npm - @bryan-thompson/inspector-assessment-client - Versions diffs - 1.19.6 → 1.20.0 - Mend

@bryan-thompson/inspector-assessment-client 1.19.6 → 1.20.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/dist/assets/{OAuthCallback-2egbdNUk.js → OAuthCallback-DX-BBIMw.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-coKZl3U4.js";
+import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-CmFoao7k.js";
 const OAuthCallback = ({ onConnect }) => {
   const { toast } = useToast();
   const hasProcessedRef = reactExports.useRef(false);

package/dist/assets/{OAuthDebugCallback-BfKpx34j.js → OAuthDebugCallback-Dgp5YOBI.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-coKZl3U4.js";
+import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-CmFoao7k.js";
 const OAuthDebugCallback = ({ onConnect }) => {
   reactExports.useEffect(() => {
     let isProcessed = false;

package/dist/assets/{index-coKZl3U4.js → index-CmFoao7k.js} RENAMED Viewed

@@ -16320,7 +16320,7 @@ object({
   token_type_hint: string().optional()
 }).strip();
 const name = "@bryan-thompson/inspector-assessment-client";
-const version$1 = "1.19.6";
+const version$1 = "1.20.0";
 const packageJson = {
   name,
   version: version$1
@@ -45352,7 +45352,7 @@ const useTheme = () => {
     [theme, setThemeWithSideEffect]
   );
 };
-const version = "1.19.6";
+const version = "1.20.0";
 var [createTooltipContext] = createContextScope("Tooltip", [
   createPopperScope
 ]);
@@ -59166,13 +59166,13 @@ const App = () => {
   ) });
   if (window.location.pathname === "/oauth/callback") {
     const OAuthCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthCallback-2egbdNUk.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthCallback-DX-BBIMw.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthCallback, { onConnect: onOAuthConnect }) });
   }
   if (window.location.pathname === "/oauth/callback/debug") {
     const OAuthDebugCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthDebugCallback-BfKpx34j.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthDebugCallback-Dgp5YOBI.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthDebugCallback, { onConnect: onOAuthDebugConnect }) });
   }

package/dist/index.html CHANGED Viewed

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-coKZl3U4.js"></script>
+    <script type="module" crossorigin src="/assets/index-CmFoao7k.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DiyPO_Zj.css">
   </head>
   <body>

package/lib/services/assessment/modules/TemporalAssessor.d.ts CHANGED Viewed

@@ -16,13 +16,17 @@ export declare class TemporalAssessor extends BaseAssessor {
     /**
      * Tool name patterns that are expected to have state-dependent responses.
      * These tools legitimately return different results based on data state,
-     * which is NOT a rug pull vulnerability (e.g., search returning more results
-     * after other tools have stored data).
+     * which is NOT a rug pull vulnerability.
      *
-     * NOTE: Uses substring matching, so "get" matches "get_user", "forget",
-     * "target", etc. This favors recall over precision - we prefer lenient
-     * schema comparison for edge cases over false positives on legitimate tools.
-     * Consider word-boundary regex if false positives become problematic.
+     * Includes both:
+     * - READ operations: search, list, query return more results after data stored
+     * - ACCUMULATION operations: add, append, store return accumulated state (counts, IDs)
+     *
+     * NOTE: Does NOT include patterns already in DESTRUCTIVE_PATTERNS (create, write,
+     * insert, etc.) - those need strict comparison to detect real rug pulls.
+     *
+     * Uses word-boundary matching to prevent false matches.
+     * "add_observations" matches "add" but "address_validator" does not.
      */
     private readonly STATEFUL_TOOL_PATTERNS;
     constructor(config: AssessmentConfiguration);
@@ -51,8 +55,12 @@ export declare class TemporalAssessor extends BaseAssessor {
     private isDestructiveTool;
     /**
      * Check if a tool is expected to have state-dependent behavior.
-     * Stateful tools (search, list, etc.) legitimately return different
+     * Stateful tools (search, list, add, store, etc.) legitimately return different
      * results as underlying data changes - this is NOT a rug pull.
+     *
+     * Uses word-boundary matching to prevent false positives:
+     * - "add_observations" matches "add" ✓
+     * - "address_validator" does NOT match "add" ✓
      */
     private isStatefulTool;
     /**

package/lib/services/assessment/modules/TemporalAssessor.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"TemporalAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/TemporalAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,uBAAuB,EAEvB,kBAAkB,EAEnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA+B9C,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,kBAAkB,CAAS;IAGnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAoBnC;IAGF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;IAEjD~~;;;;;;;;;;OAUG~~;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,~~CASrC~~;gBAEU,MAAM,EAAE,uBAAuB;IAKrC,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAqEvD,UAAU;IAuHxB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC,OAAO,CAAC,gBAAgB;IAmFxB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAsC3B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;~~IAoDzB~~;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAKzB~~;;;;OAIG~~;IACH,OAAO,CAAC,cAAc;~~IAYtB~~;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAuBtB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAiCzB,OAAO,CAAC,uBAAuB;IAa/B,OAAO,CAAC,mBAAmB;IA+C3B,OAAO,CAAC,uBAAuB;CA+DhC"}
1	+ {"version":3,"file":"TemporalAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/TemporalAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,uBAAuB,EAEvB,kBAAkB,EAEnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA+B9C,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,kBAAkB,CAAS;IAGnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAoBnC;IAGF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;IAEjD;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAqBrC;gBAEU,MAAM,EAAE,uBAAuB;IAKrC,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAqEvD,UAAU;IAuHxB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC,OAAO,CAAC,gBAAgB;IAmFxB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAsC3B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAiFzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAKzB;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAuBtB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAiCzB,OAAO,CAAC,uBAAuB;IAa/B,OAAO,CAAC,mBAAmB;IA+C3B,OAAO,CAAC,uBAAuB;CA+DhC"}

package/lib/services/assessment/modules/TemporalAssessor.js CHANGED Viewed

@@ -38,15 +38,20 @@ export class TemporalAssessor extends BaseAssessor {
     /**
      * Tool name patterns that are expected to have state-dependent responses.
      * These tools legitimately return different results based on data state,
-     * which is NOT a rug pull vulnerability (e.g., search returning more results
-     * after other tools have stored data).
+     * which is NOT a rug pull vulnerability.
      *
-     * NOTE: Uses substring matching, so "get" matches "get_user", "forget",
-     * "target", etc. This favors recall over precision - we prefer lenient
-     * schema comparison for edge cases over false positives on legitimate tools.
-     * Consider word-boundary regex if false positives become problematic.
+     * Includes both:
+     * - READ operations: search, list, query return more results after data stored
+     * - ACCUMULATION operations: add, append, store return accumulated state (counts, IDs)
+     *
+     * NOTE: Does NOT include patterns already in DESTRUCTIVE_PATTERNS (create, write,
+     * insert, etc.) - those need strict comparison to detect real rug pulls.
+     *
+     * Uses word-boundary matching to prevent false matches.
+     * "add_observations" matches "add" but "address_validator" does not.
      */
     STATEFUL_TOOL_PATTERNS = [
+        // READ operations - results depend on current data state
         "search",
         "list",
         "query",
@@ -55,6 +60,17 @@ export class TemporalAssessor extends BaseAssessor {
         "fetch",
         "read",
         "browse",
+        // ACCUMULATION operations (non-destructive) that return accumulated state
+        // These legitimately return different counts/IDs as data accumulates
+        // NOTE: "add" is NOT in DESTRUCTIVE_PATTERNS, unlike "insert", "create", "write"
+        "add",
+        "append",
+        "store",
+        "save",
+        "log",
+        "record",
+        "push",
+        "enqueue",
     ];
     constructor(config) {
         super(config);
@@ -370,6 +386,23 @@ export class TemporalAssessor extends BaseAssessor {
             .replace(/\\"sequence\\":\s*\d+/g, '\\"sequence\\": <NUMBER>')
             .replace(/"index":\s*\d+/g, '"index": <NUMBER>')
             .replace(/\\"index\\":\s*\d+/g, '\\"index\\": <NUMBER>')
+            // Additional accumulation-related counter fields (defense-in-depth)
+            .replace(/"total_observations":\s*\d+/g, '"total_observations": <NUMBER>')
+            .replace(/\\"total_observations\\":\s*\d+/g, '\\"total_observations\\": <NUMBER>')
+            .replace(/"observations_count":\s*\d+/g, '"observations_count": <NUMBER>')
+            .replace(/\\"observations_count\\":\s*\d+/g, '\\"observations_count\\": <NUMBER>')
+            .replace(/"total_records":\s*\d+/g, '"total_records": <NUMBER>')
+            .replace(/\\"total_records\\":\s*\d+/g, '\\"total_records\\": <NUMBER>')
+            .replace(/"records_added":\s*\d+/g, '"records_added": <NUMBER>')
+            .replace(/\\"records_added\\":\s*\d+/g, '\\"records_added\\": <NUMBER>')
+            .replace(/"items_added":\s*\d+/g, '"items_added": <NUMBER>')
+            .replace(/\\"items_added\\":\s*\d+/g, '\\"items_added\\": <NUMBER>')
+            .replace(/"size":\s*\d+/g, '"size": <NUMBER>')
+            .replace(/\\"size\\":\s*\d+/g, '\\"size\\": <NUMBER>')
+            .replace(/"length":\s*\d+/g, '"length": <NUMBER>')
+            .replace(/\\"length\\":\s*\d+/g, '\\"length\\": <NUMBER>')
+            .replace(/"total":\s*\d+/g, '"total": <NUMBER>')
+            .replace(/\\"total\\":\s*\d+/g, '\\"total\\": <NUMBER>')
             // String IDs
             .replace(/"id":\s*"[^"]+"/g, '"id": "<ID>"')
             // P2-1: Additional timestamp fields that vary between calls
@@ -386,8 +419,12 @@ export class TemporalAssessor extends BaseAssessor {
     }
     /**
      * Check if a tool is expected to have state-dependent behavior.
-     * Stateful tools (search, list, etc.) legitimately return different
+     * Stateful tools (search, list, add, store, etc.) legitimately return different
      * results as underlying data changes - this is NOT a rug pull.
+     *
+     * Uses word-boundary matching to prevent false positives:
+     * - "add_observations" matches "add" ✓
+     * - "address_validator" does NOT match "add" ✓
      */
     isStatefulTool(tool) {
         const toolName = tool.name.toLowerCase();
@@ -396,7 +433,12 @@ export class TemporalAssessor extends BaseAssessor {
         if (this.isDestructiveTool(tool)) {
             return false;
         }
-        return this.STATEFUL_TOOL_PATTERNS.some((pattern) => toolName.includes(pattern));
+        // Use word-boundary matching: pattern must be at start/end or bounded by _ or -
+        // This prevents "address_validator" from matching "add"
+        return this.STATEFUL_TOOL_PATTERNS.some((pattern) => {
+            const wordBoundaryRegex = new RegExp(`(^|_|-)${pattern}($|_|-)`);
+            return wordBoundaryRegex.test(toolName);
+        });
     }
     /**
      * Compare response schemas (field names) rather than full content.

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bryan-thompson/inspector-assessment-client",
-  "version": "1.19.6",
+  "version": "1.20.0",
   "description": "Client-side application for the Enhanced MCP Inspector with assessment capabilities",
   "license": "MIT",
   "author": "Bryan Thompson <bryan@triepod.ai>",