Bug: mcp-audit --version prints usage and exits 2

[royalpinto007]

What is wrong

mcp-audit --version prints the help text and exits with code 2 instead of printing the version and exiting 0.

In src/cli.ts, main() checks help before version:

if (flags["help"] || command === "help" || command === undefined) {
  process.stdout.write(usage());
  return command === undefined && !flags["help"] ? 2 : 0;
}
if (flags["version"]) {
  process.stdout.write(`${VERSION}\n`);
  return 0;
}

(lines 161-168). With argv = ["--version"] there is no positional, so command is undefined, the first branch fires, and the version branch below is unreachable. The only way to reach it today is to pass a command as well, for example mcp-audit rules --version, which is not something anyone types.

usage() documents exit code 2 as "usage or runtime error", so a plain --version currently reports a usage error.

Why it matters

tool --version is what install scripts, bug reports, CI setup steps, and Homebrew-style checks call. Exiting 2 makes a set -e script abort on a version probe.

Steps

1. In src/cli.ts main(), move the flags["version"] check above the help block.
2. While there, sanity check the neighbouring behaviour stays intact: bare mcp-audit still prints usage and returns 2, and mcp-audit --help still prints usage and returns 0.
3. Add a test. There is no test/cli.test.ts yet, so create one that imports main from ../src/cli.js and asserts await main(["--version"]) resolves to 0. main is already exported and does not touch the network for this path, so this is easy to test. Capturing stdout is optional.

Small and well contained. Comment below to claim it; a reply usually comes within a day.