@kryptosai/mcp-observatory 1.29.1 → 1.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (44) hide show
  1. package/README.md +65 -6
  2. package/README.zh-CN.md +71 -8
  3. package/dist/src/checks/runtime-profile.d.ts +5 -0
  4. package/dist/src/checks/runtime-profile.js +214 -0
  5. package/dist/src/checks/runtime-profile.js.map +1 -0
  6. package/dist/src/checks/security-rules.js +18 -0
  7. package/dist/src/checks/security-rules.js.map +1 -1
  8. package/dist/src/checks/skill-scan.d.ts +46 -0
  9. package/dist/src/checks/skill-scan.js +665 -0
  10. package/dist/src/checks/skill-scan.js.map +1 -0
  11. package/dist/src/cli.js +6 -1
  12. package/dist/src/cli.js.map +1 -1
  13. package/dist/src/commands/enforce.d.ts +12 -0
  14. package/dist/src/commands/enforce.js +187 -0
  15. package/dist/src/commands/enforce.js.map +1 -0
  16. package/dist/src/commands/scan.js +36 -9
  17. package/dist/src/commands/scan.js.map +1 -1
  18. package/dist/src/commands/skill-scan.d.ts +6 -0
  19. package/dist/src/commands/skill-scan.js +62 -0
  20. package/dist/src/commands/skill-scan.js.map +1 -0
  21. package/dist/src/commands/test.js +13 -0
  22. package/dist/src/commands/test.js.map +1 -1
  23. package/dist/src/discovery.d.ts +15 -1
  24. package/dist/src/discovery.js +219 -9
  25. package/dist/src/discovery.js.map +1 -1
  26. package/dist/src/index.d.ts +3 -1
  27. package/dist/src/index.js +3 -1
  28. package/dist/src/index.js.map +1 -1
  29. package/dist/src/receipt.d.ts +4 -1
  30. package/dist/src/receipt.js +85 -0
  31. package/dist/src/receipt.js.map +1 -1
  32. package/dist/src/reporters/markdown.js +39 -0
  33. package/dist/src/reporters/markdown.js.map +1 -1
  34. package/dist/src/reporters/terminal.d.ts +2 -0
  35. package/dist/src/reporters/terminal.js +53 -1
  36. package/dist/src/reporters/terminal.js.map +1 -1
  37. package/dist/src/runner.js +6 -0
  38. package/dist/src/runner.js.map +1 -1
  39. package/dist/src/types.d.ts +26 -1
  40. package/docs/mcp-server-safety-index.md +13 -11
  41. package/docs/safety-index/artifacts/github-mcp-server.json +1707 -0
  42. package/docs/safety-index/artifacts/github-mcp-server.md +169 -0
  43. package/docs/safety-index/targets.json +17 -0
  44. package/package.json +2 -2
package/README.md CHANGED
@@ -14,14 +14,18 @@
14
14
 
15
15
  [![CI](https://github.com/KryptosAI/mcp-observatory/actions/workflows/ci.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/ci.yml)
16
16
  [![CodeQL](https://github.com/KryptosAI/mcp-observatory/actions/workflows/codeql.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/codeql.yml)
17
- [![Coverage](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml)
17
+ [![Coverage Workflow](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml)
18
+ [![npm](https://img.shields.io/npm/v/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
19
+ [![GitHub stars](https://img.shields.io/github/stars/KryptosAI/mcp-observatory?style=flat)](https://github.com/KryptosAI/mcp-observatory/stargazers)
20
+ [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](./LICENSE)
21
+
22
+ <details>
23
+ <summary>More badges</summary>
24
+
18
25
  [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/KryptosAI/mcp-observatory/badge)](https://securityscorecards.dev/viewer/?uri=github.com/KryptosAI/mcp-observatory)
19
26
  [![Dependabot](https://img.shields.io/badge/dependabot-enabled-025e8c?logo=dependabot)](./.github/dependabot.yml)
20
27
  [![npm provenance workflow](https://img.shields.io/badge/npm%20provenance-workflow-blue)](./.github/workflows/release.yml)
21
- [![npm](https://img.shields.io/npm/v/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
22
28
  [![npm weekly downloads](https://img.shields.io/npm/dw/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
23
- [![GitHub stars](https://img.shields.io/github/stars/KryptosAI/mcp-observatory?style=flat)](https://github.com/KryptosAI/mcp-observatory/stargazers)
24
- [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](./LICENSE)
25
29
  [![Node >= 20](https://img.shields.io/badge/node-%3E%3D20-339933)](./package.json)
26
30
  [![Smithery](https://smithery.ai/badge/@kryptosai/mcp-observatory)](https://smithery.ai/server/@kryptosai/mcp-observatory)
27
31
  [![mcp-observatory MCP server](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory/badges/score.svg)](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory)
@@ -34,6 +38,8 @@
34
38
  [![OpenTools](https://img.shields.io/badge/OpenTools-listed-green)](https://opentools.ai)
35
39
  [![Gitee](https://img.shields.io/badge/Gitee-镜像-orange)](https://gitee.com/williamweishuhn/mcp-observatory)
36
40
 
41
+ </details>
42
+
37
43
  **MCP Observatory maps the risk graph of agent toolchains before agents depend on them.** It helps teams validate MCP servers before deployment into sensitive, regulated, or mission-critical agentic AI environments.
38
44
 
39
45
  <p align="center">
@@ -209,6 +215,20 @@ The open source repo is the public evidence engine. Private telemetry intelligen
209
215
 
210
216
  Run `npx @kryptosai/mcp-observatory cloud`, open a pilot request from the issue chooser, or see [COMMERCIAL.md](./COMMERCIAL.md). Also see [privacy and telemetry](./PRIVACY.md), [campaign attribution](./docs/campaign-attribution.md), and [terms for production use](./TERMS.md).
211
217
 
218
+ ## How It Compares
219
+
220
+ | Feature | mcp-observatory | Snyk agent-scan | Cisco mcp-scanner | agent-shield |
221
+ |---|---|---|---|---|
222
+ | MCP-native | ✓ | ✓ | ✓ | ✓ |
223
+ | Attack simulation | ✓ | ✗ | ✗ | ✗ |
224
+ | Schema drift detection | ✓ | ✗ | ✗ | ✗ |
225
+ | Record/replay/verify | ✓ | ✗ | ✗ | ✗ |
226
+ | Health scoring (0-100) | ✓ | ✗ | ✗ | ✗ |
227
+ | SARIF output | ✓ | ✓ | ✓ | ✓ |
228
+ | CI/CD native (setup-ci) | ✓ | ✓ | ✓ | ✓ |
229
+ | Safety index (17+ servers) | ✓ | ✗ | ✗ | ✗ |
230
+ | Runtime enforcement via mcp-seatbelt | ✓ | ✗ | ✗ | ✗ |
231
+
212
232
  ## Quick Start
213
233
 
214
234
  Scan every MCP server in your Claude config:
@@ -336,6 +356,42 @@ When you run `scan`, it looks for MCP configs in:
336
356
  - `%APPDATA%/Claude/claude_desktop_config.json` (Claude Desktop, Windows)
337
357
  - `.claude.json` and `.mcp.json` (current directory)
338
358
 
359
+ ## Architecture
360
+
361
+ ```
362
+ ┌─────────────────────────┐
363
+ │ MCP Observatory CLI │
364
+ │ npx @kryptosai/mcp- │
365
+ │ observatory scan │
366
+ └───────────┬─────────────┘
367
+ │
368
+ ┌───────────▼─────────────┐
369
+ │ Config Discovery │
370
+ │ (Claude, Cursor, etc.) │
371
+ └───────────┬─────────────┘
372
+ │
373
+ ┌─────────────────┼─────────────────┐
374
+ ▼ ▼ ▼
375
+ ┌─────────────────┐ ┌──────────────┐ ┌──────────────────┐
376
+ │ Security Scan │ │ Attack Sim │ │ Schema Drift │
377
+ │ (shell, creds) │ │ (tool poison)│ │ (version diff) │
378
+ └────────┬────────┘ └──────┬───────┘ └────────┬─────────┘
379
+ │ │ │
380
+ └─────────────────┼───────────────────┘
381
+ ▼
382
+ ┌─────────────────────┐
383
+ │ Health Score │
384
+ │ (0-100 + verdict) │
385
+ └──────────┬──────────┘
386
+ │
387
+ ┌────────────────┼────────────────┐
388
+ ▼ ▼ ▼
389
+ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
390
+ │ SARIF │ │ Markdown │ │ CI Gateway │
391
+ │ (Code Scan) │ │ Report │ │ (setup-ci) │
392
+ └──────────────┘ └──────────────┘ └──────────────┘
393
+ ```
394
+
339
395
  ## CI / GitHub Action
340
396
 
341
397
  Add Observatory to your MCP server's CI pipeline:
@@ -556,7 +612,6 @@ Target configs support `${VAR}`, `$VAR`, and `env:VAR` references in `authToken`
556
612
  | Response snapshot diffs | ✅ | — | — | — |
557
613
  | Benchmarking / latency | — | — | ✅ | — |
558
614
  | Jest integration | — | — | — | ✅ |
559
- | MCP proxy mode | — | ✅ | — | — |
560
615
  | **Works as MCP server** | **✅** | — | — | — |
561
616
 
562
617
  Each tool has strengths. Observatory focuses on regression detection and CI-friendly workflows. mcp-recorder is great as a transparent proxy. MCPBench is the go-to for performance benchmarking. mcp-jest is ideal if you're already in a Jest workflow.
@@ -577,14 +632,18 @@ The record/replay/verify pattern is inspired by:
577
632
  - Custom WebSocket transports (e.g., BrowserTools MCP) are not supported
578
633
  - A few servers time out or close before init — see [known issues](./docs/known-issues.md) and [compatibility](./docs/compatibility.md)
579
634
 
635
+ ## Works with mcp-seatbelt
636
+
637
+ Scan before you trust. Enforce at runtime with [mcp-seatbelt](https://github.com/KryptosAI/mcp-seatbelt) — an MCP proxy that consumes Observatory receipts and blocks out-of-contract tool calls in production. Observatory validates; seatbelt enforces.
638
+
580
639
  ## Contributors ✨
581
640
 
582
641
  Thanks to these amazing people who have contributed:
583
642
 
584
643
  - [leemeo3](https://github.com/leemeo3) — 3 Safety Index targets (Git, Chrome DevTools, Filesystem MCP)
644
+ - [albatrossflyon-coder](https://github.com/albatrossflyon-coder) — GitHub MCP Safety Index (#201)
585
645
  - [tanishxdev](https://github.com/tanishxdev) — Legacy CLI deprecation warnings (#187)
586
646
  - [sansynx](https://github.com/sansynx) — CLI format validation (#182)
587
- - [tanishxdev](https://github.com/tanishxdev) — Legacy CLI deprecation warnings (#187)
588
647
 
589
648
  [See all contributors →](CONTRIBUTORS.md)
590
649
 
package/README.zh-CN.md CHANGED
@@ -14,29 +14,40 @@
14
14
 
15
15
  [![CI](https://github.com/KryptosAI/mcp-observatory/actions/workflows/ci.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/ci.yml)
16
16
  [![CodeQL](https://github.com/KryptosAI/mcp-observatory/actions/workflows/codeql.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/codeql.yml)
17
- [![Coverage](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml)
17
+ [![覆盖率工作流](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml)
18
+ [![npm](https://img.shields.io/npm/v/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
19
+ [![GitHub stars](https://img.shields.io/github/stars/KryptosAI/mcp-observatory?style=flat)](https://github.com/KryptosAI/mcp-observatory/stargazers)
20
+ [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](./LICENSE)
21
+
22
+ <details>
23
+ <summary>更多徽章</summary>
24
+
18
25
  [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/KryptosAI/mcp-observatory/badge)](https://securityscorecards.dev/viewer/?uri=github.com/KryptosAI/mcp-observatory)
19
26
  [![Dependabot](https://img.shields.io/badge/dependabot-enabled-025e8c?logo=dependabot)](./.github/dependabot.yml)
20
27
  [![npm provenance workflow](https://img.shields.io/badge/npm%20provenance-workflow-blue)](./.github/workflows/release.yml)
21
- [![npm](https://img.shields.io/npm/v/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
22
28
  [![npm weekly downloads](https://img.shields.io/npm/dw/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
23
- [![GitHub stars](https://img.shields.io/github/stars/KryptosAI/mcp-observatory?style=flat)](https://github.com/KryptosAI/mcp-observatory/stargazers)
24
- [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](./LICENSE)
25
29
  [![Node >= 20](https://img.shields.io/badge/node-%3E%3D20-339933)](./package.json)
26
30
  [![Smithery](https://smithery.ai/badge/@kryptosai/mcp-observatory)](https://smithery.ai/server/@kryptosai/mcp-observatory)
27
31
  [![mcp-observatory MCP server](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory/badges/score.svg)](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory)
28
- [![All Contributors](https://img.shields.io/badge/all_contributors-1-orange.svg?style=flat-square)](./CONTRIBUTORS.md)
32
+ [![All Contributors](https://img.shields.io/badge/all_contributors-4-orange.svg?style=flat-square)](./CONTRIBUTORS.md)
29
33
  [![Gitee Stars](https://gitee.com/williamweishuhn/mcp-observatory/badge/star.svg)](https://gitee.com/williamweishuhn/mcp-observatory)
30
34
  [![Gitee Forks](https://gitee.com/williamweishuhn/mcp-observatory/badge/fork.svg)](https://gitee.com/williamweishuhn/mcp-observatory)
31
35
  [![MCP Registry](https://img.shields.io/badge/MCP_Registry-listed-blue)](https://registry.modelcontextprotocol.io)
32
36
  [![MCP Market](https://img.shields.io/badge/MCP_Market-premium-gold)](https://mcpmarket.com)
33
37
  [![MCP Hub China](https://img.shields.io/badge/MCP_Hub_China-listed-red)](https://mcp-hub.cn)
34
38
  [![OpenTools](https://img.shields.io/badge/OpenTools-listed-green)](https://opentools.ai)
39
+ [![Gitee](https://img.shields.io/badge/Gitee-镜像-orange)](https://gitee.com/williamweishuhn/mcp-observatory)
35
40
 
36
- > 我们热烈欢迎中国开发者贡献代码、文档和新的 MCP 服务器安全索引条目。请查看 CONTRIBUTING.md 了解如何参与。
41
+ </details>
42
+
43
+ > 我们热烈欢迎中国开发者贡献代码、文档和新的 MCP 服务器安全索引条目。请查看 [CONTRIBUTING.zh-CN.md](CONTRIBUTING.zh-CN.md) 了解如何参与。
37
44
 
38
45
  **MCP Observatory 在 AI Agent 依赖 MCP 服务器之前，绘制其风险图谱。** 帮助团队在将 MCP 服务器部署到敏感、受监管或关键任务的 AI Agent 环境之前进行验证。
39
46
 
47
+ <p align="center">
48
+ <img src="docs/demo.gif" alt="MCP Observatory 演示" width="700"/>
49
+ </p>
50
+
40
51
  Agent 不应依赖没人测试过的工具。MCP Observatory 将本地 MCP 检查转化为可移植的验证凭证、风险图谱、发布门禁证据、GitHub Code Scanning 的 SARIF、GitHub Actions 门禁、schema 漂移检测、信任状态输出、评分徽章以及 Agent 可访问的诊断信息。
41
52
 
42
53
  ```bash
@@ -205,6 +216,20 @@ MCP Observatory 为安全和平台团队提供 MCP 服务器 CI、schema 漂移
205
216
 
206
217
  运行 `npx @kryptosai/mcp-observatory cloud`，从 Issue 选择器发起试点请求，或参见 [COMMERCIAL.md](./COMMERCIAL.md)。另见[隐私与遥测](./PRIVACY.md)、[活动归因](./docs/campaign-attribution.md) 和[生产使用条款](./TERMS.md)。
207
218
 
219
+ ## 工具对比
220
+
221
+ | 功能 | mcp-observatory | Snyk agent-scan | Cisco mcp-scanner | agent-shield |
222
+ |---|---|---|---|---|
223
+ | MCP原生 | ✓ | ✓ | ✓ | ✓ |
224
+ | 攻击模拟 | ✓ | ✗ | ✗ | ✗ |
225
+ | Schema漂移检测 | ✓ | ✗ | ✗ | ✗ |
226
+ | 录制/回放/验证 | ✓ | ✗ | ✗ | ✗ |
227
+ | 健康评分(0-100) | ✓ | ✗ | ✗ | ✗ |
228
+ | SARIF输出 | ✓ | ✓ | ✓ | ✓ |
229
+ | CI/CD原生(setup-ci) | ✓ | ✓ | ✓ | ✓ |
230
+ | 安全索引(17+服务器) | ✓ | ✗ | ✗ | ✗ |
231
+ | 通过mcp-seatbelt运行时强制执行 | ✓ | ✗ | ✗ | ✗ |
232
+
208
233
  ## 快速开始
209
234
 
210
235
  扫描 Claude 配置中的所有 MCP 服务器：
@@ -332,6 +357,42 @@ npx @kryptosai/mcp-observatory watch target.json
332
357
  - `%APPDATA%/Claude/claude_desktop_config.json` (Claude Desktop, Windows)
333
358
  - `.claude.json` 和 `.mcp.json` (当前目录)
334
359
 
360
+ ## 架构
361
+
362
+ ```
363
+ ┌─────────────────────────┐
364
+ │ MCP Observatory CLI │
365
+ │ npx @kryptosai/mcp- │
366
+ │ observatory scan │
367
+ └───────────┬─────────────┘
368
+ │
369
+ ┌───────────▼─────────────┐
370
+ │ Config Discovery │
371
+ │ (Claude, Cursor, etc.) │
372
+ └───────────┬─────────────┘
373
+ │
374
+ ┌─────────────────┼─────────────────┐
375
+ ▼ ▼ ▼
376
+ ┌─────────────────┐ ┌──────────────┐ ┌──────────────────┐
377
+ │ Security Scan │ │ Attack Sim │ │ Schema Drift │
378
+ │ (shell, creds) │ │ (tool poison)│ │ (version diff) │
379
+ └────────┬────────┘ └──────┬───────┘ └────────┬─────────┘
380
+ │ │ │
381
+ └─────────────────┼───────────────────┘
382
+ ▼
383
+ ┌─────────────────────┐
384
+ │ Health Score │
385
+ │ (0-100 + verdict) │
386
+ └──────────┬──────────┘
387
+ │
388
+ ┌────────────────┼────────────────┐
389
+ ▼ ▼ ▼
390
+ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
391
+ │ SARIF │ │ Markdown │ │ CI Gateway │
392
+ │ (Code Scan) │ │ Report │ │ (setup-ci) │
393
+ └──────────────┘ └──────────────┘ └──────────────┘
394
+ ```
395
+
335
396
  ## CI / GitHub Action
336
397
 
337
398
  将 Observatory 添加到 MCP 服务器的 CI 流水线：
@@ -572,6 +633,10 @@ npx @kryptosai/mcp-observatory run --target ./target.json
572
633
  - 不支持自定义 WebSocket 传输（如 BrowserTools MCP）
573
634
  - 少数服务器超时或在初始化前关闭 — 参见[已知问题](./docs/known-issues.md)和[兼容性](./docs/compatibility.md)
574
635
 
636
+ ## 与 mcp-seatbelt 协作
637
+
638
+ 扫描后再信任。通过 [mcp-seatbelt](https://github.com/KryptosAI/mcp-seatbelt) 进行运行时强制执行——这是一个 MCP 代理，消费 Observatory 凭证并在生产环境中阻止超出合约的工具调用。Observatory 验证；seatbelt 执行。
639
+
575
640
  ## 贡献
576
641
 
577
642
  欢迎贡献者！本项目遵循[贡献者公约行为准则](./CODE_OF_CONDUCT.md)。最快的参与方式：
@@ -584,8 +649,6 @@ git clone https://github.com/KryptosAI/mcp-observatory.git && cd mcp-observatory
584
649
 
585
650
  最常见的首次贡献是向安全索引添加一个 MCP 服务器（10-15 分钟）。完整的指南、代码标准和贡献者认可阶梯参见 [CONTRIBUTING.md](CONTRIBUTING.md)。
586
651
 
587
- 我们特别欢迎来自中国和亚洲开发者社区的贡献。如果你对 MCP 安全感兴趣，这是一个早期参与并影响项目方向的机会。
588
-
589
652
  ---
590
653
 
591
654
  如果 Observatory 帮你避免了一次部署故障，不妨给它一个 [star](https://github.com/KryptosAI/mcp-observatory)。这能帮助更多人发现这个项目。
package/dist/src/checks/runtime-profile.d.ts ADDED
@@ -0,0 +1,5 @@
1
+ import type { Tool } from "@modelcontextprotocol/sdk/types.js";
2
+ import { type ObservedCheck } from "./base.js";
3
+ import type { RuntimeProfile } from "../types.js";
4
+ export declare function analyzeRuntimeProfile(tools: Tool[]): RuntimeProfile;
5
+ export declare function runRuntimeProfileCheck(tools: Tool[]): ObservedCheck;
package/dist/src/checks/runtime-profile.js ADDED
@@ -0,0 +1,214 @@
1
+ import { performance } from "node:perf_hooks";
2
+ import { makeCheckResult } from "./base.js";
3
+ const EGRESS_PARAM_PATTERNS = [
4
+ /^url$/i, /^uri$/i, /^endpoint$/i, /^host$/i, /^hostname$/i,
5
+ /^server$/i, /^address$/i, /^base_?url$/i,
6
+ /^webhook$/i, /^callback$/i, /^domain$/i, /^origin$/i,
7
+ ];
8
+ const EGRESS_DESC_PATTERNS = [
9
+ /\burl\b/i, /\bhttps?\b/i, /\bendpoint\b/i,
10
+ /\bhost\b/i, /\bapi\b/i, /\bwebhook\b/i,
11
+ ];
12
+ const MUTATION_PARAM_PATTERNS = [
13
+ /^path$/i, /^file$/i, /^filename$/i, /^filepath$/i, /^filePath$/i,
14
+ /^directory$/i, /^dir$/i, /^folder$/i,
15
+ /^env$/i, /^environ$/i, /^environment$/i,
16
+ /^command$/i, /^cmd$/i, /^exec$/i, /^shell$/i,
17
+ ];
18
+ const MUTATION_DESC_PATTERNS = [
19
+ /\bwrite\b/i, /\bdelete\b/i, /\bremove\b/i, /\bcreate\b/i,
20
+ /\bexecute\b/i, /\brun\b/i, /\bset\b/i, /\bupdate\b/i,
21
+ /\bmodify\b/i, /\bsave\b/i, /\bfile\b/i, /\bpath\b/i,
22
+ /\bdirectory\b/i, /\benvironment\b/i, /\bcommand\b/i,
23
+ ];
24
+ const MUTATION_NAME_PATTERNS = [
25
+ /write/i, /delete/i, /remove/i, /create/i,
26
+ /exec(ute)?/i, /run/i, /set/i, /update/i,
27
+ /modify/i, /save/i,
28
+ ];
29
+ function inferProtocol(value) {
30
+ if (/^https:\/\//i.test(value))
31
+ return "HTTPS";
32
+ if (/^http:\/\//i.test(value))
33
+ return "HTTP";
34
+ if (/^wss?:\/\//i.test(value))
35
+ return "WSS";
36
+ if (/^tcp:\/\//i.test(value))
37
+ return "TCP";
38
+ if (/^udp:\/\//i.test(value))
39
+ return "UDP";
40
+ return "unknown";
41
+ }
42
+ function inferMutationResource(paramName) {
43
+ if (/^env|^environ/i.test(paramName))
44
+ return "environment";
45
+ if (/^(command|cmd|exec|shell)$/i.test(paramName))
46
+ return "network";
47
+ return "filesystem";
48
+ }
49
+ function inferMutationOperation(toolName, paramName) {
50
+ if (/\bdelet|remov\b/i.test(toolName))
51
+ return "delete";
52
+ if (/\bwrit|creat|sav\b/i.test(toolName))
53
+ return "write";
54
+ if (/\bexec|run|command|shell|cmd\b/i.test(toolName) || /^command|cmd|exec|shell$/i.test(paramName))
55
+ return "execute";
56
+ return "write";
57
+ }
58
+ // eslint-disable-next-line @typescript-eslint/no-unused-vars
59
+ function inferMutationScope(schemaProperties, paramName, _toolName) {
60
+ if (/^env|^environ/i.test(paramName))
61
+ return "global";
62
+ if (/^(command|cmd|exec|shell)$/i.test(paramName))
63
+ return "specific_path";
64
+ if (schemaProperties?.[paramName]?.default !== undefined)
65
+ return "specific_path";
66
+ return "working_directory";
67
+ }
68
+ function stringValue(value) {
69
+ if (typeof value === "string")
70
+ return value;
71
+ return JSON.stringify(value);
72
+ }
73
+ function normalizeToolSchema(tool) {
74
+ const schema = tool.inputSchema;
75
+ const properties = schema?.["properties"];
76
+ const propertyNames = properties ? Object.keys(properties) : [];
77
+ const propertyDescriptions = propertyNames
78
+ .map((name) => stringValue(properties[name]?.description ?? ""))
79
+ .filter(Boolean);
80
+ return {
81
+ name: tool.name,
82
+ description: stringValue(tool.description ?? ""),
83
+ propertyNames,
84
+ propertyDescriptions,
85
+ properties,
86
+ };
87
+ }
88
+ export function analyzeRuntimeProfile(tools) {
89
+ const egress = [];
90
+ const mutations = [];
91
+ for (const tool of tools) {
92
+ const normalized = normalizeToolSchema(tool);
93
+ for (const paramName of normalized.propertyNames) {
94
+ if (EGRESS_PARAM_PATTERNS.some((p) => p.test(paramName))) {
95
+ const paramSchema = normalized.properties?.[paramName];
96
+ const defaultVal = stringValue(paramSchema?.default ?? paramSchema?.example ?? paramName);
97
+ egress.push({
98
+ target: defaultVal,
99
+ protocol: inferProtocol(defaultVal),
100
+ source: "tool_schema",
101
+ confidence: "high",
102
+ });
103
+ }
104
+ if (MUTATION_PARAM_PATTERNS.some((p) => p.test(paramName))) {
105
+ mutations.push({
106
+ resource: inferMutationResource(paramName),
107
+ operation: inferMutationOperation(tool.name, paramName),
108
+ scope: inferMutationScope(normalized.properties, paramName, tool.name),
109
+ source: "tool_schema",
110
+ });
111
+ }
112
+ }
113
+ for (const desc of normalized.propertyDescriptions) {
114
+ if (EGRESS_DESC_PATTERNS.some((p) => p.test(desc))) {
115
+ egress.push({
116
+ target: desc,
117
+ protocol: "unknown",
118
+ source: "description_analysis",
119
+ confidence: "medium",
120
+ });
121
+ }
122
+ if (MUTATION_DESC_PATTERNS.some((p) => p.test(desc))) {
123
+ mutations.push({
124
+ resource: "filesystem",
125
+ operation: "write",
126
+ scope: "working_directory",
127
+ source: "description_analysis",
128
+ });
129
+ }
130
+ }
131
+ if (EGRESS_DESC_PATTERNS.some((p) => p.test(normalized.description))) {
132
+ egress.push({
133
+ target: normalized.name,
134
+ protocol: "unknown",
135
+ source: "description_analysis",
136
+ confidence: "low",
137
+ });
138
+ }
139
+ if (MUTATION_DESC_PATTERNS.some((p) => p.test(normalized.description))) {
140
+ mutations.push({
141
+ resource: "filesystem",
142
+ operation: "write",
143
+ scope: "working_directory",
144
+ source: "description_analysis",
145
+ });
146
+ }
147
+ if (MUTATION_NAME_PATTERNS.some((p) => p.test(normalized.name))) {
148
+ mutations.push({
149
+ resource: "filesystem",
150
+ operation: inferMutationOperation(tool.name, ""),
151
+ scope: "working_directory",
152
+ source: "description_analysis",
153
+ });
154
+ }
155
+ }
156
+ const confidence = egress.some((e) => e.confidence === "high") || mutations.some((m) => m.source === "tool_schema")
157
+ ? "high"
158
+ : egress.length > 0 || mutations.length > 0
159
+ ? "medium"
160
+ : "low";
161
+ return {
162
+ egress: egress.length > 0 ? egress : undefined,
163
+ stateMutations: mutations.length > 0 ? mutations : undefined,
164
+ analyzedAt: new Date().toISOString(),
165
+ confidence,
166
+ };
167
+ }
168
+ function structuredEgressFindings(entries) {
169
+ return entries.map((e) => ({ ...e }));
170
+ }
171
+ function structuredMutationFindings(entries) {
172
+ return entries.map((m) => ({ ...m }));
173
+ }
174
+ export function runRuntimeProfileCheck(tools) {
175
+ const startedAt = performance.now();
176
+ const profile = analyzeRuntimeProfile(tools);
177
+ const egressCount = profile.egress?.length ?? 0;
178
+ const mutationCount = profile.stateMutations?.length ?? 0;
179
+ let status;
180
+ let message;
181
+ if (egressCount === 0 && mutationCount === 0) {
182
+ status = "pass";
183
+ message = "No egress or state mutation indicators detected in tool schemas.";
184
+ }
185
+ else if (profile.confidence === "high") {
186
+ status = "partial";
187
+ message = `Detected ${egressCount} potential egress target(s) and ${mutationCount} potential state mutation(s) with high confidence.`;
188
+ }
189
+ else {
190
+ status = "pass";
191
+ message = `Detected ${egressCount} potential egress target(s) and ${mutationCount} potential state mutation(s) with low confidence.`;
192
+ }
193
+ const evidenceList = [];
194
+ if (egressCount > 0 || mutationCount > 0) {
195
+ evidenceList.push({
196
+ endpoint: "runtime-profile/analyze",
197
+ advertised: true,
198
+ responded: true,
199
+ minimalShapePresent: true,
200
+ itemCount: egressCount + mutationCount,
201
+ diagnostics: [
202
+ `Egress entries: ${egressCount}`,
203
+ `State mutations: ${mutationCount}`,
204
+ `Confidence: ${profile.confidence}`,
205
+ ],
206
+ findings: [
207
+ ...(profile.egress ? structuredEgressFindings(profile.egress) : []),
208
+ ...(profile.stateMutations ? structuredMutationFindings(profile.stateMutations) : []),
209
+ ],
210
+ });
211
+ }
212
+ return { result: makeCheckResult("runtime-profile", status, performance.now() - startedAt, message, evidenceList) };
213
+ }
214
+ //# sourceMappingURL=runtime-profile.js.map
package/dist/src/checks/runtime-profile.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"runtime-profile.js","sourceRoot":"","sources":["../../../src/checks/runtime-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9C,OAAO,EAAE,eAAe,EAAsB,MAAM,WAAW,CAAC;AAGhE,MAAM,qBAAqB,GAAG;IAC5B,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa;IAC3D,WAAW,EAAE,YAAY,EAAE,cAAc;IACzC,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW;CACtD,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,UAAU,EAAE,aAAa,EAAE,eAAe;IAC1C,WAAW,EAAE,UAAU,EAAE,cAAc;CACxC,CAAC;AAEF,MAAM,uBAAuB,GAAG;IAC9B,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IACjE,cAAc,EAAE,QAAQ,EAAE,WAAW;IACrC,QAAQ,EAAE,YAAY,EAAE,gBAAgB;IACxC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU;CAC9C,CAAC;AAEF,MAAM,sBAAsB,GAAG;IAC7B,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IACzD,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa;IACrD,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IACpD,gBAAgB,EAAE,kBAAkB,EAAE,cAAc;CACrD,CAAC;AAEF,MAAM,sBAAsB,GAAG;IAC7B,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;IACzC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;IACxC,SAAS,EAAE,OAAO;CACnB,CAAC;AAEF,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7C,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,aAAa,CAAC;IAC3D,IAAI,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAE,SAAiB;IACjE,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvD,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACzD,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACtH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6DAA6D;AAC7D,SAAS,kBAAkB,CAAC,gBAAqE,EAAE,SAAiB,EAAE,SAAiB;IACrI,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtD,IAAI,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,eAAe,CAAC;IAC1E,IAAI,gBAAgB,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IACjF,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAU;IAOrC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAkD,CAAC;IACvE,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,YAAY,CAAwD,CAAC;IACjG,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,oBAAoB,GAAG,aAAa;SACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,UAAW,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;SAChE,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAChD,aAAa;QACb,oBAAoB;QACpB,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,SAAS,GAAoB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE7C,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YACjD,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;gBACvD,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC;gBAC1F,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM,EAAE,UAAU;oBAClB,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC;oBACnC,MAAM,EAAE,aAAa;oBACrB,UAAU,EAAE,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBAC3D,SAAS,CAAC,IAAI,CAAC;oBACb,QAAQ,EAAE,qBAAqB,CAAC,SAAS,CAAC;oBAC1C,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;oBACvD,KAAK,EAAE,kBAAkB,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC;oBACtE,MAAM,EAAE,aAAa;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,oBAAoB,EAAE,CAAC;YACnD,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,sBAAsB;oBAC9B,UAAU,EAAE,QAAQ;iBACrB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrD,SAAS,CAAC,IAAI,CAAC;oBACb,QAAQ,EAAE,YAAY;oBACtB,SAAS,EAAE,OAAO;oBAClB,KAAK,EAAE,mBAAmB;oBAC1B,MAAM,EAAE,sBAAsB;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,UAAU,CAAC,IAAI;gBACvB,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,sBAAsB;gBAC9B,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACvE,SAAS,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,OAAO;gBAClB,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,sBAAsB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChE,SAAS,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChD,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,sBAAsB;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GACd,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC;QAC9F,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YACzC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,KAAK,CAAC;IAEd,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC9C,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5D,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAsB;IACtD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAwB;IAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC;IAE1D,IAAI,MAAmC,CAAC;IACxC,IAAI,OAAe,CAAC;IAEpB,IAAI,WAAW,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,MAAM,CAAC;QAChB,OAAO,GAAG,kEAAkE,CAAC;IAC/E,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,GAAG,SAAS,CAAC;QACnB,OAAO,GAAG,YAAY,WAAW,mCAAmC,aAAa,oDAAoD,CAAC;IACxI,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,CAAC;QAChB,OAAO,GAAG,YAAY,WAAW,mCAAmC,aAAa,mDAAmD,CAAC;IACvI,CAAC;IAED,MAAM,YAAY,GAAsB,EAAE,CAAC;IAC3C,IAAI,WAAW,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACzC,YAAY,CAAC,IAAI,CAAC;YAChB,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;YACf,mBAAmB,EAAE,IAAI;YACzB,SAAS,EAAE,WAAW,GAAG,aAAa;YACtC,WAAW,EAAE;gBACX,mBAAmB,WAAW,EAAE;gBAChC,oBAAoB,aAAa,EAAE;gBACnC,eAAe,OAAO,CAAC,UAAU,EAAE;aACpC;YACD,QAAQ,EAAE;gBACR,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACtF;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,iBAAiB,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;AACtH,CAAC"}
package/dist/src/checks/security-rules.js CHANGED
@@ -124,6 +124,24 @@ export const SECURITY_RULES = [
124
124
  return null;
125
125
  },
126
126
  },
127
+ {
128
+ id: "unicode-obfuscation-description",
129
+ severity: "high",
130
+ name: "Unicode obfuscation in tool description",
131
+ match(tool) {
132
+ const desc = tool.description ?? "";
133
+ const unicodeRegex = /[\u200B-\u200D\uFEFF\u2060\u00AD\u202A-\u202E\u2066-\u2069\u{E0001}\u{E0020}-\u{E007F}]/gu;
134
+ if (unicodeRegex.test(desc)) {
135
+ return {
136
+ ruleId: this.id,
137
+ severity: this.severity,
138
+ toolName: tool.name,
139
+ message: `Tool "${tool.name}" description contains hidden Unicode characters (zero-width spaces, bidi overrides, or tag sequences) that can obscure true intent.`,
140
+ };
141
+ }
142
+ return null;
143
+ },
144
+ },
127
145
  ];
128
146
  /** Credential patterns to scan in tool response content. */
129
147
  export const CREDENTIAL_PATTERNS = [
package/dist/src/checks/security-rules.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"security-rules.js","sourceRoot":"","sources":["../../../src/checks/security-rules.ts"],"names":[],"mappings":"AAuBA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI;CAC1E,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG;IAC1B,sBAAsB;IACtB,qBAAqB;IACrB,uBAAuB;IACvB,kBAAkB;IAClB,sBAAsB;IACtB,kBAAkB;CACnB,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW;CAC/C,CAAC;AAEF,SAAS,gBAAgB,CAAC,MAAgC;IACxD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,IAAc;IACpC,OAAO,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C;QACE,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,yBAAyB;QAC/B,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtD,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACpF,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,oBAAoB,cAAc,gDAAgD;iBAC9G,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,8CAA8C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;iBAChG,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnE,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,+CAA+C;iBAC3E,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IAED;QACE,EAAE,EAAE,kBAAkB;QACtB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,yBAAyB;QAC/B,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/F,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,iBAAiB,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,aAAa,GACjB,QAAQ,KAAK,KAAK;gBAClB,WAAW,KAAK,IAAI;gBACpB,mDAAmD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEjE,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,8DAA8D;iBAC1F,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IAED;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,0BAA0B;QAChC,KAAK,CAAC,IAAI;YACR,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;YAChC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAAC;YACnE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC;YACjE,MAAM,WAAW,GAAG,WAAW,IAAI,WAAW,CAAC;YAE/C,IAAI,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;gBAC3B,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,qDAAqD;iBACjF,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,EAAE,CAAC,sBAAsB,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC7D,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,+DAA+D;iBAC3F,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;YACrC,IAAI,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;gBACxG,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,qDAAqD;iBACjF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF;CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC1D,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE;IACzD,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,yBAAyB,EAAE;IAC3D,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,mEAAmE,EAAE;CACzG,CAAC"}
1
+ {"version":3,"file":"security-rules.js","sourceRoot":"","sources":["../../../src/checks/security-rules.ts"],"names":[],"mappings":"AAuBA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI;CAC1E,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG;IAC1B,sBAAsB;IACtB,qBAAqB;IACrB,uBAAuB;IACvB,kBAAkB;IAClB,sBAAsB;IACtB,kBAAkB;CACnB,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW;CAC/C,CAAC;AAEF,SAAS,gBAAgB,CAAC,MAAgC;IACxD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,IAAc;IACpC,OAAO,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C;QACE,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,yBAAyB;QAC/B,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtD,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACpF,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,oBAAoB,cAAc,gDAAgD;iBAC9G,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,8CAA8C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;iBAChG,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnE,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,+CAA+C;iBAC3E,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IAED;QACE,EAAE,EAAE,kBAAkB;QACtB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,yBAAyB;QAC/B,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/F,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,iBAAiB,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,aAAa,GACjB,QAAQ,KAAK,KAAK;gBAClB,WAAW,KAAK,IAAI;gBACpB,mDAAmD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEjE,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,8DAA8D;iBAC1F,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IAED;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,0BAA0B;QAChC,KAAK,CAAC,IAAI;YACR,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;YAChC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAAC;YACnE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC;YACjE,MAAM,WAAW,GAAG,WAAW,IAAI,WAAW,CAAC;YAE/C,IAAI,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;gBAC3B,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,qDAAqD;iBACjF,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,EAAE,CAAC,sBAAsB,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC7D,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,+DAA+D;iBAC3F,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;YACrC,IAAI,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;gBACxG,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,qDAAqD;iBACjF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IAED;QACE,EAAE,EAAE,iCAAiC;QACrC,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,yCAAyC;QAC/C,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,2FAA2F,CAAC;YACjH,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,sIAAsI;iBAClK,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC1D,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE;IACzD,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,yBAAyB,EAAE;IAC3D,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,mEAAmE,EAAE;CACzG,CAAC"}
package/dist/src/checks/skill-scan.d.ts ADDED
@@ -0,0 +1,46 @@
1
+ export type SkillScanSeverity = "high" | "medium" | "low" | "info";
2
+ export interface SkillScanRule {
3
+ id: string;
4
+ severity: SkillScanSeverity;
5
+ name: string;
6
+ /** Regex patterns to match in file content */
7
+ patterns: RegExp[];
8
+ }
9
+ export interface SkillScanMatch {
10
+ line: number;
11
+ column: number;
12
+ pattern: string;
13
+ matchText: string;
14
+ }
15
+ export interface SkillScanFinding {
16
+ ruleId: string;
17
+ severity: SkillScanSeverity;
18
+ filePath: string;
19
+ message: string;
20
+ matches: SkillScanMatch[];
21
+ }
22
+ export interface SkillScanResult {
23
+ filePath: string;
24
+ findings: SkillScanFinding[];
25
+ }
26
+ export interface SkillScanSummary {
27
+ totalFiles: number;
28
+ totalFindings: number;
29
+ healthScore: number;
30
+ results: SkillScanResult[];
31
+ }
32
+ export declare const SKILL_SCAN_RULES: SkillScanRule[];
33
+ export declare function findLineColumn(content: string, matchIndex: number): {
34
+ line: number;
35
+ column: number;
36
+ };
37
+ export declare function scanContent(filePath: string, content: string, rules: SkillScanRule[]): SkillScanFinding[];
38
+ export declare function scanFile(filePath: string): Promise<SkillScanResult>;
39
+ export declare function scanDirectory(dirPath: string): Promise<SkillScanResult[]>;
40
+ export declare function scanPath(inputPath: string): Promise<SkillScanResult[]>;
41
+ export declare function computeSkillHealthScore(results: SkillScanResult[]): number;
42
+ export declare function summarizeScan(results: SkillScanResult[]): SkillScanSummary;
43
+ export declare function renderSkillScanTerminal(results: SkillScanResult[], healthScore: number): string;
44
+ export declare function renderSkillScanMarkdown(results: SkillScanResult[], healthScore: number): string;
45
+ export declare function renderSkillScanJson(summary: SkillScanSummary): string;
46
+ export declare function renderSkillScanSarif(results: SkillScanResult[], healthScore: number): string;