@kryptosai/mcp-observatory 1.28.2 → 1.28.3

package/docs/safety-index/mcp-risk-graph.md

@@ -0,0 +1,47 @@
+# MCP Risk Graph
+
+MCP Observatory maps the risk graph of agent toolchains before agents depend on them.
+
+This graph is evidence-based and safe-mode only. It links MCP servers to receipts, attack-sim output, capability boundaries, recommended actions, and CI/SARIF next steps.
+
+## Summary
+
+- Servers: 15
+- Capability boundaries: 5
+- Highest risk: high
+- Generated at: 2026-07-06T22:47:17.078Z
+
+## Servers
+
+| Server | Boundary | Risk | Action | Receipt | CI command | Evidence |
+| --- | --- | --- | --- | --- | --- | --- |
+| @cyanheads/git-mcp-server | filesystem | medium | gate | not_generated | mcp-observatory setup-ci --all --command "npx -y @cyanheads/git-mcp-server" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/cyanheads-git-mcp-server.json<br>attack-sim:docs/safety-index/artifacts/cyanheads-git-mcp-server.json |
+| Browser MCP | browser | low | allow | not_generated | mcp-observatory setup-ci --all --command "npx -y @browsermcp/mcp" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/browsermcp-server.json<br>attack-sim:docs/safety-index/artifacts/browsermcp-server.json |
+| Context7 | unknown | medium | gate | not_generated | mcp-observatory setup-ci --all --command "npx -y @upstash/context7-mcp" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/context7-server.json<br>attack-sim:docs/safety-index/artifacts/context7-server.json |
+| example-servers/puppeteer | browser | high | quarantine | not_generated | mcp-observatory setup-ci --all --command "npx -y puppeteer-mcp-server" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/puppeteer-server.json<br>attack-sim:docs/safety-index/artifacts/puppeteer-server.json |
+| kubernetes | infra-cloud | high | quarantine | not_generated | mcp-observatory setup-ci --all --command "npx -y mcp-server-kubernetes" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/kubernetes-server.attack.json<br>attack-sim:docs/safety-index/artifacts/kubernetes-server.attack.json<br>run-artifact:docs/safety-index/artifacts/kubernetes-server.json<br>attack-sim:docs/safety-index/artifacts/kubernetes-server.json |
+| mcp-server-chart | unknown | low | allow | not_generated | mcp-observatory setup-ci --all --command "npx -y @antv/mcp-server-chart" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/antv-chart-server.json<br>attack-sim:docs/safety-index/artifacts/antv-chart-server.json |
+| mcp-servers/everything | filesystem | low | allow | not_generated | mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-everything" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/everything-server.json<br>attack-sim:docs/safety-index/artifacts/everything-server.json |
+| memory-server | memory | low | allow | not_generated | mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-memory" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/memory-server.json<br>attack-sim:docs/safety-index/artifacts/memory-server.json |
+| opentofu | infra-cloud | medium | gate | not_generated | mcp-observatory setup-ci --all --command "npx -y @opentofu/opentofu-mcp-server" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/opentofu-server.json<br>attack-sim:docs/safety-index/artifacts/opentofu-server.json |
+| Playwright | browser | high | quarantine | not_generated | mcp-observatory setup-ci --all --command "npx -y @playwright/mcp" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/playwright-mcp-server.json<br>attack-sim:docs/safety-index/artifacts/playwright-mcp-server.json |
+| playwright-mcp | browser | high | quarantine | not_generated | mcp-observatory setup-ci --all --command "npx -y @executeautomation/playwright-mcp-server" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/executeautomation-playwright-server.json<br>attack-sim:docs/safety-index/artifacts/executeautomation-playwright-server.json |
+| promptopia-mcp | filesystem | low | allow | not_generated | mcp-observatory setup-ci --all --command "npx -y promptopia-mcp" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/promptopia-server.json<br>attack-sim:docs/safety-index/artifacts/promptopia-server.json |
+| Ref | unknown | low | allow | not_generated | mcp-observatory setup-ci --all --command "npx -y ref-tools-mcp" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/ref-tools-server.json<br>attack-sim:docs/safety-index/artifacts/ref-tools-server.json |
+| secure-filesystem-server | filesystem | medium | gate | not_generated | mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-filesystem examples/filesystem-fixture" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/filesystem-server.json<br>attack-sim:docs/safety-index/artifacts/filesystem-server.json |
+| sequential-thinking-server | unknown | low | allow | not_generated | mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-sequential-thinking" --sarif --schedule weekly | run-artifact:docs/safety-index/artifacts/sequential-thinking-server.json<br>attack-sim:docs/safety-index/artifacts/sequential-thinking-server.json |
+
+## Recommended Actions
+
+- @cyanheads/git-mcp-server: Gate adoption until maintainers review the finding.
+- Context7: Gate adoption until maintainers review the finding.
+- opentofu: Gate adoption until maintainers review the finding.
+- secure-filesystem-server: Gate adoption until maintainers review the finding.
+- example-servers/puppeteer: Quarantine from production agents until the boundary is reduced or accepted.
+- kubernetes: Quarantine from production agents until the boundary is reduced or accepted.
+- Playwright: Quarantine from production agents until the boundary is reduced or accepted.
+- playwright-mcp: Quarantine from production agents until the boundary is reduced or accepted.
+
+## Maintainer Note Template
+
+We generated a safe MCP Observatory receipt for your MCP server. It includes the exact evidence artifact, recommended action, and CI/SARIF command. If this startup command is not the safest public mode, reply with the preferred no-secret command and we will update the receipt.

package/docs/safety-index/targets.json

@@ -69,6 +69,29 @@
     "whyItMatters": "Filesystem tools need harmless test roots and clear read/write boundaries.",
     "reproductionNotes": "Runs against the checked-in harmless fixture directory."
   },
+  {
+    "id": "filesystem-mcp-server",
+    "name": "Filesystem MCP server",
+    "repo": "https://github.com/modelcontextprotocol/servers",
+    "packageName": "@modelcontextprotocol/server-filesystem",
+    "category": "Filesystem",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@modelcontextprotocol/server-filesystem",
+      "<safe-empty-temp-dir>"
+    ],
+    "tempDirArg": {
+      "index": 2,
+      "prefix": "mcp-observatory-filesystem-safety-index",
+      "placeholder": "<safe-empty-temp-dir>"
+    },
+    "timeoutMs": 30000,
+    "riskClass": "Filesystem boundary",
+    "failureClass": "Temporary directory filesystem access",
+    "whyItMatters": "Filesystem MCP is a core agent trust boundary because it exposes read, write, edit, delete, and directory traversal tools.",
+    "reproductionNotes": "Safety Index generation creates an empty temporary directory for the server root and sanitizes that path from public artifacts."
+  },
   {
     "id": "context7-server",
     "name": "Context7",
@@ -140,6 +163,23 @@
     "whyItMatters": "Coding agents often need Git context and can cause real repository changes if tool boundaries are unclear.",
     "reproductionNotes": "Zero-config public package. Keep tool invocation read-only unless a harmless fixture repository is added."
   },
+  {
+    "id": "github-mcp-server",
+    "name": "Official GitHub MCP server",
+    "repo": "https://github.com/modelcontextprotocol/servers",
+    "packageName": "@modelcontextprotocol/server-github",
+    "category": "Developer Tools",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@modelcontextprotocol/server-github"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Repository mutation and PR control",
+    "failureClass": "Write/merge tool boundary",
+    "whyItMatters": "Exposes 26 tools to agents, including file writes, branch creation, issue/PR creation, and PR merges across any repo a token can reach — high-stakes write access that needs a visible boundary before an agent is trusted with it.",
+    "reproductionNotes": "Zero-config package; tool listing succeeds without a real GitHub token, so this check is safe to run in CI. Note: npm currently flags this package as deprecated/no longer supported by the publisher — treat this target as compatibility evidence, not an endorsement of the package's maintenance status."
+  },
   {
     "id": "opentofu-server",
     "name": "OpenTofu MCP server",
@@ -264,5 +304,22 @@
     "failureClass": "Command and cluster mutation boundary",
     "whyItMatters": "Kubernetes MCP servers can expose cluster mutation, pod exec, manifest apply/delete, and broad kubectl command surfaces to agents.",
     "reproductionNotes": "Zero-config public package. Evaluated without cluster credentials; findings are metadata and schema boundary prompts, not exploit claims."
+  },
+  {
+    "id": "chrome-devtools-mcp-server",
+    "name": "Chrome DevTools MCP",
+    "repo": "https://github.com/ChromeDevTools/chrome-devtools-mcp",
+    "packageName": "chrome-devtools-mcp",
+    "category": "Browser Automation",
+    "command": "npx",
+    "args": [
+      "-y",
+      "chrome-devtools-mcp"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Browser control",
+    "failureClass": "Browser/code execution boundary",
+    "whyItMatters": "Coding agents may use Chrome DevTools MCP to inspect pages, network state, console output, and browser behavior before making changes.",
+    "reproductionNotes": "Zero-config public package; browser-control findings should be treated as policy-review prompts, not vulnerability claims."
   }
 ]

package/docs/sample-private-fleet-risk-graph.md

@@ -0,0 +1,90 @@
+# Sample Private Fleet Risk Graph
+
+This is a sanitized example deliverable for a private MCP fleet risk graph pilot. It shows the shape of the buyer artifact without exposing customer telemetry, hostnames, emails, internal repo names, raw command output, secrets, or proprietary scoring weights.
+
+## Executive Verdict
+
+The reviewed fleet is usable with controls, but not yet ready for unrestricted production agent access.
+
+Recommended decision: `gate`
+
+Why:
+
+- browser and command-execution MCP servers create high-impact permission boundaries
+- CI/SARIF coverage is incomplete
+- several dependencies lack portable receipts or maintainer-owned safe startup commands
+- no destructive probes were run; evidence is safe-mode only
+
+## Fleet Graph Summary
+
+| Boundary | Dependencies | Highest risk | Recommended action |
+| --- | ---: | --- | --- |
+| Browser | 4 | high | `gate` |
+| Command execution | 3 | high | `gate` |
+| Infrastructure/cloud | 2 | high | `gate` |
+| Memory | 2 | medium | `gate` |
+| Data/API | 7 | medium | `gate` |
+| Filesystem | 3 | medium | `gate` |
+| Identity/auth | 1 | medium | `gate` |
+
+## Top Risky MCP Dependencies
+
+| Dependency | Boundary | Evidence | Risk | Owner action |
+| --- | --- | --- | --- | --- |
+| Browser automation server | Browser | Receipt + attack-sim + SARIF | high | Add CI/SARIF and restrict production profile. |
+| Shell helper server | Command execution | Receipt + schema drift finding | high | Require explicit allowlist and owner review. |
+| Cloud deployment server | Infrastructure/cloud | Receipt only | high | Add attack-sim evidence and fixture startup mode. |
+| Memory server | Memory | Receipt + drift comparison | medium | Add weekly lock verification. |
+| Internal docs server | Data/API | Partial receipt | medium | Provide safe startup command and rerun receipt. |
+
+## CI Adoption Status
+
+| State | Count | Meaning |
+| --- | ---: | --- |
+| CI/SARIF active | 5 | Findings upload to GitHub Code Scanning or equivalent. |
+| CI present, no SARIF | 4 | Compatibility checks run, but security findings are not visible in code scanning. |
+| Receipt only | 6 | Evidence exists but is not yet enforced. |
+| No receipt | 7 | Dependency needs safe startup discovery before approval. |
+
+Recommended default:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif --schedule weekly
+```
+
+## Owner-Ready Remediation List
+
+1. Add CI/SARIF for high-capability browser, command, and infrastructure MCP servers.
+2. Require safe startup commands for every production MCP dependency.
+3. Generate receipts for all servers in the private fleet graph.
+4. Run safe `attack-sim` for high and medium dependencies.
+5. Add weekly drift checks for schemas, tool descriptions, and required fields.
+6. Route `gate`, `quarantine`, and `escalate` receipts to owner review before agent rollout.
+
+## Procurement/Security Appendix
+
+Safe-mode guarantee:
+
+- no destructive tool calls
+- no credential probing
+- no external callback infrastructure
+- no production data exfiltration
+- no mutation of customer repos without explicit approval
+
+Evidence package:
+
+- JSON risk graph
+- Markdown and HTML executive graph
+- run artifacts
+- receipt artifacts
+- SARIF outputs where applicable
+- reproduction commands
+- CI/SARIF setup commands
+- limitations and owner notes
+
+Commercial boundary:
+
+- raw telemetry, customer identifiers, internal repo names, hostnames, and private command outputs stay private
+- public artifacts are sanitized and published only with approval
+- commercial scoring weights and lead/account intelligence are not included in the OSS repo
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryptosai/mcp-observatory",
-  "version": "1.28.2",
+  "version": "1.28.3",
   "description": "GitHub-native CI, SARIF, Code Scanning, and security gates for MCP servers before agents depend on them.",
   "mcpName": "io.github.KryptosAI/mcp-observatory",
   "license": "MIT",
@@ -9,7 +9,7 @@
   "homepage": "https://github.com/KryptosAI/mcp-observatory#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/KryptosAI/mcp-observatory.git"
+    "url": "https://github.com/KryptosAI/mcp-observatory.git"
   },
   "bugs": {
     "url": "https://github.com/KryptosAI/mcp-observatory/issues"
@@ -23,7 +23,11 @@
   "main": "./dist/src/index.js",
   "types": "./dist/src/index.d.ts",
   "exports": {
-    ".": "./dist/src/index.js"
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    },
+    "./package.json": "./package.json"
   },
   "bin": {
     "mcp-observatory": "./dist/src/cli.js"
@@ -72,9 +76,11 @@
     "docs/openclaw-agent-template",
     "docs/proof.md",
     "docs/procurement-one-pager.md",
+    "docs/private-mcp-fleet-risk-graph.md",
     "docs/public-guidance-crosswalk.md",
     "docs/receipt-graph.md",
     "docs/reference-evaluations.md",
+    "docs/sample-private-fleet-risk-graph.md",
     "docs/safety-index",
     "docs/setup-ci-doctor.md",
     "docs/security-due-diligence.md",
@@ -148,7 +154,11 @@
     "feishu",
     "lark",
     "schema-drift",
-    "attack-simulation"
+    "attack-simulation",
+    "mcp-observability",
+    "security-scanner",
+    "mcp-server-testing",
+    "tool-call-audit"
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -159,16 +169,16 @@
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",
-    "@types/node": "26.0.1",
-    "@typescript-eslint/eslint-plugin": "8.62.1",
-    "@typescript-eslint/parser": "8.62.1",
+    "@types/node": "26.1.0",
+    "@typescript-eslint/eslint-plugin": "8.63.0",
+    "@typescript-eslint/parser": "8.63.0",
     "ajv": "8.20.0",
     "eslint": "10.6.0",
     "globals": "17.7.0",
-    "tsx": "4.22.4",
-    "@vitest/coverage-v8": "4.1.9",
+    "tsx": "4.23.0",
+    "@vitest/coverage-v8": "4.1.10",
     "typescript": "6.0.3",
-    "typescript-eslint": "8.62.1",
-    "vitest": "4.1.9"
+    "typescript-eslint": "8.63.0",
+    "vitest": "4.1.10"
   }
 }