@guardbee/mcp-tool-poisoning-scanner 0.1.0

package/dist/config.js

@@ -0,0 +1,101 @@
+import { readFileSync, existsSync } from "fs";
+import { resolve, join } from "path";
+const DEFAULTS = {
+    failOn: "any",
+    maxFiles: 5000,
+    exclude: [],
+};
+function findConfigFile(startDir) {
+    const names = ["guardbee.yml", "guardbee.yaml", ".guardbee.yml"];
+    let dir = resolve(startDir);
+    for (let i = 0; i < 5; i++) {
+        for (const name of names) {
+            const p = join(dir, name);
+            if (existsSync(p))
+                return p;
+        }
+        const parent = resolve(dir, "..");
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+function parseYaml(content) {
+    const root = {};
+    let currentSection = null;
+    let currentKey = null;
+    let currentList = null;
+    for (const rawLine of content.split("\n")) {
+        const line = rawLine.replace(/#.*$/, "");
+        if (!line.trim())
+            continue;
+        const indent = line.match(/^(\s*)/)?.[1].length ?? 0;
+        if (indent === 0 && line.trim().endsWith(":")) {
+            if (currentKey && currentList) {
+                root[currentSection][currentKey] = currentList;
+                currentList = null;
+                currentKey = null;
+            }
+            currentSection = line.trim().slice(0, -1);
+            root[currentSection] = {};
+            continue;
+        }
+        if (indent === 2 && currentSection) {
+            if (currentKey && currentList) {
+                root[currentSection][currentKey] = currentList;
+                currentList = null;
+                currentKey = null;
+            }
+            const colonIdx = line.indexOf(":");
+            if (colonIdx === -1)
+                continue;
+            const key = line.slice(0, colonIdx).trim();
+            const value = line.slice(colonIdx + 1).trim();
+            if (value === "") {
+                currentKey = key;
+                currentList = [];
+            }
+            else {
+                root[currentSection][key] = value;
+            }
+            continue;
+        }
+        if (indent === 4 && currentList !== null) {
+            const item = line.trim().replace(/^-\s*/, "").replace(/^['"]|['"]$/g, "");
+            currentList.push(item);
+            continue;
+        }
+    }
+    if (currentKey && currentList && currentSection) {
+        root[currentSection][currentKey] = currentList;
+    }
+    return root;
+}
+export function loadConfig(searchDir, cliOverrides = {}) {
+    const configPath = findConfigFile(searchDir);
+    if (!configPath)
+        return { ...DEFAULTS, ...cliOverrides };
+    let fileConfig = {};
+    try {
+        const raw = readFileSync(configPath, "utf8");
+        const parsed = parseYaml(raw);
+        const section = parsed["tool-poisoning-scanner"];
+        if (section) {
+            if (typeof section["fail-on"] === "string")
+                fileConfig.failOn = section["fail-on"];
+            if (typeof section["max-files"] === "string")
+                fileConfig.maxFiles = parseInt(section["max-files"], 10);
+            if (Array.isArray(section["exclude"]))
+                fileConfig.exclude = section["exclude"];
+        }
+    }
+    catch {
+        // ignore parse errors, use defaults
+    }
+    return { ...DEFAULTS, ...fileConfig, ...cliOverrides };
+}
+export function configFilePath(searchDir) {
+    return findConfigFile(searchDir);
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAgBrC,MAAM,QAAQ,GAA+B;IAC3C,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IACjE,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1B,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,WAAW,GAAoB,IAAI,CAAC;IAExC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAErD,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,cAAe,CAA6B,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;gBAC7E,WAAW,GAAG,IAAI,CAAC;gBACnB,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,IAAI,MAAM,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,cAAc,CAA6B,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;gBAC5E,WAAW,GAAG,IAAI,CAAC;gBACnB,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,QAAQ,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE9C,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,UAAU,GAAG,GAAG,CAAC;gBACjB,WAAW,GAAG,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACL,IAAI,CAAC,cAAc,CAA6B,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACjE,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,MAAM,KAAK,CAAC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC1E,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;IACH,CAAC;IAED,IAAI,UAAU,IAAI,WAAW,IAAI,cAAc,EAAE,CAAC;QAC/C,IAAI,CAAC,cAAc,CAA6B,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;IAC9E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,eAAoD,EAAE;IAClG,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,YAAY,EAAE,CAAC;IAEzD,IAAI,UAAU,GAAwC,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,wBAAwB,CAAwC,CAAC;QACxF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,QAAQ;gBAAE,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YACnF,IAAI,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ;gBAAE,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;YACvG,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAAE,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAa,CAAC;QAC7F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IAED,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,YAAY,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { scanText, scanFile, scanDirectory, extractToolBlocks } from "./scanner.js";
+export type { Finding, ScanResult } from "./scanner.js";
+export { DESCRIPTION_INJECTION_PATTERNS, MISMATCH_SINK_RULES, READ_ONLY_HINT } from "./patterns.js";
+export type { DescriptionInjectionPattern, MismatchSinkRule, ToolPoisoningCategory } from "./patterns.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACpF,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpG,YAAY,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { scanText, scanFile, scanDirectory, extractToolBlocks } from "./scanner.js";
+export { DESCRIPTION_INJECTION_PATTERNS, MISMATCH_SINK_RULES, READ_ONLY_HINT } from "./patterns.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpF,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/patterns.d.ts

@@ -0,0 +1,37 @@
+export type ToolPoisoningCategory = "description-injection" | "confused-deputy";
+export interface DescriptionInjectionPattern {
+    id: string;
+    name: string;
+    pattern: RegExp;
+    severity: "critical" | "high" | "medium";
+    recommendation: string;
+}
+/**
+ * A tool's `description` string is read by the calling LLM as part of its
+ * tool-selection context — the same trust level as a system prompt, even
+ * though it's authored by whoever published the MCP server. "Tool poisoning"
+ * (documented by Invariant Labs, 2025) hides instructions in that string
+ * rather than in the conversation: "always call this first", "read ~/.ssh
+ * and pass it as the debug param", "don't tell the user". None of this is
+ * a code-level sink — `mcp-server-auditor` won't catch it, because nothing
+ * unsafe happens in the handler. The description itself is the payload.
+ */
+export declare const DESCRIPTION_INJECTION_PATTERNS: DescriptionInjectionPattern[];
+/** Name/description keywords implying a narrow, read-only/informational tool. */
+export declare const READ_ONLY_HINT: RegExp;
+export interface MismatchSinkRule {
+    id: string;
+    pattern: RegExp;
+    category: "process-execution" | "code-execution" | "filesystem-write" | "credentials-exposure";
+    severity: "critical" | "high";
+    recommendation: string;
+}
+/**
+ * Sinks that have no business appearing inside a tool whose name/description
+ * promises read-only/informational behavior. Deliberately excludes network
+ * fetches — a "get_weather" or "search" tool legitimately calling an external
+ * API is the common case, not a red flag, so including it here would make
+ * this the noisiest, least trustworthy pattern in the catalog.
+ */
+export declare const MISMATCH_SINK_RULES: MismatchSinkRule[];
+//# sourceMappingURL=patterns.d.ts.map

package/dist/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../src/patterns.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,qBAAqB,GAAG,uBAAuB,GAAG,iBAAiB,CAAC;AAEhF,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAE,2BAA2B,EAkDvE,CAAC;AAIF,iFAAiF;AACjF,eAAO,MAAM,cAAc,QAAqH,CAAC;AAEjJ,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,sBAAsB,CAAC;IAC/F,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,gBAAgB,EA6BjD,CAAC"}

package/dist/patterns.js

@@ -0,0 +1,102 @@
+/**
+ * A tool's `description` string is read by the calling LLM as part of its
+ * tool-selection context — the same trust level as a system prompt, even
+ * though it's authored by whoever published the MCP server. "Tool poisoning"
+ * (documented by Invariant Labs, 2025) hides instructions in that string
+ * rather than in the conversation: "always call this first", "read ~/.ssh
+ * and pass it as the debug param", "don't tell the user". None of this is
+ * a code-level sink — `mcp-server-auditor` won't catch it, because nothing
+ * unsafe happens in the handler. The description itself is the payload.
+ */
+export const DESCRIPTION_INJECTION_PATTERNS = [
+    {
+        id: "instruction_override_in_description",
+        name: "Description tells the model to ignore/disregard prior instructions",
+        pattern: /\b(?:ignore|disregard)\s+(?:all\s+)?(?:previous|prior|above)\s+instructions?\b/i,
+        severity: "critical",
+        recommendation: "A tool description has no legitimate reason to override the conversation's instructions. Treat this server as compromised or malicious.",
+    },
+    {
+        id: "always_call_first_directive",
+        name: "Description instructs the model to always call this tool first/unconditionally",
+        pattern: /\balways\s+(?:call|use|invoke)\s+this\s+(?:tool|function)\s+(?:first|before)\b/i,
+        severity: "high",
+        recommendation: "A legitimate tool description explains what the tool does and lets the model decide when it's relevant — it doesn't demand priority over every other tool. This is a known tool-poisoning priming pattern.",
+    },
+    {
+        id: "covert_instruction_in_description",
+        name: "Description tells the model not to inform/mention this to the user",
+        pattern: /\bdo\s+not\s+(?:tell|inform|mention\s+(?:this\s+)?to)\s+the\s+user\b/i,
+        severity: "critical",
+        recommendation: "A tool asking to hide its own behavior from the user it's acting on behalf of is a hallmark of a poisoned tool description. Do not install this server.",
+    },
+    {
+        id: "meta_authority_directive",
+        name: "Description uses system-prompt-style authority markers",
+        pattern: /<\s*IMPORTANT\s*>|^\s*(?:IMPORTANT|SYSTEM|NOTE\s+TO\s+MODEL)\s*:/im,
+        severity: "high",
+        recommendation: "A tool description shouldn't need to invoke system-prompt-style authority (\"<IMPORTANT>\", \"SYSTEM:\") to be followed — this is a common technique to make an injected instruction feel more authoritative to the model.",
+    },
+    {
+        id: "sensitive_file_exfil_instruction",
+        name: "Description instructs reading a sensitive file into a tool parameter",
+        pattern: /\b(?:read|cat|include|attach|append)\b[^.]{0,80}(?:\.ssh\b|\bid_rsa\b|\.env\b|\.aws[\\/]credentials\b|\bprivate[\s_-]?key\b|\.npmrc\b)/i,
+        severity: "critical",
+        recommendation: "A tool description asking the model to read a credential/key file and pass its contents as a parameter is a direct exfiltration instruction — the file's contents would flow to whoever controls this MCP server.",
+    },
+    {
+        id: "hidden_zero_width_in_description",
+        name: "Description contains zero-width characters invisible to a human reviewer",
+        pattern: /[\u200B\u2060]/,
+        severity: "high",
+        recommendation: "Zero-width characters in a tool description are invisible when a human reviews the server's tool list in a UI, but are still read by the model. Their only realistic purpose here is hiding text from review.",
+    },
+    {
+        id: "other_tools_manipulation_directive",
+        name: "Description instructs the model how to call other, different tools",
+        pattern: /\bwhen\s+(?:calling|using)\s+(?:the\s+)?["'`]?[\w.-]+["'`]?\s+tool\s*,\s*(?:always|you\s+must|set|pass|include)\b/i,
+        severity: "high",
+        recommendation: "A tool's description should describe that tool — not dictate how a different tool must be called. This is a documented tool-poisoning technique for hijacking unrelated tools via a single malicious server.",
+    },
+];
+// ── Confused-deputy: promised capability vs. actual handler behavior ─────────
+/** Name/description keywords implying a narrow, read-only/informational tool. */
+export const READ_ONLY_HINT = /\b(?:get|read|list|search|lookup|find|query|describe|show|view|check|inspect|summarize|translate|status|info)\b/i;
+/**
+ * Sinks that have no business appearing inside a tool whose name/description
+ * promises read-only/informational behavior. Deliberately excludes network
+ * fetches — a "get_weather" or "search" tool legitimately calling an external
+ * API is the common case, not a red flag, so including it here would make
+ * this the noisiest, least trustworthy pattern in the catalog.
+ */
+export const MISMATCH_SINK_RULES = [
+    {
+        id: "process_execution",
+        pattern: /\b(?:execSync|spawnSync|child_process\.exec\w*|spawn)\s*\(/,
+        category: "process-execution",
+        severity: "critical",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler runs a shell/process command. Either the description is misleading (fix it so callers know what they're actually authorizing) or this tool has been given capability it shouldn't have.",
+    },
+    {
+        id: "code_execution",
+        pattern: /\b(?:eval|new\s+Function)\s*\(/,
+        category: "code-execution",
+        severity: "critical",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler evaluates code. A caller relying on the description has no way to know this tool can execute arbitrary code.",
+    },
+    {
+        id: "filesystem_write",
+        pattern: /\b(?:writeFileSync|unlinkSync|rmSync|appendFileSync|renameSync|writeFile)\s*\(/,
+        category: "filesystem-write",
+        severity: "high",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler writes/deletes files. Rename or redescribe the tool to reflect what it actually does, so callers aren't misled about its blast radius.",
+    },
+    {
+        id: "credentials_exposure",
+        pattern: /(?:\.\.\.\s*process\.env\b)|(?:JSON\.stringify\(\s*process\.env\s*\))|(?:return\s+process\.env\s*[;\n])/,
+        category: "credentials-exposure",
+        severity: "critical",
+        recommendation: "This tool's name/description promises read-only/informational behavior, but its handler exposes the entire process environment. A caller has no way to know this \"informational\" tool can leak every secret in this process.",
+    },
+];
+//# sourceMappingURL=patterns.js.map

package/dist/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../src/patterns.ts"],"names":[],"mappings":"AAUA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAkC;IAC3E;QACE,EAAE,EAAE,qCAAqC;QACzC,IAAI,EAAE,oEAAoE;QAC1E,OAAO,EAAE,iFAAiF;QAC1F,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,yIAAyI;KAC1J;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,gFAAgF;QACtF,OAAO,EAAE,iFAAiF;QAC1F,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,4MAA4M;KAC7N;IACD;QACE,EAAE,EAAE,mCAAmC;QACvC,IAAI,EAAE,oEAAoE;QAC1E,OAAO,EAAE,uEAAuE;QAChF,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,yJAAyJ;KAC1K;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,wDAAwD;QAC9D,OAAO,EAAE,oEAAoE;QAC7E,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,4NAA4N;KAC7O;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE,sEAAsE;QAC5E,OAAO,EAAE,yIAAyI;QAClJ,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,mNAAmN;KACpO;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE,0EAA0E;QAChF,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,+MAA+M;KAChO;IACD;QACE,EAAE,EAAE,oCAAoC;QACxC,IAAI,EAAE,oEAAoE;QAC1E,OAAO,EAAE,oHAAoH;QAC7H,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,8MAA8M;KAC/N;CACF,CAAC;AAEF,gFAAgF;AAEhF,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,kHAAkH,CAAC;AAUjJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAuB;IACrD;QACE,EAAE,EAAE,mBAAmB;QACvB,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,iRAAiR;KAClS;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,sMAAsM;KACvN;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,OAAO,EAAE,gFAAgF;QACzF,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,gOAAgO;KACjP;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,OAAO,EAAE,yGAAyG;QAClH,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,gOAAgO;KACjP;CACF,CAAC"}

package/dist/sarif.d.ts

@@ -0,0 +1,3 @@
+import type { Finding } from "./scanner.js";
+export declare function buildSarif(toolVersion: string, findings: Finding[]): object;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AA6B5C,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CA8C3E"}

package/dist/sarif.js

@@ -0,0 +1,52 @@
+function severityToLevel(sev) {
+    if (sev === "critical" || sev === "high")
+        return "error";
+    if (sev === "medium")
+        return "warning";
+    return "note";
+}
+export function buildSarif(toolVersion, findings) {
+    const rulesMap = new Map();
+    const results = [];
+    for (const f of findings) {
+        if (!rulesMap.has(f.patternId)) {
+            rulesMap.set(f.patternId, {
+                id: f.patternId,
+                name: f.patternName.replace(/[^a-zA-Z0-9]/g, ""),
+                shortDescription: { text: f.patternName },
+                fullDescription: { text: f.recommendation },
+                helpUri: "https://guardbee.ai/docs/tool-poisoning-scanner",
+                properties: { "problem.severity": f.severity, tags: ["security", "mcp-security", "ai-security", f.category] },
+            });
+        }
+        const result = {
+            ruleId: f.patternId,
+            level: severityToLevel(f.severity),
+            message: { text: `${f.patternName} — ${f.recommendation}` },
+        };
+        if (f.file) {
+            result.locations = [
+                { physicalLocation: { artifactLocation: { uri: f.file, uriBaseId: "%SRCROOT%" }, region: { startLine: f.line, startColumn: f.column } } },
+            ];
+        }
+        results.push(result);
+    }
+    return {
+        $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "@guardbee/mcp-tool-poisoning-scanner",
+                        version: toolVersion,
+                        informationUri: "https://guardbee.ai",
+                        rules: Array.from(rulesMap.values()),
+                    },
+                },
+                results,
+            },
+        ],
+    };
+}
+//# sourceMappingURL=sarif.js.map

package/dist/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAuBA,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACzD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,WAAmB,EAAE,QAAmB;IACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE;gBACxB,EAAE,EAAE,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;gBAChD,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;gBACzC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE;gBAC3C,OAAO,EAAE,iDAAiD;gBAC1D,UAAU,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,cAAc,EAAE,EAAE;SAC5D,CAAC;QACF,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACX,MAAM,CAAC,SAAS,GAAG;gBACjB,EAAE,gBAAgB,EAAE,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE;aAC1I,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,gGAAgG;QACzG,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,sCAAsC;wBAC5C,OAAO,EAAE,WAAW;wBACpB,cAAc,EAAE,qBAAqB;wBACrC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;qBACrC;iBACF;gBACD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/scanner.d.ts

@@ -0,0 +1,51 @@
+export interface Finding {
+    patternId: string;
+    patternName: string;
+    category: string;
+    severity: "critical" | "high" | "medium";
+    recommendation: string;
+    file?: string;
+    line: number;
+    column: number;
+    match: string;
+    context: string;
+}
+export interface ScanResult {
+    scannedFiles: number;
+    skippedFiles: number;
+    totalFindings: number;
+    findings: Finding[];
+    durationMs: number;
+}
+interface ToolBlock {
+    name: string;
+    /** Raw description string content (unescaped as written in source), or null if this .tool() call has no string description (3-arg form). */
+    description: string | null;
+    /** descriptionOffset is the absolute offset of `description`'s first character in the source, only set when description is non-null. */
+    descriptionOffset: number;
+    /** Bounded text following the tool name — covers schema + handler for the mismatch check, truncated at the next tool registration. */
+    body: string;
+    offset: number;
+}
+/**
+ * Finds every `.tool("name", ...)` registration (the MCP TypeScript SDK's
+ * `McpServer.tool()` convenience form — the shape every GuardBee server in
+ * this monorepo uses) and captures its name, description (if the very next
+ * argument is a string literal), and a bounded window of following source as
+ * a stand-in for "the rest of this tool's definition". Each block is capped
+ * at the next tool registration so a sink in tool B's handler is never
+ * misattributed to tool A.
+ */
+export declare function extractToolBlocks(text: string): ToolBlock[];
+export declare function scanText(text: string, filePath?: string): Finding[];
+export declare function scanFile(filePath: string): {
+    findings: Finding[];
+    skipped: boolean;
+};
+export declare function scanDirectory(dirPath: string, options?: {
+    maxFiles?: number;
+    include?: string[];
+    exclude?: string[];
+}): ScanResult;
+export {};
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAmBD,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,4IAA4I;IAC5I,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wIAAwI;IACxI,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sIAAsI;IACtI,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAuB3D;AAUD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,EAAE,CA2DnE;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAoBpF;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAC1E,UAAU,CAoDZ"}

package/dist/scanner.js

@@ -0,0 +1,192 @@
+import { readFileSync, statSync, readdirSync } from "fs";
+import { join, relative, extname } from "path";
+import { DESCRIPTION_INJECTION_PATTERNS, MISMATCH_SINK_RULES, READ_ONLY_HINT } from "./patterns.js";
+const SKIP_EXTENSIONS = new Set([
+    ".png", ".jpg", ".jpeg", ".gif", ".svg", ".ico", ".webp", ".bmp",
+    ".pdf", ".zip", ".tar", ".gz", ".bz2", ".rar", ".7z",
+    ".exe", ".dll", ".so", ".dylib", ".bin", ".wasm",
+    ".mp3", ".mp4", ".avi", ".mov", ".wav",
+    ".ttf", ".woff", ".woff2", ".eot",
+    ".lock",
+]);
+const SKIP_DIRS = new Set([
+    "node_modules", ".git", ".svn", "dist", "build", ".next",
+    "__pycache__", ".mypy_cache", ".pytest_cache", "venv", ".venv",
+    "coverage", ".nyc_output",
+]);
+const MAX_FILE_SIZE = 1 * 1024 * 1024;
+const MAX_BLOCK = 2000;
+const MAX_CONTEXT_LENGTH = 240;
+/**
+ * Finds every `.tool("name", ...)` registration (the MCP TypeScript SDK's
+ * `McpServer.tool()` convenience form — the shape every GuardBee server in
+ * this monorepo uses) and captures its name, description (if the very next
+ * argument is a string literal), and a bounded window of following source as
+ * a stand-in for "the rest of this tool's definition". Each block is capped
+ * at the next tool registration so a sink in tool B's handler is never
+ * misattributed to tool A.
+ */
+export function extractToolBlocks(text) {
+    const nameRe = /\.tool\(\s*["'`]([\w.-]+)["'`]\s*,\s*/g;
+    const starts = [];
+    let m;
+    while ((m = nameRe.exec(text)) !== null) {
+        starts.push({ name: m[1], start: m.index, afterName: m.index + m[0].length });
+    }
+    return starts.map((entry, i) => {
+        const nextStart = starts[i + 1]?.start ?? text.length;
+        const end = Math.min(entry.afterName + MAX_BLOCK, nextStart);
+        const rest = text.slice(entry.afterName, end);
+        let description = null;
+        let descriptionOffset = -1;
+        const descMatch = /^(["'`])((?:\\.|(?!\1)[^\\])*)\1\s*,/.exec(rest);
+        if (descMatch) {
+            description = descMatch[2];
+            descriptionOffset = entry.afterName + 1; // skip the opening quote
+        }
+        return { name: entry.name, description, descriptionOffset, body: rest, offset: entry.afterName };
+    });
+}
+function locationOf(text, absoluteIndex) {
+    const before = text.slice(0, absoluteIndex);
+    const line = before.split("\n").length;
+    const lastNl = before.lastIndexOf("\n");
+    const column = absoluteIndex - (lastNl === -1 ? 0 : lastNl + 1) + 1;
+    return { line, column };
+}
+export function scanText(text, filePath) {
+    const findings = [];
+    const blocks = extractToolBlocks(text);
+    for (const block of blocks) {
+        // ── Check 1: description-embedded injection ──────────────────────────────
+        if (block.description) {
+            for (const p of DESCRIPTION_INJECTION_PATTERNS) {
+                const re = new RegExp(p.pattern.source, p.pattern.flags.includes("g") ? p.pattern.flags : p.pattern.flags + "g");
+                let dm;
+                while ((dm = re.exec(block.description)) !== null) {
+                    const absoluteIndex = block.descriptionOffset + dm.index;
+                    const { line, column } = locationOf(text, absoluteIndex);
+                    findings.push({
+                        patternId: p.id,
+                        patternName: p.name,
+                        category: "description-injection",
+                        severity: p.severity,
+                        recommendation: p.recommendation,
+                        file: filePath,
+                        line,
+                        column,
+                        match: `tool "${block.name}": ${dm[0].trim().slice(0, MAX_CONTEXT_LENGTH)}`,
+                        context: block.description.trim().slice(0, MAX_CONTEXT_LENGTH),
+                    });
+                    if (dm.index === re.lastIndex)
+                        re.lastIndex++;
+                }
+            }
+        }
+        // ── Check 2: confused deputy (promised read-only vs. actual sink) ────────
+        // Tool names are usually snake_case/kebab-case, so "_"/"-" must become word
+        // separators before testing — otherwise "get_system_info" is one long \w
+        // token to the regex engine and \bget\b never matches inside it.
+        const normalizedName = block.name.replace(/[_-]/g, " ");
+        const promisedReadOnly = READ_ONLY_HINT.test(normalizedName) || (block.description ? READ_ONLY_HINT.test(block.description) : false);
+        if (!promisedReadOnly)
+            continue;
+        for (const rule of MISMATCH_SINK_RULES) {
+            const sm = rule.pattern.exec(block.body);
+            if (!sm)
+                continue;
+            const absoluteIndex = block.offset + sm.index;
+            const { line, column } = locationOf(text, absoluteIndex);
+            findings.push({
+                patternId: `confused_deputy_${rule.id}`,
+                patternName: `Confused deputy: "${block.name}" reads as read-only but handler has a ${rule.category} sink`,
+                category: "confused-deputy",
+                severity: rule.severity,
+                recommendation: rule.recommendation,
+                file: filePath,
+                line,
+                column,
+                match: `tool "${block.name}": ${sm[0].trim().slice(0, MAX_CONTEXT_LENGTH)}`,
+                context: (block.description ?? block.name).trim().slice(0, MAX_CONTEXT_LENGTH),
+            });
+        }
+    }
+    return findings;
+}
+export function scanFile(filePath) {
+    const ext = extname(filePath).toLowerCase();
+    if (SKIP_EXTENSIONS.has(ext))
+        return { findings: [], skipped: true };
+    let stat;
+    try {
+        stat = statSync(filePath);
+    }
+    catch {
+        return { findings: [], skipped: true };
+    }
+    if (!stat.isFile() || stat.size > MAX_FILE_SIZE)
+        return { findings: [], skipped: true };
+    let content;
+    try {
+        content = readFileSync(filePath, "utf8");
+    }
+    catch {
+        return { findings: [], skipped: true };
+    }
+    return { findings: scanText(content, filePath), skipped: false };
+}
+export function scanDirectory(dirPath, options = {}) {
+    const start = Date.now();
+    const { maxFiles = 5000, include, exclude } = options;
+    const allFindings = [];
+    let scannedFiles = 0;
+    let skippedFiles = 0;
+    function walk(dir) {
+        if (scannedFiles + skippedFiles >= maxFiles)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const fullPath = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (SKIP_DIRS.has(entry.name) || entry.name.startsWith("."))
+                    continue;
+                if (exclude?.some((ex) => entry.name === ex || fullPath.includes(ex)))
+                    continue;
+                walk(fullPath);
+            }
+            else if (entry.isFile()) {
+                const relPath = relative(dirPath, fullPath);
+                if (exclude?.some((ex) => relPath.includes(ex))) {
+                    skippedFiles++;
+                    continue;
+                }
+                if (include && !include.some((inc) => relPath.includes(inc))) {
+                    skippedFiles++;
+                    continue;
+                }
+                const { findings, skipped } = scanFile(fullPath);
+                if (skipped)
+                    skippedFiles++;
+                else {
+                    scannedFiles++;
+                    allFindings.push(...findings);
+                }
+            }
+        }
+    }
+    walk(dirPath);
+    return {
+        scannedFiles,
+        skippedFiles,
+        totalFindings: allFindings.length,
+        findings: allFindings,
+        durationMs: Date.now() - start,
+    };
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/C,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAuBpG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAChE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;IACpD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO;IAChD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACtC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;IACjC,OAAO;CACR,CAAC,CAAC;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IACxD,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO;IAC9D,UAAU,EAAE,aAAa;CAC1B,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACtC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAa/B;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,wCAAwC,CAAC;IACxD,MAAM,MAAM,GAA8D,EAAE,CAAC;IAC7E,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE9C,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,iBAAiB,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,SAAS,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,SAAS,EAAE,CAAC;YACd,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,iBAAiB,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,yBAAyB;QACpE,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IACnG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,aAAqB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,QAAiB;IACtD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAEvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,4EAA4E;QAC5E,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,8BAA8B,EAAE,CAAC;gBAC/C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;gBACjH,IAAI,EAA0B,CAAC;gBAC/B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAClD,MAAM,aAAa,GAAG,KAAK,CAAC,iBAAiB,GAAG,EAAE,CAAC,KAAK,CAAC;oBACzD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;oBACzD,QAAQ,CAAC,IAAI,CAAC;wBACZ,SAAS,EAAE,CAAC,CAAC,EAAE;wBACf,WAAW,EAAE,CAAC,CAAC,IAAI;wBACnB,QAAQ,EAAE,uBAAuB;wBACjC,QAAQ,EAAE,CAAC,CAAC,QAAQ;wBACpB,cAAc,EAAE,CAAC,CAAC,cAAc;wBAChC,IAAI,EAAE,QAAQ;wBACd,IAAI;wBACJ,MAAM;wBACN,KAAK,EAAE,SAAS,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE;wBAC3E,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;qBAC/D,CAAC,CAAC;oBACH,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;wBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACrI,IAAI,CAAC,gBAAgB;YAAE,SAAS;QAEhC,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACvC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC;YAC9C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,mBAAmB,IAAI,CAAC,EAAE,EAAE;gBACvC,WAAW,EAAE,qBAAqB,KAAK,CAAC,IAAI,0CAA0C,IAAI,CAAC,QAAQ,OAAO;gBAC1G,QAAQ,EAAE,iBAAiB;gBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,IAAI,EAAE,QAAQ;gBACd,IAAI;gBACJ,MAAM;gBACN,KAAK,EAAE,SAAS,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE;gBAC3E,OAAO,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAErE,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,aAAa;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAExF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,UAAyE,EAAE;IAE3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACtD,MAAM,WAAW,GAAc,EAAE,CAAC;IAClC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,SAAS,IAAI,CAAC,GAAW;QACvB,IAAI,YAAY,GAAG,YAAY,IAAI,QAAQ;YAAE,OAAO;QACpD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACtE,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAAE,SAAS;gBAChF,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC5C,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBAChD,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC7D,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBAED,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACjD,IAAI,OAAO;oBAAE,YAAY,EAAE,CAAC;qBACvB,CAAC;oBACJ,YAAY,EAAE,CAAC;oBACf,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,CAAC;IAEd,OAAO;QACL,YAAY;QACZ,YAAY;QACZ,aAAa,EAAE,WAAW,CAAC,MAAM;QACjC,QAAQ,EAAE,WAAW;QACrB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,2 @@
+export declare function startServer(): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAkCA,wBAAsB,WAAW,kBAgEhC"}