Kjell Tore Guttormsen
b3c572ad46
`.mcp.json` has no per-server `trust` key — verified 2026-06-18 against code.claude.com/docs/en/mcp + /settings. MCP server approval is dialog/settings-based (enableAllProjectMcpServers / enabledMcpjsonServers / disabledMcpjsonServers), never a JSON field. The scanner's "Missing trust level" (CA-MCP-001, medium) and "Invalid trust level" (high) were false positives flagging a field that does not exist. - scanner: delete both trust checks + VALID_TRUST_LEVELS; drop `trust` from VALID_SERVER_FIELDS so a stray `trust` is now flagged as an unknown field - humanizer: remove the two trust-level entries - knowledge (5 files): point to the real approval mechanism, not a trust field - fixtures: scrub `trust` (incl. the invalid "local" in optimal-setup) - tests: flip assertions (no trust-level finding; stray trust -> unknown field) + add knowledge-staleness re-freeze guards - snapshots: reseed (marketplace-medium .mcp.json -8 tokens, hermetic) - gap-matrix: mark the trust verify-first item DONE Suite: 853/853 green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
85 lines
3.1 KiB
JSON
85 lines
3.1 KiB
JSON
{
|
|
"kind": "json",
|
|
"payload": {
|
|
"scanner": "TOK",
|
|
"status": "ok",
|
|
"files_scanned": 2,
|
|
"duration_ms": 0,
|
|
"total_estimated_tokens": 801,
|
|
"hotspots": [
|
|
{
|
|
"source": "mcp:memory (.mcp.json)",
|
|
"estimated_tokens": 500,
|
|
"rank": 1,
|
|
"recommendations": [
|
|
"Review whether this source needs to load on every turn."
|
|
]
|
|
},
|
|
{
|
|
"source": "CLAUDE.md",
|
|
"estimated_tokens": 116,
|
|
"rank": 2,
|
|
"recommendations": [
|
|
"Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
|
|
"Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
|
|
],
|
|
"path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
|
|
},
|
|
{
|
|
"source": "hooks/hooks.json",
|
|
"estimated_tokens": 81,
|
|
"rank": 3,
|
|
"recommendations": [
|
|
"Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
|
|
"Move rarely-used permissions to a project-local override."
|
|
],
|
|
"path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
|
|
},
|
|
{
|
|
"source": ".claude/settings.json",
|
|
"estimated_tokens": 59,
|
|
"rank": 4,
|
|
"recommendations": [
|
|
"Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
|
|
"Move rarely-used permissions to a project-local override."
|
|
],
|
|
"path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
|
|
},
|
|
{
|
|
"source": ".mcp.json",
|
|
"estimated_tokens": 45,
|
|
"rank": 5,
|
|
"recommendations": [
|
|
"Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
|
|
"Move rarely-used permissions to a project-local override."
|
|
],
|
|
"path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
|
|
}
|
|
],
|
|
"findings": [
|
|
{
|
|
"id": "CA-TOK-001",
|
|
"scanner": "TOK",
|
|
"severity": "low",
|
|
"title": "A connected service exposes many tools, all loading on every turn",
|
|
"description": "Each tool a connected service exposes adds its description to every turn. Services with many tools eat space fast.",
|
|
"file": ".mcp.json",
|
|
"line": null,
|
|
"evidence": "tool_count=unknown; server=\"memory\"; source=\".mcp.json\" — severity reflects estimated tokens/turn based on structural heuristic; not measured against runtime telemetry",
|
|
"category": "token-efficiency",
|
|
"recommendation": "Limit which tools the service exposes (often via a `tools` allow-list), or disconnect services you rarely use.",
|
|
"autoFixable": false,
|
|
"userImpactCategory": "Wasted tokens",
|
|
"userActionLanguage": "Optional cleanup",
|
|
"relevanceContext": "affects-everyone"
|
|
}
|
|
],
|
|
"counts": {
|
|
"critical": 0,
|
|
"high": 0,
|
|
"medium": 0,
|
|
"low": 1,
|
|
"info": 0
|
|
}
|
|
}
|
|
}
|