@kryptosai/mcp-observatory 0.27.0 → 0.28.0

package/COMMERCIAL.md

@@ -4,12 +4,17 @@ MCP Observatory is the CI and security gate for MCP servers before agents depend
 
 The open source CLI and MCP server remain free for local OSS use under the MIT license. Paid pilots are for production use cases where a team needs hosted reporting, private repository CI, security reports, certification, support, or fleet visibility.
 
-## Pilot Pricing
+## MCP Readiness Review
+
+The primary paid offer is a fixed-scope MCP Readiness Review starting at `$2,500`.
+
+It includes CI rollout, SARIF/GitHub Code Scanning setup, private readiness reporting, prioritized remediation notes, and maintainer PR support for selected MCP servers.
 
 These are starting points for current pilots, not permanent fixed plans. For public OSS users, the important part is simple: local CLI use remains free, and paid work is for private or production support needs.
 
 | Pilot | Starting Price | Best Fit |
 | --- | ---: | --- |
+| MCP Readiness Review | $2,500 | CI rollout, Code Scanning, private readiness report, and prioritized fixes |
 | Team Pilot | $299/month | Small teams adding MCP regression checks to CI |
 | Business Pilot | $999/month | Private repos, recurring security reports, and shared reporting |
 | Enterprise Pilot | $3k/month | Private MCP readiness reports, support, and fleet visibility |

package/CONTRIBUTORS.md

@@ -0,0 +1,39 @@
+# Contributors
+
+MCP Observatory uses the [All Contributors](https://allcontributors.org/) spec so code, docs, tests, target research, reviews, security findings, design, and maintainer feedback can all receive visible credit.
+
+Official GitHub profile achievements are platform-controlled; this project does not award them. Instead, contributors get public proof: a role on the recognition page, an All Contributors entry, and a proof card or recognition link they can reference from a README or GitHub profile.
+
+See the full recognition path in [MCP Observatory Contributors](./docs/contributor-recognition.md).
+
+<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
+[![All Contributors](https://img.shields.io/badge/all_contributors-1-orange.svg?style=flat-square)](#contributors-)
+<!-- ALL-CONTRIBUTORS-BADGE:END -->
+
+## Contributors
+
+<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
+<!-- prettier-ignore-start -->
+<!-- markdownlint-disable -->
+<table>
+  <tbody>
+    <tr>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/KryptosAI"><img src="https://avatars.githubusercontent.com/u/140749029?s=100" width="100px;" alt="William Weishuhn"/><br /><sub><b>William Weishuhn</b></sub></a><br /><a href="https://github.com/KryptosAI/mcp-observatory/commits?author=KryptosAI" title="Code">💻</a> <a href="https://github.com/KryptosAI/mcp-observatory/commits?author=KryptosAI" title="Documentation">📖</a> <a href="#ideas-KryptosAI" title="Ideas, Planning, & Feedback">🤔</a> <a href="#maintenance-KryptosAI" title="Maintenance">🚧</a> <a href="https://github.com/KryptosAI/mcp-observatory/commits?author=KryptosAI" title="Tests">⚠️</a></td>
+    </tr>
+  </tbody>
+</table>
+
+<!-- markdownlint-restore -->
+<!-- prettier-ignore-end -->
+
+<!-- ALL-CONTRIBUTORS-LIST:END -->
+
+## Recognition Requests
+
+After a useful contribution is merged or accepted, request credit in the PR or issue:
+
+```text
+@all-contributors please add @username for code, doc, test, ideas, review
+```
+
+If the bot is unavailable, open a small PR that updates `.all-contributorsrc`, this file, and any relevant proof card under `docs/contributor-proof-cards/`.

package/README.md

@@ -11,41 +11,80 @@
 ```
 
 [![CI](https://github.com/KryptosAI/mcp-observatory/actions/workflows/ci.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/KryptosAI/mcp-observatory/actions/workflows/codeql.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/codeql.yml)
+[![Coverage](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/KryptosAI/mcp-observatory/badge)](https://securityscorecards.dev/viewer/?uri=github.com/KryptosAI/mcp-observatory)
+[![Dependabot](https://img.shields.io/badge/dependabot-enabled-025e8c?logo=dependabot)](./.github/dependabot.yml)
+[![npm provenance workflow](https://img.shields.io/badge/npm%20provenance-workflow-blue)](./.github/workflows/release.yml)
 [![npm](https://img.shields.io/npm/v/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
-[![npm downloads](https://img.shields.io/npm/dm/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
+[![npm weekly downloads](https://img.shields.io/npm/dw/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
+[![GitHub stars](https://img.shields.io/github/stars/KryptosAI/mcp-observatory?style=flat)](https://github.com/KryptosAI/mcp-observatory/stargazers)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](./LICENSE)
 [![Node >= 20](https://img.shields.io/badge/node-%3E%3D20-339933)](./package.json)
 [![Smithery](https://smithery.ai/badge/@kryptosai/mcp-observatory)](https://smithery.ai/server/@kryptosai/mcp-observatory)
 [![mcp-observatory MCP server](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory/badges/score.svg)](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory)
+[![All Contributors](https://img.shields.io/badge/all_contributors-1-orange.svg?style=flat-square)](./CONTRIBUTORS.md)
 
-**The GitHub-native CI and security gate for MCP servers before agents depend on them.**
+**The GitHub-native CI, SARIF, and security-readiness gate for MCP servers before agents depend on them.**
 
-Agents should not depend on tools nobody tests. MCP Observatory gives MCP servers the production safety rails every dependency eventually needs: CI checks, security scans, schema drift detection, PR reports, score badges, agent-accessible diagnostics, and GitHub Code Scanning findings.
+Agents should not depend on tools nobody tests. MCP Observatory turns a local MCP check into release-gate evidence maintainers already understand: GitHub Actions, security findings, schema drift detection, PR reports, score badges, agent-accessible diagnostics, and GitHub Code Scanning SARIF.
 
-Security launch path:
+## Trust Signals
+
+| Signal | What it means |
+|---|---|
+| CI + coverage | Typecheck, lint, tests, build, packed install, artifact validation, smoke test, and measured coverage run in GitHub Actions. |
+| CodeQL + OpenSSF Scorecard | Static analysis and supply-chain posture are visible in GitHub-native security surfaces. |
+| Dependabot | npm and GitHub Actions dependency updates are monitored weekly. |
+| npm provenance workflow | Release automation is prepared for npm provenance through GitHub OIDC. |
+| Security policy | Vulnerability reports go through private disclosure; see [SECURITY.md](./SECURITY.md). |
+
+## Try It
+
+Start with the homepage demo: safely simulate MCP attack-readiness for one server and emit SARIF evidence that maintainers can inspect in GitHub Code Scanning.
 
 ```bash
-npx @kryptosai/mcp-observatory test npx -y my-mcp-server --sarif mcp-observatory.sarif
+npx @kryptosai/mcp-observatory attack-sim npx -y my-mcp-server --sarif attack-results.sarif
 ```
 
-Or install the GitHub Action with Code Scanning upload:
+Then make the evidence repeatable in CI:
 
 ```bash
 npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server" --sarif
 ```
 
-See [GitHub Code Scanning for MCP servers](./docs/github-code-scanning-for-mcp.md).
+See the [MCP Attack Simulator](./docs/mcp-attack-simulator.md), [Tool-call receipts](./docs/tool-call-receipts.md), [MCP Receipt Graph](./docs/receipt-graph.md), [launch page](./docs/launch.md), [GitHub Code Scanning demo](./docs/code-scanning-demo.md), [GitHub Code Scanning for MCP servers](./docs/github-code-scanning-for-mcp.md), [sample safety reports](./docs/mcp-server-safety-index.md), and [reference evaluations](./docs/reference-evaluations.md).
+
+Want a receipt for a server your agent depends on? Comment on [Drop an MCP server, get a receipt #146](https://github.com/KryptosAI/mcp-observatory/issues/146) or use the [structured receipt request form](https://github.com/KryptosAI/mcp-observatory/issues/new?template=tool-call-receipt-request.yml). Public requests can become Safety Index entries, delta receipts, SARIF evidence, and maintainer CI conversations.
+
+## Evidence You Can Inspect
+
+| Evidence | Where |
+|---|---|
+| Example GitHub Actions adoption | [`setup-ci --all`](./docs/setup-ci-doctor.md) and the generated workflow docs |
+| Attack simulation output | [MCP Attack Simulator](./docs/mcp-attack-simulator.md) |
+| Tool-call receipts | [Receipt standard](./docs/tool-call-receipts.md) for reproducible MCP evidence |
+| Receipt graph | [Server-to-evidence map](./docs/receipt-graph.md) for agent trust decisions |
+| SARIF / Code Scanning output | [GitHub Code Scanning demo](./docs/code-scanning-demo.md) |
+| Real MCP server evaluations | [MCP Server Safety Index](./docs/mcp-server-safety-index.md) |
+| Reference reports | [Reference evaluations](./docs/reference-evaluations.md) |
+| Maintainer and contributor proof | [MCP Observatory Contributors](./docs/contributor-recognition.md) |
+| Security disclosure path | [SECURITY.md](./SECURITY.md) |
 
 Two more fast paths:
 
-Cloned this repo? Start here: [`CLONED_THIS.md`](./CLONED_THIS.md). Want to contribute? Add one server to the [MCP Target Registry](./docs/target-registry.md).
+Cloned this repo? Start here: [`CLONED_THIS.md`](./CLONED_THIS.md). Want to contribute? Add one server to the [MCP Target Registry](./docs/target-registry.md), use the [Agent Task Pack](./docs/agent-tasks.md), and get public credit through [MCP Observatory Contributors](./docs/contributor-recognition.md).
 
-Add MCP CI in one command:
+AI coding agents, agentic workflows, and rough PRs are welcome. Use the [10x Agentic Growth Sprint](./docs/10x-agentic-growth-sprint.md), [Agentic Contributor Outreach](./docs/agentic-contributor-outreach.md), or open a `Contributor quest`, `Agentic contribution idea`, or [`Drop an MCP server, get a receipt`](./docs/drop-server-get-receipt.md) issue to suggest a target, prompt, docs fix, receipt, or `setup-ci --sarif` integration.
+
+Add MCP CI and Code Scanning in one command:
 
 ```bash
-npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server"
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server" --sarif
 ```
 
+Installing MCP Observatory in an MCP server project also prints the exact CI setup command. Projects can opt into automatic workflow creation during install with [`mcpObservatory.autoSetupCi`](./docs/automatic-ci-integration.md).
+
 Upload normalized MCP findings to GitHub Code Scanning when you want a security-native release gate:
 
 ```bash
@@ -74,6 +113,8 @@ Use it as a CLI, a GitHub Action, or an MCP server that lets your AI agent scan,
 
 [![Observatory MCP server](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory/badges/card.svg)](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory)
 
+The Glama card is an external MCP directory scorecard. Treat it as directory-level social proof; click through for the underlying category details before using it as a production approval signal.
+
 ## Why MCP Observatory
 
 MCP servers are becoming production dependencies. If agents rely on them, teams need a way to catch broken tools, unsafe schemas, schema drift, slow responses, and security footguns before those failures reach users.
@@ -88,19 +129,19 @@ Observatory gives maintainers and teams:
 - **MCP server mode** so agents can inspect other MCP servers directly
 - **Production support path** for hosted history, private repo reporting, certification, support, and fleet visibility
 
-See [GitHub Code Scanning for MCP servers](./docs/github-code-scanning-for-mcp.md), the [target registry](./docs/target-registry.md), [target contribution guide](./docs/target-contribution-guide.md), [`setup-ci --doctor`](./docs/setup-ci-doctor.md), [MCP server security field guide](./docs/mcp-security-field-guide.md), [Safety Methodology](./docs/methodology.md), [MCP Server Safety Index](./docs/mcp-server-safety-index.md), [June 2026 safety field report](./docs/mcp-safety-field-report-2026-06.md), [reference evaluations](./docs/reference-evaluations.md), [MCP lock files](./docs/mcp-lock-files.md), [public proof](./docs/proof.md), [local metrics dashboard](./docs/metrics-dashboard.md), and [commercial support](./COMMERCIAL.md).
+See the [launch page](./docs/launch.md), [GitHub Code Scanning for MCP servers](./docs/github-code-scanning-for-mcp.md), [Code Scanning demo](./docs/code-scanning-demo.md), [target gallery](./docs/target-gallery.md), [target registry](./docs/target-registry.md), [target contribution guide](./docs/target-contribution-guide.md), [MCP Observatory Contributors](./docs/contributor-recognition.md), [Agent Task Pack](./docs/agent-tasks.md), [Tool-call receipts](./docs/tool-call-receipts.md), [MCP Receipt Graph](./docs/receipt-graph.md), [`setup-ci --doctor`](./docs/setup-ci-doctor.md), [MCP server security field guide](./docs/mcp-security-field-guide.md), [Safety Methodology](./docs/methodology.md), [MCP Server Safety Index](./docs/mcp-server-safety-index.md), [June 2026 safety field report](./docs/mcp-safety-field-report-2026-06.md), [reference evaluations](./docs/reference-evaluations.md), [MCP lock files](./docs/mcp-lock-files.md), [public proof](./docs/proof.md), [campaign attribution](./docs/campaign-attribution.md), [local metrics dashboard](./docs/metrics-dashboard.md), and [commercial support](./COMMERCIAL.md).
 
 ## For Security And Platform Teams
 
 MCP servers are becoming part of the AI software supply chain. Agents need reliable, testable, auditable tools before those tools become dependencies in mission-critical workflows.
 
-MCP Observatory gives security and platform teams MCP server CI, schema drift detection, security findings, SARIF/HTML/Markdown reports, GitHub Code Scanning upload, and a path toward certification or fleet visibility. Local OSS use stays free; production, private repo, and fleet usage can move through a paid pilot.
+MCP Observatory gives security and platform teams MCP server CI, schema drift detection, security findings, SARIF/HTML/Markdown reports, GitHub Code Scanning upload, and a path toward certification or fleet visibility. Local OSS use stays free; production, private repo, and fleet usage can move through a paid MCP Readiness Review.
 
 ## Production Support
 
-Local OSS use stays free under MIT. Teams running MCP in production can use [commercial support](./COMMERCIAL.md) for hosted reporting, private repo CI, recurring security reports, certification review, support, and fleet visibility.
+Local OSS use stays free under MIT. Teams running MCP in production can use the [MCP Readiness Review](./docs/paid-pilot-offer.md) for CI rollout, SARIF/Code Scanning setup, private repo review, recurring security reports, certification review, support, and fleet visibility. The default package starts at `$2,500`.
 
-Run `npx @kryptosai/mcp-observatory cloud`, open a pilot request from the issue chooser, or see [COMMERCIAL.md](./COMMERCIAL.md). Also see [privacy and telemetry](./PRIVACY.md) and [terms for production use](./TERMS.md).
+Run `npx @kryptosai/mcp-observatory cloud`, open a pilot request from the issue chooser, or see [COMMERCIAL.md](./COMMERCIAL.md). Also see [privacy and telemetry](./PRIVACY.md), [campaign attribution](./docs/campaign-attribution.md), and [terms for production use](./TERMS.md).
 
 ## Quick Start
 
@@ -256,7 +297,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: KryptosAI/mcp-observatory/action@v0.26.1
+      - uses: KryptosAI/mcp-observatory/action@v0.27.0
         with:
           command: npx -y my-mcp-server
           deep: true
@@ -362,9 +403,7 @@ Your agent gets 10 tools:
 | `get_last_run` | Retrieve previous check results for a server |
 | `suggest_servers` | Discover MCP servers that match your project stack |
 
-An AI tool that checks other AI tools. It's a tool testing tools that serve tools.*
-
-<sub>* I'm a dude playing a dude disguised as another dude.</sub>
+An AI tool that checks other AI tools. It is a tool testing tools that serve tools.
 
 ### Security
 

package/dist/src/adapters/http.js

@@ -18,8 +18,6 @@ export class HttpAdapter {
             throw new Error(`Unsupported protocol "${url.protocol}" — only http: and https: are allowed.`);
         }
         const timeoutMs = target.timeoutMs ?? 15_000;
-        // Try streamable-http first, fall back to SSE
-        let connected = false;
         let activeTransport;
         try {
             let transport = new StreamableHTTPClientTransport(url, { requestInit: { headers } });
@@ -27,19 +25,17 @@ export class HttpAdapter {
                 transport = new RecordingTransport(transport);
             await client.connect(transport, { timeout: timeoutMs });
             activeTransport = transport;
-            connected = true;
         }
         catch {
             stderrLines.push("Streamable HTTP failed, falling back to SSE.");
         }
-        if (!connected) {
+        if (!activeTransport) {
             try {
                 let transport = new SSEClientTransport(url, { requestInit: { headers } });
                 if (options?.record)
                     transport = new RecordingTransport(transport);
                 await client.connect(transport, { timeout: timeoutMs });
                 activeTransport = transport;
-                connected = true;
             }
             catch (error) {
                 const rawMessage = errorMessage(error);

package/dist/src/adapters/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,MAAM,OAAO,WAAW;IACtB,KAAK,CAAC,OAAO,CAAC,MAAwB,EAAE,OAA+B;QACrE,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,EAClD,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QAEF,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,QAAQ,wCAAwC,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;QAE7C,8CAA8C;QAC9C,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,eAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,SAAS,GAAc,IAAI,6BAA6B,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAChG,IAAI,OAAO,EAAE,MAAM;gBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;YACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,eAAe,GAAG,SAAS,CAAC;YAC5B,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,IAAI,SAAS,GAAc,IAAI,kBAAkB,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBACrF,IAAI,OAAO,EAAE,MAAM;oBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxD,eAAe,GAAG,SAAS,CAAC;gBAC5B,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;gBAC5E,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAEhD,OAAO;YACL,MAAM;YACN,kBAAkB,EAAE,MAAM,CAAC,qBAAqB,EAAE;YAClD,UAAU,EAAE,aAAa,EAAE,IAAI;YAC/B,aAAa,EAAE,aAAa,EAAE,OAAO;YACrC,WAAW;YACX,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACxD,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,MAAM,OAAO,WAAW;IACtB,KAAK,CAAC,OAAO,CAAC,MAAwB,EAAE,OAA+B;QACrE,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,EAClD,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QAEF,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,QAAQ,wCAAwC,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;QAE7C,IAAI,eAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,SAAS,GAAc,IAAI,6BAA6B,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAChG,IAAI,OAAO,EAAE,MAAM;gBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;YACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,eAAe,GAAG,SAAS,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,SAAS,GAAc,IAAI,kBAAkB,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBACrF,IAAI,OAAO,EAAE,MAAM;oBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxD,eAAe,GAAG,SAAS,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;gBAC5E,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAEhD,OAAO;YACL,MAAM;YACN,kBAAkB,EAAE,MAAM,CAAC,qBAAqB,EAAE;YAClD,UAAU,EAAE,aAAa,EAAE,IAAI;YAC/B,aAAa,EAAE,aAAa,EAAE,OAAO;YACrC,WAAW;YACX,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACxD,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/cassette.js

@@ -1,6 +1,7 @@
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { ensureDirectory } from "./storage.js";
+import { writeTextFileAtomic } from "./utils/files.js";
 import { slugify } from "./utils/ids.js";
 // ── I/O ──────────────────────────────────────────────────────────────────────
 export function defaultCassettesDirectory(cwd = process.cwd()) {
@@ -11,7 +12,7 @@ export async function saveCassette(cassette, outDir) {
     const timestamp = new Date().toISOString().replaceAll(":", "-");
     const fileName = `${timestamp}--${slugify(cassette.targetId)}.cassette.json`;
     const filePath = path.join(outDir, fileName);
-    await writeFile(filePath, JSON.stringify(cassette, null, 2) + "\n", "utf8");
+    await writeTextFileAtomic(filePath, JSON.stringify(cassette, null, 2) + "\n");
     return filePath;
 }
 export async function loadCassette(filePath) {

package/dist/src/cassette.js.map

@@ -1 +1 @@
-{"version":3,"file":"cassette.js","sourceRoot":"","sources":["../../src/cassette.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAqBzC,gFAAgF;AAEhF,MAAM,UAAU,yBAAyB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,MAAc;IAEd,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE1C,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAAgC,CAAC,SAAS,CAAC,KAAK,CAAC;QAClD,CAAC,KAAK,CAAC,OAAO,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,4CAA4C,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,IAAgB,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"cassette.js","sourceRoot":"","sources":["../../src/cassette.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAqBzC,gFAAgF;AAEhF,MAAM,UAAU,yBAAyB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,MAAc;IAEd,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE1C,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAAgC,CAAC,SAAS,CAAC,KAAK,CAAC;QAClD,CAAC,KAAK,CAAC,OAAO,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,4CAA4C,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,IAAgB,CAAC;AAC1B,CAAC"}

package/dist/src/checks/attack-sim.d.ts

@@ -0,0 +1,18 @@
+import type { CheckResult, RunArtifact } from "../types.js";
+import { type CheckContext, type ObservedCheck } from "./base.js";
+export type AttackClass = "tool-poisoning" | "exfiltration-canary" | "permission-boundary" | "contract-drift";
+export type AttackFindingSeverity = "high" | "medium" | "low";
+export interface AttackSimulationFinding {
+    ruleId: string;
+    attackClass: AttackClass;
+    severity: AttackFindingSeverity;
+    itemType: "target" | "tool" | "prompt" | "resource" | "schema" | "response";
+    itemName: string;
+    message: string;
+    evidence: Record<string, unknown>;
+    recommendation: string;
+}
+export interface AttackSimulationOptions {
+    baseline?: RunArtifact;
+}
+export declare function runAttackSimulationCheck(context: CheckContext, previousChecks: CheckResult[], options?: AttackSimulationOptions): Promise<ObservedCheck>;

package/dist/src/checks/attack-sim.js

@@ -0,0 +1,304 @@
+import { performance } from "node:perf_hooks";
+import { CREDENTIAL_PATTERNS } from "./security-rules.js";
+import { isCapabilityAdvertised, makeCheckResult } from "./base.js";
+const POISONING_PATTERNS = [
+    { id: "hidden-instruction", severity: "high", pattern: /\b(ignore|override|bypass)\b.{0,80}\b(previous|system|developer|user)\b.{0,80}\b(instruction|prompt|message|policy)s?\b/i, label: "hidden instruction override" },
+    { id: "secret-exfiltration-instruction", severity: "high", pattern: /\b(send|post|upload|exfiltrate|leak|copy)\b.{0,80}\b(secret|token|api[_ -]?key|credential|password|env|environment)\b/i, label: "secret exfiltration instruction" },
+    { id: "stealth-instruction", severity: "high", pattern: /\b(do not|don't)\b.{0,60}\b(tell|reveal|mention|disclose)\b.{0,80}\b(user|operator|developer|maintainer)\b/i, label: "stealth instruction" },
+    { id: "agent-behavior-control", severity: "medium", pattern: /\b(always|must|before answering|when called)\b.{0,80}\b(call|invoke|use|execute)\b.{0,80}\btool\b/i, label: "agent behavior control" },
+    { id: "remote-fetch-instruction", severity: "medium", pattern: /\b(fetch|download|curl|wget|open url|visit)\b.{0,80}\b(http:\/\/|https:\/\/)\S+/i, label: "remote fetch instruction" },
+];
+const CANARY_PATTERNS = [
+    { name: "MCP Observatory canary", pattern: /MCP_OBSERVATORY_CANARY_[A-Z0-9_-]+/i },
+    { name: "safe exfiltration canary", pattern: /OBSERVATORY_SAFE_CANARY_[A-Z0-9_-]+/i },
+    { name: "fake GitHub token canary", pattern: /ghp_OBSERVATORY_CANARY_[A-Za-z0-9_]+/ },
+];
+const BROAD_PARAM_NAMES = new Set([
+    "command", "cmd", "exec", "shell", "script", "code", "query", "url", "uri",
+    "endpoint", "host", "path", "file", "filepath", "filename", "directory",
+    "dir", "glob", "pattern", "headers", "body", "method",
+]);
+const DESTRUCTIVE_WORDS = /\b(write|delete|remove|overwrite|create|modify|update|execute|run|post|put|patch|mutate|send|upload)\b/i;
+function stringifyForScan(value) {
+    if (typeof value === "string")
+        return value;
+    if (value === undefined || value === null)
+        return "";
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return "";
+    }
+}
+function walkText(value, path = []) {
+    if (typeof value === "string") {
+        return [{ path: path.join(".") || "(root)", text: value }];
+    }
+    if (Array.isArray(value)) {
+        return value.flatMap((entry, index) => walkText(entry, [...path, String(index)]));
+    }
+    if (typeof value === "object" && value !== null) {
+        return Object.entries(value).flatMap(([key, entry]) => walkText(entry, [...path, key]));
+    }
+    return [];
+}
+function propertyNames(schema) {
+    if (typeof schema !== "object" || schema === null || Array.isArray(schema))
+        return [];
+    const props = schema["properties"];
+    if (typeof props !== "object" || props === null || Array.isArray(props))
+        return [];
+    return Object.keys(props);
+}
+function requiredFields(schema) {
+    if (typeof schema !== "object" || schema === null || Array.isArray(schema))
+        return [];
+    const required = schema["required"];
+    return Array.isArray(required) ? required.filter((entry) => typeof entry === "string") : [];
+}
+function additionalProperties(schema) {
+    if (typeof schema !== "object" || schema === null || Array.isArray(schema))
+        return undefined;
+    return schema["additionalProperties"];
+}
+function isDestructiveTool(tool) {
+    const annotations = tool.annotations;
+    return annotations?.["destructiveHint"] === true ||
+        annotations?.["readOnlyHint"] === false ||
+        DESTRUCTIVE_WORDS.test(tool.name) ||
+        DESTRUCTIVE_WORDS.test(tool.description ?? "");
+}
+function addPoisoningFindings(findings, itemType, itemName, value) {
+    const texts = walkText(value);
+    for (const { path, text } of texts) {
+        for (const pattern of POISONING_PATTERNS) {
+            const match = text.match(pattern.pattern);
+            if (!match)
+                continue;
+            findings.push({
+                ruleId: `attack-sim/tool-poisoning/${pattern.id}`,
+                attackClass: "tool-poisoning",
+                severity: pattern.severity,
+                itemType,
+                itemName,
+                message: `${itemType} "${itemName}" contains ${pattern.label} text that could steer an agent.`,
+                evidence: { path, excerpt: text.slice(0, 240), match: match[0] },
+                recommendation: "Remove hidden or behavioral instructions from MCP metadata; keep descriptions factual and user-visible.",
+            });
+        }
+    }
+}
+function addPermissionBoundaryFindings(findings, tool) {
+    const params = propertyNames(tool.inputSchema);
+    const broadParams = params.filter((name) => BROAD_PARAM_NAMES.has(name.toLowerCase()));
+    if (broadParams.length === 0 || !isDestructiveTool(tool))
+        return;
+    findings.push({
+        ruleId: "attack-sim/permission-boundary/broad-destructive-tool",
+        attackClass: "permission-boundary",
+        severity: broadParams.some((name) => ["command", "cmd", "exec", "shell", "script", "code"].includes(name.toLowerCase())) ? "high" : "medium",
+        itemType: "tool",
+        itemName: tool.name,
+        message: `Tool "${tool.name}" combines broad parameters (${broadParams.join(", ")}) with destructive or non-read-only behavior.`,
+        evidence: { broadParams, annotations: tool.annotations, description: tool.description },
+        recommendation: "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+    });
+}
+function addCanaryFindings(findings, source, value) {
+    const text = stringifyForScan(value);
+    if (!text)
+        return;
+    for (const canary of CANARY_PATTERNS) {
+        const match = text.match(canary.pattern);
+        if (match) {
+            findings.push({
+                ruleId: "attack-sim/exfiltration-canary/canary-exposed",
+                attackClass: "exfiltration-canary",
+                severity: "high",
+                itemType: "response",
+                itemName: source,
+                message: `${canary.name} appeared in captured MCP evidence for "${source}".`,
+                evidence: { source, match: match[0] },
+                recommendation: "Redact canary-like or secret-like values from tool responses before exposing them to agents or logs.",
+            });
+        }
+    }
+    for (const credential of CREDENTIAL_PATTERNS) {
+        const match = text.match(credential.pattern);
+        if (match) {
+            findings.push({
+                ruleId: "attack-sim/exfiltration-canary/credential-like-output",
+                attackClass: "exfiltration-canary",
+                severity: "high",
+                itemType: "response",
+                itemName: source,
+                message: `Captured MCP evidence for "${source}" contains credential-like text (${credential.name}).`,
+                evidence: { source, credentialPattern: credential.name },
+                recommendation: "Redact credentials from MCP responses and move secrets into environment or secret storage.",
+            });
+        }
+    }
+}
+function toolSchemasFromArtifact(artifact) {
+    const toolsCheck = artifact?.checks.find((check) => check.id === "tools");
+    const schemas = toolsCheck?.evidence.flatMap((entry) => entry.schemas ? [entry.schemas] : []) ?? [];
+    return Object.assign({}, ...schemas);
+}
+function toolNamesFromArtifact(artifact) {
+    const toolsCheck = artifact?.checks.find((check) => check.id === "tools");
+    return new Set(toolsCheck?.evidence.flatMap((entry) => entry.identifiers ?? []) ?? []);
+}
+function addDriftFindings(findings, tools, baseline) {
+    if (!baseline)
+        return;
+    const baselineNames = toolNamesFromArtifact(baseline);
+    const baselineSchemas = toolSchemasFromArtifact(baseline);
+    for (const tool of tools) {
+        const currentSchema = tool.inputSchema;
+        const baselineSchema = baselineSchemas[tool.name];
+        if (!baselineNames.has(tool.name) && isDestructiveTool(tool)) {
+            findings.push({
+                ruleId: "attack-sim/contract-drift/new-destructive-tool",
+                attackClass: "contract-drift",
+                severity: "high",
+                itemType: "tool",
+                itemName: tool.name,
+                message: `New destructive-looking tool "${tool.name}" appeared after the baseline.`,
+                evidence: { toolName: tool.name, description: tool.description, annotations: tool.annotations },
+                recommendation: "Review and approve new destructive tool surfaces before agents can depend on this server update.",
+            });
+        }
+        if (!baselineSchema || !currentSchema)
+            continue;
+        const oldRequired = new Set(requiredFields(baselineSchema));
+        const newRequired = new Set(requiredFields(currentSchema));
+        const removedRequired = [...oldRequired].filter((field) => !newRequired.has(field));
+        if (removedRequired.length > 0) {
+            findings.push({
+                ruleId: "attack-sim/contract-drift/required-fields-removed",
+                attackClass: "contract-drift",
+                severity: "medium",
+                itemType: "schema",
+                itemName: tool.name,
+                message: `Tool "${tool.name}" removed required fields from its schema: ${removedRequired.join(", ")}.`,
+                evidence: { removedRequired },
+                recommendation: "Treat required-field removals as agent contract drift and require maintainer review.",
+            });
+        }
+        const oldAdditional = additionalProperties(baselineSchema);
+        const newAdditional = additionalProperties(currentSchema);
+        if (oldAdditional === false && newAdditional !== false) {
+            findings.push({
+                ruleId: "attack-sim/contract-drift/schema-broadened",
+                attackClass: "contract-drift",
+                severity: "medium",
+                itemType: "schema",
+                itemName: tool.name,
+                message: `Tool "${tool.name}" broadened its schema by allowing additional properties.`,
+                evidence: { previousAdditionalProperties: oldAdditional, currentAdditionalProperties: newAdditional },
+                recommendation: "Keep agent-facing schemas strict or document why additional properties are safe.",
+            });
+        }
+    }
+}
+function scanPreviousSnapshots(findings, previousChecks) {
+    for (const check of previousChecks) {
+        for (const evidence of check.evidence) {
+            if (evidence.responseSnapshots) {
+                for (const [name, snapshot] of Object.entries(evidence.responseSnapshots)) {
+                    addCanaryFindings(findings, `${check.id}:${name}`, snapshot);
+                }
+            }
+            addCanaryFindings(findings, check.id, evidence.findings);
+        }
+    }
+}
+async function listSurfaces(context) {
+    const surfaces = { tools: [], prompts: [], resources: [], resourceTemplates: [] };
+    if (isCapabilityAdvertised(context.serverCapabilities, "tools")) {
+        try {
+            surfaces.tools = (await context.client.listTools(undefined, { timeout: context.timeoutMs })).tools;
+        }
+        catch {
+            // Existing capability checks already report list failures.
+        }
+    }
+    if (isCapabilityAdvertised(context.serverCapabilities, "prompts")) {
+        try {
+            surfaces.prompts = (await context.client.listPrompts(undefined, { timeout: context.timeoutMs })).prompts;
+        }
+        catch {
+            // Existing capability checks already report list failures.
+        }
+    }
+    if (isCapabilityAdvertised(context.serverCapabilities, "resources")) {
+        try {
+            surfaces.resources = (await context.client.listResources(undefined, { timeout: context.timeoutMs })).resources;
+        }
+        catch {
+            // Existing capability checks already report list failures.
+        }
+        try {
+            surfaces.resourceTemplates = (await context.client.listResourceTemplates(undefined, { timeout: context.timeoutMs })).resourceTemplates;
+        }
+        catch {
+            // Existing capability checks already report list failures.
+        }
+    }
+    return surfaces;
+}
+function statusForFindings(findings) {
+    if (findings.some((finding) => finding.severity === "high"))
+        return "fail";
+    if (findings.some((finding) => finding.severity === "medium"))
+        return "partial";
+    return "pass";
+}
+export async function runAttackSimulationCheck(context, previousChecks, options = {}) {
+    const startedAt = performance.now();
+    const surfaces = await listSurfaces(context);
+    const findings = [];
+    for (const tool of surfaces.tools) {
+        addPoisoningFindings(findings, "tool", tool.name, {
+            name: tool.name,
+            description: tool.description,
+            inputSchema: tool.inputSchema,
+            annotations: tool.annotations,
+        });
+        addPermissionBoundaryFindings(findings, tool);
+    }
+    for (const prompt of surfaces.prompts) {
+        addPoisoningFindings(findings, "prompt", prompt.name, prompt);
+    }
+    for (const resource of surfaces.resources) {
+        addPoisoningFindings(findings, "resource", resource.uri, resource);
+    }
+    for (const template of surfaces.resourceTemplates) {
+        addPoisoningFindings(findings, "resource", template.uriTemplate, template);
+    }
+    scanPreviousSnapshots(findings, previousChecks);
+    addDriftFindings(findings, surfaces.tools, options.baseline);
+    const status = statusForFindings(findings);
+    const high = findings.filter((finding) => finding.severity === "high").length;
+    const medium = findings.filter((finding) => finding.severity === "medium").length;
+    const low = findings.filter((finding) => finding.severity === "low").length;
+    const message = findings.length === 0
+        ? "Safe attack simulation found no high-risk MCP attack-readiness findings."
+        : `Safe attack simulation found ${findings.length} finding(s): ${high} high, ${medium} medium, ${low} low.`;
+    const diagnostics = findings.map((finding) => `[${finding.severity}] ${finding.message}`);
+    const evidence = {
+        endpoint: options.baseline ? "attack-sim/safe+baseline" : "attack-sim/safe",
+        advertised: true,
+        responded: true,
+        minimalShapePresent: true,
+        itemCount: findings.length,
+        identifiers: [...new Set(findings.map((finding) => finding.itemName))],
+        diagnostics: diagnostics.length > 0 ? diagnostics : undefined,
+        findings: findings.length > 0 ? findings.map((finding) => ({ ...finding })) : undefined,
+    };
+    return {
+        result: makeCheckResult("attack-sim", status, performance.now() - startedAt, message, [evidence]),
+    };
+}
+//# sourceMappingURL=attack-sim.js.map

package/dist/src/checks/attack-sim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attack-sim.js","sourceRoot":"","sources":["../../../src/checks/attack-sim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAK9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAyC,MAAM,WAAW,CAAC;AAgC3G,MAAM,kBAAkB,GAA2F;IACjH,EAAE,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,0HAA0H,EAAE,KAAK,EAAE,6BAA6B,EAAE;IACzN,EAAE,EAAE,EAAE,iCAAiC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,wHAAwH,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACxO,EAAE,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,6GAA6G,EAAE,KAAK,EAAE,qBAAqB,EAAE;IACrM,EAAE,EAAE,EAAE,wBAAwB,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,oGAAoG,EAAE,KAAK,EAAE,wBAAwB,EAAE;IACpM,EAAE,EAAE,EAAE,0BAA0B,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,kFAAkF,EAAE,KAAK,EAAE,0BAA0B,EAAE;CACvL,CAAC;AAEF,MAAM,eAAe,GAA6C;IAChE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAClF,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,sCAAsC,EAAE;IACrF,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,sCAAsC,EAAE;CACtF,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK;IAC1E,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW;IACvE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ;CACtD,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,yGAAyG,CAAC;AAEpI,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,OAAiB,EAAE;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,MAAe;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtF,MAAM,KAAK,GAAI,MAAkC,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,cAAc,CAAC,MAAe;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtF,MAAM,QAAQ,GAAI,MAAkC,CAAC,UAAU,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAe;IAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,OAAQ,MAAkC,CAAC,sBAAsB,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAU;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,OAAO,WAAW,EAAE,CAAC,iBAAiB,CAAC,KAAK,IAAI;QAC9C,WAAW,EAAE,CAAC,cAAc,CAAC,KAAK,KAAK;QACvC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACjC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAmC,EACnC,QAA6C,EAC7C,QAAgB,EAChB,KAAc;IAEd,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,6BAA6B,OAAO,CAAC,EAAE,EAAE;gBACjD,WAAW,EAAE,gBAAgB;gBAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ;gBACR,QAAQ;gBACR,OAAO,EAAE,GAAG,QAAQ,KAAK,QAAQ,cAAc,OAAO,CAAC,KAAK,kCAAkC;gBAC9F,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChE,cAAc,EAAE,yGAAyG;aAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAmC,EAAE,IAAU;IACpF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACvF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO;IACjE,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,uDAAuD;QAC/D,WAAW,EAAE,qBAAqB;QAClC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC5I,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,gCAAgC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,+CAA+C;QAChI,QAAQ,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;QACvF,cAAc,EAAE,2HAA2H;KAC5I,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAmC,EAAE,MAAc,EAAE,KAAc;IAC5F,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,+CAA+C;gBACvD,WAAW,EAAE,qBAAqB;gBAClC,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,2CAA2C,MAAM,IAAI;gBAC5E,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;gBACrC,cAAc,EAAE,sGAAsG;aACvH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,mBAAmB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,uDAAuD;gBAC/D,WAAW,EAAE,qBAAqB;gBAClC,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,8BAA8B,MAAM,oCAAoC,UAAU,CAAC,IAAI,IAAI;gBACpG,QAAQ,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,CAAC,IAAI,EAAE;gBACxD,cAAc,EAAE,4FAA4F;aAC7G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAiC;IAChE,MAAM,UAAU,GAAG,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,OAAO,CAA2B,CAAC;AACjE,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAiC;IAC9D,MAAM,UAAU,GAAG,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;IAC1E,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAmC,EAAE,KAAa,EAAE,QAAsB;IAClG,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC;QACvC,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,gDAAgD;gBACxD,WAAW,EAAE,gBAAgB;gBAC7B,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,OAAO,EAAE,iCAAiC,IAAI,CAAC,IAAI,gCAAgC;gBACnF,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;gBAC/F,cAAc,EAAE,kGAAkG;aACnH,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;YAAE,SAAS;QAChD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3D,MAAM,eAAe,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mDAAmD;gBAC3D,WAAW,EAAE,gBAAgB;gBAC7B,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,8CAA8C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACtG,QAAQ,EAAE,EAAE,eAAe,EAAE;gBAC7B,cAAc,EAAE,sFAAsF;aACvG,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,4CAA4C;gBACpD,WAAW,EAAE,gBAAgB;gBAC7B,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,2DAA2D;gBACtF,QAAQ,EAAE,EAAE,4BAA4B,EAAE,aAAa,EAAE,2BAA2B,EAAE,aAAa,EAAE;gBACrG,cAAc,EAAE,kFAAkF;aACnG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAmC,EAAE,cAA6B;IAC/F,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC1E,iBAAiB,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAqB;IAC/C,MAAM,QAAQ,GAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;IAClG,IAAI,sBAAsB,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,QAAQ,CAAC,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,sBAAsB,CAAC,OAAO,CAAC,kBAAkB,EAAE,SAAS,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC;YACH,QAAQ,CAAC,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3G,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,sBAAsB,CAAC,OAAO,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC;YACH,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACjH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,QAAQ,CAAC,iBAAiB,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACzI,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAmC;IAC5D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3E,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAChF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAqB,EACrB,cAA6B,EAC7B,UAAmC,EAAE;IAErC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAClD,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,qBAAqB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAChD,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAClF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnC,CAAC,CAAC,0EAA0E;QAC5E,CAAC,CAAC,gCAAgC,QAAQ,CAAC,MAAM,gBAAgB,IAAI,UAAU,MAAM,YAAY,GAAG,OAAO,CAAC;IAE9G,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAoB;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,iBAAiB;QAC3E,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,mBAAmB,EAAE,IAAI;QACzB,SAAS,EAAE,QAAQ,CAAC,MAAM;QAC1B,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,WAAW,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC7D,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KACxF,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,eAAe,CACrB,YAAY,EACZ,MAAM,EACN,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,EAC7B,OAAO,EACP,CAAC,QAAQ,CAAC,CACX;KACF,CAAC;AACJ,CAAC"}