b2407a09b3
Adds detectMcpToolBudget detection block in TOK scanner. Tiered severity
per project-local .mcp.json server based on toolCount:
- < 20: no finding
- 20-49: low
- 50-99: medium
- 100+: high
- null (manifest unparseable): low + "tool count unknown" message
Scoped to source==='.mcp.json' to keep findings actionable for the
audited path; plugin/user-level MCP servers are surfaced by the
manifest scanner (Step 19 / N2).
5 fixtures (mcp-budget/{14,25,60,120,unknown}-tools) use inline `tools`
arrays in .mcp.json — no node_modules needed for these tests.
Tests assert title+severity (not exact ID) since TOK IDs are sequential
per scan, not semantic per pattern.
[skip-docs] reason: v5 plan fences off README/CLAUDE.md badge updates
to Session 5; Forgejo pre-commit-docs-gate hook requires this tag on
feat commits without doc changes.
Tests: 586 → 593 (+7).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
5 lines
2.4 KiB
JSON
5 lines
2.4 KiB
JSON
{
|
|
"mcpServers": {
|
|
"budget-srv-60": { "command": "npx", "args": ["fake-pkg"], "tools": [{"name":"t_0","description":"tool 0"},{"name":"t_1","description":"tool 1"},{"name":"t_2","description":"tool 2"},{"name":"t_3","description":"tool 3"},{"name":"t_4","description":"tool 4"},{"name":"t_5","description":"tool 5"},{"name":"t_6","description":"tool 6"},{"name":"t_7","description":"tool 7"},{"name":"t_8","description":"tool 8"},{"name":"t_9","description":"tool 9"},{"name":"t_10","description":"tool 10"},{"name":"t_11","description":"tool 11"},{"name":"t_12","description":"tool 12"},{"name":"t_13","description":"tool 13"},{"name":"t_14","description":"tool 14"},{"name":"t_15","description":"tool 15"},{"name":"t_16","description":"tool 16"},{"name":"t_17","description":"tool 17"},{"name":"t_18","description":"tool 18"},{"name":"t_19","description":"tool 19"},{"name":"t_20","description":"tool 20"},{"name":"t_21","description":"tool 21"},{"name":"t_22","description":"tool 22"},{"name":"t_23","description":"tool 23"},{"name":"t_24","description":"tool 24"},{"name":"t_25","description":"tool 25"},{"name":"t_26","description":"tool 26"},{"name":"t_27","description":"tool 27"},{"name":"t_28","description":"tool 28"},{"name":"t_29","description":"tool 29"},{"name":"t_30","description":"tool 30"},{"name":"t_31","description":"tool 31"},{"name":"t_32","description":"tool 32"},{"name":"t_33","description":"tool 33"},{"name":"t_34","description":"tool 34"},{"name":"t_35","description":"tool 35"},{"name":"t_36","description":"tool 36"},{"name":"t_37","description":"tool 37"},{"name":"t_38","description":"tool 38"},{"name":"t_39","description":"tool 39"},{"name":"t_40","description":"tool 40"},{"name":"t_41","description":"tool 41"},{"name":"t_42","description":"tool 42"},{"name":"t_43","description":"tool 43"},{"name":"t_44","description":"tool 44"},{"name":"t_45","description":"tool 45"},{"name":"t_46","description":"tool 46"},{"name":"t_47","description":"tool 47"},{"name":"t_48","description":"tool 48"},{"name":"t_49","description":"tool 49"},{"name":"t_50","description":"tool 50"},{"name":"t_51","description":"tool 51"},{"name":"t_52","description":"tool 52"},{"name":"t_53","description":"tool 53"},{"name":"t_54","description":"tool 54"},{"name":"t_55","description":"tool 55"},{"name":"t_56","description":"tool 56"},{"name":"t_57","description":"tool 57"},{"name":"t_58","description":"tool 58"},{"name":"t_59","description":"tool 59"}] }
|
|
}
|
|
}
|