Useful evidence without a hidden blast radius.

Keep active authority narrow and publish multiple automation artifacts from the same immutable, redacted diagnostic result.

Passive first. Active only with exact authority.

Active diagnostics are never the default

inspect never calls a tool. Active diagnostics require a named tool, an explicit effect boundary, and redundant authorization. Reports omit raw arguments, results, credentials, headers, stderr, and server logs.

One run, deterministic artifacts

Human, JSON, JUnit, Markdown, and badge projections come from the same result. Destinations must be explicit, distinct, and new; reporting failure cannot be presented as diagnostic success.

mcp-doctor inspect \
+  --json-report artifacts/mcp-doctor.json \
+  --junit-report artifacts/mcp-doctor.xml \
+  -- node ./dist/server.js --stdio

Read the complete product contract

Open the repository guide Review exact commands, limits, supported behavior, and failure semantics at the source.