@guardbee/mcp-security-proxy 0.2.2 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -5
- package/TR.md +3 -5
- package/dist/config.d.ts +1 -1
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +36 -18
- package/dist/config.js.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +5 -1
- package/dist/index.js.map +1 -1
- package/dist/interceptors/definition-drift.d.ts +25 -0
- package/dist/interceptors/definition-drift.d.ts.map +1 -0
- package/dist/interceptors/definition-drift.js +105 -0
- package/dist/interceptors/definition-drift.js.map +1 -0
- package/dist/interceptors/prompt-injection.d.ts +1 -1
- package/dist/interceptors/prompt-injection.d.ts.map +1 -1
- package/dist/interceptors/prompt-injection.js +2 -2
- package/dist/interceptors/prompt-injection.js.map +1 -1
- package/dist/interceptors/tool-result.d.ts +4 -0
- package/dist/interceptors/tool-result.d.ts.map +1 -0
- package/dist/interceptors/tool-result.js +15 -0
- package/dist/interceptors/tool-result.js.map +1 -0
- package/dist/proxy.d.ts.map +1 -1
- package/dist/proxy.js +103 -5
- package/dist/proxy.js.map +1 -1
- package/dist/types.d.ts +8 -0
- package/dist/types.d.ts.map +1 -1
- package/package.json +3 -2
package/README.md
CHANGED
|
@@ -24,6 +24,8 @@ Claude ──► MCP Security Proxy ──► Any MCP Server
|
|
|
24
24
|
## Features
|
|
25
25
|
|
|
26
26
|
- **Prompt Injection Protection** — 16 attack patterns block requests attempting to override system prompts
|
|
27
|
+
- **Tool-result injection** — the same patterns applied to tool results, tagged MCP06:2025. Block mode replaces the result; warn mode prepends a warning
|
|
28
|
+
- **Session tool pin** — the first `tools/list` is pinned. A later description or schema change is a rug pull (MCP03:2025). Block mode keeps serving the pinned definition and refuses the drifted call
|
|
27
29
|
- **PII Masking** — national ID numbers, IBAN, email, phone, JWT tokens, API keys are automatically masked in responses
|
|
28
30
|
- **Block / Warn Mode** — each interceptor can independently run in blocking or warning mode
|
|
29
31
|
- **Audit Log** — configurable log written to console or a file
|
|
@@ -60,11 +62,7 @@ Add to `claude_desktop_config.json`:
|
|
|
60
62
|
|
|
61
63
|
## MCP Tools
|
|
62
64
|
|
|
63
|
-
The proxy
|
|
64
|
-
|
|
65
|
-
| Tool | Description |
|
|
66
|
-
|------|----------|
|
|
67
|
-
| `proxy_status` | Shows active interceptors and stats on the most recently blocked requests |
|
|
65
|
+
The proxy does not register tools of its own. It forwards the target server's tools and applies the interceptor chain on every call.
|
|
68
66
|
|
|
69
67
|
---
|
|
70
68
|
|
package/TR.md
CHANGED
|
@@ -24,6 +24,8 @@ Claude ──► MCP Security Proxy ──► Herhangi bir MCP Sunucu
|
|
|
24
24
|
## Özellikler
|
|
25
25
|
|
|
26
26
|
- **Prompt Injection Koruması** — 16 saldırı deseni ile sistem prompt'larını geçersiz kılmaya çalışan istekler engellenir
|
|
27
|
+
- **Tool sonucu enjeksiyonu** — aynı kalıplar tool sonucuna uygulanır (MCP06:2025). Block modu sonucu değiştirir; warn modu uyarı ekler
|
|
28
|
+
- **Oturum tool sabitlemesi** — ilk `tools/list` sabitlenir. Sonraki description veya şema değişikliği rug pull'dur (MCP03:2025). Block modu sabit tanımı sunmaya devam eder ve kaymış çağrıyı reddeder
|
|
27
29
|
- **PII Maskeleme** — TC kimlik no, IBAN, e-posta, telefon, JWT token, API key yanıtlarda otomatik maskelenir
|
|
28
30
|
- **Block / Warn Modu** — Her interceptor bağımsız olarak engelleyici veya uyarı modunda çalışabilir
|
|
29
31
|
- **Audit Log** — Console veya dosyaya yazılan yapılandırılabilir log
|
|
@@ -60,11 +62,7 @@ npm install -g @guardbee/mcp-security-proxy
|
|
|
60
62
|
|
|
61
63
|
## MCP Tools
|
|
62
64
|
|
|
63
|
-
Proxy
|
|
64
|
-
|
|
65
|
-
| Tool | Açıklama |
|
|
66
|
-
|------|----------|
|
|
67
|
-
| `proxy_status` | Aktif interceptor'ları ve son engellenen istek istatistiklerini gösterir |
|
|
65
|
+
Proxy kendi tool'unu kaydetmez. Hedef sunucunun tool'larını iletir ve her çağrıda interceptor zincirini uygular.
|
|
68
66
|
|
|
69
67
|
---
|
|
70
68
|
|
package/dist/config.d.ts
CHANGED
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;AA0D/D,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAAM,EAAiB,GAAG,WAAW,CA2B1E"}
|
package/dist/config.js
CHANGED
|
@@ -30,36 +30,54 @@ function parseConfigFile(filePath) {
|
|
|
30
30
|
return null;
|
|
31
31
|
}
|
|
32
32
|
}
|
|
33
|
-
function
|
|
33
|
+
function envEnabled(name, defaultEnabled) {
|
|
34
|
+
const value = process.env[name];
|
|
35
|
+
if (value === undefined)
|
|
36
|
+
return defaultEnabled;
|
|
37
|
+
return !["0", "false", "off", "no"].includes(value.toLowerCase());
|
|
38
|
+
}
|
|
39
|
+
function runtimeFromEnv() {
|
|
40
|
+
const sink = process.env["PROXY_LOG"] === "file" ? "file" : "console";
|
|
41
|
+
return {
|
|
42
|
+
audit: {
|
|
43
|
+
enabled: true,
|
|
44
|
+
sink,
|
|
45
|
+
filePath: process.env["PROXY_LOG_PATH"] ?? "./proxy-audit.jsonl",
|
|
46
|
+
},
|
|
47
|
+
interceptors: {
|
|
48
|
+
promptInjection: {
|
|
49
|
+
enabled: envEnabled("PROXY_INJECTION_CHECK", true),
|
|
50
|
+
action: process.env["PROXY_MODE"] === "warn" ? "warn" : "block",
|
|
51
|
+
},
|
|
52
|
+
toolResultInjection: {
|
|
53
|
+
enabled: envEnabled("PROXY_RESULT_CHECK", true),
|
|
54
|
+
action: process.env["PROXY_MODE"] === "warn" ? "warn" : "block",
|
|
55
|
+
},
|
|
56
|
+
definitionDrift: {
|
|
57
|
+
enabled: envEnabled("PROXY_DRIFT_CHECK", true),
|
|
58
|
+
action: process.env["PROXY_MODE"] === "warn" ? "warn" : "block",
|
|
59
|
+
},
|
|
60
|
+
piiMasking: { enabled: envEnabled("PROXY_PII_MASK", true) },
|
|
61
|
+
},
|
|
62
|
+
};
|
|
63
|
+
}
|
|
64
|
+
function loadProxyConfig(argv = process.argv) {
|
|
34
65
|
// 1. Config file: GUARDBEE_PROXY_CONFIG env or ./guardbee-proxy.json
|
|
35
66
|
const configPath = process.env["GUARDBEE_PROXY_CONFIG"] ??
|
|
36
67
|
path_1.default.join(process.cwd(), "guardbee-proxy.json");
|
|
37
68
|
const fileConfig = parseConfigFile(configPath);
|
|
38
69
|
if (fileConfig)
|
|
39
70
|
return fileConfig;
|
|
71
|
+
const runtime = runtimeFromEnv();
|
|
40
72
|
// 2. CLI args: guardbee-proxy -- <command> [args]
|
|
41
|
-
const fromArgs = parseServerFromArgs(
|
|
73
|
+
const fromArgs = parseServerFromArgs(argv);
|
|
42
74
|
if (fromArgs) {
|
|
43
|
-
return {
|
|
44
|
-
server: fromArgs,
|
|
45
|
-
audit: { enabled: true, sink: "console" },
|
|
46
|
-
interceptors: {
|
|
47
|
-
promptInjection: { enabled: true, action: "block" },
|
|
48
|
-
piiMasking: { enabled: true },
|
|
49
|
-
},
|
|
50
|
-
};
|
|
75
|
+
return { server: fromArgs, ...runtime };
|
|
51
76
|
}
|
|
52
77
|
// 3. Env vars
|
|
53
78
|
const fromEnv = parseServerFromEnv();
|
|
54
79
|
if (fromEnv) {
|
|
55
|
-
return {
|
|
56
|
-
server: fromEnv,
|
|
57
|
-
audit: { enabled: true, sink: "console" },
|
|
58
|
-
interceptors: {
|
|
59
|
-
promptInjection: { enabled: true, action: "block" },
|
|
60
|
-
piiMasking: { enabled: true },
|
|
61
|
-
},
|
|
62
|
-
};
|
|
80
|
+
return { server: fromEnv, ...runtime };
|
|
63
81
|
}
|
|
64
82
|
throw new Error("No proxy target configured. Use: guardbee-proxy -- <command> [args]\n" +
|
|
65
83
|
"Or create a guardbee-proxy.json config file.");
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;;;
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;;;AA4DA,0CA2BC;AAvFD,4CAAoB;AACpB,gDAAwB;AAGxB,SAAS,kBAAkB;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACzE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc;IACzC,sDAAsD;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACjC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,cAAuB;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IAC/C,OAAO,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,OAAO;QACL,KAAK,EAAE;YACL,OAAO,EAAE,IAAI;YACb,IAAI;YACJ,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,qBAAqB;SACjE;QACD,YAAY,EAAE;YACZ,eAAe,EAAE;gBACf,OAAO,EAAE,UAAU,CAAC,uBAAuB,EAAE,IAAI,CAAC;gBAClD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;aAChE;YACD,mBAAmB,EAAE;gBACnB,OAAO,EAAE,UAAU,CAAC,oBAAoB,EAAE,IAAI,CAAC;gBAC/C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;aAChE;YACD,eAAe,EAAE;gBACf,OAAO,EAAE,UAAU,CAAC,mBAAmB,EAAE,IAAI,CAAC;gBAC9C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;aAChE;YACD,UAAU,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,OAAiB,OAAO,CAAC,IAAI;IAC3D,qEAAqE;IACrE,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACpC,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IAEjC,kDAAkD;IAClD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;IAC1C,CAAC;IAED,cAAc;IACd,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,KAAK,CACb,uEAAuE;QACrE,8CAA8C,CACjD,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
export { startProxy } from "./proxy.js";
|
|
2
2
|
export { loadProxyConfig } from "./config.js";
|
|
3
3
|
export { scanForPromptInjection } from "./interceptors/prompt-injection.js";
|
|
4
|
+
export { scanToolResult } from "./interceptors/tool-result.js";
|
|
5
|
+
export { ToolDefinitionPin } from "./interceptors/definition-drift.js";
|
|
4
6
|
export { maskPiiInValue, maskPiiInText } from "./interceptors/pii-masker.js";
|
|
5
7
|
export { AuditLogger } from "./audit/logger.js";
|
|
6
8
|
export type { ProxyConfig, McpServerConfig, InterceptResult, AuditEvent } from "./types.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,12 +1,16 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.AuditLogger = exports.maskPiiInText = exports.maskPiiInValue = exports.scanForPromptInjection = exports.loadProxyConfig = exports.startProxy = void 0;
|
|
3
|
+
exports.AuditLogger = exports.maskPiiInText = exports.maskPiiInValue = exports.ToolDefinitionPin = exports.scanToolResult = exports.scanForPromptInjection = exports.loadProxyConfig = exports.startProxy = void 0;
|
|
4
4
|
var proxy_js_1 = require("./proxy.js");
|
|
5
5
|
Object.defineProperty(exports, "startProxy", { enumerable: true, get: function () { return proxy_js_1.startProxy; } });
|
|
6
6
|
var config_js_1 = require("./config.js");
|
|
7
7
|
Object.defineProperty(exports, "loadProxyConfig", { enumerable: true, get: function () { return config_js_1.loadProxyConfig; } });
|
|
8
8
|
var prompt_injection_js_1 = require("./interceptors/prompt-injection.js");
|
|
9
9
|
Object.defineProperty(exports, "scanForPromptInjection", { enumerable: true, get: function () { return prompt_injection_js_1.scanForPromptInjection; } });
|
|
10
|
+
var tool_result_js_1 = require("./interceptors/tool-result.js");
|
|
11
|
+
Object.defineProperty(exports, "scanToolResult", { enumerable: true, get: function () { return tool_result_js_1.scanToolResult; } });
|
|
12
|
+
var definition_drift_js_1 = require("./interceptors/definition-drift.js");
|
|
13
|
+
Object.defineProperty(exports, "ToolDefinitionPin", { enumerable: true, get: function () { return definition_drift_js_1.ToolDefinitionPin; } });
|
|
10
14
|
var pii_masker_js_1 = require("./interceptors/pii-masker.js");
|
|
11
15
|
Object.defineProperty(exports, "maskPiiInValue", { enumerable: true, get: function () { return pii_masker_js_1.maskPiiInValue; } });
|
|
12
16
|
Object.defineProperty(exports, "maskPiiInText", { enumerable: true, get: function () { return pii_masker_js_1.maskPiiInText; } });
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uCAAwC;AAA/B,sGAAA,UAAU,OAAA;AACnB,yCAA8C;AAArC,4GAAA,eAAe,OAAA;AACxB,0EAA4E;AAAnE,6HAAA,sBAAsB,OAAA;AAC/B,8DAA6E;AAApE,+GAAA,cAAc,OAAA;AAAE,8GAAA,aAAa,OAAA;AACtC,+CAAgD;AAAvC,wGAAA,WAAW,OAAA"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uCAAwC;AAA/B,sGAAA,UAAU,OAAA;AACnB,yCAA8C;AAArC,4GAAA,eAAe,OAAA;AACxB,0EAA4E;AAAnE,6HAAA,sBAAsB,OAAA;AAC/B,gEAA+D;AAAtD,gHAAA,cAAc,OAAA;AACvB,0EAAuE;AAA9D,wHAAA,iBAAiB,OAAA;AAC1B,8DAA6E;AAApE,+GAAA,cAAc,OAAA;AAAE,8GAAA,aAAa,OAAA;AACtC,+CAAgD;AAAvC,wGAAA,WAAW,OAAA"}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
export interface PinFinding {
|
|
2
|
+
kind: "added" | "changed" | "removed";
|
|
3
|
+
toolName: string;
|
|
4
|
+
reason: string;
|
|
5
|
+
}
|
|
6
|
+
export type ToolRecord = Record<string, unknown> & {
|
|
7
|
+
name?: unknown;
|
|
8
|
+
};
|
|
9
|
+
export declare function hashToolDefinition(tool: ToolRecord): string;
|
|
10
|
+
/**
|
|
11
|
+
* Pins the first tools/list a session sees. Later lists are compared to that
|
|
12
|
+
* pin so a server cannot change a tool's description after the client approved it.
|
|
13
|
+
*/
|
|
14
|
+
export declare class ToolDefinitionPin {
|
|
15
|
+
private pinned;
|
|
16
|
+
private ready;
|
|
17
|
+
observe(tools: ToolRecord[], action: "block" | "warn"): {
|
|
18
|
+
tools: ToolRecord[];
|
|
19
|
+
findings: PinFinding[];
|
|
20
|
+
};
|
|
21
|
+
/** Pin the current list when the session has not listed tools yet. Does not emit findings. */
|
|
22
|
+
ensurePinned(tools: ToolRecord[]): void;
|
|
23
|
+
drifted(toolName: string, tools: ToolRecord[]): PinFinding | null;
|
|
24
|
+
}
|
|
25
|
+
//# sourceMappingURL=definition-drift.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"definition-drift.d.ts","sourceRoot":"","sources":["../../src/interceptors/definition-drift.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AActE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAW3D;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAyD;IACvE,OAAO,CAAC,KAAK,CAAS;IAEtB,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG;QAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;KAAE;IAiDvG,8FAA8F;IAC9F,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI;IAIvC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,GAAG,IAAI;CAelE"}
|
|
@@ -0,0 +1,105 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.ToolDefinitionPin = void 0;
|
|
4
|
+
exports.hashToolDefinition = hashToolDefinition;
|
|
5
|
+
const crypto_1 = require("crypto");
|
|
6
|
+
function stable(value) {
|
|
7
|
+
if (Array.isArray(value))
|
|
8
|
+
return `[${value.map((item) => stable(item)).join(",")}]`;
|
|
9
|
+
if (value && typeof value === "object") {
|
|
10
|
+
const rec = value;
|
|
11
|
+
return `{${Object.keys(rec)
|
|
12
|
+
.sort()
|
|
13
|
+
.map((key) => `${JSON.stringify(key)}:${stable(rec[key])}`)
|
|
14
|
+
.join(",")}}`;
|
|
15
|
+
}
|
|
16
|
+
return JSON.stringify(value) ?? "null";
|
|
17
|
+
}
|
|
18
|
+
function hashToolDefinition(tool) {
|
|
19
|
+
return (0, crypto_1.createHash)("sha256")
|
|
20
|
+
.update(stable({
|
|
21
|
+
name: tool.name,
|
|
22
|
+
description: tool.description,
|
|
23
|
+
inputSchema: tool.inputSchema,
|
|
24
|
+
annotations: tool.annotations,
|
|
25
|
+
}))
|
|
26
|
+
.digest("hex");
|
|
27
|
+
}
|
|
28
|
+
/**
|
|
29
|
+
* Pins the first tools/list a session sees. Later lists are compared to that
|
|
30
|
+
* pin so a server cannot change a tool's description after the client approved it.
|
|
31
|
+
*/
|
|
32
|
+
class ToolDefinitionPin {
|
|
33
|
+
constructor() {
|
|
34
|
+
this.pinned = new Map();
|
|
35
|
+
this.ready = false;
|
|
36
|
+
}
|
|
37
|
+
observe(tools, action) {
|
|
38
|
+
const named = tools.filter((tool) => typeof tool.name === "string");
|
|
39
|
+
if (!this.ready) {
|
|
40
|
+
for (const tool of named)
|
|
41
|
+
this.pinned.set(tool.name, { hash: hashToolDefinition(tool), tool });
|
|
42
|
+
this.ready = true;
|
|
43
|
+
return { tools: named, findings: [] };
|
|
44
|
+
}
|
|
45
|
+
const findings = [];
|
|
46
|
+
const advertised = [];
|
|
47
|
+
const seen = new Set();
|
|
48
|
+
for (const tool of named) {
|
|
49
|
+
seen.add(tool.name);
|
|
50
|
+
const previous = this.pinned.get(tool.name);
|
|
51
|
+
if (!previous) {
|
|
52
|
+
findings.push({
|
|
53
|
+
kind: "added",
|
|
54
|
+
toolName: tool.name,
|
|
55
|
+
reason: `Tool "${tool.name}" appeared after the session pin (MCP03:2025).`,
|
|
56
|
+
});
|
|
57
|
+
if (action === "warn")
|
|
58
|
+
advertised.push(tool);
|
|
59
|
+
continue;
|
|
60
|
+
}
|
|
61
|
+
if (hashToolDefinition(tool) !== previous.hash) {
|
|
62
|
+
findings.push({
|
|
63
|
+
kind: "changed",
|
|
64
|
+
toolName: tool.name,
|
|
65
|
+
reason: `Tool "${tool.name}" changed its description or schema during this session (MCP03:2025).`,
|
|
66
|
+
});
|
|
67
|
+
advertised.push(action === "block" ? previous.tool : tool);
|
|
68
|
+
continue;
|
|
69
|
+
}
|
|
70
|
+
advertised.push(tool);
|
|
71
|
+
}
|
|
72
|
+
for (const name of this.pinned.keys()) {
|
|
73
|
+
if (!seen.has(name)) {
|
|
74
|
+
findings.push({
|
|
75
|
+
kind: "removed",
|
|
76
|
+
toolName: name,
|
|
77
|
+
reason: `Tool "${name}" disappeared after the session pin (MCP03:2025).`,
|
|
78
|
+
});
|
|
79
|
+
}
|
|
80
|
+
}
|
|
81
|
+
return { tools: advertised, findings };
|
|
82
|
+
}
|
|
83
|
+
/** Pin the current list when the session has not listed tools yet. Does not emit findings. */
|
|
84
|
+
ensurePinned(tools) {
|
|
85
|
+
if (!this.ready)
|
|
86
|
+
this.observe(tools, "block");
|
|
87
|
+
}
|
|
88
|
+
drifted(toolName, tools) {
|
|
89
|
+
const live = tools.find((tool) => tool.name === toolName);
|
|
90
|
+
const previous = this.pinned.get(toolName);
|
|
91
|
+
if (!previous && live) {
|
|
92
|
+
return { kind: "added", toolName, reason: `Tool "${toolName}" was not in the session pin (MCP03:2025).` };
|
|
93
|
+
}
|
|
94
|
+
if (previous && live && hashToolDefinition(live) !== previous.hash) {
|
|
95
|
+
return {
|
|
96
|
+
kind: "changed",
|
|
97
|
+
toolName,
|
|
98
|
+
reason: `Tool "${toolName}" changed during this session (MCP03:2025).`,
|
|
99
|
+
};
|
|
100
|
+
}
|
|
101
|
+
return null;
|
|
102
|
+
}
|
|
103
|
+
}
|
|
104
|
+
exports.ToolDefinitionPin = ToolDefinitionPin;
|
|
105
|
+
//# sourceMappingURL=definition-drift.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"definition-drift.js","sourceRoot":"","sources":["../../src/interceptors/definition-drift.ts"],"names":[],"mappings":";;;AAsBA,gDAWC;AAjCD,mCAAoC;AAUpC,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;aAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;AACzC,CAAC;AAED,SAAgB,kBAAkB,CAAC,IAAgB;IACjD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CACL,MAAM,CAAC;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAa,iBAAiB;IAA9B;QACU,WAAM,GAAG,IAAI,GAAG,EAA8C,CAAC;QAC/D,UAAK,GAAG,KAAK,CAAC;IAuExB,CAAC;IArEC,OAAO,CAAC,KAAmB,EAAE,MAAwB;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAyC,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC3G,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,MAAM,UAAU,GAAiB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM,EAAE,SAAS,IAAI,CAAC,IAAI,gDAAgD;iBAC3E,CAAC,CAAC;gBACH,IAAI,MAAM,KAAK,MAAM;oBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM,EAAE,SAAS,IAAI,CAAC,IAAI,uEAAuE;iBAClG,CAAC,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,SAAS,IAAI,mDAAmD;iBACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IAED,8FAA8F;IAC9F,YAAY,CAAC,KAAmB;QAC9B,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,KAAmB;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,QAAQ,4CAA4C,EAAE,CAAC;QAC5G,CAAC;QACD,IAAI,QAAQ,IAAI,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnE,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,QAAQ;gBACR,MAAM,EAAE,SAAS,QAAQ,6CAA6C;aACvE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAzED,8CAyEC"}
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
import type { InterceptResult } from "../types.js";
|
|
2
|
-
export declare function scanForPromptInjection(input: unknown): InterceptResult;
|
|
2
|
+
export declare function scanForPromptInjection(input: unknown, mode?: "block" | "warn"): InterceptResult;
|
|
3
3
|
//# sourceMappingURL=prompt-injection.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"prompt-injection.d.ts","sourceRoot":"","sources":["../../src/interceptors/prompt-injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA8BnD,wBAAgB,sBAAsB,
|
|
1
|
+
{"version":3,"file":"prompt-injection.d.ts","sourceRoot":"","sources":["../../src/interceptors/prompt-injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA8BnD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,OAAO,GAAG,MAAgB,GAC/B,eAAe,CAajB"}
|
|
@@ -28,12 +28,12 @@ function flattenValue(value) {
|
|
|
28
28
|
}
|
|
29
29
|
return String(value ?? "");
|
|
30
30
|
}
|
|
31
|
-
function scanForPromptInjection(input) {
|
|
31
|
+
function scanForPromptInjection(input, mode = "block") {
|
|
32
32
|
const text = flattenValue(input);
|
|
33
33
|
for (const pattern of INJECTION_PATTERNS) {
|
|
34
34
|
if (pattern.test(text)) {
|
|
35
35
|
return {
|
|
36
|
-
action:
|
|
36
|
+
action: mode,
|
|
37
37
|
reason: `Prompt injection pattern detected: ${pattern.toString()}`,
|
|
38
38
|
};
|
|
39
39
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"prompt-injection.js","sourceRoot":"","sources":["../../src/interceptors/prompt-injection.ts"],"names":[],"mappings":";;AA8BA,
|
|
1
|
+
{"version":3,"file":"prompt-injection.js","sourceRoot":"","sources":["../../src/interceptors/prompt-injection.ts"],"names":[],"mappings":";;AA8BA,wDAgBC;AA5CD,mCAAmC;AACnC,MAAM,kBAAkB,GAAa;IACnC,2DAA2D;IAC3D,8DAA8D;IAC9D,2DAA2D;IAC3D,qDAAqD;IACrD,2DAA2D;IAC3D,4DAA4D;IAC5D,YAAY;IACZ,aAAa;IACb,mBAAmB;IACnB,sBAAsB;IACtB,iBAAiB;IACjB,aAAa;IACb,8CAA8C;IAC9C,gDAAgD;IAChD,2DAA2D;IAC3D,mDAAmD;CACpD,CAAC;AAEF,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAgB,sBAAsB,CACpC,KAAc,EACd,OAAyB,OAAO;IAEhC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAEjC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,sCAAsC,OAAO,CAAC,QAAQ,EAAE,EAAE;aACnE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}
|
|
@@ -0,0 +1,4 @@
|
|
|
1
|
+
import type { InterceptResult } from "../types.js";
|
|
2
|
+
/** Same patterns as request scanning, applied to a tool result the model will read. */
|
|
3
|
+
export declare function scanToolResult(content: unknown, mode?: "block" | "warn"): InterceptResult;
|
|
4
|
+
//# sourceMappingURL=tool-result.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tool-result.d.ts","sourceRoot":"","sources":["../../src/interceptors/tool-result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,uFAAuF;AACvF,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE,OAAO,GAAG,MAAgB,GAAG,eAAe,CAOlG"}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.scanToolResult = scanToolResult;
|
|
4
|
+
const prompt_injection_js_1 = require("./prompt-injection.js");
|
|
5
|
+
/** Same patterns as request scanning, applied to a tool result the model will read. */
|
|
6
|
+
function scanToolResult(content, mode = "block") {
|
|
7
|
+
const result = (0, prompt_injection_js_1.scanForPromptInjection)(content, mode);
|
|
8
|
+
if (result.action === "allow")
|
|
9
|
+
return result;
|
|
10
|
+
return {
|
|
11
|
+
action: result.action,
|
|
12
|
+
reason: `Indirect prompt injection in tool result (MCP06:2025): ${result.reason}`,
|
|
13
|
+
};
|
|
14
|
+
}
|
|
15
|
+
//# sourceMappingURL=tool-result.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tool-result.js","sourceRoot":"","sources":["../../src/interceptors/tool-result.ts"],"names":[],"mappings":";;AAIA,wCAOC;AAVD,+DAA+D;AAE/D,uFAAuF;AACvF,SAAgB,cAAc,CAAC,OAAgB,EAAE,OAAyB,OAAO;IAC/E,MAAM,MAAM,GAAG,IAAA,4CAAsB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IAC7C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,0DAA0D,MAAM,CAAC,MAAM,EAAE;KAClF,CAAC;AACJ,CAAC"}
|
package/dist/proxy.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQ9C,wBAAsB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA8PnE"}
|
package/dist/proxy.js
CHANGED
|
@@ -7,6 +7,8 @@ const index_js_2 = require("@modelcontextprotocol/sdk/server/index.js");
|
|
|
7
7
|
const stdio_js_2 = require("@modelcontextprotocol/sdk/server/stdio.js");
|
|
8
8
|
const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
|
|
9
9
|
const prompt_injection_js_1 = require("./interceptors/prompt-injection.js");
|
|
10
|
+
const tool_result_js_1 = require("./interceptors/tool-result.js");
|
|
11
|
+
const definition_drift_js_1 = require("./interceptors/definition-drift.js");
|
|
10
12
|
const pii_masker_js_1 = require("./interceptors/pii-masker.js");
|
|
11
13
|
const logger_js_1 = require("./audit/logger.js");
|
|
12
14
|
const mcp_telemetry_1 = require("@guardbee/mcp-telemetry");
|
|
@@ -21,6 +23,11 @@ async function startProxy(config) {
|
|
|
21
23
|
});
|
|
22
24
|
await downstream.connect(transport);
|
|
23
25
|
const serverInfo = downstream.getServerVersion();
|
|
26
|
+
const driftEnabled = config.interceptors?.definitionDrift?.enabled !== false;
|
|
27
|
+
const driftAction = config.interceptors?.definitionDrift?.action ?? config.interceptors?.promptInjection?.action ?? "block";
|
|
28
|
+
const resultEnabled = config.interceptors?.toolResultInjection?.enabled !== false;
|
|
29
|
+
const resultAction = config.interceptors?.toolResultInjection?.action ?? config.interceptors?.promptInjection?.action ?? "block";
|
|
30
|
+
const pin = new definition_drift_js_1.ToolDefinitionPin();
|
|
24
31
|
// --- Start proxy MCP server (upstream, for Claude) ---
|
|
25
32
|
const server = new index_js_2.Server({ name: "guardbee-security-proxy", version: "0.1.0" }, {
|
|
26
33
|
capabilities: {
|
|
@@ -29,10 +36,22 @@ async function startProxy(config) {
|
|
|
29
36
|
prompts: {},
|
|
30
37
|
},
|
|
31
38
|
});
|
|
32
|
-
// List tools →
|
|
39
|
+
// List tools → pin the first list, and keep serving that pin if the server changes it.
|
|
33
40
|
server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
|
|
34
41
|
const result = await downstream.listTools();
|
|
35
|
-
|
|
42
|
+
if (!driftEnabled)
|
|
43
|
+
return result;
|
|
44
|
+
const observed = pin.observe(result.tools, driftAction);
|
|
45
|
+
for (const finding of observed.findings) {
|
|
46
|
+
audit.log({
|
|
47
|
+
ts: new Date().toISOString(),
|
|
48
|
+
type: driftAction === "block" ? "blocked" : "warn",
|
|
49
|
+
tool: finding.toolName,
|
|
50
|
+
server: serverInfo?.name,
|
|
51
|
+
reason: finding.reason,
|
|
52
|
+
});
|
|
53
|
+
}
|
|
54
|
+
return { ...result, tools: observed.tools };
|
|
36
55
|
});
|
|
37
56
|
// Call tool → intercept, scan, forward, mask response
|
|
38
57
|
server.setRequestHandler(types_js_1.CallToolRequestSchema, async (req) => {
|
|
@@ -41,7 +60,8 @@ async function startProxy(config) {
|
|
|
41
60
|
const started = Date.now();
|
|
42
61
|
// 1. Prompt injection scan on input
|
|
43
62
|
if (config.interceptors?.promptInjection?.enabled !== false) {
|
|
44
|
-
const
|
|
63
|
+
const mode = config.interceptors?.promptInjection?.action ?? "block";
|
|
64
|
+
const scan = (0, prompt_injection_js_1.scanForPromptInjection)(toolInput, mode);
|
|
45
65
|
if (scan.action === "block") {
|
|
46
66
|
audit.log({
|
|
47
67
|
ts: new Date().toISOString(),
|
|
@@ -80,7 +100,48 @@ async function startProxy(config) {
|
|
|
80
100
|
});
|
|
81
101
|
}
|
|
82
102
|
}
|
|
83
|
-
// 2.
|
|
103
|
+
// 2. Re-check the live tool definition against the session pin.
|
|
104
|
+
if (driftEnabled) {
|
|
105
|
+
try {
|
|
106
|
+
const listed = await downstream.listTools();
|
|
107
|
+
pin.ensurePinned(listed.tools);
|
|
108
|
+
const drift = pin.drifted(toolName, listed.tools);
|
|
109
|
+
if (drift && driftAction === "block") {
|
|
110
|
+
audit.log({
|
|
111
|
+
ts: new Date().toISOString(),
|
|
112
|
+
type: "blocked",
|
|
113
|
+
tool: toolName,
|
|
114
|
+
server: serverInfo?.name,
|
|
115
|
+
input: toolInput,
|
|
116
|
+
reason: drift.reason,
|
|
117
|
+
});
|
|
118
|
+
return {
|
|
119
|
+
content: [{ type: "text", text: `[GuardBee Security Proxy] Tool call blocked: ${drift.reason}` }],
|
|
120
|
+
isError: true,
|
|
121
|
+
};
|
|
122
|
+
}
|
|
123
|
+
if (drift) {
|
|
124
|
+
audit.log({
|
|
125
|
+
ts: new Date().toISOString(),
|
|
126
|
+
type: "warn",
|
|
127
|
+
tool: toolName,
|
|
128
|
+
server: serverInfo?.name,
|
|
129
|
+
input: toolInput,
|
|
130
|
+
reason: drift.reason,
|
|
131
|
+
});
|
|
132
|
+
}
|
|
133
|
+
}
|
|
134
|
+
catch (err) {
|
|
135
|
+
audit.log({
|
|
136
|
+
ts: new Date().toISOString(),
|
|
137
|
+
type: "warn",
|
|
138
|
+
tool: toolName,
|
|
139
|
+
server: serverInfo?.name,
|
|
140
|
+
reason: `definition re-check failed: ${err instanceof Error ? err.message : String(err)}`,
|
|
141
|
+
});
|
|
142
|
+
}
|
|
143
|
+
}
|
|
144
|
+
// 3. Log the call
|
|
84
145
|
audit.log({
|
|
85
146
|
ts: new Date().toISOString(),
|
|
86
147
|
type: "tool_call",
|
|
@@ -93,8 +154,45 @@ async function startProxy(config) {
|
|
|
93
154
|
name: toolName,
|
|
94
155
|
arguments: toolInput,
|
|
95
156
|
});
|
|
96
|
-
// 4. PII masking
|
|
157
|
+
// 4. Indirect injection in the tool result, then PII masking.
|
|
97
158
|
let content = result.content;
|
|
159
|
+
if (resultEnabled) {
|
|
160
|
+
const scan = (0, tool_result_js_1.scanToolResult)(content, resultAction);
|
|
161
|
+
if (scan.action === "block") {
|
|
162
|
+
audit.log({
|
|
163
|
+
ts: new Date().toISOString(),
|
|
164
|
+
type: "blocked",
|
|
165
|
+
tool: toolName,
|
|
166
|
+
server: serverInfo?.name,
|
|
167
|
+
output: content,
|
|
168
|
+
reason: scan.reason,
|
|
169
|
+
});
|
|
170
|
+
void (0, mcp_telemetry_1.recordEvent)({
|
|
171
|
+
server: "security-proxy",
|
|
172
|
+
tool: toolName,
|
|
173
|
+
params: toolInput,
|
|
174
|
+
success: false,
|
|
175
|
+
durationMs: Date.now() - started,
|
|
176
|
+
error: `blocked: ${scan.reason}`,
|
|
177
|
+
});
|
|
178
|
+
return {
|
|
179
|
+
content: [{ type: "text", text: `[GuardBee Security Proxy] Tool result blocked: ${scan.reason}` }],
|
|
180
|
+
isError: true,
|
|
181
|
+
};
|
|
182
|
+
}
|
|
183
|
+
if (scan.action === "warn") {
|
|
184
|
+
audit.log({
|
|
185
|
+
ts: new Date().toISOString(),
|
|
186
|
+
type: "warn",
|
|
187
|
+
tool: toolName,
|
|
188
|
+
server: serverInfo?.name,
|
|
189
|
+
output: content,
|
|
190
|
+
reason: scan.reason,
|
|
191
|
+
});
|
|
192
|
+
const warning = { type: "text", text: `[GuardBee Security Proxy] Warning: ${scan.reason}` };
|
|
193
|
+
content = [warning, ...(Array.isArray(content) ? content : [])];
|
|
194
|
+
}
|
|
195
|
+
}
|
|
98
196
|
if (config.interceptors?.piiMasking?.enabled !== false) {
|
|
99
197
|
content = (0, pii_masker_js_1.maskPiiInValue)(content);
|
|
100
198
|
}
|
package/dist/proxy.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":";;AAoBA,gCA8PC;AAlRD,wEAAmE;AACnE,wEAAiF;AACjF,wEAAmE;AACnE,wEAAiF;AACjF,iEAO4C;AAE5C,4EAA4E;AAC5E,kEAA+D;AAC/D,4EAAwF;AACxF,gEAA8D;AAC9D,iDAAgD;AAChD,2DAAsD;AAE/C,KAAK,UAAU,UAAU,CAAC,MAAmB;IAClD,MAAM,KAAK,GAAG,IAAI,uBAAW,CAC3B,MAAM,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CACnD,CAAC;IAEF,oDAAoD;IACpD,MAAM,UAAU,GAAG,IAAI,iBAAM,CAC3B,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,EACnD,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,+BAAoB,CAAC;QACzC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE;QAC9B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAA4B;KAChF,CAAC,CAAC;IAEH,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEpC,MAAM,UAAU,GAAG,UAAU,CAAC,gBAAgB,EAAE,CAAC;IACjD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE,eAAe,EAAE,OAAO,KAAK,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,EAAE,eAAe,EAAE,MAAM,IAAI,MAAM,CAAC,YAAY,EAAE,eAAe,EAAE,MAAM,IAAI,OAAO,CAAC;IAC5H,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,EAAE,mBAAmB,EAAE,OAAO,KAAK,KAAK,CAAC;IAClF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE,mBAAmB,EAAE,MAAM,IAAI,MAAM,CAAC,YAAY,EAAE,eAAe,EAAE,MAAM,IAAI,OAAO,CAAC;IACjI,MAAM,GAAG,GAAG,IAAI,uCAAiB,EAAE,CAAC;IAEpC,wDAAwD;IACxD,MAAM,MAAM,GAAG,IAAI,iBAAM,CACvB,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,EACrD;QACE,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ;KACF,CACF,CAAC;IAEF,uFAAuF;IACvF,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,YAAY;YAAE,OAAO,MAAM,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAqB,EAAE,WAAW,CAAC,CAAC;QACxE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACxC,KAAK,CAAC,GAAG,CAAC;gBACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;gBAClD,IAAI,EAAE,OAAO,CAAC,QAAQ;gBACtB,MAAM,EAAE,UAAU,EAAE,IAAI;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAA4B,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,CAAC,iBAAiB,CAAC,gCAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE3B,oCAAoC;QACpC,IAAI,MAAM,CAAC,YAAY,EAAE,eAAe,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,EAAE,eAAe,EAAE,MAAM,IAAI,OAAO,CAAC;YACrE,MAAM,IAAI,GAAG,IAAA,4CAAsB,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,KAAK,CAAC,GAAG,CAAC;oBACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC5B,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU,EAAE,IAAI;oBACxB,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;gBACH,KAAK,IAAA,2BAAW,EAAC;oBACf,MAAM,EAAE,gBAAgB;oBACxB,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,SAAoC;oBAC5C,OAAO,EAAE,KAAK;oBACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;oBAChC,KAAK,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE;iBACjC,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;yBACpE;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC;oBACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC5B,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU,EAAE,IAAI;oBACxB,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,CAAC;gBAC5C,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,KAAqB,CAAC,CAAC;gBAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAqB,CAAC,CAAC;gBAClE,IAAI,KAAK,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;oBACrC,KAAK,CAAC,GAAG,CAAC;wBACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBAC5B,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE,UAAU,EAAE,IAAI;wBACxB,KAAK,EAAE,SAAS;wBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,gDAAgD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;wBAC1G,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,EAAE,CAAC;oBACV,KAAK,CAAC,GAAG,CAAC;wBACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBAC5B,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE,UAAU,EAAE,IAAI;wBACxB,KAAK,EAAE,SAAS;wBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CAAC,GAAG,CAAC;oBACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC5B,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU,EAAE,IAAI;oBACxB,MAAM,EAAE,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBAC1F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,KAAK,CAAC,GAAG,CAAC;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,UAAU,EAAE,IAAI;YACxB,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QAEH,2BAA2B;QAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC;YACvC,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;QAEH,8DAA8D;QAC9D,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7B,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,IAAA,+BAAc,EAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,KAAK,CAAC,GAAG,CAAC;oBACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC5B,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU,EAAE,IAAI;oBACxB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;gBACH,KAAK,IAAA,2BAAW,EAAC;oBACf,MAAM,EAAE,gBAAgB;oBACxB,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,SAAoC;oBAC5C,OAAO,EAAE,KAAK;oBACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;oBAChC,KAAK,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE;iBACjC,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,kDAAkD,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC3G,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC;oBACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC5B,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU,EAAE,IAAI;oBACxB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,sCAAsC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrG,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAmB,CAAC;YACpF,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACvD,OAAO,GAAG,IAAA,8BAAc,EAAC,OAAO,CAAmB,CAAC;QACtD,CAAC;QAED,kBAAkB;QAClB,KAAK,CAAC,GAAG,CAAC;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,UAAU,EAAE,IAAI;YACxB,MAAM,EAAE,OAAO;SAChB,CAAC,CAAC;QAEH,KAAK,IAAA,2BAAW,EAAC;YACf,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,SAAoC;YAC5C,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACjC,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,yBAAyB;IACzB,MAAM,CAAC,iBAAiB,CAAC,qCAA0B,EAAE,KAAK,IAAI,EAAE;QAC9D,OAAO,MAAM,UAAU,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,oCAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChE,OAAO,MAAM,UAAU,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,uBAAuB;IACvB,MAAM,CAAC,iBAAiB,CAAC,mCAAwB,EAAE,KAAK,IAAI,EAAE;QAC5D,OAAO,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7D,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC;YAChC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI;YACrB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,wBAAwB;IACxB,MAAM,iBAAiB,GAAG,IAAI,+BAAoB,EAAE,CAAC;IACrD,MAAM,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAExC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -15,6 +15,14 @@ export type ProxyConfig = {
|
|
|
15
15
|
enabled: boolean;
|
|
16
16
|
action: "block" | "warn";
|
|
17
17
|
};
|
|
18
|
+
toolResultInjection?: {
|
|
19
|
+
enabled: boolean;
|
|
20
|
+
action: "block" | "warn";
|
|
21
|
+
};
|
|
22
|
+
definitionDrift?: {
|
|
23
|
+
enabled: boolean;
|
|
24
|
+
action: "block" | "warn";
|
|
25
|
+
};
|
|
18
26
|
piiMasking?: {
|
|
19
27
|
enabled: boolean;
|
|
20
28
|
patterns?: string[];
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,eAAe,CAAC,EAAE;YAChB,OAAO,EAAE,OAAO,CAAC;YACjB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC;QACF,UAAU,CAAC,EAAE;YACX,OAAO,EAAE,OAAO,CAAC;YACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;SACrB,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC"}
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,eAAe,CAAC,EAAE;YAChB,OAAO,EAAE,OAAO,CAAC;YACjB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC;QACF,mBAAmB,CAAC,EAAE;YACpB,OAAO,EAAE,OAAO,CAAC;YACjB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC;QACF,eAAe,CAAC,EAAE;YAChB,OAAO,EAAE,OAAO,CAAC;YACjB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC;QACF,UAAU,CAAC,EAAE;YACX,OAAO,EAAE,OAAO,CAAC;YACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;SACrB,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@guardbee/mcp-security-proxy",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.3.1",
|
|
4
|
+
"mcpName": "io.github.4hmetuyar/security-proxy",
|
|
4
5
|
"description": "Security proxy for MCP servers — intercepts tool calls, detects prompt injection, masks PII, and writes audit logs",
|
|
5
6
|
"author": "GuardBee <hello@guardbee.ai>",
|
|
6
7
|
"license": "MIT",
|
|
@@ -41,7 +42,7 @@
|
|
|
41
42
|
"dependencies": {
|
|
42
43
|
"@modelcontextprotocol/sdk": "^1.30.0",
|
|
43
44
|
"zod": "^4.5.4",
|
|
44
|
-
"@guardbee/mcp-telemetry": "^0.1.
|
|
45
|
+
"@guardbee/mcp-telemetry": "^0.1.3"
|
|
45
46
|
},
|
|
46
47
|
"scripts": {
|
|
47
48
|
"build": "tsc",
|