@aimarket/warden 0.3.0 → 0.5.0

package/README-zh.md

@@ -1,32 +1,96 @@
-# WARDEN — MCP 安全防火墙
+# WARDEN — MCP 服务器
+
+<!-- mcp-name: io.github.alexar76/warden -->
 
 <!-- aicom-readme-badges -->
 <p align="center">
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
-  <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm 版本" /></a>
+  <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
+  <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm 版本" /></a>
   <img src="docs/badges/deps.svg" alt="零运行时依赖" />
-  <img src="docs/badges/tests.svg" alt="95 项测试通过" />
+  <img src="docs/badges/tests.svg" alt="166 项测试通过" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="许可证：MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
+<p align="center">
+  <a href="https://warden.modelmarket.dev/">
+    <img src="docs/screenshots/readme/hero-3d.png" alt="WARDEN — 3D 门链：tools/list 经 static-scan、threat-feed、origin、pinning 到可记录的裁定" width="100%" />
+  </a>
+</p>
+
+
 > 🌐 [English](README.md) · [Русский](README-ru.md) · [Español](README-es.md) · [Français](README-fr.md) · **中文** · [术语表](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+**一个 MCP 服务器。针对已广告工具定义的安全防火墙。附带库。**
+
+传输：**stdio**（`npx -y @aimarket/warden` / `node dist/mcp-server.js`）。兼容主机：Claude Desktop、
+Cursor、Glama，以及任何支持 stdio 的 MCP 客户端。不需要密钥。
+
+| | |
+|------|----------|
+| MCP 入口（stdio） | `warden-mcp` → [`src/mcp-server.ts`](src/mcp-server.ts) |
+| 工具 | `vet_mcp_server`、`static_scan_tools`、`classify_sensitive_tools`、`check_egress_url`、`canonicalize_json`、`list_scan_rules` |
+| 库 | `import { Warden } from "@aimarket/warden"` |
+| Glama / Docker（stdio） | [`Dockerfile`](Dockerfile)、[`glama.json`](glama.json) |
+| Official MCP Registry | [`server.json`](server.json) → `io.github.alexar76/warden` |
+| Smithery | [`smithery.yaml`](smithery.yaml) |
+
 MCP 服务器自己告诉你的智能体，它的工具是做什么的。智能体就信了——而这句话正是攻击面。工具描述就是第三方直接
 投递进模型上下文的提示词文本；而一个名叫 `api_key` 的 schema 字段，就是以 API 形式写出来的索要密钥的请求。
 
 WARDEN 在**该服务器的任何工具到达模型之前**审查它，并返回一份可以留档的裁定：允许/阻止、0..1 的评分、导致该
 评分的各项发现、按工具的划分，以及当时生效的确切规则表。
 
+**零 npm 运行时依赖。** 库本身唯一的 import 是 `node:crypto`。stdio MCP 服务器会再用到其他 `node:`
+内建模块（`fs`、`path`、`process`），仍然不拉任何包。它就是 [ARGUS](https://github.com/alexar76/argus)
+里的那个防火墙，被单独抽出来，好让你把它放在自己的 MCP 宿主前面，而不必换用一个智能体。
+
+## 作为 MCP 服务器运行（stdio）
+
 ```bash
-npm install @aimarket/warden
+npx -y @aimarket/warden
+npm run build && node dist/mcp-server.js
 ```
 
-**零运行时依赖。** 整个包里唯一的 import 是 `node:crypto`。它就是 [ARGUS](https://github.com/alexar76/argus)
-里的那个防火墙，被单独抽出来，好让你把它放在自己的 MCP 宿主前面，而不必换用一个智能体。
+Claude Desktop / Cursor（`mcpServers`）：
 
-## 快速开始
+```json
+{
+  "mcpServers": {
+    "warden": {
+      "command": "npx",
+      "args": ["-y", "@aimarket/warden"]
+    }
+  }
+}
+```
+
+进程**不会**启动、代理或沙箱化另一个 MCP 服务器：你传入 `tools/list` 转储，得到一份裁决。
+
+| 工具 | 何时使用 |
+|---|---|
+| `vet_mcp_server` | 完整门控链 |
+| `static_scan_tools` | 仅静态扫描 |
+| `classify_sensitive_tools` | 运营方 glob 分类 |
+| `check_egress_url` | 主机 allowlist（空列表拒绝全部） |
+| `canonicalize_json` | RFC 8785 字节 |
+| `list_scan_rules` | 已发布的规则表 |
+
+### 发布到 Glama
+
+列表页：**[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+
+与 [ARGUS](https://github.com/alexar76/argus)、[aimarket-mcp](https://github.com/alexar76/aimarket-mcp)
+相同：[`glama.json`](glama.json) + [`Dockerfile`](Dockerfile) + `node dist/mcp-server.js`。
+表单：[`docs/GLAMA.md`](docs/GLAMA.md)。
+
+## 库（嵌入你的宿主）
+
+```bash
+npm install @aimarket/warden
+```
 
 ```ts
 import { Warden, ThreatFeed, silentLogger } from "@aimarket/warden";
@@ -73,7 +137,7 @@ flowchart LR
 
 | 门控 | 判定什么 | 网络 | 是否 fatal |
 |---|---|---|---|
-| **static-scan** | `description` 与 `inputSchema` 中的注入、外泄、索要凭据，以及隐藏 Unicode/base64 迹象——25 条规则（v2），其中 18 条可阻止、7 条仅提示 | 无 | 否 |
+| **static-scan** | 工具 `name`、`description` 与 `inputSchema` 中的注入、外泄、索要凭据，以及隐藏 Unicode/base64 迹象——25 条规则（v4），其中 15 条可阻止、10 条仅提示，17 条同时覆盖名称，12 条带有上下文 guard | 无 | 否 |
 | **threat-feed** | 已知恶意的服务器身份或工具：11 条内置记录，外加可选的已签名 feed | 仅 feed 下载 | 是，服务器范围的 `critical` |
 | **origin** | 该服务器是运营者声明的，还是来自远端目录 | 无 | 是，当 `allowUnknownServers: false` |
 | **pinning** | 工具定义是否仍与用户批准过的一致 | 无 | 是，当 `pinToolDefs: true` |
@@ -93,7 +157,7 @@ flowchart LR
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "2", digest: "sha256-gWC14PR4…" } }
+  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
 }
 ```
 
@@ -140,6 +204,10 @@ GET <你的 feed url>
 | [门控链](docs/gates.zh.md) | 每一个规则层级、每一个发现码、综合评分如何构成，以及如何新增一个门控 |
 | [已签名的威胁情报 feed](docs/threat-feed.zh.md) | 线上契约、三项检查，以及如何发布一个 WARDEN 会接受的 feed |
 | [集成指南](docs/integration.zh.md) | 如何把 WARDEN 接入自己的 MCP 宿主、策略取舍，以及应当留档什么 |
+| [实地普查：1 108 个公开 MCP 服务器](docs/mcp-survey.zh.md) | WARDEN 在真实的第三方工具定义上判了什么——拦截 50 个服务器，4 项成立，其余判错的六种方式 |
+| [Glama / Docker](docs/GLAMA.md) | stdio MCP、健康检查、Build steps / CMD |
+| [Security](SECURITY.md) | 如何报告防火墙绕过 |
+| [Contributing](CONTRIBUTING.md) | 零依赖规则、规则表 PR |
 
 ## 它不是什么
 
@@ -151,11 +219,12 @@ GET <你的 feed url>
   没发出的情况下报告预言机不可达。该门控已被移除，并且只要有任何门控再次声称不可达，
   `test/no-phantom-gate.test.ts` 就会失败。
 - **不能替代你亲自读工具定义。** 11 条内置威胁记录是底线，不是目录。
+- **不是代理。** stdio MCP 入口检查的是你传入的定义。它不会连接、下载或执行被扫描的服务器。
 
 ## 开发
 
 ```bash
-npm install && npm run build && npm test   # 95 项测试
+npm install && npm run build && npm test   # 166 项测试
 ```
 
 `test/packaging.test.ts` 正是让标题保持诚实的东西：一旦出现运行时依赖、任何源文件从包外 import、或者入口点不

package/README.md

@@ -1,18 +1,42 @@
-# WARDEN — MCP security firewall
+# WARDEN — MCP server
+
+<!-- mcp-name: io.github.alexar76/warden -->
 
 <!-- aicom-readme-badges -->
 <p align="center">
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
-  <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
+  <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
+  <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Zero runtime dependencies" />
-  <img src="docs/badges/tests.svg" alt="95 tests passing" />
+  <img src="docs/badges/tests.svg" alt="166 tests passing" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="License: MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
+<p align="center">
+  <a href="https://warden.modelmarket.dev/">
+    <img src="docs/screenshots/readme/hero-3d.png" alt="WARDEN — 3D gate chain: tools/list through static-scan, threat-feed, origin, and pinning to a recorded verdict" width="100%" />
+  </a>
+</p>
+
+
 > 🌐 **English** · [Русский](README-ru.md) · [Español](README-es.md) · [Français](README-fr.md) · [中文](README-zh.md) · [Glossary](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+**One MCP server. Security firewall for advertised tool definitions. Library included.**
+
+Transport: **stdio** (`npx -y @aimarket/warden` / `node dist/mcp-server.js`). Compatible hosts:
+Claude Desktop, Cursor, Glama, and any MCP client that speaks stdio. No API keys.
+
+| Item | Location |
+|------|----------|
+| MCP entrypoint (stdio) | `warden-mcp` → [`src/mcp-server.ts`](src/mcp-server.ts) |
+| Tools | `vet_mcp_server`, `static_scan_tools`, `classify_sensitive_tools`, `check_egress_url`, `canonicalize_json`, `list_scan_rules` |
+| Library | `import { Warden } from "@aimarket/warden"` |
+| Glama / Docker (stdio) | [`Dockerfile`](Dockerfile), [`glama.json`](glama.json) |
+| Official MCP Registry | [`server.json`](server.json) → `io.github.alexar76/warden` |
+| Smithery | [`smithery.yaml`](smithery.yaml) |
+
 An MCP server tells your agent what its tools do. The agent believes it — that sentence is the
 attack surface. A tool description is prompt text delivered by a third party straight into your
 model's context, and a schema field named `api_key` is a request for your secrets phrased as an API.
@@ -21,15 +45,60 @@ WARDEN vets a server **before any of its tools reach the model**, and returns a
 record: allow/block, a 0..1 score, the findings that produced it, a per-tool partition, and the
 exact rule table that was in force.
 
+**Zero npm runtime dependencies.** The library's only import is `node:crypto`. The stdio MCP
+server adds other `node:` builtins (`fs`, `path`, `process`) and still pulls in no packages. It is
+the firewall out of [ARGUS](https://github.com/alexar76/argus), extracted so you can put it in front
+of your own MCP host without adopting an agent.
+
+## Run as MCP server (stdio)
+
 ```bash
-npm install @aimarket/warden
+npx -y @aimarket/warden            # bin: warden-mcp
+# from this repo:
+npm run build && node dist/mcp-server.js
+```
+
+Claude Desktop / Cursor (`mcpServers` entry):
+
+```json
+{
+  "mcpServers": {
+    "warden": {
+      "command": "npx",
+      "args": ["-y", "@aimarket/warden"]
+    }
+  }
+}
 ```
 
-**Zero runtime dependencies.** The only import in the whole package is `node:crypto`. It is the
-firewall out of [ARGUS](https://github.com/alexar76/argus), extracted so you can put it in front of
-your own MCP host without adopting an agent.
+The process never starts, proxies, or sandboxes another MCP server — you pass a `tools/list` dump
+in, you get a verdict out.
+
+| Tool | When to use |
+|---|---|
+| `vet_mcp_server` | Full gate chain on a server identity + advertised tools |
+| `static_scan_tools` | Injection / exfil scan only (no origin / pinning / threat feed) |
+| `classify_sensitive_tools` | Operator glob split — not an injection scan |
+| `check_egress_url` | Hostname allowlist (empty list denies every host) |
+| `canonicalize_json` | RFC 8785 bytes for feeds and pins |
+| `list_scan_rules` | Published rule table + digest |
+
+Glama TDQS: MCP `annotations` (readOnly / destructive / idempotent / openWorld), when-to-use /
+when-not naming siblings, every `inputSchema` property described, `outputSchema` on every tool.
+
+### Publish on Glama
 
-## Quick start
+Listing: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+
+Same pattern as **[ARGUS](https://github.com/alexar76/argus)** and
+**[aimarket-mcp](https://github.com/alexar76/aimarket-mcp)**: repo-root [`glama.json`](glama.json) +
+[`Dockerfile`](Dockerfile) + `node dist/mcp-server.js`. Admin form values: [`docs/GLAMA.md`](docs/GLAMA.md).
+
+## Library (embed in your host)
+
+```bash
+npm install @aimarket/warden
+```
 
 ```ts
 import { Warden, ThreatFeed, silentLogger } from "@aimarket/warden";
@@ -76,7 +145,7 @@ flowchart LR
 
 | Gate | What it decides | Network | Fatal? |
 |---|---|---|---|
-| **static-scan** | Injection, exfiltration, credential requests and hidden-Unicode/base64 tells in `description` and `inputSchema` — 25 rules, v2, of which 18 can block and 7 are advisory-only | none | no |
+| **static-scan** | Injection, exfiltration, credential requests and hidden-Unicode/base64 tells in the tool `name`, its `description` and its `inputSchema` — 25 rules, v4, of which 15 can block and 10 are advisory-only, 17 also cover the name, and 12 carry a context guard | none | no |
 | **threat-feed** | Known-bad server identity or tool, from 11 built-in records plus an optional signed feed | only the feed fetch | yes, for a server-scoped `critical` |
 | **origin** | Whether the operator declared this server or it arrived from a remote catalog | none | yes, under `allowUnknownServers: false` |
 | **pinning** | Whether the tool defs still match what the user approved | none | yes, under `pinToolDefs: true` |
@@ -97,7 +166,7 @@ second as a low severity made it blocking again for anyone who tightened the thr
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "2", digest: "sha256-gWC14PR4…" } }
+  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
 }
 ```
 
@@ -149,6 +218,11 @@ no protection:
 | [The gate chain](docs/gates.md) | Every rule tier, every finding code, how the composite score is built, and how to add a gate |
 | [The signed threat feed](docs/threat-feed.md) | The wire contract, the three checks, and how to publish a feed WARDEN will accept |
 | [Integration guide](docs/integration.md) | Wiring WARDEN into your own MCP host, policy choices, and what to record |
+| [Field survey: 1 108 public MCP servers](docs/mcp-survey.md) | What WARDEN decided on real third-party tool definitions — 50 servers blocked, 4 substantiated, and the six ways the rest were wrong |
+| [Glama / Docker](docs/GLAMA.md) | stdio MCP server, health check, admin Build steps / CMD |
+| [MCP registries](docs/REGISTRIES.md) | Official Registry, Smithery, mcp.so / Pulse |
+| [Security](SECURITY.md) | How to report a firewall bypass |
+| [Contributing](CONTRIBUTING.md) | Zero-dep rule, ruleset PRs |
 
 ## What this is not
 
@@ -162,16 +236,19 @@ no protection:
   again.
 - **Not a substitute for reading the tool defs.** 11 built-in threat records is a floor, not a
   catalog.
+- **Not a proxy.** The stdio MCP entry inspects advertised definitions you pass it. It does not
+  connect to, fetch, or execute the server under scan.
 
 ## Development
 
 ```bash
-npm install && npm run build && npm test   # 95 tests
+npm install && npm run build && npm test   # 166 tests
 ```
 
-`test/packaging.test.ts` is what keeps the headline honest: it fails if a runtime dependency appears,
-if any source file imports outside the package, or if the entry point stops exporting the
-enforcement surface.
+`test/packaging.test.ts` is what keeps the headline honest: it fails if an npm runtime dependency
+appears, if any source file imports outside the package (except `node:` builtins), or if the entry
+point stops exporting the enforcement surface. `test/mcp-server.test.ts` is the Glama health
+check: `initialize` + `tools/list` + a `tools/call`.
 
 Used by [ARGUS](https://github.com/alexar76/argus) (the reference host), [MOMUS](https://github.com/alexar76/momus)
 (the publisher side), and the AICOM MCP-security course.

package/dist/glob.d.ts

@@ -0,0 +1,81 @@
+/**
+ * `*`-glob matching, without a regular expression.
+ *
+ * WARDEN matches two kinds of glob against attacker-controlled text: threat-feed
+ * patterns (a signed publisher chooses the pattern, a hostile server chooses the
+ * haystack) and `policy.sensitiveToolPatterns` (the operator chooses the pattern,
+ * the server chooses the tool name). Both used to compile `*` into `.*` and run a
+ * regex, which is a denial of service:
+ *
+ *     pattern  "*a*a*a*a*a*a*a*a*a*a*a*a*a*a*zzz"   (32 characters)
+ *     haystack "aaaa..."                            (220 characters)
+ *     -> 112 SECONDS inside one RegExp.test
+ *
+ * The engine has to try every way of distributing the wildcards over the haystack
+ * before it can conclude "no match" - exponential in the number of `*`. That
+ * mattered more than an ordinary performance bug: the threat feed's whole trust
+ * story is that a compromised publisher can only ever ADD protection, never
+ * remove it, and a record that hangs `vet()` forever removes all of it. The same
+ * shape let a hostile server freeze the agent inspecting it, by advertising a
+ * long enough tool name against an operator's own `*a*b*c*` pattern.
+ *
+ * The two-pointer algorithm below is the standard wildcard matcher: it walks the
+ * haystack once and remembers only the most recent `*` to fall back to, so the
+ * work is bounded by `pattern.length x value.length` with no backtracking tree to
+ * explode. The same 32/220 case returns in microseconds.
+ *
+ * Semantics, matching what the regex did: `*` matches any run of zero or more
+ * UTF-16 code units (including newlines - the old regex needed the `s` flag for
+ * that), every other character is literal, and the match is anchored at both
+ * ends. Case folding is the caller's job: both sides arrive already lowercased.
+ */
+export declare function wildcardMatch(pattern: string, value: string): boolean;
+/**
+ * How many wildcards a pattern may carry.
+ *
+ * The matcher above is not exponential, but `*`-heavy patterns still cost
+ * `pattern x value` per match and buy nothing: a real threat pattern names a
+ * command, a path or a keyword. A record with more than this many wildcards is
+ * refused rather than run - refusing an *addition* to the deny-list is the safe
+ * direction, and it is reported loudly.
+ */
+export declare const MAX_GLOB_WILDCARDS = 12;
+/** Count `*` in a pattern, for the record validator. */
+export declare function countWildcards(pattern: string): number;
+/**
+ * Largest gap an INTERIOR `*` in a threat pattern may span.
+ *
+ * A field survey of 1 108 public MCP servers (see docs/mcp-survey.md) found every
+ * multi-segment built-in firing on unrelated words that merely happened to appear
+ * in the same paragraph: `*drain*wallet*` matched an anti-drainer scanner because
+ * it says "drainer" in one clause and "wallet" in another, and `*seed*phrase*`
+ * matched "for a **seed** topic, returns suggested search **phrases**". A real
+ * threat pattern names something whose parts sit next to each other; 24 characters
+ * is roughly "a few words apart" and comfortably covers "wallet seed or recovery
+ * phrase".
+ */
+export declare const THREAT_MAX_GAP = 24;
+/**
+ * Threat-pattern matching: `wildcardMatch` plus two constraints that only make
+ * sense for a deny-list.
+ *
+ * 1. **Interior gaps are bounded** to {@link THREAT_MAX_GAP}. Leading and trailing
+ *    `*` stay unbounded — `*id_rsa*` must still find `id_rsa` anywhere.
+ * 2. **A segment that starts with a word character must start at a word boundary.**
+ *    `*sweep*funds*` matched an ENS floor-sweeping tool because `funds` sits inside
+ *    "re**funds**". Only the START is anchored: a pattern author writing `*drain*`
+ *    means "drainer" too, so anchoring the end as well would break ordinary
+ *    stemming.
+ *
+ * Kept separate from {@link wildcardMatch} on purpose. That function is also what
+ * `policy.sensitiveToolPatterns` runs on, where the operator wrote the pattern
+ * against their own tool names and plain glob semantics are what they expect.
+ *
+ * Completeness matters here in a way it does not for a display filter: a missed
+ * match is a deny-list entry that silently stopped working. So this explores every
+ * reachable position per segment (deduplicated, so the work stays bounded by
+ * `segments x value.length`) rather than taking the leftmost occurrence greedily,
+ * which would report "no match" for a pattern that does match further along.
+ */
+export declare function threatMatch(pattern: string, value: string): boolean;
+//# sourceMappingURL=glob.d.ts.map

package/dist/glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CA4BrE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CA+BnE"}

package/dist/glob.js

@@ -0,0 +1,180 @@
+/**
+ * `*`-glob matching, without a regular expression.
+ *
+ * WARDEN matches two kinds of glob against attacker-controlled text: threat-feed
+ * patterns (a signed publisher chooses the pattern, a hostile server chooses the
+ * haystack) and `policy.sensitiveToolPatterns` (the operator chooses the pattern,
+ * the server chooses the tool name). Both used to compile `*` into `.*` and run a
+ * regex, which is a denial of service:
+ *
+ *     pattern  "*a*a*a*a*a*a*a*a*a*a*a*a*a*a*zzz"   (32 characters)
+ *     haystack "aaaa..."                            (220 characters)
+ *     -> 112 SECONDS inside one RegExp.test
+ *
+ * The engine has to try every way of distributing the wildcards over the haystack
+ * before it can conclude "no match" - exponential in the number of `*`. That
+ * mattered more than an ordinary performance bug: the threat feed's whole trust
+ * story is that a compromised publisher can only ever ADD protection, never
+ * remove it, and a record that hangs `vet()` forever removes all of it. The same
+ * shape let a hostile server freeze the agent inspecting it, by advertising a
+ * long enough tool name against an operator's own `*a*b*c*` pattern.
+ *
+ * The two-pointer algorithm below is the standard wildcard matcher: it walks the
+ * haystack once and remembers only the most recent `*` to fall back to, so the
+ * work is bounded by `pattern.length x value.length` with no backtracking tree to
+ * explode. The same 32/220 case returns in microseconds.
+ *
+ * Semantics, matching what the regex did: `*` matches any run of zero or more
+ * UTF-16 code units (including newlines - the old regex needed the `s` flag for
+ * that), every other character is literal, and the match is anchored at both
+ * ends. Case folding is the caller's job: both sides arrive already lowercased.
+ */
+export function wildcardMatch(pattern, value) {
+    const STAR = 0x2a;
+    let p = 0;
+    let v = 0;
+    let star = -1;
+    let resume = 0;
+    while (v < value.length) {
+        if (p < pattern.length && pattern.charCodeAt(p) === value.charCodeAt(v)) {
+            p++;
+            v++;
+        }
+        else if (p < pattern.length && pattern.charCodeAt(p) === STAR) {
+            // Remember this wildcard and let it match nothing for now.
+            star = p++;
+            resume = v;
+        }
+        else if (star >= 0) {
+            // Backtrack: hand one more character to the last wildcard. There is only
+            // ever one fallback point, which is what keeps this linear-bounded.
+            p = star + 1;
+            v = ++resume;
+        }
+        else {
+            return false;
+        }
+    }
+    // Trailing wildcards may still match the empty remainder.
+    while (p < pattern.length && pattern.charCodeAt(p) === STAR)
+        p++;
+    return p === pattern.length;
+}
+/**
+ * How many wildcards a pattern may carry.
+ *
+ * The matcher above is not exponential, but `*`-heavy patterns still cost
+ * `pattern x value` per match and buy nothing: a real threat pattern names a
+ * command, a path or a keyword. A record with more than this many wildcards is
+ * refused rather than run - refusing an *addition* to the deny-list is the safe
+ * direction, and it is reported loudly.
+ */
+export const MAX_GLOB_WILDCARDS = 12;
+/** Count `*` in a pattern, for the record validator. */
+export function countWildcards(pattern) {
+    let n = 0;
+    for (let i = 0; i < pattern.length; i++) {
+        if (pattern.charCodeAt(i) === 0x2a)
+            n++;
+    }
+    return n;
+}
+/**
+ * Largest gap an INTERIOR `*` in a threat pattern may span.
+ *
+ * A field survey of 1 108 public MCP servers (see docs/mcp-survey.md) found every
+ * multi-segment built-in firing on unrelated words that merely happened to appear
+ * in the same paragraph: `*drain*wallet*` matched an anti-drainer scanner because
+ * it says "drainer" in one clause and "wallet" in another, and `*seed*phrase*`
+ * matched "for a **seed** topic, returns suggested search **phrases**". A real
+ * threat pattern names something whose parts sit next to each other; 24 characters
+ * is roughly "a few words apart" and comfortably covers "wallet seed or recovery
+ * phrase".
+ */
+export const THREAT_MAX_GAP = 24;
+/**
+ * Threat-pattern matching: `wildcardMatch` plus two constraints that only make
+ * sense for a deny-list.
+ *
+ * 1. **Interior gaps are bounded** to {@link THREAT_MAX_GAP}. Leading and trailing
+ *    `*` stay unbounded — `*id_rsa*` must still find `id_rsa` anywhere.
+ * 2. **A segment that starts with a word character must start at a word boundary.**
+ *    `*sweep*funds*` matched an ENS floor-sweeping tool because `funds` sits inside
+ *    "re**funds**". Only the START is anchored: a pattern author writing `*drain*`
+ *    means "drainer" too, so anchoring the end as well would break ordinary
+ *    stemming.
+ *
+ * Kept separate from {@link wildcardMatch} on purpose. That function is also what
+ * `policy.sensitiveToolPatterns` runs on, where the operator wrote the pattern
+ * against their own tool names and plain glob semantics are what they expect.
+ *
+ * Completeness matters here in a way it does not for a display filter: a missed
+ * match is a deny-list entry that silently stopped working. So this explores every
+ * reachable position per segment (deduplicated, so the work stays bounded by
+ * `segments x value.length`) rather than taking the leftmost occurrence greedily,
+ * which would report "no match" for a pattern that does match further along.
+ */
+export function threatMatch(pattern, value) {
+    if (!pattern.includes("*"))
+        return value.includes(pattern);
+    const parts = pattern.split("*");
+    const openStart = parts[0] === "";
+    const openEnd = parts[parts.length - 1] === "";
+    const segments = parts.filter((s) => s !== "");
+    if (segments.length === 0)
+        return true;
+    // Reachable end positions after matching the segments consumed so far.
+    let ends = [0];
+    for (let i = 0; i < segments.length; i++) {
+        const seg = segments[i];
+        // The first segment is anchored at 0 unless the pattern opened with `*`.
+        const unbounded = i === 0 ? openStart : false;
+        const next = new Set();
+        for (const from of ends) {
+            const limit = unbounded ? value.length : Math.min(value.length, from + THREAT_MAX_GAP + seg.length);
+            let at = from;
+            for (;;) {
+                const found = value.indexOf(seg, at);
+                if (found < 0 || found + seg.length > limit)
+                    break;
+                if (i === 0 && !openStart && found !== 0)
+                    break;
+                if (startsOnBoundary(seg, value, found))
+                    next.add(found + seg.length);
+                at = found + 1;
+            }
+        }
+        if (next.size === 0)
+            return false;
+        ends = [...next];
+    }
+    return openEnd || ends.some((e) => e === value.length);
+}
+/**
+ * Is `seg` at `at` starting on a word boundary?
+ *
+ * Only asked when the segment's own first character is a word character — a
+ * pattern starting with `~`, `.` or `/` has no boundary to respect.
+ */
+function startsOnBoundary(seg, value, at) {
+    if (!isWordChar(seg.charCodeAt(0)))
+        return true;
+    if (at === 0)
+        return true;
+    return !isWordChar(value.charCodeAt(at - 1));
+}
+/**
+ * Letters and digits only — `_` and `-` are BOUNDARIES here, not word characters.
+ *
+ * Tool schemas are written in snake_case and kebab-case, so a field named
+ * `seed_phrase` must still satisfy `*seed*phrase*`; treating `_` as a word
+ * character silently switched that built-in off. "re**funds**" is still rejected,
+ * because there the preceding character is a letter.
+ */
+function isWordChar(c) {
+    return ((c >= 0x30 && c <= 0x39) || // 0-9
+        (c >= 0x41 && c <= 0x5a) || // A-Z
+        (c >= 0x61 && c <= 0x7a) // a-z
+    );
+}
+//# sourceMappingURL=glob.js.map

package/dist/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,KAAa;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC;IAClB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChE,2DAA2D;YAC3D,IAAI,GAAG,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACrB,yEAAyE;YACzE,oEAAoE;YACpE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YACb,CAAC,GAAG,EAAE,MAAM,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,CAAC,EAAE,CAAC;IACjE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,wDAAwD;AACxD,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,KAAa;IACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,uEAAuE;IACvE,IAAI,IAAI,GAAa,CAAC,CAAC,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACzB,yEAAyE;QACzE,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;YACpG,IAAI,EAAE,GAAG,IAAI,CAAC;YACd,SAAS,CAAC;gBACR,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACrC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM;gBACnD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,CAAC;oBAAE,MAAM;gBAChD,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;gBACtE,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,KAAa,EAAE,EAAU;IAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CACL,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM;QAClC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM;QAClC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM;KAChC,CAAC;AACJ,CAAC"}