@guardbee/mcp-tool-poisoning-scanner 0.2.1 → 0.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/__tests__/scanner.test.js +7 -0
- package/dist/__tests__/scanner.test.js.map +1 -1
- package/dist/catalog.d.ts +2 -32
- package/dist/catalog.d.ts.map +1 -1
- package/dist/catalog.js +2 -143
- package/dist/catalog.js.map +1 -1
- package/dist/patterns.d.ts +2 -36
- package/dist/patterns.d.ts.map +1 -1
- package/dist/patterns.js +2 -115
- package/dist/patterns.js.map +1 -1
- package/package.json +3 -2
|
@@ -171,6 +171,13 @@ describe("scanToolCatalog", () => {
|
|
|
171
171
|
expect(ids).toContain("mixed_script_in_description");
|
|
172
172
|
expect(ids).toContain("encoded_blob_in_description");
|
|
173
173
|
});
|
|
174
|
+
it("does not flag a description written in another script next to Latin words", () => {
|
|
175
|
+
const findings = scanToolCatalog([
|
|
176
|
+
{ name: "orders", description: "Возвращает список заказов в формате JSON" },
|
|
177
|
+
{ name: "data", description: "Επιστρέφει δεδομένα από το API" },
|
|
178
|
+
]);
|
|
179
|
+
expect(findings.map((finding) => finding.patternId)).not.toContain("mixed_script_in_description");
|
|
180
|
+
});
|
|
174
181
|
it("sıradan bir hava durumu tool'unda bulgu döndürmez", () => {
|
|
175
182
|
expect(scanToolCatalog([{ name: "get_weather", description: "Returns the current weather for a city" }])).toEqual([]);
|
|
176
183
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scanner.test.js","sourceRoot":"","sources":["../../src/__tests__/scanner.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE5D,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG;;;;;GAKb,CAAC;QACA,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,GAAG,GAAG,+CAA+C,CAAC;QAC5D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,GAAG,GAAG;;;CAGf,CAAC;QACE,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG,6GAA6G,CAAC;QAC1H,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,GAAG,GAAG,6GAA6G,CAAC;QAC1H,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,kGAAkG,CAAC;QAC/G,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,GAAG,GAAG,4GAA4G,CAAC;QACzH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,sHAAsH,CAAC;QACnI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,GAAG,GAAG,kDAAkD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,yCAAyC,CAAC;QACnI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,iHAAiH,CAAC;QAC9H,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,GAAG,GAAG,oJAAoJ,CAAC;QACjK,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,uBAAuB,CAAC,CAAC;QACrF,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,GAAG,GAAG,qHAAqH,CAAC;QAClI,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,2HAA2H,CAAC;QACxI,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,GAAG,GAAG,mGAAmG,CAAC;QAChH,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oGAAoG,EAAE,GAAG,EAAE;QAC5G,MAAM,GAAG,GAAG,8GAA8G,CAAC;QAC3H,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE,GAAG,EAAE;QAC1G,MAAM,GAAG,GAAG,gIAAgI,CAAC;QAC7I,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,iIAAiI,CAAC;QAC9I,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG,2EAA2E,CAAC;QACxF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG,2EAA2E,CAAC;QACxF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACjD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,IAAI,GAAG,+BAA+B,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,iCAAiC,CAAC;QACzG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAE5D,MAAM,IAAI,GAAG,6BAA6B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC;QACrG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAE5D,MAAM,SAAS,GAAG,yHAAyH,CAAC;QAC5I,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,GAAG,GAAG,sGAAsG,CAAC;QACnH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,GAAG,GAAG;;;;;;;;;GASb,CAAC;QACA,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,QAAQ,GAAG,eAAe,CAC9B,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC,EAC1G,SAAS,CACV,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QACnG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B;gBACE,IAAI,EAAE,KAAK;gBACX,WAAW,EAAE,mBAAmB;gBAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,kCAAkC,CAAC,EAAE,EAAE,EAAE;aAC/H;SACF,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,oBAAoB,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE;SAC9F,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B;gBACE,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,gEAAgE;aAC9E;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"scanner.test.js","sourceRoot":"","sources":["../../src/__tests__/scanner.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE5D,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG;;;;;GAKb,CAAC;QACA,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,GAAG,GAAG,+CAA+C,CAAC;QAC5D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,GAAG,GAAG;;;CAGf,CAAC;QACE,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG,6GAA6G,CAAC;QAC1H,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,GAAG,GAAG,6GAA6G,CAAC;QAC1H,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,kGAAkG,CAAC;QAC/G,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,GAAG,GAAG,4GAA4G,CAAC;QACzH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,sHAAsH,CAAC;QACnI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,GAAG,GAAG,kDAAkD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,yCAAyC,CAAC;QACnI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,iHAAiH,CAAC;QAC9H,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,GAAG,GAAG,oJAAoJ,CAAC;QACjK,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,uBAAuB,CAAC,CAAC;QACrF,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,GAAG,GAAG,qHAAqH,CAAC;QAClI,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,2HAA2H,CAAC;QACxI,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,GAAG,GAAG,mGAAmG,CAAC;QAChH,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oGAAoG,EAAE,GAAG,EAAE;QAC5G,MAAM,GAAG,GAAG,8GAA8G,CAAC;QAC3H,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE,GAAG,EAAE;QAC1G,MAAM,GAAG,GAAG,gIAAgI,CAAC;QAC7I,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,iIAAiI,CAAC;QAC9I,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG,2EAA2E,CAAC;QACxF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG,2EAA2E,CAAC;QACxF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACjD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,IAAI,GAAG,+BAA+B,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,iCAAiC,CAAC;QACzG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAE5D,MAAM,IAAI,GAAG,6BAA6B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC;QACrG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAE5D,MAAM,SAAS,GAAG,yHAAyH,CAAC;QAC5I,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,GAAG,GAAG,sGAAsG,CAAC;QACnH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,GAAG,GAAG;;;;;;;;;GASb,CAAC;QACA,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,QAAQ,GAAG,eAAe,CAC9B,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC,EAC1G,SAAS,CACV,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QACnG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B;gBACE,IAAI,EAAE,KAAK;gBACX,WAAW,EAAE,mBAAmB;gBAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,kCAAkC,CAAC,EAAE,EAAE,EAAE;aAC/H;SACF,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,oBAAoB,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE;SAC9F,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B;gBACE,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,gEAAgE;aAC9E;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;YAC3E,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,gCAAgC,EAAE;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
package/dist/catalog.d.ts
CHANGED
|
@@ -1,33 +1,3 @@
|
|
|
1
|
-
export
|
|
2
|
-
|
|
3
|
-
patternName: string;
|
|
4
|
-
category: "description-injection" | "obfuscation";
|
|
5
|
-
severity: "critical" | "high" | "medium";
|
|
6
|
-
recommendation: string;
|
|
7
|
-
owasp: "MCP03:2025";
|
|
8
|
-
index: number;
|
|
9
|
-
match: string;
|
|
10
|
-
}
|
|
11
|
-
export interface CatalogTool {
|
|
12
|
-
name: string;
|
|
13
|
-
description?: string;
|
|
14
|
-
inputSchema?: unknown;
|
|
15
|
-
annotations?: unknown;
|
|
16
|
-
}
|
|
17
|
-
export interface CatalogFinding {
|
|
18
|
-
patternId: string;
|
|
19
|
-
patternName: string;
|
|
20
|
-
category: "description-injection" | "obfuscation" | "confused-deputy";
|
|
21
|
-
severity: "critical" | "high" | "medium";
|
|
22
|
-
owasp: "MCP03:2025";
|
|
23
|
-
recommendation: string;
|
|
24
|
-
server?: string;
|
|
25
|
-
toolName: string;
|
|
26
|
-
field: string;
|
|
27
|
-
match: string;
|
|
28
|
-
}
|
|
29
|
-
export declare function annotationContradicts(description: string): boolean;
|
|
30
|
-
/** Instruction and obfuscation hits inside one tool description, parameter description, or enum value. */
|
|
31
|
-
export declare function matchSurface(text: string): SurfaceHit[];
|
|
32
|
-
export declare function scanToolCatalog(tools: CatalogTool[], server?: string): CatalogFinding[];
|
|
1
|
+
export { annotationContradicts, matchSurface, scanToolCatalog } from "@guardbee/guard-core";
|
|
2
|
+
export type { CatalogFinding, CatalogTool, SurfaceHit } from "@guardbee/guard-core";
|
|
33
3
|
//# sourceMappingURL=catalog.d.ts.map
|
package/dist/catalog.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5F,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC"}
|
package/dist/catalog.js
CHANGED
|
@@ -1,144 +1,3 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
const LATIN = /[A-Za-z]/;
|
|
4
|
-
const OTHER_SCRIPT = /[\u0370-\u03FF\u0400-\u04FF]/;
|
|
5
|
-
export function annotationContradicts(description) {
|
|
6
|
-
return DESTRUCTIVE.test(description);
|
|
7
|
-
}
|
|
8
|
-
/** Instruction and obfuscation hits inside one tool description, parameter description, or enum value. */
|
|
9
|
-
export function matchSurface(text) {
|
|
10
|
-
const hits = [];
|
|
11
|
-
const capped = text.slice(0, 8000);
|
|
12
|
-
for (const pattern of DESCRIPTION_INJECTION_PATTERNS) {
|
|
13
|
-
const flags = pattern.pattern.flags.includes("g") ? pattern.pattern.flags : `${pattern.pattern.flags}g`;
|
|
14
|
-
const re = new RegExp(pattern.pattern.source, flags);
|
|
15
|
-
let match;
|
|
16
|
-
while ((match = re.exec(capped)) !== null) {
|
|
17
|
-
hits.push({
|
|
18
|
-
patternId: pattern.id,
|
|
19
|
-
patternName: pattern.name,
|
|
20
|
-
category: "description-injection",
|
|
21
|
-
severity: pattern.severity,
|
|
22
|
-
recommendation: pattern.recommendation,
|
|
23
|
-
owasp: "MCP03:2025",
|
|
24
|
-
index: match.index,
|
|
25
|
-
match: match[0],
|
|
26
|
-
});
|
|
27
|
-
if (match.index === re.lastIndex)
|
|
28
|
-
re.lastIndex++;
|
|
29
|
-
}
|
|
30
|
-
}
|
|
31
|
-
if (LATIN.test(capped) && OTHER_SCRIPT.test(capped)) {
|
|
32
|
-
const index = capped.search(OTHER_SCRIPT);
|
|
33
|
-
hits.push({
|
|
34
|
-
patternId: "mixed_script_in_description",
|
|
35
|
-
patternName: "Description mixes Latin letters with Cyrillic or Greek lookalikes",
|
|
36
|
-
category: "obfuscation",
|
|
37
|
-
severity: "high",
|
|
38
|
-
recommendation: "A description that mixes scripts can show a familiar word while the model reads a different identifier. Compare the raw characters, not the rendered glyphs.",
|
|
39
|
-
owasp: "MCP03:2025",
|
|
40
|
-
index: index < 0 ? 0 : index,
|
|
41
|
-
match: capped.slice(Math.max(0, index), index + 8),
|
|
42
|
-
});
|
|
43
|
-
}
|
|
44
|
-
const blob = /[A-Za-z0-9+/]{32,}={0,2}/g;
|
|
45
|
-
let encoded;
|
|
46
|
-
while ((encoded = blob.exec(capped)) !== null) {
|
|
47
|
-
if (!suspiciousBlob(encoded[0]))
|
|
48
|
-
continue;
|
|
49
|
-
hits.push({
|
|
50
|
-
patternId: "encoded_blob_in_description",
|
|
51
|
-
patternName: "Description contains a long encoded blob",
|
|
52
|
-
category: "obfuscation",
|
|
53
|
-
severity: "medium",
|
|
54
|
-
recommendation: "A long base64-shaped token in a tool description is a common way to hide an instruction from a quick review. Decode it before trusting the server.",
|
|
55
|
-
owasp: "MCP03:2025",
|
|
56
|
-
index: encoded.index,
|
|
57
|
-
match: encoded[0].slice(0, 24),
|
|
58
|
-
});
|
|
59
|
-
if (encoded.index === blob.lastIndex)
|
|
60
|
-
blob.lastIndex++;
|
|
61
|
-
}
|
|
62
|
-
return hits;
|
|
63
|
-
}
|
|
64
|
-
function suspiciousBlob(token) {
|
|
65
|
-
if (token.length < 32)
|
|
66
|
-
return false;
|
|
67
|
-
const hasUpper = /[A-Z]/.test(token);
|
|
68
|
-
const hasLower = /[a-z]/.test(token);
|
|
69
|
-
const hasDigit = /\d/.test(token);
|
|
70
|
-
return (hasUpper && hasLower) || hasDigit || token.includes("+") || token.includes("/");
|
|
71
|
-
}
|
|
72
|
-
export function scanToolCatalog(tools, server) {
|
|
73
|
-
const findings = [];
|
|
74
|
-
for (const tool of tools) {
|
|
75
|
-
const texts = [];
|
|
76
|
-
if (tool.description)
|
|
77
|
-
texts.push({ field: "description", text: tool.description });
|
|
78
|
-
for (const entry of schemaTexts(tool.inputSchema)) {
|
|
79
|
-
if (entry.text === tool.description)
|
|
80
|
-
continue;
|
|
81
|
-
texts.push(entry);
|
|
82
|
-
}
|
|
83
|
-
for (const entry of texts) {
|
|
84
|
-
for (const hit of matchSurface(entry.text)) {
|
|
85
|
-
findings.push({
|
|
86
|
-
patternId: hit.patternId,
|
|
87
|
-
patternName: hit.patternName,
|
|
88
|
-
category: hit.category,
|
|
89
|
-
severity: hit.severity,
|
|
90
|
-
owasp: "MCP03:2025",
|
|
91
|
-
recommendation: hit.recommendation,
|
|
92
|
-
server,
|
|
93
|
-
toolName: tool.name,
|
|
94
|
-
field: entry.field,
|
|
95
|
-
match: `${tool.name} ${entry.field}: ${hit.match}`.slice(0, 240),
|
|
96
|
-
});
|
|
97
|
-
}
|
|
98
|
-
}
|
|
99
|
-
if (readOnlyHint(tool.annotations) && tool.description && annotationContradicts(tool.description)) {
|
|
100
|
-
findings.push({
|
|
101
|
-
patternId: "annotation_readonly_lie",
|
|
102
|
-
patternName: `Tool "${tool.name}" is annotated read-only but its description says it mutates or executes`,
|
|
103
|
-
category: "confused-deputy",
|
|
104
|
-
severity: "high",
|
|
105
|
-
owasp: "MCP03:2025",
|
|
106
|
-
recommendation: "readOnlyHint: true tells a client this tool will not change state. A description that deletes, drops, or executes contradicts that annotation. The handler is not required for this check — the published definition already disagrees with itself.",
|
|
107
|
-
server,
|
|
108
|
-
toolName: tool.name,
|
|
109
|
-
field: "annotations.readOnlyHint",
|
|
110
|
-
match: tool.description.slice(0, 240),
|
|
111
|
-
});
|
|
112
|
-
}
|
|
113
|
-
}
|
|
114
|
-
return findings;
|
|
115
|
-
}
|
|
116
|
-
function readOnlyHint(annotations) {
|
|
117
|
-
if (!annotations || typeof annotations !== "object")
|
|
118
|
-
return false;
|
|
119
|
-
return annotations.readOnlyHint === true;
|
|
120
|
-
}
|
|
121
|
-
function schemaTexts(schema) {
|
|
122
|
-
const out = [];
|
|
123
|
-
walkSchema(schema, "inputSchema", out);
|
|
124
|
-
return out;
|
|
125
|
-
}
|
|
126
|
-
function walkSchema(node, path, out) {
|
|
127
|
-
if (!node || typeof node !== "object")
|
|
128
|
-
return;
|
|
129
|
-
const rec = node;
|
|
130
|
-
if (typeof rec.description === "string")
|
|
131
|
-
out.push({ field: `${path}.description`, text: rec.description });
|
|
132
|
-
if (Array.isArray(rec.enum)) {
|
|
133
|
-
rec.enum.forEach((item, index) => {
|
|
134
|
-
if (typeof item === "string")
|
|
135
|
-
out.push({ field: `${path}.enum[${index}]`, text: item });
|
|
136
|
-
});
|
|
137
|
-
}
|
|
138
|
-
if (rec.properties && typeof rec.properties === "object") {
|
|
139
|
-
for (const [key, child] of Object.entries(rec.properties)) {
|
|
140
|
-
walkSchema(child, `${path}.${key}`, out);
|
|
141
|
-
}
|
|
142
|
-
}
|
|
143
|
-
}
|
|
1
|
+
// The catalog scan lives in guard-core so security-proxy can apply it to live tools/list results.
|
|
2
|
+
export { annotationContradicts, matchSurface, scanToolCatalog } from "@guardbee/guard-core";
|
|
144
3
|
//# sourceMappingURL=catalog.js.map
|
package/dist/catalog.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA,
|
|
1
|
+
{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC"}
|
package/dist/patterns.d.ts
CHANGED
|
@@ -1,37 +1,3 @@
|
|
|
1
|
-
export
|
|
2
|
-
export
|
|
3
|
-
id: string;
|
|
4
|
-
name: string;
|
|
5
|
-
pattern: RegExp;
|
|
6
|
-
severity: "critical" | "high" | "medium";
|
|
7
|
-
recommendation: string;
|
|
8
|
-
}
|
|
9
|
-
/**
|
|
10
|
-
* A tool's `description` string is read by the calling LLM as part of its
|
|
11
|
-
* tool-selection context — the same trust level as a system prompt, even
|
|
12
|
-
* though it's authored by whoever published the MCP server. "Tool poisoning"
|
|
13
|
-
* (documented by Invariant Labs, 2025) hides instructions in that string
|
|
14
|
-
* rather than in the conversation: "always call this first", "read ~/.ssh
|
|
15
|
-
* and pass it as the debug param", "don't tell the user". None of this is
|
|
16
|
-
* a code-level sink — `mcp-server-auditor` won't catch it, because nothing
|
|
17
|
-
* unsafe happens in the handler. The description itself is the payload.
|
|
18
|
-
*/
|
|
19
|
-
export declare const DESCRIPTION_INJECTION_PATTERNS: DescriptionInjectionPattern[];
|
|
20
|
-
/** Name/description keywords implying a narrow, read-only/informational tool. */
|
|
21
|
-
export declare const READ_ONLY_HINT: RegExp;
|
|
22
|
-
export interface MismatchSinkRule {
|
|
23
|
-
id: string;
|
|
24
|
-
pattern: RegExp;
|
|
25
|
-
category: "process-execution" | "code-execution" | "filesystem-write" | "credentials-exposure";
|
|
26
|
-
severity: "critical" | "high";
|
|
27
|
-
recommendation: string;
|
|
28
|
-
}
|
|
29
|
-
/**
|
|
30
|
-
* Sinks that have no business appearing inside a tool whose name/description
|
|
31
|
-
* promises read-only/informational behavior. Deliberately excludes network
|
|
32
|
-
* fetches — a "get_weather" or "search" tool legitimately calling an external
|
|
33
|
-
* API is the common case, not a red flag, so including it here would make
|
|
34
|
-
* this the noisiest, least trustworthy pattern in the catalog.
|
|
35
|
-
*/
|
|
36
|
-
export declare const MISMATCH_SINK_RULES: MismatchSinkRule[];
|
|
1
|
+
export { DESCRIPTION_INJECTION_PATTERNS, MISMATCH_SINK_RULES, READ_ONLY_HINT } from "@guardbee/guard-core";
|
|
2
|
+
export type { DescriptionInjectionPattern, MismatchSinkRule, ToolPoisoningCategory } from "@guardbee/guard-core";
|
|
37
3
|
//# sourceMappingURL=patterns.d.ts.map
|
package/dist/patterns.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../src/patterns.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../src/patterns.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3G,YAAY,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}
|
package/dist/patterns.js
CHANGED
|
@@ -1,116 +1,3 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
* tool-selection context — the same trust level as a system prompt, even
|
|
4
|
-
* though it's authored by whoever published the MCP server. "Tool poisoning"
|
|
5
|
-
* (documented by Invariant Labs, 2025) hides instructions in that string
|
|
6
|
-
* rather than in the conversation: "always call this first", "read ~/.ssh
|
|
7
|
-
* and pass it as the debug param", "don't tell the user". None of this is
|
|
8
|
-
* a code-level sink — `mcp-server-auditor` won't catch it, because nothing
|
|
9
|
-
* unsafe happens in the handler. The description itself is the payload.
|
|
10
|
-
*/
|
|
11
|
-
export const DESCRIPTION_INJECTION_PATTERNS = [
|
|
12
|
-
{
|
|
13
|
-
id: "instruction_override_in_description",
|
|
14
|
-
name: "Description tells the model to ignore/disregard prior instructions",
|
|
15
|
-
pattern: /\b(?:ignore|disregard)\s+(?:all\s+)?(?:previous|prior|above)\s+instructions?\b/i,
|
|
16
|
-
severity: "critical",
|
|
17
|
-
recommendation: "A tool description has no legitimate reason to override the conversation's instructions. Treat this server as compromised or malicious.",
|
|
18
|
-
},
|
|
19
|
-
{
|
|
20
|
-
id: "always_call_first_directive",
|
|
21
|
-
name: "Description instructs the model to always call this tool first/unconditionally",
|
|
22
|
-
pattern: /\balways\s+(?:call|use|invoke)\s+this\s+(?:tool|function)\s+(?:first|before)\b/i,
|
|
23
|
-
severity: "high",
|
|
24
|
-
recommendation: "A legitimate tool description explains what the tool does and lets the model decide when it's relevant — it doesn't demand priority over every other tool. This is a known tool-poisoning priming pattern.",
|
|
25
|
-
},
|
|
26
|
-
{
|
|
27
|
-
id: "covert_instruction_in_description",
|
|
28
|
-
name: "Description tells the model not to inform/mention this to the user",
|
|
29
|
-
pattern: /\bdo\s+not\s+(?:tell|inform|mention\s+(?:this\s+)?to)\s+the\s+user\b/i,
|
|
30
|
-
severity: "critical",
|
|
31
|
-
recommendation: "A tool asking to hide its own behavior from the user it's acting on behalf of is a hallmark of a poisoned tool description. Do not install this server.",
|
|
32
|
-
},
|
|
33
|
-
{
|
|
34
|
-
id: "meta_authority_directive",
|
|
35
|
-
name: "Description uses system-prompt-style authority markers",
|
|
36
|
-
pattern: /<\s*IMPORTANT\s*>|^\s*(?:IMPORTANT|SYSTEM|NOTE\s+TO\s+MODEL)\s*:/im,
|
|
37
|
-
severity: "high",
|
|
38
|
-
recommendation: "A tool description shouldn't need to invoke system-prompt-style authority (\"<IMPORTANT>\", \"SYSTEM:\") to be followed — this is a common technique to make an injected instruction feel more authoritative to the model.",
|
|
39
|
-
},
|
|
40
|
-
{
|
|
41
|
-
id: "sensitive_file_exfil_instruction",
|
|
42
|
-
name: "Description instructs reading a sensitive file into a tool parameter",
|
|
43
|
-
pattern: /\b(?:read|cat|include|attach|append)\b[^.]{0,80}(?:\.ssh\b|\bid_rsa\b|\.env\b|\.aws[\\/]credentials\b|\bprivate[\s_-]?key\b|\.npmrc\b)/i,
|
|
44
|
-
severity: "critical",
|
|
45
|
-
recommendation: "A tool description asking the model to read a credential/key file and pass its contents as a parameter is a direct exfiltration instruction — the file's contents would flow to whoever controls this MCP server.",
|
|
46
|
-
},
|
|
47
|
-
{
|
|
48
|
-
id: "hidden_zero_width_in_description",
|
|
49
|
-
name: "Description contains zero-width characters invisible to a human reviewer",
|
|
50
|
-
pattern: /[\u200B-\u200D\u2060\uFEFF]/,
|
|
51
|
-
severity: "high",
|
|
52
|
-
recommendation: "Zero-width characters in a tool description are invisible when a human reviews the server's tool list in a UI, but are still read by the model. Their only realistic purpose here is hiding text from review.",
|
|
53
|
-
},
|
|
54
|
-
{
|
|
55
|
-
id: "hidden_bidi_in_description",
|
|
56
|
-
name: "Description contains bidirectional override characters",
|
|
57
|
-
pattern: /[\u202A-\u202E\u2066-\u2069]/,
|
|
58
|
-
severity: "high",
|
|
59
|
-
recommendation: "Bidirectional overrides reorder how a description is displayed without changing the characters the model reads. A reviewer can see a different sentence than the one that reaches the model.",
|
|
60
|
-
},
|
|
61
|
-
{
|
|
62
|
-
id: "ansi_escape_in_description",
|
|
63
|
-
name: "Description contains an ANSI escape sequence",
|
|
64
|
-
pattern: /\u001b\[[0-9;]*[A-Za-z]/,
|
|
65
|
-
severity: "high",
|
|
66
|
-
recommendation: "ANSI escapes can hide or recolor text in a terminal review of a tool list. Tool descriptions are data for the model, not a terminal UI.",
|
|
67
|
-
},
|
|
68
|
-
{
|
|
69
|
-
id: "other_tools_manipulation_directive",
|
|
70
|
-
name: "Description instructs the model how to call other, different tools",
|
|
71
|
-
pattern: /\bwhen\s+(?:calling|using)\s+(?:the\s+)?["'`]?[\w.-]+["'`]?\s+tool\s*,\s*(?:always|you\s+must|set|pass|include)\b/i,
|
|
72
|
-
severity: "high",
|
|
73
|
-
recommendation: "A tool's description should describe that tool — not dictate how a different tool must be called. This is a documented tool-poisoning technique for hijacking unrelated tools via a single malicious server.",
|
|
74
|
-
},
|
|
75
|
-
];
|
|
76
|
-
// ── Confused-deputy: promised capability vs. actual handler behavior ─────────
|
|
77
|
-
/** Name/description keywords implying a narrow, read-only/informational tool. */
|
|
78
|
-
export const READ_ONLY_HINT = /\b(?:get|read|list|search|lookup|find|query|describe|show|view|check|inspect|summarize|translate|status|info)\b/i;
|
|
79
|
-
/**
|
|
80
|
-
* Sinks that have no business appearing inside a tool whose name/description
|
|
81
|
-
* promises read-only/informational behavior. Deliberately excludes network
|
|
82
|
-
* fetches — a "get_weather" or "search" tool legitimately calling an external
|
|
83
|
-
* API is the common case, not a red flag, so including it here would make
|
|
84
|
-
* this the noisiest, least trustworthy pattern in the catalog.
|
|
85
|
-
*/
|
|
86
|
-
export const MISMATCH_SINK_RULES = [
|
|
87
|
-
{
|
|
88
|
-
id: "process_execution",
|
|
89
|
-
pattern: /\b(?:execSync|spawnSync|child_process\.exec\w*|spawn)\s*\(/,
|
|
90
|
-
category: "process-execution",
|
|
91
|
-
severity: "critical",
|
|
92
|
-
recommendation: "This tool's name/description promises read-only/informational behavior, but its handler runs a shell/process command. Either the description is misleading (fix it so callers know what they're actually authorizing) or this tool has been given capability it shouldn't have.",
|
|
93
|
-
},
|
|
94
|
-
{
|
|
95
|
-
id: "code_execution",
|
|
96
|
-
pattern: /\b(?:eval|new\s+Function)\s*\(/,
|
|
97
|
-
category: "code-execution",
|
|
98
|
-
severity: "critical",
|
|
99
|
-
recommendation: "This tool's name/description promises read-only/informational behavior, but its handler evaluates code. A caller relying on the description has no way to know this tool can execute arbitrary code.",
|
|
100
|
-
},
|
|
101
|
-
{
|
|
102
|
-
id: "filesystem_write",
|
|
103
|
-
pattern: /\b(?:writeFileSync|unlinkSync|rmSync|appendFileSync|renameSync|writeFile)\s*\(/,
|
|
104
|
-
category: "filesystem-write",
|
|
105
|
-
severity: "high",
|
|
106
|
-
recommendation: "This tool's name/description promises read-only/informational behavior, but its handler writes/deletes files. Rename or redescribe the tool to reflect what it actually does, so callers aren't misled about its blast radius.",
|
|
107
|
-
},
|
|
108
|
-
{
|
|
109
|
-
id: "credentials_exposure",
|
|
110
|
-
pattern: /(?:\.\.\.\s*process\.env\b)|(?:JSON\.stringify\(\s*process\.env\s*\))|(?:return\s+process\.env\s*[;\n])/,
|
|
111
|
-
category: "credentials-exposure",
|
|
112
|
-
severity: "critical",
|
|
113
|
-
recommendation: "This tool's name/description promises read-only/informational behavior, but its handler exposes the entire process environment. A caller has no way to know this \"informational\" tool can leak every secret in this process.",
|
|
114
|
-
},
|
|
115
|
-
];
|
|
1
|
+
// The rules live in guard-core so security-proxy can apply them to live tools/list results.
|
|
2
|
+
export { DESCRIPTION_INJECTION_PATTERNS, MISMATCH_SINK_RULES, READ_ONLY_HINT } from "@guardbee/guard-core";
|
|
116
3
|
//# sourceMappingURL=patterns.js.map
|
package/dist/patterns.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../src/patterns.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../src/patterns.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@guardbee/mcp-tool-poisoning-scanner",
|
|
3
|
-
"version": "0.2.
|
|
4
|
-
"mcpName": "io.github.
|
|
3
|
+
"version": "0.2.4",
|
|
4
|
+
"mcpName": "io.github.GuardBee/tool-poisoning-scanner",
|
|
5
5
|
"description": "MCP server that scans other MCP servers' tool definitions for tool poisoning (hidden instructions embedded in a tool's description, read as trusted context by the calling LLM) and confused-deputy mismatches (a tool's name/description promises read-only behavior while its handler has a shell/eval/file-write/env-dump sink)",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"bin": {
|
|
@@ -23,6 +23,7 @@
|
|
|
23
23
|
"dependencies": {
|
|
24
24
|
"@modelcontextprotocol/sdk": "^1.0.0",
|
|
25
25
|
"zod": "^4.5.4",
|
|
26
|
+
"@guardbee/guard-core": "^0.9.0",
|
|
26
27
|
"@guardbee/mcp-telemetry": "^0.1.3"
|
|
27
28
|
},
|
|
28
29
|
"keywords": [
|