@aimarket/warden 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -1,7 +1,52 @@
 # Changelog
 
+
+## 0.7.0 — 2026-09-30
+
+- Add `vetLaunch` for identity/origin/threat checks before starting a server.
+- Persist signed-feed snapshots per publisher key; reject rollback/equivocation across restarts; retain last-good rules with freshness status. The timeout now covers the response body.
+- Validate JSON-RPC envelopes, preserve split UTF-8, and bound NDJSON/LSP framing.
+- Add atomic `FilePinStore` and MCP status/approve/revoke operations. Mutations require operator opt-in and a reviewed revision; stale concurrent approvals are rejected.
+- Hash all advertised tool fields (format v2); require review when legacy pins lack extended-field coverage. Ruleset v6 scans title/output schema/annotations/extensions and does not confuse JSON delimiters with benign quotation.
+- ARGUS integration checks before launch and every call, handles list-change notifications, and quarantines drift or listing failure. See the five-language [migration guide](docs/security-hardening.md).
+
 All notable changes to `@aimarket/warden`.
 
+## 0.6.0 — 2026-09-23
+
+Ruleset **v5**: language-independent coverage. A rule table written in one language cannot read
+meaning in every other, so v5 strengthens what does not depend on the language at all, and says
+plainly where the table stops.
+
+- **Text is folded before any rule reads it** (`src/fold.ts`, published as `fold` beside the rules
+  and part of the digest): NFKC for fullwidth letters, ligatures and other compatibility forms;
+  invisible characters inside a word dropped; the Unicode TAG block (invisible ASCII that can spell a
+  whole sentence) decoded; look-alike Cyrillic/Greek letters mapped to Latin inside a word that
+  already mixes scripts, while text written wholly in one script is left alone. An English rule can
+  no longer be dodged by `ｉｇｎｏｒｅ`, a zero-width space inside the word, tag characters or a Cyrillic
+  `о`. The two hidden-payload rules read the raw text (`raw: true` in the published table).
+- **`TOOL_DEF_HIDDEN_UNICODE`** now also catches the Unicode-tag block and the bidi isolates
+  (U+2066–2069). `displaySafe` escapes tag characters, so a finding never prints them invisibly.
+- **`TOOL_DEF_SECRET_EXFIL`** (new, advisory): a secret store (`.env`, `~/.ssh/…`,
+  `~/.aws/credentials`, `.npmrc`, …) and a URL, e-mail address or host within 100 characters of each
+  other — the shape of "read this, send it there" whatever language the connective words are in.
+  Advisory because on 10 645 live servers its only hit was honest (a deploy tool's ssh command to its
+  own host); refusing a server on a rule whose only real-world hit is honest is the v1 mistake again.
+- **Three measured false positives removed**: "send the user to https://…" is a redirect of a person
+  (guard `navigation`); "keep calling this until done without asking the user" is autonomy, not
+  concealment (guard `autonomy`); a zero-width joiner inside an emoji sequence is not concealment.
+
+Measured on the 10 645 distinct tool sets HISTOR holds (172 771 tools): v4 blocks 63, v5 blocks 56,
+and v5 blocks none that v4 did not. The 1 108-server survey figures (v3 → v4) are unchanged and
+still describe v4's calibration; this corpus is HISTOR's, not the survey's.
+
+## 0.5.1 — 2026-09-05
+
+stdio wire fix for Glama: replies are newline-delimited JSON (MCP stdio / mcp-proxy).
+Content-Length framing on stdout made Glama's health check time out (`ignoring non-JSON
+output [ 'Content-Length: …' ]`). Input still accepts Content-Length and mirrors it on
+the reply for legacy probes.
+
 ## 0.5.0 — 2026-09-03
 
 stdio MCP server for Glama / Claude Desktop / Cursor (`warden-mcp` / `node dist/mcp-server.js`).

package/README-es.md

@@ -8,7 +8,7 @@
   <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
   <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Cero dependencias de ejecución" />
-  <img src="docs/badges/tests.svg" alt="166 pruebas en verde" />
+  <img src="docs/badges/tests.svg" alt="200 pruebas en verde" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="Licencia: MIT" /></a>
 </p>
@@ -23,6 +23,8 @@
 
 > 🌐 [English](README.md) · [Русский](README-ru.md) · **Español** · [Français](README-fr.md) · [中文](README-zh.md) · [Glosario](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+> [Seguridad y migración de 0.7.0](docs/security-hardening.es.md): `vetLaunch`, durable pins, anti-rollback, ruleset v6, runtime revalidation.
+
 **Un servidor MCP. Cortafuegos de las definiciones de herramienta anunciadas. Biblioteca incluida.**
 
 Transporte: **stdio** (`npx -y @aimarket/warden` / `node dist/mcp-server.js`). Hosts compatibles:
@@ -82,10 +84,16 @@ El proceso **no** arranca, no hace de proxy ni aísla otro servidor MCP: pasas u
 | `check_egress_url` | Allowlist de hosts (lista vacía = denegar todos) |
 | `canonicalize_json` | Bytes RFC 8785 |
 | `list_scan_rules` | Tabla de reglas publicada |
+| `status_mcp_server` | Revisar aprobación guardada y hashes actuales |
+| `approve_mcp_server` | Aprobar el snapshot revisado (habilitación del operador) |
+| `revoke_mcp_server` | Revocar la aprobación revisada (habilitación del operador) |
 
 ### Publicar en Glama
 
-Listado: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+Listado: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score: **[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
 
 El mismo patrón que [ARGUS](https://github.com/alexar76/argus) y
 [aimarket-mcp](https://github.com/alexar76/aimarket-mcp): [`glama.json`](glama.json) +
@@ -133,7 +141,7 @@ descarga del threat feed que tú pediste al pasar una URL a `load()`.
 
 ```mermaid
 flowchart LR
-  T["definiciones<br/>de herramientas"] --> S["static scan<br/>25 reglas"]
+  T["definiciones<br/>de herramientas"] --> S["static scan<br/>26 reglas"]
   S --> F["threat feed<br/>11 integradas + firmado"]
   F --> O["origin<br/>declarado vs catálogo"]
   O --> P["pinning<br/>deriva vs aprobación"]
@@ -142,7 +150,7 @@ flowchart LR
 
 | Puerta | Qué decide | Red | ¿Fatal? |
 |---|---|---|---|
-| **static-scan** | Inyección, exfiltración, peticiones de credenciales y señales de Unicode oculto/base64 en el `name`, la `description` y el `inputSchema` de la herramienta — 25 reglas, v4, de las cuales 15 pueden bloquear y 10 son solo de aviso, 17 cubren también el nombre y 12 llevan un guard de contexto | ninguna | no |
+| **static-scan** | Inyección, exfiltración, peticiones de credenciales y señales de Unicode oculto/base64 en el `name`, la `description` y el `inputSchema` de la herramienta — 26 reglas, v6, de las cuales 15 pueden bloquear y 11 son solo de aviso, 17 cubren también el nombre y 15 llevan un guard de contexto. v5 normaliza antes el texto (ancho completo, caracteres invisibles, etiquetas Unicode, letras sosias), así que la ofuscación no elude ninguna regla en ningún idioma | ninguna | no |
 | **threat-feed** | Identidad de servidor o herramienta conocida como maliciosa: 11 registros integrados más un feed firmado opcional | solo la descarga del feed | sí, para un `critical` con alcance de servidor |
 | **origin** | Si el operador declaró este servidor o llegó desde un catálogo remoto | ninguna | sí, con `allowUnknownServers: false` |
 | **pinning** | Si las definiciones de herramientas siguen coincidiendo con lo que el usuario aprobó | ninguna | sí, con `pinToolDefs: true` |
@@ -164,7 +172,7 @@ endureciera el umbral.
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "6", digest: "sha256-dop0ekCh…" } }
 }
 ```
 
@@ -242,7 +250,7 @@ degradar a ninguna protección:
 ## Desarrollo
 
 ```bash
-npm install && npm run build && npm test   # 166 pruebas
+npm install && npm run build && npm test   # 200 pruebas
 ```
 
 `test/packaging.test.ts` es lo que mantiene honesto el titular: falla si aparece una dependencia de

package/README-fr.md

@@ -8,7 +8,7 @@
   <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
   <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="version npm" /></a>
   <img src="docs/badges/deps.svg" alt="Zéro dépendance d'exécution" />
-  <img src="docs/badges/tests.svg" alt="166 tests au vert" />
+  <img src="docs/badges/tests.svg" alt="200 tests au vert" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="Licence : MIT" /></a>
 </p>
@@ -23,6 +23,8 @@
 
 > 🌐 [English](README.md) · [Русский](README-ru.md) · [Español](README-es.md) · **Français** · [中文](README-zh.md) · [Glossaire](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+> [Sécurité et migration 0.7.0](docs/security-hardening.fr.md): `vetLaunch`, durable pins, anti-rollback, ruleset v6, runtime revalidation.
+
 **Un serveur MCP. Pare-feu des définitions d'outils annoncées. Bibliothèque incluse.**
 
 Transport : **stdio** (`npx -y @aimarket/warden` / `node dist/mcp-server.js`). Hôtes compatibles :
@@ -82,10 +84,16 @@ Le processus ne démarre, ne proxifie ni n'isole un autre serveur MCP : vous pas
 | `check_egress_url` | Allowlist d'hôtes (liste vide = tout refuser) |
 | `canonicalize_json` | Octets RFC 8785 |
 | `list_scan_rules` | Table de règles publiée |
+| `status_mcp_server` | Comparer approbation et empreintes actuelles |
+| `approve_mcp_server` | Approuver le snapshot examiné (activation opérateur) |
+| `revoke_mcp_server` | Révoquer une approbation examinée (activation opérateur) |
 
 ### Publier sur Glama
 
-Listing : **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+Listing : **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score : **[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
 
 Même modèle que [ARGUS](https://github.com/alexar76/argus) et
 [aimarket-mcp](https://github.com/alexar76/aimarket-mcp) : [`glama.json`](glama.json) +
@@ -133,7 +141,7 @@ téléchargement du threat feed que vous avez demandé en passant une URL à `lo
 
 ```mermaid
 flowchart LR
-  T["définitions<br/>des outils"] --> S["static scan<br/>25 règles"]
+  T["définitions<br/>des outils"] --> S["static scan<br/>26 règles"]
   S --> F["threat feed<br/>11 intégrées + signé"]
   F --> O["origin<br/>déclaré vs catalogue"]
   O --> P["pinning<br/>dérive vs approbation"]
@@ -142,7 +150,7 @@ flowchart LR
 
 | Porte | Ce qu'elle décide | Réseau | Fatale ? |
 |---|---|---|---|
-| **static-scan** | Injection, exfiltration, demandes d'identifiants et indices d'Unicode masqué/base64 dans le `name`, la `description` et l'`inputSchema` de l'outil — 25 règles, v4, dont 15 peuvent bloquer et 10 sont purement indicatives, 17 couvrent aussi le nom et 12 portent un guard de contexte | aucun | non |
+| **static-scan** | Injection, exfiltration, demandes d'identifiants et indices d'Unicode masqué/base64 dans le `name`, la `description` et l'`inputSchema` de l'outil — 26 règles, v6, dont 15 peuvent bloquer et 11 sont purement indicatives, 17 couvrent aussi le nom et 15 portent un guard de contexte. v5 normalise d'abord le texte (pleine chasse, caractères invisibles, balises Unicode, lettres sosies) : l'obfuscation ne contourne aucune règle, quelle que soit la langue | aucun | non |
 | **threat-feed** | Identité de serveur ou outil connu comme malveillant : 11 enregistrements intégrés plus un feed signé optionnel | seulement le téléchargement du feed | oui, pour un `critical` de portée serveur |
 | **origin** | Si l'opérateur a déclaré ce serveur ou s'il provient d'un catalogue distant | aucun | oui, avec `allowUnknownServers: false` |
 | **pinning** | Si les définitions d'outils correspondent encore à ce que l'utilisateur a approuvé | aucun | oui, avec `pinToolDefs: true` |
@@ -164,7 +172,7 @@ bloquante pour quiconque durcissait le seuil.
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "6", digest: "sha256-dop0ekCh…" } }
 }
 ```
 
@@ -242,7 +250,7 @@ une absence de protection :
 ## Développement
 
 ```bash
-npm install && npm run build && npm test   # 166 tests
+npm install && npm run build && npm test   # 200 tests
 ```
 
 `test/packaging.test.ts` est ce qui tient l'accroche honnête : il échoue si une dépendance d'exécution

package/README-ru.md

@@ -8,7 +8,7 @@
   <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
   <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Zero runtime dependencies" />
-  <img src="docs/badges/tests.svg" alt="166 tests passing" />
+  <img src="docs/badges/tests.svg" alt="200 tests passing" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="License: MIT" /></a>
 </p>
@@ -23,6 +23,8 @@
 
 > 🌐 [English](README.md) · **Русский** · [Español](README-es.md) · [Français](README-fr.md) · [中文](README-zh.md) · [Глоссарий](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+> [Изменения безопасности 0.7.0 и миграция](docs/security-hardening.ru.md): `vetLaunch`, durable pins, anti-rollback, ruleset v6, runtime revalidation.
+
 **Один MCP-сервер. Файрвол для объявленных определений инструментов. Библиотека в комплекте.**
 
 Транспорт: **stdio** (`npx -y @aimarket/warden` / `node dist/mcp-server.js`). Совместимые хосты:
@@ -82,10 +84,16 @@ Claude Desktop / Cursor (`mcpServers`):
 | `check_egress_url` | Allowlist хостов (пустой список — отказ всем) |
 | `canonicalize_json` | Байты RFC 8785 |
 | `list_scan_rules` | Опубликованная таблица правил |
+| `status_mcp_server` | Сравнить сохранённое одобрение и текущие хеши |
+| `approve_mcp_server` | Одобрить рассмотренный снимок (разрешение оператора) |
+| `revoke_mcp_server` | Отозвать рассмотренное одобрение (разрешение оператора) |
 
 ### Публикация на Glama
 
-Листинг: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+Листинг: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score: **[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
 
 Тот же шаблон, что у [ARGUS](https://github.com/alexar76/argus) и
 [aimarket-mcp](https://github.com/alexar76/aimarket-mcp): [`glama.json`](glama.json) +
@@ -133,7 +141,7 @@ await warden.approve(server, tools); // зафиксировать (pin) то,
 
 ```mermaid
 flowchart LR
-  T["определения<br/>инструментов"] --> S["static scan<br/>25 правил"]
+  T["определения<br/>инструментов"] --> S["static scan<br/>26 правил"]
   S --> F["threat feed<br/>11 встроенных + подписанный"]
   F --> O["origin<br/>объявлен или из каталога"]
   O --> P["pinning<br/>дрейф против подтверждения"]
@@ -142,7 +150,7 @@ flowchart LR
 
 | Гейт | Что решает | Сеть | Fatal? |
 |---|---|---|---|
-| **static-scan** | Инъекции, эксфильтрация, запросы учётных данных, скрытый Unicode и base64-признаки в `name`, `description` и `inputSchema` инструмента — 25 правил, версия 4, из них 15 могут блокировать и 10 только сообщают, 17 покрывают и имя, а у 12 есть контекстный guard | нет | нет |
+| **static-scan** | Инъекции, эксфильтрация, запросы учётных данных, скрытый Unicode и base64-признаки в `name`, `description` и `inputSchema` инструмента — 26 правил, версия 6, из них 15 могут блокировать и 11 только сообщают, 17 покрывают и имя, а у 15 есть контекстный guard. v5 сначала приводит текст к обычному виду (широкие буквы, невидимые символы, Unicode-теги, буквы-двойники), поэтому обфускация не обходит правило ни на каком языке | нет | нет |
 | **threat-feed** | Известный плохой сервер или инструмент: 11 встроенных записей плюс опциональный подписанный feed | только загрузка feed | да, для `critical` на уровне сервера |
 | **origin** | Объявил ли оператор этот сервер, или он пришёл из удалённого каталога | нет | да, при `allowUnknownServers: false` |
 | **pinning** | Совпадают ли определения инструментов с тем, что подтвердил пользователь | нет | да, при `pinToolDefs: true` |
@@ -163,7 +171,7 @@ severity снова делало находку блокирующей для в
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "6", digest: "sha256-dop0ekCh…" } }
 }
 ```
 
@@ -241,7 +249,7 @@ GET <ваш feed url>
 ## Разработка
 
 ```bash
-npm install && npm run build && npm test   # 166 тестов
+npm install && npm run build && npm test   # 200 тестов
 ```
 
 `test/packaging.test.ts` — то, что удерживает заголовок честным: он падает, если появляется

package/README-zh.md

@@ -8,7 +8,7 @@
   <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
   <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm 版本" /></a>
   <img src="docs/badges/deps.svg" alt="零运行时依赖" />
-  <img src="docs/badges/tests.svg" alt="166 项测试通过" />
+  <img src="docs/badges/tests.svg" alt="200 项测试通过" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="许可证：MIT" /></a>
 </p>
@@ -23,6 +23,8 @@
 
 > 🌐 [English](README.md) · [Русский](README-ru.md) · [Español](README-es.md) · [Français](README-fr.md) · **中文** · [术语表](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+> [0.7.0 安全更新与迁移](docs/security-hardening.zh.md): `vetLaunch`, durable pins, anti-rollback, ruleset v6, runtime revalidation.
+
 **一个 MCP 服务器。针对已广告工具定义的安全防火墙。附带库。**
 
 传输：**stdio**（`npx -y @aimarket/warden` / `node dist/mcp-server.js`）。兼容主机：Claude Desktop、
@@ -77,10 +79,16 @@ Claude Desktop / Cursor（`mcpServers`）：
 | `check_egress_url` | 主机 allowlist（空列表拒绝全部） |
 | `canonicalize_json` | RFC 8785 字节 |
 | `list_scan_rules` | 已发布的规则表 |
+| `status_mcp_server` | 比较已保存审批与当前哈希 |
+| `approve_mcp_server` | 批准已审阅快照（需操作员开启） |
+| `revoke_mcp_server` | 撤销已审阅审批（需操作员开启） |
 
 ### 发布到 Glama
 
-列表页：**[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+列表页：**[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score：**[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
 
 与 [ARGUS](https://github.com/alexar76/argus)、[aimarket-mcp](https://github.com/alexar76/aimarket-mcp)
 相同：[`glama.json`](glama.json) + [`Dockerfile`](Dockerfile) + `node dist/mcp-server.js`。
@@ -128,7 +136,7 @@ await warden.approve(server, tools); // 把用户认可的内容固定（pin）
 
 ```mermaid
 flowchart LR
-  T["服务器给出的<br/>工具定义"] --> S["static scan<br/>25 条规则"]
+  T["服务器给出的<br/>工具定义"] --> S["static scan<br/>26 条规则"]
   S --> F["threat feed<br/>11 条内置 + 已签名"]
   F --> O["origin<br/>已声明 vs 来自目录"]
   O --> P["pinning<br/>漂移 vs 已批准"]
@@ -137,7 +145,7 @@ flowchart LR
 
 | 门控 | 判定什么 | 网络 | 是否 fatal |
 |---|---|---|---|
-| **static-scan** | 工具 `name`、`description` 与 `inputSchema` 中的注入、外泄、索要凭据，以及隐藏 Unicode/base64 迹象——25 条规则（v4），其中 15 条可阻止、10 条仅提示，17 条同时覆盖名称，12 条带有上下文 guard | 无 | 否 |
+| **static-scan** | 工具 `name`、`description` 与 `inputSchema` 中的注入、外泄、索要凭据，以及隐藏 Unicode/base64 迹象——26 条规则（v6），其中 15 条可阻止、11 条仅提示，17 条同时覆盖名称，15 条带有上下文 guard。v5 先对文本做归一化（全角、不可见字符、Unicode 标签、形近字母），因此无论何种语言，混淆都绕不过规则 | 无 | 否 |
 | **threat-feed** | 已知恶意的服务器身份或工具：11 条内置记录，外加可选的已签名 feed | 仅 feed 下载 | 是，服务器范围的 `critical` |
 | **origin** | 该服务器是运营者声明的，还是来自远端目录 | 无 | 是，当 `allowUnknownServers: false` |
 | **pinning** | 工具定义是否仍与用户批准过的一致 | 无 | 是，当 `pinToolDefs: true` |
@@ -157,7 +165,7 @@ flowchart LR
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "6", digest: "sha256-dop0ekCh…" } }
 }
 ```
 
@@ -224,7 +232,7 @@ GET <你的 feed url>
 ## 开发
 
 ```bash
-npm install && npm run build && npm test   # 166 项测试
+npm install && npm run build && npm test   # 200 项测试
 ```
 
 `test/packaging.test.ts` 正是让标题保持诚实的东西：一旦出现运行时依赖、任何源文件从包外 import、或者入口点不

package/README.md

@@ -8,7 +8,7 @@
   <a href="https://glama.ai/mcp/servers/alexar76/warden"><img src="https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg" alt="warden MCP server" /></a>
   <a href="https://warden.modelmarket.dev/"><img src="https://img.shields.io/npm/v/@aimarket/warden?color=cb3837&label=npm" alt="npm version" /></a>
   <img src="docs/badges/deps.svg" alt="Zero runtime dependencies" />
-  <img src="docs/badges/tests.svg" alt="166 tests passing" />
+  <img src="docs/badges/tests.svg" alt="200 tests passing" />
   <img src="docs/badges/node.svg" alt="Node >= 20" />
   <a href="LICENSE"><img src="docs/badges/license.svg" alt="License: MIT" /></a>
 </p>
@@ -23,6 +23,8 @@
 
 > 🌐 **English** · [Русский](README-ru.md) · [Español](README-es.md) · [Français](README-fr.md) · [中文](README-zh.md) · [Glossary](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md)
 
+> [0.7.0 security changes and migration](docs/security-hardening.md): `vetLaunch`, durable pins, anti-rollback, ruleset v6, runtime revalidation.
+
 **One MCP server. Security firewall for advertised tool definitions. Library included.**
 
 Transport: **stdio** (`npx -y @aimarket/warden` / `node dist/mcp-server.js`). Compatible hosts:
@@ -82,13 +84,19 @@ in, you get a verdict out.
 | `check_egress_url` | Hostname allowlist (empty list denies every host) |
 | `canonicalize_json` | RFC 8785 bytes for feeds and pins |
 | `list_scan_rules` | Published rule table + digest |
+| `status_mcp_server` | Review the saved approval and current hashes |
+| `approve_mcp_server` | Approve the reviewed snapshot (operator opt-in) |
+| `revoke_mcp_server` | Revoke a reviewed approval (operator opt-in) |
 
 Glama TDQS: MCP `annotations` (readOnly / destructive / idempotent / openWorld), when-to-use /
 when-not naming siblings, every `inputSchema` property described, `outputSchema` on every tool.
 
 ### Publish on Glama
 
-Listing: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)**
+Listing: **[glama.ai/mcp/servers/alexar76/warden](https://glama.ai/mcp/servers/alexar76/warden)** ·
+quality score: **[glama.ai/mcp/servers/alexar76/warden/score](https://glama.ai/mcp/servers/alexar76/warden/score)**
+
+[![alexar76/warden MCP server](https://glama.ai/mcp/servers/alexar76/warden/badges/score.svg)](https://glama.ai/mcp/servers/alexar76/warden)
 
 Same pattern as **[ARGUS](https://github.com/alexar76/argus)** and
 **[aimarket-mcp](https://github.com/alexar76/aimarket-mcp)**: repo-root [`glama.json`](glama.json) +
@@ -136,7 +144,7 @@ asked for by passing a URL to `load()`.
 
 ```mermaid
 flowchart LR
-  T["tool defs<br/>from the server"] --> S["static scan<br/>25 rules"]
+  T["tool defs<br/>from the server"] --> S["static scan<br/>26 rules"]
   S --> F["threat feed<br/>11 built-ins + signed"]
   F --> O["origin<br/>declared vs catalog"]
   O --> P["pinning<br/>drift vs approval"]
@@ -145,7 +153,7 @@ flowchart LR
 
 | Gate | What it decides | Network | Fatal? |
 |---|---|---|---|
-| **static-scan** | Injection, exfiltration, credential requests and hidden-Unicode/base64 tells in the tool `name`, its `description` and its `inputSchema` — 25 rules, v4, of which 15 can block and 10 are advisory-only, 17 also cover the name, and 12 carry a context guard | none | no |
+| **static-scan** | Injection, exfiltration, credential requests and hidden-Unicode/base64 tells in the tool `name`, its `description` and its `inputSchema` — 26 rules, v6, of which 15 can block and 11 are advisory-only, 17 also cover the name, and 15 carry a context guard. v5 folds the text first (fullwidth, invisible characters, Unicode tags, look-alike letters) so obfuscation cannot dodge a rule in any language | none | no |
 | **threat-feed** | Known-bad server identity or tool, from 11 built-in records plus an optional signed feed | only the feed fetch | yes, for a server-scoped `critical` |
 | **origin** | Whether the operator declared this server or it arrived from a remote catalog | none | yes, under `allowUnknownServers: false` |
 | **pinning** | Whether the tool defs still match what the user approved | none | yes, under `pinToolDefs: true` |
@@ -166,7 +174,7 @@ second as a low severity made it blocking again for anyone who tightened the thr
   findings: [{ gate, severity, code: "THREAT_TOOL_MATCH", message, tool, advisory? }],
   allowedTools: ["add"],
   blockedTools: ["sweeper"],
-  rulesets: { staticScan: { version: "4", digest: "sha256-klRyTiD3…" } }
+  rulesets: { staticScan: { version: "6", digest: "sha256-dop0ekCh…" } }
 }
 ```
 
@@ -242,7 +250,7 @@ no protection:
 ## Development
 
 ```bash
-npm install && npm run build && npm test   # 166 tests
+npm install && npm run build && npm test   # 200 tests
 ```
 
 `test/packaging.test.ts` is what keeps the headline honest: it fails if an npm runtime dependency

package/dist/fold.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Unicode folding before the rule table reads a tool definition.
+ *
+ * A rule written as `ignore previous instructions` must not be defeated by the
+ * same words spelled so that a regex no longer sees them while a model still
+ * does. Three spellings do that, and none of them depends on the language:
+ *
+ *   1. Compatibility forms. `ｉｇｎｏｒｅ ｐｒｅｖｉｏｕｓ` (fullwidth), ligatures,
+ *      mathematical alphanumerics, circled letters. NFKC maps each to the plain
+ *      letter a reader sees.
+ *   2. Invisible characters inside a word. `ig​nore`, a soft hyphen, a
+ *      variation selector. They are dropped here so they cannot split a rule word.
+ *      The high-signal ones (zero-width, bidi, word-joiner, BOM, the tag block and
+ *      the variation-selector supplement) are ALSO reported, because the
+ *      hidden-character rule runs on the raw text; the purely cosmetic ones (a
+ *      soft hyphen, an Indic/Arabic joiner control) are neutralised here and not
+ *      separately flagged.
+ *   3. Look-alike letters from another script inside a Latin word: `іgnоre` with a
+ *      Cyrillic і and о. A token that mixes Latin with Cyrillic or Greek letters has
+ *      its look-alikes mapped to Latin. A token written wholly in one script is left
+ *      alone, so Russian and Greek text still reads as Russian and Greek.
+ *
+ * Unicode TAG characters (U+E0020–U+E007E) are the exception to "dropped": each is
+ * an invisible copy of an ASCII character, and a whole instruction can be written in
+ * them. They are DECODED to that ASCII here, so the instruction they carry meets the
+ * same rules as visible text.
+ *
+ * The fold is part of the published ruleset (FOLD_ID is in its digest): the same
+ * regexes over folded and unfolded text are different scans.
+ */
+/** Identity of this fold, carried in the ruleset preimage. Bump on any change below. */
+export declare const FOLD_ID = "nfkc+tags-decoded+invisible-stripped+mixed-script-confusables/1";
+/**
+ * Fold `text` for matching. Never shown to anyone: findings quote the folded span,
+ * and the raw text is what the hidden-character rules and the reader see.
+ */
+export declare function foldForScan(text: string): string;
+//# sourceMappingURL=fold.d.ts.map

package/dist/fold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fold.d.ts","sourceRoot":"","sources":["../src/fold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,wFAAwF;AACxF,eAAO,MAAM,OAAO,oEAAoE,CAAC;AAuCzF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBhD"}

package/dist/fold.js

@@ -0,0 +1,99 @@
+/**
+ * Unicode folding before the rule table reads a tool definition.
+ *
+ * A rule written as `ignore previous instructions` must not be defeated by the
+ * same words spelled so that a regex no longer sees them while a model still
+ * does. Three spellings do that, and none of them depends on the language:
+ *
+ *   1. Compatibility forms. `ｉｇｎｏｒｅ ｐｒｅｖｉｏｕｓ` (fullwidth), ligatures,
+ *      mathematical alphanumerics, circled letters. NFKC maps each to the plain
+ *      letter a reader sees.
+ *   2. Invisible characters inside a word. `ig​nore`, a soft hyphen, a
+ *      variation selector. They are dropped here so they cannot split a rule word.
+ *      The high-signal ones (zero-width, bidi, word-joiner, BOM, the tag block and
+ *      the variation-selector supplement) are ALSO reported, because the
+ *      hidden-character rule runs on the raw text; the purely cosmetic ones (a
+ *      soft hyphen, an Indic/Arabic joiner control) are neutralised here and not
+ *      separately flagged.
+ *   3. Look-alike letters from another script inside a Latin word: `іgnоre` with a
+ *      Cyrillic і and о. A token that mixes Latin with Cyrillic or Greek letters has
+ *      its look-alikes mapped to Latin. A token written wholly in one script is left
+ *      alone, so Russian and Greek text still reads as Russian and Greek.
+ *
+ * Unicode TAG characters (U+E0020–U+E007E) are the exception to "dropped": each is
+ * an invisible copy of an ASCII character, and a whole instruction can be written in
+ * them. They are DECODED to that ASCII here, so the instruction they carry meets the
+ * same rules as visible text.
+ *
+ * The fold is part of the published ruleset (FOLD_ID is in its digest): the same
+ * regexes over folded and unfolded text are different scans.
+ */
+/** Identity of this fold, carried in the ruleset preimage. Bump on any change below. */
+export const FOLD_ID = "nfkc+tags-decoded+invisible-stripped+mixed-script-confusables/1";
+/**
+ * Characters with no visible form in running text. Dropped by the fold; the
+ * hidden-character rule reports them from the raw text.
+ */
+const INVISIBLE_RE = new RegExp("[\\u00AD\\u034F\\u061C\\u115F\\u1160\\u17B4\\u17B5\\u180B-\\u180F\\u200B-\\u200F\\u202A-\\u202E" +
+    "\\u2060-\\u2064\\u2066-\\u206F\\u3164\\uFE00-\\uFE0F\\uFEFF\\uFFA0\\u{E0000}-\\u{E001F}" +
+    "\\u{E007F}\\u{E0100}-\\u{E01EF}]", "gu");
+/** U+E0020–U+E007E: invisible ASCII. Decoded, not dropped. */
+const TAG_RE = /[\u{E0020}-\u{E007E}]/gu;
+/**
+ * Cyrillic and Greek letters that render like a Latin letter. Used only inside a
+ * token that already contains Latin letters.
+ */
+const CONFUSABLE = {
+    // Cyrillic lower case
+    "а": "a", "в": "b", "е": "e", "ё": "e", "к": "k", "м": "m", "н": "h", "о": "o", "р": "p",
+    "с": "c", "т": "t", "у": "y", "х": "x", "і": "i", "ї": "i", "ј": "j", "ѕ": "s", "ԁ": "d",
+    "ԛ": "q", "ԝ": "w", "ӏ": "l", "һ": "h", "ɡ": "g",
+    // Cyrillic upper case
+    "А": "A", "В": "B", "Е": "E", "Ё": "E", "К": "K", "М": "M", "Н": "H", "О": "O", "Р": "P",
+    "С": "C", "Т": "T", "У": "Y", "Х": "X", "І": "I", "Ї": "I", "Ј": "J", "Ѕ": "S", "Һ": "H",
+    "Ԛ": "Q", "Ԝ": "W", "Ӏ": "I",
+    // Greek
+    "α": "a", "ε": "e", "ι": "i", "κ": "k", "ν": "v", "ο": "o", "ρ": "p", "τ": "t", "υ": "u",
+    "χ": "x", "Α": "A", "Β": "B", "Ε": "E", "Ζ": "Z", "Η": "H", "Ι": "I", "Κ": "K", "Μ": "M",
+    "Ν": "N", "Ο": "O", "Ρ": "P", "Τ": "T", "Υ": "Y", "Χ": "X",
+};
+const TOKEN_RE = /[\p{L}\p{M}]+/gu;
+const LATIN_RE = /[A-Za-z]/;
+const CONFUSABLE_RE = new RegExp(`[${Object.keys(CONFUSABLE).join("")}]`, "gu");
+/**
+ * Fold `text` for matching. Never shown to anyone: findings quote the folded span,
+ * and the raw text is what the hidden-character rules and the reader see.
+ */
+export function foldForScan(text) {
+    if (!text)
+        return text;
+    let out = text.normalize("NFKC");
+    out = out.replace(TAG_RE, (ch) => String.fromCharCode((ch.codePointAt(0) ?? 0xe0020) - 0xe0000));
+    out = out.replace(INVISIBLE_RE, "");
+    CONFUSABLE_RE.lastIndex = 0;
+    if (!CONFUSABLE_RE.test(out))
+        return out;
+    return out.replace(TOKEN_RE, (tok) => {
+        // Map a token that mixes Latin with look-alikes (`pаypаl`), OR one written
+        // WHOLLY in look-alike letters (`ЅУЅТЕМ`, `рrіvаtе` where every letter is in
+        // the table). A token with non-Latin letters that are NOT all confusables —
+        // ordinary Russian or Greek — is left alone, so those languages read normally.
+        // The scanner also matches the un-mapped raw text, so this only ever ADDS a
+        // reading; it never hides the original.
+        const marks = tok.replace(/\p{M}/gu, "");
+        if (!LATIN_RE.test(tok) && !allConfusable(marks))
+            return tok;
+        return tok.replace(CONFUSABLE_RE, (ch) => CONFUSABLE[ch] ?? ch);
+    });
+}
+/** Every letter of the token is one of the Latin look-alikes in the table. */
+function allConfusable(letters) {
+    if (!letters)
+        return false;
+    for (const ch of letters) {
+        if (!(ch in CONFUSABLE) && !/[A-Za-z]/.test(ch))
+            return false;
+    }
+    return /[^A-Za-z]/.test(letters); // at least one non-Latin look-alike, else nothing to map
+}
+//# sourceMappingURL=fold.js.map

package/dist/fold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fold.js","sourceRoot":"","sources":["../src/fold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAEzF;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,iGAAiG;IAC/F,yFAAyF;IACzF,kCAAkC,EACpC,IAAI,CACL,CAAC;AAEF,8DAA8D;AAC9D,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,GAA2B;IACzC,sBAAsB;IACtB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAChD,sBAAsB;IACtB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC5B,QAAQ;IACR,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CAC3D,CAAC;AAEF,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAC5B,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAEhF;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IACjG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACzC,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QACnC,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC7D,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,yDAAyD;AAC7F,CAAC"}

package/dist/index.d.ts

@@ -2,6 +2,7 @@ import type { McpServerRef, PinStore, ToolDef, WardenGate, WardenLogger, WardenP
 import { ThreatFeed } from "./threat-feed.js";
 export { StaticScanGate, staticScanRuleset, staticScanRulesetRef, STATIC_SCAN_RULESET_VERSION, } from "./static-scan.js";
 export { PinningGate, canonicalToolsHash, tryCanonicalToolsHash, serverIdentityHash, UNCANONICAL_TOOLS_HASH } from "./pinning.js";
+export { FilePinStore } from "./pin-store.js";
 export { OriginGate } from "./origin.js";
 export { ThreatFeed, ThreatGate, DEFAULT_FEED_MAX_AGE_MS, FEED_CLOCK_SKEW_MS } from "./threat-feed.js";
 export { EgressGuard, isSensitiveTool, classifyTools } from "./sandbox.js";
@@ -73,6 +74,7 @@ export declare class Warden {
      * circuiting only on a fatal gate result. A connection is blocked if any gate
      * is fatal or any finding reaches policy.blockAtSeverity.
      */
+    vetLaunch(server: McpServerRef): Promise<WardenVerdict>;
     vet(server: McpServerRef, tools: ToolDef[]): Promise<WardenVerdict>;
     /**
      * Run one gate, converting a thrown error into a blocking finding.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,QAAQ,EAER,OAAO,EAEP,UAAU,EAEV,YAAY,EACZ,YAAY,EACZ,aAAa,EACd,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,UAAU,EAAc,MAAM,kBAAkB,CAAC;AAK1D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAClI,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACvG,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,cAAc,YAAY,CAAC;AAU3B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,kEAAkE;IAClE,GAAG,CAAC,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,QAAQ,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAC;IACvB,GAAG,CAAC,EAAE,YAAY,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE,UAAU;IAM5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,eAAe;IAWvB,yEAAyE;IACzE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM;IAU7C;;;;OAIG;IACG,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAqDzE;;;;;;;;;;;;;;OAcG;YACW,OAAO;IAiCrB;;;OAGG;IACG,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpE;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,cAAc;CAGvB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,QAAQ,EAER,OAAO,EAEP,UAAU,EAEV,YAAY,EACZ,YAAY,EACZ,aAAa,EACd,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,UAAU,EAAc,MAAM,kBAAkB,CAAC;AAK1D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAClI,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACvG,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,cAAc,YAAY,CAAC;AAU3B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,kEAAkE;IAClE,GAAG,CAAC,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,QAAQ,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAC;IACvB,GAAG,CAAC,EAAE,YAAY,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE,UAAU;IAM5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,eAAe;IAWvB,yEAAyE;IACzE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM;IAU7C;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAUvD,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAqDzE;;;;;;;;;;;;;;OAcG;YACW,OAAO;IAiCrB;;;OAGG;IACG,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpE;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,cAAc;CAGvB"}

package/dist/index.js

@@ -7,6 +7,7 @@ import { silentLogger } from "./logger.js";
 import { displaySafe } from "./sanitize.js";
 export { StaticScanGate, staticScanRuleset, staticScanRulesetRef, STATIC_SCAN_RULESET_VERSION, } from "./static-scan.js";
 export { PinningGate, canonicalToolsHash, tryCanonicalToolsHash, serverIdentityHash, UNCANONICAL_TOOLS_HASH } from "./pinning.js";
+export { FilePinStore } from "./pin-store.js";
 export { OriginGate } from "./origin.js";
 export { ThreatFeed, ThreatGate, DEFAULT_FEED_MAX_AGE_MS, FEED_CLOCK_SKEW_MS } from "./threat-feed.js";
 export { EgressGuard, isSensitiveTool, classifyTools } from "./sandbox.js";
@@ -85,6 +86,13 @@ export class Warden {
      * circuiting only on a fatal gate result. A connection is blocked if any gate
      * is fatal or any finding reaches policy.blockAtSeverity.
      */
+    async vetLaunch(server) {
+        // Tool hashes cannot be checked until tools/list. Do not compare them to [].
+        const gates = this.gates.filter((g) => !(g instanceof StaticScanGate)).map((g) => g instanceof PinningGate
+            ? { name: g.name, evaluate: g.evaluateLaunch.bind(g) }
+            : g);
+        return new Warden({ gates, policy: this.policy, log: this.log }).vet(server, []);
+    }
     async vet(server, tools) {
         const findings = [];
         const scores = [];