//! Arguments for `mcptest scan`: a static security scan of MCP config files.

use std::path::PathBuf;

use clap::{Args, ValueEnum};

use super::security::SecurityFailOn;

/// Statically scan an MCP config file for security risks without launching a
/// server: hardcoded secrets, broad filesystem access, missing credentials, and
/// auto-approved tools, with a per-server risk score.
#[derive(Debug, Args)]
pub struct ScanArgs {
    /// Config file to scan (for example `mcp.json` or
    /// `claude_desktop_config.json`). Omit to scan every MCP server discovered
    /// from local client configs.
    #[arg(value_name = "PATH")]
    pub path: Option<PathBuf>,

    /// Output format.
    #[arg(long, value_enum, default_value_t = ScanFormat::Pretty)]
    pub format: ScanFormat,

    /// Exit non-zero when any finding is at or above this severity. Off by
    /// default so the scan reports without gating.
    #[arg(long, value_enum)]
    pub fail_on: Option<SecurityFailOn>,

    /// Path to a waiver file (`.mcptest-waivers.yaml`). Accepted findings are
    /// excluded from `--fail-on` but still shown; expired and stale waivers are
    /// reported.
    #[arg(long, value_name = "PATH")]
    pub waivers: Option<PathBuf>,
}

/// Output formats for `mcptest scan --format`.
#[derive(Copy, Clone, Debug, Default, PartialEq, Eq, ValueEnum)]
#[value(rename_all = "kebab-case")]
pub enum ScanFormat {
    /// Human-friendly summary with per-server risk banding (default).
    #[default]
    Pretty,
    /// One JSON object: the full scan report.
    Json,
    /// SARIF 2.1.0 for code-scanning ingestion.
    Sarif,
    /// Self-contained HTML report (inline CSS) for sharing or CI artifacts.
    Html,
}
