b2407a09b3
Adds detectMcpToolBudget detection block in TOK scanner. Tiered severity
per project-local .mcp.json server based on toolCount:
- < 20: no finding
- 20-49: low
- 50-99: medium
- 100+: high
- null (manifest unparseable): low + "tool count unknown" message
Scoped to source==='.mcp.json' to keep findings actionable for the
audited path; plugin/user-level MCP servers are surfaced by the
manifest scanner (Step 19 / N2).
5 fixtures (mcp-budget/{14,25,60,120,unknown}-tools) use inline `tools`
arrays in .mcp.json — no node_modules needed for these tests.
Tests assert title+severity (not exact ID) since TOK IDs are sequential
per scan, not semantic per pattern.
[skip-docs] reason: v5 plan fences off README/CLAUDE.md badge updates
to Session 5; Forgejo pre-commit-docs-gate hook requires this tag on
feat commits without doc changes.
Tests: 586 → 593 (+7).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
5 lines
1.1 KiB
JSON
5 lines
1.1 KiB
JSON
{
|
|
"mcpServers": {
|
|
"budget-srv-25": { "command": "npx", "args": ["fake-pkg"], "tools": [{"name":"t_0","description":"tool 0"},{"name":"t_1","description":"tool 1"},{"name":"t_2","description":"tool 2"},{"name":"t_3","description":"tool 3"},{"name":"t_4","description":"tool 4"},{"name":"t_5","description":"tool 5"},{"name":"t_6","description":"tool 6"},{"name":"t_7","description":"tool 7"},{"name":"t_8","description":"tool 8"},{"name":"t_9","description":"tool 9"},{"name":"t_10","description":"tool 10"},{"name":"t_11","description":"tool 11"},{"name":"t_12","description":"tool 12"},{"name":"t_13","description":"tool 13"},{"name":"t_14","description":"tool 14"},{"name":"t_15","description":"tool 15"},{"name":"t_16","description":"tool 16"},{"name":"t_17","description":"tool 17"},{"name":"t_18","description":"tool 18"},{"name":"t_19","description":"tool 19"},{"name":"t_20","description":"tool 20"},{"name":"t_21","description":"tool 21"},{"name":"t_22","description":"tool 22"},{"name":"t_23","description":"tool 23"},{"name":"t_24","description":"tool 24"}] }
|
|
}
|
|
}
|