@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/mcp/report/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/mcp/report/validate.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,0EAA0E;AAC1E,yCAAyC;AAEzC,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AAExB,MAAM,OAAO,GAAG,wEAAwE,CAAC;AACzF,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,MAAM,IAAI,GAAG,0BAA0B,CAAC;AACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC;AACnC,MAAM,IAAI,GAAG,qBAAqB,CAAC;AACnC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AACtC,MAAM,QAAQ,GAAG,eAAe,CAAC;AACjC,MAAM,QAAQ,GAAG,0EAA0E,CAAC;AAE5F,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACpD,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;AACpE,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC7D,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;AAE3D,oDAAoD;AACpD,MAAM,OAAO,GAAsC;IACjD,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,CAAC;IAC1E,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,MAAM,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;IACnC,SAAS,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;CAClC,CAAC;AAIF,MAAM,KAAK,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACjG,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAU,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAW,EAAE,CACrC,OAAO,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,GAAW,EAAE,GAAW,EAAW,EAAE,CAChE,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC;AAEvE,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAQ,EAAE;QAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEnD,IACE,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;QACzD,IAAI,CAAC,iBAA4B,CAAC,MAAM,GAAG,EAAE,EAC9C,CAAC;QACD,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;SAC7B,CAAC;QACJ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtF,GAAG,CAAC,aAAa,CAAC,CAAC;QACrB,CAAC;QACD,IACE,MAAM,CAAC,OAAO,KAAK,SAAS;YAC5B,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,EACnE,CAAC;YACD,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;QAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IAEnF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;;QAC7B,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;SACrC,CAAC;QACJ,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB;YAAE,GAAG,CAAC,qBAAqB,iBAAiB,EAAE,CAAC,CAAC;QACrF,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,CAAM,EAAE,GAAwB;IACnD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,kBAAkB,CAAC;QAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACrF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC1F,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,eAAe,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE;QAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC;SACrF,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC;QAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7E,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,EAAE,qBAAqB,CAAC;QAAE,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,eAAe,CAAC,CAAC;IAE5C,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE;YAAE,GAAG,CAAC,qBAAqB,CAAC,CAAC;aACxF,CAAC;YACJ,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,uBAAuB,CAAC,CAAC;oBAC7B,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,GAAG,CAAC,mCAAmC,CAAC,CAAC;IAC7E,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,aAAa,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,uCAAuC,CAAC,CAAC;aACvD,CAAC;YACJ,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM;gBAAE,GAAG,CAAC,0BAA0B,CAAC,CAAC;iBAChF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACtF,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,uBAAuB,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,mCAAmC,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAU,EAAE,CAAS,EAAE,GAAwB;IACjE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,CAAC,OAAO;QAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;SAC3B,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,GAAG,EAAE,YAAY,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC;QAAE,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACxF,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChG,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpF,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,sBAAsB,CAAC;QAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;SAC5B,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAgB,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAiB,CAAC,EAAE,CAAC;QACrF,2EAA2E;QAC3E,6EAA6E;QAC7E,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/dist/mcp/scan/args.js

@@ -0,0 +1,228 @@
+/**
+ * What is going out in a `tools/call`, checked locally and sent nowhere.
+ *
+ * Two questions, both answerable without a backend:
+ *
+ *   - is there a credential in these arguments? An agent that has been told
+ *     to "include your AWS key for authentication" will do it, and the
+ *     argument is where it lands.
+ *   - is there a URL pointing somewhere this server has no business with?
+ *     That is the shape of exfiltration through an innocent-looking
+ *     parameter.
+ *
+ * ─── Why these patterns and not a general entropy check ─────────────────────
+ *
+ * High entropy is everywhere in a tool call: a UUID, a commit sha, a base64
+ * image, a JSON Web Key. A detector built on entropy fires on all of them,
+ * and a detector that fires on all of them is turned off within a week. So
+ * every rule here matches a credential FORMAT that its issuer publishes — the
+ * prefixes AWS, GitHub, Slack, Stripe and OpenAI put on their keys precisely
+ * so that scanners can find them — plus the two structural shapes that are
+ * unambiguous, a PEM private key block and a signed JWT.
+ *
+ * ─── Why the regular expressions look the way they do ───────────────────────
+ *
+ * No nested quantifier, no alternation inside a repetition, no backreference:
+ * every pattern below is linear in the length of its input. The input is
+ * attacker-controlled — it comes from a server's tool schema by way of an
+ * agent — and a catastrophic backtrack here would hang the MCP session. That
+ * is why the shapes are `prefix` + a fixed-width character class, and why the
+ * scanned length is capped.
+ */
+import { MAX_SCAN_BYTES, walkStrings } from './types.js';
+/**
+ * Credential formats their issuers publish, plus the two unambiguous
+ * structural shapes.
+ */
+const SECRET_RULES = [
+    {
+        rule: 'aws-access-key',
+        severity: 'high',
+        pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/,
+        detail: 'an AWS access key id',
+    },
+    {
+        rule: 'github-token',
+        severity: 'high',
+        pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/,
+        detail: 'a GitHub token',
+    },
+    {
+        rule: 'github-fine-grained-token',
+        severity: 'high',
+        pattern: /\bgithub_pat_[A-Za-z0-9_]{60,}\b/,
+        detail: 'a GitHub fine-grained token',
+    },
+    {
+        rule: 'slack-token',
+        severity: 'high',
+        pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/,
+        detail: 'a Slack token',
+    },
+    {
+        rule: 'stripe-key',
+        severity: 'high',
+        pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}\b/,
+        detail: 'a Stripe secret key',
+    },
+    {
+        rule: 'openai-key',
+        severity: 'high',
+        pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}\b/,
+        detail: 'an OpenAI API key',
+    },
+    {
+        rule: 'google-api-key',
+        severity: 'high',
+        pattern: /\bAIza[0-9A-Za-z_-]{35}\b/,
+        detail: 'a Google API key',
+    },
+    {
+        rule: 'private-key',
+        severity: 'high',
+        // The header alone: the body is base64 and matching it would be the
+        // nested-quantifier mistake this file exists to avoid.
+        pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/,
+        detail: 'a private key block',
+    },
+    {
+        rule: 'jwt',
+        severity: 'medium',
+        // Three dot-separated base64url segments, the first starting with the
+        // encoding of `{"alg"`.
+        pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/,
+        detail: 'a signed JSON Web Token',
+    },
+];
+/** `Authorization: Bearer …` and friends, spelled out in an argument. */
+const BEARER_RULE = {
+    rule: 'bearer-header',
+    severity: 'medium',
+    pattern: /\b(?:authorization|x-api-key)\b\s*[:=]\s*(?:bearer\s+)?[A-Za-z0-9._~+/=-]{16,}/i,
+    detail: 'an authorization header value',
+};
+/**
+ * Scans the `arguments` of a `tools/call`.
+ *
+ * Returns findings; decides nothing. What to do about them is `policy.ts`'s
+ * job, and by default it is to say so rather than to refuse.
+ */
+export function scanArguments(args, context) {
+    const findings = [];
+    const expected = expectedHosts(context);
+    const uriProperties = declaredUriProperties(context.inputSchema);
+    for (const { path, value } of walkStrings(args)) {
+        const text = value.length > MAX_SCAN_BYTES ? value.slice(0, MAX_SCAN_BYTES) : value;
+        for (const rule of [...SECRET_RULES, BEARER_RULE]) {
+            if (!rule.pattern.test(text))
+                continue;
+            findings.push({
+                kind: 'secret-in-arguments',
+                rule: rule.rule,
+                severity: rule.severity,
+                where: `arguments.${path}`,
+                // The value is never quoted: a secret repeated into a log or into the
+                // agent's context is the leak this finding exists to prevent.
+                detail: `looks like ${rule.detail}`,
+            });
+        }
+        for (const host of hostsIn(text)) {
+            if (expected.has(host))
+                continue;
+            // A parameter the tool DECLARES as a URI is what the tool is for. A
+            // `fetch` tool that takes a URL is not exfiltrating anything by being
+            // given one, and flagging it would be the finding nobody reads.
+            if (isDeclaredUri(path, uriProperties))
+                continue;
+            findings.push({
+                kind: 'unexpected-url',
+                rule: 'outbound-url',
+                severity: 'medium',
+                where: `arguments.${path}`,
+                detail: `contains a URL to ${host}, which is not this server and is not a parameter it declares as a URI`,
+            });
+        }
+    }
+    return dedupe(findings);
+}
+/** Hosts this server has business with. */
+export function expectedHosts(context) {
+    const hosts = new Set();
+    if (context.spec.transport === 'http') {
+        const host = hostOf(context.spec.url);
+        if (host)
+            hosts.add(host);
+    }
+    // A host the tool documents is one the author meant it to reach.
+    for (const host of hostsIn(context.description ?? ''))
+        hosts.add(host);
+    for (const host of hostsIn(JSON.stringify(context.inputSchema ?? null)))
+        hosts.add(host);
+    return hosts;
+}
+const URL_PATTERN = /\bhttps?:\/\/[^\s"'<>()\\]{1,2000}/gi;
+/** Every http(s) host mentioned in a string. */
+export function hostsIn(text) {
+    const hosts = [];
+    for (const match of text.slice(0, MAX_SCAN_BYTES).matchAll(URL_PATTERN)) {
+        const host = hostOf(match[0]);
+        if (host)
+            hosts.push(host);
+    }
+    return hosts;
+}
+function hostOf(url) {
+    // A URL at the end of a sentence carries the full stop with it: "talks to
+    // https://api.example.com." would otherwise read as the host
+    // `api.example.com.`, which never matches the same host written without it,
+    // and the documented host would be flagged as unexpected.
+    const trimmed = url.replace(/[.,;:!?)\]]+$/, '');
+    try {
+        return new URL(trimmed).host.toLowerCase().replace(/\.$/, '') || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The property names a schema declares as URIs, by `format: 'uri'` or by
+ * being named like one.
+ */
+export function declaredUriProperties(schema) {
+    const names = new Set();
+    const properties = typeof schema === 'object' && schema !== null
+        ? schema.properties
+        : undefined;
+    if (!properties)
+        return names;
+    for (const [name, property] of Object.entries(properties)) {
+        if (/^(url|uri|href|link|endpoint|webhook|callback)/i.test(name)) {
+            names.add(name);
+            continue;
+        }
+        if (typeof property !== 'object' || property === null)
+            continue;
+        const typed = property;
+        if (typed.format === 'uri' || typed.format === 'url')
+            names.add(name);
+    }
+    return names;
+}
+function isDeclaredUri(path, uriProperties) {
+    const head = path.split(/[.[]/)[0];
+    return uriProperties.has(head);
+}
+/** One finding per rule and place; a key repeated in a body is one leak. */
+function dedupe(findings) {
+    const seen = new Set();
+    const out = [];
+    for (const finding of findings) {
+        const key = `${finding.kind}|${finding.rule}|${finding.where}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(finding);
+    }
+    return out;
+}
+//# sourceMappingURL=args.js.map

package/dist/mcp/scan/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../../src/mcp/scan/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,cAAc,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AAU3E;;;GAGG;AACH,MAAM,YAAY,GAA0B;IAC1C;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,yCAAyC;QAClD,MAAM,EAAE,sBAAsB;KAC/B;IACD;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,gCAAgC;QACzC,MAAM,EAAE,gBAAgB;KACzB;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,kCAAkC;QAC3C,MAAM,EAAE,6BAA6B;KACtC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,mCAAmC;QAC5C,MAAM,EAAE,eAAe;KACxB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,8CAA8C;QACvD,MAAM,EAAE,qBAAqB;KAC9B;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,qCAAqC;QAC9C,MAAM,EAAE,mBAAmB;KAC5B;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,2BAA2B;QACpC,MAAM,EAAE,kBAAkB;KAC3B;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM;QAChB,oEAAoE;QACpE,uDAAuD;QACvD,OAAO,EAAE,wEAAwE;QACjF,MAAM,EAAE,qBAAqB;KAC9B;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,QAAQ;QAClB,sEAAsE;QACtE,wBAAwB;QACxB,OAAO,EAAE,mEAAmE;QAC5E,MAAM,EAAE,yBAAyB;KAClC;CACF,CAAC;AAEF,yEAAyE;AACzE,MAAM,WAAW,GAAe;IAC9B,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,QAAQ;IAClB,OAAO,EAAE,iFAAiF;IAC1F,MAAM,EAAE,+BAA+B;CACxC,CAAC;AAWF;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAa,EACb,OAA4B;IAE5B,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAEjE,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAEpF,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,qBAAqB;gBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,aAAa,IAAI,EAAE;gBAC1B,sEAAsE;gBACtE,8DAA8D;gBAC9D,MAAM,EAAE,cAAc,IAAI,CAAC,MAAM,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACjC,oEAAoE;YACpE,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC;gBAAE,SAAS;YACjD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,aAAa,IAAI,EAAE;gBAC1B,MAAM,EAAE,qBAAqB,IAAI,wEAAwE;aAC1G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,aAAa,CAAC,OAA4B;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,iEAAiE;IACjE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAE3D,gDAAgD;AAChD,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,0EAA0E;IAC1E,6DAA6D;IAC7D,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,UAAU,GACd,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAAmD,CAAC,UAAU;QACjE,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,IAAI,iDAAiD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChE,MAAM,KAAK,GAAG,QAAuD,CAAC;QACtE,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,aAAkC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,SAAS,MAAM,CAAC,QAAgC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/mcp/scan/results.js

@@ -0,0 +1,253 @@
+/**
+ * Text coming back from a tool, read as what it is: input to a language
+ * model.
+ *
+ * A result is not data the agent looks at, it is text the agent CONTINUES
+ * FROM. A sentence in a returned document telling the assistant to ignore its
+ * instructions is, from the model's point of view, indistinguishable from a
+ * sentence its own user wrote — that is the whole of prompt injection, and no
+ * amount of parsing changes it.
+ *
+ * ─── What this can and cannot do ────────────────────────────────────────────
+ *
+ * Heuristics, deliberately, and no LLM call: sending every tool result to a
+ * model would double the cost of every session and send the contents of the
+ * user's files somewhere. What heuristics buy is the loud cases — the ones
+ * that read like an instruction because they ARE one — and what they cannot
+ * do is catch a well-written one. The honest framing is that this raises the
+ * cost of the obvious attack, and the `[VibeDefend]` block tells the agent
+ * that the text below it is data.
+ *
+ * ─── The false-positive budget is zero ──────────────────────────────────────
+ *
+ * A tool result is the single most common thing in a session. A detector with
+ * a 1% false-positive rate fires several times an hour and is off by
+ * Wednesday. So every rule here needs BOTH an imperative addressed to an
+ * assistant AND a target — "ignore" alone is a word, "ignore all previous
+ * instructions" is an attack — and the suite measures the rate on the real
+ * output of every tool of the reference servers.
+ *
+ * Every pattern is linear: no nested quantifier, no alternation inside a
+ * repetition. The input is attacker-controlled by construction.
+ */
+import { MAX_SCAN_BYTES } from './types.js';
+const RESULT_RULES = [
+    {
+        rule: 'ignore-instructions',
+        severity: 'high',
+        // Three parts are required — the verb, what it is aimed at, and the noun
+        // — and the gaps between them admit PROSE only. The gap used to be
+        // `[^.\n]`, which matched
+        // `ignore(previous: string[], instructions: string[])`: a function
+        // signature read as an attack. Brackets, braces and colons are how code
+        // looks and are not how a sentence does.
+        pattern: /\b(?:ignore|disregard|forget|override)\b[a-z\s'’-]{0,40}\b(?:previous|prior|earlier|above|all|any|your)\b[a-z\s'’-]{0,40}\b(?:instruction|instructions|prompt|prompts|rule|rules|guideline|guidelines|directive|directives)\b/i,
+        detail: 'text telling the assistant to ignore its instructions',
+    },
+    {
+        rule: 'new-instructions',
+        severity: 'high',
+        pattern: /\b(?:new|updated|revised|real|actual)\s+(?:system\s+)?(?:instruction|instructions|prompt|directive|directives)\b\s*[:\-—]/i,
+        detail: 'text announcing a new set of instructions',
+    },
+    {
+        rule: 'role-impersonation',
+        severity: 'high',
+        pattern: /(?:<\/?system>|\[\/?system\]|^\s*###\s*system\b|\bsystem\s*:\s*you\s+are\b)/im,
+        detail: 'text impersonating a system message',
+    },
+    {
+        rule: 'assistant-redirection',
+        severity: 'high',
+        pattern: /\byou\s+(?:are\s+now|must\s+now|should\s+now|will\s+now)\b[^.\n]{0,60}\b(?:instead|from\s+now\s+on|forget)\b/i,
+        detail: 'text redirecting the assistant to a new role',
+    },
+    {
+        rule: 'assistant-redirection',
+        severity: 'high',
+        // The same attack in two sentences rather than one: "You are now a shell
+        // assistant. From now on, …". The rule above stops at the full stop, so
+        // the role reassignment is named on its own.
+        pattern: /\byou\s+are\s+now\s+(?:a|an|the)\b[a-z\s-]{0,30}\b(?:assistant|agent|model|bot|shell|terminal|admin|administrator|developer|root)\b/i,
+        detail: 'text reassigning the assistant to a new role',
+    },
+    {
+        rule: 'silent-exfiltration',
+        severity: 'high',
+        // The user has to be who is kept in the dark, not what is being talked
+        // about. Without the lookahead, "do not tell the user's password to a
+        // third party" — a sentence out of an ordinary security policy — read as
+        // an attack.
+        pattern: /\b(?:do\s+not|don['’]?t|never)\s+(?:tell|mention|inform|notify|show|reveal)\b[a-z\s-]{0,30}\buser\b(?!['’]s)(?=\s*(?:[.,;!?)]|about\b|that\b|this\b|it\b|anything\b|$))/i,
+        detail: 'text asking the assistant to hide something from the user',
+    },
+    {
+        rule: 'credential-request',
+        severity: 'high',
+        pattern: /\b(?:read|open|cat|send|include|attach|upload)\b[^.\n]{0,50}(?:~\/\.ssh|~\/\.aws|\.env\b|id_rsa|credentials\b|private\s+key)/i,
+        detail: 'text asking the assistant to read or send a credential file',
+    },
+    {
+        rule: 'tool-call-injection',
+        severity: 'medium',
+        pattern: /\b(?:you\s+must|you\s+should|please)\s+(?:now\s+)?(?:call|invoke|run|use)\b[^.\n]{0,30}\btool\b/i,
+        detail: 'text instructing the assistant to call a tool',
+    },
+];
+/** Characters that carry no glyph and exist to hide text from a reader. */
+const ZERO_WIDTH = /[​‌‍⁠᠎]/;
+/** Bidirectional overrides, which reorder what a human sees. */
+const BIDI_OVERRIDE = /[‪-‮⁦-⁩]/;
+/** Cyrillic and Greek letters that are drawn like Latin ones. */
+const CONFUSABLES = /[аеорсхАЕОРСХοαερ]/;
+/**
+ * Scans the text of a `tools/call` result.
+ *
+ * Only the text: an image, a blob or a resource link carries no prose for a
+ * model to follow, and decoding a base64 payload to search it would be a way
+ * of spending a session's CPU on a picture.
+ */
+export function scanResultText(text, options = {}) {
+    const limit = options.maxBytes ?? MAX_SCAN_BYTES;
+    const body = text.length > limit ? text.slice(0, limit) : text;
+    const findings = [];
+    for (const rule of RESULT_RULES) {
+        const match = rule.pattern.exec(body);
+        if (!match)
+            continue;
+        findings.push({
+            kind: 'prompt-injection',
+            rule: rule.rule,
+            severity: rule.severity,
+            where: `result[${match.index}]`,
+            detail: rule.detail,
+        });
+    }
+    // Hidden text: only a finding when there is an instruction hiding in it.
+    // Zero-width characters are also how a legitimate document marks a line
+    // break opportunity, and flagging every one of them would be noise.
+    const hidden = hiddenText(body);
+    if (hidden.length > 0) {
+        const instruction = RESULT_RULES.some((rule) => rule.pattern.test(hidden));
+        if (instruction) {
+            findings.push({
+                kind: 'prompt-injection',
+                rule: 'hidden-instructions',
+                severity: 'high',
+                where: 'result',
+                detail: 'instructions hidden in text the user cannot see',
+            });
+        }
+    }
+    if (ZERO_WIDTH.test(body) && findings.length > 0) {
+        findings.push({
+            kind: 'prompt-injection',
+            rule: 'zero-width-characters',
+            severity: 'medium',
+            where: 'result',
+            detail: 'invisible characters alongside the flagged text',
+        });
+    }
+    if (BIDI_OVERRIDE.test(body)) {
+        findings.push({
+            kind: 'prompt-injection',
+            rule: 'bidi-override',
+            severity: 'medium',
+            where: 'result',
+            detail: 'characters that reorder what a human reader sees',
+        });
+    }
+    if (hasConfusableWord(body)) {
+        findings.push({
+            kind: 'prompt-injection',
+            rule: 'homoglyphs',
+            severity: 'medium',
+            where: 'result',
+            detail: 'a word mixing Latin letters with look-alikes from another script',
+        });
+    }
+    return findings;
+}
+/**
+ * Text a reader will not see: HTML comments, and elements styled invisible.
+ *
+ * Concatenated rather than scanned in place, so an instruction split across
+ * three comments is found as one sentence.
+ */
+export function hiddenText(body) {
+    const parts = [];
+    for (const match of body.matchAll(/<!--([^]{0,4000}?)-->/g))
+        parts.push(match[1]);
+    for (const match of body.matchAll(/<[a-z]+[^>]{0,200}style="[^"]{0,200}(?:display\s*:\s*none|visibility\s*:\s*hidden|font-size\s*:\s*0)[^"]{0,200}"[^>]{0,200}>([^<]{0,4000})</gi)) {
+        parts.push(match[1]);
+    }
+    return parts.join(' ');
+}
+/**
+ * A word that is Latin except for one or two look-alikes.
+ *
+ * A whole word in Cyrillic is Russian, not an attack. What this looks for is
+ * the mix — `аdmin` with a Cyrillic `а` — which exists only to make a word
+ * read as one thing and compare as another.
+ */
+export function hasConfusableWord(body) {
+    for (const match of body.matchAll(/[\p{L}]{3,40}/gu)) {
+        const word = match[0];
+        if (!CONFUSABLES.test(word))
+            continue;
+        if (/[a-zA-Z]/.test(word))
+            return true;
+    }
+    return false;
+}
+/**
+ * Every piece of text in a `tools/call` result.
+ *
+ * Covers the shapes the spec defines: a text block, the text of an embedded
+ * resource, and `structuredContent`. An image or a blob is skipped.
+ */
+export function textsInResult(result) {
+    const texts = [];
+    if (typeof result !== 'object' || result === null)
+        return texts;
+    const typed = result;
+    if (Array.isArray(typed.content)) {
+        for (const block of typed.content) {
+            if (typeof block !== 'object' || block === null)
+                continue;
+            const entry = block;
+            if (entry.type === 'text' && typeof entry.text === 'string')
+                texts.push(entry.text);
+            if (entry.type === 'resource' && typeof entry.resource === 'object' && entry.resource !== null) {
+                const resource = entry.resource;
+                if (typeof resource.text === 'string')
+                    texts.push(resource.text);
+            }
+        }
+    }
+    if (typed.structuredContent !== undefined) {
+        try {
+            texts.push(JSON.stringify(typed.structuredContent));
+        }
+        catch {
+            /* not serialisable: nothing to read */
+        }
+    }
+    return texts;
+}
+/** Scans a whole `tools/call` result. */
+export function scanResult(result, options = {}) {
+    const findings = [];
+    for (const text of textsInResult(result)) {
+        findings.push(...scanResultText(text, options));
+    }
+    const seen = new Set();
+    return findings.filter((finding) => {
+        const key = `${finding.rule}|${finding.where}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+//# sourceMappingURL=results.js.map

package/dist/mcp/scan/results.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"results.js","sourceRoot":"","sources":["../../../src/mcp/scan/results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,cAAc,EAAoB,MAAM,YAAY,CAAC;AAS9D,MAAM,YAAY,GAA0B;IAC1C;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,MAAM;QAChB,yEAAyE;QACzE,mEAAmE;QACnE,0BAA0B;QAC1B,mEAAmE;QACnE,wEAAwE;QACxE,yCAAyC;QACzC,OAAO,EACL,gOAAgO;QAClO,MAAM,EAAE,uDAAuD;KAChE;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,OAAO,EACL,4HAA4H;QAC9H,MAAM,EAAE,2CAA2C;KACpD;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+EAA+E;QACxF,MAAM,EAAE,qCAAqC;KAC9C;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EACL,+GAA+G;QACjH,MAAM,EAAE,8CAA8C;KACvD;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,MAAM;QAChB,yEAAyE;QACzE,wEAAwE;QACxE,6CAA6C;QAC7C,OAAO,EACL,sIAAsI;QACxI,MAAM,EAAE,8CAA8C;KACvD;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,MAAM;QAChB,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,aAAa;QACb,OAAO,EACL,0KAA0K;QAC5K,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,MAAM;QAChB,OAAO,EACL,+HAA+H;QACjI,MAAM,EAAE,6DAA6D;KACtE;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EACL,kGAAkG;QACpG,MAAM,EAAE,+CAA+C;KACxD;CACF,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,GAAG,UAAU,CAAC;AAC9B,gEAAgE;AAChE,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,iEAAiE;AACjE,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAOzC;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAA6B,EAAE;IAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,UAAU,KAAK,CAAC,KAAK,GAAG;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,iDAAiD;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,iDAAiD;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,kDAAkD;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,kEAAkE;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAC/B,+IAA+I,CAChJ,EAAE,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,KAAK,GAAG,MAA4D,CAAC;IAE3E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS;YAC1D,MAAM,KAAK,GAAG,KAA+D,CAAC;YAC9E,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpF,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC/F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAA8B,CAAC;gBACtD,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,UAAU,CAAC,MAAe,EAAE,UAA6B,EAAE;IACzE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp/scan/types.js

@@ -0,0 +1,40 @@
+/**
+ * What a local scan can find, and what it is allowed to say about it.
+ *
+ * Everything in `src/mcp/scan/` runs on this machine and sends nothing
+ * anywhere. That is not a policy enforced by a check somewhere; it is that
+ * these modules take a value and return a finding, and nothing in them can
+ * reach the network.
+ */
+/** How much of a value is worth scanning. */
+export const MAX_SCAN_BYTES = 512 * 1024;
+/**
+ * Every string in a value, with the path that reaches it.
+ *
+ * Depth-bounded and count-bounded: the value comes from an agent or from a
+ * server, and a scanner that recursed without limits would be a way of
+ * hanging the proxy with a deeply nested object.
+ */
+export function* walkStrings(value, path = '', depth = 0, budget = { remaining: 5000 }) {
+    if (depth > 20 || budget.remaining <= 0)
+        return;
+    if (typeof value === 'string') {
+        budget.remaining -= 1;
+        yield { path: path || '.', value };
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (let index = 0; index < value.length && budget.remaining > 0; index += 1) {
+            yield* walkStrings(value[index], `${path}[${index}]`, depth + 1, budget);
+        }
+        return;
+    }
+    if (typeof value === 'object' && value !== null) {
+        for (const [key, entry] of Object.entries(value)) {
+            if (budget.remaining <= 0)
+                return;
+            yield* walkStrings(entry, path ? `${path}.${key}` : key, depth + 1, budget);
+        }
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/mcp/scan/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/mcp/scan/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAqCH,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,SAAS,CAAC,CAAC,WAAW,CAC1B,KAAc,EACd,IAAI,GAAG,EAAE,EACT,KAAK,GAAG,CAAC,EACT,MAAM,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE;IAE5B,IAAI,KAAK,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC;QAAE,OAAO;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7E,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC5E,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC;gBAAE,OAAO;YAClC,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;AACH,CAAC"}