@aimarket/warden 0.22.3 → 0.23.0

package/docs/scan.zh.md

@@ -7,11 +7,11 @@
 `warden-mcp scan` 读取你已有的 MCP 配置，连接其中启动的每个服务器，并在模型看到工具定义之前对其进行审查。它与 [`wrap`](../README-zh.md) 和[库](integration.zh.md)使用同一条关卡链，只是对你的配置运行一次，而不是挡在单个服务器前面。
 
 ```bash
-npx -y @aimarket/warden@0.22.3 scan
+npx -y @aimarket/warden@0.23.0 scan
 ```
 
 ```text
-WARDEN scan 0.22.3 · ruleset 16 sha256-86y6iNc4R+LM… · block at high
+WARDEN scan 0.23.0 · ruleset 17 sha256-UOfK25xo6D8v… · block at high
   read .mcp.json (claude-code, 3 servers)
 
   ✓ allow   notes       claude-code    1 tool · score 0.90

package/docs/scanner-comparison.md

@@ -76,6 +76,16 @@ The other scanners were not run again; the table at the top is from 2026-10-16.
 in the gVisor containers of 2026-10-16. Verdicts by case id:
 [`results/2026-10-22-mcptox-v15.json`](../scripts/scanner-comparison/results/2026-10-22-mcptox-v15.json).
 
+## Ruleset v17, 2026-11-01 (WARDEN only)
+
+DevToolLab's test of MCP security tools has a tool whose description adds a BCC to another server's `send_email`; it
+passed v16 and Cisco mcp-scanner's YARA mode. v17 catches it ([the rule](gates.md)). It is not from MCPTox, so neither
+half was read for it. Against a v16 build on the same files, v17 changes no verdict: MCPTox dev half 250 of 267,
+held-out half 210 of 218, 0 of 45 clean servers, 225 of 225 with the marker, the same 4 of 986 corpus servers and the
+same 20 of a 1,000-package HISTOR sample drawn on 2026-11-01. The v16 build reproduced the 2026-10-22 MCPTox verdicts
+case for case. Verdicts: [`results/2026-11-01-mcptox-v17.json`](../scripts/scanner-comparison/results/2026-11-01-mcptox-v17.json),
+[`results/2026-11-01-v17-vs-v16.json`](../scripts/scanner-comparison/results/2026-11-01-v17-vs-v16.json).
+
 ## Five scanners, and the ones we did not run
 
 Glama's listing for WARDEN names seven related tools. We read each one's code or listing before deciding.

package/opencode-plugin/warden.js

@@ -0,0 +1,10 @@
+// WARDEN flow guard for OpenCode: copy this file into OpenCode's plugin folder (~/.config/opencode/plugin/ or
+// .opencode/plugin/), and dist/opencode-plugin.js with every dist/flow-guard*.js into ~/.config/opencode/warden/.
+// Export only the plugin: OpenCode calls every exported function as one. See docs/opencode.md.
+import { createWardenPlugin } from '../warden/opencode-plugin.js';
+
+export const WardenFlowGuard = createWardenPlugin({
+  block: 'data',
+  // Keys only the OpenCode process needs; shell commands get them blank. Add your provider's.
+  stripEnv: ['DEEPSEEK_API_KEY', 'OPENAI_API_KEY', 'ANTHROPIC_API_KEY'],
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aimarket/warden",
-  "version": "0.22.3",
+  "version": "0.23.0",
   "description": "WARDEN — MCP security firewall. Stdio wrap proxy, inspection tools and library. Vets definitions before model exposure. Zero runtime dependencies.",
   "type": "module",
   "license": "MIT",
@@ -34,6 +34,11 @@
       "types": "./dist/atomic-screen.d.ts",
       "import": "./dist/atomic-screen.js",
       "default": "./dist/atomic-screen.js"
+    },
+    "./opencode": {
+      "types": "./dist/opencode-plugin.d.ts",
+      "import": "./dist/opencode-plugin.js",
+      "default": "./dist/opencode-plugin.js"
     }
   },
   "files": [
@@ -51,11 +56,13 @@
     "docs/security-hardening*.md",
     "docs/gates*.md",
     "docs/flow-guard*.md",
+    "docs/opencode*.md",
     "examples/atomic-screen-server.mjs",
     "examples/answer-gate-host.mjs",
     "native/macos/Package.swift",
     "native/macos/Sources",
-    "scripts/build-macos.mjs"
+    "scripts/build-macos.mjs",
+    "opencode-plugin/warden.js"
   ],
   "engines": {
     "node": ">=20"