test health: findings for azd-rest

[jongio]

test health

• The service package (service.go) has 0% test coverage despite being the core business logic layer specifically designed with dependency injection for testability - BuildRequestOptions, Execute, NewRequestService, DefaultTokenProviderFactory, and DefaultHTTPClientFactory are all completely untested.
• The config package has 0% test coverage - config.Defaults() and the Config struct are never exercised in tests, leaving default values and config construction unverified.
• TestClient_Execute_RetryExponentialBackoff is a potentially flaky test - it uses hard absolute timing assertions (interval1 >= 50ms, interval2 > interval1, interval3 > interval2) with no tolerance band, making it susceptible to failures under CPU contention, slow CI runners, or OS scheduling jitter.
• The formatResponse error path in mcp.go (75% coverage) - the branch where json.MarshalIndent fails is untested, leaving the MCP fallback error serialization unverified.
• NewMCPCommand's RunE (the actual MCP server startup via server.ServeStdio) is never exercised in tests (66.7% coverage), so any initialization or startup error in that path is invisible to the test suite.
• validateScopeURLMatch has 86.7% coverage - the single-label scope host rejection branch (e.g., a bare TLD like "com" as scope) lacks a dedicated test, leaving a security-relevant guard uncovered.

Automated analysis - 6 finding(s)