From c79a5df758aa56d59480fe427b72ffb5a973309e Mon Sep 17 00:00:00 2001
From: "Sharad." <sharadvc@users.noreply.github.com>
Date: Sat, 12 Sep 2026 14:20:48 +0000
Subject: [PATCH 1/2] test: fail on unknown top-level config keys (issue #29)

---
 test/config.test.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/test/config.test.ts b/test/config.test.ts
index b1b20a2..2412fb4 100644
--- a/test/config.test.ts
+++ b/test/config.test.ts
@@ -24,6 +24,12 @@ describe("normalizeConfig", () => {
     expect(config.severityOverrides.MCP021).toBe("high");
   });
 
+  it("rejects unknown top-level config keys", () => {
+    expect(() =>
+      normalizeConfig({ disabledRule: ["MCP001"] }),
+    ).toThrow(/disabledRule/);
+  });
+
   it("rejects an invalid failOn severity", () => {
     expect(() => normalizeConfig({ failOn: "catastrophic" })).toThrow(
       /Invalid severity/,

From ae163b2fd2645b269d5806006a9dba392ffcee62 Mon Sep 17 00:00:00 2001
From: "Sharad." <sharadvc@users.noreply.github.com>
Date: Sat, 12 Sep 2026 14:20:48 +0000
Subject: [PATCH 2/2] fix: reject unknown top-level keys in normalizeConfig

---
 src/config.ts | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/src/config.ts b/src/config.ts
index 5a8d4c2..188df45 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -26,6 +26,22 @@ export const DEFAULT_CONFIG: McpAuditConfig = {
   ignore: [],
 };
 
+const KNOWN_CONFIG_KEYS = new Set<string>([
+  "disabledRules",
+  "enabledRules",
+  "severityOverrides",
+  "failOn",
+  "ignore",
+]);
+
+function assertKnownConfigKeys(obj: Record<string, unknown>): void {
+  for (const key of Object.keys(obj)) {
+    if (!KNOWN_CONFIG_KEYS.has(key)) {
+      throw new Error(`Unknown config key "${key}".`);
+    }
+  }
+}
+
 const CONFIG_FILENAMES = [
   ".mcpauditrc",
   ".mcpauditrc.json",
@@ -62,6 +78,7 @@ export function normalizeConfig(
   base: McpAuditConfig = DEFAULT_CONFIG,
 ): McpAuditConfig {
   const obj = (raw ?? {}) as Record<string, unknown>;
+  assertKnownConfigKeys(obj);
   const config: McpAuditConfig = {
     disabledRules: [...base.disabledRules],
     enabledRules: [...base.enabledRules],