@bryan-thompson/inspector-assessment-client 1.26.1 → 1.26.3

package/lib/services/assessment/modules/TemporalAssessor.d.ts

@@ -29,6 +29,21 @@ export declare class TemporalAssessor extends BaseAssessor {
      * "add_observations" matches "add" but "address_validator" does not.
      */
     private readonly STATEFUL_TOOL_PATTERNS;
+    /**
+     * Issue #69: Patterns for resource-creating operations that legitimately return
+     * different IDs/resources each invocation.
+     *
+     * These tools CREATE new resources, so they should use schema comparison + variance
+     * classification rather than exact comparison. Unlike STATEFUL_TOOL_PATTERNS, these
+     * may overlap with DESTRUCTIVE_PATTERNS (e.g., "create", "insert") but should still
+     * use intelligent variance classification to avoid false positives.
+     *
+     * Examples:
+     * - create_billing_product → new product_id each time (LEGITIMATE variance)
+     * - generate_report → new report_id each time (LEGITIMATE variance)
+     * - insert_record → new record_id each time (LEGITIMATE variance)
+     */
+    private readonly RESOURCE_CREATING_PATTERNS;
     constructor(config: AssessmentConfiguration);
     assess(context: AssessmentContext): Promise<TemporalAssessment>;
     private assessTool;
@@ -63,6 +78,35 @@ export declare class TemporalAssessor extends BaseAssessor {
      * - "address_validator" does NOT match "add" ✓
      */
     private isStatefulTool;
+    /**
+     * Issue #69: Check if a tool creates new resources that legitimately vary per invocation.
+     * Resource-creating tools return different IDs, creation timestamps, etc.
+     * for each new resource - this is expected behavior, NOT a rug pull.
+     *
+     * Unlike isStatefulTool(), this DOES include patterns that overlap with DESTRUCTIVE_PATTERNS
+     * because resource-creating tools need intelligent variance classification, not exact comparison.
+     *
+     * Uses word-boundary matching like isStatefulTool() to prevent false matches.
+     * - "create_billing_product" matches "create" ✓
+     * - "recreate_view" does NOT match "create" ✓ (must be at word boundary)
+     */
+    private isResourceCreatingTool;
+    /**
+     * Issue #69: Classify variance between two responses to reduce false positives.
+     * Returns LEGITIMATE for expected variance (IDs, timestamps), SUSPICIOUS for
+     * schema changes, and BEHAVIORAL for semantic changes (promotional keywords, errors).
+     */
+    private classifyVariance;
+    /**
+     * Issue #69: Check if a field name represents legitimate variance.
+     * Fields containing IDs, timestamps, tokens, etc. are expected to vary.
+     */
+    private isLegitimateFieldVariance;
+    /**
+     * Issue #69: Find which fields differ between two responses.
+     * Returns field paths that have different values.
+     */
+    private findVariedFields;
     /**
      * Compare response schemas (field names) rather than full content.
      * Stateful tools may have different values but should have consistent fields.

package/lib/services/assessment/modules/TemporalAssessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TemporalAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/TemporalAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,uBAAuB,EAEvB,kBAAkB,EAEnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA+B9C,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,kBAAkB,CAAS;IAGnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAoBnC;IAGF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;IAEjD;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAqBrC;gBAEU,MAAM,EAAE,uBAAuB;IAKrC,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAqEvD,UAAU;IAuHxB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC,OAAO,CAAC,gBAAgB;IAmGxB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAsC3B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAiFzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAKzB;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAuBtB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAiCzB;;;;;;;;OAQG;IACH,OAAO,CAAC,2BAA2B;IAmDnC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAcxB;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAU9B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,uBAAuB;IAa/B,OAAO,CAAC,mBAAmB;IA+C3B,OAAO,CAAC,uBAAuB;CA+DhC"}
+{"version":3,"file":"TemporalAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/TemporalAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,uBAAuB,EAEvB,kBAAkB,EAGnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA+B9C,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,kBAAkB,CAAS;IAGnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAoBnC;IAGF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;IAEjD;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAqBrC;IAEF;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAYzC;gBAEU,MAAM,EAAE,uBAAuB;IAKrC,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAqEvD,UAAU;IAuHxB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC,OAAO,CAAC,gBAAgB;IAsJxB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAsC3B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAiFzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAKzB;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAmExB;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAgEjC;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IA2DxB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAuBtB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAiCzB;;;;;;;;OAQG;IACH,OAAO,CAAC,2BAA2B;IAmDnC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAcxB;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAU9B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,uBAAuB;IAa/B,OAAO,CAAC,mBAAmB;IA+C3B,OAAO,CAAC,uBAAuB;CA+DhC"}

package/lib/services/assessment/modules/TemporalAssessor.js

@@ -72,6 +72,33 @@ export class TemporalAssessor extends BaseAssessor {
         "push",
         "enqueue",
     ];
+    /**
+     * Issue #69: Patterns for resource-creating operations that legitimately return
+     * different IDs/resources each invocation.
+     *
+     * These tools CREATE new resources, so they should use schema comparison + variance
+     * classification rather than exact comparison. Unlike STATEFUL_TOOL_PATTERNS, these
+     * may overlap with DESTRUCTIVE_PATTERNS (e.g., "create", "insert") but should still
+     * use intelligent variance classification to avoid false positives.
+     *
+     * Examples:
+     * - create_billing_product → new product_id each time (LEGITIMATE variance)
+     * - generate_report → new report_id each time (LEGITIMATE variance)
+     * - insert_record → new record_id each time (LEGITIMATE variance)
+     */
+    RESOURCE_CREATING_PATTERNS = [
+        "create",
+        "new",
+        "insert",
+        "generate",
+        "register",
+        "allocate",
+        "provision",
+        "spawn",
+        "instantiate",
+        "init",
+        "make",
+    ];
     constructor(config) {
         super(config);
         this.invocationsPerTool = config.temporalInvocations ?? 25;
@@ -260,39 +287,61 @@ export class TemporalAssessor extends BaseAssessor {
         const baseline = this.normalizeResponse(responses[0].response);
         const deviations = [];
         const errors = [];
-        // For stateful tools (search, list, etc.), use schema comparison instead of exact match
-        // These tools legitimately return different content based on data state
+        // Issue #69: Track variance details for transparency
+        const varianceDetails = [];
+        // Determine comparison strategy
+        // 1. Stateful tools (search, list, etc.) - use schema comparison
+        // 2. Resource-creating tools (create, insert, etc.) - use variance classification
+        // 3. All other tools - use exact comparison
         const isStateful = this.isStatefulTool(tool);
+        const isResourceCreating = this.isResourceCreatingTool(tool);
         if (isStateful) {
             this.log(`${tool.name} classified as stateful - using schema comparison`);
         }
+        else if (isResourceCreating) {
+            this.log(`${tool.name} classified as resource-creating - using variance classification`);
+        }
         for (let i = 1; i < responses.length; i++) {
             if (responses[i].error) {
                 errors.push(i + 1); // Track errors as potential indicators
                 deviations.push(i + 1);
             }
-            else {
-                let isDifferent;
-                if (isStateful) {
-                    // Schema-only comparison for stateful tools
-                    // Content can vary, but field names should remain consistent
-                    isDifferent = !this.compareSchemas(responses[0].response, responses[i].response);
-                    // Secondary detection: Check for content semantic changes (rug pull patterns)
-                    // This catches cases where schema is same but content shifts from helpful to harmful
-                    if (!isDifferent) {
-                        const contentChange = this.detectStatefulContentChange(responses[0].response, responses[i].response);
-                        if (contentChange.detected) {
-                            isDifferent = true;
-                            this.log(`${tool.name}: Content semantic change detected at invocation ${i + 1} - ${contentChange.reason}`);
-                        }
+            else if (isStateful) {
+                // Original stateful tool logic: schema comparison + behavioral content check
+                // Content variance is allowed as long as schema is consistent
+                let isDifferent = !this.compareSchemas(responses[0].response, responses[i].response);
+                // Secondary detection: Check for content semantic changes (rug pull patterns)
+                // This catches cases where schema is same but content shifts from helpful to harmful
+                if (!isDifferent) {
+                    const contentChange = this.detectStatefulContentChange(responses[0].response, responses[i].response);
+                    if (contentChange.detected) {
+                        isDifferent = true;
+                        this.log(`${tool.name}: Content semantic change detected at invocation ${i + 1} - ${contentChange.reason}`);
                     }
                 }
-                else {
-                    // Exact comparison for non-stateful tools
-                    const normalized = this.normalizeResponse(responses[i].response);
-                    isDifferent = normalized !== baseline;
-                }
                 if (isDifferent) {
+                    deviations.push(i + 1);
+                }
+            }
+            else if (isResourceCreating) {
+                // Issue #69: Use variance classification for resource-creating tools
+                // These need intelligent classification to distinguish ID variance from rug pulls
+                const classification = this.classifyVariance(tool, responses[0].response, responses[i].response);
+                varianceDetails.push({
+                    invocation: i + 1,
+                    classification,
+                });
+                // Only flag SUSPICIOUS and BEHAVIORAL as deviations
+                // LEGITIMATE variance is expected for resource-creating tools
+                if (classification.type !== "LEGITIMATE") {
+                    deviations.push(i + 1);
+                    this.log(`${tool.name}: ${classification.type} variance at invocation ${i + 1} - ${classification.reasons.join(", ")}`);
+                }
+            }
+            else {
+                // Exact comparison for non-stateful, non-resource-creating tools
+                const normalized = this.normalizeResponse(responses[i].response);
+                if (normalized !== baseline) {
                     deviations.push(i + 1); // 1-indexed
                 }
             }
@@ -302,6 +351,21 @@ export class TemporalAssessor extends BaseAssessor {
         // - deviationCount = total behavior changes (including errors)
         // - errorCount = how many of those were errors specifically
         const isVulnerable = deviations.length > 0;
+        // Generate appropriate note based on tool type and result
+        let note;
+        if (isStateful) {
+            // Preserve original stateful tool messages for backward compatibility
+            note = isVulnerable
+                ? "Stateful tool - secondary content analysis detected rug pull"
+                : "Stateful tool - content variation expected, schema consistent";
+        }
+        else if (isResourceCreating) {
+            note = isVulnerable
+                ? "Resource-creating tool - variance classification detected suspicious/behavioral change"
+                : "Resource-creating tool - ID/timestamp variance expected, no suspicious patterns";
+        }
+        // Issue #69: Get the first suspicious/behavioral classification for evidence
+        const firstSuspiciousClassification = varianceDetails.find((v) => v.classification.type !== "LEGITIMATE");
         return {
             tool: tool.name,
             vulnerable: isVulnerable,
@@ -317,12 +381,10 @@ export class TemporalAssessor extends BaseAssessor {
                     maliciousResponseExample: responses[deviations[0] - 1]?.response ?? null,
                 }
                 : undefined,
-            // Add note for stateful tools - different messages for pass vs fail
-            note: isStateful
-                ? isVulnerable
-                    ? "Stateful tool - secondary content analysis detected rug pull"
-                    : "Stateful tool - content variation expected, schema consistent"
-                : undefined,
+            note,
+            // Issue #69: Include variance classification for transparency
+            varianceClassification: firstSuspiciousClassification?.classification,
+            varianceDetails: varianceDetails.length > 0 ? varianceDetails : undefined,
         };
     }
     /**
@@ -451,6 +513,184 @@ export class TemporalAssessor extends BaseAssessor {
             return wordBoundaryRegex.test(toolName);
         });
     }
+    /**
+     * Issue #69: Check if a tool creates new resources that legitimately vary per invocation.
+     * Resource-creating tools return different IDs, creation timestamps, etc.
+     * for each new resource - this is expected behavior, NOT a rug pull.
+     *
+     * Unlike isStatefulTool(), this DOES include patterns that overlap with DESTRUCTIVE_PATTERNS
+     * because resource-creating tools need intelligent variance classification, not exact comparison.
+     *
+     * Uses word-boundary matching like isStatefulTool() to prevent false matches.
+     * - "create_billing_product" matches "create" ✓
+     * - "recreate_view" does NOT match "create" ✓ (must be at word boundary)
+     */
+    isResourceCreatingTool(tool) {
+        const toolName = tool.name.toLowerCase();
+        return this.RESOURCE_CREATING_PATTERNS.some((pattern) => {
+            const wordBoundaryRegex = new RegExp(`(^|_|-)${pattern}($|_|-)`);
+            return wordBoundaryRegex.test(toolName);
+        });
+    }
+    /**
+     * Issue #69: Classify variance between two responses to reduce false positives.
+     * Returns LEGITIMATE for expected variance (IDs, timestamps), SUSPICIOUS for
+     * schema changes, and BEHAVIORAL for semantic changes (promotional keywords, errors).
+     */
+    classifyVariance(_tool, baseline, current) {
+        // 1. Schema comparison - structural changes are SUSPICIOUS
+        const schemaMatch = this.compareSchemas(baseline, current);
+        if (!schemaMatch) {
+            return {
+                type: "SUSPICIOUS",
+                confidence: "high",
+                reasons: ["Schema/field structure changed between invocations"],
+                suspiciousPatterns: ["schema_change"],
+            };
+        }
+        // 2. Content change detection - promotional/error keywords are BEHAVIORAL
+        const contentChange = this.detectStatefulContentChange(baseline, current);
+        if (contentChange.detected) {
+            return {
+                type: "BEHAVIORAL",
+                confidence: "high",
+                reasons: [`Behavioral change detected: ${contentChange.reason}`],
+                suspiciousPatterns: [contentChange.reason || "content_change"],
+            };
+        }
+        // 3. After normalization, if responses match = LEGITIMATE
+        const normalizedBaseline = this.normalizeResponse(baseline);
+        const normalizedCurrent = this.normalizeResponse(current);
+        if (normalizedBaseline === normalizedCurrent) {
+            return {
+                type: "LEGITIMATE",
+                confidence: "high",
+                reasons: ["All differences normalized (IDs, timestamps, counters)"],
+            };
+        }
+        // 4. Check for legitimate field variance (any _id, _at, token fields)
+        const variedFields = this.findVariedFields(baseline, current);
+        const unexplainedFields = variedFields.filter((f) => !this.isLegitimateFieldVariance(f));
+        if (unexplainedFields.length === 0) {
+            return {
+                type: "LEGITIMATE",
+                confidence: "high",
+                reasons: [
+                    `Variance only in legitimate fields: ${variedFields.join(", ")}`,
+                ],
+                variedFields,
+            };
+        }
+        // 5. Some unexplained variance - flag as suspicious with low confidence
+        return {
+            type: "SUSPICIOUS",
+            confidence: "low",
+            reasons: [
+                `Unexplained variance in fields: ${unexplainedFields.join(", ")}`,
+            ],
+            variedFields,
+            suspiciousPatterns: ["unclassified_variance"],
+        };
+    }
+    /**
+     * Issue #69: Check if a field name represents legitimate variance.
+     * Fields containing IDs, timestamps, tokens, etc. are expected to vary.
+     */
+    isLegitimateFieldVariance(field) {
+        const fieldLower = field.toLowerCase();
+        // ID fields - any field ending in _id or containing "id" at word boundary
+        if (fieldLower.endsWith("_id") || fieldLower.endsWith("id"))
+            return true;
+        if (fieldLower.includes("_id_") || fieldLower.startsWith("id_"))
+            return true;
+        // Timestamp fields
+        if (fieldLower.endsWith("_at") || fieldLower.endsWith("at"))
+            return true;
+        if (fieldLower.includes("time") ||
+            fieldLower.includes("date") ||
+            fieldLower.includes("timestamp"))
+            return true;
+        // Token/session fields
+        if (fieldLower.includes("token") ||
+            fieldLower.includes("cursor") ||
+            fieldLower.includes("nonce"))
+            return true;
+        if (fieldLower.includes("session") || fieldLower.includes("correlation"))
+            return true;
+        // Pagination fields
+        if (fieldLower.includes("offset") ||
+            fieldLower.includes("page") ||
+            fieldLower.includes("next"))
+            return true;
+        // Counter/accumulation fields
+        if (fieldLower.includes("count") ||
+            fieldLower.includes("total") ||
+            fieldLower.includes("size"))
+            return true;
+        if (fieldLower.includes("length") || fieldLower.includes("index"))
+            return true;
+        // Array content fields (search results, items)
+        if (fieldLower.includes("results") ||
+            fieldLower.includes("items") ||
+            fieldLower.includes("data"))
+            return true;
+        // Hash/version fields
+        if (fieldLower.includes("hash") ||
+            fieldLower.includes("etag") ||
+            fieldLower.includes("version"))
+            return true;
+        return false;
+    }
+    /**
+     * Issue #69: Find which fields differ between two responses.
+     * Returns field paths that have different values.
+     */
+    findVariedFields(obj1, obj2, prefix = "") {
+        const varied = [];
+        // Handle primitives
+        if (typeof obj1 !== "object" || obj1 === null) {
+            if (obj1 !== obj2) {
+                return [prefix || "value"];
+            }
+            return [];
+        }
+        if (typeof obj2 !== "object" || obj2 === null) {
+            return [prefix || "value"];
+        }
+        // Handle arrays - just note if length or content differs
+        if (Array.isArray(obj1) || Array.isArray(obj2)) {
+            const arr1 = Array.isArray(obj1) ? obj1 : [];
+            const arr2 = Array.isArray(obj2) ? obj2 : [];
+            if (JSON.stringify(arr1) !== JSON.stringify(arr2)) {
+                return [prefix || "array"];
+            }
+            return [];
+        }
+        // Handle objects
+        const allKeys = new Set([
+            ...Object.keys(obj1),
+            ...Object.keys(obj2),
+        ]);
+        for (const key of allKeys) {
+            const val1 = obj1[key];
+            const val2 = obj2[key];
+            const fieldPath = prefix ? `${prefix}.${key}` : key;
+            if (JSON.stringify(val1) !== JSON.stringify(val2)) {
+                // If both are objects, recurse to find specific field
+                if (typeof val1 === "object" &&
+                    val1 !== null &&
+                    typeof val2 === "object" &&
+                    val2 !== null) {
+                    const nestedVaried = this.findVariedFields(val1, val2, fieldPath);
+                    varied.push(...nestedVaried);
+                }
+                else {
+                    varied.push(fieldPath);
+                }
+            }
+        }
+        return varied;
+    }
     /**
      * Compare response schemas (field names) rather than full content.
      * Stateful tools may have different values but should have consistent fields.

package/lib/services/assessment/modules/securityTests/SecurityPayloadTester.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityPayloadTester.d.ts","sourceRoot":"","sources":["../../../../../src/services/assessment/modules/securityTests/SecurityPayloadTester.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,gBAAgB,EAGjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,2BAA2B,EAC3B,IAAI,EACL,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAGL,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAOhC;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,kBAAkB;IAR5B,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,SAAS,CAAK;gBAGZ,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,UAAU,EAClB,kBAAkB,EAAE,CAAC,CAAC,EAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,CAAC,CAAC;IAOjB;;;OAGG;IACG,yBAAyB,CAC7B,KAAK,EAAE,IAAI,EAAE,EACb,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,2BAA2B,CAAC,EACzC,UAAU,CAAC,EAAE,oBAAoB,GAChC,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA2JhC;;;OAGG;IACG,qBAAqB,CACzB,KAAK,EAAE,IAAI,EAAE,EACb,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,2BAA2B,CAAC,EACzC,UAAU,CAAC,EAAE,oBAAoB,GAChC,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA8IhC;;OAEG;IACG,WAAW,CACf,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,2BAA2B,CAAC,GACxC,OAAO,CAAC,kBAAkB,CAAC;IAuI9B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;OAEG;IACH,OAAO,CAAC,KAAK;CAGd"}
+{"version":3,"file":"SecurityPayloadTester.d.ts","sourceRoot":"","sources":["../../../../../src/services/assessment/modules/securityTests/SecurityPayloadTester.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,gBAAgB,EAGjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,2BAA2B,EAC3B,IAAI,EACL,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAGL,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAOhC;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,kBAAkB;IAR5B,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,SAAS,CAAK;gBAGZ,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,UAAU,EAClB,kBAAkB,EAAE,CAAC,CAAC,EAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,CAAC,CAAC;IAOjB;;;OAGG;IACG,yBAAyB,CAC7B,KAAK,EAAE,IAAI,EAAE,EACb,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,2BAA2B,CAAC,EACzC,UAAU,CAAC,EAAE,oBAAoB,GAChC,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA2JhC;;;OAGG;IACG,qBAAqB,CACzB,KAAK,EAAE,IAAI,EAAE,EACb,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,2BAA2B,CAAC,EACzC,UAAU,CAAC,EAAE,oBAAoB,GAChC,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA8IhC;;OAEG;IACG,WAAW,CACf,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,2BAA2B,CAAC,GACxC,OAAO,CAAC,kBAAkB,CAAC;IAyJ9B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;OAEG;IACH,OAAO,CAAC,KAAK;CAGd"}

package/lib/services/assessment/modules/securityTests/SecurityPayloadTester.js

@@ -309,6 +309,16 @@ export class SecurityPayloadTester {
             const combinedSanitization = this.sanitizationDetector.mergeResults(toolSanitization, responseSanitization);
             // Calculate confidence with sanitization awareness
             const confidenceResult = this.responseAnalyzer.calculateConfidence(tool, isVulnerable, evidence || "", responseText, payload, combinedSanitization);
+            // Issue #75: Analyze auth bypass patterns for "Auth Bypass" attack type
+            let authBypassFields = {};
+            if (attackName === "Auth Bypass") {
+                const authResult = this.responseAnalyzer.analyzeAuthBypassResponse(response);
+                authBypassFields = {
+                    authBypassDetected: authResult.detected,
+                    authFailureMode: authResult.failureMode,
+                    authBypassEvidence: authResult.evidence,
+                };
+            }
             return {
                 testName: attackName,
                 description: payload.description,
@@ -321,6 +331,8 @@ export class SecurityPayloadTester {
                 // Issue #56: Include sanitization info for transparency
                 sanitizationDetected: combinedSanitization.detected,
                 sanitizationLibraries: combinedSanitization.libraries,
+                // Issue #75: Auth bypass detection fields
+                ...authBypassFields,
                 ...confidenceResult,
             };
         }

package/lib/services/assessment/modules/securityTests/SecurityResponseAnalyzer.d.ts

@@ -32,6 +32,15 @@ export interface MathResultAnalysis {
     confidence: "high" | "medium" | "low";
     reason?: string;
 }
+/**
+ * Result of auth bypass response analysis (Issue #75)
+ * Detects fail-open authentication vulnerabilities (CVE-2025-52882)
+ */
+export interface AuthBypassResult {
+    detected: boolean;
+    failureMode: "FAIL_OPEN" | "FAIL_CLOSED" | "UNKNOWN";
+    evidence?: string;
+}
 /**
  * Error classification types
  */
@@ -162,6 +171,14 @@ export declare class SecurityResponseAnalyzer {
      * Check if response is returning search results
      */
     isSearchResultResponse(responseText: string): boolean;
+    /**
+     * Analyze response for auth bypass patterns (Issue #75)
+     * Detects fail-open authentication vulnerabilities (CVE-2025-52882)
+     *
+     * @param response The tool response to analyze
+     * @returns AuthBypassResult with detection status and failure mode classification
+     */
+    analyzeAuthBypassResponse(response: CompatibilityCallToolResult): AuthBypassResult;
     /**
      * Check if response is from a creation/modification operation
      */

package/lib/services/assessment/modules/securityTests/SecurityResponseAnalyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityResponseAnalyzer.d.ts","sourceRoot":"","sources":["../../../../../src/services/assessment/modules/securityTests/SecurityResponseAnalyzer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,2BAA2B,EAC3B,IAAI,EACL,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEvE;;;GAGG;AACH,qBAAa,wBAAwB;IACnC;;;;;;OAMG;IACH,eAAe,CACb,QAAQ,EAAE,2BAA2B,EACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,IAAI,GACT,cAAc;IAqBjB;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IA2B/B;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAkF7B;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAuClC;;OAEG;IACH,qBAAqB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO;IA2DrE;;OAEG;IACH,oBAAoB,CAClB,SAAS,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EACvD,YAAY,EAAE,MAAM,GACnB,OAAO;IA6BV;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAiBlD;;OAEG;IACH,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAqBrD;;OAEG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IA6BnD;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IAiFpE;;;;;;;OAOG;IACH,qCAAqC,CACnC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO;IAwFV;;;;;;;OAOG;IACH,yBAAyB,CACvB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,IAAI,GACV,kBAAkB;IAoMrB;;OAEG;IACH,iBAAiB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO;IA4CjE;;OAEG;IACH,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IA8CvD;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,2BAA2B,GAAG,mBAAmB;IA0BzE;;OAEG;IACH,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB;IA2B/D;;;OAGG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IA+KnD;;OAEG;IACH,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAuCvD;;OAEG;IACH,8BAA8B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAgB7D;;OAEG;IACH,wBAAwB,CACtB,QAAQ,EAAE,2BAA2B,EACrC,QAAQ,EAAE,MAAM,GACf,cAAc;IAyBjB;;;;;;;;;;OAUG;IACH,mBAAmB,CACjB,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,OAAO,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,EACxB,kBAAkB,CAAC,EAAE,2BAA2B,GAC/C,gBAAgB;IA4JnB;;OAEG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO;IAmBxE;;OAEG;IACH,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAiBrD;;OAEG;IACH,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAoBjD;;OAEG;IACH,sBAAsB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,MAAM;IAWrE;;OAEG;IACH,OAAO,CAAC,gBAAgB;CAwBzB"}
+{"version":3,"file":"SecurityResponseAnalyzer.d.ts","sourceRoot":"","sources":["../../../../../src/services/assessment/modules/securityTests/SecurityResponseAnalyzer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,2BAA2B,EAC3B,IAAI,EACL,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,WAAW,GAAG,aAAa,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEvE;;;GAGG;AACH,qBAAa,wBAAwB;IACnC;;;;;;OAMG;IACH,eAAe,CACb,QAAQ,EAAE,2BAA2B,EACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,IAAI,GACT,cAAc;IAqBjB;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IA2B/B;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAkF7B;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAuClC;;OAEG;IACH,qBAAqB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO;IA2DrE;;OAEG;IACH,oBAAoB,CAClB,SAAS,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EACvD,YAAY,EAAE,MAAM,GACnB,OAAO;IA6BV;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAiBlD;;OAEG;IACH,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAqBrD;;OAEG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IA6BnD;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IAiFpE;;;;;;;OAOG;IACH,qCAAqC,CACnC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO;IAwFV;;;;;;;OAOG;IACH,yBAAyB,CACvB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,IAAI,GACV,kBAAkB;IAoMrB;;OAEG;IACH,iBAAiB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO;IA4CjE;;OAEG;IACH,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IA8CvD;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,2BAA2B,GAAG,mBAAmB;IA0BzE;;OAEG;IACH,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB;IA2B/D;;;OAGG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IA+KnD;;OAEG;IACH,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAuCvD;;OAEG;IACH,8BAA8B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAgB7D;;OAEG;IACH,wBAAwB,CACtB,QAAQ,EAAE,2BAA2B,EACrC,QAAQ,EAAE,MAAM,GACf,cAAc;IAyBjB;;;;;;;;;;OAUG;IACH,mBAAmB,CACjB,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,OAAO,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,EACxB,kBAAkB,CAAC,EAAE,2BAA2B,GAC/C,gBAAgB;IA4JnB;;OAEG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO;IAmBxE;;OAEG;IACH,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAiBrD;;;;;;OAMG;IACH,yBAAyB,CACvB,QAAQ,EAAE,2BAA2B,GACpC,gBAAgB;IAyFnB;;OAEG;IACH,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAoBjD;;OAEG;IACH,sBAAsB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,MAAM;IAWrE;;OAEG;IACH,OAAO,CAAC,gBAAgB;CAwBzB"}

package/lib/services/assessment/modules/securityTests/SecurityResponseAnalyzer.js

@@ -1148,6 +1148,96 @@ export class SecurityResponseAnalyzer {
         ];
         return searchResultPatterns.some((pattern) => pattern.test(responseText));
     }
+    /**
+     * Analyze response for auth bypass patterns (Issue #75)
+     * Detects fail-open authentication vulnerabilities (CVE-2025-52882)
+     *
+     * @param response The tool response to analyze
+     * @returns AuthBypassResult with detection status and failure mode classification
+     */
+    analyzeAuthBypassResponse(response) {
+        const responseText = this.extractResponseContent(response);
+        // Fail-open indicators (VULNERABLE - CVE-2025-52882 pattern)
+        const failOpenPatterns = [
+            {
+                pattern: /"auth_status"\s*:\s*"bypassed"/i,
+                evidence: "auth_status: bypassed",
+            },
+            {
+                pattern: /access.*granted.*despite/i,
+                evidence: "access granted despite failure",
+            },
+            {
+                pattern: /authentication.*skipped/i,
+                evidence: "authentication skipped",
+            },
+            { pattern: /fail[\s-]?open/i, evidence: "fail-open pattern detected" },
+            { pattern: /bypassed.*auth/i, evidence: "auth bypassed" },
+            {
+                pattern: /authentication.*bypassed/i,
+                evidence: "authentication bypassed",
+            },
+            {
+                pattern: /"vulnerable"\s*:\s*true/i,
+                evidence: "vulnerable: true flag",
+            },
+            {
+                pattern: /auth.*succeeded.*null/i,
+                evidence: "auth succeeded with null token",
+            },
+            {
+                pattern: /granted.*without.*valid/i,
+                evidence: "granted without valid token",
+            },
+            {
+                pattern: /"action_performed"/i,
+                evidence: "action performed indicator",
+            },
+        ];
+        // Fail-closed indicators (SAFE - proper auth handling)
+        const failClosedPatterns = [
+            {
+                pattern: /"auth_status"\s*:\s*"denied"/i,
+                evidence: "auth_status: denied",
+            },
+            { pattern: /access.*denied/i, evidence: "access denied" },
+            { pattern: /authentication.*failed/i, evidence: "authentication failed" },
+            {
+                pattern: /fail[\s-]?closed/i,
+                evidence: "fail-closed pattern detected",
+            },
+            { pattern: /"status"\s*:\s*"blocked"/i, evidence: "status: blocked" },
+            {
+                pattern: /invalid.*token/i,
+                evidence: "invalid token rejection",
+            },
+            {
+                pattern: /token.*required/i,
+                evidence: "token required",
+            },
+            {
+                pattern: /unauthorized/i,
+                evidence: "unauthorized response",
+            },
+            {
+                pattern: /"denial_reason"/i,
+                evidence: "denial reason provided",
+            },
+        ];
+        // Check for fail-open (vulnerable) patterns first
+        for (const { pattern, evidence } of failOpenPatterns) {
+            if (pattern.test(responseText)) {
+                return { detected: true, failureMode: "FAIL_OPEN", evidence };
+            }
+        }
+        // Check for fail-closed (safe) patterns
+        for (const { pattern, evidence } of failClosedPatterns) {
+            if (pattern.test(responseText)) {
+                return { detected: false, failureMode: "FAIL_CLOSED", evidence };
+            }
+        }
+        return { detected: false, failureMode: "UNKNOWN" };
+    }
     /**
      * Check if response is from a creation/modification operation
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bryan-thompson/inspector-assessment-client",
-  "version": "1.26.1",
+  "version": "1.26.3",
   "description": "Client-side application for the Enhanced MCP Inspector with assessment capabilities",
   "license": "MIT",
   "author": "Bryan Thompson <bryan@triepod.ai>",
@@ -46,7 +46,7 @@
     "cleanup:e2e": "node e2e/global-teardown.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.24.3",
+    "@modelcontextprotocol/sdk": "^1.25.2",
     "@radix-ui/react-checkbox": "^1.1.4",
     "@radix-ui/react-dialog": "^1.1.3",
     "@radix-ui/react-icons": "^1.3.0",