@aimarket/warden 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -2,14 +2,113 @@
 
 All notable changes to `@aimarket/warden`.
 
+## 0.5.0 — 2026-09-03
+
+stdio MCP server for Glama / Claude Desktop / Cursor (`warden-mcp` / `node dist/mcp-server.js`).
+Six tools with TDQS-oriented definitions (title, when-to-use / when-not naming siblings, MCP
+annotations, per-parameter descriptions, `outputSchema`). Dockerfile + `glama.json`. No secrets,
+no npm runtime dependencies. The process inspects a `tools/list` dump; it does not launch the
+server under scan.
+
+## 0.4.0 — 2026-08-24
+
+Calibrated against the ecosystem, not against fixtures. WARDEN was pointed at every public MCP
+server it could legitimately reach — 1 108 of them answered a live `tools/list` with 17 491 tool
+definitions — and the result is written up in [`docs/mcp-survey.md`](docs/mcp-survey.md).
+
+Ruleset `v3` blocked 50 of those 1 108 servers. Four held up on review. The other 46 were blocked
+for saying the right thing: *"Never send a private key"*, *"the private key never leaves your
+machine"*, a security scanner listing the attacks it detects, a Persian tool description spelled with
+the ZERO WIDTH NON-JOINER its language requires. A scanner with that false-positive profile does not
+get tuned by its users; it gets uninstalled.
+
+Ruleset **v4** brings blocking from 50 servers down to **6** on the same corpus, with all four real
+findings still caught.
+
+### Rules read context now
+
+Rules gained **guards** — named context checks that decide whether a match is the thing the rule is
+looking for. A guard is part of the published rule table and therefore of the digest: the same regex
+with and without `polarity` is a different ruleset, and a recorded verdict has to be able to say
+which one it was.
+
+- **`polarity`** — a credential noun inside a refusal is a promise, not a request. This one
+  distinction accounted for 390 of the 492 blocking findings in the survey.
+- **`mention`** — a phrase in quotes, in backticks, or as a bare JSON `enum` value is cited, not said.
+- **`detection`** — a secret named as the object of `detect`/`scan`/`find`/`leaked` is what a scanner
+  looks for, not what it wants.
+- **`identifierFragment`** — `mnemonic` inside `bip39-mnemonic-checksum` is that identifier's name.
+- **`harvestTarget`** — a harvest instruction says *whose* secret or *where* it lives. Without it,
+  "Obtain a permanent anonymous API key" read as theft rather than issuance.
+- **`uri`** — `javascript:` is now matched case-**sensitively** and needs a payload. Under `/i` it
+  matched the word *JavaScript* followed by a colon, i.e. every language list ever written.
+- **`payload`** — a `data:…;base64,` URI with fewer than 32 characters behind the comma is the format
+  being documented.
+- **`blob`** — `/` is in the base64 alphabet, so a JSON Schema `$ref` pointer read as a hidden blob.
+  Now gated on entropy and on schema keywords.
+- **`zeroWidth`** — U+200C/U+200D adjacent to Arabic, Persian or Indic script is orthography. U+200B,
+  U+FEFF and the bidi overrides still block.
+- **`publicKeyPath`** — `authorized_keys`, `known_hosts` and `*.pub` are public by definition.
+
+### Rules demoted from block to advise
+
+Each of these was measured selecting for honest servers. They are still reported.
+
+- **`exfiltrat*`** as a bare noun. An attacker does not name the attack; a defender names it in every
+  sentence. All three hits were defensive tools. The anchored *"send X to <external destination>"*
+  rules keep the blocking weight.
+- **`system prompt` / `developer message`**. 15 findings across 6 servers, every one an LLM proxy,
+  persona manager or agent-configuration tool that declares a `system` parameter because setting a
+  system prompt is its job.
+- **`do not tell the user`**. Four real uses, four of them the opposite of concealment — *"no refund
+  is issued automatically … do not tell the user a refund is coming"*. A blocking rule needs a
+  concealment target that refers to the tool's own action; the bare phrase carries none.
+- The **credential nouns** keep blocking but drop from `critical` to `high`: still over the default
+  threshold, no longer zeroing the gate score. One noun in a schema template shared by 377 tools
+  should not read as "maximally compromised".
+
+### Threat feed
+
+- Wildcard threat patterns now use `threatMatch`: **interior gaps are bounded** to 24 characters and
+  a segment starting with a letter must **start on a word boundary**. `*sweep*funds*` was matching
+  `funds` inside "re**funds**", and `*drain*wallet*` was joining two words from different clauses.
+  Leading and trailing `*` stay unbounded, and `_`/`-` count as boundaries so a `seed_phrase` schema
+  field still matches. `policy.sensitiveToolPatterns` keeps plain glob semantics — that is the
+  operator's own pattern against their own tool names.
+
+### Findings say what they matched
+
+- Every finding message now quotes the matched text: `… signature (\b(?:read|extract|…) at "obtain
+  the redacted credential"`. Without it a reviewer cannot tell which alternative of an alternation
+  fired, or on what. Recovering that by hand is most of the work of judging a finding, and it cost
+  hours in the survey itself.
+- Dropped matches are logged at `debug` with the guard's reason, because a guard silently discarding a
+  finding is the one behaviour in this gate that a verdict cannot show.
+
+### Release gate
+
+- `npm run check:ruleset` fails if the version in `package.json` is already on the registry with a
+  different ruleset ref, and runs in CI and in `prepublishOnly`. **0.3.0 was published carrying
+  ruleset v2 sixty-four seconds before the extraction commit, v3 landed in the source 52 minutes
+  later, and nothing republished** — so `npm install @aimarket/warden@0.3.0` handed strangers a
+  scanner with no rules on the tool-name surface while the README in that same tarball documented v3.
+  Measured after the fact, that cost nothing on the 1 108-server corpus; the ambiguity in every
+  recorded verdict was the real defect.
+
+### Tests
+
+- `test/field-survey-regression.test.ts` — 19 cases built from the survey's real text. Both
+  directions: the 46 false positives must not block, and the four real findings must.
+
 ## 0.3.0 — 2026-08-24
 
 First standalone release. The gates, the threat feed, the pinning store contract and the RFC 8785
 canonicalizer were extracted from [ARGUS](https://github.com/alexar76/argus) 0.3.0, where they had
 lived as `src/warden/`. The version number is deliberately continuous with the agent that shipped
-them, not reset to 0.1.0: this is the same enforcement code, at the same ruleset version (`v2`,
-digest `sha256-gWC14PR4kUylkJaAGMnIYYX6tPhZTJ60cSB61UZxuWc=`), with the same 85 behavioural tests
-that guarded it there.
+them, not reset to 0.1.0: this is the same enforcement code, with the same behavioural tests that
+guarded it there. The extraction itself changed no rule — it moved ruleset `v2` byte for byte — and
+the security review below, run before this package was ever published, is what took the rules to
+`v3` and closed six holes in the machinery around them.
 
 ### Why it moved
 
@@ -35,6 +134,59 @@ nothing but `node:crypto`.
 - No behavioural change to any gate. The rule table, the severities, the tiers, the score arithmetic
   and every finding code are the ones ARGUS 0.3.0 shipped.
 
+### Security review before first release
+
+The extracted code was read end to end and the findings reproduced. Six were real; all six are fixed
+here and each has a regression test in `test/hardening.test.ts` that fails on the code as extracted.
+
+- **Denial of service through glob matching (critical).** Threat-feed patterns and
+  `policy.sensitiveToolPatterns` compiled `*` into `.*` and ran a regex. A 32-character pattern
+  against a 220-character haystack took **112 seconds**; the sensitive-tool path took **89 seconds**
+  from a long tool name. A signed feed record could therefore hang every connection check, which is
+  precisely what the feed's trust model says a publisher must not be able to do — "a compromised
+  publisher can only add protection" is false if one record stops the firewall answering. Replaced
+  with a linear two-pointer matcher (`src/glob.ts`): the same case now returns in about a
+  millisecond. Feed records are additionally refused past `MAX_GLOB_WILDCARDS` (12), and a feed is
+  refused past 2000 records.
+- **Terminal injection through finding messages (high).** Tool names, server ids, catalog names and
+  a feed's `reason` string were interpolated raw into `finding.message`, which hosts print to a TTY
+  and store in receipts. A tool named `<ESC>[2K<ESC>[1A…` overwrote the BLOCK line WARDEN had just
+  written. Control characters and invisible characters are now escaped visibly (`src/sanitize.ts`,
+  exported as `displaySafe`) — escaped rather than stripped, because a name containing `U+202E`
+  should look suspicious in the report, not clean. `finding.tool` deliberately keeps the raw name:
+  it is the key a host filters its tool list with.
+- **The tool NAME was scanned by nothing (high).** An injection phrase, a zero-width character or a
+  base64 blob in the first field the model reads produced zero findings. Ruleset **v3** gives every
+  rule a `surfaces` list and adds the name to 17 of the 25 — every phrase-keyed and hidden-payload
+  rule. The three noun-keyed codes stay off the name on purpose (`sign_with_private_key` is a
+  plausible tool, and refusing it would be the v1 calibration error on a new surface).
+- **A gate that threw took the whole verdict with it (high).** `vet()` rejected, so the host got no
+  verdict at all — not even the findings the earlier gates had already produced — and a
+  full-disk pin store or a bug in a custom gate decided whether the connection was blocked. A throw
+  is now a `GATE_ERROR` finding at `high` with a zero score: a gate that crashed cleared nothing.
+- **A frozen policy crashed the constructor (medium).** The `blockAtSeverity` typo fallback assigned
+  into the caller's own object, so `Object.freeze(policy)` — a reasonable thing for a host to do —
+  raised a `TypeError` out of `new Warden()` under ESM strict mode. The policy is now normalized
+  into a private copy and the caller's object is never touched.
+- **Pinning covered the advertisement but not the program (medium).** Tool-def pinning caught a
+  server that changed what it advertises, not one that kept the advertisement and changed the
+  command behind it — which a remote **catalog** can do to an already-approved id. `PinnedServer`
+  gained an optional `identityHash` (transport, command, args, url, name) and a
+  `SERVER_IDENTITY_DRIFT` finding. `env` is excluded on purpose: it holds secrets, and the pin is
+  written to disk. Pins from before the field exists stay silent — absent is "not recorded", never
+  "changed".
+
+Two smaller fixes came out of the same pass: a `feedPublicKey` that parses but is not an Ed25519 key
+is now refused with a warning instead of failing inside `verify()` and being logged at `debug`
+(indistinguishable from "the feed had nothing new"), and an oversized feed body is now streamed and
+aborted at the cap instead of being buffered whole by `res.text()` — `content-length` is advisory,
+so the old check was one missing header away from being no check at all.
+
+Two things the review deliberately did **not** change: `EgressGuard` passed every case put to it
+(userinfo tricks, `file:`/`data:` schemes, suffix confusion, case folding), and the scan's cost over
+large tool definitions is linear (500 tools × 240 KB in 1.3 s), so no truncation was introduced for
+a problem that does not exist.
+
 ### Added
 
 - `test/packaging.test.ts` — fails if a runtime dependency appears, if any source file imports outside

package/README-es.md

@@ -1,18 +1,42 @@
-# WARDEN — cortafuegos de seguridad para MCP
+# WARDEN — servidor MCP
+
+<!-- mcp-name: io.github.alexar76/warden -->
 
 <!-- aicom-readme-badges -->
 <p align="center">
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
-  <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
+  <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
+  <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Cero dependencias de ejecución" />
-  <img src="docs/badges/tests.svg" alt="95 pruebas en verde" />
+  <img src="docs/badges/tests.svg" alt="166 pruebas en verde" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="Licencia: MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
+<p align="center">
+  <a href="https://warden.modelmarket.dev/">
+    <img src="docs/screenshots/readme/hero-3d.png" alt="WARDEN — cadena 3D de puertas: tools/list por static-scan, threat-feed, origin y pinning hasta un veredicto registrado" width="100%" />
+  </a>
+</p>
+
+
 > 🌐 [English](README.md) · [Русский](README-ru.md) · **Español** · [Français](README-fr.md) · [中文](README-zh.md) · [Glosario](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+**Un servidor MCP. Cortafuegos de las definiciones de herramienta anunciadas. Biblioteca incluida.**
+
+Transporte: **stdio** (`npx -y @aimarket/warden` / `node dist/mcp-server.js`). Hosts compatibles:
+Claude Desktop, Cursor, Glama y cualquier cliente MCP con stdio. Sin claves.
+
+| | |
+|------|----------|
+| Entrada MCP (stdio) | `warden-mcp` → [`src/mcp-server.ts`](src/mcp-server.ts) |
+| Herramientas | `vet_mcp_server`, `static_scan_tools`, `classify_sensitive_tools`, `check_egress_url`, `canonicalize_json`, `list_scan_rules` |
+| Biblioteca | `import { Warden } from "@aimarket/warden"` |
+| Glama / Docker (stdio) | [`Dockerfile`](Dockerfile), [`glama.json`](glama.json) |
+| Official MCP Registry | [`server.json`](server.json) → `io.github.alexar76/warden` |
+| Smithery | [`smithery.yaml`](smithery.yaml) |
+
 Un servidor MCP le dice a tu agente qué hacen sus herramientas. El agente se lo cree — y esa frase
 es la superficie de ataque. La descripción de una herramienta es texto de prompt que un tercero
 entrega directamente al contexto de tu modelo, y un campo de esquema llamado `api_key` es una
@@ -22,15 +46,56 @@ WARDEN examina un servidor **antes de que ninguna de sus herramientas llegue al
 un veredicto que puedes registrar: permitir/bloquear, una puntuación 0..1, los hallazgos que la
 produjeron, una partición por herramienta y la tabla de reglas exacta que estaba en vigor.
 
+**Cero dependencias npm de ejecución.** El único import de la biblioteca es `node:crypto`. El
+servidor MCP stdio añade otros builtins `node:` (`fs`, `path`, `process`) y sigue sin traer paquetes.
+Es el cortafuegos de [ARGUS](https://github.com/alexar76/argus), extraído para que puedas ponerlo
+delante de tu propio host MCP sin adoptar un agente.
+
+## Ejecutar como servidor MCP (stdio)
+
 ```bash
-npm install @aimarket/warden
+npx -y @aimarket/warden
+npm run build && node dist/mcp-server.js
+```
+
+Claude Desktop / Cursor (`mcpServers`):
+
+```json
+{
+  "mcpServers": {
+    "warden": {
+      "command": "npx",
+      "args": ["-y", "@aimarket/warden"]
+    }
+  }
+}
 ```
 
-**Cero dependencias de ejecución.** El único import de todo el paquete es `node:crypto`. Es el
-cortafuegos de [ARGUS](https://github.com/alexar76/argus), extraído para que puedas ponerlo delante
-de tu propio host MCP sin adoptar un agente.
+El proceso **no** arranca, no hace de proxy ni aísla otro servidor MCP: pasas un dump de
+`tools/list` y recibes un veredicto.
+
+| Herramienta | Cuándo usarla |
+|---|---|
+| `vet_mcp_server` | Cadena completa de puertas |
+| `static_scan_tools` | Solo el escaneo estático |
+| `classify_sensitive_tools` | Partición por globs del operador |
+| `check_egress_url` | Allowlist de hosts (lista vacía = denegar todos) |
+| `canonicalize_json` | Bytes RFC 8785 |
+| `list_scan_rules` | Tabla de reglas publicada |
+
+### Publicar en Glama
 
-## Inicio rápido
+Listado: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+
+El mismo patrón que [ARGUS](https://github.com/alexar76/argus) y
+[aimarket-mcp](https://github.com/alexar76/aimarket-mcp): [`glama.json`](glama.json) +
+[`Dockerfile`](Dockerfile) + `node dist/mcp-server.js`. Formulario: [`docs/GLAMA.md`](docs/GLAMA.md).
+
+## Biblioteca (incrustar en tu host)
+
+```bash
+npm install @aimarket/warden
+```
 
 ```ts
 import { Warden, ThreatFeed, silentLogger } from "@aimarket/warden";
@@ -77,7 +142,7 @@ flowchart LR
 
 | Puerta | Qué decide | Red | ¿Fatal? |
 |---|---|---|---|
-| **static-scan** | Inyección, exfiltración, peticiones de credenciales y señales de Unicode oculto/base64 en `description` e `inputSchema` — 25 reglas, v2, de las cuales 18 pueden bloquear y 7 son solo de aviso | ninguna | no |
+| **static-scan** | Inyección, exfiltración, peticiones de credenciales y señales de Unicode oculto/base64 en el `name`, la `description` y el `inputSchema` de la herramienta — 25 reglas, v4, de las cuales 15 pueden bloquear y 10 son solo de aviso, 17 cubren también el nombre y 12 llevan un guard de contexto | ninguna | no |
 | **threat-feed** | Identidad de servidor o herramienta conocida como maliciosa: 11 registros integrados más un feed firmado opcional | solo la descarga del feed | sí, para un `critical` con alcance de servidor |
 | **origin** | Si el operador declaró este servidor o llegó desde un catálogo remoto | ninguna | sí, con `allowUnknownServers: false` |
 | **pinning** | Si las definiciones de herramientas siguen coincidiendo con lo que el usuario aprobó | ninguna | sí, con `pinToolDefs: true` |
@@ -99,7 +164,7 @@ endureciera el umbral.
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "2", digest: "sha256-gWC14PR4…" } }
+  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
 }
 ```
 
@@ -153,6 +218,10 @@ degradar a ninguna protección:
 | [La cadena de puertas](docs/gates.es.md) | Cada nivel de regla, cada código de hallazgo, cómo se construye la puntuación compuesta y cómo añadir una puerta |
 | [El threat feed firmado](docs/threat-feed.es.md) | El contrato en el cable, las tres comprobaciones y cómo publicar un feed que WARDEN acepte |
 | [Guía de integración](docs/integration.es.md) | Cómo conectar WARDEN a tu propio host MCP, elecciones de política y qué registrar |
+| [Estudio de campo: 1 108 servidores MCP públicos](docs/mcp-survey.es.md) | Qué decidió WARDEN sobre definiciones de herramienta reales de terceros — 50 servidores bloqueados, 4 sustentados, y las seis formas en que el resto se equivocó |
+| [Glama / Docker](docs/GLAMA.md) | MCP stdio, health check, Build steps / CMD |
+| [Security](SECURITY.md) | Cómo informar de un bypass del cortafuegos |
+| [Contributing](CONTRIBUTING.md) | Regla de cero dependencias, PRs de la tabla de reglas |
 
 ## Lo que esto no es
 
@@ -167,11 +236,13 @@ degradar a ninguna protección:
   `test/no-phantom-gate.test.ts` falla si alguna puerta vuelve a declarar inalcanzabilidad.
 - **No sustituye a leer las definiciones de herramientas.** 11 registros integrados de amenazas son
   un suelo, no un catálogo.
+- **No es un proxy.** La entrada MCP stdio inspecciona las definiciones que le pasas. No se conecta
+  al servidor bajo examen, no lo descarga ni lo ejecuta.
 
 ## Desarrollo
 
 ```bash
-npm install && npm run build && npm test   # 95 pruebas
+npm install && npm run build && npm test   # 166 pruebas
 ```
 
 `test/packaging.test.ts` es lo que mantiene honesto el titular: falla si aparece una dependencia de

package/README-fr.md

@@ -1,18 +1,42 @@
-# WARDEN — pare-feu de sécurité MCP
+# WARDEN — serveur MCP
+
+<!-- mcp-name: io.github.alexar76/warden -->
 
 <!-- aicom-readme-badges -->
 <p align="center">
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
-  <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="version npm" /></a>
+  <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
+  <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="version npm" /></a>
   <img src="docs/badges/deps.svg" alt="Zéro dépendance d'exécution" />
-  <img src="docs/badges/tests.svg" alt="95 tests au vert" />
+  <img src="docs/badges/tests.svg" alt="166 tests au vert" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="Licence : MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
+<p align="center">
+  <a href="https://warden.modelmarket.dev/">
+    <img src="docs/screenshots/readme/hero-3d.png" alt="WARDEN — chaîne 3D de portes : tools/list via static-scan, threat-feed, origin et pinning jusqu’à un verdict enregistré" width="100%" />
+  </a>
+</p>
+
+
 > 🌐 [English](README.md) · [Русский](README-ru.md) · [Español](README-es.md) · **Français** · [中文](README-zh.md) · [Glossaire](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+**Un serveur MCP. Pare-feu des définitions d'outils annoncées. Bibliothèque incluse.**
+
+Transport : **stdio** (`npx -y @aimarket/warden` / `node dist/mcp-server.js`). Hôtes compatibles :
+Claude Desktop, Cursor, Glama et tout client MCP en stdio. Aucune clé.
+
+| | |
+|------|----------|
+| Entrée MCP (stdio) | `warden-mcp` → [`src/mcp-server.ts`](src/mcp-server.ts) |
+| Outils | `vet_mcp_server`, `static_scan_tools`, `classify_sensitive_tools`, `check_egress_url`, `canonicalize_json`, `list_scan_rules` |
+| Bibliothèque | `import { Warden } from "@aimarket/warden"` |
+| Glama / Docker (stdio) | [`Dockerfile`](Dockerfile), [`glama.json`](glama.json) |
+| Official MCP Registry | [`server.json`](server.json) → `io.github.alexar76/warden` |
+| Smithery | [`smithery.yaml`](smithery.yaml) |
+
 Un serveur MCP indique lui-même à votre agent ce que font ses outils. L'agent le croit — et cette
 phrase est la surface d'attaque. La description d'un outil est du texte de prompt qu'un tiers livre
 directement dans le contexte de votre modèle, et un champ de schéma nommé `api_key` est une demande
@@ -22,15 +46,56 @@ WARDEN examine un serveur **avant qu'aucun de ses outils n'atteigne le modèle**
 que vous pouvez consigner : autoriser/bloquer, un score 0..1, les constats qui l'ont produit, une
 partition par outil et la table de règles exacte qui était en vigueur.
 
+**Zéro dépendance npm d'exécution.** Le seul import de la bibliothèque est `node:crypto`. Le serveur
+MCP stdio ajoute d'autres builtins `node:` (`fs`, `path`, `process`) et ne tire toujours aucun paquet.
+C'est le pare-feu d'[ARGUS](https://github.com/alexar76/argus), extrait pour que vous puissiez le
+placer devant votre propre hôte MCP sans adopter d'agent.
+
+## Lancer comme serveur MCP (stdio)
+
 ```bash
-npm install @aimarket/warden
+npx -y @aimarket/warden
+npm run build && node dist/mcp-server.js
+```
+
+Claude Desktop / Cursor (`mcpServers`) :
+
+```json
+{
+  "mcpServers": {
+    "warden": {
+      "command": "npx",
+      "args": ["-y", "@aimarket/warden"]
+    }
+  }
+}
 ```
 
-**Zéro dépendance d'exécution.** Le seul import de tout le paquet est `node:crypto`. C'est le pare-feu
-d'[ARGUS](https://github.com/alexar76/argus), extrait pour que vous puissiez le placer devant votre
-propre hôte MCP sans adopter d'agent.
+Le processus ne démarre, ne proxifie ni n'isole un autre serveur MCP : vous passez un dump
+`tools/list`, vous récupérez un verdict.
+
+| Outil | Quand l'appeler |
+|---|---|
+| `vet_mcp_server` | Chaîne complète de portes |
+| `static_scan_tools` | Scan statique uniquement |
+| `classify_sensitive_tools` | Partition par globs opérateur |
+| `check_egress_url` | Allowlist d'hôtes (liste vide = tout refuser) |
+| `canonicalize_json` | Octets RFC 8785 |
+| `list_scan_rules` | Table de règles publiée |
+
+### Publier sur Glama
 
-## Démarrage rapide
+Listing : **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+
+Même modèle que [ARGUS](https://github.com/alexar76/argus) et
+[aimarket-mcp](https://github.com/alexar76/aimarket-mcp) : [`glama.json`](glama.json) +
+[`Dockerfile`](Dockerfile) + `node dist/mcp-server.js`. Formulaire : [`docs/GLAMA.md`](docs/GLAMA.md).
+
+## Bibliothèque (embarquer dans votre hôte)
+
+```bash
+npm install @aimarket/warden
+```
 
 ```ts
 import { Warden, ThreatFeed, silentLogger } from "@aimarket/warden";
@@ -77,7 +142,7 @@ flowchart LR
 
 | Porte | Ce qu'elle décide | Réseau | Fatale ? |
 |---|---|---|---|
-| **static-scan** | Injection, exfiltration, demandes d'identifiants et indices d'Unicode masqué/base64 dans `description` et `inputSchema` — 25 règles, v2, dont 18 peuvent bloquer et 7 sont purement indicatives | aucun | non |
+| **static-scan** | Injection, exfiltration, demandes d'identifiants et indices d'Unicode masqué/base64 dans le `name`, la `description` et l'`inputSchema` de l'outil — 25 règles, v4, dont 15 peuvent bloquer et 10 sont purement indicatives, 17 couvrent aussi le nom et 12 portent un guard de contexte | aucun | non |
 | **threat-feed** | Identité de serveur ou outil connu comme malveillant : 11 enregistrements intégrés plus un feed signé optionnel | seulement le téléchargement du feed | oui, pour un `critical` de portée serveur |
 | **origin** | Si l'opérateur a déclaré ce serveur ou s'il provient d'un catalogue distant | aucun | oui, avec `allowUnknownServers: false` |
 | **pinning** | Si les définitions d'outils correspondent encore à ce que l'utilisateur a approuvé | aucun | oui, avec `pinToolDefs: true` |
@@ -99,7 +164,7 @@ bloquante pour quiconque durcissait le seuil.
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "2", digest: "sha256-gWC14PR4…" } }
+  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
 }
 ```
 
@@ -153,6 +218,10 @@ une absence de protection :
 | [La chaîne de portes](docs/gates.fr.md) | Chaque niveau de règle, chaque code de constat, la construction du score composite et comment ajouter une porte |
 | [Le threat feed signé](docs/threat-feed.fr.md) | Le contrat sur le fil, les trois vérifications, et comment publier un feed que WARDEN acceptera |
 | [Guide d'intégration](docs/integration.fr.md) | Brancher WARDEN sur votre propre hôte MCP, choix de politique, et quoi consigner |
+| [Étude de terrain : 1 108 serveurs MCP publics](docs/mcp-survey.fr.md) | Ce que WARDEN a décidé sur de vraies définitions d'outil tierces — 50 serveurs bloqués, 4 étayés, et les six façons dont le reste était faux |
+| [Glama / Docker](docs/GLAMA.md) | MCP stdio, health check, Build steps / CMD |
+| [Security](SECURITY.md) | Signaler un contournement du pare-feu |
+| [Contributing](CONTRIBUTING.md) | Règle zéro dépendance, PRs de table de règles |
 
 ## Ce que ce n'est pas
 
@@ -167,11 +236,13 @@ une absence de protection :
   `test/no-phantom-gate.test.ts` échoue si une porte déclare de nouveau une injoignabilité.
 - **Pas un substitut à la lecture des définitions d'outils.** 11 enregistrements de menaces intégrés
   sont un socle, pas un catalogue.
+- **Pas un proxy.** L'entrée MCP stdio inspecte les définitions que vous lui passez. Elle ne se
+  connecte pas au serveur examiné, ne le télécharge pas et ne l'exécute pas.
 
 ## Développement
 
 ```bash
-npm install && npm run build && npm test   # 95 tests
+npm install && npm run build && npm test   # 166 tests
 ```
 
 `test/packaging.test.ts` est ce qui tient l'accroche honnête : il échoue si une dépendance d'exécution

package/README-ru.md

@@ -1,18 +1,42 @@
-# WARDEN — файрвол безопасности MCP
+# WARDEN — MCP-сервер
+
+<!-- mcp-name: io.github.alexar76/warden -->
 
 <!-- aicom-readme-badges -->
 <p align="center">
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
-  <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
+  <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
+  <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Zero runtime dependencies" />
-  <img src="docs/badges/tests.svg" alt="95 tests passing" />
+  <img src="docs/badges/tests.svg" alt="166 tests passing" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="License: MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
+<p align="center">
+  <a href="https://warden.modelmarket.dev/">
+    <img src="docs/screenshots/readme/hero-3d.png" alt="WARDEN — 3D-цепочка гейтов: tools/list через static-scan, threat-feed, origin и pinning к записанному вердикту" width="100%" />
+  </a>
+</p>
+
+
 > 🌐 [English](README.md) · **Русский** · [Español](README-es.md) · [Français](README-fr.md) · [中文](README-zh.md) · [Глоссарий](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+**Один MCP-сервер. Файрвол для объявленных определений инструментов. Библиотека в комплекте.**
+
+Транспорт: **stdio** (`npx -y @aimarket/warden` / `node dist/mcp-server.js`). Совместимые хосты:
+Claude Desktop, Cursor, Glama и любой MCP-клиент со stdio. Ключи не нужны.
+
+| | |
+|------|----------|
+| Точка входа MCP (stdio) | `warden-mcp` → [`src/mcp-server.ts`](src/mcp-server.ts) |
+| Инструменты | `vet_mcp_server`, `static_scan_tools`, `classify_sensitive_tools`, `check_egress_url`, `canonicalize_json`, `list_scan_rules` |
+| Библиотека | `import { Warden } from "@aimarket/warden"` |
+| Glama / Docker (stdio) | [`Dockerfile`](Dockerfile), [`glama.json`](glama.json) |
+| Official MCP Registry | [`server.json`](server.json) → `io.github.alexar76/warden` |
+| Smithery | [`smithery.yaml`](smithery.yaml) |
+
 MCP-сервер сам сообщает вашему агенту, что делают его инструменты. Агент этому верит — и вот эта
 фраза и есть поверхность атаки. Описание инструмента — это текст промпта, который третья сторона
 доставляет прямо в контекст модели, а поле схемы с именем `api_key` — это запрос ваших секретов,
@@ -22,15 +46,56 @@ WARDEN проверяет сервер **до того, как его инстр
 который можно записать: allow/block, оценку 0..1, найденные проблемы, разбиение по инструментам и
 точную таблицу правил, которая действовала в момент проверки.
 
+**Ноль npm-зависимостей в рантайме.** В библиотеке единственный импорт — `node:crypto`. stdio
+MCP-сервер добавляет другие `node:` builtins (`fs`, `path`, `process`) и по-прежнему не тянет пакеты.
+Это файрвол из [ARGUS](https://github.com/alexar76/argus), вынесенный отдельно, чтобы его можно было
+поставить перед своим MCP-хостом, не переезжая на агента.
+
+## Запуск как MCP-сервер (stdio)
+
 ```bash
-npm install @aimarket/warden
+npx -y @aimarket/warden
+npm run build && node dist/mcp-server.js
+```
+
+Claude Desktop / Cursor (`mcpServers`):
+
+```json
+{
+  "mcpServers": {
+    "warden": {
+      "command": "npx",
+      "args": ["-y", "@aimarket/warden"]
+    }
+  }
+}
 ```
 
-**Ноль рантайм-зависимостей.** Единственный импорт во всём пакете — `node:crypto`. Это файрвол из
-[ARGUS](https://github.com/alexar76/argus), вынесенный отдельно, чтобы его можно было поставить
-перед своим MCP-хостом, не переезжая на агента.
+Процесс **не** запускает, не проксирует и не изолирует чужой MCP-сервер: вы передаёте дамп
+`tools/list`, получаете вердикт.
+
+| Инструмент | Когда вызывать |
+|---|---|
+| `vet_mcp_server` | Полная цепочка гейтов |
+| `static_scan_tools` | Только static-scan |
+| `classify_sensitive_tools` | Glob-разбиение оператора |
+| `check_egress_url` | Allowlist хостов (пустой список — отказ всем) |
+| `canonicalize_json` | Байты RFC 8785 |
+| `list_scan_rules` | Опубликованная таблица правил |
+
+### Публикация на Glama
 
-## Быстрый старт
+Листинг: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+
+Тот же шаблон, что у [ARGUS](https://github.com/alexar76/argus) и
+[aimarket-mcp](https://github.com/alexar76/aimarket-mcp): [`glama.json`](glama.json) +
+[`Dockerfile`](Dockerfile) + `node dist/mcp-server.js`. Форма: [`docs/GLAMA.md`](docs/GLAMA.md).
+
+## Библиотека (встроить в свой хост)
+
+```bash
+npm install @aimarket/warden
+```
 
 ```ts
 import { Warden, ThreatFeed, silentLogger } from "@aimarket/warden";
@@ -77,7 +142,7 @@ flowchart LR
 
 | Гейт | Что решает | Сеть | Fatal? |
 |---|---|---|---|
-| **static-scan** | Инъекции, эксфильтрация, запросы учётных данных, скрытый Unicode и base64-признаки в `description` и `inputSchema` — 25 правил, версия 2, из них 18 могут блокировать и 7 только сообщают | нет | нет |
+| **static-scan** | Инъекции, эксфильтрация, запросы учётных данных, скрытый Unicode и base64-признаки в `name`, `description` и `inputSchema` инструмента — 25 правил, версия 4, из них 15 могут блокировать и 10 только сообщают, 17 покрывают и имя, а у 12 есть контекстный guard | нет | нет |
 | **threat-feed** | Известный плохой сервер или инструмент: 11 встроенных записей плюс опциональный подписанный feed | только загрузка feed | да, для `critical` на уровне сервера |
 | **origin** | Объявил ли оператор этот сервер, или он пришёл из удалённого каталога | нет | да, при `allowUnknownServers: false` |
 | **pinning** | Совпадают ли определения инструментов с тем, что подтвердил пользователь | нет | да, при `pinToolDefs: true` |
@@ -98,7 +163,7 @@ severity снова делало находку блокирующей для в
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "2", digest: "sha256-gWC14PR4…" } }
+  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
 }
 ```
 
@@ -152,6 +217,10 @@ GET <ваш feed url>
 | [Цепочка гейтов](docs/gates.ru.md) | Все уровни правил, все коды находок, как складывается composite score и как добавить свой гейт |
 | [Подписанный threat feed](docs/threat-feed.ru.md) | Контракт на проводе, три проверки и как публиковать feed, который WARDEN примет |
 | [Руководство по интеграции](docs/integration.ru.md) | Как встроить WARDEN в свой MCP-хост, выбор политики и что записывать |
+| [Полевой обзор: 1 108 публичных MCP-серверов](docs/mcp-survey.ru.md) | Что WARDEN решил на настоящих чужих определениях инструментов — 50 серверов заблокировано, 4 подтверждено, и шесть способов, которыми остальные оказались ошибкой |
+| [Glama / Docker](docs/GLAMA.md) | stdio MCP, health check, Build steps / CMD |
+| [Security](SECURITY.md) | Как сообщать об обходе файрвола |
+| [Contributing](CONTRIBUTING.md) | Правило нулевых зависимостей, PR на таблицу правил |
 
 ## Чем это не является
 
@@ -166,11 +235,13 @@ GET <ваш feed url>
   снова заявит о недоступности.
 - **Не замена чтению определений инструментов.** 11 встроенных записей об угрозах — это минимум, а не
   каталог.
+- **Не прокси.** stdio MCP-вход смотрит на определения, которые вы ему передали. Он не
+  подключается к проверяемому серверу, не качает его и не исполняет.
 
 ## Разработка
 
 ```bash
-npm install && npm run build && npm test   # 95 тестов
+npm install && npm run build && npm test   # 166 тестов
 ```
 
 `test/packaging.test.ts` — то, что удерживает заголовок честным: он падает, если появляется