npm - @bryan-thompson/inspector-assessment-client - Versions diffs - 1.23.5 → 1.23.7 - Mend

@bryan-thompson/inspector-assessment-client 1.23.5 → 1.23.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/dist/assets/{OAuthCallback-DeXwqSKV.js → OAuthCallback-cHMTHdzd.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-5ZFeiSLu.js";
+import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-Cw3SDcg4.js";
 const OAuthCallback = ({ onConnect }) => {
   const { toast } = useToast();
   const hasProcessedRef = reactExports.useRef(false);

package/dist/assets/{OAuthDebugCallback-DyxX1t_p.js → OAuthDebugCallback-BAhy5GT7.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-5ZFeiSLu.js";
+import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-Cw3SDcg4.js";
 const OAuthDebugCallback = ({ onConnect }) => {
   reactExports.useEffect(() => {
     let isProcessed = false;

package/dist/assets/{index-5ZFeiSLu.js → index-Cw3SDcg4.js} RENAMED Viewed

@@ -16320,7 +16320,7 @@ object({
   token_type_hint: string().optional()
 }).strip();
 const name = "@bryan-thompson/inspector-assessment-client";
-const version$1 = "1.23.5";
+const version$1 = "1.23.6";
 const packageJson = {
   name,
   version: version$1
@@ -45217,7 +45217,7 @@ const useTheme = () => {
     [theme, setThemeWithSideEffect]
   );
 };
-const version = "1.23.5";
+const version = "1.23.6";
 var [createTooltipContext] = createContextScope("Tooltip", [
   createPopperScope
 ]);
@@ -48774,13 +48774,13 @@ const App = () => {
   ) });
   if (window.location.pathname === "/oauth/callback") {
     const OAuthCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthCallback-DeXwqSKV.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthCallback-cHMTHdzd.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthCallback, { onConnect: onOAuthConnect }) });
   }
   if (window.location.pathname === "/oauth/callback/debug") {
     const OAuthDebugCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthDebugCallback-DyxX1t_p.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthDebugCallback-BAhy5GT7.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthDebugCallback, { onConnect: onOAuthDebugConnect }) });
   }

package/dist/index.html CHANGED Viewed

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-5ZFeiSLu.js"></script>
+    <script type="module" crossorigin src="/assets/index-Cw3SDcg4.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-Df9Sx1jt.css">
   </head>
   <body>

package/lib/lib/securityPatterns.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 /**
  * Backend API Security Patterns
- * Tests MCP server API security with 22 focused patterns
+ * Tests MCP server API security with 23 focused patterns
  *
  * Architecture: Attack-Type with Specific Payloads
  * - Critical Injection (6 patterns): Command, Calculator, SQL, Path Traversal, XXE, NoSQL

package/lib/lib/securityPatterns.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"securityPatterns.d.ts","sourceRoot":"","sources":["../../src/lib/securityPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,aAAa,~~EAqxCnD~~,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,eAAe,EAAE,CAQnB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,EAAE,CAEtD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;;;;;;;;EA8BnC"}
1	+ {"version":3,"file":"securityPatterns.d.ts","sourceRoot":"","sources":["../../src/lib/securityPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,aAAa,EAuxCnD,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,eAAe,EAAE,CAQnB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,EAAE,CAEtD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;;;;;;;;EA8BnC"}

package/lib/lib/securityPatterns.js CHANGED Viewed

@@ -1,6 +1,6 @@
 /**
  * Backend API Security Patterns
- * Tests MCP server API security with 22 focused patterns
+ * Tests MCP server API security with 23 focused patterns
  *
  * Architecture: Attack-Type with Specific Payloads
  * - Critical Injection (6 patterns): Command, Calculator, SQL, Path Traversal, XXE, NoSQL
@@ -49,7 +49,9 @@ export const SECURITY_ATTACK_PATTERNS = [
             },
             {
                 payload: "ls -la",
-                evidence: /(total|drwx|rwx|-rw-|permissions|directory)/i,
+                // Issue #27: Tighten pattern to require ls -la specific context
+                // Avoids false positives from "X total in memory" tool status messages
+                evidence: /(total\s+\d+\s*$|^[d-][rwx-]{9}\s+\d+|drwxr|permissions\s+denied)/im,
                 riskLevel: "HIGH",
                 description: "Directory listing command",
                 payloadType: "injection",

package/lib/services/assessment/modules/SecurityAssessor.d.ts CHANGED Viewed

@@ -86,6 +86,15 @@ export declare class SecurityAssessor extends BaseAssessor {
      * - "schema validation error: must be a string"
      */
     private isMCPValidationError;
+    /**
+     * Check if response is an HTTP error (Issue #26)
+     * HTTP 4xx/5xx error responses indicate tool rejection, not vulnerability.
+     *
+     * This prevents false positives like "404: Not Found" being flagged for
+     * Calculator Injection (the digit "4" in "404" was incorrectly matching
+     * as the computed result of "2+2").
+     */
+    private isHttpErrorResponse;
     /**
      * Check if evidence pattern is ambiguous (can match both validation and execution)
      * These patterns appear in BOTH:

package/lib/services/assessment/modules/SecurityAssessor.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SecurityAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/SecurityAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,kBAAkB,EAInB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAc9D,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,iBAAiB,CAAuC;IAC1D,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAuFrE;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAkC7B;;;;OAIG;YACW,yBAAyB;IA2KvC;;;;OAIG;YACW,qBAAqB;IA4JnC;;OAEG;YACW,WAAW;IA4HzB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAgDzB;;;OAGG;IACH,OAAO,CAAC,8BAA8B;IAiDtC;;OAEG;IACH,OAAO,CAAC,aAAa;IA+BrB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAgClC;;;OAGG;IACH,OAAO,CAAC,eAAe;~~IAuIvB~~;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAiE7B;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAqC5B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAsB3B;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;~~IA8E5B~~;;OAEG;YACW,+BAA+B;IAiC7C;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA0B/B;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAkEnC;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAuI3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;~~IAoN5B~~;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAwDhC;;;OAGG;IACH,OAAO,CAAC,8BAA8B;IAuBtC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA8BhC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAW9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,oBAAoB;IAoH5B;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,CAAC,eAAe;IASvB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAiB9B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;CAmB3B"}
1	+ {"version":3,"file":"SecurityAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/SecurityAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,kBAAkB,EAInB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAc9D,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,iBAAiB,CAAuC;IAC1D,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAuFrE;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAkC7B;;;;OAIG;YACW,yBAAyB;IA2KvC;;;;OAIG;YACW,qBAAqB;IA4JnC;;OAEG;YACW,WAAW;IA4HzB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAgDzB;;;OAGG;IACH,OAAO,CAAC,8BAA8B;IAiDtC;;OAEG;IACH,OAAO,CAAC,aAAa;IA+BrB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAgClC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAkJvB;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAiE7B;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAqC5B;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAsB3B;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IA8F5B;;OAEG;YACW,+BAA+B;IAiC7C;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA0B/B;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAkEnC;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAuI3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAwN5B;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAwDhC;;;OAGG;IACH,OAAO,CAAC,8BAA8B;IAuBtC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA8BhC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAW9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,oBAAoB;IAoH5B;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,CAAC,eAAe;IASvB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAiB9B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;CAmB3B"}

package/lib/services/assessment/modules/SecurityAssessor.js CHANGED Viewed

@@ -601,6 +601,15 @@ export class SecurityAssessor extends BaseAssessor {
                 evidence: `MCP validation error${errorCode}: Tool properly rejected invalid input before processing`,
             };
         }
+        // ✅ STEP 1.1: Check for HTTP error responses (Issue #26)
+        // HTTP 4xx/5xx errors indicate tool rejection, not vulnerability
+        // This prevents false positives like "404: Not Found" being flagged for Calculator Injection
+        if (this.isHttpErrorResponse(responseText)) {
+            return {
+                isVulnerable: false,
+                evidence: "HTTP error response indicates tool rejection (not vulnerability)",
+            };
+        }
         // ✅ STEP 1.5: Classify tool and check for safe categories (prevents false positives)
         // Check tool category before generic pattern matching to avoid false positives
         const classifier = new ToolClassifier();
@@ -802,6 +811,33 @@ export class SecurityAssessor extends BaseAssessor {
         ];
         return validationPatterns.some((pattern) => pattern.test(responseText));
     }
+    /**
+     * Check if response is an HTTP error (Issue #26)
+     * HTTP 4xx/5xx error responses indicate tool rejection, not vulnerability.
+     *
+     * This prevents false positives like "404: Not Found" being flagged for
+     * Calculator Injection (the digit "4" in "404" was incorrectly matching
+     * as the computed result of "2+2").
+     */
+    isHttpErrorResponse(responseText) {
+        // Pattern 1: HTTP status code followed by error description
+        // e.g., "404 Not Found", "500 Internal Server Error", "503 Service Unavailable"
+        const httpErrorPattern = /\b(4\d{2}|5\d{2})\b.*?(not found|error|bad request|unauthorized|forbidden|internal server|unavailable|timeout|service)/i;
+        // Pattern 2: Response starts with HTTP status code
+        // e.g., "404: Not Found", "500: Error"
+        const simpleHttpPattern = /^(4\d{2}|5\d{2})[\s:]/;
+        // Pattern 3: Short "not found" messages (common API error response)
+        // e.g., "Not Found", "Resource not found"
+        const notFoundPattern = /not found/i;
+        const isShortNotFound = notFoundPattern.test(responseText) && responseText.length < 100;
+        // Pattern 4: HTTP status in JSON error structure
+        // e.g., {"status": 404, "error": "Not Found"}
+        const jsonStatusPattern = /"status":\s*(4\d{2}|5\d{2})/;
+        return (httpErrorPattern.test(responseText) ||
+            simpleHttpPattern.test(responseText) ||
+            isShortNotFound ||
+            jsonStatusPattern.test(responseText));
+    }
     /**
      * Check if evidence pattern is ambiguous (can match both validation and execution)
      * These patterns appear in BOTH:
@@ -874,6 +910,17 @@ export class SecurityAssessor extends BaseAssessor {
      * Added for Issue #14: False positives on safe input reflection
      */
     isComputedMathResult(payload, responseText) {
+        // Issue #26: Skip HTTP error responses - they indicate tool rejection, not computation
+        // HTTP 4xx/5xx status codes (e.g., "404: Not Found") should not trigger false positives
+        // The digit "4" in "404" was incorrectly matching as computed result of "2+2"
+        const httpErrorPattern = /\b(4\d{2}|5\d{2})\b.*?(not found|error|bad request|unauthorized|forbidden|internal server|unavailable|timeout)/i;
+        const simpleHttpPattern = /^(4\d{2}|5\d{2})[\s:]/; // Starts with HTTP status code
+        const notFoundPattern = /not found/i;
+        if (httpErrorPattern.test(responseText) ||
+            simpleHttpPattern.test(responseText) ||
+            (notFoundPattern.test(responseText) && responseText.length < 100)) {
+            return false; // HTTP error response, not a computed result
+        }
         // Check if payload looks like a simple math expression
         // Matches: "2+2", "15*37+100", "10/2", "5-3", etc.
         const simpleMathPattern = /^\s*(\d+)\s*([+\-*/])\s*(\d+)(?:\s*([+\-*/])\s*(\d+))?\s*$/;
@@ -1174,6 +1221,10 @@ export class SecurityAssessor extends BaseAssessor {
     isReflectionResponse(responseText) {
         // Status message patterns (NEW)
         const statusPatterns = [
+            // Issue #27: Tool statistics/metrics messages (not command execution)
+            // Prevents false positives from "1000 total in memory" style responses
+            /\d+\s+total\s+(in\s+)?(memory|storage|items|results)/i,
+            /\d+\s+(results|items|records),?\s+\d+\s+total/i,
             // "Action executed successfully: <anything>" (generic status message)
             /action\s+executed\s+successfully:/i,
             /command\s+executed\s+successfully:/i,

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bryan-thompson/inspector-assessment-client",
-  "version": "1.23.5",
+  "version": "1.23.7",
   "description": "Client-side application for the Enhanced MCP Inspector with assessment capabilities",
   "license": "MIT",
   "author": "Bryan Thompson <bryan@triepod.ai>",