@guardbee/mcp-toxic-flow-auditor 0.1.0

package/README.md

@@ -0,0 +1,61 @@
+# @guardbee/mcp-toxic-flow-auditor
+
+**🇬🇧 English** | [🇹🇷 Türkçe](TR.md)
+
+An MCP server that audits an MCP **tool catalog** for **toxic flows** — Simon Willison's *lethal trifecta*:
+
+1. **Untrusted content** (fetch, scrape, browse, issues, feeds)
+2. **Sensitive / private data** (vault, DB, secrets, KVKK-regulated PII)
+3. **Exfiltration or destruction** (send, webhook, export, delete, drop)
+
+When one MCP server exposes all three, a single prompt injection can chain them. Mapped primarily to **OWASP MCP10:2025**.
+
+> This package sends usage telemetry by default (tool name + short parameters, scanned code is never included — see [`@guardbee/mcp-telemetry`](../telemetry/README.md)). Disable with `GUARDBEE_TELEMETRY=0`.
+
+```
+Claude ──► toxic-flow-auditor ──► tools/list JSON or MCP server source
+              │
+              ├─ lethal_trifecta      (untrusted + sensitive + outbound)
+              ├─ single_tool_trifecta (one tool alone spans all three)
+              ├─ sensitive_plus_exfil
+              ├─ untrusted_plus_exfil
+              └─ sensitive_plus_destruct
+```
+
+## What it flags
+
+- **Lethal trifecta across the catalog.** Tools that fetch untrusted content, reach vault/DB/PII, and can send data out or destroy it — on the same server.
+- **Single-tool trifecta.** One registration whose name/description itself spans all three capabilities.
+- **Dangerous pairs.** Sensitive+exfil, untrusted+exfil, or sensitive+destructive even when the full trifecta is not present.
+- **KVKK-aware heuristics.** Turkish PII signals (`tc_kimlik`, `müşteri`, `KVKK`) count as sensitive data.
+
+Grades **A–F**. No API key. Static / catalog analysis only — does not call live tools.
+
+## Tools
+
+| Tool | Purpose |
+|---|---|
+| `audit_catalog` | Audit a `tools/list`-shaped JSON dump |
+| `scan_source` | Extract `.tool(...)` registrations from source text |
+| `scan_file` | Scan one source file |
+| `scan_directory` | Recursive scan; merges tools across files |
+| `explain_trifecta` | Explain the model |
+
+## CLI
+
+```
+npx @guardbee/mcp-toxic-flow-auditor audit <tools.json> [--fail-on=any] [--format=text|json|sarif]
+npx @guardbee/mcp-toxic-flow-auditor scan <path>        [--fail-on=any] [--format=text|json|sarif]
+```
+
+Example catalog:
+
+```json
+{
+  "tools": [
+    { "name": "fetch_page", "description": "Scrape a URL" },
+    { "name": "read_vault_secret", "description": "Read API key from vault" },
+    { "name": "send_slack_message", "description": "Post to webhook" }
+  ]
+}
+```

package/TR.md

@@ -0,0 +1,49 @@
+# @guardbee/mcp-toxic-flow-auditor
+
+[🇬🇧 English](README.md) | **🇹🇷 Türkçe**
+
+Bir MCP **tool kataloğunu** **toksik akışlar** (Simon Willison'ın *lethal trifecta*'sı) için denetleyen bir MCP server:
+
+1. **Güvenilmeyen içerik** (fetch, scrape, browse, issue, feed)
+2. **Hassas / özel veri** (vault, DB, secret, KVKK kapsamındaki PII)
+3. **Sızdırma veya yıkım** (send, webhook, export, delete, drop)
+
+Aynı MCP server bu üçünü birden açıyorsa, tek bir prompt injection bunları zincirleyebilir. Başlıca eşleme: **OWASP MCP10:2025**.
+
+> Bu paket varsayılan olarak kullanım telemetrisi gönderir (tool adı + kısa parametreler; taranan kod hiç gitmez — bkz. [`@guardbee/mcp-telemetry`](../telemetry/TR.md)). Kapatmak için `GUARDBEE_TELEMETRY=0`.
+
+```
+Claude ──► toxic-flow-auditor ──► tools/list JSON veya MCP server kaynağı
+              │
+              ├─ lethal_trifecta      (güvenilmeyen + hassas + dışarı)
+              ├─ single_tool_trifecta (tek tool üç yeteneği birden taşıyor)
+              ├─ sensitive_plus_exfil
+              ├─ untrusted_plus_exfil
+              └─ sensitive_plus_destruct
+```
+
+## Ne yakalar
+
+- **Katalog genelinde lethal trifecta.** Güvenilmeyen içerik okuyan, vault/DB/PII'ye ulaşan ve veriyi dışarı gönderen veya silen tool'lar — aynı server'da.
+- **Tek-tool trifecta.** İsim/açıklaması üç yeteneği birden kapsayan tek kayıt.
+- **Tehlikeli çiftler.** Tam trifecta yokken bile sensitive+exfil, untrusted+exfil veya sensitive+destructive.
+- **KVKK bilinci.** `tc_kimlik`, `müşteri`, `KVKK` gibi Türkçe PII sinyalleri hassas veri sayılır.
+
+Not: **A–F**. API anahtarı yok. Sadece statik / katalog analizi — canlı tool çağrısı yok.
+
+## Tool'lar
+
+| Tool | Amaç |
+|---|---|
+| `audit_catalog` | `tools/list` biçimli JSON denetle |
+| `scan_source` | Kaynak metinden `.tool(...)` kayıtlarını çıkar |
+| `scan_file` | Tek dosya |
+| `scan_directory` | Özyinelemeli; dosyalar arası tool birleştirme |
+| `explain_trifecta` | Modeli açıkla |
+
+## CLI
+
+```
+npx @guardbee/mcp-toxic-flow-auditor audit <tools.json> [--fail-on=any] [--format=text|json|sarif]
+npx @guardbee/mcp-toxic-flow-auditor scan <path>        [--fail-on=any] [--format=text|json|sarif]
+```

package/dist/__tests__/analyzer.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=analyzer.test.d.ts.map

package/dist/__tests__/analyzer.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/analyzer.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/analyzer.test.js

@@ -0,0 +1,76 @@
+import { describe, it, expect } from "vitest";
+import { auditCatalog, classifyTool, extractToolsFromSource } from "../index.js";
+describe("classifyTool", () => {
+    it("fetch toolunu untrusted sayar", () => {
+        expect(classifyTool({ name: "fetch_url", description: "Download a page" })).toContain("untrusted-content");
+    });
+    it("vault toolunu sensitive sayar", () => {
+        expect(classifyTool({ name: "get_secret", description: "Read from vault" })).toContain("sensitive-data");
+    });
+    it("KVKK / müşteri alanını sensitive sayar", () => {
+        expect(classifyTool({
+            name: "lookup_customer",
+            description: "KVKK kapsamındaki müşteri kaydını getir",
+            inputSchema: { properties: { tc_kimlik: { type: "string" } } },
+        })).toContain("sensitive-data");
+    });
+    it("send_email toolunu exfil sayar", () => {
+        expect(classifyTool({ name: "send_email", description: "Notify user" })).toContain("exfiltration");
+    });
+});
+describe("auditCatalog — lethal trifecta", () => {
+    it("üç yetenek bir arada ise F ve lethal_trifecta üretir", () => {
+        const result = auditCatalog([
+            { name: "fetch_page", description: "Scrape a URL" },
+            { name: "read_vault_secret", description: "Read API key from vault" },
+            { name: "send_slack_message", description: "Post to webhook" },
+        ]);
+        expect(result.grade).toBe("F");
+        expect(result.findings.map((f) => f.patternId)).toContain("lethal_trifecta");
+        expect(result.findings[0]?.owasp).toBe("MCP10:2025");
+    });
+    it("sadece isim listesi temizse A üretir", () => {
+        const result = auditCatalog([
+            { name: "list_patterns", description: "List scanner rules" },
+            { name: "scan_text", description: "Scan a string" },
+        ]);
+        expect(result.grade).toBe("A");
+        expect(result.findings).toEqual([]);
+    });
+    it("sensitive + exfil çiftini high olarak işaretler", () => {
+        const result = auditCatalog([
+            { name: "get_db_row", description: "Read database users" },
+            { name: "export_csv", description: "Export and upload report" },
+        ]);
+        expect(result.findings.map((f) => f.patternId)).toContain("sensitive_plus_exfil");
+        expect(result.grade).toBe("C");
+    });
+    it("tek tool trifecta yakalar", () => {
+        const result = auditCatalog([
+            {
+                name: "research_and_mail_secrets",
+                description: "Fetch a URL, read vault secrets, and send email with findings",
+            },
+        ]);
+        expect(result.findings.map((f) => f.patternId)).toContain("single_tool_trifecta");
+        expect(result.grade).toBe("F");
+    });
+    it("destructive + sensitive çiftini yakalar", () => {
+        const result = auditCatalog([
+            { name: "read_customer_db", description: "SQL select from müşteri table" },
+            { name: "drop_table", description: "Drop a database table" },
+        ]);
+        expect(result.findings.map((f) => f.patternId)).toContain("sensitive_plus_destruct");
+    });
+});
+describe("extractToolsFromSource", () => {
+    it("server.tool kayıtlarını çıkarır", () => {
+        const src = `
+server.tool("fetch_url", "Download page", {}, async () => {});
+server.tool("send_email", "Mail user", {}, async () => {});
+`;
+        const tools = extractToolsFromSource(src);
+        expect(tools.map((t) => t.name)).toEqual(["fetch_url", "send_email"]);
+    });
+});
+//# sourceMappingURL=analyzer.test.js.map

package/dist/__tests__/analyzer.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.test.js","sourceRoot":"","sources":["../../src/__tests__/analyzer.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAEjF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CACJ,YAAY,CAAC;YACX,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,yCAAyC;YACtD,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;SAC/D,CAAC,CACH,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE;YACnD,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,yBAAyB,EAAE;YACrE,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,iBAAiB,EAAE;SAC/D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC7E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,oBAAoB,EAAE;YAC5D,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,qBAAqB,EAAE;YAC1D,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B;gBACE,IAAI,EAAE,2BAA2B;gBACjC,WAAW,EAAE,+DAA+D;aAC7E;SACF,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,+BAA+B,EAAE;YAC1E,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,uBAAuB,EAAE;SAC7D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG;;;CAGf,CAAC;QACE,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/analyzer.d.ts

@@ -0,0 +1,32 @@
+import { type Capability, type FlowCategory, type ToolRecord } from "./capabilities.js";
+export interface Finding {
+    patternId: string;
+    patternName: string;
+    category: FlowCategory;
+    severity: "critical" | "high" | "medium";
+    owasp: string;
+    recommendation: string;
+    tools: string[];
+    capabilities: Capability[];
+    match: string;
+}
+export type Grade = "A" | "B" | "C" | "D" | "F";
+export interface AuditResult {
+    toolCount: number;
+    grade: Grade;
+    score: number;
+    byCapability: Record<Capability, string[]>;
+    findings: Finding[];
+    durationMs: number;
+}
+export declare function gradeFromFindings(findings: Finding[]): {
+    grade: Grade;
+    score: number;
+};
+/**
+ * Audits a tools/list-shaped catalog for Simon Willison's lethal trifecta:
+ * untrusted content + sensitive data + (exfiltration OR destruction) on one server.
+ */
+export declare function auditCatalog(tools: ToolRecord[], label?: string): AuditResult;
+export declare function parseToolsJson(raw: string): ToolRecord[];
+//# sourceMappingURL=analyzer.d.ts.map

package/dist/analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEtG,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,KAAK,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAEhD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAMtF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,SAAY,GAAG,WAAW,CAoHhF;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAOxD"}

package/dist/analyzer.js

@@ -0,0 +1,139 @@
+import { classifyTool } from "./capabilities.js";
+function toolsWith(cap, classified) {
+    return [...classified.entries()].filter(([, caps]) => caps.includes(cap)).map(([name]) => name);
+}
+export function gradeFromFindings(findings) {
+    if (findings.some((f) => f.patternId === "lethal_trifecta"))
+        return { grade: "F", score: 0 };
+    if (findings.some((f) => f.severity === "critical"))
+        return { grade: "D", score: 25 };
+    if (findings.some((f) => f.severity === "high"))
+        return { grade: "C", score: 50 };
+    if (findings.some((f) => f.severity === "medium"))
+        return { grade: "B", score: 75 };
+    return { grade: "A", score: 100 };
+}
+/**
+ * Audits a tools/list-shaped catalog for Simon Willison's lethal trifecta:
+ * untrusted content + sensitive data + (exfiltration OR destruction) on one server.
+ */
+export function auditCatalog(tools, label = "catalog") {
+    const start = Date.now();
+    const classified = new Map();
+    for (const tool of tools) {
+        classified.set(tool.name, classifyTool(tool));
+    }
+    const byCapability = {
+        "untrusted-content": toolsWith("untrusted-content", classified),
+        "sensitive-data": toolsWith("sensitive-data", classified),
+        exfiltration: toolsWith("exfiltration", classified),
+        destructive: toolsWith("destructive", classified),
+    };
+    const findings = [];
+    const hasUntrusted = byCapability["untrusted-content"].length > 0;
+    const hasSensitive = byCapability["sensitive-data"].length > 0;
+    const hasExfil = byCapability.exfiltration.length > 0;
+    const hasDestruct = byCapability.destructive.length > 0;
+    const hasOutbound = hasExfil || hasDestruct;
+    if (hasUntrusted && hasSensitive && hasOutbound) {
+        const involved = [
+            ...byCapability["untrusted-content"],
+            ...byCapability["sensitive-data"],
+            ...byCapability.exfiltration,
+            ...byCapability.destructive,
+        ];
+        findings.push({
+            patternId: "lethal_trifecta",
+            patternName: "Lethal trifecta (toxic flow) across this MCP server's tools",
+            category: "toxic-flow",
+            severity: "critical",
+            owasp: "MCP10:2025",
+            recommendation: "This server can read untrusted content, reach private/sensitive data, and send data out or destroy it. A single prompt injection can chain those capabilities. Split the server: keep research/fetch tools off any vault, DB, or mail connector, or put a human approval gate on exfil/destructive tools.",
+            tools: [...new Set(involved)],
+            capabilities: [
+                "untrusted-content",
+                "sensitive-data",
+                ...(hasExfil ? ["exfiltration"] : []),
+                ...(hasDestruct ? ["destructive"] : []),
+            ],
+            match: `${label}: untrusted=[${byCapability["untrusted-content"].join(", ")}] sensitive=[${byCapability["sensitive-data"].join(", ")}] outbound=[${[...byCapability.exfiltration, ...byCapability.destructive].join(", ")}]`,
+        });
+    }
+    else if (hasSensitive && hasExfil) {
+        findings.push({
+            patternId: "sensitive_plus_exfil",
+            patternName: "Sensitive data tools share a server with an exfiltration path",
+            category: "dangerous-pair",
+            severity: "high",
+            owasp: "MCP10:2025",
+            recommendation: "Even without an obvious untrusted-content tool, a compromised prompt or sibling MCP can still push private data out through send/export/webhook tools. Isolate vault/DB readers from outbound connectors.",
+            tools: [...new Set([...byCapability["sensitive-data"], ...byCapability.exfiltration])],
+            capabilities: ["sensitive-data", "exfiltration"],
+            match: `${label}: sensitive=[${byCapability["sensitive-data"].join(", ")}] exfil=[${byCapability.exfiltration.join(", ")}]`,
+        });
+    }
+    else if (hasUntrusted && hasExfil) {
+        findings.push({
+            patternId: "untrusted_plus_exfil",
+            patternName: "Untrusted-content tools share a server with an exfiltration path",
+            category: "dangerous-pair",
+            severity: "high",
+            owasp: "MCP06:2025",
+            recommendation: "Fetched pages or issues can inject instructions that then use send/webhook tools. Prefer a research-only server with no outbound side effects.",
+            tools: [...new Set([...byCapability["untrusted-content"], ...byCapability.exfiltration])],
+            capabilities: ["untrusted-content", "exfiltration"],
+            match: `${label}: untrusted=[${byCapability["untrusted-content"].join(", ")}] exfil=[${byCapability.exfiltration.join(", ")}]`,
+        });
+    }
+    else if (hasSensitive && hasDestruct) {
+        findings.push({
+            patternId: "sensitive_plus_destruct",
+            patternName: "Sensitive data tools share a server with destructive tools",
+            category: "dangerous-pair",
+            severity: "high",
+            owasp: "MCP02:2025",
+            recommendation: "An injection that reaches delete/drop/purge next to vault or DB access is a wipe risk. Require confirmation or move destructive tools to a separate, tightly approved server.",
+            tools: [...new Set([...byCapability["sensitive-data"], ...byCapability.destructive])],
+            capabilities: ["sensitive-data", "destructive"],
+            match: `${label}: sensitive=[${byCapability["sensitive-data"].join(", ")}] destruct=[${byCapability.destructive.join(", ")}]`,
+        });
+    }
+    // Single-tool combinations: one registration that itself spans the trifecta.
+    for (const [name, caps] of classified) {
+        const u = caps.includes("untrusted-content");
+        const s = caps.includes("sensitive-data");
+        const o = caps.includes("exfiltration") || caps.includes("destructive");
+        if (u && s && o) {
+            findings.push({
+                patternId: "single_tool_trifecta",
+                patternName: `Tool "${name}" alone spans the lethal trifecta`,
+                category: "toxic-flow",
+                severity: "critical",
+                owasp: "MCP10:2025",
+                recommendation: "Split this tool. A single handler that fetches untrusted content, touches secrets, and can send or destroy data is the densest toxic-flow shape.",
+                tools: [name],
+                capabilities: caps,
+                match: name,
+            });
+        }
+    }
+    const { grade, score } = gradeFromFindings(findings);
+    return {
+        toolCount: tools.length,
+        grade,
+        score,
+        byCapability,
+        findings,
+        durationMs: Date.now() - start,
+    };
+}
+export function parseToolsJson(raw) {
+    const parsed = JSON.parse(raw);
+    if (Array.isArray(parsed))
+        return parsed;
+    if (parsed && typeof parsed === "object" && Array.isArray(parsed.tools)) {
+        return parsed.tools;
+    }
+    throw new Error("Expected a tools array or { tools: [...] } JSON document");
+}
+//# sourceMappingURL=analyzer.js.map

package/dist/analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.js","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuD,MAAM,mBAAmB,CAAC;AAyBtG,SAAS,SAAS,CAAC,GAAe,EAAE,UAAqC;IACvE,OAAO,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAmB;IACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,iBAAiB,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC7F,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACtF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAClF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACpF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAmB,EAAE,KAAK,GAAG,SAAS;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,YAAY,GAAiC;QACjD,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE,UAAU,CAAC;QAC/D,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE,UAAU,CAAC;QACzD,YAAY,EAAE,SAAS,CAAC,cAAc,EAAE,UAAU,CAAC;QACnD,WAAW,EAAE,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC;KAClD,CAAC;IAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,QAAQ,IAAI,WAAW,CAAC;IAE5C,IAAI,YAAY,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG;YACf,GAAG,YAAY,CAAC,mBAAmB,CAAC;YACpC,GAAG,YAAY,CAAC,gBAAgB,CAAC;YACjC,GAAG,YAAY,CAAC,YAAY;YAC5B,GAAG,YAAY,CAAC,WAAW;SAC5B,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,iBAAiB;YAC5B,WAAW,EAAE,6DAA6D;YAC1E,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,YAAY;YACnB,cAAc,EACZ,2SAA2S;YAC7S,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,YAAY,EAAE;gBACZ,mBAAmB;gBACnB,gBAAgB;gBAChB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,cAAc,CAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,aAAa,CAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D;YACD,KAAK,EAAE,GAAG,KAAK,gBAAgB,YAAY,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,YAAY,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,YAAY,CAAC,YAAY,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC7N,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,sBAAsB;YACjC,WAAW,EAAE,+DAA+D;YAC5E,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,YAAY;YACnB,cAAc,EACZ,2MAA2M;YAC7M,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,gBAAgB,CAAC,EAAE,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;YACtF,YAAY,EAAE,CAAC,gBAAgB,EAAE,cAAc,CAAC;YAChD,KAAK,EAAE,GAAG,KAAK,gBAAgB,YAAY,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC5H,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,sBAAsB;YACjC,WAAW,EAAE,kEAAkE;YAC/E,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,YAAY;YACnB,cAAc,EACZ,gJAAgJ;YAClJ,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,mBAAmB,CAAC,EAAE,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;YACzF,YAAY,EAAE,CAAC,mBAAmB,EAAE,cAAc,CAAC;YACnD,KAAK,EAAE,GAAG,KAAK,gBAAgB,YAAY,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC/H,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,yBAAyB;YACpC,WAAW,EAAE,4DAA4D;YACzE,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,YAAY;YACnB,cAAc,EACZ,+KAA+K;YACjL,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,gBAAgB,CAAC,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,YAAY,EAAE,CAAC,gBAAgB,EAAE,aAAa,CAAC;YAC/C,KAAK,EAAE,GAAG,KAAK,gBAAgB,YAAY,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC9H,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,sBAAsB;gBACjC,WAAW,EAAE,SAAS,IAAI,mCAAmC;gBAC7D,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,YAAY;gBACnB,cAAc,EACZ,kJAAkJ;gBACpJ,KAAK,EAAE,CAAC,IAAI,CAAC;gBACb,YAAY,EAAE,IAAI;gBAClB,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,KAAK;QACL,KAAK;QACL,YAAY;QACZ,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAsB,CAAC;IACzD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAE,MAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;QACjG,OAAQ,MAAkC,CAAC,KAAK,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;AAC9E,CAAC"}

package/dist/capabilities.d.ts

@@ -0,0 +1,12 @@
+export type Capability = "untrusted-content" | "sensitive-data" | "exfiltration" | "destructive";
+export type FlowCategory = "toxic-flow" | "dangerous-pair" | "capability";
+export interface ToolRecord {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+}
+/** Name/description/schema heuristics for Simon Willison's lethal trifecta. */
+export declare const CAPABILITY_RULES: Record<Capability, RegExp>;
+export declare function textOf(tool: ToolRecord): string;
+export declare function classifyTool(tool: ToolRecord): Capability[];
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAClB,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,aAAa,CAAC;AAElB,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,gBAAgB,GAAG,YAAY,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CASvD,CAAC;AAEF,wBAAgB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAG/C;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,EAAE,CAqB3D"}

package/dist/capabilities.js

@@ -0,0 +1,32 @@
+/** Name/description/schema heuristics for Simon Willison's lethal trifecta. */
+export const CAPABILITY_RULES = {
+    "untrusted-content": /\b(fetch|scrape|browse|crawl|http|https?|url|web[_-]?search|search[_-]?web|read[_-]?page|download|wiki|rss|feed|issue|ticket|inbox|comment|tweet|reddit|html|screenshot)\b/i,
+    "sensitive-data": /\b(secret|credential|token|api[_-]?key|password|passwd|vault|private[_-]?key|ssh|env|database|sql|postgres|mysql|mongo|payment|card|iban|kvkk|pii|tc[_-]?kimlik|identity|müşteri|musteri|kullanıcı|kullanici|email|e-mail|mailbox|inbox|read[_-]?file|read[_-]?secret|get[_-]?secret|list[_-]?secret|dump|export[_-]?user)\b/i,
+    "exfiltration": /\b(send|post|publish|upload|email|mail|notify|webhook|export|sync|push|transfer|message|slack|discord|telegram|http[_-]?request|fetch[_-]?post|write[_-]?url|relay|forward)\b/i,
+    destructive: /\b(delete|remove|drop|destroy|purge|reset|truncate|revoke|kill|terminate|overwrite|wipe|rm\b|unlink)\b/i,
+};
+export function textOf(tool) {
+    const schema = tool.inputSchema ? JSON.stringify(tool.inputSchema) : "";
+    return `${tool.name}\n${tool.description ?? ""}\n${schema}`;
+}
+export function classifyTool(tool) {
+    const text = textOf(tool);
+    const name = tool.name;
+    const found = [];
+    // Untrusted / exfil / destructive: name is primary (CheckMCP-style); description reinforces.
+    if (CAPABILITY_RULES["untrusted-content"].test(name) || CAPABILITY_RULES["untrusted-content"].test(text)) {
+        found.push("untrusted-content");
+    }
+    if (CAPABILITY_RULES.exfiltration.test(name) || CAPABILITY_RULES.exfiltration.test(text)) {
+        found.push("exfiltration");
+    }
+    if (CAPABILITY_RULES.destructive.test(name) || CAPABILITY_RULES.destructive.test(text)) {
+        found.push("destructive");
+    }
+    // Sensitive: name + description + schema (secrets often hide in schema field names).
+    if (CAPABILITY_RULES["sensitive-data"].test(text)) {
+        found.push("sensitive-data");
+    }
+    return found;
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAcA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAA+B;IAC1D,mBAAmB,EACjB,6KAA6K;IAC/K,gBAAgB,EACd,+TAA+T;IACjU,cAAc,EACZ,gLAAgL;IAClL,WAAW,EACT,yGAAyG;CAC5G,CAAC;AAEF,MAAM,UAAU,MAAM,CAAC,IAAgB;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,KAAK,GAAiB,EAAE,CAAC;IAE/B,6FAA6F;IAC7F,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzF,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5B,CAAC;IACD,qFAAqF;IACrF,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import { startServer } from "./server.js";
+import { auditCatalog, parseToolsJson } from "./analyzer.js";
+import { scanDirectory, scanSourceFile } from "./scanner.js";
+import { buildSarif } from "./sarif.js";
+import { readFileSync, statSync } from "fs";
+import { resolve, dirname } from "path";
+import { fileURLToPath } from "url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+function getVersion() {
+    try {
+        return JSON.parse(readFileSync(resolve(__dirname, "../package.json"), "utf8")).version;
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+function printHelp() {
+    console.log(`@guardbee/mcp-toxic-flow-auditor
+
+Usage (MCP server):
+  guardbee-toxic-flow-auditor [serve]
+
+Usage (CLI):
+  guardbee-toxic-flow-auditor audit <tools.json>   Audit a tools/list JSON dump
+  guardbee-toxic-flow-auditor scan <path>          Scan source file or directory
+
+Options:
+  --format=text|json|sarif   Output format (default: text)
+  --fail-on=any|critical|high|medium|none
+`);
+}
+function parseArgs(args) {
+    const positionals = [];
+    let format = "text";
+    let failOn = "any";
+    for (const arg of args) {
+        if (arg.startsWith("--format="))
+            format = arg.split("=")[1] ?? "text";
+        else if (arg.startsWith("--fail-on="))
+            failOn = arg.split("=")[1] ?? "any";
+        else if (!arg.startsWith("--"))
+            positionals.push(arg);
+    }
+    return { positionals, format, failOn };
+}
+function shouldFail(findings, failOn) {
+    if (failOn === "none")
+        return false;
+    if (failOn === "any")
+        return findings.length > 0;
+    const RANK = { critical: 0, high: 1, medium: 2 };
+    const threshold = RANK[failOn] ?? 1;
+    return findings.some((f) => (RANK[f.severity] ?? 3) <= threshold);
+}
+async function runAudit(path, format, failOn) {
+    const tools = parseToolsJson(readFileSync(path, "utf8"));
+    const result = auditCatalog(tools, path);
+    emit(result, format, failOn);
+}
+async function runScan(path, format, failOn) {
+    const stat = statSync(path);
+    const result = stat.isDirectory() ? scanDirectory(path) : scanSourceFile(path).result;
+    emit(result, format, failOn);
+}
+function emit(result, format, failOn) {
+    if (format === "json") {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else if (format === "sarif") {
+        console.log(JSON.stringify(buildSarif(getVersion(), result.findings), null, 2));
+    }
+    else {
+        console.log(`Grade ${result.grade} (${result.score}/100) — ${result.toolCount} tools, ${result.durationMs}ms`);
+        console.log(`  untrusted : ${result.byCapability["untrusted-content"].join(", ") || "—"}`);
+        console.log(`  sensitive : ${result.byCapability["sensitive-data"].join(", ") || "—"}`);
+        console.log(`  exfil     : ${result.byCapability.exfiltration.join(", ") || "—"}`);
+        console.log(`  destruct  : ${result.byCapability.destructive.join(", ") || "—"}`);
+        console.log("");
+        if (result.findings.length === 0) {
+            console.log("✅ No toxic-flow findings");
+        }
+        else {
+            for (const f of result.findings) {
+                console.log(`[${f.severity.toUpperCase()}] ${f.patternName} (${f.owasp})`);
+                console.log(`  tools: ${f.tools.join(", ")}`);
+                console.log(`  fix  : ${f.recommendation}`);
+                console.log("");
+            }
+        }
+    }
+    process.exit(shouldFail(result.findings, failOn) ? 1 : 0);
+}
+const [, , firstArg, ...rest] = process.argv;
+if (!firstArg || firstArg === "serve") {
+    startServer().catch((err) => {
+        process.stderr.write(`[guardbee-toxic-flow-auditor] ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+    });
+}
+else if (firstArg === "--help" || firstArg === "-h") {
+    printHelp();
+}
+else if (firstArg === "audit") {
+    const { positionals, format, failOn } = parseArgs(rest);
+    const target = positionals[0];
+    if (!target) {
+        console.error("Usage: guardbee-toxic-flow-auditor audit <tools.json>");
+        process.exit(2);
+    }
+    runAudit(target, format, failOn).catch((err) => {
+        console.error("Error:", err.message);
+        process.exit(2);
+    });
+}
+else if (firstArg === "scan") {
+    const { positionals, format, failOn } = parseArgs(rest);
+    const target = positionals[0];
+    if (!target) {
+        console.error("Usage: guardbee-toxic-flow-auditor scan <path>");
+        process.exit(2);
+    }
+    runScan(target, format, failOn).catch((err) => {
+        console.error("Error:", err.message);
+        process.exit(2);
+    });
+}
+else {
+    console.error(`Unknown command: ${firstArg}`);
+    printHelp();
+    process.exit(2);
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAC,OAAO,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;CAYb,CAAC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;aACjE,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;aACtE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,QAAgC,EAAE,MAAc;IAClE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,MAAM,IAAI,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAc,EAAE,MAAc;IAClE,MAAM,KAAK,GAAG,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,MAAc,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACtF,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,IAAI,CACX,MAAgD,EAChD,MAAc,EACd,MAAc;IAEd,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,SAAS,WAAW,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;QAC/G,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;gBAC3E,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC9C,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,EAAE,AAAD,EAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;AAE7C,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;IACtC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;IACtD,SAAS,EAAE,CAAC;AACd,CAAC;KAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;IAChC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;IAC/B,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5C,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,KAAK,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC;IACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { auditCatalog, parseToolsJson, gradeFromFindings } from "./analyzer.js";
+export type { Finding, AuditResult, Grade } from "./analyzer.js";
+export { classifyTool, CAPABILITY_RULES } from "./capabilities.js";
+export type { Capability, ToolRecord } from "./capabilities.js";
+export { extractToolsFromSource, scanSourceText, scanSourceFile, scanDirectory } from "./scanner.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAChF,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACnE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { auditCatalog, parseToolsJson, gradeFromFindings } from "./analyzer.js";
+export { classifyTool, CAPABILITY_RULES } from "./capabilities.js";
+export { extractToolsFromSource, scanSourceText, scanSourceFile, scanDirectory } from "./scanner.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEhF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/sarif.d.ts

@@ -0,0 +1,3 @@
+import type { Finding } from "./analyzer.js";
+export declare function buildSarif(toolVersion: string, findings: Finding[]): object;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAQ7C,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CA2C3E"}

package/dist/sarif.js

@@ -0,0 +1,50 @@
+function severityToLevel(sev) {
+    if (sev === "critical" || sev === "high")
+        return "error";
+    if (sev === "medium")
+        return "warning";
+    return "note";
+}
+export function buildSarif(toolVersion, findings) {
+    const rulesMap = new Map();
+    const results = [];
+    for (const f of findings) {
+        if (!rulesMap.has(f.patternId)) {
+            rulesMap.set(f.patternId, {
+                id: f.patternId,
+                name: f.patternName.replace(/[^a-zA-Z0-9]/g, ""),
+                shortDescription: { text: f.patternName },
+                fullDescription: { text: f.recommendation },
+                helpUri: "https://guardbee.ai/docs/toxic-flow-auditor",
+                properties: {
+                    "problem.severity": f.severity,
+                    tags: ["security", "ai-security", "mcp-security", "toxic-flow", f.owasp, f.category],
+                },
+            });
+        }
+        results.push({
+            ruleId: f.patternId,
+            level: severityToLevel(f.severity),
+            message: { text: `${f.patternName} — ${f.recommendation}` },
+            properties: { tools: f.tools, capabilities: f.capabilities },
+        });
+    }
+    return {
+        $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "@guardbee/mcp-toxic-flow-auditor",
+                        version: toolVersion,
+                        informationUri: "https://guardbee.ai",
+                        rules: Array.from(rulesMap.values()),
+                    },
+                },
+                results,
+            },
+        ],
+    };
+}
+//# sourceMappingURL=sarif.js.map

package/dist/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAEA,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACzD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,WAAmB,EAAE,QAAmB;IACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE;gBACxB,EAAE,EAAE,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;gBAChD,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;gBACzC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE;gBAC3C,OAAO,EAAE,6CAA6C;gBACtD,UAAU,EAAE;oBACV,kBAAkB,EAAE,CAAC,CAAC,QAAQ;oBAC9B,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC;iBACrF;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,cAAc,EAAE,EAAE;YAC3D,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO,EAAE,gGAAgG;QACzG,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,WAAW;wBACpB,cAAc,EAAE,qBAAqB;wBACrC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;qBACrC;iBACF;gBACD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/scanner.d.ts

@@ -0,0 +1,21 @@
+import { type AuditResult, type Finding } from "./analyzer.js";
+import type { ToolRecord } from "./capabilities.js";
+/**
+ * Extract MCP SDK `.tool("name", "description", ...)` registrations from source.
+ * Enough to rough-classify a server without a live tools/list.
+ */
+export declare function extractToolsFromSource(text: string): ToolRecord[];
+export declare function scanSourceText(text: string, label?: string): AuditResult;
+export declare function scanSourceFile(filePath: string): {
+    result: AuditResult;
+    skipped: boolean;
+};
+export declare function scanDirectory(dirPath: string, options?: {
+    maxFiles?: number;
+    exclude?: string[];
+}): AuditResult & {
+    scannedFiles: number;
+    skippedFiles: number;
+};
+export type { Finding, AuditResult };
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAYpD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CASjE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,CAExE;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAiB1F;AAkBD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GACtD,WAAW,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CA4E9D;AAED,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/scanner.js

@@ -0,0 +1,150 @@
+import { readFileSync, statSync, readdirSync } from "fs";
+import { join, relative, extname } from "path";
+import { auditCatalog } from "./analyzer.js";
+const SKIP_EXTENSIONS = new Set([
+    ".png", ".jpg", ".jpeg", ".gif", ".svg", ".ico", ".webp", ".bmp",
+    ".pdf", ".zip", ".tar", ".gz", ".lock",
+]);
+const SKIP_DIRS = new Set([
+    "node_modules", ".git", "dist", "build", ".next",
+    "__pycache__", "coverage", "venv", ".venv",
+]);
+const MAX_FILE_SIZE = 1 * 1024 * 1024;
+/**
+ * Extract MCP SDK `.tool("name", "description", ...)` registrations from source.
+ * Enough to rough-classify a server without a live tools/list.
+ */
+export function extractToolsFromSource(text) {
+    const tools = [];
+    const re = /\.tool\s*\(\s*["'`]([^"'`]+)["'`]\s*(?:,\s*["'`]([^"'`]*)["'`])?/g;
+    let match;
+    while ((match = re.exec(text)) !== null) {
+        tools.push({ name: match[1] ?? "", description: match[2] });
+        if (match.index === re.lastIndex)
+            re.lastIndex++;
+    }
+    return tools;
+}
+export function scanSourceText(text, label) {
+    return auditCatalog(extractToolsFromSource(text), label ?? "source");
+}
+export function scanSourceFile(filePath) {
+    const ext = extname(filePath).toLowerCase();
+    if (SKIP_EXTENSIONS.has(ext))
+        return { result: emptyResult(), skipped: true };
+    let stat;
+    try {
+        stat = statSync(filePath);
+    }
+    catch {
+        return { result: emptyResult(), skipped: true };
+    }
+    if (!stat.isFile() || stat.size > MAX_FILE_SIZE)
+        return { result: emptyResult(), skipped: true };
+    let content;
+    try {
+        content = readFileSync(filePath, "utf8");
+    }
+    catch {
+        return { result: emptyResult(), skipped: true };
+    }
+    return { result: scanSourceText(content, filePath), skipped: false };
+}
+function emptyResult() {
+    return {
+        toolCount: 0,
+        grade: "A",
+        score: 100,
+        byCapability: {
+            "untrusted-content": [],
+            "sensitive-data": [],
+            exfiltration: [],
+            destructive: [],
+        },
+        findings: [],
+        durationMs: 0,
+    };
+}
+export function scanDirectory(dirPath, options = {}) {
+    const start = Date.now();
+    const { maxFiles = 5000, exclude } = options;
+    if (!Number.isInteger(maxFiles) || maxFiles < 1) {
+        throw new Error(`maxFiles must be a positive integer (got ${String(maxFiles)})`);
+    }
+    const allTools = [];
+    let scannedFiles = 0;
+    let skippedFiles = 0;
+    function walk(dir) {
+        if (scannedFiles + skippedFiles >= maxFiles)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const fullPath = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (SKIP_DIRS.has(entry.name) || entry.name.startsWith("."))
+                    continue;
+                if (exclude?.some((ex) => entry.name === ex || fullPath.includes(ex)))
+                    continue;
+                walk(fullPath);
+            }
+            else if (entry.isFile()) {
+                const rel = relative(dirPath, fullPath);
+                if (exclude?.some((ex) => rel.includes(ex))) {
+                    skippedFiles++;
+                    continue;
+                }
+                const ext = extname(fullPath).toLowerCase();
+                if (SKIP_EXTENSIONS.has(ext)) {
+                    skippedFiles++;
+                    continue;
+                }
+                let stat;
+                try {
+                    stat = statSync(fullPath);
+                }
+                catch {
+                    skippedFiles++;
+                    continue;
+                }
+                if (!stat.isFile() || stat.size > MAX_FILE_SIZE) {
+                    skippedFiles++;
+                    continue;
+                }
+                try {
+                    const content = readFileSync(fullPath, "utf8");
+                    const tools = extractToolsFromSource(content);
+                    scannedFiles++;
+                    allTools.push(...tools);
+                }
+                catch {
+                    skippedFiles++;
+                }
+            }
+        }
+    }
+    walk(dirPath);
+    const byName = new Map();
+    for (const tool of allTools) {
+        if (!tool.name)
+            continue;
+        const prev = byName.get(tool.name);
+        if (!prev || (tool.description && !(prev.description ?? "")))
+            byName.set(tool.name, tool);
+        else if (!byName.has(tool.name))
+            byName.set(tool.name, tool);
+    }
+    const result = auditCatalog([...byName.values()], dirPath);
+    return {
+        ...result,
+        scannedFiles,
+        skippedFiles,
+        durationMs: Date.now() - start,
+    };
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAkC,MAAM,eAAe,CAAC;AAG7E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAChE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CACvC,CAAC,CAAC;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAChD,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO;CAC3C,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,mEAAmE,CAAC;IAC/E,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;YAAE,EAAE,CAAC,SAAS,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAc;IACzD,OAAO,YAAY,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9E,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjG,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,KAAK,EAAE,GAAG;QACV,KAAK,EAAE,GAAG;QACV,YAAY,EAAE;YACZ,mBAAmB,EAAE,EAAE;YACvB,gBAAgB,EAAE,EAAE;YACpB,YAAY,EAAE,EAAE;YAChB,WAAW,EAAE,EAAE;SAChB;QACD,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,CAAC;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,UAAqD,EAAE;IAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,SAAS,IAAI,CAAC,GAAW;QACvB,IAAI,YAAY,GAAG,YAAY,IAAI,QAAQ;YAAE,OAAO;QACpD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACtE,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAAE,SAAS;gBAChF,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACxC,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC5C,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC;gBACT,IAAI,CAAC;oBACH,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;oBAChD,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;oBAC/C,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;oBAC9C,YAAY,EAAE,CAAC;oBACf,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,CAAC;IAEd,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,SAAS;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACrF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO;QACL,GAAG,MAAM;QACT,YAAY;QACZ,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,4 @@
+import { type Finding } from "./analyzer.js";
+export declare function startServer(): Promise<void>;
+export type { Finding };
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkD,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AA+B7F,wBAAsB,WAAW,kBA6FhC;AAED,YAAY,EAAE,OAAO,EAAE,CAAC"}

package/dist/server.js

@@ -0,0 +1,96 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { instrumentServer } from "@guardbee/mcp-telemetry";
+import { z } from "zod";
+import { auditCatalog, parseToolsJson } from "./analyzer.js";
+import { scanDirectory, scanSourceFile, scanSourceText } from "./scanner.js";
+function formatAudit(result, extra = "") {
+    const lines = [
+        `Grade ${result.grade} (score ${result.score}/100) — ${result.toolCount} tool(s) in ${result.durationMs}ms`,
+        `  untrusted-content : ${result.byCapability["untrusted-content"].join(", ") || "—"}`,
+        `  sensitive-data    : ${result.byCapability["sensitive-data"].join(", ") || "—"}`,
+        `  exfiltration      : ${result.byCapability.exfiltration.join(", ") || "—"}`,
+        `  destructive       : ${result.byCapability.destructive.join(", ") || "—"}`,
+        "",
+    ];
+    if (extra)
+        lines.unshift(extra);
+    if (result.findings.length === 0) {
+        lines.push("✅ No toxic-flow or dangerous capability pairs found.");
+        return lines.join("\n");
+    }
+    lines.push(`⚠️  ${result.findings.length} finding(s):`);
+    lines.push("");
+    for (const f of result.findings) {
+        lines.push(`[${f.severity.toUpperCase()}] ${f.patternName} (${f.owasp})`);
+        lines.push(`  Tools          : ${f.tools.join(", ")}`);
+        lines.push(`  Capabilities   : ${f.capabilities.join(", ")}`);
+        lines.push(`  Recommendation : ${f.recommendation}`);
+        lines.push("");
+    }
+    return lines.join("\n");
+}
+export async function startServer() {
+    const server = new McpServer({
+        name: "guardbee-toxic-flow-auditor",
+        version: "0.1.0",
+    });
+    instrumentServer(server, "toxic-flow-auditor");
+    server.tool("audit_catalog", "Audit a tools/list-shaped JSON catalog for the lethal trifecta (toxic flow): untrusted content + sensitive/private data + exfiltration or destruction on the same MCP server. Returns an A–F grade.", {
+        catalog: z.string().describe("JSON array of tools, or { tools: [...] } from tools/list"),
+        label: z.string().optional().describe("Optional label for the server/catalog"),
+    }, async ({ catalog, label }) => {
+        const tools = parseToolsJson(catalog);
+        const result = auditCatalog(tools, label ?? "catalog");
+        return { content: [{ type: "text", text: formatAudit(result) }] };
+    });
+    server.tool("scan_source", "Scan TypeScript/JavaScript MCP server source for .tool(...) registrations and audit them for toxic flows", {
+        content: z.string().describe("Source code to scan"),
+        label: z.string().optional(),
+    }, async ({ content, label }) => {
+        const result = scanSourceText(content, label);
+        return { content: [{ type: "text", text: formatAudit(result) }] };
+    });
+    server.tool("scan_file", "Scan a single source file for toxic flows", { path: z.string() }, async ({ path: filePath }) => {
+        const { result, skipped } = scanSourceFile(filePath);
+        if (skipped) {
+            return { content: [{ type: "text", text: `⏭️  File skipped: ${filePath}` }] };
+        }
+        return { content: [{ type: "text", text: formatAudit(result) }] };
+    });
+    server.tool("scan_directory", "Recursively scan a directory of MCP server source for toxic flows across all registered tools", {
+        path: z.string(),
+        maxFiles: z.number().int().positive().optional(),
+        exclude: z.array(z.string()).optional(),
+    }, async ({ path: dirPath, maxFiles, exclude }) => {
+        const result = scanDirectory(dirPath, { maxFiles, exclude });
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: formatAudit(result, `Scanned ${result.scannedFiles} file(s), skipped ${result.skippedFiles}.`),
+                },
+            ],
+        };
+    });
+    server.tool("explain_trifecta", "Explain the lethal trifecta / toxic-flow model this auditor uses", {}, async () => ({
+        content: [
+            {
+                type: "text",
+                text: [
+                    "Lethal trifecta (Simon Willison) / toxic flow:",
+                    "1. Untrusted content — fetch, scrape, browse, issues, feeds the model will read",
+                    "2. Sensitive data — secrets, DB, vault, mailboxes, KVKK-regulated PII",
+                    "3. Exfiltration or destruction — send, webhook, export, delete, drop",
+                    "",
+                    "When one MCP server exposes all three, a prompt injection can chain them.",
+                    "Mapped primarily to OWASP MCP10:2025 (context over-sharing / toxic combination).",
+                    "Also reports dangerous pairs (sensitive+exfil, untrusted+exfil, sensitive+destruct).",
+                ].join("\n"),
+            },
+        ],
+    }));
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,cAAc,EAAkC,MAAM,eAAe,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE7E,SAAS,WAAW,CAAC,MAAmB,EAAE,KAAK,GAAG,EAAE;IAClD,MAAM,KAAK,GAAa;QACtB,SAAS,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,SAAS,eAAe,MAAM,CAAC,UAAU,IAAI;QAC3G,yBAAyB,MAAM,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE;QACrF,yBAAyB,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE;QAClF,yBAAyB,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE;QAC7E,yBAAyB,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE;QAC5E,EAAE;KACH,CAAC;IACF,IAAI,KAAK;QAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IACH,gBAAgB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAE/C,MAAM,CAAC,IAAI,CACT,eAAe,EACf,qMAAqM,EACrM;QACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;QACxF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;KAC/E,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACpE,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,aAAa,EACb,0GAA0G,EAC1G;QACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACpE,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,WAAW,EACX,2CAA2C,EAC3C,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EACpB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC3B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACpE,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,+FAA+F,EAC/F;QACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAChD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxC,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,YAAY,qBAAqB,MAAM,CAAC,YAAY,GAAG,CAAC;iBACrG;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,kEAAkE,EAClE,EAAE,EACF,KAAK,IAAI,EAAE,CAAC,CAAC;QACX,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE;oBACJ,gDAAgD;oBAChD,iFAAiF;oBACjF,uEAAuE;oBACvE,sEAAsE;oBACtE,EAAE;oBACF,2EAA2E;oBAC3E,kFAAkF;oBAClF,sFAAsF;iBACvF,CAAC,IAAI,CAAC,IAAI,CAAC;aACb;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@guardbee/mcp-toxic-flow-auditor",
+  "version": "0.1.0",
+  "mcpName": "io.github.4hmetuyar/toxic-flow-auditor",
+  "description": "MCP server that detects toxic flows (lethal trifecta) across an MCP tool catalog — untrusted content + private/sensitive data + exfiltration or destruction on the same server",
+  "type": "module",
+  "bin": {
+    "guardbee-toxic-flow-auditor": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "TR.md"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "zod": "^4.5.4",
+    "@guardbee/mcp-telemetry": "^0.1.3"
+  },
+  "keywords": [
+    "mcp",
+    "security",
+    "ai-security",
+    "mcp-security",
+    "toxic-flow",
+    "lethal-trifecta",
+    "owasp-mcp-top-10",
+    "kvkk",
+    "guardbee",
+    "devtools"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/GuardBee/guardbee-mcp.git",
+    "directory": "packages/toxic-flow-auditor"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/cli.js",
+    "test": "vitest run"
+  }
+}