@aimarket/warden 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -2,14 +2,105 @@
 
 All notable changes to `@aimarket/warden`.
 
+## 0.4.0 — 2026-08-24
+
+Calibrated against the ecosystem, not against fixtures. WARDEN was pointed at every public MCP
+server it could legitimately reach — 1 108 of them answered a live `tools/list` with 17 491 tool
+definitions — and the result is written up in [`docs/mcp-survey.md`](docs/mcp-survey.md).
+
+Ruleset `v3` blocked 50 of those 1 108 servers. Four held up on review. The other 46 were blocked
+for saying the right thing: *"Never send a private key"*, *"the private key never leaves your
+machine"*, a security scanner listing the attacks it detects, a Persian tool description spelled with
+the ZERO WIDTH NON-JOINER its language requires. A scanner with that false-positive profile does not
+get tuned by its users; it gets uninstalled.
+
+Ruleset **v4** brings blocking from 50 servers down to **6** on the same corpus, with all four real
+findings still caught.
+
+### Rules read context now
+
+Rules gained **guards** — named context checks that decide whether a match is the thing the rule is
+looking for. A guard is part of the published rule table and therefore of the digest: the same regex
+with and without `polarity` is a different ruleset, and a recorded verdict has to be able to say
+which one it was.
+
+- **`polarity`** — a credential noun inside a refusal is a promise, not a request. This one
+  distinction accounted for 390 of the 492 blocking findings in the survey.
+- **`mention`** — a phrase in quotes, in backticks, or as a bare JSON `enum` value is cited, not said.
+- **`detection`** — a secret named as the object of `detect`/`scan`/`find`/`leaked` is what a scanner
+  looks for, not what it wants.
+- **`identifierFragment`** — `mnemonic` inside `bip39-mnemonic-checksum` is that identifier's name.
+- **`harvestTarget`** — a harvest instruction says *whose* secret or *where* it lives. Without it,
+  "Obtain a permanent anonymous API key" read as theft rather than issuance.
+- **`uri`** — `javascript:` is now matched case-**sensitively** and needs a payload. Under `/i` it
+  matched the word *JavaScript* followed by a colon, i.e. every language list ever written.
+- **`payload`** — a `data:…;base64,` URI with fewer than 32 characters behind the comma is the format
+  being documented.
+- **`blob`** — `/` is in the base64 alphabet, so a JSON Schema `$ref` pointer read as a hidden blob.
+  Now gated on entropy and on schema keywords.
+- **`zeroWidth`** — U+200C/U+200D adjacent to Arabic, Persian or Indic script is orthography. U+200B,
+  U+FEFF and the bidi overrides still block.
+- **`publicKeyPath`** — `authorized_keys`, `known_hosts` and `*.pub` are public by definition.
+
+### Rules demoted from block to advise
+
+Each of these was measured selecting for honest servers. They are still reported.
+
+- **`exfiltrat*`** as a bare noun. An attacker does not name the attack; a defender names it in every
+  sentence. All three hits were defensive tools. The anchored *"send X to <external destination>"*
+  rules keep the blocking weight.
+- **`system prompt` / `developer message`**. 15 findings across 6 servers, every one an LLM proxy,
+  persona manager or agent-configuration tool that declares a `system` parameter because setting a
+  system prompt is its job.
+- **`do not tell the user`**. Four real uses, four of them the opposite of concealment — *"no refund
+  is issued automatically … do not tell the user a refund is coming"*. A blocking rule needs a
+  concealment target that refers to the tool's own action; the bare phrase carries none.
+- The **credential nouns** keep blocking but drop from `critical` to `high`: still over the default
+  threshold, no longer zeroing the gate score. One noun in a schema template shared by 377 tools
+  should not read as "maximally compromised".
+
+### Threat feed
+
+- Wildcard threat patterns now use `threatMatch`: **interior gaps are bounded** to 24 characters and
+  a segment starting with a letter must **start on a word boundary**. `*sweep*funds*` was matching
+  `funds` inside "re**funds**", and `*drain*wallet*` was joining two words from different clauses.
+  Leading and trailing `*` stay unbounded, and `_`/`-` count as boundaries so a `seed_phrase` schema
+  field still matches. `policy.sensitiveToolPatterns` keeps plain glob semantics — that is the
+  operator's own pattern against their own tool names.
+
+### Findings say what they matched
+
+- Every finding message now quotes the matched text: `… signature (\b(?:read|extract|…) at "obtain
+  the redacted credential"`. Without it a reviewer cannot tell which alternative of an alternation
+  fired, or on what. Recovering that by hand is most of the work of judging a finding, and it cost
+  hours in the survey itself.
+- Dropped matches are logged at `debug` with the guard's reason, because a guard silently discarding a
+  finding is the one behaviour in this gate that a verdict cannot show.
+
+### Release gate
+
+- `npm run check:ruleset` fails if the version in `package.json` is already on the registry with a
+  different ruleset ref, and runs in CI and in `prepublishOnly`. **0.3.0 was published carrying
+  ruleset v2 sixty-four seconds before the extraction commit, v3 landed in the source 52 minutes
+  later, and nothing republished** — so `npm install @aimarket/warden@0.3.0` handed strangers a
+  scanner with no rules on the tool-name surface while the README in that same tarball documented v3.
+  Measured after the fact, that cost nothing on the 1 108-server corpus; the ambiguity in every
+  recorded verdict was the real defect.
+
+### Tests
+
+- `test/field-survey-regression.test.ts` — 19 cases built from the survey's real text. Both
+  directions: the 46 false positives must not block, and the four real findings must.
+
 ## 0.3.0 — 2026-08-24
 
 First standalone release. The gates, the threat feed, the pinning store contract and the RFC 8785
 canonicalizer were extracted from [ARGUS](https://github.com/alexar76/argus) 0.3.0, where they had
 lived as `src/warden/`. The version number is deliberately continuous with the agent that shipped
-them, not reset to 0.1.0: this is the same enforcement code, at the same ruleset version (`v2`,
-digest `sha256-gWC14PR4kUylkJaAGMnIYYX6tPhZTJ60cSB61UZxuWc=`), with the same 85 behavioural tests
-that guarded it there.
+them, not reset to 0.1.0: this is the same enforcement code, with the same behavioural tests that
+guarded it there. The extraction itself changed no rule — it moved ruleset `v2` byte for byte — and
+the security review below, run before this package was ever published, is what took the rules to
+`v3` and closed six holes in the machinery around them.
 
 ### Why it moved
 
@@ -35,6 +126,59 @@ nothing but `node:crypto`.
 - No behavioural change to any gate. The rule table, the severities, the tiers, the score arithmetic
   and every finding code are the ones ARGUS 0.3.0 shipped.
 
+### Security review before first release
+
+The extracted code was read end to end and the findings reproduced. Six were real; all six are fixed
+here and each has a regression test in `test/hardening.test.ts` that fails on the code as extracted.
+
+- **Denial of service through glob matching (critical).** Threat-feed patterns and
+  `policy.sensitiveToolPatterns` compiled `*` into `.*` and ran a regex. A 32-character pattern
+  against a 220-character haystack took **112 seconds**; the sensitive-tool path took **89 seconds**
+  from a long tool name. A signed feed record could therefore hang every connection check, which is
+  precisely what the feed's trust model says a publisher must not be able to do — "a compromised
+  publisher can only add protection" is false if one record stops the firewall answering. Replaced
+  with a linear two-pointer matcher (`src/glob.ts`): the same case now returns in about a
+  millisecond. Feed records are additionally refused past `MAX_GLOB_WILDCARDS` (12), and a feed is
+  refused past 2000 records.
+- **Terminal injection through finding messages (high).** Tool names, server ids, catalog names and
+  a feed's `reason` string were interpolated raw into `finding.message`, which hosts print to a TTY
+  and store in receipts. A tool named `<ESC>[2K<ESC>[1A…` overwrote the BLOCK line WARDEN had just
+  written. Control characters and invisible characters are now escaped visibly (`src/sanitize.ts`,
+  exported as `displaySafe`) — escaped rather than stripped, because a name containing `U+202E`
+  should look suspicious in the report, not clean. `finding.tool` deliberately keeps the raw name:
+  it is the key a host filters its tool list with.
+- **The tool NAME was scanned by nothing (high).** An injection phrase, a zero-width character or a
+  base64 blob in the first field the model reads produced zero findings. Ruleset **v3** gives every
+  rule a `surfaces` list and adds the name to 17 of the 25 — every phrase-keyed and hidden-payload
+  rule. The three noun-keyed codes stay off the name on purpose (`sign_with_private_key` is a
+  plausible tool, and refusing it would be the v1 calibration error on a new surface).
+- **A gate that threw took the whole verdict with it (high).** `vet()` rejected, so the host got no
+  verdict at all — not even the findings the earlier gates had already produced — and a
+  full-disk pin store or a bug in a custom gate decided whether the connection was blocked. A throw
+  is now a `GATE_ERROR` finding at `high` with a zero score: a gate that crashed cleared nothing.
+- **A frozen policy crashed the constructor (medium).** The `blockAtSeverity` typo fallback assigned
+  into the caller's own object, so `Object.freeze(policy)` — a reasonable thing for a host to do —
+  raised a `TypeError` out of `new Warden()` under ESM strict mode. The policy is now normalized
+  into a private copy and the caller's object is never touched.
+- **Pinning covered the advertisement but not the program (medium).** Tool-def pinning caught a
+  server that changed what it advertises, not one that kept the advertisement and changed the
+  command behind it — which a remote **catalog** can do to an already-approved id. `PinnedServer`
+  gained an optional `identityHash` (transport, command, args, url, name) and a
+  `SERVER_IDENTITY_DRIFT` finding. `env` is excluded on purpose: it holds secrets, and the pin is
+  written to disk. Pins from before the field exists stay silent — absent is "not recorded", never
+  "changed".
+
+Two smaller fixes came out of the same pass: a `feedPublicKey` that parses but is not an Ed25519 key
+is now refused with a warning instead of failing inside `verify()` and being logged at `debug`
+(indistinguishable from "the feed had nothing new"), and an oversized feed body is now streamed and
+aborted at the cap instead of being buffered whole by `res.text()` — `content-length` is advisory,
+so the old check was one missing header away from being no check at all.
+
+Two things the review deliberately did **not** change: `EgressGuard` passed every case put to it
+(userinfo tricks, `file:`/`data:` schemes, suffix confusion, case folding), and the scan's cost over
+large tool definitions is linear (500 tools × 240 KB in 1.3 s), so no truncation was introduced for
+a problem that does not exist.
+
 ### Added
 
 - `test/packaging.test.ts` — fails if a runtime dependency appears, if any source file imports outside

package/README-es.md

@@ -5,12 +5,17 @@
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
   <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Cero dependencias de ejecución" />
-  <img src="docs/badges/tests.svg" alt="95 pruebas en verde" />
+  <img src="docs/badges/tests.svg" alt="141 pruebas en verde" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="Licencia: MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
+<p align="center">
+  <img src="docs/assets/hero.svg" alt="WARDEN — MCP security firewall: tool defs pass static-scan, threat-feed, origin, and pinning before a recorded verdict" width="920" />
+</p>
+
+
 > 🌐 [English](README.md) · [Русский](README-ru.md) · **Español** · [Français](README-fr.md) · [中文](README-zh.md) · [Glosario](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
 Un servidor MCP le dice a tu agente qué hacen sus herramientas. El agente se lo cree — y esa frase
@@ -77,7 +82,7 @@ flowchart LR
 
 | Puerta | Qué decide | Red | ¿Fatal? |
 |---|---|---|---|
-| **static-scan** | Inyección, exfiltración, peticiones de credenciales y señales de Unicode oculto/base64 en `description` e `inputSchema` — 25 reglas, v2, de las cuales 18 pueden bloquear y 7 son solo de aviso | ninguna | no |
+| **static-scan** | Inyección, exfiltración, peticiones de credenciales y señales de Unicode oculto/base64 en el `name`, la `description` y el `inputSchema` de la herramienta — 25 reglas, v4, de las cuales 15 pueden bloquear y 10 son solo de aviso, 17 cubren también el nombre y 12 llevan un guard de contexto | ninguna | no |
 | **threat-feed** | Identidad de servidor o herramienta conocida como maliciosa: 11 registros integrados más un feed firmado opcional | solo la descarga del feed | sí, para un `critical` con alcance de servidor |
 | **origin** | Si el operador declaró este servidor o llegó desde un catálogo remoto | ninguna | sí, con `allowUnknownServers: false` |
 | **pinning** | Si las definiciones de herramientas siguen coincidiendo con lo que el usuario aprobó | ninguna | sí, con `pinToolDefs: true` |
@@ -99,7 +104,7 @@ endureciera el umbral.
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "2", digest: "sha256-gWC14PR4…" } }
+  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
 }
 ```
 
@@ -153,6 +158,7 @@ degradar a ninguna protección:
 | [La cadena de puertas](docs/gates.es.md) | Cada nivel de regla, cada código de hallazgo, cómo se construye la puntuación compuesta y cómo añadir una puerta |
 | [El threat feed firmado](docs/threat-feed.es.md) | El contrato en el cable, las tres comprobaciones y cómo publicar un feed que WARDEN acepte |
 | [Guía de integración](docs/integration.es.md) | Cómo conectar WARDEN a tu propio host MCP, elecciones de política y qué registrar |
+| [Estudio de campo: 1 108 servidores MCP públicos](docs/mcp-survey.es.md) | Qué decidió WARDEN sobre definiciones de herramienta reales de terceros — 50 servidores bloqueados, 4 sustentados, y las seis formas en que el resto se equivocó |
 
 ## Lo que esto no es
 
@@ -171,7 +177,7 @@ degradar a ninguna protección:
 ## Desarrollo
 
 ```bash
-npm install && npm run build && npm test   # 95 pruebas
+npm install && npm run build && npm test   # 141 pruebas
 ```
 
 `test/packaging.test.ts` es lo que mantiene honesto el titular: falla si aparece una dependencia de

package/README-fr.md

@@ -5,12 +5,17 @@
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
   <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="version npm" /></a>
   <img src="docs/badges/deps.svg" alt="Zéro dépendance d'exécution" />
-  <img src="docs/badges/tests.svg" alt="95 tests au vert" />
+  <img src="docs/badges/tests.svg" alt="141 tests au vert" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="Licence : MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
+<p align="center">
+  <img src="docs/assets/hero.svg" alt="WARDEN — MCP security firewall: tool defs pass static-scan, threat-feed, origin, and pinning before a recorded verdict" width="920" />
+</p>
+
+
 > 🌐 [English](README.md) · [Русский](README-ru.md) · [Español](README-es.md) · **Français** · [中文](README-zh.md) · [Glossaire](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
 Un serveur MCP indique lui-même à votre agent ce que font ses outils. L'agent le croit — et cette
@@ -77,7 +82,7 @@ flowchart LR
 
 | Porte | Ce qu'elle décide | Réseau | Fatale ? |
 |---|---|---|---|
-| **static-scan** | Injection, exfiltration, demandes d'identifiants et indices d'Unicode masqué/base64 dans `description` et `inputSchema` — 25 règles, v2, dont 18 peuvent bloquer et 7 sont purement indicatives | aucun | non |
+| **static-scan** | Injection, exfiltration, demandes d'identifiants et indices d'Unicode masqué/base64 dans le `name`, la `description` et l'`inputSchema` de l'outil — 25 règles, v4, dont 15 peuvent bloquer et 10 sont purement indicatives, 17 couvrent aussi le nom et 12 portent un guard de contexte | aucun | non |
 | **threat-feed** | Identité de serveur ou outil connu comme malveillant : 11 enregistrements intégrés plus un feed signé optionnel | seulement le téléchargement du feed | oui, pour un `critical` de portée serveur |
 | **origin** | Si l'opérateur a déclaré ce serveur ou s'il provient d'un catalogue distant | aucun | oui, avec `allowUnknownServers: false` |
 | **pinning** | Si les définitions d'outils correspondent encore à ce que l'utilisateur a approuvé | aucun | oui, avec `pinToolDefs: true` |
@@ -99,7 +104,7 @@ bloquante pour quiconque durcissait le seuil.
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "2", digest: "sha256-gWC14PR4…" } }
+  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
 }
 ```
 
@@ -153,6 +158,7 @@ une absence de protection :
 | [La chaîne de portes](docs/gates.fr.md) | Chaque niveau de règle, chaque code de constat, la construction du score composite et comment ajouter une porte |
 | [Le threat feed signé](docs/threat-feed.fr.md) | Le contrat sur le fil, les trois vérifications, et comment publier un feed que WARDEN acceptera |
 | [Guide d'intégration](docs/integration.fr.md) | Brancher WARDEN sur votre propre hôte MCP, choix de politique, et quoi consigner |
+| [Étude de terrain : 1 108 serveurs MCP publics](docs/mcp-survey.fr.md) | Ce que WARDEN a décidé sur de vraies définitions d'outil tierces — 50 serveurs bloqués, 4 étayés, et les six façons dont le reste était faux |
 
 ## Ce que ce n'est pas
 
@@ -171,7 +177,7 @@ une absence de protection :
 ## Développement
 
 ```bash
-npm install && npm run build && npm test   # 95 tests
+npm install && npm run build && npm test   # 141 tests
 ```
 
 `test/packaging.test.ts` est ce qui tient l'accroche honnête : il échoue si une dépendance d'exécution

package/README-ru.md

@@ -5,12 +5,17 @@
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
   <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Zero runtime dependencies" />
-  <img src="docs/badges/tests.svg" alt="95 tests passing" />
+  <img src="docs/badges/tests.svg" alt="141 tests passing" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="License: MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
+<p align="center">
+  <img src="docs/assets/hero.svg" alt="WARDEN — MCP security firewall: tool defs pass static-scan, threat-feed, origin, and pinning before a recorded verdict" width="920" />
+</p>
+
+
 > 🌐 [English](README.md) · **Русский** · [Español](README-es.md) · [Français](README-fr.md) · [中文](README-zh.md) · [Глоссарий](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
 MCP-сервер сам сообщает вашему агенту, что делают его инструменты. Агент этому верит — и вот эта
@@ -77,7 +82,7 @@ flowchart LR
 
 | Гейт | Что решает | Сеть | Fatal? |
 |---|---|---|---|
-| **static-scan** | Инъекции, эксфильтрация, запросы учётных данных, скрытый Unicode и base64-признаки в `description` и `inputSchema` — 25 правил, версия 2, из них 18 могут блокировать и 7 только сообщают | нет | нет |
+| **static-scan** | Инъекции, эксфильтрация, запросы учётных данных, скрытый Unicode и base64-признаки в `name`, `description` и `inputSchema` инструмента — 25 правил, версия 4, из них 15 могут блокировать и 10 только сообщают, 17 покрывают и имя, а у 12 есть контекстный guard | нет | нет |
 | **threat-feed** | Известный плохой сервер или инструмент: 11 встроенных записей плюс опциональный подписанный feed | только загрузка feed | да, для `critical` на уровне сервера |
 | **origin** | Объявил ли оператор этот сервер, или он пришёл из удалённого каталога | нет | да, при `allowUnknownServers: false` |
 | **pinning** | Совпадают ли определения инструментов с тем, что подтвердил пользователь | нет | да, при `pinToolDefs: true` |
@@ -98,7 +103,7 @@ severity снова делало находку блокирующей для в
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "2", digest: "sha256-gWC14PR4…" } }
+  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
 }
 ```
 
@@ -152,6 +157,7 @@ GET <ваш feed url>
 | [Цепочка гейтов](docs/gates.ru.md) | Все уровни правил, все коды находок, как складывается composite score и как добавить свой гейт |
 | [Подписанный threat feed](docs/threat-feed.ru.md) | Контракт на проводе, три проверки и как публиковать feed, который WARDEN примет |
 | [Руководство по интеграции](docs/integration.ru.md) | Как встроить WARDEN в свой MCP-хост, выбор политики и что записывать |
+| [Полевой обзор: 1 108 публичных MCP-серверов](docs/mcp-survey.ru.md) | Что WARDEN решил на настоящих чужих определениях инструментов — 50 серверов заблокировано, 4 подтверждено, и шесть способов, которыми остальные оказались ошибкой |
 
 ## Чем это не является
 
@@ -170,7 +176,7 @@ GET <ваш feed url>
 ## Разработка
 
 ```bash
-npm install && npm run build && npm test   # 95 тестов
+npm install && npm run build && npm test   # 141 тестов
 ```
 
 `test/packaging.test.ts` — то, что удерживает заголовок честным: он падает, если появляется

package/README-zh.md

@@ -5,12 +5,17 @@
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
   <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm 版本" /></a>
   <img src="docs/badges/deps.svg" alt="零运行时依赖" />
-  <img src="docs/badges/tests.svg" alt="95 项测试通过" />
+  <img src="docs/badges/tests.svg" alt="141 项测试通过" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="许可证：MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
+<p align="center">
+  <img src="docs/assets/hero.svg" alt="WARDEN — MCP security firewall: tool defs pass static-scan, threat-feed, origin, and pinning before a recorded verdict" width="920" />
+</p>
+
+
 > 🌐 [English](README.md) · [Русский](README-ru.md) · [Español](README-es.md) · [Français](README-fr.md) · **中文** · [术语表](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
 MCP 服务器自己告诉你的智能体，它的工具是做什么的。智能体就信了——而这句话正是攻击面。工具描述就是第三方直接
@@ -73,7 +78,7 @@ flowchart LR
 
 | 门控 | 判定什么 | 网络 | 是否 fatal |
 |---|---|---|---|
-| **static-scan** | `description` 与 `inputSchema` 中的注入、外泄、索要凭据，以及隐藏 Unicode/base64 迹象——25 条规则（v2），其中 18 条可阻止、7 条仅提示 | 无 | 否 |
+| **static-scan** | 工具 `name`、`description` 与 `inputSchema` 中的注入、外泄、索要凭据，以及隐藏 Unicode/base64 迹象——25 条规则（v4），其中 15 条可阻止、10 条仅提示，17 条同时覆盖名称，12 条带有上下文 guard | 无 | 否 |
 | **threat-feed** | 已知恶意的服务器身份或工具：11 条内置记录，外加可选的已签名 feed | 仅 feed 下载 | 是，服务器范围的 `critical` |
 | **origin** | 该服务器是运营者声明的，还是来自远端目录 | 无 | 是，当 `allowUnknownServers: false` |
 | **pinning** | 工具定义是否仍与用户批准过的一致 | 无 | 是，当 `pinToolDefs: true` |
@@ -93,7 +98,7 @@ flowchart LR
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "2", digest: "sha256-gWC14PR4…" } }
+  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
 }
 ```
 
@@ -140,6 +145,7 @@ GET <你的 feed url>
 | [门控链](docs/gates.zh.md) | 每一个规则层级、每一个发现码、综合评分如何构成，以及如何新增一个门控 |
 | [已签名的威胁情报 feed](docs/threat-feed.zh.md) | 线上契约、三项检查，以及如何发布一个 WARDEN 会接受的 feed |
 | [集成指南](docs/integration.zh.md) | 如何把 WARDEN 接入自己的 MCP 宿主、策略取舍，以及应当留档什么 |
+| [实地普查：1 108 个公开 MCP 服务器](docs/mcp-survey.zh.md) | WARDEN 在真实的第三方工具定义上判了什么——拦截 50 个服务器，4 项成立，其余判错的六种方式 |
 
 ## 它不是什么
 
@@ -155,7 +161,7 @@ GET <你的 feed url>
 ## 开发
 
 ```bash
-npm install && npm run build && npm test   # 95 项测试
+npm install && npm run build && npm test   # 141 项测试
 ```
 
 `test/packaging.test.ts` 正是让标题保持诚实的东西：一旦出现运行时依赖、任何源文件从包外 import、或者入口点不

package/README.md

@@ -5,12 +5,17 @@
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
   <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Zero runtime dependencies" />
-  <img src="docs/badges/tests.svg" alt="95 tests passing" />
+  <img src="docs/badges/tests.svg" alt="141 tests passing" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="License: MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
+<p align="center">
+  <img src="docs/assets/hero.svg" alt="WARDEN — MCP security firewall: tool defs pass static-scan, threat-feed, origin, and pinning before a recorded verdict" width="920" />
+</p>
+
+
 > 🌐 **English** · [Русский](README-ru.md) · [Español](README-es.md) · [Français](README-fr.md) · [中文](README-zh.md) · [Glossary](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
 An MCP server tells your agent what its tools do. The agent believes it — that sentence is the
@@ -76,7 +81,7 @@ flowchart LR
 
 | Gate | What it decides | Network | Fatal? |
 |---|---|---|---|
-| **static-scan** | Injection, exfiltration, credential requests and hidden-Unicode/base64 tells in `description` and `inputSchema` — 25 rules, v2, of which 18 can block and 7 are advisory-only | none | no |
+| **static-scan** | Injection, exfiltration, credential requests and hidden-Unicode/base64 tells in the tool `name`, its `description` and its `inputSchema` — 25 rules, v4, of which 15 can block and 10 are advisory-only, 17 also cover the name, and 12 carry a context guard | none | no |
 | **threat-feed** | Known-bad server identity or tool, from 11 built-in records plus an optional signed feed | only the feed fetch | yes, for a server-scoped `critical` |
 | **origin** | Whether the operator declared this server or it arrived from a remote catalog | none | yes, under `allowUnknownServers: false` |
 | **pinning** | Whether the tool defs still match what the user approved | none | yes, under `pinToolDefs: true` |
@@ -97,7 +102,7 @@ second as a low severity made it blocking again for anyone who tightened the thr
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "2", digest: "sha256-gWC14PR4…" } }
+  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
 }
 ```
 
@@ -149,6 +154,7 @@ no protection:
 | [The gate chain](docs/gates.md) | Every rule tier, every finding code, how the composite score is built, and how to add a gate |
 | [The signed threat feed](docs/threat-feed.md) | The wire contract, the three checks, and how to publish a feed WARDEN will accept |
 | [Integration guide](docs/integration.md) | Wiring WARDEN into your own MCP host, policy choices, and what to record |
+| [Field survey: 1 108 public MCP servers](docs/mcp-survey.md) | What WARDEN decided on real third-party tool definitions — 50 servers blocked, 4 substantiated, and the six ways the rest were wrong |
 
 ## What this is not
 
@@ -166,7 +172,7 @@ no protection:
 ## Development
 
 ```bash
-npm install && npm run build && npm test   # 95 tests
+npm install && npm run build && npm test   # 141 tests
 ```
 
 `test/packaging.test.ts` is what keeps the headline honest: it fails if a runtime dependency appears,

package/dist/glob.d.ts

@@ -0,0 +1,81 @@
+/**
+ * `*`-glob matching, without a regular expression.
+ *
+ * WARDEN matches two kinds of glob against attacker-controlled text: threat-feed
+ * patterns (a signed publisher chooses the pattern, a hostile server chooses the
+ * haystack) and `policy.sensitiveToolPatterns` (the operator chooses the pattern,
+ * the server chooses the tool name). Both used to compile `*` into `.*` and run a
+ * regex, which is a denial of service:
+ *
+ *     pattern  "*a*a*a*a*a*a*a*a*a*a*a*a*a*a*zzz"   (32 characters)
+ *     haystack "aaaa..."                            (220 characters)
+ *     -> 112 SECONDS inside one RegExp.test
+ *
+ * The engine has to try every way of distributing the wildcards over the haystack
+ * before it can conclude "no match" - exponential in the number of `*`. That
+ * mattered more than an ordinary performance bug: the threat feed's whole trust
+ * story is that a compromised publisher can only ever ADD protection, never
+ * remove it, and a record that hangs `vet()` forever removes all of it. The same
+ * shape let a hostile server freeze the agent inspecting it, by advertising a
+ * long enough tool name against an operator's own `*a*b*c*` pattern.
+ *
+ * The two-pointer algorithm below is the standard wildcard matcher: it walks the
+ * haystack once and remembers only the most recent `*` to fall back to, so the
+ * work is bounded by `pattern.length x value.length` with no backtracking tree to
+ * explode. The same 32/220 case returns in microseconds.
+ *
+ * Semantics, matching what the regex did: `*` matches any run of zero or more
+ * UTF-16 code units (including newlines - the old regex needed the `s` flag for
+ * that), every other character is literal, and the match is anchored at both
+ * ends. Case folding is the caller's job: both sides arrive already lowercased.
+ */
+export declare function wildcardMatch(pattern: string, value: string): boolean;
+/**
+ * How many wildcards a pattern may carry.
+ *
+ * The matcher above is not exponential, but `*`-heavy patterns still cost
+ * `pattern x value` per match and buy nothing: a real threat pattern names a
+ * command, a path or a keyword. A record with more than this many wildcards is
+ * refused rather than run - refusing an *addition* to the deny-list is the safe
+ * direction, and it is reported loudly.
+ */
+export declare const MAX_GLOB_WILDCARDS = 12;
+/** Count `*` in a pattern, for the record validator. */
+export declare function countWildcards(pattern: string): number;
+/**
+ * Largest gap an INTERIOR `*` in a threat pattern may span.
+ *
+ * A field survey of 1 108 public MCP servers (see docs/mcp-survey.md) found every
+ * multi-segment built-in firing on unrelated words that merely happened to appear
+ * in the same paragraph: `*drain*wallet*` matched an anti-drainer scanner because
+ * it says "drainer" in one clause and "wallet" in another, and `*seed*phrase*`
+ * matched "for a **seed** topic, returns suggested search **phrases**". A real
+ * threat pattern names something whose parts sit next to each other; 24 characters
+ * is roughly "a few words apart" and comfortably covers "wallet seed or recovery
+ * phrase".
+ */
+export declare const THREAT_MAX_GAP = 24;
+/**
+ * Threat-pattern matching: `wildcardMatch` plus two constraints that only make
+ * sense for a deny-list.
+ *
+ * 1. **Interior gaps are bounded** to {@link THREAT_MAX_GAP}. Leading and trailing
+ *    `*` stay unbounded — `*id_rsa*` must still find `id_rsa` anywhere.
+ * 2. **A segment that starts with a word character must start at a word boundary.**
+ *    `*sweep*funds*` matched an ENS floor-sweeping tool because `funds` sits inside
+ *    "re**funds**". Only the START is anchored: a pattern author writing `*drain*`
+ *    means "drainer" too, so anchoring the end as well would break ordinary
+ *    stemming.
+ *
+ * Kept separate from {@link wildcardMatch} on purpose. That function is also what
+ * `policy.sensitiveToolPatterns` runs on, where the operator wrote the pattern
+ * against their own tool names and plain glob semantics are what they expect.
+ *
+ * Completeness matters here in a way it does not for a display filter: a missed
+ * match is a deny-list entry that silently stopped working. So this explores every
+ * reachable position per segment (deduplicated, so the work stays bounded by
+ * `segments x value.length`) rather than taking the leftmost occurrence greedily,
+ * which would report "no match" for a pattern that does match further along.
+ */
+export declare function threatMatch(pattern: string, value: string): boolean;
+//# sourceMappingURL=glob.d.ts.map

package/dist/glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CA4BrE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CA+BnE"}