MCP CLI and baseline comparison

@pentriarch/mcp-scan is currently a private repository package. These commands require an authorised checkout with workspace dependencies installed; they do not describe a public npm installation.

Use the repository’s documented Node and pnpm requirements. Only launch trusted code in stdio mode: static inspection avoids tool calls but still starts the server process.

Use an endpoint you are permitted to assess. --http selects streamable HTTP; --sse selects SSE.

Save and review a known baseline, then compare it after a change. A baseline records an observation; it is not an approval certificate.

Exit 0 means below the configured threshold, exit 1 means findings meet or exceed it, and exit 2 means an error. The default threshold is high. An error is not a clean assessment.

Retain machine-readable output. Distinguish a threshold failure from a connection failure. Do not automatically replace an unreviewed baseline merely to pass a pipeline.