The HTTP transport and the entire CLI layer are untested, and that is where five open bugs live

[royalpinto007]

Problem

Two of the three transports and the entire CLI layer have no tests.

The test suite covers rules (test/rules.test.ts), config (test/config.test.ts), the engine (test/engine.test.ts), reporters (test/reporters.test.ts), static manifests (test/static.test.ts), and stdio (test/stdio.integration.test.ts, which does spawn the fixture server and is genuinely good). Nothing imports src/transport/http.ts. Nothing imports src/cli.ts.

That is where the open bugs are. #3 (--header documented as repeatable but only the last one is sent), #4 (--version prints usage and exits 2), #5 (version hardcoded and drifted from package.json), #6 (unknown rule ids in --only silently ignored), and #7 (--no-color sets a global env var and probably does not work) are all in cli.ts. Five of the nine open issues are in the one untested file.

connectHttp is untested despite containing real logic worth pinning down: header merging, the authProvided derivation that checks both options.token and a case-insensitive authorization header, and the SSE versus Streamable HTTP branch. MCP040 is a rule about HTTP auth, so authProvided being wrong means a security finding is wrong.

Suggested approach

1. Add test/cli.test.ts. main(argv) is exported and returns a number, so it can be called directly. Capture stdout and stderr with vitest spies. Cover each command, each exit code path (0, 1, 2), --output writing to a temp file, and --json and --sarif producing parseable output.
2. Add test/http.test.ts. Stand up a small HTTP server in the test, as stdio.integration.test.ts does for a child process, or mock the SDK transport. Assert: headers reach the request, --token becomes an Authorization header, authProvided is true for a lowercase authorization header supplied via --header, and --sse selects SSEClientTransport.
3. Add a coverage threshold to vitest.config.ts so the untested surface cannot grow silently, and run it in CI.
4. The CI self-scan job currently audits one fixture manifest. Consider having it audit the mock server over stdio as well, so the live path is exercised on every push.

Done when

• src/cli.ts and src/transport/http.ts both have direct tests.
• Every documented flag has at least one test.
• Coverage is measured in CI with a floor.

Landing failing tests for the open CLI bugs and fixing them in separate PRs is a fine way to split this up.

---

If you want to take this on, comment on the issue to claim it and it will be assigned. Please keep to a maximum of 2 open claims per person at a time so other contributors get a chance.