Three merged PRs in an MCP security scanner: the review that found my bug, and two more

Three PRs were merged into the yunaremaia/mcp-guard repository in approximately 36 hours: PR #87, #88, and #86.

PR #87 changed the behavior of scan --fail-on low to no longer exist in a clean, empty scan. This change was made because the root cause was a comparison between max(..., default=0) and a threshold of 0.

PR #88 modified keyword matching to no longer flag read-only tools as CRITICAL. Previously, the feature would flag tools as destructive if they contained write-related keywords in their names or descriptions. The fix involved tokenizing the names and matching them based on whole segments, while ignoring leading read-only verbs.

PR #86 addressed the issue of mcp-guard verify not being able to report when a package is signed. The reviewer found that the feature could never report "signed" because the endpoint used for verifying the package ref was returning a 404 error for every package, including the reference implementation. To fix this, the pathname of the discovered URL was used instead of following it as an absolute host.

The review process for these PRs was thorough, with each change being verified live against the live registry before being merged. The maintainer of the repository, who had a fast and rigorous approach, merged the PRs within hours of receiving the reviews. This allowed for improvements to be made quickly and efficiently, ensuring that the security tool was reliable and accurate in its evaluations.