +1,8 @@
+"""Lint rules for MCP servers."""
+
+from __future__ import annotations
+
+from mcpxray.rules import builtin  # noqa: F401  — registers builtin rules
+from mcpxray.rules.base import Rule, register_rule, rules, run_all
+
+__all__ = ["Rule", "register_rule", "rules", "run_all"]

mcpxray/rules/base.py

@@ -0,0 +1,67 @@
+"""Rule API, registry, and runner.
+
+A :class:`Rule` inspects a :class:`~mcpxray.ir.McpServer` and yields
+:class:`~mcpxray.ir.Diagnostic` findings. Builtins self-register via
+:func:`register_rule`; external packages declare an entry-point in the
+``mcpxray.rules`` group. ``run_all`` applies every applicable rule, sorts the
+findings by severity (errors first), and mirrors them onto ``doc.diagnostics``.
+"""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from collections.abc import Iterable
+
+from mcpxray.ir import (
+    RISK_MEDIUM,
+    SEVERITY_WARNING,
+    Diagnostic,
+    McpServer,
+    severity_rank,
+)
+
+# Stable plugin API for rule authors (see CONTRIBUTING.md → "Plugin API
+# stability"). Methods/attributes of ``Rule`` below are part of the contract;
+# ``_RULES`` and any ``_``-prefixed name are internal.
+__all__ = ["Rule", "register_rule", "rules", "run_all"]
+
+_RULES: list[type[Rule]] = []
+
+
+class Rule(ABC):
+    """Base class for all lint rules."""
+
+    id: str = ""
+    severity: str = SEVERITY_WARNING
+    risk: str = RISK_MEDIUM  # scoring weight
+
+    def applies(self, doc: McpServer) -> bool:  # noqa: ARG002
+        """Override to gate the rule (e.g. source-only vs manifest-only)."""
+        return True
+
+    @abstractmethod
+    def check(self, doc: McpServer) -> Iterable[Diagnostic]:
+        """Yield findings for this rule."""
+
+
+def register_rule(cls: type[Rule]) -> type[Rule]:
+    """Class decorator: register a :class:`Rule` subclass."""
+    _RULES.append(cls)
+    return cls
+
+
+def rules() -> list[type[Rule]]:
+    """All registered rule classes (builtins first, registration order)."""
+    return list(_RULES)
+
+
+def run_all(doc: McpServer) -> list[Diagnostic]:
+    """Run every applicable rule; return findings sorted by severity (errors first)."""
+    diags: list[Diagnostic] = []
+    for cls in _RULES:
+        rule = cls()
+        if rule.applies(doc):
+            diags.extend(rule.check(doc))
+    diags.sort(key=lambda d: -severity_rank(d.severity))
+    doc.diagnostics.extend(diags)
+    return diags

mcpxray/rules/builtin/__init__.py

@@ -0,0 +1,5 @@
+"""Builtin lint rules. Importing this package registers every rule."""
+
+from __future__ import annotations
+
+from mcpxray.rules.builtin import descriptions, schema, source, supply, transport  # noqa: F401

mcpxray/rules/builtin/descriptions.py

@@ -0,0 +1,103 @@
+"""Rules over tool descriptions: tool poisoning (MCP101) and hygiene (MCP107)."""
+
+from __future__ import annotations
+
+import re
+import unicodedata
+
+from mcpxray.ir import (
+    RISK_CRITICAL,
+    RISK_LOW,
+    SEVERITY_ERROR,
+    SEVERITY_WARNING,
+    Diagnostic,
+    McpServer,
+)
+from mcpxray.rules.base import Rule, register_rule
+
+# Indirect-prompt-injection signatures commonly embedded in poisoned tool
+# descriptions (the channel the model trusts most — see Invariant Labs / OWASP).
+_POISON_PATTERNS = [
+    re.compile(p, re.IGNORECASE)
+    for p in (
+        r"ignore\s+(?:all\s+)?previous\s+(?:instructions?|prompts?|rules?)",
+        r"disregard\s+(?:all|the|any|previous|above)",
+        r"do\s+not\s+(?:show|reveal|display|mention|report)\s+(?:this|the|your)",
+        r"instead\s+of\s+(?:responding|answering|following|showing|executing)",
+        r"you\s+are\s+(?:now|actually)\s+(?:a|an)\b",
+        r"(?:exfiltrate|upload|send|post|transmit|leak).{0,40}?"
+        r"(?:to\s+(?:an?\s+)?(?:url|webhook|http|server|email|attacker)|https?://)",
+        r"</?(?:system|secret|hidden|implicit)\s*>",
+        r"before\s+answering(?:,|:)\s*(?:read|fetch|include|append)",
+    )
+]
+
+_DESC_TOO_LONG = 4096  # bloats the context budget on every request
+
+
+def _hidden_format_chars(text: str) -> list[str]:
+    """Zero-width / bidi-override characters invisible to humans but read by the model."""
+    return [ch for ch in text if unicodedata.category(ch) == "Cf"]
+
+
+@register_rule
+class ToolPoisoning(Rule):
+    id = "MCP101"
+    severity = SEVERITY_ERROR
+    risk = RISK_CRITICAL
+
+    def check(self, doc: McpServer):  # type: ignore[override]
+        for tool in doc.tools:
+            if not tool.description:
+                continue
+            for pattern in _POISON_PATTERNS:
+                for m in pattern.finditer(tool.description):
+                    yield Diagnostic(
+                        self.id,
+                        self.severity,
+                        f"tool '{tool.name}': description contains a possible prompt-injection "
+                        f"signature ({m.group(0)!r})",
+                        tool=tool.name,
+                        file=tool.source_path,
+                        line=tool.line,
+                    )
+            hidden = _hidden_format_chars(tool.description)
+            if hidden:
+                yield Diagnostic(
+                    self.id,
+                    self.severity,
+                    f"tool '{tool.name}': description contains hidden format/bidi characters "
+                    f"({len(hidden)})",
+                    tool=tool.name,
+                    file=tool.source_path,
+                    line=tool.line,
+                )
+
+
+@register_rule
+class DescriptionHygiene(Rule):
+    id = "MCP107"
+    severity = SEVERITY_WARNING
+    risk = RISK_LOW
+
+    def check(self, doc: McpServer):  # type: ignore[override]
+        for tool in doc.tools:
+            if not tool.description or not tool.description.strip():
+                yield Diagnostic(
+                    self.id,
+                    self.severity,
+                    f"tool '{tool.name}': no description; model can't decide when to call it",
+                    tool=tool.name,
+                    file=tool.source_path,
+                    line=tool.line,
+                )
+            elif len(tool.description) > _DESC_TOO_LONG:
+                yield Diagnostic(
+                    self.id,
+                    self.severity,
+                    f"tool '{tool.name}': description is {len(tool.description)} chars "
+                    f"(>{_DESC_TOO_LONG}); bloats the context budget on every request",
+                    tool=tool.name,
+                    file=tool.source_path,
+                    line=tool.line,
+                )

mcpxray/rules/builtin/schema.py

@@ -0,0 +1,115 @@
+"""Schema rules: weak/unvalidatable schemas (MCP104) and strict-client compatibility (MCP106)."""
+
+from __future__ import annotations
+
+from mcpxray.ir import RISK_MEDIUM, SEVERITY_WARNING, Diagnostic, McpServer
+from mcpxray.rules.base import Rule, register_rule
+
+# Keywords strict clients (Cursor, ChatGPT tool-calling) handle poorly or reject.
+_STRICT_INCOMPAT_KEYS = ("$ref", "oneOf", "anyOf", "allOf")
+
+
+@register_rule
+class WeakSchema(Rule):
+    id = "MCP104"
+    severity = SEVERITY_WARNING
+    risk = RISK_MEDIUM
+
+    def check(self, doc: McpServer):  # type: ignore[override]
+        for tool in doc.tools:
+            schema = tool.input_schema or {}
+            props = schema.get("properties") or {}
+            required = schema.get("required") or []
+            if props and not required:
+                yield Diagnostic(
+                    self.id,
+                    self.severity,
+                    f"tool '{tool.name}': schema has no required parameters -- accepts anything",
+                    tool=tool.name,
+                    file=tool.source_path,
+                    line=tool.line,
+                )
+            for pname, pschema in props.items():
+                if isinstance(pschema, dict) and not pschema:
+                    yield Diagnostic(
+                        self.id,
+                        self.severity,
+                        f"tool '{tool.name}': parameter '{pname}' has no type -- unvalidatable",
+                        tool=tool.name,
+                        file=tool.source_path,
+                        line=tool.line,
+                    )
+
+
+@register_rule
+class SchemaCompatibility(Rule):
+    id = "MCP106"
+    severity = SEVERITY_WARNING
+    risk = RISK_MEDIUM
+
+    def check(self, doc: McpServer):  # type: ignore[override]
+        for tool in doc.tools:
+            schema = tool.input_schema or {}
+            if not isinstance(schema, dict) or not schema:
+                continue
+            bad = next((k for k in _STRICT_INCOMPAT_KEYS if k in schema), None)
+            if bad:
+                yield Diagnostic(
+                    self.id,
+                    self.severity,
+                    f"tool '{tool.name}': schema uses '{bad}', which strict clients "
+                    f"(Cursor/ChatGPT) may reject",
+                    tool=tool.name,
+                    file=tool.source_path,
+                    line=tool.line,
+                )
+            elif "type" not in schema and "properties" not in schema:
+                yield Diagnostic(
+                    self.id,
+                    self.severity,
+                    f"tool '{tool.name}': schema declares no 'type'",
+                    tool=tool.name,
+                    file=tool.source_path,
+                    line=tool.line,
+                )
+
+
+@register_rule
+class SchemaImplDrift(Rule):
+    """MCP105 — a tool's declared inputSchema disagrees with its handler.
+
+    Caught when the handler destructures its arguments (so we know what it reads):
+    a parameter the schema declares but the handler ignores (clients must send
+    data the tool never uses), or one the handler reads but the schema doesn't
+    declare (unvalidated input bypasses the schema). Skipped when
+    :attr:`Tool.handler_params` is ``None`` — i.e. a bare ``args`` handler,
+    Python (where the schema *is* the signature), or a manifest tool.
+    """
+
+    id = "MCP105"
+    severity = SEVERITY_WARNING
+    risk = RISK_MEDIUM
+
+    def check(self, doc: McpServer):  # type: ignore[override]
+        for tool in doc.tools:
+            if tool.handler_params is None:
+                continue  # can't compare — undeterminable handler signature
+            declared = set((tool.input_schema or {}).get("properties") or {})
+            used = set(tool.handler_params)
+            ignored = sorted(declared - used)  # schema declares, handler doesn't read
+            unvalidated = sorted(used - declared)  # handler reads, schema doesn't validate
+            if not (ignored or unvalidated):
+                continue
+            parts: list[str] = []
+            if ignored:
+                parts.append(f"schema declares {ignored} but the handler doesn't read them")
+            if unvalidated:
+                parts.append(f"handler reads {unvalidated} but the schema doesn't declare them")
+            yield Diagnostic(
+                self.id,
+                self.severity,
+                f"tool '{tool.name}': " + "; ".join(parts),
+                tool=tool.name,
+                file=tool.source_path,
+                line=tool.line,
+            )

mcpxray/rules/builtin/source.py

@@ -0,0 +1,95 @@
+"""Source-scanning rules: secret exposure (MCP102) and dangerous capabilities (MCP103)."""
+
+from __future__ import annotations
+
+import re
+
+from mcpxray.ir import RISK_CRITICAL, RISK_HIGH, SEVERITY_ERROR, Diagnostic, McpServer
+from mcpxray.rules.base import Rule, register_rule
+
+# (pattern, human label). Tuned for precision — high-confidence secret shapes.
+_SECRET_PATTERNS: list[tuple[re.Pattern, str]] = [
+    (
+        re.compile(r"-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----"),
+        "private key",
+    ),
+    (re.compile(r"\bsk-[A-Za-z0-9]{20,}"), "OpenAI-style API key"),
+    (re.compile(r"\bAKIA[0-9A-Z]{16}\b"), "AWS access key id"),
+    (re.compile(r"\bgh[pousr]_[A-Za-z0-9]{36,}\b"), "GitHub token"),
+    (re.compile(r"\bglpat-[A-Za-z0-9_-]{20,}\b"), "GitLab token"),
+    (re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}\b"), "Slack token"),
+    (re.compile(r"\baiza[0-9A-Za-z_-]{35,}\b"), "Google API key"),
+    (
+        re.compile(
+            r"(?i)(?:api[_-]?key|secret|token|password|passwd)\s*[=:]\s*"
+            r"['\"]([A-Za-z0-9_\-+/=]{12,})['\"]"
+        ),
+        "hardcoded credential",
+    ),
+]
+
+# Dangerous primitives an MCP tool should rarely invoke directly.
+_RCE_PATTERNS: list[tuple[re.Pattern, str]] = [
+    (re.compile(r"\bos\.system\s*\("), "os.system (arbitrary shell command)"),
+    (re.compile(r"\bos\.popen\s*\("), "os.popen (arbitrary shell command)"),
+    (re.compile(r"(?<![\w.])eval\s*\("), "eval (arbitrary code execution)"),
+    (re.compile(r"(?<![\w.])exec\s*\("), "exec (arbitrary code execution)"),
+    (re.compile(r"\bpickle\.loads?\s*\("), "pickle deserialization (RCE risk)"),
+    (re.compile(r"\bmarshal\.loads?\s*\("), "marshal deserialization (RCE risk)"),
+    (
+        re.compile(
+            r"subprocess\.(?:run|Popen|call|check_output|check_call)"
+            r"\s*\([^)]*?shell\s*=\s*True",
+            re.S,
+        ),
+        "subprocess with shell=True (shell injection risk)",
+    ),
+]
+
+
+def _line_of(text: str, offset: int) -> int:
+    return text.count("\n", 0, offset) + 1
+
+
+@register_rule
+class SecretExposure(Rule):
+    id = "MCP102"
+    severity = SEVERITY_ERROR
+    risk = RISK_CRITICAL
+
+    def applies(self, doc: McpServer) -> bool:
+        return bool(doc.sources)
+
+    def check(self, doc: McpServer):  # type: ignore[override]
+        for path, text in doc.sources.items():
+            for pattern, label in _SECRET_PATTERNS:
+                for m in pattern.finditer(text):
+                    yield Diagnostic(
+                        self.id,
+                        self.severity,
+                        f"possible {label} exposed in source",
+                        file=path,
+                        line=_line_of(text, m.start()),
+                    )
+
+
+@register_rule
+class DangerousCapabilities(Rule):
+    id = "MCP103"
+    severity = SEVERITY_ERROR
+    risk = RISK_HIGH
+
+    def applies(self, doc: McpServer) -> bool:
+        return bool(doc.sources)
+
+    def check(self, doc: McpServer):  # type: ignore[override]
+        for path, text in doc.sources.items():
+            for pattern, label in _RCE_PATTERNS:
+                for m in pattern.finditer(text):
+                    yield Diagnostic(
+                        self.id,
+                        self.severity,
+                        f"dangerous capability: {label}",
+                        file=path,
+                        line=_line_of(text, m.start()),
+                    )

mcpxray/rules/builtin/supply.py

@@ -0,0 +1,92 @@
+"""Supply-chain rule: unpinned dependencies without a lockfile (MCP108)."""
+
+from __future__ import annotations
+
+import re
+
+from mcpxray.fix import exact_pin
+from mcpxray.ir import RISK_MEDIUM, SEVERITY_WARNING, Diagnostic, Fix, McpServer, TextEdit
+from mcpxray.rules.base import Rule, register_rule
+
+# npm: an exact bare version is reproducible; carets/tilde/ranges/wildcards/tags
+# drift. Pre-release/build suffixes (``1.2.3-beta.1``) still pin exactly. A bare
+# package name (``flask``) or a pip range (``>=2``) deliberately fails to match.
+_NPM_PIN_RE = re.compile(r"^[v=]?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$")
+
+
+def _is_pinned(spec: str) -> bool:
+    """True if ``spec`` makes an install reproducible.
+
+    Covers both ecosystems an MCP server can declare:
+    * **pip** — exact ``==1.2.3`` or compatible-release ``~=1.2``.
+    * **npm** — an exact bare version ``1.2.3`` / ``v1.2.3`` / ``=1.2.3``.
+    Ranges and floating tags (``>=``, ``^``, ``~``, ``*``, ``latest``, ``1.x``)
+    are *not* pinned — they resolve differently between installs.
+    """
+    spec = spec.strip()
+    if not spec:
+        return False
+    if "==" in spec or spec.startswith("~="):  # pip
+        return True
+    return bool(_NPM_PIN_RE.match(spec))  # npm exact version
+
+
+def _pin_edits(
+    dependencies: dict[str, str], unpinned: list[str], dep_file: str, *, pip: bool
+) -> list[TextEdit]:
+    """Literal ``TextEdit``\\s pinning each unpinned dep to its concrete floor.
+
+    Skips specs with no resolvable floor (``*``/``latest``/bare) or with extras
+    / env markers (``name[extra]`` / ``name ; python>'3'``) — rewriting those
+    textually is unsafe, so they're left for manual pinning. Each edit anchors on
+    the dep name so the fix engine's uniqueness check lands on the right site.
+    """
+    edits: list[TextEdit] = []
+    for name in unpinned:
+        spec = dependencies[name]
+        if "[" in spec or ";" in spec:
+            continue
+        pinned = exact_pin(spec, pip=pip)
+        if pinned is None:
+            continue
+        if pip:  # pyproject array element: ``"name<spec>"``
+            edits.append(TextEdit(old=f"{name}{spec}", new=f"{name}{pinned}"))
+        else:  # package.json pair: ``"name": "<spec>"``
+            edits.append(TextEdit(old=f'"{name}": "{spec}"', new=f'"{name}": "{pinned}"'))
+    return edits
+
+
+@register_rule
+class UnpinnedDependencies(Rule):
+    id = "MCP108"
+    severity = SEVERITY_WARNING
+    risk = RISK_MEDIUM
+
+    def applies(self, doc: McpServer) -> bool:
+        # A lockfile makes installs reproducible regardless of pin style.
+        return bool(doc.dependencies) and not doc.lockfiles
+
+    def check(self, doc: McpServer):  # type: ignore[override]
+        unpinned = sorted(n for n, spec in doc.dependencies.items() if not _is_pinned(spec))
+        if not unpinned:
+            return
+        shown = ", ".join(unpinned[:5])
+        more = f" (+{len(unpinned) - 5} more)" if len(unpinned) > 5 else ""
+        diag = Diagnostic(
+            self.id,
+            self.severity,
+            f"{len(unpinned)} unpinned dependencies and no lockfile: {shown}{more}",
+            file=doc.meta.path,
+        )
+        dep_file = doc.dep_file
+        if dep_file:
+            edits = _pin_edits(
+                doc.dependencies, unpinned, dep_file, pip=not dep_file.endswith("package.json")
+            )
+            if edits:
+                diag.fix = Fix(
+                    description="pin unpinned dependencies to their declared floor version",
+                    file=dep_file,
+                    edits=edits,
+                )
+        yield diag

mcpxray/rules/builtin/transport.py

@@ -0,0 +1,79 @@
+"""Transport rule: insecure network transport without TLS / auth (MCP109)."""
+
+from __future__ import annotations
+
+import re
+
+from mcpxray.ir import RISK_MEDIUM, SEVERITY_WARNING, Diagnostic, McpServer
+from mcpxray.rules.base import Rule, register_rule
+
+# Construction of an HTTP/SSE-based MCP transport (stdio is local and safe).
+# Covers the TS SDK (StreamableHTTP/SSE transports, ``transport: "http"|"sse"``)
+# and Python FastMCP (``.run(transport="http"|"sse"|"streamable_http")``).
+_HTTP_TRANSPORT_RE = re.compile(
+    r"StreamableHTTPServerTransport"
+    r"|SSEServerTransport"
+    r"|transport\s*[:=]\s*['\"](?:streamable_http|http|sse)['\"]"
+    r"|\.(?:connect|serve|start)\s*\(\s*['\"](?:http|sse)['\"]",
+    re.IGNORECASE,
+)
+
+# A non-loopback plain-HTTP endpoint — transport without TLS.
+_INSECURE_URL_RE = re.compile(r"http://(?!localhost|127\.0\.0\.1|0\.0\.0\.0|\[?::1\]?)")
+
+# Signals that transport is encrypted or authenticated (suppress MCP109).
+_TLS_RE = re.compile(
+    r"https://|\bssl\b|\btls\b|createSecureContext|SecureServer|SSLContext",
+    re.IGNORECASE,
+)
+_AUTH_RE = re.compile(
+    r"authenticate|authorization|bearer|api[_-]?key|authmiddleware|verifytoken"
+    r"|requires_auth|httpbasic|oauth|verify_token|@authenticated",
+    re.IGNORECASE,
+)
+
+
+@register_rule
+class InsecureTransport(Rule):
+    """MCP109 — an HTTP/SSE transport exposed without TLS or authentication.
+
+    Only inspected when the server actually constructs a network transport
+    (``stdio`` is local, so it's out of scope). Two independent warnings:
+
+    * a non-loopback ``http://`` endpoint and no TLS anywhere → *no encryption*;
+    * no auth primitive anywhere → *unauthenticated* (any reachable client can
+      invoke the tools).
+
+    Both are warnings: a reverse proxy may legitimately provide TLS/auth, so the
+    finding is surfaced for review rather than treated as a hard error.
+    """
+
+    id = "MCP109"
+    severity = SEVERITY_WARNING
+    risk = RISK_MEDIUM
+
+    def applies(self, doc: McpServer) -> bool:
+        return bool(doc.sources)
+
+    def check(self, doc: McpServer):  # type: ignore[override]
+        blob = "\n".join(doc.sources.values())
+        if not _HTTP_TRANSPORT_RE.search(blob):
+            return  # stdio / no transport — nothing to flag
+        has_tls = bool(_TLS_RE.search(blob))
+        has_auth = bool(_AUTH_RE.search(blob))
+        if _INSECURE_URL_RE.search(blob) and not has_tls:
+            yield Diagnostic(
+                self.id,
+                self.severity,
+                "HTTP transport endpoint without TLS — use https so tool traffic "
+                "isn't sent in the clear",
+                file=doc.meta.path,
+            )
+        if not has_auth:
+            yield Diagnostic(
+                self.id,
+                self.severity,
+                "network transport exposed without authentication — any reachable "
+                "client can invoke these tools",
+                file=doc.meta.path,
+            )