fix(cli): reject unknown --rule values instead of silently passing

[dmchaledev]

Summary

Fixes #11. A security scanner that silently passes on misconfiguration is worse than one that fails loudly, because it gives false assurance.

Today an unknown or typo'd --rule value is cast straight to RuleId and used to filter the rule set (src/args.ts):

} else if (arg.startsWith('--rule=')) {
  rules.push(arg.slice('--rule='.length) as RuleId); // no validation
}

A value matching no real rule filters the rule set down to nothing, so the scan produces zero findings, a passing report, and exit code 0:

# Intended: gate on the no-auth rule. Typo: should be NO_AUTH.
mcp-security-scanner --rule=NOAUTH --exit-code ./mcp-config.json
# Before: 0 findings, PASSED, exit 0  → security gate silently bypassed

This was inconsistent with --format and --fail-on, which already validate their input and exit 2. (The original issue pointed at cli.ts; the --rule parsing has since moved into args.ts, but the bug came along with it.)

Changes

• src/args.ts — validate each --rule value against the RuleId enum; return an error result (exit 2) with a clear message listing valid rule IDs when it doesn't match.
• src/cli.ts — list valid rule IDs in --help for discoverability.
• src/__tests__/args.test.ts — regression test asserting --rule=NOAUTH exits 2.

Verification

$ node dist/cli.js --rule=NOAUTH --exit-code ./c.json
Error: Unknown rule "NOAUTH". Valid rule IDs: NO_AUTH, WEAK_API_KEY, MISSING_TLS, ...
$ echo $?
2

$ node dist/cli.js --rule=NO_AUTH ./c.json   # valid rule still works → exit 0

npm run typecheck, npm run lint, and npm test (100 tests) all pass.

Acceptance criteria (from #11)

• --rule=BOGUS exits with code 2 and a clear error message
• Valid rule IDs continue to work and are filtered correctly
• --help lists valid rule IDs
• Test covering the unknown-rule case

🤖 Generated with Claude Code

https://claude.ai/code/session_017ffK3ewW2pyTMsmmNSQK2R

---

Generated by Claude Code