docs: fix broken SARIF CLI example and inverted risk-score comment in README

[dmchaledev]

Summary

Two concrete, user-facing documentation bugs in the README that break on copy-paste.

1. Broken SARIF / GitHub Code Scanning example (Quick Start)

The README documents:

npx @hailbytes/mcp-security-scanner ./config.json --output=sarif --exit-code

But the CLI accepts --format, not --output, and explicitly rejects unknown flags with exit code 2:

$ node dist/cli.js ./examples/vulnerable-config.json --output=sarif --exit-code
Error: Unknown flag "--output=sarif". Use --help to see available options.
# exit 2

This is the flagship CI/CD integration command, so anyone copy-pasting it from the README hits an error. Fixed to --format=sarif. Verified the corrected command works (exits 1 on findings as intended).

2. Inverted risk-score comment (Programmatic example)

The README said:

console.log(report.score);     // 0–100 risk score (lower = riskier)

The score is the opposite — higher = riskier. The vulnerable example config scores 100 and passed: false; the secure config scores 0 and passed: true. This also matches the SecurityReport.score type doc ("0 (safest) – 100 (most risk)") and the computeScore implementation. Corrected to (higher = riskier).

Testing

• npm run build ✓
• Confirmed --output=sarif fails (exit 2) and --format=sarif --exit-code works (exit 1 on findings) ✓
• Confirmed score direction against the bundled vulnerable-config.json (100) and secure-config.json (0) ✓

Docs-only change; no code or behavior modified.

https://claude.ai/code/session_01MiYpVP9yynmPt1KTCiKt2d

---

Generated by Claude Code