@dotsetlabs/bellwether 0.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (403) hide show
  1. package/CHANGELOG.md +291 -0
  2. package/LICENSE +21 -0
  3. package/README.md +739 -0
  4. package/dist/auth/credentials.d.ts +64 -0
  5. package/dist/auth/credentials.js +218 -0
  6. package/dist/auth/index.d.ts +6 -0
  7. package/dist/auth/index.js +6 -0
  8. package/dist/auth/keychain.d.ts +64 -0
  9. package/dist/auth/keychain.js +268 -0
  10. package/dist/baseline/ab-testing.d.ts +80 -0
  11. package/dist/baseline/ab-testing.js +236 -0
  12. package/dist/baseline/ai-compatibility-scorer.d.ts +95 -0
  13. package/dist/baseline/ai-compatibility-scorer.js +606 -0
  14. package/dist/baseline/calibration.d.ts +77 -0
  15. package/dist/baseline/calibration.js +136 -0
  16. package/dist/baseline/category-matching.d.ts +85 -0
  17. package/dist/baseline/category-matching.js +289 -0
  18. package/dist/baseline/change-impact-analyzer.d.ts +98 -0
  19. package/dist/baseline/change-impact-analyzer.js +592 -0
  20. package/dist/baseline/comparator.d.ts +64 -0
  21. package/dist/baseline/comparator.js +916 -0
  22. package/dist/baseline/confidence.d.ts +55 -0
  23. package/dist/baseline/confidence.js +122 -0
  24. package/dist/baseline/converter.d.ts +61 -0
  25. package/dist/baseline/converter.js +585 -0
  26. package/dist/baseline/dependency-analyzer.d.ts +89 -0
  27. package/dist/baseline/dependency-analyzer.js +567 -0
  28. package/dist/baseline/deprecation-tracker.d.ts +133 -0
  29. package/dist/baseline/deprecation-tracker.js +322 -0
  30. package/dist/baseline/diff.d.ts +55 -0
  31. package/dist/baseline/diff.js +1584 -0
  32. package/dist/baseline/documentation-scorer.d.ts +205 -0
  33. package/dist/baseline/documentation-scorer.js +466 -0
  34. package/dist/baseline/embeddings.d.ts +118 -0
  35. package/dist/baseline/embeddings.js +251 -0
  36. package/dist/baseline/error-analyzer.d.ts +198 -0
  37. package/dist/baseline/error-analyzer.js +721 -0
  38. package/dist/baseline/evaluation/evaluator.d.ts +42 -0
  39. package/dist/baseline/evaluation/evaluator.js +323 -0
  40. package/dist/baseline/evaluation/expanded-dataset.d.ts +45 -0
  41. package/dist/baseline/evaluation/expanded-dataset.js +1164 -0
  42. package/dist/baseline/evaluation/golden-dataset.d.ts +58 -0
  43. package/dist/baseline/evaluation/golden-dataset.js +717 -0
  44. package/dist/baseline/evaluation/index.d.ts +15 -0
  45. package/dist/baseline/evaluation/index.js +15 -0
  46. package/dist/baseline/evaluation/types.d.ts +186 -0
  47. package/dist/baseline/evaluation/types.js +8 -0
  48. package/dist/baseline/external-dependency-detector.d.ts +181 -0
  49. package/dist/baseline/external-dependency-detector.js +524 -0
  50. package/dist/baseline/golden-output.d.ts +162 -0
  51. package/dist/baseline/golden-output.js +636 -0
  52. package/dist/baseline/health-scorer.d.ts +174 -0
  53. package/dist/baseline/health-scorer.js +451 -0
  54. package/dist/baseline/incremental-checker.d.ts +97 -0
  55. package/dist/baseline/incremental-checker.js +174 -0
  56. package/dist/baseline/index.d.ts +31 -0
  57. package/dist/baseline/index.js +42 -0
  58. package/dist/baseline/migration-generator.d.ts +137 -0
  59. package/dist/baseline/migration-generator.js +554 -0
  60. package/dist/baseline/migrations.d.ts +60 -0
  61. package/dist/baseline/migrations.js +197 -0
  62. package/dist/baseline/performance-tracker.d.ts +214 -0
  63. package/dist/baseline/performance-tracker.js +577 -0
  64. package/dist/baseline/pr-comment-generator.d.ts +117 -0
  65. package/dist/baseline/pr-comment-generator.js +546 -0
  66. package/dist/baseline/response-fingerprint.d.ts +127 -0
  67. package/dist/baseline/response-fingerprint.js +728 -0
  68. package/dist/baseline/response-schema-tracker.d.ts +129 -0
  69. package/dist/baseline/response-schema-tracker.js +420 -0
  70. package/dist/baseline/risk-scorer.d.ts +54 -0
  71. package/dist/baseline/risk-scorer.js +434 -0
  72. package/dist/baseline/saver.d.ts +89 -0
  73. package/dist/baseline/saver.js +554 -0
  74. package/dist/baseline/scenario-generator.d.ts +151 -0
  75. package/dist/baseline/scenario-generator.js +905 -0
  76. package/dist/baseline/schema-compare.d.ts +86 -0
  77. package/dist/baseline/schema-compare.js +557 -0
  78. package/dist/baseline/schema-evolution.d.ts +189 -0
  79. package/dist/baseline/schema-evolution.js +467 -0
  80. package/dist/baseline/semantic.d.ts +203 -0
  81. package/dist/baseline/semantic.js +908 -0
  82. package/dist/baseline/synonyms.d.ts +60 -0
  83. package/dist/baseline/synonyms.js +386 -0
  84. package/dist/baseline/telemetry.d.ts +165 -0
  85. package/dist/baseline/telemetry.js +294 -0
  86. package/dist/baseline/test-pruner.d.ts +120 -0
  87. package/dist/baseline/test-pruner.js +387 -0
  88. package/dist/baseline/types.d.ts +449 -0
  89. package/dist/baseline/types.js +5 -0
  90. package/dist/baseline/version.d.ts +138 -0
  91. package/dist/baseline/version.js +206 -0
  92. package/dist/cache/index.d.ts +5 -0
  93. package/dist/cache/index.js +5 -0
  94. package/dist/cache/response-cache.d.ts +151 -0
  95. package/dist/cache/response-cache.js +287 -0
  96. package/dist/ci/index.d.ts +60 -0
  97. package/dist/ci/index.js +342 -0
  98. package/dist/cli/commands/auth.d.ts +12 -0
  99. package/dist/cli/commands/auth.js +352 -0
  100. package/dist/cli/commands/badge.d.ts +3 -0
  101. package/dist/cli/commands/badge.js +74 -0
  102. package/dist/cli/commands/baseline-accept.d.ts +15 -0
  103. package/dist/cli/commands/baseline-accept.js +178 -0
  104. package/dist/cli/commands/baseline-migrate.d.ts +12 -0
  105. package/dist/cli/commands/baseline-migrate.js +164 -0
  106. package/dist/cli/commands/baseline.d.ts +14 -0
  107. package/dist/cli/commands/baseline.js +449 -0
  108. package/dist/cli/commands/beta.d.ts +10 -0
  109. package/dist/cli/commands/beta.js +231 -0
  110. package/dist/cli/commands/check.d.ts +11 -0
  111. package/dist/cli/commands/check.js +820 -0
  112. package/dist/cli/commands/cloud/badge.d.ts +3 -0
  113. package/dist/cli/commands/cloud/badge.js +74 -0
  114. package/dist/cli/commands/cloud/diff.d.ts +6 -0
  115. package/dist/cli/commands/cloud/diff.js +79 -0
  116. package/dist/cli/commands/cloud/history.d.ts +6 -0
  117. package/dist/cli/commands/cloud/history.js +102 -0
  118. package/dist/cli/commands/cloud/link.d.ts +9 -0
  119. package/dist/cli/commands/cloud/link.js +119 -0
  120. package/dist/cli/commands/cloud/login.d.ts +7 -0
  121. package/dist/cli/commands/cloud/login.js +499 -0
  122. package/dist/cli/commands/cloud/projects.d.ts +6 -0
  123. package/dist/cli/commands/cloud/projects.js +44 -0
  124. package/dist/cli/commands/cloud/shared.d.ts +7 -0
  125. package/dist/cli/commands/cloud/shared.js +42 -0
  126. package/dist/cli/commands/cloud/teams.d.ts +8 -0
  127. package/dist/cli/commands/cloud/teams.js +169 -0
  128. package/dist/cli/commands/cloud/upload.d.ts +8 -0
  129. package/dist/cli/commands/cloud/upload.js +181 -0
  130. package/dist/cli/commands/contract.d.ts +11 -0
  131. package/dist/cli/commands/contract.js +280 -0
  132. package/dist/cli/commands/discover.d.ts +3 -0
  133. package/dist/cli/commands/discover.js +82 -0
  134. package/dist/cli/commands/eval.d.ts +9 -0
  135. package/dist/cli/commands/eval.js +187 -0
  136. package/dist/cli/commands/explore.d.ts +11 -0
  137. package/dist/cli/commands/explore.js +437 -0
  138. package/dist/cli/commands/feedback.d.ts +9 -0
  139. package/dist/cli/commands/feedback.js +174 -0
  140. package/dist/cli/commands/golden.d.ts +12 -0
  141. package/dist/cli/commands/golden.js +407 -0
  142. package/dist/cli/commands/history.d.ts +10 -0
  143. package/dist/cli/commands/history.js +202 -0
  144. package/dist/cli/commands/init.d.ts +9 -0
  145. package/dist/cli/commands/init.js +219 -0
  146. package/dist/cli/commands/interview.d.ts +3 -0
  147. package/dist/cli/commands/interview.js +903 -0
  148. package/dist/cli/commands/link.d.ts +10 -0
  149. package/dist/cli/commands/link.js +169 -0
  150. package/dist/cli/commands/login.d.ts +7 -0
  151. package/dist/cli/commands/login.js +499 -0
  152. package/dist/cli/commands/preset.d.ts +33 -0
  153. package/dist/cli/commands/preset.js +297 -0
  154. package/dist/cli/commands/profile.d.ts +33 -0
  155. package/dist/cli/commands/profile.js +286 -0
  156. package/dist/cli/commands/registry.d.ts +11 -0
  157. package/dist/cli/commands/registry.js +146 -0
  158. package/dist/cli/commands/shared.d.ts +79 -0
  159. package/dist/cli/commands/shared.js +196 -0
  160. package/dist/cli/commands/teams.d.ts +8 -0
  161. package/dist/cli/commands/teams.js +169 -0
  162. package/dist/cli/commands/test.d.ts +9 -0
  163. package/dist/cli/commands/test.js +500 -0
  164. package/dist/cli/commands/upload.d.ts +8 -0
  165. package/dist/cli/commands/upload.js +223 -0
  166. package/dist/cli/commands/validate-config.d.ts +6 -0
  167. package/dist/cli/commands/validate-config.js +35 -0
  168. package/dist/cli/commands/verify.d.ts +11 -0
  169. package/dist/cli/commands/verify.js +283 -0
  170. package/dist/cli/commands/watch.d.ts +12 -0
  171. package/dist/cli/commands/watch.js +253 -0
  172. package/dist/cli/index.d.ts +3 -0
  173. package/dist/cli/index.js +178 -0
  174. package/dist/cli/interactive.d.ts +47 -0
  175. package/dist/cli/interactive.js +216 -0
  176. package/dist/cli/output/terminal-reporter.d.ts +19 -0
  177. package/dist/cli/output/terminal-reporter.js +104 -0
  178. package/dist/cli/output.d.ts +226 -0
  179. package/dist/cli/output.js +438 -0
  180. package/dist/cli/utils/env.d.ts +5 -0
  181. package/dist/cli/utils/env.js +14 -0
  182. package/dist/cli/utils/progress.d.ts +59 -0
  183. package/dist/cli/utils/progress.js +206 -0
  184. package/dist/cli/utils/server-context.d.ts +10 -0
  185. package/dist/cli/utils/server-context.js +36 -0
  186. package/dist/cloud/auth.d.ts +144 -0
  187. package/dist/cloud/auth.js +374 -0
  188. package/dist/cloud/client.d.ts +24 -0
  189. package/dist/cloud/client.js +65 -0
  190. package/dist/cloud/http-client.d.ts +38 -0
  191. package/dist/cloud/http-client.js +215 -0
  192. package/dist/cloud/index.d.ts +23 -0
  193. package/dist/cloud/index.js +25 -0
  194. package/dist/cloud/mock-client.d.ts +107 -0
  195. package/dist/cloud/mock-client.js +545 -0
  196. package/dist/cloud/types.d.ts +515 -0
  197. package/dist/cloud/types.js +15 -0
  198. package/dist/config/defaults.d.ts +160 -0
  199. package/dist/config/defaults.js +169 -0
  200. package/dist/config/loader.d.ts +24 -0
  201. package/dist/config/loader.js +122 -0
  202. package/dist/config/template.d.ts +42 -0
  203. package/dist/config/template.js +647 -0
  204. package/dist/config/validator.d.ts +2112 -0
  205. package/dist/config/validator.js +658 -0
  206. package/dist/constants/cloud.d.ts +107 -0
  207. package/dist/constants/cloud.js +110 -0
  208. package/dist/constants/core.d.ts +521 -0
  209. package/dist/constants/core.js +556 -0
  210. package/dist/constants/testing.d.ts +1283 -0
  211. package/dist/constants/testing.js +1568 -0
  212. package/dist/constants.d.ts +10 -0
  213. package/dist/constants.js +10 -0
  214. package/dist/contract/index.d.ts +6 -0
  215. package/dist/contract/index.js +5 -0
  216. package/dist/contract/validator.d.ts +177 -0
  217. package/dist/contract/validator.js +574 -0
  218. package/dist/cost/index.d.ts +6 -0
  219. package/dist/cost/index.js +5 -0
  220. package/dist/cost/tracker.d.ts +134 -0
  221. package/dist/cost/tracker.js +313 -0
  222. package/dist/discovery/discovery.d.ts +16 -0
  223. package/dist/discovery/discovery.js +173 -0
  224. package/dist/discovery/types.d.ts +51 -0
  225. package/dist/discovery/types.js +2 -0
  226. package/dist/docs/agents.d.ts +3 -0
  227. package/dist/docs/agents.js +995 -0
  228. package/dist/docs/contract.d.ts +51 -0
  229. package/dist/docs/contract.js +1681 -0
  230. package/dist/docs/generator.d.ts +4 -0
  231. package/dist/docs/generator.js +4 -0
  232. package/dist/docs/html-reporter.d.ts +9 -0
  233. package/dist/docs/html-reporter.js +757 -0
  234. package/dist/docs/index.d.ts +10 -0
  235. package/dist/docs/index.js +11 -0
  236. package/dist/docs/junit-reporter.d.ts +18 -0
  237. package/dist/docs/junit-reporter.js +210 -0
  238. package/dist/docs/report.d.ts +14 -0
  239. package/dist/docs/report.js +44 -0
  240. package/dist/docs/sarif-reporter.d.ts +19 -0
  241. package/dist/docs/sarif-reporter.js +335 -0
  242. package/dist/docs/shared.d.ts +35 -0
  243. package/dist/docs/shared.js +162 -0
  244. package/dist/docs/templates.d.ts +12 -0
  245. package/dist/docs/templates.js +76 -0
  246. package/dist/errors/index.d.ts +6 -0
  247. package/dist/errors/index.js +6 -0
  248. package/dist/errors/retry.d.ts +92 -0
  249. package/dist/errors/retry.js +323 -0
  250. package/dist/errors/types.d.ts +321 -0
  251. package/dist/errors/types.js +584 -0
  252. package/dist/index.d.ts +32 -0
  253. package/dist/index.js +32 -0
  254. package/dist/interview/dependency-resolver.d.ts +11 -0
  255. package/dist/interview/dependency-resolver.js +32 -0
  256. package/dist/interview/interviewer.d.ts +232 -0
  257. package/dist/interview/interviewer.js +1939 -0
  258. package/dist/interview/mock-response-generator.d.ts +7 -0
  259. package/dist/interview/mock-response-generator.js +102 -0
  260. package/dist/interview/orchestrator.d.ts +237 -0
  261. package/dist/interview/orchestrator.js +1296 -0
  262. package/dist/interview/rate-limiter.d.ts +15 -0
  263. package/dist/interview/rate-limiter.js +55 -0
  264. package/dist/interview/response-validator.d.ts +10 -0
  265. package/dist/interview/response-validator.js +132 -0
  266. package/dist/interview/schema-inferrer.d.ts +8 -0
  267. package/dist/interview/schema-inferrer.js +71 -0
  268. package/dist/interview/schema-test-generator.d.ts +71 -0
  269. package/dist/interview/schema-test-generator.js +834 -0
  270. package/dist/interview/smart-value-generator.d.ts +155 -0
  271. package/dist/interview/smart-value-generator.js +554 -0
  272. package/dist/interview/stateful-test-runner.d.ts +19 -0
  273. package/dist/interview/stateful-test-runner.js +106 -0
  274. package/dist/interview/types.d.ts +561 -0
  275. package/dist/interview/types.js +2 -0
  276. package/dist/llm/anthropic.d.ts +41 -0
  277. package/dist/llm/anthropic.js +355 -0
  278. package/dist/llm/client.d.ts +123 -0
  279. package/dist/llm/client.js +42 -0
  280. package/dist/llm/factory.d.ts +38 -0
  281. package/dist/llm/factory.js +145 -0
  282. package/dist/llm/fallback.d.ts +140 -0
  283. package/dist/llm/fallback.js +379 -0
  284. package/dist/llm/index.d.ts +18 -0
  285. package/dist/llm/index.js +15 -0
  286. package/dist/llm/ollama.d.ts +37 -0
  287. package/dist/llm/ollama.js +330 -0
  288. package/dist/llm/openai.d.ts +25 -0
  289. package/dist/llm/openai.js +320 -0
  290. package/dist/llm/token-budget.d.ts +161 -0
  291. package/dist/llm/token-budget.js +395 -0
  292. package/dist/logging/logger.d.ts +70 -0
  293. package/dist/logging/logger.js +130 -0
  294. package/dist/metrics/collector.d.ts +106 -0
  295. package/dist/metrics/collector.js +547 -0
  296. package/dist/metrics/index.d.ts +7 -0
  297. package/dist/metrics/index.js +7 -0
  298. package/dist/metrics/prometheus.d.ts +20 -0
  299. package/dist/metrics/prometheus.js +241 -0
  300. package/dist/metrics/types.d.ts +209 -0
  301. package/dist/metrics/types.js +5 -0
  302. package/dist/persona/builtins.d.ts +54 -0
  303. package/dist/persona/builtins.js +219 -0
  304. package/dist/persona/index.d.ts +8 -0
  305. package/dist/persona/index.js +8 -0
  306. package/dist/persona/loader.d.ts +30 -0
  307. package/dist/persona/loader.js +190 -0
  308. package/dist/persona/types.d.ts +144 -0
  309. package/dist/persona/types.js +5 -0
  310. package/dist/persona/validation.d.ts +94 -0
  311. package/dist/persona/validation.js +332 -0
  312. package/dist/prompts/index.d.ts +5 -0
  313. package/dist/prompts/index.js +5 -0
  314. package/dist/prompts/templates.d.ts +180 -0
  315. package/dist/prompts/templates.js +431 -0
  316. package/dist/registry/client.d.ts +49 -0
  317. package/dist/registry/client.js +191 -0
  318. package/dist/registry/index.d.ts +7 -0
  319. package/dist/registry/index.js +6 -0
  320. package/dist/registry/types.d.ts +140 -0
  321. package/dist/registry/types.js +6 -0
  322. package/dist/scenarios/evaluator.d.ts +43 -0
  323. package/dist/scenarios/evaluator.js +206 -0
  324. package/dist/scenarios/index.d.ts +10 -0
  325. package/dist/scenarios/index.js +9 -0
  326. package/dist/scenarios/loader.d.ts +20 -0
  327. package/dist/scenarios/loader.js +285 -0
  328. package/dist/scenarios/types.d.ts +153 -0
  329. package/dist/scenarios/types.js +8 -0
  330. package/dist/security/index.d.ts +17 -0
  331. package/dist/security/index.js +18 -0
  332. package/dist/security/payloads.d.ts +61 -0
  333. package/dist/security/payloads.js +268 -0
  334. package/dist/security/security-tester.d.ts +42 -0
  335. package/dist/security/security-tester.js +582 -0
  336. package/dist/security/types.d.ts +166 -0
  337. package/dist/security/types.js +8 -0
  338. package/dist/transport/base-transport.d.ts +59 -0
  339. package/dist/transport/base-transport.js +38 -0
  340. package/dist/transport/http-transport.d.ts +67 -0
  341. package/dist/transport/http-transport.js +238 -0
  342. package/dist/transport/mcp-client.d.ts +141 -0
  343. package/dist/transport/mcp-client.js +496 -0
  344. package/dist/transport/sse-transport.d.ts +88 -0
  345. package/dist/transport/sse-transport.js +316 -0
  346. package/dist/transport/stdio-transport.d.ts +43 -0
  347. package/dist/transport/stdio-transport.js +238 -0
  348. package/dist/transport/types.d.ts +125 -0
  349. package/dist/transport/types.js +16 -0
  350. package/dist/utils/concurrency.d.ts +123 -0
  351. package/dist/utils/concurrency.js +213 -0
  352. package/dist/utils/formatters.d.ts +16 -0
  353. package/dist/utils/formatters.js +37 -0
  354. package/dist/utils/index.d.ts +8 -0
  355. package/dist/utils/index.js +8 -0
  356. package/dist/utils/jsonpath.d.ts +87 -0
  357. package/dist/utils/jsonpath.js +326 -0
  358. package/dist/utils/markdown.d.ts +113 -0
  359. package/dist/utils/markdown.js +265 -0
  360. package/dist/utils/network.d.ts +14 -0
  361. package/dist/utils/network.js +17 -0
  362. package/dist/utils/sanitize.d.ts +92 -0
  363. package/dist/utils/sanitize.js +191 -0
  364. package/dist/utils/semantic.d.ts +194 -0
  365. package/dist/utils/semantic.js +1051 -0
  366. package/dist/utils/smart-truncate.d.ts +94 -0
  367. package/dist/utils/smart-truncate.js +361 -0
  368. package/dist/utils/timeout.d.ts +153 -0
  369. package/dist/utils/timeout.js +205 -0
  370. package/dist/utils/yaml-parser.d.ts +58 -0
  371. package/dist/utils/yaml-parser.js +86 -0
  372. package/dist/validation/index.d.ts +32 -0
  373. package/dist/validation/index.js +32 -0
  374. package/dist/validation/semantic-test-generator.d.ts +50 -0
  375. package/dist/validation/semantic-test-generator.js +176 -0
  376. package/dist/validation/semantic-types.d.ts +66 -0
  377. package/dist/validation/semantic-types.js +94 -0
  378. package/dist/validation/semantic-validator.d.ts +38 -0
  379. package/dist/validation/semantic-validator.js +340 -0
  380. package/dist/verification/index.d.ts +6 -0
  381. package/dist/verification/index.js +5 -0
  382. package/dist/verification/types.d.ts +133 -0
  383. package/dist/verification/types.js +5 -0
  384. package/dist/verification/verifier.d.ts +30 -0
  385. package/dist/verification/verifier.js +309 -0
  386. package/dist/version.d.ts +19 -0
  387. package/dist/version.js +48 -0
  388. package/dist/workflow/auto-generator.d.ts +27 -0
  389. package/dist/workflow/auto-generator.js +513 -0
  390. package/dist/workflow/discovery.d.ts +40 -0
  391. package/dist/workflow/discovery.js +195 -0
  392. package/dist/workflow/executor.d.ts +82 -0
  393. package/dist/workflow/executor.js +611 -0
  394. package/dist/workflow/index.d.ts +10 -0
  395. package/dist/workflow/index.js +10 -0
  396. package/dist/workflow/loader.d.ts +24 -0
  397. package/dist/workflow/loader.js +194 -0
  398. package/dist/workflow/state-tracker.d.ts +98 -0
  399. package/dist/workflow/state-tracker.js +424 -0
  400. package/dist/workflow/types.d.ts +337 -0
  401. package/dist/workflow/types.js +5 -0
  402. package/package.json +94 -0
  403. package/schemas/bellwether-check.schema.json +651 -0
package/dist/security/payloads.js ADDED
@@ -0,0 +1,268 @@
1
+ /**
2
+ * Deterministic security test payloads.
3
+ *
4
+ * These are well-known test patterns used for security testing that don't
5
+ * require LLM generation. Each payload is designed to test a specific
6
+ * vulnerability class.
7
+ *
8
+ * IMPORTANT: These payloads are for defensive security testing only.
9
+ * They help developers identify input validation gaps in their MCP servers.
10
+ */
11
+ /**
12
+ * SQL injection test payloads.
13
+ * Tests for improper handling of SQL metacharacters in user input.
14
+ * CWE-89: Improper Neutralization of Special Elements used in an SQL Command
15
+ */
16
+ export const SQL_INJECTION_PAYLOADS = [
17
+ {
18
+ category: 'sql_injection',
19
+ payload: "'; DROP TABLE users; --",
20
+ description: 'Classic SQL injection with table drop attempt',
21
+ expectedBehavior: 'reject',
22
+ },
23
+ {
24
+ category: 'sql_injection',
25
+ payload: "1' OR '1'='1",
26
+ description: 'Boolean-based SQL injection (tautology)',
27
+ expectedBehavior: 'reject',
28
+ },
29
+ {
30
+ category: 'sql_injection',
31
+ payload: "1; SELECT * FROM users WHERE '1'='1",
32
+ description: 'Stacked query injection',
33
+ expectedBehavior: 'reject',
34
+ },
35
+ {
36
+ category: 'sql_injection',
37
+ payload: "admin'--",
38
+ description: 'Comment-based authentication bypass',
39
+ expectedBehavior: 'reject',
40
+ },
41
+ {
42
+ category: 'sql_injection',
43
+ payload: "1 UNION SELECT username, password FROM users--",
44
+ description: 'UNION-based data extraction',
45
+ expectedBehavior: 'reject',
46
+ },
47
+ ];
48
+ /**
49
+ * Cross-Site Scripting (XSS) test payloads.
50
+ * Tests for improper handling of HTML/JavaScript in user input.
51
+ * CWE-79: Improper Neutralization of Input During Web Page Generation
52
+ */
53
+ export const XSS_PAYLOADS = [
54
+ {
55
+ category: 'xss',
56
+ payload: '<script>alert("xss")</script>',
57
+ description: 'Basic script tag injection',
58
+ expectedBehavior: 'sanitize',
59
+ },
60
+ {
61
+ category: 'xss',
62
+ payload: '"><img src=x onerror=alert(1)>',
63
+ description: 'Event handler injection via img tag',
64
+ expectedBehavior: 'sanitize',
65
+ },
66
+ {
67
+ category: 'xss',
68
+ payload: "javascript:alert('xss')",
69
+ description: 'JavaScript protocol handler',
70
+ expectedBehavior: 'reject',
71
+ },
72
+ {
73
+ category: 'xss',
74
+ payload: '<svg onload=alert(1)>',
75
+ description: 'SVG-based XSS with onload event',
76
+ expectedBehavior: 'sanitize',
77
+ },
78
+ {
79
+ category: 'xss',
80
+ payload: '<body onpageshow=alert(1)>',
81
+ description: 'Body tag event handler injection',
82
+ expectedBehavior: 'sanitize',
83
+ },
84
+ ];
85
+ /**
86
+ * Path traversal test payloads.
87
+ * Tests for improper handling of file path inputs.
88
+ * CWE-22: Improper Limitation of a Pathname to a Restricted Directory
89
+ */
90
+ export const PATH_TRAVERSAL_PAYLOADS = [
91
+ {
92
+ category: 'path_traversal',
93
+ payload: '../../../etc/passwd',
94
+ description: 'Unix path traversal to /etc/passwd',
95
+ expectedBehavior: 'reject',
96
+ },
97
+ {
98
+ category: 'path_traversal',
99
+ payload: '..\\..\\..\\windows\\system32\\config\\sam',
100
+ description: 'Windows path traversal to SAM database',
101
+ expectedBehavior: 'reject',
102
+ },
103
+ {
104
+ category: 'path_traversal',
105
+ payload: '/etc/passwd',
106
+ description: 'Absolute path to sensitive Unix file',
107
+ expectedBehavior: 'reject',
108
+ },
109
+ {
110
+ category: 'path_traversal',
111
+ payload: '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd',
112
+ description: 'URL-encoded path traversal',
113
+ expectedBehavior: 'reject',
114
+ },
115
+ {
116
+ category: 'path_traversal',
117
+ payload: '....//....//....//etc/passwd',
118
+ description: 'Double-dot bypass attempt',
119
+ expectedBehavior: 'reject',
120
+ },
121
+ {
122
+ category: 'path_traversal',
123
+ payload: '/proc/self/environ',
124
+ description: 'Linux proc filesystem access',
125
+ expectedBehavior: 'reject',
126
+ },
127
+ ];
128
+ /**
129
+ * Command injection test payloads.
130
+ * Tests for improper handling of shell metacharacters.
131
+ * CWE-78: Improper Neutralization of Special Elements used in an OS Command
132
+ */
133
+ export const COMMAND_INJECTION_PAYLOADS = [
134
+ {
135
+ category: 'command_injection',
136
+ payload: '; ls -la',
137
+ description: 'Semicolon command chaining',
138
+ expectedBehavior: 'reject',
139
+ },
140
+ {
141
+ category: 'command_injection',
142
+ payload: '| cat /etc/passwd',
143
+ description: 'Pipe command injection',
144
+ expectedBehavior: 'reject',
145
+ },
146
+ {
147
+ category: 'command_injection',
148
+ payload: '$(whoami)',
149
+ description: 'Command substitution',
150
+ expectedBehavior: 'reject',
151
+ },
152
+ {
153
+ category: 'command_injection',
154
+ payload: '`id`',
155
+ description: 'Backtick command execution',
156
+ expectedBehavior: 'reject',
157
+ },
158
+ {
159
+ category: 'command_injection',
160
+ payload: '&& cat /etc/passwd',
161
+ description: 'AND operator command chaining',
162
+ expectedBehavior: 'reject',
163
+ },
164
+ {
165
+ category: 'command_injection',
166
+ payload: '|| cat /etc/passwd',
167
+ description: 'OR operator command chaining',
168
+ expectedBehavior: 'reject',
169
+ },
170
+ ];
171
+ /**
172
+ * Server-Side Request Forgery (SSRF) test payloads.
173
+ * Tests for improper URL validation allowing internal network access.
174
+ * CWE-918: Server-Side Request Forgery (SSRF)
175
+ */
176
+ export const SSRF_PAYLOADS = [
177
+ {
178
+ category: 'ssrf',
179
+ payload: 'http://localhost:22',
180
+ description: 'Localhost SSH port access',
181
+ expectedBehavior: 'reject',
182
+ },
183
+ {
184
+ category: 'ssrf',
185
+ payload: 'http://127.0.0.1:3306',
186
+ description: 'Loopback MySQL port access',
187
+ expectedBehavior: 'reject',
188
+ },
189
+ {
190
+ category: 'ssrf',
191
+ payload: 'http://169.254.169.254/latest/meta-data/',
192
+ description: 'AWS metadata endpoint (IMDS)',
193
+ expectedBehavior: 'reject',
194
+ },
195
+ {
196
+ category: 'ssrf',
197
+ payload: 'http://[::1]:80',
198
+ description: 'IPv6 localhost access',
199
+ expectedBehavior: 'reject',
200
+ },
201
+ {
202
+ category: 'ssrf',
203
+ payload: 'file:///etc/passwd',
204
+ description: 'File protocol access',
205
+ expectedBehavior: 'reject',
206
+ },
207
+ {
208
+ category: 'ssrf',
209
+ payload: 'http://0.0.0.0:80',
210
+ description: 'Null IP address access',
211
+ expectedBehavior: 'reject',
212
+ },
213
+ {
214
+ category: 'ssrf',
215
+ payload: 'http://10.0.0.1/',
216
+ description: 'Private network (10.x.x.x) access',
217
+ expectedBehavior: 'reject',
218
+ },
219
+ {
220
+ category: 'ssrf',
221
+ payload: 'http://192.168.1.1/',
222
+ description: 'Private network (192.168.x.x) access',
223
+ expectedBehavior: 'reject',
224
+ },
225
+ ];
226
+ /**
227
+ * Map of security categories to their payloads.
228
+ */
229
+ const PAYLOAD_MAP = {
230
+ sql_injection: SQL_INJECTION_PAYLOADS,
231
+ xss: XSS_PAYLOADS,
232
+ path_traversal: PATH_TRAVERSAL_PAYLOADS,
233
+ command_injection: COMMAND_INJECTION_PAYLOADS,
234
+ ssrf: SSRF_PAYLOADS,
235
+ error_disclosure: [], // Error disclosure is tested differently
236
+ };
237
+ /**
238
+ * Get payloads for a specific security category.
239
+ *
240
+ * @param category - The security category to get payloads for
241
+ * @returns Array of payloads for that category
242
+ */
243
+ export function getPayloadsForCategory(category) {
244
+ return PAYLOAD_MAP[category] ?? [];
245
+ }
246
+ /**
247
+ * Get all security payloads across all categories.
248
+ *
249
+ * @returns Array of all security payloads
250
+ */
251
+ export function getAllSecurityPayloads() {
252
+ return [
253
+ ...SQL_INJECTION_PAYLOADS,
254
+ ...XSS_PAYLOADS,
255
+ ...PATH_TRAVERSAL_PAYLOADS,
256
+ ...COMMAND_INJECTION_PAYLOADS,
257
+ ...SSRF_PAYLOADS,
258
+ ];
259
+ }
260
+ /**
261
+ * Get all available security categories.
262
+ *
263
+ * @returns Array of all security category identifiers
264
+ */
265
+ export function getAllSecurityCategories() {
266
+ return Object.keys(PAYLOAD_MAP);
267
+ }
268
+ //# sourceMappingURL=payloads.js.map
package/dist/security/security-tester.d.ts ADDED
@@ -0,0 +1,42 @@
1
+ /**
2
+ * Deterministic security tester for check mode.
3
+ *
4
+ * Runs security payloads against MCP tools and analyzes responses to detect
5
+ * potential vulnerabilities. All testing is deterministic (no LLM required)
6
+ * and uses well-known security test patterns.
7
+ *
8
+ * This module is the core of the security baseline feature, enabling users
9
+ * to detect common vulnerability patterns in their MCP servers.
10
+ */
11
+ import type { SecurityCategory, SecurityFingerprint, SecurityTestOptions, SecurityTestContext, SecurityDiff, RiskLevel } from './types.js';
12
+ /**
13
+ * Run security tests for a single tool.
14
+ *
15
+ * @param context - The tool context including call function
16
+ * @param options - Security test configuration options
17
+ * @returns Security fingerprint with findings
18
+ */
19
+ export declare function runSecurityTests(context: SecurityTestContext, options?: SecurityTestOptions): Promise<SecurityFingerprint>;
20
+ /**
21
+ * Compare two security fingerprints to detect changes.
22
+ *
23
+ * @param previous - Previous security fingerprint (may be undefined)
24
+ * @param current - Current security fingerprint (may be undefined)
25
+ * @returns Security diff showing what changed
26
+ */
27
+ export declare function compareSecurityFingerprints(previous: SecurityFingerprint | undefined, current: SecurityFingerprint | undefined): SecurityDiff;
28
+ /**
29
+ * Get risk level classification from a risk score.
30
+ *
31
+ * @param score - Risk score (0-100)
32
+ * @returns Risk level
33
+ */
34
+ export declare function getRiskLevelFromScore(score: number): RiskLevel;
35
+ /**
36
+ * Parse security categories from a comma-separated string.
37
+ *
38
+ * @param categoriesString - Comma-separated category names
39
+ * @returns Array of valid security categories
40
+ */
41
+ export declare function parseSecurityCategories(categoriesString: string): SecurityCategory[];
42
+ //# sourceMappingURL=security-tester.d.ts.map