docs: fix broken CLI flag and inverted score semantics in README

[dmchaledev]

Problem

Two concrete documentation bugs in the primary README.md (and the dev.to launch post) — the first things a new user reads — that actively mislead users:

1. The documented SARIF command doesn't work

The Quick Start shows:

npx @hailbytes/mcp-security-scanner ./config.json --output=sarif --exit-code

But the CLI only accepts --format=, not --output=. An unknown flag falls through to the error branch in cli.ts (Error: Unknown flag "--output=sarif") and exits with code 2 — so the copy-paste-able command in the README fails immediately. This is the exact command a CI user would reach for.

2. The risk-score semantics are described backwards

The programmatic example commented:

console.log(report.score);  // 0–100 risk score (lower = riskier)

This is inverted. scorer.ts and types.ts both define the score as higher = more risk (severity weights are summed and capped at 100), and scanner.ts sets passed = score < 50 && no critical findings. A user reading "lower = riskier" would interpret the CI gate backwards.

Fix

• Replace --output=sarif with the real --format=sarif flag in README.md and dev-to/launch-post.md.
• Correct the score comment to (higher = riskier) and clarify the passed gate condition.

Docs-only change; no code or tests affected.

https://claude.ai/code/session_0165ZgwpmDnLYUiRzbgykfmq

---

Generated by Claude Code