feat: config-file-first audit mode (claude_desktop_config.json)

[ksek87]

Problem

fuzzd audit --transport stdio --cmd "node server.js" requires the user to know the exact command for each server. mcp-scan built its 2,000+ star audience almost entirely from a single ergonomic: mcp-scan reads your Claude Desktop config and audits all configured servers in one pass.

fuzzd needs an equivalent: fuzzd audit --from-config ~/.config/claude/claude_desktop_config.json.

Config format

Claude Desktop uses a JSON config at:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Linux: ~/.config/claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Shape:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"],
      "env": {}
    },
    "github": {
      "command": "npx",
      "args": ["@modelcontextprotocol/server-github"],
      "env": { "GITHUB_TOKEN": "..." }
    }
  }
}

Cline uses a similar format at ~/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json.

Acceptance criteria

• --from-config <path> flag on fuzzd audit — parses the config and spawns an audit for each configured server
• --from-config auto — searches standard platform paths automatically
• Each server audited with the attack modules specified in --attacks
• Multi-server result aggregation: findings tagged with server name, summary report shows per-server breakdown
• Env var passthrough from config (needed for servers that require tokens like GITHUB_TOKEN)
• Graceful handling: if a server fails to start, skip it with a warning and continue
• Support for both Claude Desktop and Cline config formats
• Unit test: parse a fixture config JSON, verify correct server commands extracted

Notes

The env field in config needs careful handling — don't log env var values (they may contain secrets). The config parser should be a standalone src/config.rs module.