From 089fbf24ad504600e090410f049064093fcd83c7 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 14 Jun 2026 21:06:09 +0000 Subject: [PATCH] docs: fix incorrect CLI flag and inverted score semantics in README - Replace non-existent --output=sarif with the actual --format=sarif flag in README and dev.to launch post (the documented command errored out and exited with code 2) - Correct the programmatic example comment: the risk score is higher = riskier (per scorer.ts/types.ts), not lower, and clarify the passed gate --- README.md | 6 +++--- dev-to/launch-post.md | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index e240bfe..a98ffd4 100644 --- a/README.md +++ b/README.md @@ -38,7 +38,7 @@ npx @hailbytes/mcp-security-scanner ./mcp-config.json npx @hailbytes/mcp-security-scanner https://my-mcp-server.example.com # Output SARIF for GitHub Code Scanning + fail on findings -npx @hailbytes/mcp-security-scanner ./config.json --output=sarif --exit-code +npx @hailbytes/mcp-security-scanner ./config.json --format=sarif --exit-code ``` ### Programmatic @@ -49,8 +49,8 @@ import { scan } from "@hailbytes/mcp-security-scanner"; const report = await scan({ configPath: "./mcp-config.json" }); console.log(report.findings); // Finding[] — individual security issues -console.log(report.score); // 0–100 risk score (lower = riskier) -console.log(report.passed); // boolean — use as CI gate +console.log(report.score); // 0–100 risk score (higher = riskier) +console.log(report.passed); // boolean — true when score < 50 and no critical findings; use as CI gate ``` --- diff --git a/dev-to/launch-post.md b/dev-to/launch-post.md index b173bee..60a9b83 100644 --- a/dev-to/launch-post.md +++ b/dev-to/launch-post.md @@ -41,7 +41,7 @@ npx @hailbytes/mcp-security-scanner ./mcp-config.json npx @hailbytes/mcp-security-scanner https://my-mcp-server.example.com # SARIF output + fail the build -npx @hailbytes/mcp-security-scanner ./config.json --output=sarif --exit-code +npx @hailbytes/mcp-security-scanner ./config.json --format=sarif --exit-code ``` ## Programmatic