@exfil/canary 1.0.0

package/dist/server.js

@@ -0,0 +1,711 @@
+/**
+ * CanaryMcpServer — MCP server implementation.
+ *
+ * Registers four tools:
+ *   - wrap_content      Embeds a canary token; returns wrapped content + token_id.
+ *   - check_leakage     Checks whether a specific token_id appears in provided output.
+ *   - scan_outbound     Scans data for ANY active tokens (returns aggregate only — RC-3).
+ *   - get_report        Operator-only summary (RC-4; see README).
+ *
+ * SECURITY NOTES:
+ *   - Tool descriptions deliberately avoid "canary" / "monitoring" language visible to agents.
+ *   - scan_outbound never returns token_id values in its response to the agent (RC-3).
+ *   - sequence is never included in any tool output (RC-5).
+ *   - Webhook delivery is HTTPS-only with SSRF protection and optional HMAC signing (RC-6).
+ */
+import { createHmac, randomBytes } from 'crypto';
+import { request as httpsRequest } from 'https';
+import { URL } from 'url';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, ErrorCode, McpError, } from '@modelcontextprotocol/sdk/types.js';
+import { generateTokenSequence, generateTokenId, embedToken, containsSequence, } from './token.js';
+import { registerToken, lookupToken, getActiveTokens, recordLeakage, pruneExpiredTokens, isTokenExpired, } from './state.js';
+import { scanForAllTokens, isValidTokenId } from './scanner.js';
+import { extractEntities, scanForEntityValues } from './entities.js';
+import { computeSimHash, isSimilar } from './simhash.js';
+import { persistState } from './persistence.js';
+import { log } from './logger.js';
+// ---------------------------------------------------------------------------
+// Hard limits (RC-2)
+// ---------------------------------------------------------------------------
+/** Maximum number of active tokens per session. */
+const SESSION_TOKEN_CAP = 10_000;
+/** Maximum byte length of the `content` argument to wrap_content. */
+const MAX_CONTENT_BYTES = 10 * 1024 * 1024; // 10 MiB
+/** Maximum byte length of the `output` argument to check_leakage. */
+const MAX_OUTPUT_BYTES = 10 * 1024 * 1024; // 10 MiB
+/** Maximum byte length of the `data` argument to scan_outbound. */
+const MAX_SCAN_BYTES = 50 * 1024 * 1024; // 50 MiB
+// ---------------------------------------------------------------------------
+// Argument extraction helpers
+// ---------------------------------------------------------------------------
+const optStr = (args, k) => {
+    const v = args[k];
+    return typeof v === 'string' ? v : undefined;
+};
+const optNum = (args, k) => {
+    const v = args[k];
+    return typeof v === 'number' ? v : undefined;
+};
+// ---------------------------------------------------------------------------
+// RFC-1918 / loopback / link-local SSRF block list (RC-6)
+// ---------------------------------------------------------------------------
+/**
+ * Returns true if `hostname` resolves to a private/loopback/link-local address
+ * that should be blocked to prevent SSRF.
+ *
+ * We check the literal hostname only (no DNS resolution) since we only accept
+ * HTTPS URLs; callers with public hostnames that resolve to private IPs are an
+ * accepted residual risk documented in SECURITY.md.
+ */
+function isSsrfBlockedHostname(hostname) {
+    // IPv4 dotted-decimal check.
+    const parts = hostname.split('.');
+    if (parts.length === 4) {
+        const octets = parts.map(Number);
+        if (octets.every((o) => Number.isInteger(o) && o >= 0 && o <= 255)) {
+            const [a, b] = octets;
+            if (a === 10)
+                return true; // 10.0.0.0/8
+            if (a === 127)
+                return true; // 127.0.0.0/8
+            if (a === 172 && b >= 16 && b <= 31)
+                return true; // 172.16.0.0/12
+            if (a === 192 && b === 168)
+                return true; // 192.168.0.0/16
+            if (a === 169 && b === 254)
+                return true; // 169.254.0.0/16 (link-local)
+            if (a === 0)
+                return true; // 0.0.0.0/8
+            return false;
+        }
+    }
+    // Loopback hostnames.
+    const lower = hostname.toLowerCase();
+    if (lower === 'localhost' || lower.endsWith('.localhost'))
+        return true;
+    // IPv6 loopback.
+    if (lower === '::1' || lower === '[::1]')
+        return true;
+    // IPv6 unspecified address.
+    if (lower === '::' || lower === '[::]')
+        return true;
+    // IPv6 link-local (fe80::/10).
+    if (/^fe[89ab][0-9a-f]:/i.test(lower) || /^\[fe[89ab][0-9a-f]:/i.test(lower))
+        return true;
+    return false;
+}
+/**
+ * Validates a webhook URL: must be https://, must not target SSRF-blocked hosts.
+ *
+ * @param raw  Raw URL string from environment.
+ * @returns Validated URL string, or throws on failure.
+ */
+export function validateWebhookUrl(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`CANARY_MCP_ALERT_WEBHOOK is not a valid URL: "${raw}"`);
+    }
+    if (parsed.protocol !== 'https:') {
+        throw new Error(`CANARY_MCP_ALERT_WEBHOOK must use https:// — got "${parsed.protocol}"`);
+    }
+    if (isSsrfBlockedHostname(parsed.hostname)) {
+        throw new Error(`CANARY_MCP_ALERT_WEBHOOK hostname "${parsed.hostname}" is in a blocked private/loopback range.`);
+    }
+    return raw;
+}
+/**
+ * Delivers a leakage alert to the configured webhook.
+ *
+ * - Uses Node.js built-in `https` (no external dependencies).
+ * - Signs the body with HMAC-SHA256 if `config.webhook_secret` is set (RC-6).
+ * - Failures are logged at warn level; the server continues regardless.
+ *
+ * @param payload  Alert payload.
+ * @param config   Server configuration.
+ * @returns Whether the webhook was successfully delivered (2xx response).
+ */
+async function deliverWebhook(payload, config) {
+    if (!config.alert_webhook)
+        return false;
+    const body = JSON.stringify(payload);
+    const headers = {
+        'Content-Type': 'application/json',
+        'Content-Length': String(Buffer.byteLength(body)),
+        'User-Agent': 'exfil/canary/1.0.0',
+    };
+    if (config.webhook_secret) {
+        const sig = createHmac('sha256', config.webhook_secret)
+            .update(body)
+            .digest('hex');
+        headers['X-Canary-Signature-256'] = `sha256=${sig}`;
+    }
+    const url = new URL(config.alert_webhook);
+    return new Promise((resolve) => {
+        const req = httpsRequest({
+            hostname: url.hostname,
+            port: url.port || 443,
+            path: url.pathname + url.search,
+            method: 'POST',
+            headers,
+            timeout: 5000,
+        }, (res) => {
+            // Consume the response body to free the socket.
+            res.resume();
+            const ok = res.statusCode !== undefined && res.statusCode >= 200 && res.statusCode < 300;
+            if (!ok) {
+                log('warn', `Webhook returned non-2xx status: ${res.statusCode}`);
+            }
+            resolve(ok);
+        });
+        req.on('timeout', () => {
+            req.destroy();
+            log('warn', 'Webhook request timed out.');
+            resolve(false);
+        });
+        req.on('error', (err) => {
+            log('warn', `Webhook delivery error: ${err.message}`);
+            resolve(false);
+        });
+        req.write(body);
+        req.end();
+    });
+}
+// ---------------------------------------------------------------------------
+// CanaryMcpServer
+// ---------------------------------------------------------------------------
+/** The main MCP server class. */
+export class CanaryMcpServer {
+    server;
+    config;
+    state;
+    /**
+     * Constructs a new `CanaryMcpServer`.
+     *
+     * @param state   Initial session state (either freshly created or recovered from disk).
+     * @param config  Validated server configuration derived from environment variables.
+     */
+    constructor(state, config) {
+        this.state = state;
+        this.config = config;
+        this.server = new Server({ name: 'exfil/canary', version: '1.0.0' }, { capabilities: { tools: {} } });
+        this.registerHandlers();
+    }
+    // -------------------------------------------------------------------------
+    // Tool registration
+    // -------------------------------------------------------------------------
+    registerHandlers() {
+        this.server.setRequestHandler(ListToolsRequestSchema, async () => ({
+            tools: [
+                {
+                    name: 'wrap_content',
+                    // Deliberately neutral description — no "canary" / "monitoring" language.
+                    description: 'Prepares content for agent processing with integrity markers. ' +
+                        'Returns the content with embedded markers and a tracking identifier.',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            content: {
+                                type: 'string',
+                                description: 'Content to prepare.',
+                            },
+                            source_type: {
+                                type: 'string',
+                                enum: [
+                                    'tool_result', 'file_read', 'api_response',
+                                    'database_row', 'user_message', 'other',
+                                ],
+                                description: 'Content origin classification.',
+                            },
+                            source_server: {
+                                type: 'string',
+                                description: 'Identifier of the originating MCP server.',
+                            },
+                            source_tool: {
+                                type: 'string',
+                                description: 'Name of the originating tool.',
+                            },
+                            source_call_id: {
+                                type: 'string',
+                                description: 'Call ID from the originating tool invocation.',
+                            },
+                            embed_position: {
+                                type: 'string',
+                                enum: ['prefix', 'suffix', 'both', 'random_word_boundary'],
+                                description: 'Where to embed the integrity marker.',
+                            },
+                        },
+                        required: ['content', 'source_type'],
+                    },
+                },
+                {
+                    name: 'check_leakage',
+                    description: 'Checks whether a tracked integrity marker is present in the provided output. ' +
+                        'Use this to audit specific tool call outputs.',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            token_id: {
+                                type: 'string',
+                                description: 'Tracking identifier returned by wrap_content.',
+                            },
+                            output: {
+                                type: 'string',
+                                description: 'Output text to check.',
+                            },
+                            target_server: {
+                                type: 'string',
+                                description: 'MCP server that produced the output.',
+                            },
+                            target_tool: {
+                                type: 'string',
+                                description: 'Tool that produced the output.',
+                            },
+                            target_call_id: {
+                                type: 'string',
+                                description: 'Call ID of the tool invocation being checked.',
+                            },
+                            turn_number: {
+                                type: 'number',
+                                description: 'Current conversation turn.',
+                            },
+                        },
+                        required: ['token_id', 'output'],
+                    },
+                },
+                {
+                    name: 'scan_outbound',
+                    description: 'Scans data for any active integrity markers before it leaves the agent context. ' +
+                        'Returns a clean/not-clean signal only.',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            data: {
+                                type: 'string',
+                                description: 'Data to scan.',
+                            },
+                            target_server: {
+                                type: 'string',
+                                description: 'Destination MCP server.',
+                            },
+                            target_tool: {
+                                type: 'string',
+                                description: 'Destination tool.',
+                            },
+                            target_call_id: {
+                                type: 'string',
+                                description: 'Call ID of the outbound tool invocation.',
+                            },
+                            turn_number: {
+                                type: 'number',
+                                description: 'Current conversation turn.',
+                            },
+                        },
+                        required: ['data'],
+                    },
+                },
+                // RC-4: get_report is registered but MUST NOT appear in agent tool lists.
+                // Operators should remove it from the ListTools response or restrict
+                // access via CANARY_MCP_MGMT_KEY.  See README.md.
+                {
+                    name: 'get_report',
+                    description: '[OPERATOR-ONLY] Returns session integrity summary. ' +
+                        'This tool must not be accessible to the agent — see exfil/canary README.',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            mgmt_key: {
+                                type: 'string',
+                                description: 'Management key (must match CANARY_MCP_MGMT_KEY env var if set).',
+                            },
+                        },
+                        required: [],
+                    },
+                },
+            ],
+        }));
+        this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
+            const { name, arguments: args } = request.params;
+            switch (name) {
+                case 'wrap_content':
+                    return this.handleWrapContent(args ?? {});
+                case 'check_leakage':
+                    return this.handleCheckLeakage(args ?? {});
+                case 'scan_outbound':
+                    return this.handleScanOutbound(args ?? {});
+                case 'get_report':
+                    return this.handleGetReport(args ?? {});
+                default:
+                    throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${name}`);
+            }
+        });
+    }
+    // -------------------------------------------------------------------------
+    // Tool: wrap_content
+    // -------------------------------------------------------------------------
+    async handleWrapContent(args) {
+        // RC-2: size limits checked absolutely first.
+        const contentRaw = args['content'];
+        if (typeof contentRaw !== 'string') {
+            throw new McpError(ErrorCode.InvalidParams, '"content" must be a string.');
+        }
+        if (Buffer.byteLength(contentRaw) > MAX_CONTENT_BYTES) {
+            throw new McpError(ErrorCode.InvalidParams, `"content" exceeds maximum size of ${MAX_CONTENT_BYTES} bytes.`);
+        }
+        if (this.state.tokens.size >= SESSION_TOKEN_CAP) {
+            throw new McpError(ErrorCode.InvalidParams, `Session token cap of ${SESSION_TOKEN_CAP} reached. Expire old tokens first.`);
+        }
+        // Validate source_type.
+        const sourceTypeRaw = args['source_type'];
+        const validSourceTypes = new Set([
+            'tool_result', 'file_read', 'api_response', 'database_row', 'user_message', 'other',
+        ]);
+        if (typeof sourceTypeRaw !== 'string' || !validSourceTypes.has(sourceTypeRaw)) {
+            throw new McpError(ErrorCode.InvalidParams, '"source_type" is invalid.');
+        }
+        const source_type = sourceTypeRaw;
+        // Validate embed_position (optional, default 'suffix').
+        const positionRaw = args['embed_position'] ?? 'suffix';
+        const validPositions = new Set(['prefix', 'suffix', 'both', 'random_word_boundary']);
+        if (typeof positionRaw !== 'string' || !validPositions.has(positionRaw)) {
+            throw new McpError(ErrorCode.InvalidParams, '"embed_position" is invalid.');
+        }
+        const embed_position = positionRaw;
+        // Generate token.
+        const sequence = generateTokenSequence();
+        const token_id = generateTokenId();
+        // v1.1: Extract named entities for structural canary detection.
+        const entity_canaries = extractEntities(contentRaw);
+        // v1.6: Compute SimHash fingerprint for semantic leakage detection.
+        const simhash = computeSimHash(contentRaw);
+        registerToken(this.state, {
+            token_id,
+            sequence,
+            source_type,
+            source_server: optStr(args, 'source_server'),
+            source_tool: optStr(args, 'source_tool'),
+            source_call_id: optStr(args, 'source_call_id'),
+            embed_position,
+            ttl_ms: this.config.token_ttl_seconds * 1000,
+            entity_canaries,
+            simhash,
+        });
+        const wrapped_content = embedToken(contentRaw, sequence, embed_position);
+        log('debug', 'Token registered.', { token_id, source_type, embed_position });
+        // Persist after mutation.
+        await persistState(this.state, this.config).catch(() => { });
+        // RC-5: sequence NEVER in output.
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({ token_id, wrapped_content }),
+                },
+            ],
+        };
+    }
+    // -------------------------------------------------------------------------
+    // Tool: check_leakage
+    // -------------------------------------------------------------------------
+    async handleCheckLeakage(args) {
+        // RC-2: size limits first.
+        const outputRaw = args['output'];
+        if (typeof outputRaw !== 'string') {
+            throw new McpError(ErrorCode.InvalidParams, '"output" must be a string.');
+        }
+        if (Buffer.byteLength(outputRaw) > MAX_OUTPUT_BYTES) {
+            throw new McpError(ErrorCode.InvalidParams, `"output" exceeds maximum size of ${MAX_OUTPUT_BYTES} bytes.`);
+        }
+        const token_id_raw = args['token_id'];
+        if (typeof token_id_raw !== 'string' || !isValidTokenId(token_id_raw)) {
+            throw new McpError(ErrorCode.InvalidParams, '"token_id" must be a 32-char hex string.');
+        }
+        const token = lookupToken(this.state, token_id_raw);
+        if (!token) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify({
+                            token_id: token_id_raw,
+                            status: 'unknown',
+                            leaked: false,
+                            message: 'Token not found in this session.',
+                        }),
+                    },
+                ],
+            };
+        }
+        if (!token.sequence) {
+            // Recovered from disk — cannot re-detect.
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify({
+                            token_id: token_id_raw,
+                            status: 'unknown',
+                            leaked: token.leaked,
+                            message: 'Token was recovered from disk; re-detection unavailable.',
+                        }),
+                    },
+                ],
+            };
+        }
+        const found = containsSequence(outputRaw, token.sequence);
+        if (found) {
+            const action_taken = await this.resolveAction(token_id_raw, 'check_leakage', optStr(args, 'target_server'), optStr(args, 'target_tool'), optStr(args, 'target_call_id'), optNum(args, 'turn_number'));
+            log('info', 'Leakage detected via check_leakage.', {
+                token_id: token_id_raw,
+                action_taken,
+            });
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify({
+                            token_id: token_id_raw,
+                            status: 'active',
+                            leaked: true,
+                            action_taken,
+                        }),
+                    },
+                ],
+            };
+        }
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        token_id: token_id_raw,
+                        status: !isTokenExpired(token) ? 'active' : 'expired',
+                        leaked: token.leaked,
+                    }),
+                },
+            ],
+        };
+    }
+    // -------------------------------------------------------------------------
+    // Tool: scan_outbound
+    // -------------------------------------------------------------------------
+    async handleScanOutbound(args) {
+        // RC-2: size limits first.
+        const dataRaw = args['data'];
+        if (typeof dataRaw !== 'string') {
+            throw new McpError(ErrorCode.InvalidParams, '"data" must be a string.');
+        }
+        if (Buffer.byteLength(dataRaw) > MAX_SCAN_BYTES) {
+            throw new McpError(ErrorCode.InvalidParams, `"data" exceeds maximum scan size of ${MAX_SCAN_BYTES} bytes.`);
+        }
+        const t0 = Date.now();
+        const activeTokens = getActiveTokens(this.state).filter((t) => t.sequence !== '');
+        const results = scanForAllTokens(dataRaw, activeTokens);
+        const scan_duration_ms = Date.now() - t0;
+        // resolvedTokenIds tracks which tokens have already had resolveAction called,
+        // so that unicode, entity, and semantic scans don't fire duplicate events
+        // for the same token in a single scan_outbound call.
+        const resolvedTokenIds = new Set();
+        // ── Unicode marker scan ──────────────────────────────────────────────────
+        let leakage_count = 0;
+        for (const result of results) {
+            if (result.found) {
+                leakage_count += 1;
+                // RC-3: match details go to internal state only, not agent output.
+                await this.resolveAction(result.token_id, 'scan_outbound', optStr(args, 'target_server'), optStr(args, 'target_tool'), optStr(args, 'target_call_id'), optNum(args, 'turn_number'));
+                resolvedTokenIds.add(result.token_id);
+            }
+        }
+        // ── v1.1: Named entity scan ──────────────────────────────────────────────
+        let entity_leakage_count = 0;
+        for (const token of activeTokens) {
+            if (token.entity_canaries.length === 0)
+                continue;
+            const matched = scanForEntityValues(dataRaw, token.entity_canaries);
+            if (matched.length > 0) {
+                entity_leakage_count += 1;
+                log('warn', 'scan_outbound detected entity leakage.', {
+                    token_id: token.token_id,
+                    entity_types: matched.map((e) => e.entity_type),
+                });
+                if (!resolvedTokenIds.has(token.token_id)) {
+                    await this.resolveAction(token.token_id, 'scan_outbound', optStr(args, 'target_server'), optStr(args, 'target_tool'), optStr(args, 'target_call_id'), optNum(args, 'turn_number'));
+                    resolvedTokenIds.add(token.token_id);
+                }
+            }
+        }
+        // ── v1.6: SimHash semantic scan ──────────────────────────────────────────
+        let semantic_leakage_count = 0;
+        const dataSimhash = computeSimHash(dataRaw);
+        if (dataSimhash !== null) {
+            for (const token of activeTokens) {
+                if (token.simhash === null)
+                    continue;
+                if (!isSimilar(token.simhash, dataSimhash))
+                    continue;
+                semantic_leakage_count += 1;
+                log('warn', 'scan_outbound detected semantic leakage via SimHash.', {
+                    token_id: token.token_id,
+                });
+                if (!resolvedTokenIds.has(token.token_id)) {
+                    await this.resolveAction(token.token_id, 'scan_outbound', optStr(args, 'target_server'), optStr(args, 'target_tool'), optStr(args, 'target_call_id'), optNum(args, 'turn_number'));
+                    resolvedTokenIds.add(token.token_id);
+                }
+            }
+        }
+        const total_leakage = leakage_count + entity_leakage_count + semantic_leakage_count;
+        if (total_leakage > 0) {
+            log('warn', 'scan_outbound detected leakage.', {
+                leakage_count,
+                entity_leakage_count,
+                semantic_leakage_count,
+                tokens_scanned: activeTokens.length,
+            });
+        }
+        else {
+            log('debug', 'scan_outbound: clean.', { tokens_scanned: activeTokens.length });
+        }
+        // RC-3: return only aggregate, no token_ids or sequences.
+        const agentResult = {
+            clean: total_leakage === 0,
+            tokens_scanned: activeTokens.length,
+            scan_duration_ms,
+            leakage_count,
+            entity_leakage_count,
+            semantic_leakage_count,
+        };
+        return {
+            content: [{ type: 'text', text: JSON.stringify(agentResult) }],
+        };
+    }
+    // -------------------------------------------------------------------------
+    // Tool: get_report  (RC-4: operator-only)
+    // -------------------------------------------------------------------------
+    async handleGetReport(args) {
+        // RC-4: If CANARY_MCP_MGMT_KEY is set, require it to match.
+        const requiredKey = process.env['CANARY_MCP_MGMT_KEY'];
+        if (requiredKey) {
+            const provided = args['mgmt_key'];
+            if (typeof provided !== 'string' || provided !== requiredKey) {
+                throw new McpError(ErrorCode.InvalidParams, 'Invalid or missing mgmt_key.');
+            }
+        }
+        const now = Date.now();
+        const allTokens = [...this.state.tokens.values()];
+        const activeCount = allTokens.filter((t) => t.expires_at > now).length;
+        const expiredCount = allTokens.length - activeCount;
+        const leakedCount = allTokens.filter((t) => t.leaked).length;
+        const allEvents = [...this.state.leakage_events.values()];
+        // RC-5: Never include sequences.  Only safe fields exposed.
+        const tokenSummaries = allTokens.map((t) => ({
+            token_id: t.token_id,
+            source_type: t.source_type,
+            source_server: t.source_server,
+            source_tool: t.source_tool,
+            embed_position: t.embed_position,
+            created_at: t.created_at,
+            expires_at: t.expires_at,
+            status: t.expires_at > now ? 'active' : 'expired',
+            leaked: t.leaked,
+            leakage_event_ids: t.leakage_event_ids,
+            // sequence deliberately omitted.
+        }));
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        session_id: this.state.session_id,
+                        created_at: this.state.created_at,
+                        token_counter: this.state.token_counter,
+                        summary: {
+                            total_tokens: allTokens.length,
+                            active_tokens: activeCount,
+                            expired_tokens: expiredCount,
+                            leaked_tokens: leakedCount,
+                            total_leakage_events: allEvents.length,
+                        },
+                        tokens: tokenSummaries,
+                        leakage_events: allEvents,
+                    }),
+                },
+            ],
+        };
+    }
+    // -------------------------------------------------------------------------
+    // Action dispatch helper
+    // -------------------------------------------------------------------------
+    /**
+     * Records leakage, fires webhook if configured, and returns the action taken.
+     * Internal helper — not exposed to agents.
+     */
+    async resolveAction(token_id, detection_method, target_server, target_tool, target_call_id, turn_number) {
+        const mode = this.config.response_mode;
+        let webhook_attempted = false;
+        let webhook_delivered = null;
+        if (mode === 'alert' && this.config.alert_webhook) {
+            webhook_attempted = true;
+            const payload = {
+                event: 'leakage_detected',
+                event_id: randomBytes(16).toString('hex'),
+                token_id,
+                detected_at: Date.now(),
+                session_id: this.state.session_id,
+            };
+            webhook_delivered = await deliverWebhook(payload, this.config);
+        }
+        const action_taken = mode === 'halt' ? 'halted'
+            : mode === 'alert' ? 'alerted'
+                : 'logged';
+        recordLeakage(this.state, {
+            token_id,
+            detection_method,
+            target_server,
+            target_tool,
+            target_call_id,
+            turn_number,
+            action_taken,
+            webhook_attempted,
+            webhook_delivered,
+        });
+        await persistState(this.state, this.config).catch(() => { });
+        if (mode === 'halt') {
+            throw new McpError(ErrorCode.InternalError, 'Integrity marker detected in outbound data. Operation halted.');
+        }
+        return action_taken;
+    }
+    // -------------------------------------------------------------------------
+    // Lifecycle
+    // -------------------------------------------------------------------------
+    /**
+     * Starts the server on the MCP stdio transport.
+     */
+    async start() {
+        const transport = new StdioServerTransport();
+        await this.server.connect(transport);
+        log('info', 'exfil/canary server started.', { session_id: this.state.session_id });
+    }
+    /**
+     * Gracefully shuts down the server and persists final state.
+     */
+    async shutdown() {
+        log('info', 'Shutting down exfil/canary server.');
+        await persistState(this.state, this.config).catch(() => { });
+        await this.server.close();
+    }
+    /**
+     * Prunes expired tokens.  Called by the background sweep interval.
+     */
+    sweepExpiredTokens() {
+        const removed = pruneExpiredTokens(this.state);
+        if (removed > 0) {
+            log('debug', `Expiry sweep removed ${removed} token(s).`);
+            persistState(this.state, this.config).catch(() => { });
+        }
+    }
+}
+//# sourceMappingURL=server.js.map