docs: fix README/launch-post to match actual CLI flag and score semantics

[dmchaledev]

Summary

Two user-facing documentation bugs where the docs contradict the code. Both are small, self-contained, and docs-only.

1. Documented SARIF command errors out (--output= vs --format=)

README.md and dev-to/launch-post.md both advertise:

npx @hailbytes/mcp-security-scanner ./config.json --output=sarif --exit-code

But the CLI only accepts --format= (see src/cli.ts). The documented command fails outright:

$ node dist/cli.js --output=sarif examples/vulnerable-config.json
Error: Unknown flag "--output=sarif". Use --help to see available options.   # exit 2

Fixed to --format=sarif, which produces valid SARIF as intended. (This was flagged as out-of-scope in #12; addressing it here.)

2. README inverts the meaning of report.score

The programmatic example described the score as:

console.log(report.score);     // 0–100 risk score (lower = riskier)

This is backwards. The code is unambiguous that higher = riskier:

• src/scorer.ts: "Higher score = more risk" — score sums severity weights.
• src/types.ts: "Risk score 0 (safest) – 100 (most risk)".
• src/scanner.ts: passed = score < 50 && !hasCritical.

A CI gate written from the old comment would invert its pass/fail logic — a meaningful footgun for a security tool. Corrected to higher = riskier; 0 is safest.

Verification

$ node dist/cli.js --format=sarif examples/vulnerable-config.json   # valid SARIF, exit 1
$ node dist/cli.js examples/vulnerable-config.json   ->  score 100, passed false
$ node dist/cli.js examples/secure-config.json       ->  score 0,   passed true

Confirms higher score = riskier and that --format=sarif is the correct flag.

No production code changed.

https://claude.ai/code/session_01WUxsN7GXqccfdLHTb4k86R

---

Generated by Claude Code