Never invent agents in someone else's repository

[blocksifrdev]

I tested the path a reader actually takes before we announce anything: no clone, just npx @blocksifr/pctr init && scan in a normal Express app with no agents in it at all.

It reported 5 agents, 3 tools and a CRITICAL consequence on customers.delete — in the identical format as a real finding. The only hint was one dim line during init that scrolls past.

For a tool whose whole proposition is telling you what is really there, appearing to invent findings is the worst failure available. Anyone technical who tried our published quickstart on their own project would have concluded it fabricates — and they'd have been right.

Changes

• init no longer writes the example when discovery finds nothing. It says no agents were found, names what it looks for (MCP servers; OpenAI, Claude, LangGraph, CrewAI, AutoGen, AGT declarations), and points at --example.
• The example is opt-in, and the manifest it writes is marked "example": true.
• scan prints an unmissable banner on an example manifest, and refuses to render a scan at all when no agents are declared.
• The shared Markdown report carries the same warning above anything that reads as a finding — that report travels into other people's pull requests.
• The GitHub Action inherits it: a repo with no agents now produces an empty scan, not a false report.

Before / after, same empty project

Agents found          5          →   No agents found in this project.
CRITICAL              1              PCTR looks for MCP servers, and for agent and
Highest priority:                    tool declarations in your source…
customers.delete                     pctr init --example  (made-up agents, clearly labelled)

Discovery on a project that does have agents is unchanged — still finds the MCP tools and CrewAI agent in the fixture.

195 tests. Version bumped to 0.1.1 for publishing.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.