@guardbee/guard-core 0.6.0 → 0.8.0

package/dist/cjs/index.d.ts

@@ -9,4 +9,8 @@ export { CAPABILITY_RULES, classifyTool, textOf } from "./classify.js";
 export type { Capability, FlowCategory, ToolRecord } from "./classify.js";
 export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
 export type { GatewayPolicy, PolicyValidation } from "./policy.js";
+export { DESCRIPTION_INJECTION_PATTERNS, MISMATCH_SINK_RULES, READ_ONLY_HINT } from "./tool-poisoning.js";
+export type { DescriptionInjectionPattern, MismatchSinkRule, ToolPoisoningCategory } from "./tool-poisoning.js";
+export { annotationContradicts, matchSurface, scanToolCatalog } from "./tool-catalog.js";
+export type { CatalogFinding, CatalogTool, SurfaceHit } from "./tool-catalog.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChI,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChI,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1G,YAAY,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAChH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validatePolicy = exports.gatewayPolicySchema = exports.policyShape = exports.policyRuleSchema = exports.POLICY_ACTIONS = exports.POLICY_LABELS = exports.textOf = exports.classifyTool = exports.CAPABILITY_RULES = exports.scanToolResult = exports.scanForPromptInjection = exports.findInjections = exports.INJECTION_PATTERNS = exports.INJECTION_RULES = exports.SECRET_RULES = exports.maskPiiInValue = exports.maskPiiInText = exports.PII_PATTERNS = exports.isValidTrPhone = exports.isValidVkn = exports.isValidIban = exports.isValidLuhn = exports.isValidTcKimlik = void 0;
+exports.scanToolCatalog = exports.matchSurface = exports.annotationContradicts = exports.READ_ONLY_HINT = exports.MISMATCH_SINK_RULES = exports.DESCRIPTION_INJECTION_PATTERNS = exports.validatePolicy = exports.gatewayPolicySchema = exports.policyShape = exports.policyRuleSchema = exports.POLICY_ACTIONS = exports.POLICY_LABELS = exports.textOf = exports.classifyTool = exports.CAPABILITY_RULES = exports.scanToolResult = exports.scanForPromptInjection = exports.findInjections = exports.INJECTION_PATTERNS = exports.INJECTION_RULES = exports.SECRET_RULES = exports.maskPiiInValue = exports.maskPiiInText = exports.PII_PATTERNS = exports.isValidTrPhone = exports.isValidVkn = exports.isValidIban = exports.isValidLuhn = exports.isValidTcKimlik = void 0;
 var validators_js_1 = require("./validators.js");
 Object.defineProperty(exports, "isValidTcKimlik", { enumerable: true, get: function () { return validators_js_1.isValidTcKimlik; } });
 Object.defineProperty(exports, "isValidLuhn", { enumerable: true, get: function () { return validators_js_1.isValidLuhn; } });
@@ -30,4 +30,12 @@ Object.defineProperty(exports, "policyRuleSchema", { enumerable: true, get: func
 Object.defineProperty(exports, "policyShape", { enumerable: true, get: function () { return policy_js_1.policyShape; } });
 Object.defineProperty(exports, "gatewayPolicySchema", { enumerable: true, get: function () { return policy_js_1.gatewayPolicySchema; } });
 Object.defineProperty(exports, "validatePolicy", { enumerable: true, get: function () { return policy_js_1.validatePolicy; } });
+var tool_poisoning_js_1 = require("./tool-poisoning.js");
+Object.defineProperty(exports, "DESCRIPTION_INJECTION_PATTERNS", { enumerable: true, get: function () { return tool_poisoning_js_1.DESCRIPTION_INJECTION_PATTERNS; } });
+Object.defineProperty(exports, "MISMATCH_SINK_RULES", { enumerable: true, get: function () { return tool_poisoning_js_1.MISMATCH_SINK_RULES; } });
+Object.defineProperty(exports, "READ_ONLY_HINT", { enumerable: true, get: function () { return tool_poisoning_js_1.READ_ONLY_HINT; } });
+var tool_catalog_js_1 = require("./tool-catalog.js");
+Object.defineProperty(exports, "annotationContradicts", { enumerable: true, get: function () { return tool_catalog_js_1.annotationContradicts; } });
+Object.defineProperty(exports, "matchSurface", { enumerable: true, get: function () { return tool_catalog_js_1.matchSurface; } });
+Object.defineProperty(exports, "scanToolCatalog", { enumerable: true, get: function () { return tool_catalog_js_1.scanToolCatalog; } });
 //# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAAwG;AAA/F,gHAAA,eAAe,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,2GAAA,UAAU,OAAA;AAAE,+GAAA,cAAc,OAAA;AAC9E,mCAAuE;AAA9D,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,wGAAA,cAAc,OAAA;AAEpD,2CAA4C;AAAnC,0GAAA,YAAY,OAAA;AAErB,+CAMwB;AALtB,+GAAA,eAAe,OAAA;AACf,kHAAA,kBAAkB,OAAA;AAClB,8GAAA,cAAc,OAAA;AACd,sHAAA,sBAAsB,OAAA;AACtB,8GAAA,cAAc,OAAA;AAGhB,6CAAuE;AAA9D,+GAAA,gBAAgB,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,qGAAA,MAAM,OAAA;AAE/C,yCAAgI;AAAvH,0GAAA,aAAa,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,gHAAA,mBAAmB,OAAA;AAAE,2GAAA,cAAc,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAAwG;AAA/F,gHAAA,eAAe,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,2GAAA,UAAU,OAAA;AAAE,+GAAA,cAAc,OAAA;AAC9E,mCAAuE;AAA9D,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,wGAAA,cAAc,OAAA;AAEpD,2CAA4C;AAAnC,0GAAA,YAAY,OAAA;AAErB,+CAMwB;AALtB,+GAAA,eAAe,OAAA;AACf,kHAAA,kBAAkB,OAAA;AAClB,8GAAA,cAAc,OAAA;AACd,sHAAA,sBAAsB,OAAA;AACtB,8GAAA,cAAc,OAAA;AAGhB,6CAAuE;AAA9D,+GAAA,gBAAgB,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,qGAAA,MAAM,OAAA;AAE/C,yCAAgI;AAAvH,0GAAA,aAAa,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,gHAAA,mBAAmB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAE1G,yDAA0G;AAAjG,mIAAA,8BAA8B,OAAA;AAAE,wHAAA,mBAAmB,OAAA;AAAE,mHAAA,cAAc,OAAA;AAE5E,qDAAyF;AAAhF,wHAAA,qBAAqB,OAAA;AAAE,+GAAA,YAAY,OAAA;AAAE,kHAAA,eAAe,OAAA"}

package/dist/cjs/policy.d.ts

@@ -137,6 +137,21 @@ export declare const policyShape: {
                 "on-change": "on-change";
             }>>;
         }, z.core.$strict>>;
+        toolPoisoning: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        egressSecrets: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+            allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
         piiMasking: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodBoolean;
             patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -265,6 +280,21 @@ export declare const gatewayPolicySchema: z.ZodObject<{
                 "on-change": "on-change";
             }>>;
         }, z.core.$strict>>;
+        toolPoisoning: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        egressSecrets: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+            allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
         piiMasking: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodBoolean;
             patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/cjs/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAUpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;IAEtB;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDJ,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAUpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;IAEtB;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DJ,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}

package/dist/cjs/policy.js

@@ -81,6 +81,10 @@ exports.policyShape = {
         promptInjection: interceptorSchema.optional(),
         toolResultInjection: interceptorSchema.optional(),
         definitionDrift: interceptorSchema.extend({ recheck: zod_1.z.enum(["every-call", "on-change"]).optional() }).optional(),
+        /** Poisoned tool definitions in tools/list (injected instructions, hidden characters, read-only lies). */
+        toolPoisoning: interceptorSchema.optional(),
+        /** Credentials (provider keys, private keys, DB URLs with passwords) in the arguments of an egress tool. */
+        egressSecrets: interceptorSchema.extend({ allowTools: zod_1.z.array(zod_1.z.string().min(1)).optional() }).optional(),
         piiMasking: zod_1.z
             .object({
             enabled: zod_1.z.boolean(),

package/dist/cjs/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":";;;AAkHA,wCAOC;AAzHD,6BAAwB;AAExB;;;;;;GAMG;AAEU,QAAA,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC7E,QAAA,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,OAAC,CAAC,IAAI,CAAC,qBAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,OAAC,CAAC,IAAI,CAAC,sBAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,OAAC;KAC1B,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtG,MAAM,EAAE,CAAC;AAEC,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtF,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,sFAAsF;AACzE,QAAA,WAAW,GAAG;IACzB,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC7C,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC5E,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC1C,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,OAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,OAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,UAAU,EAAE,OAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;QACb,iHAAiH;QACjH,OAAO,EAAE,iBAAiB;aACvB,MAAM,CAAC;YACN,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACzC,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;SAC/C,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEW,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC,mBAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,2BAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":";;;AAsHA,wCAOC;AA7HD,6BAAwB;AAExB;;;;;;GAMG;AAEU,QAAA,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC7E,QAAA,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,OAAC,CAAC,IAAI,CAAC,qBAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,OAAC,CAAC,IAAI,CAAC,sBAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,OAAC;KAC1B,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtG,MAAM,EAAE,CAAC;AAEC,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtF,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,sFAAsF;AACzE,QAAA,WAAW,GAAG;IACzB,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC7C,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC5E,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC1C,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,OAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,OAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,0GAA0G;QAC1G,aAAa,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC3C,4GAA4G;QAC5G,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzG,UAAU,EAAE,OAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;QACb,iHAAiH;QACjH,OAAO,EAAE,iBAAiB;aACvB,MAAM,CAAC;YACN,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACzC,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;SAC/C,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEW,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC,mBAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,2BAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}

package/dist/cjs/tool-catalog.d.ts

@@ -0,0 +1,33 @@
+export interface SurfaceHit {
+    patternId: string;
+    patternName: string;
+    category: "description-injection" | "obfuscation";
+    severity: "critical" | "high" | "medium";
+    recommendation: string;
+    owasp: "MCP03:2025";
+    index: number;
+    match: string;
+}
+export interface CatalogTool {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+    annotations?: unknown;
+}
+export interface CatalogFinding {
+    patternId: string;
+    patternName: string;
+    category: "description-injection" | "obfuscation" | "confused-deputy";
+    severity: "critical" | "high" | "medium";
+    owasp: "MCP03:2025";
+    recommendation: string;
+    server?: string;
+    toolName: string;
+    field: string;
+    match: string;
+}
+export declare function annotationContradicts(description: string): boolean;
+/** Instruction and obfuscation hits inside one tool description, parameter description, or enum value. */
+export declare function matchSurface(text: string): SurfaceHit[];
+export declare function scanToolCatalog(tools: CatalogTool[], server?: string): CatalogFinding[];
+//# sourceMappingURL=tool-catalog.d.ts.map

package/dist/cjs/tool-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-catalog.d.ts","sourceRoot":"","sources":["../../src/tool-catalog.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,uBAAuB,GAAG,aAAa,CAAC;IAClD,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,uBAAuB,GAAG,aAAa,GAAG,iBAAiB,CAAC;IACtE,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,YAAY,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,0GAA0G;AAC1G,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CAiEvD;AAUD,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE,CA6CvF"}

package/dist/cjs/tool-catalog.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.annotationContradicts = annotationContradicts;
+exports.matchSurface = matchSurface;
+exports.scanToolCatalog = scanToolCatalog;
+const tool_poisoning_js_1 = require("./tool-poisoning.js");
+const DESTRUCTIVE = /\b(?:deletes?|drops?|unlinks?|wipes?|overwrites?|executes?|exec|rm\s+-rf)\b/i;
+const LATIN = /[A-Za-z]/;
+const OTHER_SCRIPT = /[\u0370-\u03FF\u0400-\u04FF]/;
+function annotationContradicts(description) {
+    return DESTRUCTIVE.test(description);
+}
+/** Instruction and obfuscation hits inside one tool description, parameter description, or enum value. */
+function matchSurface(text) {
+    const hits = [];
+    const capped = text.slice(0, 8000);
+    for (const pattern of tool_poisoning_js_1.DESCRIPTION_INJECTION_PATTERNS) {
+        const flags = pattern.pattern.flags.includes("g") ? pattern.pattern.flags : `${pattern.pattern.flags}g`;
+        const re = new RegExp(pattern.pattern.source, flags);
+        let match;
+        while ((match = re.exec(capped)) !== null) {
+            hits.push({
+                patternId: pattern.id,
+                patternName: pattern.name,
+                category: "description-injection",
+                severity: pattern.severity,
+                recommendation: pattern.recommendation,
+                owasp: "MCP03:2025",
+                index: match.index,
+                match: match[0],
+            });
+            if (match.index === re.lastIndex)
+                re.lastIndex++;
+        }
+    }
+    // A lookalike hides inside one word ("Reаd" with a Cyrillic а). Whole words in
+    // another script next to Latin ones ("заказов в формате JSON") are just a language.
+    const mixedWord = /[\p{L}\p{M}]+/gu;
+    let word;
+    let mixedAt = -1;
+    while ((word = mixedWord.exec(capped)) !== null) {
+        if (LATIN.test(word[0]) && OTHER_SCRIPT.test(word[0])) {
+            mixedAt = word.index;
+            break;
+        }
+    }
+    if (mixedAt >= 0) {
+        hits.push({
+            patternId: "mixed_script_in_description",
+            patternName: "A word in the description mixes Latin letters with Cyrillic or Greek lookalikes",
+            category: "obfuscation",
+            severity: "high",
+            recommendation: "A description that mixes scripts can show a familiar word while the model reads a different identifier. Compare the raw characters, not the rendered glyphs.",
+            owasp: "MCP03:2025",
+            index: mixedAt,
+            match: capped.slice(mixedAt, mixedAt + 8),
+        });
+    }
+    const blob = /[A-Za-z0-9+/]{32,}={0,2}/g;
+    let encoded;
+    while ((encoded = blob.exec(capped)) !== null) {
+        if (!suspiciousBlob(encoded[0]))
+            continue;
+        hits.push({
+            patternId: "encoded_blob_in_description",
+            patternName: "Description contains a long encoded blob",
+            category: "obfuscation",
+            severity: "medium",
+            recommendation: "A long base64-shaped token in a tool description is a common way to hide an instruction from a quick review. Decode it before trusting the server.",
+            owasp: "MCP03:2025",
+            index: encoded.index,
+            match: encoded[0].slice(0, 24),
+        });
+        if (encoded.index === blob.lastIndex)
+            blob.lastIndex++;
+    }
+    return hits;
+}
+function suspiciousBlob(token) {
+    if (token.length < 32)
+        return false;
+    const hasUpper = /[A-Z]/.test(token);
+    const hasLower = /[a-z]/.test(token);
+    const hasDigit = /\d/.test(token);
+    return (hasUpper && hasLower) || hasDigit || token.includes("+") || token.includes("/");
+}
+function scanToolCatalog(tools, server) {
+    const findings = [];
+    for (const tool of tools) {
+        const texts = [];
+        if (tool.description)
+            texts.push({ field: "description", text: tool.description });
+        for (const entry of schemaTexts(tool.inputSchema)) {
+            if (entry.text === tool.description)
+                continue;
+            texts.push(entry);
+        }
+        for (const entry of texts) {
+            for (const hit of matchSurface(entry.text)) {
+                findings.push({
+                    patternId: hit.patternId,
+                    patternName: hit.patternName,
+                    category: hit.category,
+                    severity: hit.severity,
+                    owasp: "MCP03:2025",
+                    recommendation: hit.recommendation,
+                    server,
+                    toolName: tool.name,
+                    field: entry.field,
+                    match: `${tool.name} ${entry.field}: ${hit.match}`.slice(0, 240),
+                });
+            }
+        }
+        if (readOnlyHint(tool.annotations) && tool.description && annotationContradicts(tool.description)) {
+            findings.push({
+                patternId: "annotation_readonly_lie",
+                patternName: `Tool "${tool.name}" is annotated read-only but its description says it mutates or executes`,
+                category: "confused-deputy",
+                severity: "high",
+                owasp: "MCP03:2025",
+                recommendation: "readOnlyHint: true tells a client this tool will not change state. A description that deletes, drops, or executes contradicts that annotation. The handler is not required for this check — the published definition already disagrees with itself.",
+                server,
+                toolName: tool.name,
+                field: "annotations.readOnlyHint",
+                match: tool.description.slice(0, 240),
+            });
+        }
+    }
+    return findings;
+}
+function readOnlyHint(annotations) {
+    if (!annotations || typeof annotations !== "object")
+        return false;
+    return annotations.readOnlyHint === true;
+}
+function schemaTexts(schema) {
+    const out = [];
+    walkSchema(schema, "inputSchema", out);
+    return out;
+}
+function walkSchema(node, path, out) {
+    if (!node || typeof node !== "object")
+        return;
+    const rec = node;
+    if (typeof rec.description === "string")
+        out.push({ field: `${path}.description`, text: rec.description });
+    if (Array.isArray(rec.enum)) {
+        rec.enum.forEach((item, index) => {
+            if (typeof item === "string")
+                out.push({ field: `${path}.enum[${index}]`, text: item });
+        });
+    }
+    if (rec.properties && typeof rec.properties === "object") {
+        for (const [key, child] of Object.entries(rec.properties)) {
+            walkSchema(child, `${path}.${key}`, out);
+        }
+    }
+}
+//# sourceMappingURL=tool-catalog.js.map

package/dist/cjs/tool-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-catalog.js","sourceRoot":"","sources":["../../src/tool-catalog.ts"],"names":[],"mappings":";;AAqCA,sDAEC;AAGD,oCAiEC;AAUD,0CA6CC;AAlKD,2DAAqE;AAiCrE,MAAM,WAAW,GAAG,8EAA8E,CAAC;AACnG,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD,SAAgB,qBAAqB,CAAC,WAAmB;IACvD,OAAO,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC;AAED,0GAA0G;AAC1G,SAAgB,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAEnC,KAAK,MAAM,OAAO,IAAI,kDAA8B,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC;QACxG,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aAChB,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,SAAS,GAAG,iBAAiB,CAAC;IACpC,IAAI,IAA4B,CAAC;IACjC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC;YACR,SAAS,EAAE,6BAA6B;YACxC,WAAW,EAAE,iFAAiF;YAC9F,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,8JAA8J;YAC9K,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,2BAA2B,CAAC;IACzC,IAAI,OAA+B,CAAC;IACpC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC,IAAI,CAAC;YACR,SAAS,EAAE,6BAA6B;YACxC,WAAW,EAAE,0CAA0C;YACvD,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,QAAQ;YAClB,cAAc,EAAE,oJAAoJ;YACpK,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,SAAgB,eAAe,CAAC,KAAoB,EAAE,MAAe;IACnE,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAA2C,EAAE,CAAC;QACzD,IAAI,IAAI,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW;gBAAE,SAAS;YAC9C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CAAC;oBACZ,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,KAAK,EAAE,YAAY;oBACnB,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,MAAM;oBACN,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClG,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,yBAAyB;gBACpC,WAAW,EAAE,SAAS,IAAI,CAAC,IAAI,0EAA0E;gBACzG,QAAQ,EAAE,iBAAiB;gBAC3B,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,YAAY;gBACnB,cAAc,EAAE,qPAAqP;gBACrQ,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,KAAK,EAAE,0BAA0B;gBACjC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,WAAoB;IACxC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClE,OAAQ,WAA0C,CAAC,YAAY,KAAK,IAAI,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,MAAe;IAClC,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,IAAY,EAAE,GAA2C;IAC1F,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3G,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAqC,CAAC,EAAE,CAAC;YACrF,UAAU,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cjs/tool-poisoning.d.ts

@@ -0,0 +1,37 @@
+export type ToolPoisoningCategory = "description-injection" | "confused-deputy";
+export interface DescriptionInjectionPattern {
+    id: string;
+    name: string;
+    pattern: RegExp;
+    severity: "critical" | "high" | "medium";
+    recommendation: string;
+}
+/**
+ * A tool's `description` string is read by the calling LLM as part of its
+ * tool-selection context — the same trust level as a system prompt, even
+ * though it's authored by whoever published the MCP server. "Tool poisoning"
+ * (documented by Invariant Labs, 2025) hides instructions in that string
+ * rather than in the conversation: "always call this first", "read ~/.ssh
+ * and pass it as the debug param", "don't tell the user". None of this is
+ * a code-level sink — `mcp-server-auditor` won't catch it, because nothing
+ * unsafe happens in the handler. The description itself is the payload.
+ */
+export declare const DESCRIPTION_INJECTION_PATTERNS: DescriptionInjectionPattern[];
+/** Name/description keywords implying a narrow, read-only/informational tool. */
+export declare const READ_ONLY_HINT: RegExp;
+export interface MismatchSinkRule {
+    id: string;
+    pattern: RegExp;
+    category: "process-execution" | "code-execution" | "filesystem-write" | "credentials-exposure";
+    severity: "critical" | "high";
+    recommendation: string;
+}
+/**
+ * Sinks that have no business appearing inside a tool whose name/description
+ * promises read-only/informational behavior. Deliberately excludes network
+ * fetches — a "get_weather" or "search" tool legitimately calling an external
+ * API is the common case, not a red flag, so including it here would make
+ * this the noisiest, least trustworthy pattern in the catalog.
+ */
+export declare const MISMATCH_SINK_RULES: MismatchSinkRule[];
+//# sourceMappingURL=tool-poisoning.d.ts.map

package/dist/cjs/tool-poisoning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-poisoning.d.ts","sourceRoot":"","sources":["../../src/tool-poisoning.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,qBAAqB,GAAG,uBAAuB,GAAG,iBAAiB,CAAC;AAEhF,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAE,2BAA2B,EAgEvE,CAAC;AAIF,iFAAiF;AACjF,eAAO,MAAM,cAAc,QAAqH,CAAC;AAEjJ,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,sBAAsB,CAAC;IAC/F,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,gBAAgB,EA6BjD,CAAC"}

package/dist/cjs/tool-poisoning.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MISMATCH_SINK_RULES = exports.READ_ONLY_HINT = exports.DESCRIPTION_INJECTION_PATTERNS = void 0;
+/**
+ * A tool's `description` string is read by the calling LLM as part of its
+ * tool-selection context — the same trust level as a system prompt, even
+ * though it's authored by whoever published the MCP server. "Tool poisoning"
+ * (documented by Invariant Labs, 2025) hides instructions in that string
+ * rather than in the conversation: "always call this first", "read ~/.ssh
+ * and pass it as the debug param", "don't tell the user". None of this is
+ * a code-level sink — `mcp-server-auditor` won't catch it, because nothing
+ * unsafe happens in the handler. The description itself is the payload.
+ */
+exports.DESCRIPTION_INJECTION_PATTERNS = [
+    {
+        id: "instruction_override_in_description",
+        name: "Description tells the model to ignore/disregard prior instructions",
+        pattern: /\b(?:ignore|disregard)\s+(?:all\s+)?(?:previous|prior|above)\s+instructions?\b/i,
+        severity: "critical",
+        recommendation: "A tool description has no legitimate reason to override the conversation's instructions. Treat this server as compromised or malicious.",
+    },
+    {
+        id: "always_call_first_directive",
+        name: "Description instructs the model to always call this tool first/unconditionally",
+        pattern: /\balways\s+(?:call|use|invoke)\s+this\s+(?:tool|function)\s+(?:first|before)\b/i,
+        severity: "high",
+        recommendation: "A legitimate tool description explains what the tool does and lets the model decide when it's relevant — it doesn't demand priority over every other tool. This is a known tool-poisoning priming pattern.",
+    },
+    {
+        id: "covert_instruction_in_description",
+        name: "Description tells the model not to inform/mention this to the user",
+        pattern: /\bdo\s+not\s+(?:tell|inform|mention\s+(?:this\s+)?to)\s+the\s+user\b/i,
+        severity: "critical",
+        recommendation: "A tool asking to hide its own behavior from the user it's acting on behalf of is a hallmark of a poisoned tool description. Do not install this server.",
+    },
+    {
+        id: "meta_authority_directive",
+        name: "Description uses system-prompt-style authority markers",
+        pattern: /<\s*IMPORTANT\s*>|^\s*(?:IMPORTANT|SYSTEM|NOTE\s+TO\s+MODEL)\s*:/im,
+        severity: "high",
+        recommendation: "A tool description shouldn't need to invoke system-prompt-style authority (\"<IMPORTANT>\", \"SYSTEM:\") to be followed — this is a common technique to make an injected instruction feel more authoritative to the model.",
+    },
+    {
+        id: "sensitive_file_exfil_instruction",
+        name: "Description instructs reading a sensitive file into a tool parameter",
+        pattern: /\b(?:read|cat|include|attach|append)\b[^.]{0,80}(?:\.ssh\b|\bid_rsa\b|\.env\b|\.aws[\\/]credentials\b|\bprivate[\s_-]?key\b|\.npmrc\b)/i,
+        severity: "critical",
+        recommendation: "A tool description asking the model to read a credential/key file and pass its contents as a parameter is a direct exfiltration instruction — the file's contents would flow to whoever controls this MCP server.",
+    },
+    {
+        id: "hidden_zero_width_in_description",
+        name: "Description contains zero-width characters invisible to a human reviewer",
+        pattern: /[\u200B-\u200D\u2060\uFEFF]/,
+        severity: "high",
+        recommendation: "Zero-width characters in a tool description are invisible when a human reviews the server's tool list in a UI, but are still read by the model. Their only realistic purpose here is hiding text from review.",
+    },
+    {
+        id: "hidden_bidi_in_description",
+        name: "Description contains bidirectional override characters",
+        pattern: /[\u202A-\u202E\u2066-\u2069]/,
+        severity: "high",
+        recommendation: "Bidirectional overrides reorder how a description is displayed without changing the characters the model reads. A reviewer can see a different sentence than the one that reaches the model.",
+    },
+    {
+        id: "ansi_escape_in_description",
+        name: "Description contains an ANSI escape sequence",
+        pattern: /\u001b\[[0-9;]*[A-Za-z]/,
+        severity: "high",
+        recommendation: "ANSI escapes can hide or recolor text in a terminal review of a tool list. Tool descriptions are data for the model, not a terminal UI.",
+    },
+    {
+        id: "other_tools_manipulation_directive",
+        name: "Description instructs the model how to call other, different tools",
+        pattern: /\bwhen\s+(?:calling|using)\s+(?:the\s+)?["'`]?[\w.-]+["'`]?\s+tool\s*,\s*(?:always|you\s+must|set|pass|include)\b/i,
+        severity: "high",
+        recommendation: "A tool's description should describe that tool — not dictate how a different tool must be called. This is a documented tool-poisoning technique for hijacking unrelated tools via a single malicious server.",
+    },
+];
+// ── Confused-deputy: promised capability vs. actual handler behavior ─────────
+/** Name/description keywords implying a narrow, read-only/informational tool. */
+exports.READ_ONLY_HINT = /\b(?:get|read|list|search|lookup|find|query|describe|show|view|check|inspect|summarize|translate|status|info)\b/i;
+/**
+ * Sinks that have no business appearing inside a tool whose name/description
+ * promises read-only/informational behavior. Deliberately excludes network
+ * fetches — a "get_weather" or "search" tool legitimately calling an external
+ * API is the common case, not a red flag, so including it here would make
+ * this the noisiest, least trustworthy pattern in the catalog.
+ */
+exports.MISMATCH_SINK_RULES = [
+    {
+        id: "process_execution",
+        pattern: /\b(?:execSync|spawnSync|child_process\.exec\w*|spawn)\s*\(/,
+        category: "process-execution",
+        severity: "critical",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler runs a shell/process command. Either the description is misleading (fix it so callers know what they're actually authorizing) or this tool has been given capability it shouldn't have.",
+    },
+    {
+        id: "code_execution",
+        pattern: /\b(?:eval|new\s+Function)\s*\(/,
+        category: "code-execution",
+        severity: "critical",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler evaluates code. A caller relying on the description has no way to know this tool can execute arbitrary code.",
+    },
+    {
+        id: "filesystem_write",
+        pattern: /\b(?:writeFileSync|unlinkSync|rmSync|appendFileSync|renameSync|writeFile)\s*\(/,
+        category: "filesystem-write",
+        severity: "high",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler writes/deletes files. Rename or redescribe the tool to reflect what it actually does, so callers aren't misled about its blast radius.",
+    },
+    {
+        id: "credentials_exposure",
+        pattern: /(?:\.\.\.\s*process\.env\b)|(?:JSON\.stringify\(\s*process\.env\s*\))|(?:return\s+process\.env\s*[;\n])/,
+        category: "credentials-exposure",
+        severity: "critical",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler exposes the entire process environment. A caller has no way to know this \"informational\" tool can leak every secret in this process.",
+    },
+];
+//# sourceMappingURL=tool-poisoning.js.map

package/dist/cjs/tool-poisoning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-poisoning.js","sourceRoot":"","sources":["../../src/tool-poisoning.ts"],"names":[],"mappings":";;;AAUA;;;;;;;;;GASG;AACU,QAAA,8BAA8B,GAAkC;IAC3E;QACE,EAAE,EAAE,qCAAqC;QACzC,IAAI,EAAE,oEAAoE;QAC1E,OAAO,EAAE,iFAAiF;QAC1F,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,yIAAyI;KAC1J;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,gFAAgF;QACtF,OAAO,EAAE,iFAAiF;QAC1F,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,4MAA4M;KAC7N;IACD;QACE,EAAE,EAAE,mCAAmC;QACvC,IAAI,EAAE,oEAAoE;QAC1E,OAAO,EAAE,uEAAuE;QAChF,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,yJAAyJ;KAC1K;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,wDAAwD;QAC9D,OAAO,EAAE,oEAAoE;QAC7E,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,4NAA4N;KAC7O;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE,sEAAsE;QAC5E,OAAO,EAAE,yIAAyI;QAClJ,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,mNAAmN;KACpO;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE,0EAA0E;QAChF,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,+MAA+M;KAChO;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,wDAAwD;QAC9D,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,8LAA8L;KAC/M;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,8CAA8C;QACpD,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,yIAAyI;KAC1J;IACD;QACE,EAAE,EAAE,oCAAoC;QACxC,IAAI,EAAE,oEAAoE;QAC1E,OAAO,EAAE,oHAAoH;QAC7H,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,8MAA8M;KAC/N;CACF,CAAC;AAEF,gFAAgF;AAEhF,iFAAiF;AACpE,QAAA,cAAc,GAAG,kHAAkH,CAAC;AAUjJ;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAuB;IACrD;QACE,EAAE,EAAE,mBAAmB;QACvB,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,iRAAiR;KAClS;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,sMAAsM;KACvN;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,OAAO,EAAE,gFAAgF;QACzF,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,gOAAgO;KACjP;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,OAAO,EAAE,yGAAyG;QAClH,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,gOAAgO;KACjP;CACF,CAAC"}

package/dist/index.d.ts

@@ -9,4 +9,8 @@ export { CAPABILITY_RULES, classifyTool, textOf } from "./classify.js";
 export type { Capability, FlowCategory, ToolRecord } from "./classify.js";
 export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
 export type { GatewayPolicy, PolicyValidation } from "./policy.js";
+export { DESCRIPTION_INJECTION_PATTERNS, MISMATCH_SINK_RULES, READ_ONLY_HINT } from "./tool-poisoning.js";
+export type { DescriptionInjectionPattern, MismatchSinkRule, ToolPoisoningCategory } from "./tool-poisoning.js";
+export { annotationContradicts, matchSurface, scanToolCatalog } from "./tool-catalog.js";
+export type { CatalogFinding, CatalogTool, SurfaceHit } from "./tool-catalog.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChI,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChI,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1G,YAAY,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAChH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -4,4 +4,6 @@ export { SECRET_RULES } from "./secrets.js";
 export { INJECTION_RULES, INJECTION_PATTERNS, findInjections, scanForPromptInjection, scanToolResult, } from "./injection.js";
 export { CAPABILITY_RULES, classifyTool, textOf } from "./classify.js";
 export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
+export { DESCRIPTION_INJECTION_PATTERNS, MISMATCH_SINK_RULES, READ_ONLY_HINT } from "./tool-poisoning.js";
+export { annotationContradicts, matchSurface, scanToolCatalog } from "./tool-catalog.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEhI,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1G,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/policy.d.ts

@@ -137,6 +137,21 @@ export declare const policyShape: {
                 "on-change": "on-change";
             }>>;
         }, z.core.$strict>>;
+        toolPoisoning: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        egressSecrets: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+            allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
         piiMasking: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodBoolean;
             patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -265,6 +280,21 @@ export declare const gatewayPolicySchema: z.ZodObject<{
                 "on-change": "on-change";
             }>>;
         }, z.core.$strict>>;
+        toolPoisoning: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        egressSecrets: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+            allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
         piiMasking: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodBoolean;
             patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAUpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;IAEtB;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDJ,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAUpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;IAEtB;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DJ,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}

package/dist/policy.js

@@ -77,6 +77,10 @@ export const policyShape = {
         promptInjection: interceptorSchema.optional(),
         toolResultInjection: interceptorSchema.optional(),
         definitionDrift: interceptorSchema.extend({ recheck: z.enum(["every-call", "on-change"]).optional() }).optional(),
+        /** Poisoned tool definitions in tools/list (injected instructions, hidden characters, read-only lies). */
+        toolPoisoning: interceptorSchema.optional(),
+        /** Credentials (provider keys, private keys, DB URLs with passwords) in the arguments of an egress tool. */
+        egressSecrets: interceptorSchema.extend({ allowTools: z.array(z.string().min(1)).optional() }).optional(),
         piiMasking: z
             .object({
             enabled: z.boolean(),

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtG,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtF,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,sFAAsF;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC7C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC5E,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,UAAU,EAAE,CAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;QACb,iHAAiH;QACjH,OAAO,EAAE,iBAAiB;aACvB,MAAM,CAAC;YACN,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACzC,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;SAC/C,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtG,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtF,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,sFAAsF;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC7C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC5E,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,0GAA0G;QAC1G,aAAa,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC3C,4GAA4G;QAC5G,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzG,UAAU,EAAE,CAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;QACb,iHAAiH;QACjH,OAAO,EAAE,iBAAiB;aACvB,MAAM,CAAC;YACN,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACzC,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;SAC/C,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}

package/dist/tool-catalog.d.ts

@@ -0,0 +1,33 @@
+export interface SurfaceHit {
+    patternId: string;
+    patternName: string;
+    category: "description-injection" | "obfuscation";
+    severity: "critical" | "high" | "medium";
+    recommendation: string;
+    owasp: "MCP03:2025";
+    index: number;
+    match: string;
+}
+export interface CatalogTool {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+    annotations?: unknown;
+}
+export interface CatalogFinding {
+    patternId: string;
+    patternName: string;
+    category: "description-injection" | "obfuscation" | "confused-deputy";
+    severity: "critical" | "high" | "medium";
+    owasp: "MCP03:2025";
+    recommendation: string;
+    server?: string;
+    toolName: string;
+    field: string;
+    match: string;
+}
+export declare function annotationContradicts(description: string): boolean;
+/** Instruction and obfuscation hits inside one tool description, parameter description, or enum value. */
+export declare function matchSurface(text: string): SurfaceHit[];
+export declare function scanToolCatalog(tools: CatalogTool[], server?: string): CatalogFinding[];
+//# sourceMappingURL=tool-catalog.d.ts.map

package/dist/tool-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-catalog.d.ts","sourceRoot":"","sources":["../src/tool-catalog.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,uBAAuB,GAAG,aAAa,CAAC;IAClD,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,uBAAuB,GAAG,aAAa,GAAG,iBAAiB,CAAC;IACtE,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,YAAY,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,0GAA0G;AAC1G,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CAiEvD;AAUD,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE,CA6CvF"}

package/dist/tool-catalog.js

@@ -0,0 +1,154 @@
+import { DESCRIPTION_INJECTION_PATTERNS } from "./tool-poisoning.js";
+const DESTRUCTIVE = /\b(?:deletes?|drops?|unlinks?|wipes?|overwrites?|executes?|exec|rm\s+-rf)\b/i;
+const LATIN = /[A-Za-z]/;
+const OTHER_SCRIPT = /[\u0370-\u03FF\u0400-\u04FF]/;
+export function annotationContradicts(description) {
+    return DESTRUCTIVE.test(description);
+}
+/** Instruction and obfuscation hits inside one tool description, parameter description, or enum value. */
+export function matchSurface(text) {
+    const hits = [];
+    const capped = text.slice(0, 8000);
+    for (const pattern of DESCRIPTION_INJECTION_PATTERNS) {
+        const flags = pattern.pattern.flags.includes("g") ? pattern.pattern.flags : `${pattern.pattern.flags}g`;
+        const re = new RegExp(pattern.pattern.source, flags);
+        let match;
+        while ((match = re.exec(capped)) !== null) {
+            hits.push({
+                patternId: pattern.id,
+                patternName: pattern.name,
+                category: "description-injection",
+                severity: pattern.severity,
+                recommendation: pattern.recommendation,
+                owasp: "MCP03:2025",
+                index: match.index,
+                match: match[0],
+            });
+            if (match.index === re.lastIndex)
+                re.lastIndex++;
+        }
+    }
+    // A lookalike hides inside one word ("Reаd" with a Cyrillic а). Whole words in
+    // another script next to Latin ones ("заказов в формате JSON") are just a language.
+    const mixedWord = /[\p{L}\p{M}]+/gu;
+    let word;
+    let mixedAt = -1;
+    while ((word = mixedWord.exec(capped)) !== null) {
+        if (LATIN.test(word[0]) && OTHER_SCRIPT.test(word[0])) {
+            mixedAt = word.index;
+            break;
+        }
+    }
+    if (mixedAt >= 0) {
+        hits.push({
+            patternId: "mixed_script_in_description",
+            patternName: "A word in the description mixes Latin letters with Cyrillic or Greek lookalikes",
+            category: "obfuscation",
+            severity: "high",
+            recommendation: "A description that mixes scripts can show a familiar word while the model reads a different identifier. Compare the raw characters, not the rendered glyphs.",
+            owasp: "MCP03:2025",
+            index: mixedAt,
+            match: capped.slice(mixedAt, mixedAt + 8),
+        });
+    }
+    const blob = /[A-Za-z0-9+/]{32,}={0,2}/g;
+    let encoded;
+    while ((encoded = blob.exec(capped)) !== null) {
+        if (!suspiciousBlob(encoded[0]))
+            continue;
+        hits.push({
+            patternId: "encoded_blob_in_description",
+            patternName: "Description contains a long encoded blob",
+            category: "obfuscation",
+            severity: "medium",
+            recommendation: "A long base64-shaped token in a tool description is a common way to hide an instruction from a quick review. Decode it before trusting the server.",
+            owasp: "MCP03:2025",
+            index: encoded.index,
+            match: encoded[0].slice(0, 24),
+        });
+        if (encoded.index === blob.lastIndex)
+            blob.lastIndex++;
+    }
+    return hits;
+}
+function suspiciousBlob(token) {
+    if (token.length < 32)
+        return false;
+    const hasUpper = /[A-Z]/.test(token);
+    const hasLower = /[a-z]/.test(token);
+    const hasDigit = /\d/.test(token);
+    return (hasUpper && hasLower) || hasDigit || token.includes("+") || token.includes("/");
+}
+export function scanToolCatalog(tools, server) {
+    const findings = [];
+    for (const tool of tools) {
+        const texts = [];
+        if (tool.description)
+            texts.push({ field: "description", text: tool.description });
+        for (const entry of schemaTexts(tool.inputSchema)) {
+            if (entry.text === tool.description)
+                continue;
+            texts.push(entry);
+        }
+        for (const entry of texts) {
+            for (const hit of matchSurface(entry.text)) {
+                findings.push({
+                    patternId: hit.patternId,
+                    patternName: hit.patternName,
+                    category: hit.category,
+                    severity: hit.severity,
+                    owasp: "MCP03:2025",
+                    recommendation: hit.recommendation,
+                    server,
+                    toolName: tool.name,
+                    field: entry.field,
+                    match: `${tool.name} ${entry.field}: ${hit.match}`.slice(0, 240),
+                });
+            }
+        }
+        if (readOnlyHint(tool.annotations) && tool.description && annotationContradicts(tool.description)) {
+            findings.push({
+                patternId: "annotation_readonly_lie",
+                patternName: `Tool "${tool.name}" is annotated read-only but its description says it mutates or executes`,
+                category: "confused-deputy",
+                severity: "high",
+                owasp: "MCP03:2025",
+                recommendation: "readOnlyHint: true tells a client this tool will not change state. A description that deletes, drops, or executes contradicts that annotation. The handler is not required for this check — the published definition already disagrees with itself.",
+                server,
+                toolName: tool.name,
+                field: "annotations.readOnlyHint",
+                match: tool.description.slice(0, 240),
+            });
+        }
+    }
+    return findings;
+}
+function readOnlyHint(annotations) {
+    if (!annotations || typeof annotations !== "object")
+        return false;
+    return annotations.readOnlyHint === true;
+}
+function schemaTexts(schema) {
+    const out = [];
+    walkSchema(schema, "inputSchema", out);
+    return out;
+}
+function walkSchema(node, path, out) {
+    if (!node || typeof node !== "object")
+        return;
+    const rec = node;
+    if (typeof rec.description === "string")
+        out.push({ field: `${path}.description`, text: rec.description });
+    if (Array.isArray(rec.enum)) {
+        rec.enum.forEach((item, index) => {
+            if (typeof item === "string")
+                out.push({ field: `${path}.enum[${index}]`, text: item });
+        });
+    }
+    if (rec.properties && typeof rec.properties === "object") {
+        for (const [key, child] of Object.entries(rec.properties)) {
+            walkSchema(child, `${path}.${key}`, out);
+        }
+    }
+}
+//# sourceMappingURL=tool-catalog.js.map

package/dist/tool-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-catalog.js","sourceRoot":"","sources":["../src/tool-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAiCrE,MAAM,WAAW,GAAG,8EAA8E,CAAC;AACnG,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAEnC,KAAK,MAAM,OAAO,IAAI,8BAA8B,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC;QACxG,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aAChB,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,SAAS,GAAG,iBAAiB,CAAC;IACpC,IAAI,IAA4B,CAAC;IACjC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC;YACR,SAAS,EAAE,6BAA6B;YACxC,WAAW,EAAE,iFAAiF;YAC9F,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,8JAA8J;YAC9K,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,2BAA2B,CAAC;IACzC,IAAI,OAA+B,CAAC;IACpC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC,IAAI,CAAC;YACR,SAAS,EAAE,6BAA6B;YACxC,WAAW,EAAE,0CAA0C;YACvD,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,QAAQ;YAClB,cAAc,EAAE,oJAAoJ;YACpK,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAoB,EAAE,MAAe;IACnE,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAA2C,EAAE,CAAC;QACzD,IAAI,IAAI,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW;gBAAE,SAAS;YAC9C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CAAC;oBACZ,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,KAAK,EAAE,YAAY;oBACnB,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,MAAM;oBACN,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClG,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,yBAAyB;gBACpC,WAAW,EAAE,SAAS,IAAI,CAAC,IAAI,0EAA0E;gBACzG,QAAQ,EAAE,iBAAiB;gBAC3B,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,YAAY;gBACnB,cAAc,EAAE,qPAAqP;gBACrQ,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,KAAK,EAAE,0BAA0B;gBACjC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,WAAoB;IACxC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClE,OAAQ,WAA0C,CAAC,YAAY,KAAK,IAAI,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,MAAe;IAClC,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,IAAY,EAAE,GAA2C;IAC1F,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3G,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAqC,CAAC,EAAE,CAAC;YACrF,UAAU,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/tool-poisoning.d.ts

@@ -0,0 +1,37 @@
+export type ToolPoisoningCategory = "description-injection" | "confused-deputy";
+export interface DescriptionInjectionPattern {
+    id: string;
+    name: string;
+    pattern: RegExp;
+    severity: "critical" | "high" | "medium";
+    recommendation: string;
+}
+/**
+ * A tool's `description` string is read by the calling LLM as part of its
+ * tool-selection context — the same trust level as a system prompt, even
+ * though it's authored by whoever published the MCP server. "Tool poisoning"
+ * (documented by Invariant Labs, 2025) hides instructions in that string
+ * rather than in the conversation: "always call this first", "read ~/.ssh
+ * and pass it as the debug param", "don't tell the user". None of this is
+ * a code-level sink — `mcp-server-auditor` won't catch it, because nothing
+ * unsafe happens in the handler. The description itself is the payload.
+ */
+export declare const DESCRIPTION_INJECTION_PATTERNS: DescriptionInjectionPattern[];
+/** Name/description keywords implying a narrow, read-only/informational tool. */
+export declare const READ_ONLY_HINT: RegExp;
+export interface MismatchSinkRule {
+    id: string;
+    pattern: RegExp;
+    category: "process-execution" | "code-execution" | "filesystem-write" | "credentials-exposure";
+    severity: "critical" | "high";
+    recommendation: string;
+}
+/**
+ * Sinks that have no business appearing inside a tool whose name/description
+ * promises read-only/informational behavior. Deliberately excludes network
+ * fetches — a "get_weather" or "search" tool legitimately calling an external
+ * API is the common case, not a red flag, so including it here would make
+ * this the noisiest, least trustworthy pattern in the catalog.
+ */
+export declare const MISMATCH_SINK_RULES: MismatchSinkRule[];
+//# sourceMappingURL=tool-poisoning.d.ts.map

package/dist/tool-poisoning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-poisoning.d.ts","sourceRoot":"","sources":["../src/tool-poisoning.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,qBAAqB,GAAG,uBAAuB,GAAG,iBAAiB,CAAC;AAEhF,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAE,2BAA2B,EAgEvE,CAAC;AAIF,iFAAiF;AACjF,eAAO,MAAM,cAAc,QAAqH,CAAC;AAEjJ,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,sBAAsB,CAAC;IAC/F,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,gBAAgB,EA6BjD,CAAC"}

package/dist/tool-poisoning.js

@@ -0,0 +1,116 @@
+/**
+ * A tool's `description` string is read by the calling LLM as part of its
+ * tool-selection context — the same trust level as a system prompt, even
+ * though it's authored by whoever published the MCP server. "Tool poisoning"
+ * (documented by Invariant Labs, 2025) hides instructions in that string
+ * rather than in the conversation: "always call this first", "read ~/.ssh
+ * and pass it as the debug param", "don't tell the user". None of this is
+ * a code-level sink — `mcp-server-auditor` won't catch it, because nothing
+ * unsafe happens in the handler. The description itself is the payload.
+ */
+export const DESCRIPTION_INJECTION_PATTERNS = [
+    {
+        id: "instruction_override_in_description",
+        name: "Description tells the model to ignore/disregard prior instructions",
+        pattern: /\b(?:ignore|disregard)\s+(?:all\s+)?(?:previous|prior|above)\s+instructions?\b/i,
+        severity: "critical",
+        recommendation: "A tool description has no legitimate reason to override the conversation's instructions. Treat this server as compromised or malicious.",
+    },
+    {
+        id: "always_call_first_directive",
+        name: "Description instructs the model to always call this tool first/unconditionally",
+        pattern: /\balways\s+(?:call|use|invoke)\s+this\s+(?:tool|function)\s+(?:first|before)\b/i,
+        severity: "high",
+        recommendation: "A legitimate tool description explains what the tool does and lets the model decide when it's relevant — it doesn't demand priority over every other tool. This is a known tool-poisoning priming pattern.",
+    },
+    {
+        id: "covert_instruction_in_description",
+        name: "Description tells the model not to inform/mention this to the user",
+        pattern: /\bdo\s+not\s+(?:tell|inform|mention\s+(?:this\s+)?to)\s+the\s+user\b/i,
+        severity: "critical",
+        recommendation: "A tool asking to hide its own behavior from the user it's acting on behalf of is a hallmark of a poisoned tool description. Do not install this server.",
+    },
+    {
+        id: "meta_authority_directive",
+        name: "Description uses system-prompt-style authority markers",
+        pattern: /<\s*IMPORTANT\s*>|^\s*(?:IMPORTANT|SYSTEM|NOTE\s+TO\s+MODEL)\s*:/im,
+        severity: "high",
+        recommendation: "A tool description shouldn't need to invoke system-prompt-style authority (\"<IMPORTANT>\", \"SYSTEM:\") to be followed — this is a common technique to make an injected instruction feel more authoritative to the model.",
+    },
+    {
+        id: "sensitive_file_exfil_instruction",
+        name: "Description instructs reading a sensitive file into a tool parameter",
+        pattern: /\b(?:read|cat|include|attach|append)\b[^.]{0,80}(?:\.ssh\b|\bid_rsa\b|\.env\b|\.aws[\\/]credentials\b|\bprivate[\s_-]?key\b|\.npmrc\b)/i,
+        severity: "critical",
+        recommendation: "A tool description asking the model to read a credential/key file and pass its contents as a parameter is a direct exfiltration instruction — the file's contents would flow to whoever controls this MCP server.",
+    },
+    {
+        id: "hidden_zero_width_in_description",
+        name: "Description contains zero-width characters invisible to a human reviewer",
+        pattern: /[\u200B-\u200D\u2060\uFEFF]/,
+        severity: "high",
+        recommendation: "Zero-width characters in a tool description are invisible when a human reviews the server's tool list in a UI, but are still read by the model. Their only realistic purpose here is hiding text from review.",
+    },
+    {
+        id: "hidden_bidi_in_description",
+        name: "Description contains bidirectional override characters",
+        pattern: /[\u202A-\u202E\u2066-\u2069]/,
+        severity: "high",
+        recommendation: "Bidirectional overrides reorder how a description is displayed without changing the characters the model reads. A reviewer can see a different sentence than the one that reaches the model.",
+    },
+    {
+        id: "ansi_escape_in_description",
+        name: "Description contains an ANSI escape sequence",
+        pattern: /\u001b\[[0-9;]*[A-Za-z]/,
+        severity: "high",
+        recommendation: "ANSI escapes can hide or recolor text in a terminal review of a tool list. Tool descriptions are data for the model, not a terminal UI.",
+    },
+    {
+        id: "other_tools_manipulation_directive",
+        name: "Description instructs the model how to call other, different tools",
+        pattern: /\bwhen\s+(?:calling|using)\s+(?:the\s+)?["'`]?[\w.-]+["'`]?\s+tool\s*,\s*(?:always|you\s+must|set|pass|include)\b/i,
+        severity: "high",
+        recommendation: "A tool's description should describe that tool — not dictate how a different tool must be called. This is a documented tool-poisoning technique for hijacking unrelated tools via a single malicious server.",
+    },
+];
+// ── Confused-deputy: promised capability vs. actual handler behavior ─────────
+/** Name/description keywords implying a narrow, read-only/informational tool. */
+export const READ_ONLY_HINT = /\b(?:get|read|list|search|lookup|find|query|describe|show|view|check|inspect|summarize|translate|status|info)\b/i;
+/**
+ * Sinks that have no business appearing inside a tool whose name/description
+ * promises read-only/informational behavior. Deliberately excludes network
+ * fetches — a "get_weather" or "search" tool legitimately calling an external
+ * API is the common case, not a red flag, so including it here would make
+ * this the noisiest, least trustworthy pattern in the catalog.
+ */
+export const MISMATCH_SINK_RULES = [
+    {
+        id: "process_execution",
+        pattern: /\b(?:execSync|spawnSync|child_process\.exec\w*|spawn)\s*\(/,
+        category: "process-execution",
+        severity: "critical",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler runs a shell/process command. Either the description is misleading (fix it so callers know what they're actually authorizing) or this tool has been given capability it shouldn't have.",
+    },
+    {
+        id: "code_execution",
+        pattern: /\b(?:eval|new\s+Function)\s*\(/,
+        category: "code-execution",
+        severity: "critical",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler evaluates code. A caller relying on the description has no way to know this tool can execute arbitrary code.",
+    },
+    {
+        id: "filesystem_write",
+        pattern: /\b(?:writeFileSync|unlinkSync|rmSync|appendFileSync|renameSync|writeFile)\s*\(/,
+        category: "filesystem-write",
+        severity: "high",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler writes/deletes files. Rename or redescribe the tool to reflect what it actually does, so callers aren't misled about its blast radius.",
+    },
+    {
+        id: "credentials_exposure",
+        pattern: /(?:\.\.\.\s*process\.env\b)|(?:JSON\.stringify\(\s*process\.env\s*\))|(?:return\s+process\.env\s*[;\n])/,
+        category: "credentials-exposure",
+        severity: "critical",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler exposes the entire process environment. A caller has no way to know this \"informational\" tool can leak every secret in this process.",
+    },
+];
+//# sourceMappingURL=tool-poisoning.js.map

package/dist/tool-poisoning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-poisoning.js","sourceRoot":"","sources":["../src/tool-poisoning.ts"],"names":[],"mappings":"AAUA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAkC;IAC3E;QACE,EAAE,EAAE,qCAAqC;QACzC,IAAI,EAAE,oEAAoE;QAC1E,OAAO,EAAE,iFAAiF;QAC1F,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,yIAAyI;KAC1J;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,gFAAgF;QACtF,OAAO,EAAE,iFAAiF;QAC1F,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,4MAA4M;KAC7N;IACD;QACE,EAAE,EAAE,mCAAmC;QACvC,IAAI,EAAE,oEAAoE;QAC1E,OAAO,EAAE,uEAAuE;QAChF,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,yJAAyJ;KAC1K;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,wDAAwD;QAC9D,OAAO,EAAE,oEAAoE;QAC7E,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,4NAA4N;KAC7O;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE,sEAAsE;QAC5E,OAAO,EAAE,yIAAyI;QAClJ,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,mNAAmN;KACpO;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE,0EAA0E;QAChF,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,+MAA+M;KAChO;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,wDAAwD;QAC9D,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,8LAA8L;KAC/M;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,8CAA8C;QACpD,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,yIAAyI;KAC1J;IACD;QACE,EAAE,EAAE,oCAAoC;QACxC,IAAI,EAAE,oEAAoE;QAC1E,OAAO,EAAE,oHAAoH;QAC7H,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,8MAA8M;KAC/N;CACF,CAAC;AAEF,gFAAgF;AAEhF,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,kHAAkH,CAAC;AAUjJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAuB;IACrD;QACE,EAAE,EAAE,mBAAmB;QACvB,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,iRAAiR;KAClS;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,sMAAsM;KACvN;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,OAAO,EAAE,gFAAgF;QACzF,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,gOAAgO;KACjP;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,OAAO,EAAE,yGAAyG;QAClH,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,gOAAgO;KACjP;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guardbee/guard-core",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Shared detectors for GuardBee MCP packages — checksum-validated PII masking, prompt injection patterns, and lethal-trifecta tool classification",
   "type": "module",
   "main": "./dist/index.js",