@guardbee/mcp-toxic-flow-auditor 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/capabilities.d.ts +2 -11
- package/dist/capabilities.d.ts.map +1 -1
- package/dist/capabilities.js +2 -31
- package/dist/capabilities.js.map +1 -1
- package/package.json +2 -1
package/dist/capabilities.d.ts
CHANGED
|
@@ -1,12 +1,3 @@
|
|
|
1
|
-
export
|
|
2
|
-
export type FlowCategory
|
|
3
|
-
export interface ToolRecord {
|
|
4
|
-
name: string;
|
|
5
|
-
description?: string;
|
|
6
|
-
inputSchema?: unknown;
|
|
7
|
-
}
|
|
8
|
-
/** Name/description/schema heuristics for Simon Willison's lethal trifecta. */
|
|
9
|
-
export declare const CAPABILITY_RULES: Record<Capability, RegExp>;
|
|
10
|
-
export declare function textOf(tool: ToolRecord): string;
|
|
11
|
-
export declare function classifyTool(tool: ToolRecord): Capability[];
|
|
1
|
+
export { CAPABILITY_RULES, classifyTool, textOf } from "@guardbee/guard-core";
|
|
2
|
+
export type { Capability, FlowCategory, ToolRecord } from "@guardbee/guard-core";
|
|
12
3
|
//# sourceMappingURL=capabilities.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9E,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC"}
|
package/dist/capabilities.js
CHANGED
|
@@ -1,32 +1,3 @@
|
|
|
1
|
-
|
|
2
|
-
export
|
|
3
|
-
"untrusted-content": /\b(fetch|scrape|browse|crawl|http|https?|url|web[_-]?search|search[_-]?web|read[_-]?page|download|wiki|rss|feed|issue|ticket|inbox|comment|tweet|reddit|html|screenshot)\b/i,
|
|
4
|
-
"sensitive-data": /\b(secret|credential|token|api[_-]?key|password|passwd|vault|private[_-]?key|ssh|env|database|sql|postgres|mysql|mongo|payment|card|iban|kvkk|pii|tc[_-]?kimlik|identity|müşteri|musteri|kullanıcı|kullanici|email|e-mail|mailbox|inbox|read[_-]?file|read[_-]?secret|get[_-]?secret|list[_-]?secret|dump|export[_-]?user)\b/i,
|
|
5
|
-
"exfiltration": /\b(send|post|publish|upload|email|mail|notify|webhook|export|sync|push|transfer|message|slack|discord|telegram|http[_-]?request|fetch[_-]?post|write[_-]?url|relay|forward)\b/i,
|
|
6
|
-
destructive: /\b(delete|remove|drop|destroy|purge|reset|truncate|revoke|kill|terminate|overwrite|wipe|rm\b|unlink)\b/i,
|
|
7
|
-
};
|
|
8
|
-
export function textOf(tool) {
|
|
9
|
-
const schema = tool.inputSchema ? JSON.stringify(tool.inputSchema) : "";
|
|
10
|
-
return `${tool.name}\n${tool.description ?? ""}\n${schema}`;
|
|
11
|
-
}
|
|
12
|
-
export function classifyTool(tool) {
|
|
13
|
-
const text = textOf(tool);
|
|
14
|
-
const name = tool.name;
|
|
15
|
-
const found = [];
|
|
16
|
-
// Untrusted / exfil / destructive: name is primary (CheckMCP-style); description reinforces.
|
|
17
|
-
if (CAPABILITY_RULES["untrusted-content"].test(name) || CAPABILITY_RULES["untrusted-content"].test(text)) {
|
|
18
|
-
found.push("untrusted-content");
|
|
19
|
-
}
|
|
20
|
-
if (CAPABILITY_RULES.exfiltration.test(name) || CAPABILITY_RULES.exfiltration.test(text)) {
|
|
21
|
-
found.push("exfiltration");
|
|
22
|
-
}
|
|
23
|
-
if (CAPABILITY_RULES.destructive.test(name) || CAPABILITY_RULES.destructive.test(text)) {
|
|
24
|
-
found.push("destructive");
|
|
25
|
-
}
|
|
26
|
-
// Sensitive: name + description + schema (secrets often hide in schema field names).
|
|
27
|
-
if (CAPABILITY_RULES["sensitive-data"].test(text)) {
|
|
28
|
-
found.push("sensitive-data");
|
|
29
|
-
}
|
|
30
|
-
return found;
|
|
31
|
-
}
|
|
1
|
+
// Trifecta classification lives in @guardbee/guard-core so the gateway applies the same rules at runtime.
|
|
2
|
+
export { CAPABILITY_RULES, classifyTool, textOf } from "@guardbee/guard-core";
|
|
32
3
|
//# sourceMappingURL=capabilities.js.map
|
package/dist/capabilities.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@guardbee/mcp-toxic-flow-auditor",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.1",
|
|
4
4
|
"mcpName": "io.github.4hmetuyar/toxic-flow-auditor",
|
|
5
5
|
"description": "MCP server that detects toxic flows (lethal trifecta) across an MCP tool catalog — untrusted content + private/sensitive data + exfiltration or destruction on the same server",
|
|
6
6
|
"type": "module",
|
|
@@ -23,6 +23,7 @@
|
|
|
23
23
|
"dependencies": {
|
|
24
24
|
"@modelcontextprotocol/sdk": "^1.0.0",
|
|
25
25
|
"zod": "^4.5.4",
|
|
26
|
+
"@guardbee/guard-core": "^0.1.0",
|
|
26
27
|
"@guardbee/mcp-telemetry": "^0.1.3"
|
|
27
28
|
},
|
|
28
29
|
"keywords": [
|