@mayhemx87/mcpscan 0.3.1 → 0.5.0

package/README.md

@@ -91,7 +91,7 @@ the exact line of the offending server definition.
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/mayhemx87/mcpscan
-    rev: v0.3.1
+    rev: v0.5.0
     hooks:
       - id: mcpscan
 ```
@@ -115,11 +115,15 @@ Dedicated MCP config files and editor settings files that embed MCP servers:
 | `.amazonq/mcp.json` | Amazon Q |
 | `.roo/mcp.json` | Roo Code |
 | `.kiro/settings/mcp.json` | Kiro |
+| `.trae/mcp.json` | Trae |
 | `.claude/settings.json`, `.claude/settings.local.json` | Claude Code |
 | `.gemini/settings.json` | Gemini CLI |
+| `.zed/settings.json` (`context_servers`) | Zed |
+| `.junie/mcp/mcp.json` | Junie |
 
-Both `mcpServers` and VS Code's `servers` keys are understood; `command` and
-`args` are analyzed together; remote (`url`-based) servers are covered. Nested
+Both `mcpServers` and VS Code's `servers` keys are understood, as is Zed's
+`context_servers` key; `command` and `args` are analyzed together, including
+Zed's legacy nested command format; remote (`url`-based) servers are covered. Nested
 occurrences of these paths are scanned too (any subdirectory can be opened as a
 workspace root). Only `.git/` and `node_modules/` are skipped; `.gitignore` is
 deliberately ignored — an injected config would be exactly the file that's

package/dist/discovery.js

@@ -11,6 +11,10 @@ const SKIP_DIRS = new Set(['.git', 'node_modules']);
  */
 const MCP_CONFIG_SUFFIXES = [
     '.mcp.json',
+    // A bare `mcp.json` in any directory. Besides Claude Code's own file this is
+    // the exact path several clients auto-load from their own dot-directory --
+    // Trae (`.trae/mcp.json`) among them -- so those need no entry of their own.
+    // Keep new clients out of this list unless their filename differs.
     'mcp.json',
     '.amazonq/mcp.json',
     '.cursor/mcp.json',
@@ -24,6 +28,7 @@ const MCP_CONFIG_SUFFIXES = [
     '.claude/settings.json',
     '.claude/settings.local.json',
     '.gemini/settings.json',
+    '.zed/settings.json',
 ];
 function isMcpConfigPath(relPath) {
     const p = relPath.replace(/\\/g, '/');

package/dist/engine.js

@@ -53,6 +53,8 @@ function looksLikeLiteralSecret(value) {
         return false;
     return SECRET_VALUE_PATTERNS.some(p => p.test(value));
 }
+const REPO_ESCAPE_PATH = /^(?:\/|[A-Za-z]:[\\/]|\\\\|\.\.[\\/])/;
+const PATH_TRAVERSAL_IN_LINE = /(?:^|[\s;|&])\.\.[\\/]/;
 /**
  * Returns true if the command line contains npx/uvx/pipx with an unversioned
  * package (handles compound commands like cmd1 && npx pkg). Runner flags
@@ -88,8 +90,9 @@ export function isEmbeddedHostFile(filePath) {
 }
 /** Extract the server map from any known config shape:
  * - dedicated files: { mcpServers: {...} } or VS Code's { servers: {...} }
- * - embedded hosts:  { mcpServers: {...} } (Claude/Gemini settings) or
- *                    { mcp: { servers: {...} } } (VS Code settings.json)
+ * - embedded hosts:  { mcpServers: {...} } (Claude/Gemini settings),
+ *                    { mcp: { servers: {...} } } (VS Code settings.json), or
+ *                    { context_servers: {...} } (Zed settings.json)
  * Also returns the JSON path to the map so findings can carry line numbers. */
 function extractServers(config) {
     if (config.mcpServers && typeof config.mcpServers === 'object') {
@@ -102,6 +105,9 @@ function extractServers(config) {
     if (mcp && typeof mcp === 'object' && mcp.servers && typeof mcp.servers === 'object') {
         return { servers: mcp.servers, path: ['mcp', 'servers'] };
     }
+    if (config.context_servers && typeof config.context_servers === 'object') {
+        return { servers: config.context_servers, path: ['context_servers'] };
+    }
     return null;
 }
 /**
@@ -161,8 +167,18 @@ export function analyzeConfig(filePath, content, isGitTracked) {
         // Analyze command AND args as one line -- the dominant real-world shape
         // is {"command": "npx", "args": ["-y", "pkg"]}, invisible to any rule
         // that inspects `command` alone (the v0.1.0 gap).
-        const args = Array.isArray(server.args) ? server.args.filter(a => typeof a === 'string') : [];
-        const line = [server.command ?? '', ...args].join(' ').trim();
+        const command = typeof server.command === 'string' ? server.command : server.command?.path ?? '';
+        // Legacy Zed command.args and the top-level args are merged into one
+        // array -- MCP-004's absolute-path check scans `args` directly, so
+        // command.args must live there too or it silently evades detection.
+        const commandArgs = typeof server.command === 'object' && Array.isArray(server.command.args)
+            ? server.command.args.filter(a => typeof a === 'string')
+            : [];
+        const args = [
+            ...commandArgs,
+            ...(Array.isArray(server.args) ? server.args.filter(a => typeof a === 'string') : []),
+        ];
+        const line = [command, ...args].join(' ').trim();
         const serverFindings = [];
         // MCP-001: remote URL or network command execution
         if (line && (/https?:\/\//.test(line) || /\b(curl|wget)\b/.test(line))) {
@@ -202,10 +218,8 @@ export function analyzeConfig(filePath, content, isGitTracked) {
             }
         }
         // MCP-004: absolute path or path traversal outside repo
-        const cmd = server.command ?? '';
-        if (cmd.startsWith('/') ||
-            args.some(a => a.startsWith('/')) ||
-            /(?:^|[\s;|&])\.\.\//.test(line)) {
+        if ([command, ...args].some(value => REPO_ESCAPE_PATH.test(value.trimStart())) ||
+            PATH_TRAVERSAL_IN_LINE.test(line)) {
             serverFindings.push({
                 file: filePath,
                 rule_id: 'MCP-004',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mayhemx87/mcpscan",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Static scanner for malicious MCP config files in AI-integrated editor repos",
   "type": "module",
   "bin": {