Kjell Tore Guttormsen
b3c572ad46
`.mcp.json` has no per-server `trust` key — verified 2026-06-18 against code.claude.com/docs/en/mcp + /settings. MCP server approval is dialog/settings-based (enableAllProjectMcpServers / enabledMcpjsonServers / disabledMcpjsonServers), never a JSON field. The scanner's "Missing trust level" (CA-MCP-001, medium) and "Invalid trust level" (high) were false positives flagging a field that does not exist. - scanner: delete both trust checks + VALID_TRUST_LEVELS; drop `trust` from VALID_SERVER_FIELDS so a stray `trust` is now flagged as an unknown field - humanizer: remove the two trust-level entries - knowledge (5 files): point to the real approval mechanism, not a trust field - fixtures: scrub `trust` (incl. the invalid "local" in optimal-setup) - tests: flip assertions (no trust-level finding; stray trust -> unknown field) + add knowledge-staleness re-freeze guards - snapshots: reseed (marketplace-medium .mcp.json -8 tokens, hermetic) - gap-matrix: mark the trust verify-first item DONE Suite: 853/853 green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8 |
||
|---|---|---|
| .. | ||
| .claude | ||
| .claude-plugin | ||
| hooks | ||
| .lsp.json | ||
| .mcp.json | ||
| CLAUDE.md | ||
| README.md | ||
Optimal Setup Example
This example demonstrates a fully-configured Claude Code project that scores A on config-audit's posture assessment.
What's configured
| Feature | File | Gap Check |
|---|---|---|
| Project instructions | CLAUDE.md |
t1_1 |
| Permissions | .claude/settings.json |
t1_2 |
| Hooks (3 events) | hooks/hooks.json |
t1_3, t2_5 |
| Custom commands | .claude/commands/build.md |
t1_4 |
| MCP servers | .mcp.json |
t1_5, t4_1 |
| Multi-scope settings | .claude/settings.local.json |
t2_1 |
| Modular rules | .claude/rules/ |
t2_2 |
| Path-scoped rules | code-style.md, testing.md |
t2_3 |
| Custom agents | .claude/agents/review-agent.md |
t2_6 |
| Model config | settings.json (model key) |
t2_7 |
| Status line | settings.json (statusLine) |
t3_1 |
| Custom keybindings | .claude/keybindings.json |
t3_2 |
| Output style | settings.json (outputStyle) |
t3_3 |
| Worktree config | settings.json (worktree) |
t3_4 |
| Advanced skill frontmatter | build.md (argument-hint) |
t3_5 |
| Agent isolation | review-agent.md (worktree) |
t3_6 |
| Dynamic context | build.md (!git ...) |
t3_7 |
| Auto mode | settings.json (autoMode) |
t3_8 |
| Plugin manifest | .claude-plugin/plugin.json |
t4_2 |
| Agent teams | settings.json (env) |
t4_3 |
| LSP config | .lsp.json |
t4_5 |
How to test
cd examples/optimal-setup
node ../../scanners/posture.mjs .
Expected: A-grade score with high utilization across all tiers.