@inkog-io/mcp 1.0.20 → 1.0.21

package/dist/tools/mcp-scan.js

@@ -0,0 +1,350 @@
+/**
+ * inkog_mcp_scan Tool
+ *
+ * Scan MCP servers from registry or by repository URL for security vulnerabilities.
+ * Detects tool poisoning, command injection, data exfiltration, excessive permissions, and more.
+ *
+ * For skill package scanning, use inkog_skill_scan instead.
+ */
+import { z } from 'zod';
+import { getClient, InkogApiError, InkogAuthError, InkogNetworkError, InkogRateLimitError, } from '../api/client.js';
+// =============================================================================
+// Schema
+// =============================================================================
+const MCPScanArgsSchema = z
+    .object({
+    server_name: z
+        .string()
+        .optional()
+        .describe('MCP server name from registry (e.g., "github", "filesystem", "postgres")'),
+    repository_url: z
+        .string()
+        .url()
+        .optional()
+        .describe('GitHub repository URL of the MCP server to scan'),
+    deep: z
+        .boolean()
+        .optional()
+        .default(false)
+        .describe('Enable AI deep analysis (slower but catches novel threats)'),
+})
+    .refine((data) => data.server_name !== undefined ||
+    data.repository_url !== undefined, {
+    message: 'Either server_name or repository_url must be provided',
+});
+// =============================================================================
+// Formatters
+// =============================================================================
+function formatSeverityIcon(severity) {
+    switch (severity) {
+        case 'CRITICAL':
+            return '🔴';
+        case 'HIGH':
+            return '🟠';
+        case 'MEDIUM':
+            return '🟡';
+        case 'LOW':
+            return '🟢';
+        default:
+            return '⚪';
+    }
+}
+function formatRiskBadge(risk) {
+    switch (risk) {
+        case 'critical':
+            return '🔴 CRITICAL';
+        case 'high':
+            return '🟠 HIGH';
+        case 'medium':
+            return '🟡 MEDIUM';
+        case 'low':
+            return '🟢 LOW';
+        default:
+            return risk.toUpperCase();
+    }
+}
+function formatPermission(name, enabled) {
+    return enabled ? `⚠️ ${name}` : `✅ ${name} (not used)`;
+}
+// =============================================================================
+// Deep Scan Helpers
+// =============================================================================
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function formatDeepFindings(scan) {
+    const aiFindings = scan.ai_findings;
+    if (!aiFindings)
+        return '';
+    let parsed = aiFindings;
+    if (typeof parsed === 'string') {
+        try {
+            parsed = JSON.parse(parsed);
+        }
+        catch {
+            return '';
+        }
+    }
+    let findings = [];
+    if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+        const obj = parsed;
+        if (Array.isArray(obj.findings))
+            findings = obj.findings;
+    }
+    else if (Array.isArray(parsed)) {
+        findings = parsed;
+    }
+    if (findings.length === 0)
+        return '';
+    const lines = [];
+    lines.push('## Deep Analysis Findings');
+    for (const f of findings) {
+        const sev = typeof f.severity === 'string' ? f.severity : 'LOW';
+        const severity = sev.toUpperCase();
+        const icon = severity === 'CRITICAL' ? '🔴' : severity === 'HIGH' ? '🟠' : severity === 'MEDIUM' ? '🟡' : '🟢';
+        const title = typeof f.title === 'string' ? f.title : typeof f.description === 'string' ? f.description : 'Finding';
+        lines.push(`### ${icon} ${title}`);
+        if (typeof f.file === 'string') {
+            lines.push(`📁 ${f.file}${typeof f.line === 'number' ? `:${f.line.toString()}` : ''}`);
+        }
+        if (typeof f.description === 'string')
+            lines.push(f.description);
+        if (typeof f.remediation === 'string')
+            lines.push(`💡 ${f.remediation}`);
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+// =============================================================================
+// Handler
+// =============================================================================
+async function handleMCPScan(args) {
+    const parsed = MCPScanArgsSchema.parse(args);
+    try {
+        const client = getClient();
+        let response;
+        if (parsed.server_name) {
+            // Scan MCP server from registry (optionally with repo URL for deep)
+            const mcpOpts = {
+                serverName: parsed.server_name,
+            };
+            if (parsed.repository_url) {
+                mcpOpts.url = parsed.repository_url;
+            }
+            response = await client.scanMCPServer(mcpOpts);
+        }
+        else if (parsed.repository_url) {
+            // Scan MCP server from repository URL
+            response = await client.scanSkill({
+                repositoryUrl: parsed.repository_url,
+            });
+        }
+        else {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: 'Please provide either server_name or repository_url.',
+                    },
+                ],
+                isError: true,
+            };
+        }
+        if (!response.success || !response.result) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `MCP scan failed: ${response.error ?? 'Unknown error'}`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+        // Format the results
+        const result = response.result;
+        const lines = [];
+        lines.push(`# MCP Server Security Scan: ${result.name || 'Unknown'}`);
+        lines.push('');
+        lines.push(`**Overall Risk:** ${formatRiskBadge(result.overall_risk)}`);
+        lines.push(`**Security Score:** ${result.security_score}/100`);
+        lines.push(`**Files Scanned:** ${result.files_scanned} | **Lines:** ${result.lines_of_code}`);
+        lines.push('');
+        // Permissions
+        if (result.permissions) {
+            const p = result.permissions;
+            lines.push('## Permissions');
+            lines.push(formatPermission('File Access', p.file_access));
+            lines.push(formatPermission('Network Access', p.network_access));
+            lines.push(formatPermission('Code Execution', p.code_execution));
+            lines.push(formatPermission('Database Access', p.database_access));
+            lines.push(formatPermission('Environment Access', p.environment_access));
+            lines.push(`**Scope:** ${p.scope}`);
+            if (p.code_execution && p.network_access && (p.file_access || p.environment_access)) {
+                lines.push('');
+                lines.push('⚠️ **LETHAL TRIFECTA DETECTED:** Code Execution + Network + File/Env Access');
+            }
+            lines.push('');
+        }
+        // Tools
+        if (result.tool_analyses?.length > 0) {
+            lines.push(`## Tools (${result.tool_analyses.length})`);
+            for (const tool of result.tool_analyses) {
+                const riskIcon = tool.risk_level === 'dangerous' ? '🔴' :
+                    tool.risk_level === 'moderate' ? '🟡' : '🟢';
+                lines.push(`- ${riskIcon} **${tool.name}** [${tool.risk_level}]`);
+                if (tool.attack_vectors?.length) {
+                    for (const v of tool.attack_vectors) {
+                        lines.push(`  - Attack vector: ${v}`);
+                    }
+                }
+            }
+            lines.push('');
+        }
+        // Findings
+        if (result.findings.length > 0) {
+            lines.push(`## Findings (${result.findings.length})`);
+            lines.push(`🔴 Critical: ${result.critical_count} | 🟠 High: ${result.high_count} | 🟡 Medium: ${result.medium_count} | 🟢 Low: ${result.low_count}`);
+            lines.push('');
+            for (let i = 0; i < result.findings.length; i++) {
+                const f = result.findings[i];
+                lines.push(`### ${formatSeverityIcon(f.severity)} #${i + 1}: ${f.title}`);
+                if (f.file) {
+                    lines.push(`📁 ${f.file}${f.line ? `:${f.line}` : ''}`);
+                }
+                if (f.tool_name) {
+                    lines.push(`🔧 Tool: ${f.tool_name}`);
+                }
+                lines.push(f.description);
+                if (f.owasp_agentic || f.owasp_mcp) {
+                    const refs = [];
+                    if (f.owasp_agentic)
+                        refs.push(`OWASP Agentic: ${f.owasp_agentic}`);
+                    if (f.owasp_mcp)
+                        refs.push(`OWASP MCP: ${f.owasp_mcp}`);
+                    lines.push(`📋 ${refs.join(' | ')}`);
+                }
+                lines.push(`💡 ${f.remediation}`);
+                lines.push('');
+            }
+        }
+        else {
+            lines.push('## ✅ No security findings detected');
+        }
+        // Deep scan flow
+        if (parsed.deep && response.scan_id) {
+            lines.push('');
+            lines.push('---');
+            lines.push('## 🔬 Deep Analysis');
+            lines.push('Triggering AI deep analysis...');
+            try {
+                await client.triggerSkillDeepScan(response.scan_id);
+            }
+            catch {
+                lines.push('⚠️ Could not trigger deep analysis. Returning standard results.');
+                return {
+                    content: [{ type: 'text', text: lines.join('\n') }],
+                };
+            }
+            const deadline = Date.now() + 15 * 60 * 1000;
+            let deepDone = false;
+            while (Date.now() < deadline) {
+                await sleep(5000);
+                try {
+                    const detail = await client.getSkillScan(response.scan_id);
+                    const status = detail.scan?.ai_scan_status;
+                    if (status === 'completed') {
+                        const deepOutput = formatDeepFindings(detail.scan);
+                        if (deepOutput) {
+                            lines.push(deepOutput);
+                        }
+                        else {
+                            lines.push('✅ Deep analysis completed — no additional findings.');
+                        }
+                        deepDone = true;
+                        break;
+                    }
+                    if (status === 'failed') {
+                        lines.push('⚠️ Deep analysis failed. Standard scan results are shown above.');
+                        deepDone = true;
+                        break;
+                    }
+                }
+                catch {
+                    // Polling error — continue waiting
+                }
+            }
+            if (!deepDone) {
+                lines.push('⏱️ Deep analysis timed out (15 min). Check the dashboard for results.');
+            }
+        }
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: lines.join('\n'),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        if (err instanceof InkogAuthError) {
+            return {
+                content: [{ type: 'text', text: '🔐 Authentication required. Set INKOG_API_KEY environment variable.' }],
+                isError: true,
+            };
+        }
+        if (err instanceof InkogRateLimitError) {
+            return {
+                content: [{ type: 'text', text: '⏳ Rate limited. Please wait and try again.' }],
+                isError: true,
+            };
+        }
+        if (err instanceof InkogNetworkError) {
+            return {
+                content: [{ type: 'text', text: '🌐 Network error. Check your connection and try again.' }],
+                isError: true,
+            };
+        }
+        if (err instanceof InkogApiError) {
+            return {
+                content: [{ type: 'text', text: `❌ API error: ${err.message}` }],
+                isError: true,
+            };
+        }
+        throw err;
+    }
+}
+// =============================================================================
+// Tool Definition
+// =============================================================================
+export const mcpScanTool = {
+    tool: {
+        name: 'inkog_mcp_scan',
+        description: 'Scan MCP servers from registry or by repository URL for security vulnerabilities. ' +
+            'Detects tool poisoning, command injection, data exfiltration, prompt injection, excessive permissions, ' +
+            'obfuscation, supply chain risks, and more. Maps findings to OWASP Agentic Top 10 and OWASP MCP Top 10. ' +
+            'Set deep=true for AI-powered deep analysis (~10 min, catches novel threats). ' +
+            'For skill package scanning, use inkog_skill_scan instead.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                server_name: {
+                    type: 'string',
+                    description: 'MCP server name from registry (e.g., "github", "filesystem", "postgres")',
+                },
+                repository_url: {
+                    type: 'string',
+                    description: 'GitHub repository URL of the MCP server',
+                },
+                deep: {
+                    type: 'boolean',
+                    description: 'Enable AI deep analysis',
+                    default: false,
+                },
+            },
+        },
+    },
+    handler: handleMCPScan,
+};
+//# sourceMappingURL=mcp-scan.js.map

package/dist/tools/mcp-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-scan.js","sourceRoot":"","sources":["../../src/tools/mcp-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,SAAS,EACT,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAI1B,gFAAgF;AAChF,SAAS;AACT,gFAAgF;AAEhF,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACvF,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,4DAA4D,CAAC;CAC1E,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,WAAW,KAAK,SAAS;IAC9B,IAAI,CAAC,cAAc,KAAK,SAAS,EACnC;IACE,OAAO,EAAE,uDAAuD;CACjE,CACF,CAAC;AAEJ,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,IAAI,CAAC;QACd,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;QACd,KAAK,KAAK;YACR,OAAO,IAAI,CAAC;QACd;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,SAAS,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAgB;IACtD,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,aAAa,CAAC;AACzD,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA6B;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,IAAI,MAAM,GAAY,UAAU,CAAC;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IAC3D,CAAC;IAED,IAAI,QAAQ,GAA8B,EAAE,CAAC;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,QAAQ,GAAG,GAAG,CAAC,QAAqC,CAAC;IACxF,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,QAAQ,GAAG,MAAmC,CAAC;IACjD,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/G,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACpH,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,KAAK,UAAU,aAAa,CAAC,IAA6B;IACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,QAA2B,CAAC;QAEhC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,oEAAoE;YACpE,MAAM,OAAO,GAAyC;gBACpD,UAAU,EAAE,MAAM,CAAC,WAAW;aAC/B,CAAC;YACF,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC;YACtC,CAAC;YACD,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACjC,sCAAsC;YACtC,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC;gBAChC,aAAa,EAAE,MAAM,CAAC,cAAc;aACrC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,sDAAsD;qBAC7D;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,oBAAoB,QAAQ,CAAC,KAAK,IAAI,eAAe,EAAE;qBAC9D;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,CAAC,IAAI,CAAC,+BAA+B,MAAM,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,qBAAqB,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,cAAc,MAAM,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,aAAa,iBAAiB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,cAAc;QACd,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YACjE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YACjE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;YACnE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACzE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAEpC,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACpF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;YAC5F,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,QAAQ;QACR,IAAI,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;YACxD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACxC,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9D,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,MAAM,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;gBAClE,IAAI,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;oBAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;oBACxC,CAAC;gBACH,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,WAAW;QACX,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,cAAc,eAAe,MAAM,CAAC,UAAU,iBAAiB,MAAM,CAAC,YAAY,cAAc,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACtJ,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC1E,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBACX,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBACD,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;oBAChB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;gBACxC,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC1B,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;oBACnC,MAAM,IAAI,GAAa,EAAE,CAAC;oBAC1B,IAAI,CAAC,CAAC,aAAa;wBAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;oBACpE,IAAI,CAAC,CAAC,SAAS;wBAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;oBACxD,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACvC,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACnD,CAAC;QAED,iBAAiB;QACjB,IAAI,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAE7C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;gBAC9E,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;iBACpD,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAC7C,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,MAAM,GAA4B,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBACpF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,cAAoC,CAAC;oBAEjE,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;wBAC3B,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;wBACnD,IAAI,UAAU,EAAE,CAAC;4BACf,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;wBACzB,CAAC;6BAAM,CAAC;4BACN,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;wBACpE,CAAC;wBACD,QAAQ,GAAG,IAAI,CAAC;wBAChB,MAAM;oBACR,CAAC;oBACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACxB,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;wBAC9E,QAAQ,GAAG,IAAI,CAAC;wBAChB,MAAM;oBACR,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,mCAAmC;gBACrC,CAAC;YACH,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,KAAK,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;iBACvB;aACF;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qEAAqE,EAAE,CAAC;gBACxG,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,4CAA4C,EAAE,CAAC;gBAC/E,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wDAAwD,EAAE,CAAC;gBAC3F,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE;QACJ,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,oFAAoF;YACpF,yGAAyG;YACzG,yGAAyG;YACzG,+EAA+E;YAC/E,2DAA2D;QAC7D,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0EAA0E;iBACxF;gBACD,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,yCAAyC;iBACvD;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,yBAAyB;oBACtC,OAAO,EAAE,KAAK;iBACf;aACF;SACF;KACF;IACD,OAAO,EAAE,aAAa;CACvB,CAAC"}

package/dist/tools/scan.js

@@ -116,7 +116,7 @@ function formatFinding(finding, detailed) {
 }
 function formatSummaryFromCounts(total, critical, high, medium, low, riskScore, filesScanned, policy) {
     let output = '╔══════════════════════════════════════════════════════╗\n';
-    output += '║           🔍 AI Agent Risk Assessment                ║\n';
+    output += '║           🔍 Inkog Core Scan Results                 ║\n';
     output += '╚══════════════════════════════════════════════════════╝\n\n';
     output += `📁 Files scanned: ${filesScanned}\n`;
     output += `📊 Risk score: ${riskScore}/100\n`;

package/dist/tools/skill-scan.d.ts

@@ -0,0 +1,11 @@
+/**
+ * inkog_skill_scan Tool
+ *
+ * Scan SKILL.md packages and agent tool definitions for security vulnerabilities.
+ * Detects tool poisoning, command injection, data exfiltration, excessive permissions, and more.
+ *
+ * For MCP server scanning, use inkog_mcp_scan instead.
+ */
+import type { ToolDefinition } from './index.js';
+export declare const skillScanTool: ToolDefinition;
+//# sourceMappingURL=skill-scan.d.ts.map

package/dist/tools/skill-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-scan.d.ts","sourceRoot":"","sources":["../../src/tools/skill-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,YAAY,CAAC;AA0U7D,eAAO,MAAM,aAAa,EAAE,cA6B3B,CAAC"}