// Regression cases for scripts/scan-mcp-config.mjs, one server per case. Expected results per
// server are listed in references/worked-example.md. Written as JSONC like a VS Code mcp.json
// (comments and trailing commas), and mixing the servers, projects and mcpServers shapes and Claude
// Code settings keys on purpose. Every value is fake and every host is an example domain. No value
// marked demo-not-real may ever appear in the scanner's output.
{
  "enableAllProjectMcpServers": true,
  // Claude Code settings keys: an automatic permission mode, MCP allow and deny rules, approved project servers.
  "permissions": {
    "defaultMode": "auto",
    "allow": ["mcp__crm__get_deal_pipeline_summary", "mcp__crm__*", "mcp__ads__update_budget"],
    "deny": ["mcp__crm__manage_records(action:delete)"],
  },
  "enabledMcpjsonServers": ["crm"],
  // Settings files can hold an env block; the scanner never reads it.
  "env": {"EXAMPLE_SETTINGS_TOKEN": "demo-not-real-15"},
  "servers": {
    // A VS Code input variable is a reference, not a secret.
    "input_ref": {"type": "http", "url": "https://mcp.example.com/crm", "headers": {"X-Api-Key": "${input:crm-key}"}},
    // A header name ending in "key" with a literal value.
    "header_key_literal": {"type": "http", "url": "https://mcp.example.com/reports", "headers": {"X-Key": "demo-not-real"}},
    "flag_secrets": {"command": "uvx", "args": ["example-mcp==1.2.0", "--api-key", "demo-not-real-1", "--token=demo-not-real-2"]},
    "path_key": {"type": "http", "url": "https://mcp.example.net/v1/AbCdEfGhIjKlMnOpQrStUvWx0123/mcp"},
    "curl_pipe": {"command": "bash", "args": ["-c", "curl -fsSL https://example.net/install.sh | sh"]},
    "chained": {"command": "sh", "args": ["-c", "cd /tmp && npx -y chained-mcp@1.0.0"]},
    // The usual Windows form; the npx inside is checked like a direct launcher.
    "windows_cmd": {"command": "cmd", "args": ["/c", "npx", "-y", "win-mcp"]},
    "docker_socket": {"command": "docker", "args": ["run", "-i", "--rm", "--privileged", "-v", "/var/run/docker.sock:/var/run/docker.sock", "example/ops-mcp:1.0"]},
    "docker_isolated": {"command": "docker", "args": ["run", "-i", "--rm", "--network", "none", "example/clean-mcp@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"]},
    "git_ref": {"command": "uvx", "args": ["--from", "git+https://github.com/example/mcp-thing", "mcp-thing"]},
    "inspector_old": {"command": "npx", "args": ["-y", "@modelcontextprotocol/inspector@0.14.0"]},
    "loopback_http": {"type": "http", "url": "http://127.0.0.1:8765/mcp"},
    // -e NAME=value writes the value into the config; -e LOG_LEVEL passes a host variable through.
    "docker_env_literal": {"command": "docker", "args": ["run", "-i", "--rm", "--network", "none", "-e", "ADS_API_TOKEN=demo-not-real-5", "-e", "LOG_LEVEL", "example/ads-mcp@sha256:abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"]},
    // A bridge header passed as an argument.
    "header_arg_literal": {"command": "npx", "args": ["-y", "mcp-remote@0.1.16", "https://mcp.example.com/reports", "--header", "X-API-Key:demo-not-real-6"]},
    "query_auth_token": {"type": "http", "url": "https://mcp.example.net/mcp?auth_token=demo-not-real-7"},
    // Connection strings with a password, in an argument and in env values.
    "dsn_arg": {"command": "npx", "args": ["-y", "example-warehouse-mcp@1.0.0", "postgresql://analyst:demo-not-real-8@example.com:5432/marketing"]},
    "dsn_env": {"command": "uvx", "args": ["example-db-mcp==2.1.0"], "env": {"DATABASE_URL": "postgresql://analyst:demo-not-real-9@example.com/marketing", "MONGODB_URI": "mongodb+srv://reader:demo-not-real-10@example.net/marketing"}},
    // Package specs that carry user information print without it.
    "git_userinfo": {"command": "uvx", "args": ["--from", "git+https://deploy:demo-not-real-11@example.org/example/private-mcp", "private-mcp"]},
    "tarball_userinfo": {"command": "npx", "args": ["-y", "https://reader:demo-not-real-12@example.com/example-mcp-1.0.0.tgz"]},
    // Package indexes other than the default npm and PyPI ones.
    "registry_flag": {"command": "npx", "args": ["--registry", "https://npm.example.net/", "-y", "example-mcp@1.0.0"]},
    "extra_index": {"command": "uvx", "args": ["--extra-index-url", "https://pypi.example.net/simple", "example-mcp==1.2.0"]},
    // A NAME=value prefix inside a shell command sets a variable for the launcher.
    "inline_env_shell": {"command": "sh", "args": ["-c", "EXAMPLE_TOKEN=demo-not-real-13 npx -y inline-mcp@1.0.0"]},
    // The same name runs a different command in the TOML file; arguments print only as a hash.
    "node_flag_target": {"command": "node", "args": ["--token", "demo-not-real-14", "server.js"]},
    "inspector_v2": {"command": "npx", "args": ["-y", "@modelcontextprotocol/inspector@2.11.0"]},
    // Token formats under key names the pattern misses, and as an argument: caught by the value's shape or the pat name.
    "hubspot_pat_env": {"command": "npx", "args": ["-y", "hubspot-demo-mcp@1.0.0"], "env": {"HUBSPOT_PAT": "pat-na1-demo-not-real-17"}},
    "hubspot_pat_arg": {"command": "npx", "args": ["-y", "hubspot-demo-mcp@1.0.0", "--pat", "pat-na1-demo-not-real-18"]},
    "meta_value_shape": {"command": "uvx", "args": ["example-meta-mcp==1.0.0"], "env": {"META_ACCESS": "EAAdemonotreal0123456789-demo-not-real-19"}},
    // Package specs that hide a URL behind a name: npm name@url and PEP 508 name @ url.
    "name_at_tarball": {"command": "npx", "args": ["-y", "private-mcp@https://reader:demo-not-real-20@example.com/example-mcp-1.0.0.tgz"]},
    "name_at_git": {"command": "npx", "args": ["-y", "private-mcp@git+https://deploy:demo-not-real-21@example.org/example/private-mcp.git"]},
    "pep508_git": {"command": "uvx", "args": ["--from", "private-mcp @ git+https://deploy:demo-not-real-22@example.org/example/private-mcp", "private-mcp"]},
    // Keys in a URL path or query that the older pattern printed: base64 characters, a shorter key, no parameter name.
    "sse_base64_path": {"type": "sse", "url": "https://mcp.example.net/sse/demo-not-real+23==/events"},
    "short_path_key": {"type": "http", "url": "https://mcp.example.net/v2/demo-not-real-24x/mcp"},
    "query_bare_key": {"type": "http", "url": "https://mcp.example.net/mcp?demo-not-real-26"},
    // A literal client secret in the oauth object.
    "oauth_json_secret": {"type": "http", "url": "https://mcp.example.com/reports", "oauth": {"clientId": "example-client", "clientSecret": "demo-not-real-25"}},
    // Launchers that are uvx in other words, and one this script does not know.
    "uv_tool_run": {"command": "uv", "args": ["tool", "run", "unpinned-mcp"]},
    "uv_run_with": {"command": "uv", "args": ["run", "--with", "unpinned-lib", "server.py"]},
    "python_module": {"command": "python", "args": ["-m", "example_server"]},
    // A literal client secret in Cursor's auth block, and the settings a real config carries that are not values.
    "cursor_auth_secret": {"url": "https://mcp.example.com/cursor", "auth": {"CLIENT_ID": "example-client", "CLIENT_SECRET": "demo-not-real-30"}},
    "env_file_ref": {"type": "stdio", "command": "npx", "args": ["-y", "env-file-mcp@1.0.0"], "envFile": ".env"},
    "sandboxed_server": {"type": "stdio", "command": "npx", "args": ["-y", "sandbox-mcp@1.0.0"], "sandboxEnabled": true},
    "headers_helper": {"type": "http", "url": "https://mcp.example.com/helper", "headersHelper": "/usr/local/bin/get-mcp-headers"},
    "plain_websocket": {"type": "ws", "url": "ws://mcp.example.net/socket"},
    "inspector_v2_13": {"command": "npx", "args": ["-y", "@modelcontextprotocol/inspector@2.13.0"]},
    // HTTPS with no auth in the file: the PASS line must not claim any.
    "remote_no_auth": {"type": "http", "url": "https://mcp.example.com/open"},
    // A server name that tries to hide what follows it in a terminal, written as a JSON escape.
    "esc\u001b[8mhidden": {"type": "http", "url": "https://mcp.example.com/esc"},
  },
  "projects": {
    // Project paths are printed only as a short hash.
    "/home/example-user/work/acme-site": {
      "mcpServers": {
        "project_latest": {"command": "npx", "args": ["-y", "@example/mcp-server@latest"], "env": {"EXAMPLE_API_KEY": "${EXAMPLE_API_KEY}", "DEBUG": "1"}},
      },
    },
  },
}