@guardbee/mcp-owasp-scan 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,39 @@
-# Temporary Holding Version
+# @guardbee/mcp-owasp-scan
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**🇬🇧 English** | [🇹🇷 Türkçe](TR.md) | [🇨🇳 中文](ZH.md)
+
+One CLI/MCP for a **unified [OWASP MCP Top 10](https://owasp.org/www-project-mcp-top-10/) gut-check** — GuardBee’s answer to one-shot scanners that only connect live.
+
+| Mode | What it does |
+|---|---|
+| `scan <path>` | Orchestrates secret, server, oauth, audit-gap, context-oversharing, toxic-flow, tool-poisoning |
+| `live` | Connects (stdio/HTTP), `tools/list`, then toxic-flow + tool-poisoning |
+| `catalog` | Same as live, from a JSON dump |
+
+Optional `--discover-shadow` adds **MCP09** host discovery via `mcp-config-auditor`.
+
+> Telemetry defaults on (tool name + short params; scanned code never sent). Disable with `GUARDBEE_TELEMETRY=0`.
+
+## Quick start
+
+```bash
+npx @guardbee/mcp-owasp-scan scan ./src --format=sarif --fail-on=high
+npx @guardbee/mcp-owasp-scan live --url=https://mcp.example.com/mcp
+npx @guardbee/mcp-owasp-scan catalog ./tools.json --format=json
+```
+
+```json
+{
+  "mcpServers": {
+    "guardbee-owasp-scan": {
+      "command": "npx",
+      "args": ["-y", "@guardbee/mcp-owasp-scan"]
+    }
+  }
+}
+```
+
+## Coverage notes
+
+- **MCP04** (supply chain) and **MCP06** (RAG prompt injection) stay in their dedicated packages (`dependency-auditor` / `slopsquat-scanner`, `prompt-injection-scanner`) — they need network or content corpora this meta-scan does not pull in by default.
+- Grade **A–F** follows toxic-flow semantics (lethal trifecta → F).

package/TR.md

@@ -0,0 +1,9 @@
+# @guardbee/mcp-owasp-scan
+
+**🇬🇧 [English](README.md)** | 🇹🇷 Türkçe | [🇨🇳 中文](ZH.md)
+
+Tek CLI/MCP ile **OWASP MCP Top 10** taraması: path üzerinde GuardBee auditor’larını birleştirir; `live` / `catalog` ile `tools/list` üzerinden toxic-flow + tool-poisoning notlar (A–F).
+
+```bash
+npx @guardbee/mcp-owasp-scan scan ./src --format=sarif --fail-on=high
+```

package/ZH.md

@@ -0,0 +1,9 @@
+# @guardbee/mcp-owasp-scan
+
+**🇬🇧 [English](README.md)** | [🇹🇷 Türkçe](TR.md) | 🇨🇳 中文
+
+统一的 **OWASP MCP Top 10** 扫描：路径模式编排 GuardBee 各审计器；`live` / `catalog` 对 `tools/list` 做 toxic-flow + 工具投毒评分（A–F）。
+
+```bash
+npx @guardbee/mcp-owasp-scan scan ./src --format=sarif --fail-on=high
+```

package/dist/__tests__/orchestrator.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=orchestrator.test.d.ts.map

package/dist/__tests__/orchestrator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/orchestrator.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/orchestrator.test.js

@@ -0,0 +1,71 @@
+import { describe, it, expect } from "vitest";
+import { mkdtempSync, writeFileSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { scanPath, scanCatalogJson } from "../orchestrator.js";
+import { gradeFromFindings } from "../grade.js";
+import { resolveOwasp } from "../owaspMap.js";
+describe("resolveOwasp", () => {
+    it("honors explicit tags", () => {
+        expect(resolveOwasp("MCP05:2025", "x", "mcp-server-auditor")).toBe("MCP05:2025");
+    });
+    it("maps secret-scanner to MCP01", () => {
+        expect(resolveOwasp(undefined, "aws_access_key", "secret-scanner")).toBe("MCP01:2025");
+    });
+});
+describe("gradeFromFindings", () => {
+    it("grades lethal trifecta as F", () => {
+        expect(gradeFromFindings([
+            {
+                patternId: "lethal_trifecta",
+                patternName: "x",
+                severity: "critical",
+                owasp: "MCP10:2025",
+                source: "toxic-flow",
+                recommendation: "",
+                match: "",
+            },
+        ]).grade).toBe("F");
+    });
+    it("grades clean as A", () => {
+        expect(gradeFromFindings([]).grade).toBe("A");
+    });
+});
+describe("scanCatalogJson", () => {
+    it("detects lethal trifecta in a catalog", () => {
+        const report = scanCatalogJson(JSON.stringify({
+            tools: [
+                { name: "fetch_url", description: "Fetch arbitrary web pages" },
+                { name: "read_vault_secret", description: "Read customer vault secrets" },
+                { name: "send_email", description: "Send email to any address" },
+            ],
+        }));
+        expect(report.grade).toBe("F");
+        expect(report.findings.some((f) => f.patternId === "lethal_trifecta")).toBe(true);
+        expect(report.byOwasp.find((b) => b.id === "MCP10:2025")?.findingCount).toBeGreaterThan(0);
+    });
+});
+describe("scanPath", () => {
+    it("flags MCP05 shell sink and MCP08 audit gap in a sample server", () => {
+        const dir = mkdtempSync(join(tmpdir(), "owasp-scan-"));
+        try {
+            writeFileSync(join(dir, "server.ts"), `
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { execSync } from "child_process";
+const server = new McpServer({ name: "demo", version: "1.0.0" });
+server.tool("run", "Run", {}, async (input) => {
+  execSync(input.command);
+  return { content: [] };
+});
+`);
+            const report = scanPath(dir);
+            expect(report.findings.some((f) => f.owasp === "MCP05:2025")).toBe(true);
+            expect(report.findings.some((f) => f.owasp === "MCP08:2025")).toBe(true);
+            expect(report.grade).not.toBe("A");
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});
+//# sourceMappingURL=orchestrator.test.js.map

package/dist/__tests__/orchestrator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.test.js","sourceRoot":"","sources":["../../src/__tests__/orchestrator.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CACJ,iBAAiB,CAAC;YAChB;gBACE,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,GAAG;gBAChB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,YAAY;gBACpB,cAAc,EAAE,EAAE;gBAClB,KAAK,EAAE,EAAE;aACV;SACF,CAAC,CAAC,KAAK,CACT,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,eAAe,CAC5B,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,2BAA2B,EAAE;gBAC/D,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,6BAA6B,EAAE;gBACzE,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,2BAA2B,EAAE;aACjE;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EACtB;;;;;;;;CAQP,CACM,CAAC;YACF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+import { startServer } from "./server.js";
+import { scanPath, scanLive, scanCatalogFile } from "./orchestrator.js";
+import { buildSarif } from "./sarif.js";
+import { readFileSync } from "fs";
+import { resolve, dirname } from "path";
+import { fileURLToPath } from "url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+function getVersion() {
+    try {
+        return JSON.parse(readFileSync(resolve(__dirname, "../package.json"), "utf8")).version;
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+function printHelp() {
+    console.log(`@guardbee/mcp-owasp-scan
+
+Usage (MCP server):
+  guardbee-owasp-scan [serve]
+
+Usage (CLI):
+  guardbee-owasp-scan scan <path>              Static OWASP MCP Top 10 path scan
+  guardbee-owasp-scan live --url=<url>         Live tools/list + toxic-flow + poisoning
+  guardbee-owasp-scan live --stdio=<cmd> [--arg=...]
+  guardbee-owasp-scan catalog <tools.json>     Audit a tools/list JSON dump
+
+Options:
+  --format=text|json|sarif
+  --fail-on=any|critical|high|medium|none
+  --max-files=<n>
+  --discover-shadow              Also run MCP09 host discover
+  --allowlist=<path>             Allowlist for Shadow MCP discover
+`);
+}
+function parseArgs(args) {
+    const positionals = [];
+    const stdioArgs = [];
+    let format = "text";
+    let failOn = "any";
+    let maxFiles = 5000;
+    let url;
+    let stdio;
+    let discoverShadow = false;
+    let allowlist;
+    for (const arg of args) {
+        if (arg.startsWith("--format="))
+            format = arg.split("=")[1] ?? "text";
+        else if (arg.startsWith("--fail-on="))
+            failOn = arg.split("=")[1] ?? "any";
+        else if (arg.startsWith("--max-files="))
+            maxFiles = parseInt(arg.split("=")[1] ?? "5000", 10);
+        else if (arg.startsWith("--url="))
+            url = arg.slice("--url=".length);
+        else if (arg.startsWith("--stdio="))
+            stdio = arg.slice("--stdio=".length);
+        else if (arg.startsWith("--arg="))
+            stdioArgs.push(arg.slice("--arg=".length));
+        else if (arg === "--discover-shadow")
+            discoverShadow = true;
+        else if (arg.startsWith("--allowlist="))
+            allowlist = arg.slice("--allowlist=".length);
+        else if (!arg.startsWith("--"))
+            positionals.push(arg);
+    }
+    return { positionals, format, failOn, maxFiles, url, stdio, stdioArgs, discoverShadow, allowlist };
+}
+function shouldFail(findings, failOn) {
+    if (failOn === "none")
+        return false;
+    if (failOn === "any")
+        return findings.length > 0;
+    const RANK = { critical: 0, high: 1, medium: 2, low: 3 };
+    const threshold = RANK[failOn] ?? 1;
+    return findings.some((f) => (RANK[f.severity] ?? 3) <= threshold);
+}
+function emit(report, format, failOn, fallbackUri) {
+    if (format === "json") {
+        console.log(JSON.stringify(report, null, 2));
+    }
+    else if (format === "sarif") {
+        console.log(JSON.stringify(buildSarif(getVersion(), report.findings, fallbackUri), null, 2));
+    }
+    else {
+        console.log(`Grade ${report.grade} (${report.score}/100) — ${report.totalFindings} finding(s), ${report.durationMs}ms`);
+        console.log(`  mode: ${report.mode}  label: ${report.label}`);
+        if (report.scannedFiles !== undefined)
+            console.log(`  scannedFiles: ${report.scannedFiles}`);
+        if (report.toolCount !== undefined)
+            console.log(`  tools: ${report.toolCount}`);
+        console.log("");
+        for (const bucket of report.byOwasp) {
+            if (bucket.findingCount === 0)
+                continue;
+            console.log(`${bucket.id} ${bucket.title}: ${bucket.findingCount}`);
+            for (const f of bucket.findings.slice(0, 20)) {
+                const loc = f.file ? `${f.file}:${f.line ?? 0}` : f.tools?.join(", ") ?? f.source;
+                console.log(`  [${f.severity}] ${f.patternName} — ${loc}`);
+            }
+            if (bucket.findings.length > 20)
+                console.log(`  … +${bucket.findings.length - 20} more`);
+            console.log("");
+        }
+        if (report.totalFindings === 0)
+            console.log("✅ No OWASP MCP Top 10 findings.");
+    }
+    process.exit(shouldFail(report.findings, failOn) ? 1 : 0);
+}
+async function main() {
+    const [, , firstArg, ...rest] = process.argv;
+    if (!firstArg || firstArg === "serve") {
+        await startServer();
+        return;
+    }
+    if (firstArg === "--help" || firstArg === "-h") {
+        printHelp();
+        process.exit(0);
+    }
+    const opts = parseArgs(rest);
+    if (firstArg === "scan") {
+        const path = opts.positionals[0];
+        if (!path) {
+            console.error("Usage: guardbee-owasp-scan scan <path>");
+            process.exit(2);
+        }
+        const report = scanPath(path, {
+            maxFiles: opts.maxFiles,
+            discoverShadow: opts.discoverShadow,
+            allowlistPath: opts.allowlist,
+        });
+        emit(report, opts.format, opts.failOn, path);
+        return;
+    }
+    if (firstArg === "catalog") {
+        const path = opts.positionals[0];
+        if (!path) {
+            console.error("Usage: guardbee-owasp-scan catalog <tools.json>");
+            process.exit(2);
+        }
+        emit(scanCatalogFile(path), opts.format, opts.failOn, path);
+        return;
+    }
+    if (firstArg === "live") {
+        let target;
+        if (opts.url)
+            target = { type: "http", url: opts.url };
+        else if (opts.stdio)
+            target = { type: "stdio", command: opts.stdio, args: opts.stdioArgs };
+        else {
+            console.error("Usage: guardbee-owasp-scan live --url=<url> | --stdio=<cmd> [--arg=...]");
+            process.exit(2);
+        }
+        const report = await scanLive(target);
+        emit(report, opts.format, opts.failOn);
+        return;
+    }
+    console.error(`Unknown command: ${firstArg}`);
+    printHelp();
+    process.exit(2);
+}
+main().catch((err) => {
+    console.error("Error:", err instanceof Error ? err.message : String(err));
+    process.exit(2);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAC,OAAO,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;CAiBb,CAAC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,GAAuB,CAAC;IAC5B,IAAI,KAAyB,CAAC;IAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,SAA6B,CAAC;IAElC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;aACjE,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;aACtE,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;aACzF,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aACrE,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;aACzE,IAAI,GAAG,KAAK,mBAAmB;YAAE,cAAc,GAAG,IAAI,CAAC;aACvD,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;aACjF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AACrG,CAAC;AAED,SAAS,UAAU,CAAC,QAAgC,EAAE,MAAc;IAClE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,MAAM,IAAI,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACjF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,IAAI,CAAC,MAAmB,EAAE,MAAc,EAAE,MAAc,EAAE,WAAoB;IACrF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,aAAa,gBAAgB,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;QACxH,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,YAAY,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7F,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;gBAAE,SAAS;YACxC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YACpE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;gBAClF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,MAAM,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;YACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,EAAE,AAAD,EAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAE7C,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACtC,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/C,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE7B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,SAAS;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,MAAwB,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG;YAAE,MAAM,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAClD,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;aACtF,CAAC;YACJ,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;YACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC;IACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/grade.d.ts

@@ -0,0 +1,6 @@
+import type { Grade, NormalizedFinding } from "./types.js";
+export declare function gradeFromFindings(findings: NormalizedFinding[]): {
+    grade: Grade;
+    score: number;
+};
+//# sourceMappingURL=grade.d.ts.map

package/dist/grade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grade.d.ts","sourceRoot":"","sources":["../src/grade.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAShG"}

package/dist/grade.js

@@ -0,0 +1,15 @@
+export function gradeFromFindings(findings) {
+    if (findings.some((f) => f.patternId === "lethal_trifecta" || f.severity === "critical")) {
+        if (findings.some((f) => f.patternId === "lethal_trifecta"))
+            return { grade: "F", score: 0 };
+        return { grade: "D", score: 25 };
+    }
+    if (findings.some((f) => f.severity === "high"))
+        return { grade: "C", score: 50 };
+    if (findings.some((f) => f.severity === "medium"))
+        return { grade: "B", score: 75 };
+    if (findings.some((f) => f.severity === "low"))
+        return { grade: "B", score: 85 };
+    return { grade: "A", score: 100 };
+}
+//# sourceMappingURL=grade.js.map

package/dist/grade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grade.js","sourceRoot":"","sources":["../src/grade.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,iBAAiB,CAAC,QAA6B;IAC7D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,iBAAiB,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,EAAE,CAAC;QACzF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,iBAAiB,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAClF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACpF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { scanPath, scanLive, scanCatalogJson, scanCatalogFile } from "./orchestrator.js";
+export type { PathScanOptions } from "./orchestrator.js";
+export { gradeFromFindings } from "./grade.js";
+export { OWASP_TITLES, resolveOwasp } from "./owaspMap.js";
+export { connectAndListTools } from "./mcpClient.js";
+export type { OwaspReport, OwaspBucket, OwaspId, NormalizedFinding, Grade, ConnectionTarget, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzF,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,YAAY,EACV,WAAW,EACX,WAAW,EACX,OAAO,EACP,iBAAiB,EACjB,KAAK,EACL,gBAAgB,GACjB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { scanPath, scanLive, scanCatalogJson, scanCatalogFile } from "./orchestrator.js";
+export { gradeFromFindings } from "./grade.js";
+export { OWASP_TITLES, resolveOwasp } from "./owaspMap.js";
+export { connectAndListTools } from "./mcpClient.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/mcpClient.d.ts

@@ -0,0 +1,17 @@
+import type { ConnectionTarget } from "./types.js";
+export interface LiveTool {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+    annotations?: unknown;
+}
+export interface LiveServerInfo {
+    serverInfo?: {
+        name: string;
+        version: string;
+    };
+    tools: LiveTool[];
+}
+/** Connect just long enough to call tools/list (same pattern as rug-pull-detector). */
+export declare function connectAndListTools(target: ConnectionTarget, timeoutMs?: number): Promise<LiveServerInfo>;
+//# sourceMappingURL=mcpClient.d.ts.map

package/dist/mcpClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpClient.d.ts","sourceRoot":"","sources":["../src/mcpClient.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,KAAK,EAAE,QAAQ,EAAE,CAAC;CACnB;AAED,uFAAuF;AACvF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,SAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAwB9G"}

package/dist/mcpClient.js

@@ -0,0 +1,34 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+/** Connect just long enough to call tools/list (same pattern as rug-pull-detector). */
+export async function connectAndListTools(target, timeoutMs = 15000) {
+    const client = new Client({ name: "guardbee-owasp-scan", version: "0.1.0" }, { capabilities: {} });
+    const transport = target.type === "stdio"
+        ? new StdioClientTransport({ command: target.command, args: target.args, env: target.env, cwd: target.cwd })
+        : new StreamableHTTPClientTransport(new URL(target.url));
+    try {
+        await withTimeout(client.connect(transport), timeoutMs, "Connecting to the server");
+        const serverVersion = client.getServerVersion();
+        const { tools } = await withTimeout(client.listTools(), timeoutMs, "Listing tools");
+        return {
+            serverInfo: serverVersion ? { name: serverVersion.name, version: serverVersion.version } : undefined,
+            tools: tools.map((t) => ({
+                name: t.name,
+                description: t.description,
+                inputSchema: t.inputSchema,
+                annotations: t.annotations,
+            })),
+        };
+    }
+    finally {
+        await client.close().catch(() => { });
+    }
+}
+function withTimeout(promise, ms, what) {
+    return Promise.race([
+        promise,
+        new Promise((_, reject) => setTimeout(() => reject(new Error(`${what} timed out after ${ms}ms`)), ms)),
+    ]);
+}
+//# sourceMappingURL=mcpClient.js.map

package/dist/mcpClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpClient.js","sourceRoot":"","sources":["../src/mcpClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAenG,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAwB,EAAE,SAAS,GAAG,KAAK;IACnF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IACnG,MAAM,SAAS,GACb,MAAM,CAAC,IAAI,KAAK,OAAO;QACrB,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QAC5G,CAAC,CAAC,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACpF,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAChD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAEpF,OAAO;YACL,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;YACpG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU,EAAE,IAAY;IACnE,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,OAAO;QACP,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KAC1G,CAAC,CAAC;AACL,CAAC"}

package/dist/orchestrator.d.ts

@@ -0,0 +1,14 @@
+import type { ConnectionTarget, OwaspReport } from "./types.js";
+export interface PathScanOptions {
+    maxFiles?: number;
+    exclude?: string[];
+    /** Path to Shadow MCP allowlist (JSON/YAML). Used when discoverShadow is true. */
+    allowlistPath?: string;
+    /** Also walk host MCP client configs for Shadow MCP (MCP09). Default false. */
+    discoverShadow?: boolean;
+}
+export declare function scanPath(targetPath: string, options?: PathScanOptions): OwaspReport;
+export declare function scanCatalogJson(raw: string, label?: string): OwaspReport;
+export declare function scanLive(target: ConnectionTarget, timeoutMs?: number): Promise<OwaspReport>;
+export declare function scanCatalogFile(path: string): OwaspReport;
+//# sourceMappingURL=orchestrator.d.ts.map

package/dist/orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,gBAAgB,EAIhB,WAAW,EAEZ,MAAM,YAAY,CAAC;AA+DpB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AASD,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,WAAW,CAyJvF;AA2ID,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,SAAY,GAAG,WAAW,CA0C3E;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,SAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAwBhG;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAEzD"}

package/dist/orchestrator.js

@@ -0,0 +1,328 @@
+import { scanDirectory as scanSecrets, scanFile as secretScanFile } from "@guardbee/mcp-secret-scanner";
+import { scanDirectory as scanServer, scanFile as serverScanFile } from "@guardbee/mcp-server-auditor";
+import { scanDirectory as scanOAuth, scanFile as oauthScanFile } from "@guardbee/mcp-oauth-auditor";
+import { scanDirectory as scanAuditGap, scanFile as auditScanFile } from "@guardbee/mcp-audit-gap-auditor";
+import { scanDirectory as scanContext, scanFile as contextScanFile } from "@guardbee/mcp-context-oversharing-auditor";
+import { scanDirectory as scanToxicDir, scanSourceFile as toxicScanFile, auditCatalog, parseToolsJson, } from "@guardbee/mcp-toxic-flow-auditor";
+import { scanDirectory as scanPoisonDir, scanFile as poisonScanFile, scanToolCatalog } from "@guardbee/mcp-tool-poisoning-scanner";
+import { discoverShadowMcp, loadAllowlistFile } from "@guardbee/mcp-config-auditor";
+import { statSync, readFileSync } from "fs";
+import { gradeFromFindings } from "./grade.js";
+import { OWASP_TITLES, resolveOwasp } from "./owaspMap.js";
+import { connectAndListTools } from "./mcpClient.js";
+function normalize(partial, source) {
+    const owasp = resolveOwasp(partial.owasp, partial.patternId, source);
+    if (!owasp)
+        return null;
+    return {
+        patternId: partial.patternId,
+        patternName: partial.patternName,
+        severity: partial.severity,
+        owasp,
+        source,
+        recommendation: partial.recommendation ?? `See ${source} / ${partial.patternId}`,
+        file: partial.file,
+        line: partial.line,
+        column: partial.column,
+        match: partial.match,
+        tools: partial.tools,
+    };
+}
+function bucketize(findings) {
+    const ids = Object.keys(OWASP_TITLES);
+    return ids.map((id) => {
+        const items = findings.filter((f) => f.owasp === id);
+        return { id, title: OWASP_TITLES[id], findingCount: items.length, findings: items };
+    });
+}
+function buildReport(mode, label, findings, start, extras = {}) {
+    const { grade, score } = gradeFromFindings(findings);
+    return {
+        mode,
+        grade,
+        score,
+        totalFindings: findings.length,
+        byOwasp: bucketize(findings),
+        findings,
+        durationMs: Date.now() - start,
+        label,
+        ...extras,
+    };
+}
+function pushNormalized(findings, items, source) {
+    for (const item of items) {
+        const n = normalize(item, source);
+        if (n)
+            findings.push(n);
+    }
+}
+export function scanPath(targetPath, options = {}) {
+    const start = Date.now();
+    const maxFiles = options.maxFiles ?? 5000;
+    const exclude = options.exclude;
+    const findings = [];
+    let scannedFiles = 0;
+    const stat = statSync(targetPath);
+    if (!stat.isDirectory() && !stat.isFile()) {
+        throw new Error(`Path is neither file nor directory: ${targetPath}`);
+    }
+    if (stat.isFile()) {
+        const report = scanSingleFile(targetPath, start);
+        if (options.discoverShadow) {
+            report.findings.push(...runDiscover(options.allowlistPath));
+            report.totalFindings = report.findings.length;
+            report.byOwasp = bucketize(report.findings);
+            const graded = gradeFromFindings(report.findings);
+            report.grade = graded.grade;
+            report.score = graded.score;
+        }
+        return report;
+    }
+    const dirOpts = { maxFiles, exclude };
+    const secrets = scanSecrets(targetPath, dirOpts);
+    scannedFiles = Math.max(scannedFiles, secrets.scannedFiles);
+    pushNormalized(findings, secrets.findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        recommendation: "Remove or rotate the leaked credential; load secrets from a vault/env at runtime.",
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "secret-scanner");
+    const server = scanServer(targetPath, dirOpts);
+    scannedFiles = Math.max(scannedFiles, server.scannedFiles);
+    pushNormalized(findings, server.findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "mcp-server-auditor");
+    const oauth = scanOAuth(targetPath, dirOpts);
+    scannedFiles = Math.max(scannedFiles, oauth.scannedFiles);
+    pushNormalized(findings, oauth.findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        recommendation: f.recommendation,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "oauth-auditor");
+    const audit = scanAuditGap(targetPath, dirOpts);
+    scannedFiles = Math.max(scannedFiles, audit.scannedFiles);
+    pushNormalized(findings, audit.findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "audit-gap");
+    const ctx = scanContext(targetPath, dirOpts);
+    scannedFiles = Math.max(scannedFiles, ctx.scannedFiles);
+    pushNormalized(findings, ctx.findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "context-oversharing");
+    const toxic = scanToxicDir(targetPath, dirOpts);
+    pushNormalized(findings, toxic.findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        match: f.match,
+        tools: f.tools,
+    })), "toxic-flow");
+    const poison = scanPoisonDir(targetPath, dirOpts);
+    scannedFiles = Math.max(scannedFiles, poison.scannedFiles);
+    pushNormalized(findings, poison.findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "tool-poisoning");
+    if (options.discoverShadow) {
+        findings.push(...runDiscover(options.allowlistPath));
+    }
+    return buildReport("path", targetPath, findings, start, { scannedFiles });
+}
+function scanSingleFile(filePath, start) {
+    const findings = [];
+    pushNormalized(findings, secretScanFile(filePath).findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        recommendation: "Remove or rotate the leaked credential; load secrets from a vault/env at runtime.",
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "secret-scanner");
+    pushNormalized(findings, serverScanFile(filePath).findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "mcp-server-auditor");
+    pushNormalized(findings, oauthScanFile(filePath).findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        recommendation: f.recommendation,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "oauth-auditor");
+    pushNormalized(findings, auditScanFile(filePath).findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "audit-gap");
+    pushNormalized(findings, contextScanFile(filePath).findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "context-oversharing");
+    pushNormalized(findings, poisonScanFile(filePath).findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "tool-poisoning");
+    const toxic = toxicScanFile(filePath);
+    if (!toxic.skipped) {
+        pushNormalized(findings, toxic.result.findings.map((f) => ({
+            patternId: f.patternId,
+            patternName: f.patternName,
+            severity: f.severity,
+            owasp: f.owasp,
+            recommendation: f.recommendation,
+            match: f.match,
+            tools: f.tools,
+        })), "toxic-flow");
+    }
+    return buildReport("path", filePath, findings, start, { scannedFiles: 1 });
+}
+function runDiscover(allowlistPath) {
+    let allowlist = null;
+    if (allowlistPath) {
+        allowlist = loadAllowlistFile(allowlistPath);
+    }
+    const result = discoverShadowMcp({ allowlist });
+    const out = [];
+    pushNormalized(out, result.findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        match: f.match,
+    })), "config-discover");
+    return out;
+}
+export function scanCatalogJson(raw, label = "catalog") {
+    const start = Date.now();
+    const tools = parseToolsJson(raw);
+    const findings = [];
+    const toxic = auditCatalog(tools, label);
+    pushNormalized(findings, toxic.findings.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        match: f.match,
+        tools: f.tools,
+    })), "toxic-flow");
+    const poison = scanToolCatalog(tools.map((t) => ({
+        name: t.name,
+        description: t.description,
+        inputSchema: t.inputSchema,
+    })));
+    pushNormalized(findings, poison.map((f) => ({
+        patternId: f.patternId,
+        patternName: f.patternName,
+        severity: f.severity,
+        owasp: f.owasp,
+        recommendation: f.recommendation,
+        match: f.match,
+        tools: [f.toolName],
+    })), "tool-poisoning");
+    return buildReport("catalog", label, findings, start, { toolCount: tools.length });
+}
+export async function scanLive(target, timeoutMs = 15000) {
+    const start = Date.now();
+    const live = await connectAndListTools(target, timeoutMs);
+    const label = target.type === "http"
+        ? target.url
+        : [target.command, ...(target.args ?? [])].join(" ");
+    const toolsJson = JSON.stringify({
+        tools: live.tools.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.inputSchema,
+        })),
+    });
+    const report = scanCatalogJson(toolsJson, label);
+    report.mode = "live";
+    report.toolCount = live.tools.length;
+    report.durationMs = Date.now() - start;
+    if (live.serverInfo) {
+        report.label = `${live.serverInfo.name}@${live.serverInfo.version} (${label})`;
+    }
+    return report;
+}
+export function scanCatalogFile(path) {
+    return scanCatalogJson(readFileSync(path, "utf8"), path);
+}
+//# sourceMappingURL=orchestrator.js.map

package/dist/orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,IAAI,WAAW,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACxG,OAAO,EAAE,aAAa,IAAI,UAAU,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACvG,OAAO,EAAE,aAAa,IAAI,SAAS,EAAE,QAAQ,IAAI,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACpG,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,QAAQ,IAAI,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAC3G,OAAO,EAAE,aAAa,IAAI,WAAW,EAAE,QAAQ,IAAI,eAAe,EAAE,MAAM,2CAA2C,CAAC;AACtH,OAAO,EACL,aAAa,IAAI,YAAY,EAC7B,cAAc,IAAI,aAAa,EAC/B,YAAY,EACZ,cAAc,GACf,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,QAAQ,IAAI,cAAc,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACnI,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAkB,MAAM,8BAA8B,CAAC;AACpG,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAUrD,SAAS,SAAS,CAChB,OAWC,EACD,MAAc;IAEd,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAoB;QACtC,KAAK;QACL,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,MAAM,MAAM,OAAO,CAAC,SAAS,EAAE;QAChF,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,QAA6B;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAc,CAAC;IACnD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAClB,IAAyB,EACzB,KAAa,EACb,QAA6B,EAC7B,KAAa,EACb,SAA+B,EAAE;IAEjC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO;QACL,IAAI;QACJ,KAAK;QACL,KAAK;QACL,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC5B,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;QAC9B,KAAK;QACL,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAWD,SAAS,cAAc,CAAC,QAA6B,EAAE,KAA6C,EAAE,MAAc;IAClH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,UAA2B,EAAE;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;YAC5D,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACjD,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5D,cAAc,CACZ,QAAQ,EACR,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,cAAc,EAAE,mFAAmF;QACnG,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,gBAAgB,CACjB,CAAC;IAEF,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/C,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3D,cAAc,CACZ,QAAQ,EACR,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,oBAAoB,CACrB,CAAC;IAEF,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7C,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,cAAc,CACZ,QAAQ,EACR,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,eAAe,CAChB,CAAC;IAEF,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,cAAc,CACZ,QAAQ,EACR,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,WAAW,CACZ,CAAC;IAEF,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7C,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IACxD,cAAc,CACZ,QAAQ,EACR,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,qBAAqB,CACtB,CAAC;IAEF,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,cAAc,CACZ,QAAQ,EACR,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,YAAY,CACb,CAAC;IAEF,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3D,cAAc,CACZ,QAAQ,EACR,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,gBAAgB,CACjB,CAAC;IAEF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,KAAa;IACrD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,cAAc,CACZ,QAAQ,EACR,cAAc,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,cAAc,EAAE,mFAAmF;QACnG,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,gBAAgB,CACjB,CAAC;IACF,cAAc,CACZ,QAAQ,EACR,cAAc,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,oBAAoB,CACrB,CAAC;IACF,cAAc,CACZ,QAAQ,EACR,aAAa,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,eAAe,CAChB,CAAC;IACF,cAAc,CACZ,QAAQ,EACR,aAAa,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,WAAW,CACZ,CAAC;IACF,cAAc,CACZ,QAAQ,EACR,eAAe,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,qBAAqB,CACtB,CAAC;IACF,cAAc,CACZ,QAAQ,EACR,cAAc,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,gBAAgB,CACjB,CAAC;IAEF,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,cAAc,CACZ,QAAQ,EACR,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC,EACH,YAAY,CACb,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,aAAsB;IACzC,IAAI,SAAS,GAAqB,IAAI,CAAC;IACvC,IAAI,aAAa,EAAE,CAAC;QAClB,SAAS,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,cAAc,CACZ,GAAG,EACH,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,iBAAiB,CAClB,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,KAAK,GAAG,SAAS;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACzC,cAAc,CACZ,QAAQ,EACR,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,EACH,YAAY,CACb,CAAC;IAEF,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC,CAAC,CACJ,CAAC;IACF,cAAc,CACZ,QAAQ,EACR,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;KACpB,CAAC,CAAC,EACH,gBAAgB,CACjB,CAAC;IAEF,OAAO,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAwB,EAAE,SAAS,GAAG,KAAK;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,KAAK,GACT,MAAM,CAAC,IAAI,KAAK,MAAM;QACpB,CAAC,CAAC,MAAM,CAAC,GAAG;QACZ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEzD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IACrC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,KAAK,KAAK,GAAG,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC"}

package/dist/owaspMap.d.ts

@@ -0,0 +1,5 @@
+import type { OwaspId } from "./types.js";
+export declare const OWASP_TITLES: Record<OwaspId, string>;
+/** Map a scanner finding to an OWASP MCP Top 10 id. */
+export declare function resolveOwasp(explicit: string | undefined, patternId: string, source: string): OwaspId | null;
+//# sourceMappingURL=owaspMap.d.ts.map

package/dist/owaspMap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owaspMap.d.ts","sourceRoot":"","sources":["../src/owaspMap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAWhD,CAAC;AAEF,uDAAuD;AACvD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,GAAG,IAAI,CAmBhB"}

package/dist/owaspMap.js

@@ -0,0 +1,42 @@
+export const OWASP_TITLES = {
+    "MCP01:2025": "Token / credential exposure",
+    "MCP02:2025": "Privilege / excessive agency",
+    "MCP03:2025": "Tool poisoning / rug pull surface",
+    "MCP04:2025": "Supply chain / dependency risk",
+    "MCP05:2025": "Command / code injection via tools",
+    "MCP06:2025": "Prompt / context injection",
+    "MCP07:2025": "Auth / OAuth misconfiguration",
+    "MCP08:2025": "Lack of audit and telemetry",
+    "MCP09:2025": "Shadow MCP servers",
+    "MCP10:2025": "Toxic flows / context oversharing",
+};
+/** Map a scanner finding to an OWASP MCP Top 10 id. */
+export function resolveOwasp(explicit, patternId, source) {
+    if (explicit && /^MCP\d{2}:2025$/.test(explicit))
+        return explicit;
+    if (source === "secret-scanner")
+        return "MCP01:2025";
+    if (source === "tool-poisoning")
+        return "MCP03:2025";
+    if (source === "oauth-auditor")
+        return "MCP07:2025";
+    if (source === "audit-gap")
+        return "MCP08:2025";
+    if (source === "config-discover")
+        return "MCP09:2025";
+    if (source === "context-oversharing" || source === "toxic-flow")
+        return "MCP10:2025";
+    if (source === "mcp-server-auditor") {
+        if (/shell|eval|sql_injection/i.test(patternId))
+            return "MCP05:2025";
+        if (/unrestricted_shell|excessive/i.test(patternId))
+            return "MCP02:2025";
+        if (/secret|env_exposed|hardcoded/i.test(patternId))
+            return "MCP01:2025";
+        if (/ssrf|cors/i.test(patternId))
+            return "MCP02:2025";
+        return "MCP02:2025";
+    }
+    return null;
+}
+//# sourceMappingURL=owaspMap.js.map

package/dist/owaspMap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owaspMap.js","sourceRoot":"","sources":["../src/owaspMap.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,YAAY,GAA4B;IACnD,YAAY,EAAE,6BAA6B;IAC3C,YAAY,EAAE,8BAA8B;IAC5C,YAAY,EAAE,mCAAmC;IACjD,YAAY,EAAE,gCAAgC;IAC9C,YAAY,EAAE,oCAAoC;IAClD,YAAY,EAAE,4BAA4B;IAC1C,YAAY,EAAE,+BAA+B;IAC7C,YAAY,EAAE,6BAA6B;IAC3C,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,mCAAmC;CAClD,CAAC;AAEF,uDAAuD;AACvD,MAAM,UAAU,YAAY,CAC1B,QAA4B,EAC5B,SAAiB,EACjB,MAAc;IAEd,IAAI,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAmB,CAAC;IAE7E,IAAI,MAAM,KAAK,gBAAgB;QAAE,OAAO,YAAY,CAAC;IACrD,IAAI,MAAM,KAAK,gBAAgB;QAAE,OAAO,YAAY,CAAC;IACrD,IAAI,MAAM,KAAK,eAAe;QAAE,OAAO,YAAY,CAAC;IACpD,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,YAAY,CAAC;IAChD,IAAI,MAAM,KAAK,iBAAiB;QAAE,OAAO,YAAY,CAAC;IACtD,IAAI,MAAM,KAAK,qBAAqB,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAErF,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpC,IAAI,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,YAAY,CAAC;QACrE,IAAI,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,YAAY,CAAC;QACzE,IAAI,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,YAAY,CAAC;QACzE,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,YAAY,CAAC;QACtD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sarif.d.ts

@@ -0,0 +1,8 @@
+import type { NormalizedFinding } from "./types.js";
+/**
+ * `fallbackUri` anchors findings that have no file of their own (toxic-flow
+ * combinations, catalog/live results) — GitHub code scanning rejects results
+ * without a location.
+ */
+export declare function buildSarif(toolVersion: string, findings: NormalizedFinding[], fallbackUri?: string): object;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA6BpD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAwD3G"}

package/dist/sarif.js

@@ -0,0 +1,67 @@
+function severityToLevel(sev) {
+    if (sev === "critical" || sev === "high")
+        return "error";
+    if (sev === "medium")
+        return "warning";
+    return "note";
+}
+/**
+ * `fallbackUri` anchors findings that have no file of their own (toxic-flow
+ * combinations, catalog/live results) — GitHub code scanning rejects results
+ * without a location.
+ */
+export function buildSarif(toolVersion, findings, fallbackUri) {
+    const rulesMap = new Map();
+    const results = [];
+    for (const f of findings) {
+        const ruleId = `${f.source}:${f.patternId}`;
+        if (!rulesMap.has(ruleId)) {
+            rulesMap.set(ruleId, {
+                id: ruleId,
+                name: f.patternName.replace(/[^a-zA-Z0-9]/g, ""),
+                shortDescription: { text: f.patternName },
+                fullDescription: { text: f.recommendation },
+                helpUri: "https://guardbee.ai/docs/owasp-scan",
+                properties: {
+                    "problem.severity": f.severity,
+                    tags: ["security", "ai-security", "mcp-security", f.owasp, f.source],
+                },
+            });
+        }
+        const result = {
+            ruleId,
+            level: severityToLevel(f.severity),
+            message: { text: `${f.patternName} [${f.owasp}] — ${f.recommendation}` },
+        };
+        const uri = f.file ?? fallbackUri;
+        if (uri) {
+            result.locations = [
+                {
+                    physicalLocation: {
+                        artifactLocation: { uri, uriBaseId: "%SRCROOT%" },
+                        region: { startLine: f.line ?? 1, startColumn: f.column ?? 1 },
+                    },
+                },
+            ];
+        }
+        results.push(result);
+    }
+    return {
+        $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "@guardbee/mcp-owasp-scan",
+                        version: toolVersion,
+                        informationUri: "https://guardbee.ai",
+                        rules: Array.from(rulesMap.values()),
+                    },
+                },
+                results,
+            },
+        ],
+    };
+}
+//# sourceMappingURL=sarif.js.map

package/dist/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAuBA,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACzD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,WAAmB,EAAE,QAA6B,EAAE,WAAoB;IACjG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE;gBACnB,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;gBAChD,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;gBACzC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE;gBAC3C,OAAO,EAAE,qCAAqC;gBAC9C,UAAU,EAAE;oBACV,kBAAkB,EAAE,CAAC,CAAC,QAAQ;oBAC9B,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;iBACrE;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,MAAM;YACN,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;SACzE,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC;QAClC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,SAAS,GAAG;gBACjB;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE;wBACjD,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE;qBAC/D;iBACF;aACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,gGAAgG;QACzG,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,0BAA0B;wBAChC,OAAO,EAAE,WAAW;wBACpB,cAAc,EAAE,qBAAqB;wBACrC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;qBACrC;iBACF;gBACD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,2 @@
+export declare function startServer(): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AA4BA,wBAAsB,WAAW,kBA4EhC"}

package/dist/server.js

@@ -0,0 +1,80 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { instrumentServer } from "@guardbee/mcp-telemetry";
+import { z } from "zod";
+import { scanPath, scanLive, scanCatalogJson } from "./orchestrator.js";
+import { OWASP_TITLES } from "./owaspMap.js";
+function formatReport(report) {
+    const lines = [
+        `Grade ${report.grade} (${report.score}/100) — ${report.totalFindings} finding(s), ${report.durationMs}ms`,
+        `mode=${report.mode} label=${report.label}`,
+        "",
+    ];
+    for (const bucket of report.byOwasp) {
+        lines.push(`${bucket.id} ${bucket.title}: ${bucket.findingCount}`);
+    }
+    lines.push("");
+    for (const f of report.findings.slice(0, 40)) {
+        const loc = f.file ? `${f.file}:${f.line ?? 0}` : f.tools?.join(", ") ?? f.source;
+        lines.push(`[${f.severity}] ${f.owasp} ${f.patternName} (${loc})`);
+        lines.push(`  ${f.recommendation}`);
+    }
+    if (report.findings.length > 40)
+        lines.push(`… +${report.findings.length - 40} more`);
+    if (report.totalFindings === 0)
+        lines.push("✅ No OWASP MCP Top 10 findings.");
+    return lines.join("\n");
+}
+export async function startServer() {
+    const server = new McpServer({
+        name: "guardbee-owasp-scan",
+        version: "0.1.0",
+    });
+    instrumentServer(server, "owasp-scan");
+    server.tool("owasp_scan_path", "Run a unified OWASP MCP Top 10 scan over a filesystem path — orchestrates secret, server, oauth, audit-gap, context-oversharing, toxic-flow, and tool-poisoning auditors; returns A–F grade.", {
+        path: z.string().describe("File or directory to scan"),
+        maxFiles: z.number().int().positive().optional(),
+        discoverShadow: z.boolean().optional().describe("Also discover Shadow MCP on this host (MCP09)"),
+        allowlistPath: z.string().optional().describe("Allowlist file for Shadow MCP discover"),
+    }, async ({ path, maxFiles, discoverShadow, allowlistPath }) => {
+        const report = scanPath(path, { maxFiles, discoverShadow, allowlistPath });
+        return { content: [{ type: "text", text: formatReport(report) }] };
+    });
+    server.tool("owasp_scan_live", "Connect to a live MCP server (stdio or HTTP), call tools/list, then grade toxic-flow + tool-poisoning (MCP03/MCP10).", {
+        url: z.string().url().optional().describe("Streamable HTTP MCP URL"),
+        command: z.string().optional().describe("stdio command to spawn"),
+        args: z.array(z.string()).optional(),
+    }, async ({ url, command, args }) => {
+        if (url) {
+            const report = await scanLive({ type: "http", url });
+            return { content: [{ type: "text", text: formatReport(report) }] };
+        }
+        if (command) {
+            const report = await scanLive({ type: "stdio", command, args });
+            return { content: [{ type: "text", text: formatReport(report) }] };
+        }
+        return { content: [{ type: "text", text: "Provide either url or command." }], isError: true };
+    });
+    server.tool("owasp_scan_catalog", "Audit a tools/list JSON dump for toxic flows and tool-description poisoning (MCP03/MCP10).", {
+        catalog: z.string().describe("JSON string: { tools: [...] } or a bare tools array"),
+        label: z.string().optional(),
+    }, async ({ catalog, label }) => {
+        const report = scanCatalogJson(catalog, label);
+        return { content: [{ type: "text", text: formatReport(report) }] };
+    });
+    server.tool("list_owasp_coverage", "List OWASP MCP Top 10 categories and which GuardBee scanners cover them in this meta-scan", {}, async () => {
+        const lines = ["OWASP MCP Top 10 coverage in @guardbee/mcp-owasp-scan:\n"];
+        for (const [id, title] of Object.entries(OWASP_TITLES)) {
+            lines.push(`${id} — ${title}`);
+        }
+        lines.push("");
+        lines.push("Path scan: MCP01 secrets, MCP02/05 server-auditor, MCP03 poisoning, MCP07 oauth, MCP08 audit-gap, MCP09 discover (opt), MCP10 toxic-flow + context-oversharing.");
+        lines.push("Live/catalog: MCP03 poisoning + MCP10 toxic-flow (and related pairs).");
+        lines.push("MCP04 supply-chain: use @guardbee/mcp-dependency-auditor / slopsquat-scanner separately (network).");
+        lines.push("MCP06 prompt injection in RAG content: use @guardbee/mcp-prompt-injection-scanner separately.");
+        return { content: [{ type: "text", text: lines.join("\n") }] };
+    });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,SAAS,YAAY,CAAC,MAAmB;IACvC,MAAM,KAAK,GAAa;QACtB,SAAS,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,aAAa,gBAAgB,MAAM,CAAC,UAAU,IAAI;QAC1G,QAAQ,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,KAAK,EAAE;QAC3C,EAAE;KACH,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAClF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,KAAK,GAAG,GAAG,CAAC,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IACH,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAEvC,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,8LAA8L,EAC9L;QACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAChD,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;QAChG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;KACxF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACrE,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,sHAAsH,EACtH;QACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACpE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACrC,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QAC/B,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChG,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,4FAA4F,EAC5F;QACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;QACnF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACrE,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,2FAA2F,EAC3F,EAAE,EACF,KAAK,IAAI,EAAE;QACT,MAAM,KAAK,GAAG,CAAC,0DAA0D,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,iKAAiK,CAAC,CAAC;QAC9K,KAAK,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACpF,KAAK,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;QACjH,KAAK,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;QAC5G,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACjE,CAAC,CACF,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,45 @@
+export type OwaspId = "MCP01:2025" | "MCP02:2025" | "MCP03:2025" | "MCP04:2025" | "MCP05:2025" | "MCP06:2025" | "MCP07:2025" | "MCP08:2025" | "MCP09:2025" | "MCP10:2025";
+export type Grade = "A" | "B" | "C" | "D" | "F";
+export type Severity = "critical" | "high" | "medium" | "low";
+export interface NormalizedFinding {
+    patternId: string;
+    patternName: string;
+    severity: Severity;
+    owasp: OwaspId;
+    source: string;
+    recommendation: string;
+    file?: string;
+    line?: number;
+    column?: number;
+    match: string;
+    tools?: string[];
+}
+export interface OwaspBucket {
+    id: OwaspId;
+    title: string;
+    findingCount: number;
+    findings: NormalizedFinding[];
+}
+export interface OwaspReport {
+    mode: "path" | "live" | "catalog";
+    grade: Grade;
+    score: number;
+    scannedFiles?: number;
+    toolCount?: number;
+    totalFindings: number;
+    byOwasp: OwaspBucket[];
+    findings: NormalizedFinding[];
+    durationMs: number;
+    label: string;
+}
+export type ConnectionTarget = {
+    type: "stdio";
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+    cwd?: string;
+} | {
+    type: "http";
+    url: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GACf,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,YAAY,CAAC;AAEjB,MAAM,MAAM,KAAK,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAEhD,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAClC,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/F;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,62 @@
 {
   "name": "@guardbee/mcp-owasp-scan",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "mcpName": "io.github.4hmetuyar/owasp-scan",
+  "description": "Unified OWASP MCP Top 10 scanner — one CLI/MCP that orchestrates GuardBee auditors against a path or a live tools/list, maps findings to MCP01–MCP10, and grades A–F",
+  "type": "module",
+  "bin": {
+    "guardbee-owasp-scan": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "TR.md",
+    "ZH.md"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "zod": "^4.5.4",
+    "@guardbee/mcp-audit-gap-auditor": "^0.2.0",
+    "@guardbee/mcp-context-oversharing-auditor": "^0.1.0",
+    "@guardbee/mcp-config-auditor": "^0.4.0",
+    "@guardbee/mcp-toxic-flow-auditor": "^0.1.5",
+    "@guardbee/mcp-telemetry": "^0.1.3",
+    "@guardbee/mcp-oauth-auditor": "^0.1.3",
+    "@guardbee/mcp-server-auditor": "^0.1.6",
+    "@guardbee/mcp-secret-scanner": "^0.2.11",
+    "@guardbee/mcp-tool-poisoning-scanner": "^0.2.1"
+  },
+  "keywords": [
+    "mcp",
+    "security",
+    "ai-security",
+    "mcp-security",
+    "owasp",
+    "owasp-mcp-top-10",
+    "guardbee",
+    "devtools"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/GuardBee/guardbee-mcp.git",
+    "directory": "packages/owasp-scan"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/cli.js",
+    "test": "vitest run"
+  }
 }