@guardbee/mcp-reverse-shield 0.0.0-stage → 0.1.1

package/dist/rules.d.ts

@@ -0,0 +1,22 @@
+export type Severity = "critical" | "high" | "medium" | "low";
+export type RuleCategory = "source-exposure" | "obfuscation" | "debug-surface" | "tamper-resistance" | "binary-hardening" | "secrets-in-artifact";
+export type TargetKind = "web" | "electron" | "android" | "native" | "dotnet";
+export interface Rule {
+    id: string;
+    name: string;
+    target: TargetKind;
+    category: RuleCategory;
+    severity: Severity;
+    /** What an analyst (or an agent driving a reverse-engineering MCP) gets out of this. */
+    exposes: string;
+    recommendation: string;
+}
+/**
+ * Every check this package runs. A finding carries one of these ids; the
+ * severity here is the default and a few checks raise or lower it from what
+ * they actually find (a source map that embeds the original sources is worse
+ * than one that only maps positions).
+ */
+export declare const RULES: Rule[];
+export declare function getRule(id: string): Rule;
+//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,YAAY,GACpB,iBAAiB,GACjB,aAAa,GACb,eAAe,GACf,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9E,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,KAAK,EAAE,IAAI,EAuVvB,CAAC;AAIF,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAIxC"}

package/dist/rules.js

@@ -0,0 +1,354 @@
+/**
+ * Every check this package runs. A finding carries one of these ids; the
+ * severity here is the default and a few checks raise or lower it from what
+ * they actually find (a source map that embeds the original sources is worse
+ * than one that only maps positions).
+ */
+export const RULES = [
+    // ── Web / JavaScript bundles ───────────────────────────────────────────────
+    {
+        id: "sourcemap_embeds_source",
+        name: "Source map ships the original source code",
+        target: "web",
+        category: "source-exposure",
+        severity: "critical",
+        exposes: "The complete pre-build source (file names, comments, un-minified code) via the map's sourcesContent.",
+        recommendation: "Do not deploy .map files. Generate them as 'hidden' source maps (webpack devtool: 'hidden-source-map', Vite build.sourcemap: 'hidden') and upload them only to your error tracker, or strip sourcesContent.",
+    },
+    {
+        id: "sourcemap_shipped",
+        name: "Source map shipped with the build",
+        target: "web",
+        category: "source-exposure",
+        severity: "high",
+        exposes: "Original file paths, symbol names and line structure, which turn minified code back into readable modules.",
+        recommendation: "Remove .map files from the deployed output, or serve them only to authenticated error-tracking infrastructure.",
+    },
+    {
+        id: "sourcemap_inline",
+        name: "Inline source map embedded in the bundle",
+        target: "web",
+        category: "source-exposure",
+        severity: "high",
+        exposes: "A base64 source map inside the JavaScript itself, so every visitor downloads it.",
+        recommendation: "Switch the production build away from inline source maps (webpack devtool 'inline-*', Vite build.sourcemap: 'inline').",
+    },
+    {
+        id: "sourcemap_reference",
+        name: "Bundle points at a source map URL",
+        target: "web",
+        category: "source-exposure",
+        severity: "low",
+        exposes: "Where the map lives. If that URL is ever reachable, the original sources are one request away.",
+        recommendation: "Build with hidden source maps so the //# sourceMappingURL comment is not emitted.",
+    },
+    {
+        id: "sourcemap_publicly_reachable",
+        name: "Source map is publicly downloadable",
+        target: "web",
+        category: "source-exposure",
+        severity: "high",
+        exposes: "The live site serves the map for its own bundle to anyone who asks.",
+        recommendation: "Block *.map at the CDN/web server or stop uploading them with the static assets.",
+    },
+    {
+        id: "eval_devtool_bundle",
+        name: "Development-style eval bundle",
+        target: "web",
+        category: "source-exposure",
+        severity: "high",
+        exposes: "Each module wrapped in eval() with its original path (//# sourceURL=webpack://...), effectively a source tree.",
+        recommendation: "Build in production mode; eval-based devtool settings are for local development only.",
+    },
+    {
+        id: "unminified_bundle",
+        name: "Bundle is not minified",
+        target: "web",
+        category: "obfuscation",
+        severity: "medium",
+        exposes: "Readable identifiers, comments and control flow without any deobfuscation step.",
+        recommendation: "Enable minification (Terser/esbuild/SWC) with identifier mangling for production builds. Consider javascript-obfuscator for code that encodes business logic you need to protect.",
+    },
+    {
+        id: "dev_build_framework",
+        name: "Framework development build in production",
+        target: "web",
+        category: "debug-surface",
+        severity: "medium",
+        exposes: "Component names, prop types and dev-only warnings that map the UI structure and state.",
+        recommendation: "Set NODE_ENV=production (or the framework's production flag) for the build so the development runtime is tree-shaken out.",
+    },
+    {
+        id: "bundle_secret",
+        name: "Credential embedded in shipped code",
+        target: "web",
+        category: "secrets-in-artifact",
+        severity: "high",
+        exposes: "A working credential that anyone who unpacks the artifact can lift, with no reverse engineering skill needed.",
+        recommendation: "Move the secret server-side and rotate it now; anything in a client bundle, app package or binary must be considered public.",
+    },
+    {
+        id: "internal_endpoint",
+        name: "Internal or non-production endpoint in shipped code",
+        target: "web",
+        category: "debug-surface",
+        severity: "low",
+        exposes: "Hosts behind the public surface (localhost, private IPs, *.internal, staging) that hint at infrastructure worth probing.",
+        recommendation: "Inject environment-specific URLs at build time and make sure production builds only contain production endpoints.",
+    },
+    // ── Electron ──────────────────────────────────────────────────────────────
+    {
+        id: "electron_app_unpacked",
+        name: "Electron app code shipped as plain files",
+        target: "electron",
+        category: "source-exposure",
+        severity: "high",
+        exposes: "The whole app as a readable resources/app directory that can be edited in place.",
+        recommendation: "Package the app into app.asar (electron-builder/forge do this by default) and enable the OnlyLoadAppFromAsar and EmbeddedAsarIntegrityValidation fuses.",
+    },
+    {
+        id: "electron_fuse_run_as_node",
+        name: "Electron RunAsNode fuse enabled",
+        target: "electron",
+        category: "tamper-resistance",
+        severity: "high",
+        exposes: "ELECTRON_RUN_AS_NODE=1 turns the signed app binary into a plain Node.js runtime that runs any script with the app's identity and permissions.",
+        recommendation: "Flip the RunAsNode fuse off with @electron/fuses (or electron-builder/forge fuse config).",
+    },
+    {
+        id: "electron_fuse_inspect_args",
+        name: "Electron Node inspector arguments allowed",
+        target: "electron",
+        category: "debug-surface",
+        severity: "high",
+        exposes: "--inspect / --inspect-brk attach a full debugger to the main process: breakpoints, memory and live code inside the shipped app.",
+        recommendation: "Flip the EnableNodeCliInspectArguments fuse off.",
+    },
+    {
+        id: "electron_fuse_node_options",
+        name: "Electron honours NODE_OPTIONS",
+        target: "electron",
+        category: "tamper-resistance",
+        severity: "medium",
+        exposes: "NODE_OPTIONS=--require ./hook.js injects code into the main process before the app starts.",
+        recommendation: "Flip the EnableNodeOptionsEnvironmentVariable fuse off.",
+    },
+    {
+        id: "electron_fuse_asar_integrity_off",
+        name: "Electron ASAR integrity validation off",
+        target: "electron",
+        category: "tamper-resistance",
+        severity: "medium",
+        exposes: "app.asar can be unpacked, patched and repacked without the signed binary noticing.",
+        recommendation: "Enable the EnableEmbeddedAsarIntegrityValidation fuse (requires a recent electron-builder/forge that writes the integrity hash).",
+    },
+    {
+        id: "electron_fuse_load_outside_asar",
+        name: "Electron may load the app from outside the ASAR",
+        target: "electron",
+        category: "tamper-resistance",
+        severity: "medium",
+        exposes: "Dropping a resources/app folder next to app.asar replaces the app code without touching the archive.",
+        recommendation: "Enable the OnlyLoadAppFromAsar fuse.",
+    },
+    // ── Android ───────────────────────────────────────────────────────────────
+    {
+        id: "apk_debuggable",
+        name: "APK is debuggable",
+        target: "android",
+        category: "debug-surface",
+        severity: "critical",
+        exposes: "Any device can attach a Java/native debugger, run-as into the app's private data and inspect it live.",
+        recommendation: "Ship a release build; never set android:debuggable=\"true\" (it is set automatically on debug builds).",
+    },
+    {
+        id: "apk_no_obfuscation",
+        name: "App classes are not obfuscated",
+        target: "android",
+        category: "obfuscation",
+        severity: "high",
+        exposes: "jadx output that reads like the original Kotlin/Java: class, method and field names intact.",
+        recommendation: "Enable R8 for the release build (isMinifyEnabled = true, isShrinkResources = true) and keep rules only for what reflection needs.",
+    },
+    {
+        id: "apk_js_bundle_plaintext",
+        name: "React Native bundle shipped as plain JavaScript",
+        target: "android",
+        category: "source-exposure",
+        severity: "high",
+        exposes: "assets/index.android.bundle is readable JavaScript containing the app's business logic.",
+        recommendation: "Enable Hermes so the bundle ships as bytecode, and minify it.",
+    },
+    {
+        id: "apk_unsigned",
+        name: "APK is not signed",
+        target: "android",
+        category: "tamper-resistance",
+        severity: "high",
+        exposes: "There is no signature to break, so a modified copy is indistinguishable from the original.",
+        recommendation: "Sign release builds with APK Signature Scheme v2 or later (Play App Signing does this for bundles).",
+    },
+    {
+        id: "apk_v1_only_signature",
+        name: "APK signed with JAR (v1) scheme only",
+        target: "android",
+        category: "tamper-resistance",
+        severity: "medium",
+        exposes: "v1 signatures do not cover the whole file (Janus, CVE-2017-13156), so repackaging tricks stay possible on older devices.",
+        recommendation: "Enable v2/v3 signing (default in current Android Gradle Plugin) and raise minSdk where you can.",
+    },
+    {
+        id: "apk_allow_backup",
+        name: "App data can be pulled through backup",
+        target: "android",
+        category: "debug-surface",
+        severity: "medium",
+        exposes: "adb backup / device transfer copies the app's private databases, preferences and tokens for offline analysis.",
+        recommendation: "Set android:allowBackup=\"false\", or define dataExtractionRules/fullBackupContent that exclude sensitive files.",
+    },
+    {
+        id: "apk_test_only",
+        name: "APK marked testOnly",
+        target: "android",
+        category: "debug-surface",
+        severity: "low",
+        exposes: "A test build left in a distributed package; such builds usually carry other debug affordances too.",
+        recommendation: "Distribute release builds only; testOnly is set by the IDE for run configurations.",
+    },
+    // ── Native binaries (ELF, Mach-O, PE) ──────────────────────────────────────
+    {
+        id: "native_debug_info",
+        name: "Debug information shipped in the binary",
+        target: "native",
+        category: "source-exposure",
+        severity: "high",
+        exposes: "DWARF/PDB data maps machine code back to source files, line numbers, types and local variable names.",
+        recommendation: "Strip debug info from release artifacts (strip -S / -g, dsymutil + strip on macOS, /DEBUG with a separate PDB on Windows) and keep symbols in a private symbol server.",
+    },
+    {
+        id: "native_symbols_not_stripped",
+        name: "Symbol table not stripped",
+        target: "native",
+        category: "obfuscation",
+        severity: "medium",
+        exposes: "Internal function names label the disassembly, which is most of the work a reverse engineer does by hand.",
+        recommendation: "Strip local symbols in release builds (strip, -Wl,-s, -Wl,-dead_strip -Wl,-x on macOS) and build with -fvisibility=hidden.",
+    },
+    {
+        id: "native_debuggable_entitlement",
+        name: "get-task-allow entitlement present",
+        target: "native",
+        category: "debug-surface",
+        severity: "high",
+        exposes: "macOS lets any process of the same user attach a debugger (lldb) and read the app's memory.",
+        recommendation: "Sign release builds without com.apple.security.get-task-allow (Xcode adds it only to Debug).",
+    },
+    {
+        id: "native_no_hardened_runtime",
+        name: "macOS executable without the Hardened Runtime",
+        target: "native",
+        category: "tamper-resistance",
+        severity: "medium",
+        exposes: "DYLD_INSERT_LIBRARIES injection and debugger attachment are not blocked by the OS.",
+        recommendation: "Sign with --options runtime (required for notarization) and avoid the disable-library-validation / allow-dyld-environment-variables exceptions.",
+    },
+    {
+        id: "native_injection_entitlement",
+        name: "Entitlement that re-opens code injection",
+        target: "native",
+        category: "tamper-resistance",
+        severity: "medium",
+        exposes: "disable-library-validation or allow-dyld-environment-variables lets unsigned dylibs load into the process.",
+        recommendation: "Remove the entitlement; if a plug-in model needs it, load plug-ins in a separate helper process.",
+    },
+    {
+        id: "native_unsigned",
+        name: "Binary is not code-signed",
+        target: "native",
+        category: "tamper-resistance",
+        severity: "medium",
+        exposes: "Patched copies of the binary run without any OS warning.",
+        recommendation: "Code-sign release binaries (Developer ID on macOS, Authenticode on Windows).",
+    },
+    {
+        id: "native_adhoc_signed",
+        name: "Binary is only ad-hoc signed",
+        target: "native",
+        category: "tamper-resistance",
+        severity: "low",
+        exposes: "An ad-hoc signature has no identity; anyone can re-sign a patched copy the same way.",
+        recommendation: "Sign with a Developer ID certificate and notarize.",
+    },
+    {
+        id: "native_build_path_leak",
+        name: "Build machine path embedded in the binary",
+        target: "native",
+        category: "debug-surface",
+        severity: "low",
+        exposes: "The PDB path reveals the build host's directory layout, user name and project structure.",
+        recommendation: "Use /PDBALTPATH:%_PDB% (MSVC) or -fdebug-prefix-map / -ffile-prefix-map to strip build paths.",
+    },
+    {
+        id: "native_no_pie",
+        name: "Executable is not position-independent",
+        target: "native",
+        category: "binary-hardening",
+        severity: "medium",
+        exposes: "Fixed load addresses make every address found during analysis directly reusable in an exploit.",
+        recommendation: "Build with -fPIE -pie (ELF), keep MH_PIE on macOS, and /DYNAMICBASE on Windows.",
+    },
+    {
+        id: "native_no_nx",
+        name: "Stack/data not marked non-executable",
+        target: "native",
+        category: "binary-hardening",
+        severity: "medium",
+        exposes: "Injected code on the stack or heap can run directly.",
+        recommendation: "Link with -z noexecstack (ELF) or /NXCOMPAT (Windows).",
+    },
+    {
+        id: "native_no_relro",
+        name: "No RELRO",
+        target: "native",
+        category: "binary-hardening",
+        severity: "low",
+        exposes: "The GOT stays writable, a classic target for redirecting calls after memory corruption.",
+        recommendation: "Link with -Wl,-z,relro,-z,now.",
+    },
+    {
+        id: "native_no_stack_canary",
+        name: "No stack protector",
+        target: "native",
+        category: "binary-hardening",
+        severity: "low",
+        exposes: "Stack buffer overflows overwrite return addresses without detection.",
+        recommendation: "Compile with -fstack-protector-strong.",
+    },
+    // ── .NET ──────────────────────────────────────────────────────────────────
+    {
+        id: "dotnet_not_obfuscated",
+        name: ".NET assembly is not obfuscated",
+        target: "dotnet",
+        category: "obfuscation",
+        severity: "high",
+        exposes: "ILSpy/dnSpy decompile it to C# that is close to the original, names included.",
+        recommendation: "Run an obfuscator in the release pipeline (e.g. Obfuscar, ConfuserEx 2, a commercial protector) or publish with NativeAOT where the app allows it.",
+    },
+    {
+        id: "dotnet_embedded_pdb",
+        name: ".NET assembly embeds its PDB",
+        target: "dotnet",
+        category: "source-exposure",
+        severity: "high",
+        exposes: "Embedded portable PDB gives decompilers local variable names, source paths and sometimes the source itself.",
+        recommendation: "Set <DebugType>none</DebugType> (or portable, shipped separately) for Release, and do not set EmbedAllSources.",
+    },
+];
+const RULE_BY_ID = new Map(RULES.map((r) => [r.id, r]));
+export function getRule(id) {
+    const rule = RULE_BY_ID.get(id);
+    if (!rule)
+        throw new Error(`Unknown rule: ${id}`);
+    return rule;
+}
+//# sourceMappingURL=rules.js.map

package/dist/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAuBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAW;IAC3B,8EAA8E;IAC9E;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,sGAAsG;QAC/G,cAAc,EAAE,6MAA6M;KAC9N;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4GAA4G;QACrH,cAAc,EAAE,gHAAgH;KACjI;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,0CAA0C;QAChD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,kFAAkF;QAC3F,cAAc,EAAE,wHAAwH;KACzI;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,gGAAgG;QACzG,cAAc,EAAE,mFAAmF;KACpG;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE,qCAAqC;QAC3C,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,qEAAqE;QAC9E,cAAc,EAAE,kFAAkF;KACnG;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,gHAAgH;QACzH,cAAc,EAAE,uFAAuF;KACxG;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,iFAAiF;QAC1F,cAAc,EAAE,mLAAmL;KACpM;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,wFAAwF;QACjG,cAAc,EAAE,2HAA2H;KAC5I;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,qCAAqC;QAC3C,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,qBAAqB;QAC/B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+GAA+G;QACxH,cAAc,EAAE,8HAA8H;KAC/I;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,qDAAqD;QAC3D,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,0HAA0H;QACnI,cAAc,EAAE,mHAAmH;KACpI;IAED,6EAA6E;IAC7E;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,0CAA0C;QAChD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,kFAAkF;QAC3F,cAAc,EAAE,yJAAyJ;KAC1K;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+IAA+I;QACxJ,cAAc,EAAE,2FAA2F;KAC5G;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iIAAiI;QAC1I,cAAc,EAAE,kDAAkD;KACnE;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,4FAA4F;QACrG,cAAc,EAAE,yDAAyD;KAC1E;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE,wCAAwC;QAC9C,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,oFAAoF;QAC7F,cAAc,EAAE,kIAAkI;KACnJ;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,sGAAsG;QAC/G,cAAc,EAAE,sCAAsC;KACvD;IAED,6EAA6E;IAC7E;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,uGAAuG;QAChH,cAAc,EAAE,wGAAwG;KACzH;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,gCAAgC;QACtC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6FAA6F;QACtG,cAAc,EAAE,mIAAmI;KACpJ;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,yFAAyF;QAClG,cAAc,EAAE,+DAA+D;KAChF;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4FAA4F;QACrG,cAAc,EAAE,qGAAqG;KACtH;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,sCAAsC;QAC5C,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,0HAA0H;QACnI,cAAc,EAAE,iGAAiG;KAClH;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,+GAA+G;QACxH,cAAc,EAAE,kHAAkH;KACnI;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oGAAoG;QAC7G,cAAc,EAAE,oFAAoF;KACrG;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,sGAAsG;QAC/G,cAAc,EAAE,wKAAwK;KACzL;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,2GAA2G;QACpH,cAAc,EAAE,4HAA4H;KAC7I;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,IAAI,EAAE,oCAAoC;QAC1C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6FAA6F;QACtG,cAAc,EAAE,8FAA8F;KAC/G;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,+CAA+C;QACrD,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,oFAAoF;QAC7F,cAAc,EAAE,iJAAiJ;KAClK;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE,0CAA0C;QAChD,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,4GAA4G;QACrH,cAAc,EAAE,kGAAkG;KACnH;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,0DAA0D;QACnE,cAAc,EAAE,8EAA8E;KAC/F;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,sFAAsF;QAC/F,cAAc,EAAE,oDAAoD;KACrE;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,0FAA0F;QACnG,cAAc,EAAE,+FAA+F;KAChH;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,wCAAwC;QAC9C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,gGAAgG;QACzG,cAAc,EAAE,iFAAiF;KAClG;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,sCAAsC;QAC5C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,sDAAsD;QAC/D,cAAc,EAAE,wDAAwD;KACzE;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,yFAAyF;QAClG,cAAc,EAAE,gCAAgC;KACjD;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,sEAAsE;QAC/E,cAAc,EAAE,wCAAwC;KACzD;IAED,6EAA6E;IAC7E;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+EAA+E;QACxF,cAAc,EAAE,oJAAoJ;KACrK;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6GAA6G;QACtH,cAAc,EAAE,gHAAgH;KACjI;CACF,CAAC;AAEF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAExD,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sarif.d.ts

@@ -0,0 +1,3 @@
+import type { Finding } from "./finding.js";
+export declare function buildSarif(toolVersion: string, findings: Finding[]): object;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AA6B5C,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAwD3E"}

package/dist/sarif.js

@@ -0,0 +1,60 @@
+function severityToLevel(sev) {
+    if (sev === "critical" || sev === "high")
+        return "error";
+    if (sev === "medium")
+        return "warning";
+    return "note";
+}
+export function buildSarif(toolVersion, findings) {
+    const rulesMap = new Map();
+    const results = [];
+    for (const f of findings) {
+        if (!rulesMap.has(f.patternId)) {
+            rulesMap.set(f.patternId, {
+                id: f.patternId,
+                name: f.patternName.replace(/[^a-zA-Z0-9]/g, ""),
+                shortDescription: { text: f.patternName },
+                fullDescription: { text: f.recommendation },
+                helpUri: "https://guardbee.ai/docs/reverse-shield",
+                properties: {
+                    "problem.severity": f.severity,
+                    tags: ["security", "reverse-engineering", f.target, f.category],
+                },
+            });
+        }
+        const result = {
+            ruleId: f.patternId,
+            level: severityToLevel(f.severity),
+            message: { text: f.match ? `${f.patternName} — ${f.match} — ${f.recommendation}` : `${f.patternName} — ${f.recommendation}` },
+        };
+        if (f.file) {
+            result.locations = [
+                {
+                    physicalLocation: {
+                        artifactLocation: { uri: f.file, uriBaseId: "%SRCROOT%" },
+                        region: { startLine: f.line, startColumn: f.column },
+                    },
+                },
+            ];
+        }
+        results.push(result);
+    }
+    return {
+        $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "@guardbee/mcp-reverse-shield",
+                        version: toolVersion,
+                        informationUri: "https://guardbee.ai",
+                        rules: Array.from(rulesMap.values()),
+                    },
+                },
+                results,
+            },
+        ],
+    };
+}
+//# sourceMappingURL=sarif.js.map

package/dist/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAuBA,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACzD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,WAAmB,EAAE,QAAmB;IACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE;gBACxB,EAAE,EAAE,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;gBAChD,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;gBACzC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE;gBAC3C,OAAO,EAAE,yCAAyC;gBAClD,UAAU,EAAE;oBACV,kBAAkB,EAAE,CAAC,CAAC,QAAQ;oBAC9B,IAAI,EAAE,CAAC,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;iBAChE;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,cAAc,EAAE,EAAE;SAC9H,CAAC;QAEF,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACX,MAAM,CAAC,SAAS,GAAG;gBACjB;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;wBACzD,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;qBACrD;iBACF;aACF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,gGAAgG;QACzG,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,8BAA8B;wBACpC,OAAO,EAAE,WAAW;wBACpB,cAAc,EAAE,qBAAqB;wBACrC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;qBACrC;iBACF;gBACD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/scanner.d.ts

@@ -0,0 +1,27 @@
+import type { Finding } from "./finding.js";
+import type { TargetKind } from "./rules.js";
+export interface ScanOptions {
+    maxFiles?: number;
+    include?: string[];
+    exclude?: string[];
+}
+export interface ScanResult {
+    target: string;
+    /** What was recognised: web assets, an Electron app, an APK, native binaries, .NET assemblies. */
+    kinds: TargetKind[];
+    grade: "A" | "B" | "C" | "D" | "F";
+    scannedFiles: number;
+    totalFindings: number;
+    findings: Finding[];
+    /** Context that is not a finding: fuse states, signing scheme, obfuscator detected, files skipped. */
+    notes: string[];
+    truncated: boolean;
+    durationMs: number;
+}
+/**
+ * Scans a build artifact for what it gives away to a reverse engineer: a file
+ * (APK, ASAR, bundle, source map, ELF/Mach-O/PE/.NET binary), a macOS .app,
+ * an Electron app folder, or a build output directory containing any of them.
+ */
+export declare function scanPath(target: string, options?: ScanOptions): ScanResult;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,kGAAkG;IAClG,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,sGAAsG;IACtG,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAkID;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,UAAU,CAyB9E"}