@mcp-index/sdk 0.3.0 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +17 -0
- package/dist/src/ambient.d.ts.map +1 -1
- package/dist/src/ambient.js +5 -3
- package/dist/src/ambient.js.map +1 -1
- package/dist/src/scan.d.ts.map +1 -1
- package/dist/src/scan.js +9 -4
- package/dist/src/scan.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -3,6 +3,23 @@
|
|
|
3
3
|
All notable changes to the TypeScript SDK. Versioning is semver (0.x: minor =
|
|
4
4
|
additive feature, patch = fix). Backward-compatible additions only in 0.2.0.
|
|
5
5
|
|
|
6
|
+
## 0.3.2 — 2026-06-08
|
|
7
|
+
|
|
8
|
+
### Fixed
|
|
9
|
+
- **Schema-content scanner no longer false-flags benign URLs** — the exfil tripwire
|
|
10
|
+
(`scanSchemaHasMarker`) had a bare `https?://` rule that flagged any URL in a tool's
|
|
11
|
+
declared schema as a CRITICAL exfil marker. A real crawl tripped it on a benign
|
|
12
|
+
`web_url_reader` whose `url` param carried example URLs. A URL now signals exfil only
|
|
13
|
+
in an exfil-verb context (`forward … https://…`); example/doc URLs are clean.
|
|
14
|
+
Credential-path and injection detection unchanged. Mirrors the Python `schema_scan` fix.
|
|
15
|
+
|
|
16
|
+
## 0.3.1 — 2026-06-08
|
|
17
|
+
|
|
18
|
+
### Changed
|
|
19
|
+
- **Ambient line reworded `watching` → `noted`** — `mcpindex · noted <server>/<tool> — …`.
|
|
20
|
+
The previous "watching" read like surveillance *of the user*; "noted" frames it as
|
|
21
|
+
mcpindex quietly keeping track on your behalf. Copy-only; behavior identical.
|
|
22
|
+
|
|
6
23
|
## 0.3.0 — 2026-06-08
|
|
7
24
|
|
|
8
25
|
### Added
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ambient.d.ts","sourceRoot":"","sources":["../../src/ambient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;
|
|
1
|
+
{"version":3,"file":"ambient.d.ts","sourceRoot":"","sources":["../../src/ambient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAwBH;;oDAEoD;AACpD,oBAAY,WAAW;IACrB,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,GAAG,QAAQ;CACZ;AAED,KAAK,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AASlD;;;;wFAIwF;AACxF,wBAAgB,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,CAetD;AAED;6EAC6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;4CAE4C;AAC5C,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;AAE1D,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B;AAED;;yFAEyF;AACzF,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAqBzC,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACnC;AAED;;wDAEwD;AACxD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,MAAM,CAAS;gBAEX,OAAO,GAAE,sBAA2B;IAMhD,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,qBAA0B,GAAG,eAAe;IAQpE,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;gFAC4E;IAC5E,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,kBAAkB,GAAG,WAAW;IAa/F;;6BAEyB;IACzB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,kBAAkB,GAAG,WAAW,GAAG,IAAI;IAmB3G;;2FAEuF;IACvF,cAAc,CAAC,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM,GAAG,IAAI;IAahF;oFACgF;IAChF,OAAO,CAAC,IAAI;CAmBb"}
|
package/dist/src/ambient.js
CHANGED
|
@@ -32,7 +32,9 @@ const SILENCE_HINT = `silence: ${AMBIENT_ENV}=off`;
|
|
|
32
32
|
const MAX_LABEL = 128; // bound a remote-controlled name before it reaches a terminal / log
|
|
33
33
|
const SEEN_CAP = 4096; // bound the per-session dedupe set (a hostile server can't grow it unbounded)
|
|
34
34
|
// eslint-disable-next-line no-control-regex
|
|
35
|
-
|
|
35
|
+
// Includes U+2028/U+2029 (LINE / PARAGRAPH SEPARATOR) for parity with Python str.isprintable()
|
|
36
|
+
// (which drops Zl/Zp): both can forge an apparent newline in JS / log-viewer contexts.
|
|
37
|
+
const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g;
|
|
36
38
|
/** Sanitize a remote-server-controlled label (tool/server name) before it is rendered into a
|
|
37
39
|
* stderr line: drop ANSI escapes / CR / LF / other control bytes and bound the length. Defends
|
|
38
40
|
* the terminal and any downstream log parser against forged-line / escape-sequence injection. */
|
|
@@ -136,7 +138,7 @@ export class AmbientNotifier {
|
|
|
136
138
|
// Drop the "— action, reversible" clause when the blast radius is unknown (e.g. the TS
|
|
137
139
|
// SDK has no local classifier yet) so the line reads clean instead of "— unknown, unknown".
|
|
138
140
|
const detail = action === UNKNOWN && reversible === UNKNOWN ? "" : ` — ${action}, ${reversible}`;
|
|
139
|
-
const text = `mcpindex ·
|
|
141
|
+
const text = `mcpindex · noted ${safeLabel(serverId)}/${safeLabel(toolName)}${detail}`;
|
|
140
142
|
return { serverId, toolName, action, reversible, text };
|
|
141
143
|
}
|
|
142
144
|
/** Record one PROCEED-path invocation; emit per the cadence. Returns the note IFF a
|
|
@@ -169,7 +171,7 @@ export class AmbientNotifier {
|
|
|
169
171
|
sessionSummary(counts = {}) {
|
|
170
172
|
if (this.mode === AmbientMode.OFF || this.tools === 0)
|
|
171
173
|
return null;
|
|
172
|
-
let base = `mcpindex
|
|
174
|
+
let base = `mcpindex noted ${this.tools} tool(s) / ${this.servers.size} server(s) this session`;
|
|
173
175
|
const { drift, flagged } = counts;
|
|
174
176
|
if (drift !== undefined && flagged !== undefined) {
|
|
175
177
|
base += ` — ${drift} drift, ${flagged} flagged`;
|
package/dist/src/ambient.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ambient.js","sourceRoot":"","sources":["../../src/ambient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,GAAG,yBAAyB,CAAC,CAAC,6BAA6B;AAC5E,MAAM,gBAAgB,GAAG,8BAA8B,CAAC,CAAC,eAAe;AACxE,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,mFAAmF;AACnF,sEAAsE;AACtE,MAAM,YAAY,GAAG,YAAY,WAAW,MAAM,CAAC;AACnD,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,oEAAoE;AAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,8EAA8E;AAErG,4CAA4C;AAC5C,MAAM,aAAa,GAAG
|
|
1
|
+
{"version":3,"file":"ambient.js","sourceRoot":"","sources":["../../src/ambient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,GAAG,yBAAyB,CAAC,CAAC,6BAA6B;AAC5E,MAAM,gBAAgB,GAAG,8BAA8B,CAAC,CAAC,eAAe;AACxE,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,mFAAmF;AACnF,sEAAsE;AACtE,MAAM,YAAY,GAAG,YAAY,WAAW,MAAM,CAAC;AACnD,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,oEAAoE;AAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,8EAA8E;AAErG,4CAA4C;AAC5C,+FAA+F;AAC/F,uFAAuF;AACvF,MAAM,aAAa,GAAG,2CAA2C,CAAC;AAElE;;iGAEiG;AACjG,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED;;oDAEoD;AACpD,MAAM,CAAN,IAAY,WAKX;AALD,WAAY,WAAW;IACrB,0CAA2B,CAAA;IAC3B,kCAAmB,CAAA;IACnB,8BAAe,CAAA;IACf,0BAAW,CAAA;AACb,CAAC,EALW,WAAW,KAAX,WAAW,QAKtB;AAID,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AACpD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,SAAS,KAAK,CAAC,KAAyB;IACtC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC5C,CAAC;AAED;;;;wFAIwF;AACxF,MAAM,UAAU,WAAW,CAAC,GAAa;IACvC,MAAM,MAAM,GAAY,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC;IAC/C,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,CAAC;QACtE,OAAO,WAAW,CAAC,GAAG,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACjC,CAAC;IACD,OAAO,WAAW,CAAC,WAAW,CAAC;AACjC,CAAC;AA2BD,SAAS,SAAS,CAAC,cAAkC,EAAE,GAAW;IAChE,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAClG,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAI,cAA0C,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAED;;4FAE4F;AAC5F,SAAS,cAAc,CAAC,cAAkC;IACxD,MAAM,GAAG,GAAG,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,cAAc,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACjG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAcD;;wDAEwD;AACxD,MAAM,OAAO,eAAe;IACT,IAAI,CAAc;IAClB,MAAM,CAAe;IACrB,QAAQ,CAAyB;IACjC,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IACzB,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,GAAG,CAAC,CAAC;IACV,MAAM,GAAG,KAAK,CAAC,CAAC,8DAA8D;IAEtF,YAAY,UAAkC,EAAE;QAC9C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,WAAW,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,UAAiC,EAAE;QAChD,OAAO,IAAI,eAAe,CAAC;YACzB,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,CAAC;IACvC,CAAC;IAED;gFAC4E;IAC5E,SAAS,CAAC,QAAgB,EAAE,QAAgB,EAAE,cAAmC;QAC/E,mFAAmF;QACnF,uFAAuF;QACvF,IAAI,MAAM,GAAG,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,OAAO;YAAE,MAAM,GAAG,SAAS,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QAClD,uFAAuF;QACvF,4FAA4F;QAC5F,MAAM,MAAM,GAAG,MAAM,KAAK,OAAO,IAAI,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,KAAK,UAAU,EAAE,CAAC;QACjG,MAAM,IAAI,GAAG,oBAAoB,SAAS,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC;QACvF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED;;6BAEyB;IACzB,cAAc,CAAC,QAAgB,EAAE,QAAgB,EAAE,cAAmC;QACpF,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,QAAQ,OAAO,QAAQ,EAAE,CAAC;QACzC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC/B,KAAK,GAAG,KAAK,CAAC,CAAC,0EAA0E;YAC3F,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC;QACjG,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED;;2FAEuF;IACvF,cAAc,CAAC,SAA+C,EAAE;QAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,IAAI,IAAI,GAAG,kBAAkB,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,yBAAyB,CAAC;QAChG,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,IAAI,MAAM,KAAK,WAAW,OAAO,UAAU,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,IAAI,gBAAgB,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oFAAoF;IACpF;oFACgF;IACxE,IAAI,CAAC,IAAY,EAAE,IAAwB;QACjD,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,GAAG,GAAG,IAAI,MAAM,YAAY,GAAG,CAAC;YACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
|
package/dist/src/scan.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;
|
|
1
|
+
{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoCH,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAS1C,CAAC;AA+BH;;qCAEqC;AACrC,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CASjF"}
|
package/dist/src/scan.js
CHANGED
|
@@ -10,10 +10,15 @@
|
|
|
10
10
|
const CREDENTIAL_PATH = new RegExp("(?:[/\\\\~]\\.?(?:ssh|aws|gnupg)\\b)" +
|
|
11
11
|
"|(?:[/\\\\](?:credentials?|secrets?|vault|keys?|private[_-]?keys?)\\b)" +
|
|
12
12
|
"|(?:\\b(?:id_rsa|\\.pem|\\.env|/var/secrets|\\.config/credentials)\\b)", "i");
|
|
13
|
-
const EXFIL_INSTRUCTION = new RegExp(
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
13
|
+
const EXFIL_INSTRUCTION = new RegExp(
|
|
14
|
+
// An exfil VERB + a destination (word OR URL) within 48 chars. A BARE URL is NOT
|
|
15
|
+
// flagged on its own: benign tools carry example/doc URLs in schema strings (a
|
|
16
|
+
// web_url_reader's `url` param), which the prior bare `https?://` alternative
|
|
17
|
+
// false-flagged CRITICAL on real data. Mirrors the tightened Python
|
|
18
|
+
// `_EXFIL_INSTRUCTION` — a URL signals exfil only in a verb context.
|
|
19
|
+
"\\b(?:mirror|exfiltrat\\w*|forward|transmit|relay|smuggle|leak|harvest|replicate|stage)\\b" +
|
|
20
|
+
".{0,48}?(?:\\b(?:to|into|channel|webhook|endpoint|inbox|hook|server|outbound|operator)\\b|https?://)" +
|
|
21
|
+
"|\\b(?:webhook-delta|slack-hook|discord-relay|teams-forward)\\b", "i");
|
|
17
22
|
const INJECTION = new RegExp("\\b(?:ignore (?:all )?(?:previous|prior)|disregard (?:previous|prior|the above))\\b" +
|
|
18
23
|
"|^\\s*(?:SYSTEM|ADMIN)\\s*:" +
|
|
19
24
|
"|\\[(?:ADMIN|SYSTEM)\\]" +
|
package/dist/src/scan.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,sCAAsC;IACpC,wEAAwE;IACxE,wEAAwE,EAC1E,GAAG,CACJ,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,MAAM,
|
|
1
|
+
{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,sCAAsC;IACpC,wEAAwE;IACxE,wEAAwE,EAC1E,GAAG,CACJ,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,MAAM;AAClC,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,oEAAoE;AACpE,qEAAqE;AACrE,4FAA4F;IAC1F,sGAAsG;IACtG,iEAAiE,EACnE,GAAG,CACJ,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,MAAM,CAC1B,qFAAqF;IACnF,6BAA6B;IAC7B,yBAAyB;IACzB,2EAA2E,EAC7E,IAAI,CACL,CAAC;AAEF,+EAA+E;AAC/E,6EAA6E;AAC7E,kFAAkF;AAClF,wEAAwE;AACxE,mFAAmF;AACnF,oFAAoF;AACpF,uFAAuF;AACvF,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IACtD,SAAS;IACT,SAAS;IACT,OAAO;IACP,OAAO;IACP,aAAa;IACb,UAAU;IACV,UAAU;IACV,qBAAqB;CACtB,CAAC,CAAC;AAEH,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,IAAa,EAAE,GAAa;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC1B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,CAAC;qBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5B,KAAK,MAAM,IAAI,IAAI,CAAC;wBAAE,IAAI,OAAO,IAAI,KAAK,QAAQ;4BAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrE,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,KAAK,MAAM,IAAI,IAAI,CAAC;oBAAE,IAAI,OAAO,IAAI,KAAK,QAAQ;wBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;qCAEqC;AACrC,MAAM,UAAU,mBAAmB,CAAC,WAAoC;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mcp-index/sdk",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.2",
|
|
4
4
|
"description": "Pre-flight MCP tool-contract drift interceptor — one-line wrap() over an MCP client session that HOLDs a tool call before your agent runs it when the contract drifted from your pin. No credential handling.",
|
|
5
5
|
"license": "PolyForm-Noncommercial-1.0.0",
|
|
6
6
|
"author": "Bhartis LLC",
|