@guardbee/mcp-security-proxy 1.0.0 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/README.md +16 -14
  2. package/TR.md +16 -14
  3. package/dist/gateway/tokens.js +1 -1
  4. package/dist/gateway/tokens.js.map +1 -1
  5. package/package.json +2 -2
package/README.md CHANGED
@@ -13,8 +13,8 @@ A transparent security layer that sits in front of any MCP server. Blocks prompt
13
13
  ```
14
14
  Claude ──► MCP Security Proxy ──► Any MCP Server
15
15
  │
16
- ├─ Prompt injection detection (16 attack patterns)
17
- ├─ PII masking (national ID, IBAN, email, JWT, API key)
16
+ ├─ Prompt injection detection (27 rules, EN + TR)
17
+ ├─ PII + secret masking (TC, VKN, IBAN, card, phone, 22 key formats)
18
18
  ├─ Block or warn mode
19
19
  ├─ Toxic-flow (lethal trifecta) blocking
20
20
  └─ Hash-chained audit log
@@ -24,10 +24,10 @@ Claude ──► MCP Security Proxy ──► Any MCP Server
24
24
 
25
25
  ## Features
26
26
 
27
- - **Prompt Injection Protection** — 16 attack patterns block requests attempting to override system prompts
27
+ - **Prompt Injection Protection** — 27 rules in English and Turkish; precise ones block, generic phrases only warn
28
28
  - **Tool-result injection** — the same patterns applied to tool results, tagged MCP06:2025. Block mode replaces the result; warn mode prepends a warning
29
29
  - **Session tool pin** — the first `tools/list` is pinned. A later description or schema change is a rug pull (MCP03:2025). Block mode keeps serving the pinned definition and refuses the drifted call
30
- - **PII Masking** — national ID numbers, IBAN, email, phone, JWT tokens, API keys are automatically masked in responses
30
+ - **PII Masking** — TC Kimlik No, VKN, IBAN, card and phone numbers (checksum-validated), email, 22 provider key formats, private keys and connection strings are masked in responses
31
31
  - **Block / Warn Mode** — each interceptor can independently run in blocking or warning mode
32
32
  - **Audit Log** — configurable log written to console or a file
33
33
  - **Gateway mode** — several MCP servers behind one proxy, one YAML policy (allow / deny / mask / warn)
@@ -142,15 +142,13 @@ The proxy does not register tools of its own. It forwards the target server's to
142
142
 
143
143
  ### Prompt Injection Detector
144
144
 
145
- Looks for the following attack patterns in incoming messages:
145
+ 27 rules from [`@guardbee/guard-core`](../guard-core/README.md), applied to tool arguments, tool results, resources and prompts:
146
146
 
147
- - `ignore previous instructions`
148
- - `disregard your system prompt`
149
- - `you are now [DAN/jailbreak]`
150
- - `act as` / `pretend to be` role overrides
151
- - `DAN mode`, `developer mode`, `jailbreak`
152
- - fake `[SYSTEM]` / `<system>` tags
153
- - and 6 more patterns
147
+ - **Block** (13 precise, high/critical): instruction overrides in English and Turkish ("ignore all previous instructions", "önceki talimatları yok say"), `DAN mode`, "bypass your safety guardrails", chat-template tokens (`<|im_start|>`, `[INST]`), `<system>` tags, text hidden in Unicode tag characters, instructions in CSS-hidden elements or HTML comments, markdown image exfiltration beacons, requests to reveal the system prompt (English and Turkish), "send the user's data to https://…".
148
+ - **Warn only** (14): generic phrases that also appear in ordinary text — "act as", "you are now", "developer mode", "jailbreak", "override policy", "sen artık" — and medium-severity signals such as zero-width or bidi control characters and a line-start `System:` label.
149
+ - **Base64:** runs that decode to readable text are decoded and checked against the block rules, so an instruction cannot hide in an encoded blob.
150
+
151
+ Since 1.1, a broad phrase alone no longer blocks: in 1.0 "use jailbreak mode" or "act as a reverse proxy" in a tool result was blocked; now it is logged and the result carries a warning.
154
152
 
155
153
  ### PII Masker
156
154
 
@@ -160,9 +158,13 @@ Looks for the following attack patterns in incoming messages:
160
158
  | IBAN (TR) | mod-97 | `TR330006100519786457841326` | `TR**[IBAN]` |
161
159
  | Card number | Luhn | `4111 1111 1111 1111` | `****-****-****-[KART]` |
162
160
  | Email | — | `ahmet@example.com` | `***@[EMAIL]` |
163
- | Phone (TR) | — | `0532 123 45 67` | `+90-***-***-**[TELEFON]` |
161
+ | Phone (TR) | mobile / landline / 850 prefix | `0532 123 45 67` | `+90-***-***-**[TELEFON]` |
162
+ | Tax number (VKN) | check digit, needs a `VKN` / `Vergi No` label | `VKN: 1234567890` | `VKN: [VKN]` |
163
+ | Provider keys | 22 key and token formats from secret-scanner (AWS, GitHub, Stripe, OpenAI, Anthropic, Slack, …) | `ghp_…`, `AKIA…` | `[API-KEY]` |
164
+ | Other API keys | `sk_`/`api_`/`token_`… prefix, letters and digits | `api_k3y9x8…` | `[API-KEY]` |
165
+ | Private key | whole BEGIN…END block | `-----BEGIN … PRIVATE KEY-----` | `[PRIVATE-KEY]` |
166
+ | Connection string | user:password in the URL (localhost excluded) | `postgres://app:pw@db/prod` | `[CONNECTION-STRING]` |
164
167
  | JWT | — | `eyJhbGc...` | `[JWT-TOKEN]` |
165
- | API Key | — | `sk_abc123...` | `[API-KEY]` |
166
168
 
167
169
  A number that fails its checksum (an order number, a tracking code) is left as is.
168
170
 
package/TR.md CHANGED
@@ -13,8 +13,8 @@ Herhangi bir MCP sunucusunun önüne oturan şeffaf güvenlik katmanı. Prompt i
13
13
  ```
14
14
  Claude ──► MCP Security Proxy ──► Herhangi bir MCP Sunucu
15
15
  │
16
- ├─ Prompt injection tespiti (16 saldırı deseni)
17
- ├─ PII maskeleme (TC kimlik, IBAN, e-posta, JWT, API key)
16
+ ├─ Prompt injection tespiti (27 kural, EN + TR)
17
+ ├─ PII + secret maskeleme (TC, VKN, IBAN, kart, telefon, 22 anahtar formatı)
18
18
  ├─ Block veya warn modu
19
19
  ├─ Toxic-flow (lethal trifecta) engelleme
20
20
  └─ Hash zincirli audit log
@@ -24,10 +24,10 @@ Claude ──► MCP Security Proxy ──► Herhangi bir MCP Sunucu
24
24
 
25
25
  ## Özellikler
26
26
 
27
- - **Prompt Injection Koruması** — 16 saldırı deseni ile sistem prompt'larını geçersiz kılmaya çalışan istekler engellenir
27
+ - **Prompt Injection Koruması** — İngilizce ve Türkçe 27 kural; kesin kurallar engeller, genel ifadeler sadece uyarır
28
28
  - **Tool sonucu enjeksiyonu** — aynı kalıplar tool sonucuna uygulanır (MCP06:2025). Block modu sonucu değiştirir; warn modu uyarı ekler
29
29
  - **Oturum tool sabitlemesi** — ilk `tools/list` sabitlenir. Sonraki description veya şema değişikliği rug pull'dur (MCP03:2025). Block modu sabit tanımı sunmaya devam eder ve kaymış çağrıyı reddeder
30
- - **PII Maskeleme** — TC kimlik no, IBAN, e-posta, telefon, JWT token, API key yanıtlarda otomatik maskelenir
30
+ - **PII Maskeleme** — TC kimlik no, VKN, IBAN, kart ve telefon numaraları (checksum doğrulamalı), e-posta, 22 sağlayıcı anahtar formatı, özel anahtarlar ve bağlantı dizeleri yanıtlarda maskelenir
31
31
  - **Block / Warn Modu** — Her interceptor bağımsız olarak engelleyici veya uyarı modunda çalışabilir
32
32
  - **Audit Log** — Console veya dosyaya yazılan yapılandırılabilir log
33
33
  - **Gateway modu** — birden fazla MCP sunucusu tek proxy'nin arkasında, tek YAML politikası (allow / deny / mask / warn)
@@ -142,15 +142,13 @@ Proxy kendi tool'unu kaydetmez. Hedef sunucunun tool'larını iletir ve her ça
142
142
 
143
143
  ### Prompt Injection Detector
144
144
 
145
- Gelen mesajlarda aşağıdaki saldırı desenlerini arar:
145
+ [`@guardbee/guard-core`](../guard-core/README.md) içindeki 27 kural; tool argümanlarına, tool sonuçlarına, resource'lara ve prompt'lara uygulanır:
146
146
 
147
- - `ignore previous instructions`
148
- - `disregard your system prompt`
149
- - `you are now [DAN/jailbreak]`
150
- - `act as` / `pretend to be` rol değiştirme
151
- - `DAN mode`, `developer mode`, `jailbreak`
152
- - sahte `[SYSTEM]` / `<system>` etiketleri
153
- - ve 6 desen daha
147
+ - **Engeller** (13 kesin kural, high/critical): İngilizce ve Türkçe talimat geçersiz kılma ("ignore all previous instructions", "önceki talimatları yok say"), `DAN mode`, "bypass your safety guardrails", chat-template token'ları (`<|im_start|>`, `[INST]`), `<system>` etiketleri, Unicode tag karakterlerine gizlenmiş metin, CSS ile gizlenmiş öğelerde veya HTML yorumlarında talimat, markdown görsel exfiltration işaretçileri, sistem istemini isteme (İngilizce ve Türkçe), "send the user's data to https://…".
148
+ - **Sadece uyarır** (14): sıradan metinde de geçen genel ifadeler — "act as", "you are now", "developer mode", "jailbreak", "override policy", "sen artık" — ve zero-width veya bidi kontrol karakterleri, satır başındaki `System:` etiketi gibi orta önemdeki işaretler.
149
+ - **Base64:** okunabilir metne çözülen dizileri çözer ve engelleme kurallarıyla kontrol eder; talimat kodlanmış bir blob'a saklanamaz.
150
+
151
+ 1.1'den itibaren genel bir ifade tek başına engellemez: 1.0'da bir tool sonucundaki "use jailbreak mode" veya "act as a reverse proxy" engelleniyordu; artık loglanır ve sonuca bir uyarı eklenir.
154
152
 
155
153
  ### PII Masker
156
154
 
@@ -160,9 +158,13 @@ Gelen mesajlarda aşağıdaki saldırı desenlerini arar:
160
158
  | IBAN (TR) | mod-97 | `TR330006100519786457841326` | `TR**[IBAN]` |
161
159
  | Kart numarası | Luhn | `4111 1111 1111 1111` | `****-****-****-[KART]` |
162
160
  | E-posta | — | `ahmet@example.com` | `***@[EMAIL]` |
163
- | Telefon (TR) | — | `0532 123 45 67` | `+90-***-***-**[TELEFON]` |
161
+ | Telefon (TR) | cep / sabit hat / 850 öneki | `0532 123 45 67` | `+90-***-***-**[TELEFON]` |
162
+ | Vergi no (VKN) | kontrol hanesi, `VKN` / `Vergi No` etiketi gerekir | `VKN: 1234567890` | `VKN: [VKN]` |
163
+ | Sağlayıcı anahtarları | secret-scanner'dan 22 anahtar ve token formatı (AWS, GitHub, Stripe, OpenAI, Anthropic, Slack, …) | `ghp_…`, `AKIA…` | `[API-KEY]` |
164
+ | Diğer API key'ler | `sk_`/`api_`/`token_`… öneki, harf ve rakam | `api_k3y9x8…` | `[API-KEY]` |
165
+ | Özel anahtar | BEGIN…END bloğunun tamamı | `-----BEGIN … PRIVATE KEY-----` | `[PRIVATE-KEY]` |
166
+ | Bağlantı dizesi | URL'de kullanıcı:şifre (localhost hariç) | `postgres://app:pw@db/prod` | `[CONNECTION-STRING]` |
164
167
  | JWT | — | `eyJhbGc...` | `[JWT-TOKEN]` |
165
- | API Key | — | `sk_abc123...` | `[API-KEY]` |
166
168
 
167
169
  Checksum'ı tutmayan sayılar (sipariş no, takip kodu) olduğu gibi bırakılır.
168
170
 
package/dist/gateway/tokens.js CHANGED
@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
3
3
  exports.PiiVault = void 0;
4
4
  const crypto_1 = require("crypto");
5
5
  const guard_core_1 = require("@guardbee/guard-core");
6
- const TOKEN = /<pii:[a-z_]+:[0-9a-f]{8}>/g;
6
+ const TOKEN = /<pii:[a-z0-9_]+:[0-9a-f]{8}>/g;
7
7
  /**
8
8
  * Session-scoped reversible PII tokens. The model sees `<pii:tc_kimlik:7f3a9b21>`
9
9
  * instead of the value, and can still pass that token to another tool; the
package/dist/gateway/tokens.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/gateway/tokens.ts"],"names":[],"mappings":";;;AAAA,mCAAqC;AACrC,qDAAsD;AAEtD,MAAM,KAAK,GAAG,4BAA4B,CAAC;AAE3C;;;;;GAKG;AACH,MAAa,QAAQ;IAArB;QACmB,YAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QACpC,YAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAuCvD,CAAC;IArCC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,2GAA2G;IAC3G,QAAQ,CAAI,KAAQ;QAClB,OAAO,IAAA,2BAAc,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,IAAI,KAAa,CAAC;YAClB;gBAAG,KAAK,GAAG,QAAQ,IAAI,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;mBACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC,CAAM,CAAC;IACV,CAAC;IAED,4FAA4F;IAC5F,UAAU,CAAI,KAAQ;QACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAM,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAM,CAAC;QACjF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;QACjG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6DAA6D;IAC7D,WAAW,CAAC,KAAc;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1G,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAzCD,4BAyCC"}
1
+ {"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/gateway/tokens.ts"],"names":[],"mappings":";;;AAAA,mCAAqC;AACrC,qDAAsD;AAEtD,MAAM,KAAK,GAAG,+BAA+B,CAAC;AAE9C;;;;;GAKG;AACH,MAAa,QAAQ;IAArB;QACmB,YAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QACpC,YAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAuCvD,CAAC;IArCC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,2GAA2G;IAC3G,QAAQ,CAAI,KAAQ;QAClB,OAAO,IAAA,2BAAc,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,IAAI,KAAa,CAAC;YAClB;gBAAG,KAAK,GAAG,QAAQ,IAAI,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;mBACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC,CAAM,CAAC;IACV,CAAC;IAED,4FAA4F;IAC5F,UAAU,CAAI,KAAQ;QACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAM,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAM,CAAC;QACjF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;QACjG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6DAA6D;IAC7D,WAAW,CAAC,KAAc;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1G,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAzCD,4BAyCC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@guardbee/mcp-security-proxy",
3
- "version": "1.0.0",
3
+ "version": "1.1.0",
4
4
  "mcpName": "io.github.4hmetuyar/security-proxy",
5
5
  "description": "MCP security gateway: several MCP servers behind one policy, with toxic-flow (lethal trifecta) blocking, approvals, PII masking and a hash-chained audit log",
6
6
  "author": "GuardBee <hello@guardbee.ai>",
@@ -43,7 +43,7 @@
43
43
  "@modelcontextprotocol/sdk": "^1.30.0",
44
44
  "yaml": "^2.9.1",
45
45
  "zod": "^4.5.4",
46
- "@guardbee/guard-core": "^0.1.0",
46
+ "@guardbee/guard-core": "^0.2.0",
47
47
  "@guardbee/mcp-telemetry": "^0.1.3"
48
48
  },
49
49
  "scripts": {