@aimarket/warden 0.4.0 → 0.6.0

package/README-zh.md

@@ -1,37 +1,99 @@
-# WARDEN — MCP 安全防火墙
+# WARDEN — MCP 服务器
+
+<!-- mcp-name: io.github.alexar76/warden -->
 
 <!-- aicom-readme-badges -->
 <p align="center">
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
-  <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm 版本" /></a>
+  <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
+  <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm 版本" /></a>
   <img src="docs/badges/deps.svg" alt="零运行时依赖" />
-  <img src="docs/badges/tests.svg" alt="141 项测试通过" />
+  <img src="docs/badges/tests.svg" alt="189 项测试通过" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="许可证：MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
 <p align="center">
-  <img src="docs/assets/hero.svg" alt="WARDEN — MCP security firewall: tool defs pass static-scan, threat-feed, origin, and pinning before a recorded verdict" width="920" />
+  <a href="https://warden.modelmarket.dev/">
+    <img src="docs/screenshots/readme/hero-3d.png" alt="WARDEN — 3D 门链：tools/list 经 static-scan、threat-feed、origin、pinning 到可记录的裁定" width="100%" />
+  </a>
 </p>
 
 
 > 🌐 [English](README.md) · [Русский](README-ru.md) · [Español](README-es.md) · [Français](README-fr.md) · **中文** · [术语表](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+**一个 MCP 服务器。针对已广告工具定义的安全防火墙。附带库。**
+
+传输：**stdio**（`npx -y @aimarket/warden` / `node dist/mcp-server.js`）。兼容主机：Claude Desktop、
+Cursor、Glama，以及任何支持 stdio 的 MCP 客户端。不需要密钥。
+
+| | |
+|------|----------|
+| MCP 入口（stdio） | `warden-mcp` → [`src/mcp-server.ts`](src/mcp-server.ts) |
+| 工具 | `vet_mcp_server`、`static_scan_tools`、`classify_sensitive_tools`、`check_egress_url`、`canonicalize_json`、`list_scan_rules` |
+| 库 | `import { Warden } from "@aimarket/warden"` |
+| Glama / Docker（stdio） | [`Dockerfile`](Dockerfile)、[`glama.json`](glama.json) |
+| Official MCP Registry | [`server.json`](server.json) → `io.github.alexar76/warden` |
+| Smithery | [`smithery.yaml`](smithery.yaml) |
+
 MCP 服务器自己告诉你的智能体，它的工具是做什么的。智能体就信了——而这句话正是攻击面。工具描述就是第三方直接
 投递进模型上下文的提示词文本；而一个名叫 `api_key` 的 schema 字段，就是以 API 形式写出来的索要密钥的请求。
 
 WARDEN 在**该服务器的任何工具到达模型之前**审查它，并返回一份可以留档的裁定：允许/阻止、0..1 的评分、导致该
 评分的各项发现、按工具的划分，以及当时生效的确切规则表。
 
+**零 npm 运行时依赖。** 库本身唯一的 import 是 `node:crypto`。stdio MCP 服务器会再用到其他 `node:`
+内建模块（`fs`、`path`、`process`），仍然不拉任何包。它就是 [ARGUS](https://github.com/alexar76/argus)
+里的那个防火墙，被单独抽出来，好让你把它放在自己的 MCP 宿主前面，而不必换用一个智能体。
+
+## 作为 MCP 服务器运行（stdio）
+
 ```bash
-npm install @aimarket/warden
+npx -y @aimarket/warden
+npm run build && node dist/mcp-server.js
 ```
 
-**零运行时依赖。** 整个包里唯一的 import 是 `node:crypto`。它就是 [ARGUS](https://github.com/alexar76/argus)
-里的那个防火墙，被单独抽出来，好让你把它放在自己的 MCP 宿主前面，而不必换用一个智能体。
+Claude Desktop / Cursor（`mcpServers`）：
 
-## 快速开始
+```json
+{
+  "mcpServers": {
+    "warden": {
+      "command": "npx",
+      "args": ["-y", "@aimarket/warden"]
+    }
+  }
+}
+```
+
+进程**不会**启动、代理或沙箱化另一个 MCP 服务器：你传入 `tools/list` 转储，得到一份裁决。
+
+| 工具 | 何时使用 |
+|---|---|
+| `vet_mcp_server` | 完整门控链 |
+| `static_scan_tools` | 仅静态扫描 |
+| `classify_sensitive_tools` | 运营方 glob 分类 |
+| `check_egress_url` | 主机 allowlist（空列表拒绝全部） |
+| `canonicalize_json` | RFC 8785 字节 |
+| `list_scan_rules` | 已发布的规则表 |
+
+### 发布到 Glama
+
+列表页：**[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score：**[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
+
+与 [ARGUS](https://github.com/alexar76/argus)、[aimarket-mcp](https://github.com/alexar76/aimarket-mcp)
+相同：[`glama.json`](glama.json) + [`Dockerfile`](Dockerfile) + `node dist/mcp-server.js`。
+表单：[`docs/GLAMA.md`](docs/GLAMA.md)。
+
+## 库（嵌入你的宿主）
+
+```bash
+npm install @aimarket/warden
+```
 
 ```ts
 import { Warden, ThreatFeed, silentLogger } from "@aimarket/warden";
@@ -69,7 +131,7 @@ await warden.approve(server, tools); // 把用户认可的内容固定（pin）
 
 ```mermaid
 flowchart LR
-  T["服务器给出的<br/>工具定义"] --> S["static scan<br/>25 条规则"]
+  T["服务器给出的<br/>工具定义"] --> S["static scan<br/>26 条规则"]
   S --> F["threat feed<br/>11 条内置 + 已签名"]
   F --> O["origin<br/>已声明 vs 来自目录"]
   O --> P["pinning<br/>漂移 vs 已批准"]
@@ -78,7 +140,7 @@ flowchart LR
 
 | 门控 | 判定什么 | 网络 | 是否 fatal |
 |---|---|---|---|
-| **static-scan** | 工具 `name`、`description` 与 `inputSchema` 中的注入、外泄、索要凭据，以及隐藏 Unicode/base64 迹象——25 条规则（v4），其中 15 条可阻止、10 条仅提示，17 条同时覆盖名称，12 条带有上下文 guard | 无 | 否 |
+| **static-scan** | 工具 `name`、`description` 与 `inputSchema` 中的注入、外泄、索要凭据，以及隐藏 Unicode/base64 迹象——26 条规则（v5），其中 15 条可阻止、11 条仅提示，17 条同时覆盖名称，15 条带有上下文 guard。v5 先对文本做归一化（全角、不可见字符、Unicode 标签、形近字母），因此无论何种语言，混淆都绕不过规则 | 无 | 否 |
 | **threat-feed** | 已知恶意的服务器身份或工具：11 条内置记录，外加可选的已签名 feed | 仅 feed 下载 | 是，服务器范围的 `critical` |
 | **origin** | 该服务器是运营者声明的，还是来自远端目录 | 无 | 是，当 `allowUnknownServers: false` |
 | **pinning** | 工具定义是否仍与用户批准过的一致 | 无 | 是，当 `pinToolDefs: true` |
@@ -98,7 +160,7 @@ flowchart LR
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "5", digest: "sha256-HUKSzM6c…" } }
 }
 ```
 
@@ -146,6 +208,9 @@ GET <你的 feed url>
 | [已签名的威胁情报 feed](docs/threat-feed.zh.md) | 线上契约、三项检查，以及如何发布一个 WARDEN 会接受的 feed |
 | [集成指南](docs/integration.zh.md) | 如何把 WARDEN 接入自己的 MCP 宿主、策略取舍，以及应当留档什么 |
 | [实地普查：1 108 个公开 MCP 服务器](docs/mcp-survey.zh.md) | WARDEN 在真实的第三方工具定义上判了什么——拦截 50 个服务器，4 项成立，其余判错的六种方式 |
+| [Glama / Docker](docs/GLAMA.md) | stdio MCP、健康检查、Build steps / CMD |
+| [Security](SECURITY.md) | 如何报告防火墙绕过 |
+| [Contributing](CONTRIBUTING.md) | 零依赖规则、规则表 PR |
 
 ## 它不是什么
 
@@ -157,11 +222,12 @@ GET <你的 feed url>
   没发出的情况下报告预言机不可达。该门控已被移除，并且只要有任何门控再次声称不可达，
   `test/no-phantom-gate.test.ts` 就会失败。
 - **不能替代你亲自读工具定义。** 11 条内置威胁记录是底线，不是目录。
+- **不是代理。** stdio MCP 入口检查的是你传入的定义。它不会连接、下载或执行被扫描的服务器。
 
 ## 开发
 
 ```bash
-npm install && npm run build && npm test   # 141 项测试
+npm install && npm run build && npm test   # 189 项测试
 ```
 
 `test/packaging.test.ts` 正是让标题保持诚实的东西：一旦出现运行时依赖、任何源文件从包外 import、或者入口点不

package/README.md

@@ -1,23 +1,42 @@
-# WARDEN — MCP security firewall
+# WARDEN — MCP server
+
+<!-- mcp-name: io.github.alexar76/warden -->
 
 <!-- aicom-readme-badges -->
 <p align="center">
   <a href="https://github.com/alexar76/warden/actions/workflows/ci.yml"><img src="docs/badges/ci.svg" alt="CI" /></a>
-  <a href="https://www.npmjs.com/package/@aimarket/warden"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
+  <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
+  <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Zero runtime dependencies" />
-  <img src="docs/badges/tests.svg" alt="141 tests passing" />
+  <img src="docs/badges/tests.svg" alt="189 tests passing" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="License: MIT" /></a>
 </p>
 <!-- /aicom-readme-badges -->
 
 <p align="center">
-  <img src="docs/assets/hero.svg" alt="WARDEN — MCP security firewall: tool defs pass static-scan, threat-feed, origin, and pinning before a recorded verdict" width="920" />
+  <a href="https://warden.modelmarket.dev/">
+    <img src="docs/screenshots/readme/hero-3d.png" alt="WARDEN — 3D gate chain: tools/list through static-scan, threat-feed, origin, and pinning to a recorded verdict" width="100%" />
+  </a>
 </p>
 
 
 > 🌐 **English** · [Русский](README-ru.md) · [Español](README-es.md) · [Français](README-fr.md) · [中文](README-zh.md) · [Glossary](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+**One MCP server. Security firewall for advertised tool definitions. Library included.**
+
+Transport: **stdio** (`npx -y @aimarket/warden` / `node dist/mcp-server.js`). Compatible hosts:
+Claude Desktop, Cursor, Glama, and any MCP client that speaks stdio. No API keys.
+
+| Item | Location |
+|------|----------|
+| MCP entrypoint (stdio) | `warden-mcp` → [`src/mcp-server.ts`](src/mcp-server.ts) |
+| Tools | `vet_mcp_server`, `static_scan_tools`, `classify_sensitive_tools`, `check_egress_url`, `canonicalize_json`, `list_scan_rules` |
+| Library | `import { Warden } from "@aimarket/warden"` |
+| Glama / Docker (stdio) | [`Dockerfile`](Dockerfile), [`glama.json`](glama.json) |
+| Official MCP Registry | [`server.json`](server.json) → `io.github.alexar76/warden` |
+| Smithery | [`smithery.yaml`](smithery.yaml) |
+
 An MCP server tells your agent what its tools do. The agent believes it — that sentence is the
 attack surface. A tool description is prompt text delivered by a third party straight into your
 model's context, and a schema field named `api_key` is a request for your secrets phrased as an API.
@@ -26,15 +45,63 @@ WARDEN vets a server **before any of its tools reach the model**, and returns a
 record: allow/block, a 0..1 score, the findings that produced it, a per-tool partition, and the
 exact rule table that was in force.
 
+**Zero npm runtime dependencies.** The library's only import is `node:crypto`. The stdio MCP
+server adds other `node:` builtins (`fs`, `path`, `process`) and still pulls in no packages. It is
+the firewall out of [ARGUS](https://github.com/alexar76/argus), extracted so you can put it in front
+of your own MCP host without adopting an agent.
+
+## Run as MCP server (stdio)
+
 ```bash
-npm install @aimarket/warden
+npx -y @aimarket/warden            # bin: warden-mcp
+# from this repo:
+npm run build && node dist/mcp-server.js
+```
+
+Claude Desktop / Cursor (`mcpServers` entry):
+
+```json
+{
+  "mcpServers": {
+    "warden": {
+      "command": "npx",
+      "args": ["-y", "@aimarket/warden"]
+    }
+  }
+}
 ```
 
-**Zero runtime dependencies.** The only import in the whole package is `node:crypto`. It is the
-firewall out of [ARGUS](https://github.com/alexar76/argus), extracted so you can put it in front of
-your own MCP host without adopting an agent.
+The process never starts, proxies, or sandboxes another MCP server — you pass a `tools/list` dump
+in, you get a verdict out.
 
-## Quick start
+| Tool | When to use |
+|---|---|
+| `vet_mcp_server` | Full gate chain on a server identity + advertised tools |
+| `static_scan_tools` | Injection / exfil scan only (no origin / pinning / threat feed) |
+| `classify_sensitive_tools` | Operator glob split — not an injection scan |
+| `check_egress_url` | Hostname allowlist (empty list denies every host) |
+| `canonicalize_json` | RFC 8785 bytes for feeds and pins |
+| `list_scan_rules` | Published rule table + digest |
+
+Glama TDQS: MCP `annotations` (readOnly / destructive / idempotent / openWorld), when-to-use /
+when-not naming siblings, every `inputSchema` property described, `outputSchema` on every tool.
+
+### Publish on Glama
+
+Listing: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score: **[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
+
+Same pattern as **[ARGUS](https://github.com/alexar76/argus)** and
+**[aimarket-mcp](https://github.com/alexar76/aimarket-mcp)**: repo-root [`glama.json`](glama.json) +
+[`Dockerfile`](Dockerfile) + `node dist/mcp-server.js`. Admin form values: [`docs/GLAMA.md`](docs/GLAMA.md).
+
+## Library (embed in your host)
+
+```bash
+npm install @aimarket/warden
+```
 
 ```ts
 import { Warden, ThreatFeed, silentLogger } from "@aimarket/warden";
@@ -72,7 +139,7 @@ asked for by passing a URL to `load()`.
 
 ```mermaid
 flowchart LR
-  T["tool defs<br/>from the server"] --> S["static scan<br/>25 rules"]
+  T["tool defs<br/>from the server"] --> S["static scan<br/>26 rules"]
   S --> F["threat feed<br/>11 built-ins + signed"]
   F --> O["origin<br/>declared vs catalog"]
   O --> P["pinning<br/>drift vs approval"]
@@ -81,7 +148,7 @@ flowchart LR
 
 | Gate | What it decides | Network | Fatal? |
 |---|---|---|---|
-| **static-scan** | Injection, exfiltration, credential requests and hidden-Unicode/base64 tells in the tool `name`, its `description` and its `inputSchema` — 25 rules, v4, of which 15 can block and 10 are advisory-only, 17 also cover the name, and 12 carry a context guard | none | no |
+| **static-scan** | Injection, exfiltration, credential requests and hidden-Unicode/base64 tells in the tool `name`, its `description` and its `inputSchema` — 26 rules, v5, of which 15 can block and 11 are advisory-only, 17 also cover the name, and 15 carry a context guard. v5 folds the text first (fullwidth, invisible characters, Unicode tags, look-alike letters) so obfuscation cannot dodge a rule in any language | none | no |
 | **threat-feed** | Known-bad server identity or tool, from 11 built-in records plus an optional signed feed | only the feed fetch | yes, for a server-scoped `critical` |
 | **origin** | Whether the operator declared this server or it arrived from a remote catalog | none | yes, under `allowUnknownServers: false` |
 | **pinning** | Whether the tool defs still match what the user approved | none | yes, under `pinToolDefs: true` |
@@ -102,7 +169,7 @@ second as a low severity made it blocking again for anyone who tightened the thr
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "5", digest: "sha256-HUKSzM6c…" } }
 }
 ```
 
@@ -155,6 +222,10 @@ no protection:
 | [The signed threat feed](docs/threat-feed.md) | The wire contract, the three checks, and how to publish a feed WARDEN will accept |
 | [Integration guide](docs/integration.md) | Wiring WARDEN into your own MCP host, policy choices, and what to record |
 | [Field survey: 1 108 public MCP servers](docs/mcp-survey.md) | What WARDEN decided on real third-party tool definitions — 50 servers blocked, 4 substantiated, and the six ways the rest were wrong |
+| [Glama / Docker](docs/GLAMA.md) | stdio MCP server, health check, admin Build steps / CMD |
+| [MCP registries](docs/REGISTRIES.md) | Official Registry, Smithery, mcp.so / Pulse |
+| [Security](SECURITY.md) | How to report a firewall bypass |
+| [Contributing](CONTRIBUTING.md) | Zero-dep rule, ruleset PRs |
 
 ## What this is not
 
@@ -168,16 +239,19 @@ no protection:
   again.
 - **Not a substitute for reading the tool defs.** 11 built-in threat records is a floor, not a
   catalog.
+- **Not a proxy.** The stdio MCP entry inspects advertised definitions you pass it. It does not
+  connect to, fetch, or execute the server under scan.
 
 ## Development
 
 ```bash
-npm install && npm run build && npm test   # 141 tests
+npm install && npm run build && npm test   # 189 tests
 ```
 
-`test/packaging.test.ts` is what keeps the headline honest: it fails if a runtime dependency appears,
-if any source file imports outside the package, or if the entry point stops exporting the
-enforcement surface.
+`test/packaging.test.ts` is what keeps the headline honest: it fails if an npm runtime dependency
+appears, if any source file imports outside the package (except `node:` builtins), or if the entry
+point stops exporting the enforcement surface. `test/mcp-server.test.ts` is the Glama health
+check: `initialize` + `tools/list` + a `tools/call`.
 
 Used by [ARGUS](https://github.com/alexar76/argus) (the reference host), [MOMUS](https://github.com/alexar76/momus)
 (the publisher side), and the AICOM MCP-security course.

package/dist/fold.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Unicode folding before the rule table reads a tool definition.
+ *
+ * A rule written as `ignore previous instructions` must not be defeated by the
+ * same words spelled so that a regex no longer sees them while a model still
+ * does. Three spellings do that, and none of them depends on the language:
+ *
+ *   1. Compatibility forms. `ｉｇｎｏｒｅ ｐｒｅｖｉｏｕｓ` (fullwidth), ligatures,
+ *      mathematical alphanumerics, circled letters. NFKC maps each to the plain
+ *      letter a reader sees.
+ *   2. Invisible characters inside a word. `ig​nore`, a soft hyphen, a
+ *      variation selector. They are dropped here so they cannot split a rule word.
+ *      The high-signal ones (zero-width, bidi, word-joiner, BOM, the tag block and
+ *      the variation-selector supplement) are ALSO reported, because the
+ *      hidden-character rule runs on the raw text; the purely cosmetic ones (a
+ *      soft hyphen, an Indic/Arabic joiner control) are neutralised here and not
+ *      separately flagged.
+ *   3. Look-alike letters from another script inside a Latin word: `іgnоre` with a
+ *      Cyrillic і and о. A token that mixes Latin with Cyrillic or Greek letters has
+ *      its look-alikes mapped to Latin. A token written wholly in one script is left
+ *      alone, so Russian and Greek text still reads as Russian and Greek.
+ *
+ * Unicode TAG characters (U+E0020–U+E007E) are the exception to "dropped": each is
+ * an invisible copy of an ASCII character, and a whole instruction can be written in
+ * them. They are DECODED to that ASCII here, so the instruction they carry meets the
+ * same rules as visible text.
+ *
+ * The fold is part of the published ruleset (FOLD_ID is in its digest): the same
+ * regexes over folded and unfolded text are different scans.
+ */
+/** Identity of this fold, carried in the ruleset preimage. Bump on any change below. */
+export declare const FOLD_ID = "nfkc+tags-decoded+invisible-stripped+mixed-script-confusables/1";
+/**
+ * Fold `text` for matching. Never shown to anyone: findings quote the folded span,
+ * and the raw text is what the hidden-character rules and the reader see.
+ */
+export declare function foldForScan(text: string): string;
+//# sourceMappingURL=fold.d.ts.map

package/dist/fold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fold.d.ts","sourceRoot":"","sources":["../src/fold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,wFAAwF;AACxF,eAAO,MAAM,OAAO,oEAAoE,CAAC;AAuCzF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBhD"}

package/dist/fold.js

@@ -0,0 +1,99 @@
+/**
+ * Unicode folding before the rule table reads a tool definition.
+ *
+ * A rule written as `ignore previous instructions` must not be defeated by the
+ * same words spelled so that a regex no longer sees them while a model still
+ * does. Three spellings do that, and none of them depends on the language:
+ *
+ *   1. Compatibility forms. `ｉｇｎｏｒｅ ｐｒｅｖｉｏｕｓ` (fullwidth), ligatures,
+ *      mathematical alphanumerics, circled letters. NFKC maps each to the plain
+ *      letter a reader sees.
+ *   2. Invisible characters inside a word. `ig​nore`, a soft hyphen, a
+ *      variation selector. They are dropped here so they cannot split a rule word.
+ *      The high-signal ones (zero-width, bidi, word-joiner, BOM, the tag block and
+ *      the variation-selector supplement) are ALSO reported, because the
+ *      hidden-character rule runs on the raw text; the purely cosmetic ones (a
+ *      soft hyphen, an Indic/Arabic joiner control) are neutralised here and not
+ *      separately flagged.
+ *   3. Look-alike letters from another script inside a Latin word: `іgnоre` with a
+ *      Cyrillic і and о. A token that mixes Latin with Cyrillic or Greek letters has
+ *      its look-alikes mapped to Latin. A token written wholly in one script is left
+ *      alone, so Russian and Greek text still reads as Russian and Greek.
+ *
+ * Unicode TAG characters (U+E0020–U+E007E) are the exception to "dropped": each is
+ * an invisible copy of an ASCII character, and a whole instruction can be written in
+ * them. They are DECODED to that ASCII here, so the instruction they carry meets the
+ * same rules as visible text.
+ *
+ * The fold is part of the published ruleset (FOLD_ID is in its digest): the same
+ * regexes over folded and unfolded text are different scans.
+ */
+/** Identity of this fold, carried in the ruleset preimage. Bump on any change below. */
+export const FOLD_ID = "nfkc+tags-decoded+invisible-stripped+mixed-script-confusables/1";
+/**
+ * Characters with no visible form in running text. Dropped by the fold; the
+ * hidden-character rule reports them from the raw text.
+ */
+const INVISIBLE_RE = new RegExp("[\\u00AD\\u034F\\u061C\\u115F\\u1160\\u17B4\\u17B5\\u180B-\\u180F\\u200B-\\u200F\\u202A-\\u202E" +
+    "\\u2060-\\u2064\\u2066-\\u206F\\u3164\\uFE00-\\uFE0F\\uFEFF\\uFFA0\\u{E0000}-\\u{E001F}" +
+    "\\u{E007F}\\u{E0100}-\\u{E01EF}]", "gu");
+/** U+E0020–U+E007E: invisible ASCII. Decoded, not dropped. */
+const TAG_RE = /[\u{E0020}-\u{E007E}]/gu;
+/**
+ * Cyrillic and Greek letters that render like a Latin letter. Used only inside a
+ * token that already contains Latin letters.
+ */
+const CONFUSABLE = {
+    // Cyrillic lower case
+    "а": "a", "в": "b", "е": "e", "ё": "e", "к": "k", "м": "m", "н": "h", "о": "o", "р": "p",
+    "с": "c", "т": "t", "у": "y", "х": "x", "і": "i", "ї": "i", "ј": "j", "ѕ": "s", "ԁ": "d",
+    "ԛ": "q", "ԝ": "w", "ӏ": "l", "һ": "h", "ɡ": "g",
+    // Cyrillic upper case
+    "А": "A", "В": "B", "Е": "E", "Ё": "E", "К": "K", "М": "M", "Н": "H", "О": "O", "Р": "P",
+    "С": "C", "Т": "T", "У": "Y", "Х": "X", "І": "I", "Ї": "I", "Ј": "J", "Ѕ": "S", "Һ": "H",
+    "Ԛ": "Q", "Ԝ": "W", "Ӏ": "I",
+    // Greek
+    "α": "a", "ε": "e", "ι": "i", "κ": "k", "ν": "v", "ο": "o", "ρ": "p", "τ": "t", "υ": "u",
+    "χ": "x", "Α": "A", "Β": "B", "Ε": "E", "Ζ": "Z", "Η": "H", "Ι": "I", "Κ": "K", "Μ": "M",
+    "Ν": "N", "Ο": "O", "Ρ": "P", "Τ": "T", "Υ": "Y", "Χ": "X",
+};
+const TOKEN_RE = /[\p{L}\p{M}]+/gu;
+const LATIN_RE = /[A-Za-z]/;
+const CONFUSABLE_RE = new RegExp(`[${Object.keys(CONFUSABLE).join("")}]`, "gu");
+/**
+ * Fold `text` for matching. Never shown to anyone: findings quote the folded span,
+ * and the raw text is what the hidden-character rules and the reader see.
+ */
+export function foldForScan(text) {
+    if (!text)
+        return text;
+    let out = text.normalize("NFKC");
+    out = out.replace(TAG_RE, (ch) => String.fromCharCode((ch.codePointAt(0) ?? 0xe0020) - 0xe0000));
+    out = out.replace(INVISIBLE_RE, "");
+    CONFUSABLE_RE.lastIndex = 0;
+    if (!CONFUSABLE_RE.test(out))
+        return out;
+    return out.replace(TOKEN_RE, (tok) => {
+        // Map a token that mixes Latin with look-alikes (`pаypаl`), OR one written
+        // WHOLLY in look-alike letters (`ЅУЅТЕМ`, `рrіvаtе` where every letter is in
+        // the table). A token with non-Latin letters that are NOT all confusables —
+        // ordinary Russian or Greek — is left alone, so those languages read normally.
+        // The scanner also matches the un-mapped raw text, so this only ever ADDS a
+        // reading; it never hides the original.
+        const marks = tok.replace(/\p{M}/gu, "");
+        if (!LATIN_RE.test(tok) && !allConfusable(marks))
+            return tok;
+        return tok.replace(CONFUSABLE_RE, (ch) => CONFUSABLE[ch] ?? ch);
+    });
+}
+/** Every letter of the token is one of the Latin look-alikes in the table. */
+function allConfusable(letters) {
+    if (!letters)
+        return false;
+    for (const ch of letters) {
+        if (!(ch in CONFUSABLE) && !/[A-Za-z]/.test(ch))
+            return false;
+    }
+    return /[^A-Za-z]/.test(letters); // at least one non-Latin look-alike, else nothing to map
+}
+//# sourceMappingURL=fold.js.map

package/dist/fold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fold.js","sourceRoot":"","sources":["../src/fold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAEzF;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,iGAAiG;IAC/F,yFAAyF;IACzF,kCAAkC,EACpC,IAAI,CACL,CAAC;AAEF,8DAA8D;AAC9D,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,GAA2B;IACzC,sBAAsB;IACtB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAChD,sBAAsB;IACtB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC5B,QAAQ;IACR,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CAC3D,CAAC;AAEF,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAC5B,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAEhF;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IACjG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACzC,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QACnC,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC7D,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,yDAAyD;AAC7F,CAAC"}

package/dist/mcp-rpc.d.ts

@@ -0,0 +1,40 @@
+/**
+ * JSON-RPC MCP methods for the stdio server (no transport).
+ */
+export declare const PROTOCOL = "2025-03-26";
+export declare function packageVersion(): string;
+export interface JsonRpcReq {
+    jsonrpc?: string;
+    id?: string | number | null;
+    method?: string;
+    params?: unknown;
+}
+export interface JsonRpcRes {
+    jsonrpc: "2.0";
+    id: string | number | null;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+    };
+}
+export declare function listedTools(): {
+    name: string;
+    title: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    outputSchema: Record<string, unknown>;
+    annotations: {
+        title: string;
+        readOnlyHint: boolean;
+        destructiveHint: boolean;
+        idempotentHint: boolean;
+        openWorldHint: boolean;
+    };
+}[];
+export declare function consumeLsp(buf: Buffer): {
+    rest: Buffer;
+    bodies: string[];
+};
+export declare function handleRpc(msg: JsonRpcReq): Promise<JsonRpcRes | null>;
+//# sourceMappingURL=mcp-rpc.d.ts.map

package/dist/mcp-rpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-rpc.d.ts","sourceRoot":"","sources":["../src/mcp-rpc.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,eAAO,MAAM,QAAQ,eAAe,CAAC;AAGrC,wBAAgB,cAAc,IAAI,MAAM,CAQvC;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,wBAAgB,WAAW;;;;;;;;;;;;;IAS1B;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAiB1E;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAgE3E"}

package/dist/mcp-rpc.js

@@ -0,0 +1,117 @@
+/**
+ * JSON-RPC MCP methods for the stdio server (no transport).
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { callMcpTool, MCP_INSTRUCTIONS, MCP_TOOLS, McpToolError, payloadTooLarge } from "./mcp-tools.js";
+export const PROTOCOL = "2025-03-26";
+const FALLBACK_VERSION = "0.5.1";
+export function packageVersion() {
+    try {
+        const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        return typeof pkg.version === "string" ? pkg.version : FALLBACK_VERSION;
+    }
+    catch {
+        return FALLBACK_VERSION;
+    }
+}
+export function listedTools() {
+    return MCP_TOOLS.map((t) => ({
+        name: t.name,
+        title: t.title,
+        description: t.description,
+        inputSchema: t.inputSchema,
+        outputSchema: t.outputSchema,
+        annotations: t.annotations,
+    }));
+}
+export function consumeLsp(buf) {
+    const bodies = [];
+    while (true) {
+        const headerEnd = buf.indexOf("\r\n\r\n");
+        if (headerEnd < 0)
+            return { rest: buf, bodies };
+        const header = buf.subarray(0, headerEnd).toString("ascii");
+        const match = /Content-Length:\s*(\d+)/i.exec(header);
+        if (!match) {
+            buf = buf.subarray(headerEnd + 4);
+            continue;
+        }
+        const len = Number(match[1]);
+        const start = headerEnd + 4;
+        if (buf.length < start + len)
+            return { rest: buf, bodies };
+        bodies.push(buf.subarray(start, start + len).toString("utf8"));
+        buf = buf.subarray(start + len);
+    }
+}
+export async function handleRpc(msg) {
+    const method = msg.method ?? "";
+    const id = msg.id;
+    if (method.startsWith("notifications/"))
+        return null;
+    const ok = (result) => ({ jsonrpc: "2.0", id: id ?? null, result });
+    const fail = (code, message) => ({
+        jsonrpc: "2.0",
+        id: id ?? null,
+        error: { code, message },
+    });
+    switch (method) {
+        case "initialize":
+            return ok({
+                protocolVersion: PROTOCOL,
+                capabilities: { tools: { listChanged: false } },
+                serverInfo: {
+                    name: "warden",
+                    title: "WARDEN MCP security firewall",
+                    version: packageVersion(),
+                },
+                instructions: MCP_INSTRUCTIONS,
+            });
+        case "ping":
+            return ok({});
+        case "tools/list":
+            return ok({ tools: listedTools() });
+        case "tools/call": {
+            if (id === undefined)
+                return null;
+            const params = (msg.params ?? {});
+            const name = typeof params.name === "string" ? params.name : "";
+            if (!name)
+                return fail(-32602, "tools/call requires params.name");
+            const args = params.arguments && typeof params.arguments === "object" && !Array.isArray(params.arguments)
+                ? params.arguments
+                : {};
+            if (payloadTooLarge(args)) {
+                return ok({ content: [{ type: "text", text: "payload exceeds 256 KiB" }], isError: true });
+            }
+            try {
+                const { structured } = await callMcpTool(name, args);
+                return ok({
+                    content: [{ type: "text", text: JSON.stringify(structured, null, 2) }],
+                    structuredContent: structured,
+                });
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                if (!(err instanceof McpToolError) && !(err instanceof Error)) {
+                    return ok({ content: [{ type: "text", text: String(err) }], isError: true });
+                }
+                return ok({ content: [{ type: "text", text: message }], isError: true });
+            }
+        }
+        case "resources/list":
+            return ok({ resources: [] });
+        case "resources/templates/list":
+            return ok({ resourceTemplates: [] });
+        case "prompts/list":
+            return ok({ prompts: [] });
+        default:
+            if (id === undefined)
+                return null;
+            return fail(-32601, `method not found: ${method}`);
+    }
+}
+//# sourceMappingURL=mcp-rpc.js.map