Stop printing PASS when deployment-safety checks only warn

README.md

@@ -93,7 +93,8 @@ connected through SSH local forwarding.
 
    The MCP server also calls `classify_base_url` on start and refuses a
    fail-status `OLLAMA_BASE_URL` (wildcard, tunnel, public IP, hostname,
-   userinfo, or decimal/integer-form IP). Private LAN URLs still only warn.
+   userinfo, or decimal/integer-form IP). Private LAN URLs still only warn;
+   the checker then prints `WARN deployment safety`, not PASS.
 
 6. Deployment safety checks (no GPU required; inspects this host only):
 

scripts/check_deployment_safety.py

@@ -42,7 +42,10 @@ def main() -> None:
     if status == "fail":
         print("FAIL deployment safety")
         raise SystemExit(1)
-    print("PASS deployment safety" if status == "pass" else "PASS deployment safety (warnings)")
+    if status == "warn":
+        print("WARN deployment safety")
+        raise SystemExit(0)
+    print("PASS deployment safety")
     raise SystemExit(0)
 
 

tests/test_deployment_safety_ci.py

@@ -82,6 +82,18 @@ def test_skip_listen_exits_0_on_current_repo(self) -> None:
         )
         self.assertEqual(proc.returncode, 0, proc.stderr)
         self.assertIn("deployment safety", proc.stdout)
+        self.assertNotIn("PASS deployment safety", proc.stdout)
+
+    def test_warnings_only_does_not_print_pass(self) -> None:
+        """Hostile/warnings-only config must not print PASS as success."""
+        module = _load_script()
+        with patch.dict(os.environ, {"OLLAMA_BASE_URL": "http://192.168.1.10:11434"}):
+            code, stdout, stderr = _run_main(
+                module, [str(SCRIPT), "--skip-listen"]
+            )
+        self.assertEqual(code, 0, stderr)
+        self.assertNotIn("PASS deployment safety", stdout)
+        self.assertIn("WARN deployment safety", stdout)
 
     def test_hostname_url_fails_deployment_safety(self) -> None:
         module = _load_script()