@mcp-shark/mcp-shark 1.5.13 → 1.6.0

package/core/cli/data/tool-classifications.json

@@ -0,0 +1,111 @@
+{
+  "mcp-server-github": {
+    "get_issue": "ingests_untrusted",
+    "get_pull_request": "ingests_untrusted",
+    "search_issues": "ingests_untrusted",
+    "list_issues": "ingests_untrusted",
+    "search_code": "ingests_untrusted",
+    "get_file_contents": "reads_secrets",
+    "create_pull_request": "writes_code",
+    "push_files": "writes_code",
+    "create_issue": "writes_code",
+    "update_issue": "writes_code",
+    "create_or_update_file": "writes_code",
+    "fork_repository": "writes_code",
+    "create_branch": "writes_code"
+  },
+  "mcp-server-slack": {
+    "list_messages": "ingests_untrusted",
+    "get_channel_history": "ingests_untrusted",
+    "search_messages": "ingests_untrusted",
+    "send_message": "sends_external",
+    "post_message": "sends_external",
+    "upload_file": "sends_external"
+  },
+  "mcp-server-filesystem": {
+    "read_file": "reads_secrets",
+    "read_multiple_files": "reads_secrets",
+    "list_directory": "reads_secrets",
+    "search_files": "reads_secrets",
+    "get_file_info": "reads_secrets",
+    "write_file": "writes_code",
+    "create_directory": "writes_code",
+    "move_file": "writes_code",
+    "edit_file": "writes_code"
+  },
+  "mcp-server-git": {
+    "git_log": "reads_secrets",
+    "git_diff": "reads_secrets",
+    "git_status": "reads_secrets",
+    "git_show": "reads_secrets",
+    "git_commit": "writes_code",
+    "git_add": "writes_code",
+    "git_push": "writes_code",
+    "git_init": "writes_code"
+  },
+  "mcp-server-postgres": {
+    "query": "reads_secrets",
+    "list_tables": "reads_secrets",
+    "describe_table": "reads_secrets"
+  },
+  "mcp-server-sqlite": {
+    "read_query": "reads_secrets",
+    "write_query": "writes_code",
+    "list_tables": "reads_secrets"
+  },
+  "mcp-server-fetch": {
+    "fetch": "ingests_untrusted"
+  },
+  "mcp-server-brave-search": {
+    "brave_web_search": "ingests_untrusted",
+    "brave_local_search": "ingests_untrusted"
+  },
+  "mcp-server-puppeteer": {
+    "navigate": "ingests_untrusted",
+    "screenshot": "ingests_untrusted",
+    "click": "ingests_untrusted",
+    "evaluate": "writes_code"
+  },
+  "@playwright/mcp": {
+    "browser_navigate": "ingests_untrusted",
+    "browser_snapshot": "ingests_untrusted",
+    "browser_click": "ingests_untrusted",
+    "browser_type": "ingests_untrusted"
+  },
+  "mcp-server-kubernetes": {
+    "kubectl_get": "reads_secrets",
+    "kubectl_apply": "modifies_infra",
+    "kubectl_delete": "modifies_infra",
+    "kubectl_scale": "modifies_infra",
+    "kubectl_patch": "modifies_infra"
+  },
+  "heroku-mcp-server": {
+    "list_apps": "reads_secrets",
+    "transfer_app": "modifies_infra",
+    "scale_formation": "modifies_infra",
+    "create_app": "modifies_infra",
+    "delete_app": "modifies_infra"
+  },
+  "mcp-server-docker": {
+    "list_containers": "reads_secrets",
+    "container_run": "modifies_infra",
+    "container_stop": "modifies_infra",
+    "container_remove": "modifies_infra",
+    "image_pull": "modifies_infra"
+  },
+  "google-docs-mcp": {
+    "get_document": "ingests_untrusted",
+    "search_documents": "ingests_untrusted",
+    "create_document": "writes_code"
+  },
+  "jira-mcp-server": {
+    "get_issue": "ingests_untrusted",
+    "search_issues": "ingests_untrusted",
+    "get_ticket": "ingests_untrusted",
+    "create_issue": "writes_code"
+  },
+  "mcp-server-memory": {
+    "store": "writes_code",
+    "retrieve": "reads_secrets"
+  }
+}

package/core/cli/data/toxic-flow-rules.json

@@ -0,0 +1,47 @@
+[
+  {
+    "source": "ingests_untrusted",
+    "target": "writes_code",
+    "risk": "HIGH",
+    "title": "Prompt injection \u2192 code modification",
+    "scenario": "A {source_ide} message with prompt injection processed by {source} could cause your agent to push malicious code via {target}.",
+    "catalog": "\u00a71.3, \u00a71.10, \u00a71.12",
+    "owasp": "MCP03 + MCP10"
+  },
+  {
+    "source": "ingests_untrusted",
+    "target": "sends_external",
+    "risk": "HIGH",
+    "title": "Prompt injection \u2192 data exfiltration",
+    "scenario": "Untrusted content ingested by {source} could instruct the agent to exfiltrate sensitive data through {target}.",
+    "catalog": "\u00a71.2",
+    "owasp": "MCP03 + MCP06"
+  },
+  {
+    "source": "reads_secrets",
+    "target": "sends_external",
+    "risk": "HIGH",
+    "title": "Secret theft via external channel",
+    "scenario": "Your agent can read sensitive files via {source} and exfiltrate them through {target}.",
+    "catalog": "\u00a71.1, \u00a71.14",
+    "owasp": "MCP01 + MCP10"
+  },
+  {
+    "source": "ingests_untrusted",
+    "target": "modifies_infra",
+    "risk": "HIGH",
+    "title": "Prompt injection \u2192 infrastructure takeover",
+    "scenario": "Attacker-controlled content from {source} could cause infrastructure changes via {target}.",
+    "catalog": "\u00a71.13",
+    "owasp": "MCP03 + MCP05"
+  },
+  {
+    "source": "reads_secrets",
+    "target": "ingests_untrusted",
+    "risk": "MEDIUM",
+    "title": "Sensitive data leakage to untrusted channel",
+    "scenario": "Sensitive data from {source} could leak into context shared with untrusted content from {target}.",
+    "catalog": "\u00a71.7",
+    "owasp": "MCP10"
+  }
+]

package/core/cli/index.js

@@ -0,0 +1,23 @@
+/**
+ * CLI module barrel file
+ */
+export { applyFixes, renderFixResults } from './AutoFixEngine.js';
+export { scanIdeConfigs, getAllServers } from './ConfigScanner.js';
+export { loadBuiltinJson, loadUserYamlList, loadUserYamlMap } from './DataLoader.js';
+export { loadDeclarativeRules } from './DeclarativeRuleEngine.js';
+export { executeDoctor } from './DoctorCommand.js';
+export { applyFix, createEnvExample, undoFixes } from './FixHandlers.js';
+export { generateHtmlReport } from './HtmlReportGenerator.js';
+export { executeList } from './ListCommand.js';
+export { computeDiff, renderDiff, hashToolDefinition } from './LockDiffEngine.js';
+export { executeLock, executeLockVerify, executeDiff } from './LockCommand.js';
+export { executeScan } from './ScanCommand.js';
+export { runScan } from './ScanService.js';
+export { detectHardcodedSecrets } from './SecretDetector.js';
+export { S } from './symbols.js';
+export { calculateSharkScore, countBySeverity } from './SharkScoreCalculator.js';
+export { analyzeToxicFlows } from './ToxicFlowAnalyzer.js';
+export { executeUpdateRules } from './UpdateCommand.js';
+export { executeWatch } from './WatchCommand.js';
+export { generateWalkthroughs } from './WalkthroughGenerator.js';
+export { loadYamlRules, applyYamlRules } from './YamlRuleEngine.js';

package/core/cli/output/Banner.js

@@ -0,0 +1,52 @@
+/**
+ * CLI banner — clean, text-only
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import kleur from 'kleur';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const rootDir = resolve(__dirname, '..', '..', '..');
+
+function getVersion() {
+  try {
+    const pkgPath = join(rootDir, 'package.json');
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+    return pkg.version;
+  } catch (_err) {
+    return 'unknown';
+  }
+}
+
+/**
+ * Display the scan banner — minimal, Biome-style
+ */
+export function displayScanBanner() {
+  const version = getVersion();
+
+  console.log('');
+  console.log(`  ${kleur.bold('mcp-shark')} ${kleur.dim(`v${version}`)}`);
+  console.log(kleur.dim('  ─────────────────────────────────────'));
+  console.log('');
+}
+
+/**
+ * Display the serve banner (existing ASCII art style)
+ */
+export function displayServeBanner() {
+  const version = getVersion();
+  const banner = `
+   ███╗   ███╗ ██████╗ ██████╗      ███████╗██╗  ██╗ █████╗ ██████╗ ██╗  ██╗
+   ████╗ ████║██╔════╝██╔══██╗     ██╔════╝██║  ██║██╔══██╗██╔══██╗██║ ██╔╝
+   ██╔████╔██║██║     ██████╔╝     ███████╗███████║███████║██████╔╝█████╔╝ 
+   ██║╚██╔╝██║██║     ██╔═══╝      ╚════██║██╔══██║██╔══██║██╔══██╗██╔═██╗ 
+   ██║ ╚═╝ ██║╚██████╗██║          ███████║██║  ██║██║  ██║██║  ██║██║  ██╗
+   ╚═╝     ╚═╝ ╚═════╝╚═╝          ╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝
+   
+   Aggregate multiple MCP servers into a unified interface
+   Version: ${version} | Homepage: https://mcpshark.sh
+`;
+  console.log(banner);
+}

package/core/cli/output/Formatter.js

@@ -0,0 +1,183 @@
+/**
+ * Terminal output formatter for scan results
+ * Renders findings, toxic flows, and summaries with colors
+ */
+import kleur from 'kleur';
+import { S } from '../symbols.js';
+
+const SEVERITY_COLORS = {
+  critical: (text) => kleur.bgRed().white().bold(` ${text} `),
+  high: (text) => kleur.red().bold(text),
+  medium: (text) => kleur.yellow(text),
+  low: (text) => kleur.blue(text),
+};
+
+const SEVERITY_LABELS = {
+  critical: 'CRIT',
+  high: 'HIGH',
+  medium: 'MED ',
+  low: 'LOW ',
+};
+
+/**
+ * Format a single finding for terminal output
+ */
+export function formatFinding(finding) {
+  const severity = (finding.severity || finding.risk_level || 'medium').toLowerCase();
+  const label = SEVERITY_LABELS[severity] || 'INFO';
+  const colorFn = SEVERITY_COLORS[severity] || kleur.gray;
+  const confidence = finding.confidence === 'possible' ? 'advisory' : 'confirmed';
+  const confidenceColor = confidence === 'confirmed' ? kleur.white : kleur.gray;
+
+  const ruleId = finding.rule_id || finding.category || '';
+  const ruleDisplay = ruleId.toUpperCase().replace(/-/g, '').slice(0, 5);
+
+  const message = finding.title || finding.description || finding.message || '';
+
+  return `    ${colorFn(label)}  ${kleur.dim(ruleDisplay)}  ${message}  ${confidenceColor(confidence)}`;
+}
+
+/**
+ * Format findings grouped by server
+ */
+export function formatServerFindings(serverName, ideName, findings) {
+  const lines = [];
+  const header = kleur.bold(`  ${serverName}`) + kleur.dim(` (${ideName})`);
+  lines.push(header);
+
+  for (const finding of findings) {
+    lines.push(formatFinding(finding));
+  }
+
+  lines.push('');
+  return lines.join('\n');
+}
+
+/**
+ * Format clean servers summary
+ */
+export function formatCleanServers(cleanServerNames) {
+  if (cleanServerNames.length === 0) {
+    return '';
+  }
+  const names = cleanServerNames.join(', ');
+  return `  ${names} ${kleur.green(`${S.bar} clean ${S.pass}`)}\n`;
+}
+
+/**
+ * Format toxic flow section
+ */
+export function formatToxicFlows(flows) {
+  if (flows.length === 0) {
+    return '';
+  }
+
+  const lines = [];
+  lines.push(`  ${kleur.dim(S.bar.repeat(65))}`);
+  lines.push(`  ${kleur.bold('Toxic Flows')}`);
+  lines.push(`  ${kleur.dim(S.bar.repeat(65))}`);
+  lines.push('');
+
+  for (const flow of flows) {
+    const riskColor = flow.risk === 'HIGH' ? kleur.red : kleur.yellow;
+    lines.push(
+      `  ${riskColor(`${S.warn} ${flow.risk}`)}  ${kleur.bold(flow.source)} ${kleur.dim(S.arrow)} ${kleur.bold(flow.target)}`
+    );
+    lines.push(`    ${flow.scenario}`);
+    lines.push(`    ${kleur.dim(`(Catalog ${flow.catalog})`)}`);
+    lines.push('');
+  }
+
+  lines.push(`  ${kleur.dim(S.bar.repeat(65))}`);
+  return lines.join('\n');
+}
+
+/**
+ * Format the Shark Score display
+ */
+export function formatSharkScore(scoreResult) {
+  const { score, grade } = scoreResult;
+
+  const gradeColors = {
+    A: kleur.green,
+    B: kleur.green,
+    C: kleur.yellow,
+    D: kleur.red,
+    F: kleur.bgRed().white,
+  };
+
+  const colorFn = gradeColors[grade] || kleur.white;
+  return `  Shark Score: ${colorFn(`${score}/100 (${grade})`)}`;
+}
+
+/**
+ * Format the summary counts line
+ */
+export function formatSummaryCounts(counts, flowCount) {
+  const parts = [];
+  if (counts.critical > 0) {
+    parts.push(kleur.red(`${counts.critical} critical`));
+  }
+  if (counts.high > 0) {
+    parts.push(kleur.red(`${counts.high} high`));
+  }
+  if (counts.medium > 0) {
+    parts.push(kleur.yellow(`${counts.medium} medium`));
+  }
+  if (counts.low > 0) {
+    parts.push(kleur.blue(`${counts.low} low`));
+  }
+  if (flowCount > 0) {
+    parts.push(kleur.red(`${flowCount} toxic flows`));
+  }
+
+  if (parts.length === 0) {
+    return `  ${kleur.green(`${S.pass} No issues found`)}`;
+  }
+
+  return `  ${parts.join(kleur.dim(` ${S.dot} `))}`;
+}
+
+/**
+ * Format completion timing
+ */
+export function formatTiming(elapsedMs, serverCount, ruleCount, toolCount) {
+  const seconds = (elapsedMs / 1000).toFixed(1);
+  return kleur.dim(
+    `  Completed in ${seconds}s ${S.dot} ${serverCount} servers ${S.dot} ${ruleCount} rules ${S.dot} ${toolCount} tools checked`
+  );
+}
+
+/**
+ * Format next steps suggestions
+ */
+export function formatNextSteps(hasFixable, hasFlows) {
+  const lines = [];
+  lines.push('');
+  lines.push(kleur.dim('  Next steps:'));
+
+  if (hasFixable) {
+    lines.push(`    ${kleur.cyan('npx mcp-shark scan --fix')}          Auto-fix fixable issues`);
+  }
+  if (hasFlows) {
+    lines.push(`    ${kleur.cyan('npx mcp-shark scan --walkthrough')}  See full attack chains`);
+  }
+  lines.push(`    ${kleur.cyan('npx mcp-shark lock')}                Pin tool definitions`);
+
+  return lines.join('\n');
+}
+
+/**
+ * Format IDE discovery line
+ */
+export function formatIdeDiscovery(ideResults) {
+  const found = ideResults.filter((ide) => ide.found);
+  const names = found.map((ide) => ide.name);
+  const serverCount = found.reduce((sum, ide) => sum + ide.serverCount, 0);
+
+  if (names.length === 0) {
+    return `  ${kleur.yellow(`${S.warn} No MCP configurations found`)}`;
+  }
+
+  return kleur.dim(`  Scanning ${serverCount} servers across ${names.join(', ')}...`);
+}

package/core/cli/output/JsonFormatter.js

@@ -0,0 +1,106 @@
+/**
+ * JSON and SARIF output formatters for scan results
+ */
+
+/**
+ * Format scan results as JSON
+ */
+export function formatAsJson(scanResult) {
+  return JSON.stringify(scanResult, null, 2);
+}
+
+/**
+ * Format scan results as SARIF v2.1.0
+ * Static Analysis Results Interchange Format for CI/CD integration
+ */
+export function formatAsSarif(scanResult) {
+  const sarifRules = buildSarifRules(scanResult.findings);
+  const sarifResults = buildSarifResults(scanResult.findings);
+
+  const sarif = {
+    $schema:
+      'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json',
+    version: '2.1.0',
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: 'mcp-shark',
+            version: scanResult.version || '1.0.0',
+            informationUri: 'https://mcpshark.sh',
+            rules: sarifRules,
+          },
+        },
+        results: sarifResults,
+      },
+    ],
+  };
+
+  return JSON.stringify(sarif, null, 2);
+}
+
+/**
+ * Build SARIF rule descriptors from findings
+ */
+function buildSarifRules(findings) {
+  const ruleMap = new Map();
+
+  for (const finding of findings) {
+    const ruleId = finding.rule_id || finding.category || 'unknown';
+    if (ruleMap.has(ruleId)) {
+      continue;
+    }
+
+    ruleMap.set(ruleId, {
+      id: ruleId,
+      name: finding.title || ruleId,
+      shortDescription: {
+        text: finding.title || finding.description || ruleId,
+      },
+      defaultConfiguration: {
+        level: mapSeverityToSarif(finding.severity || finding.risk_level),
+      },
+    });
+  }
+
+  return [...ruleMap.values()];
+}
+
+/**
+ * Build SARIF result entries from findings
+ */
+function buildSarifResults(findings) {
+  return findings.map((finding) => ({
+    ruleId: finding.rule_id || finding.category || 'unknown',
+    level: mapSeverityToSarif(finding.severity || finding.risk_level),
+    message: {
+      text: finding.description || finding.title || finding.message || '',
+    },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: {
+            uri: finding.config_path || finding.server_name || 'unknown',
+          },
+        },
+      },
+    ],
+    properties: {
+      confidence: finding.confidence || 'probable',
+      serverName: finding.server_name || null,
+    },
+  }));
+}
+
+/**
+ * Map internal severity to SARIF level
+ */
+function mapSeverityToSarif(severity) {
+  const map = {
+    critical: 'error',
+    high: 'error',
+    medium: 'warning',
+    low: 'note',
+  };
+  return map[(severity || '').toLowerCase()] || 'warning';
+}

package/core/cli/output/index.js

@@ -0,0 +1,16 @@
+/**
+ * CLI output module barrel file
+ */
+export { displayScanBanner, displayServeBanner } from './Banner.js';
+export {
+  formatFinding,
+  formatServerFindings,
+  formatCleanServers,
+  formatToxicFlows,
+  formatSharkScore,
+  formatSummaryCounts,
+  formatTiming,
+  formatNextSteps,
+  formatIdeDiscovery,
+} from './Formatter.js';
+export { formatAsJson, formatAsSarif } from './JsonFormatter.js';

package/core/cli/secureRegistryFetch.js

@@ -0,0 +1,157 @@
+/**
+ * Hardened HTTP fetch for rule registry and pack downloads.
+ * - HTTPS only by default (HTTP only with MCP_SHARK_INSECURE_HTTP_REGISTRY=1)
+ * - No userinfo in URLs (prevents credential injection)
+ * - Manual redirect handling with re-validation each hop (mitigates redirect-to-internal SSRF)
+ * - Response size cap (mitigates memory exhaustion)
+ */
+import { createHash } from 'node:crypto';
+
+const MAX_REDIRECTS = 5;
+const DEFAULT_MAX_BYTES = 25 * 1024 * 1024;
+
+/**
+ * @param {string} urlString
+ * @returns {string} normalized href
+ */
+export function assertAllowedRegistryUrl(urlString) {
+  let parsed;
+  try {
+    parsed = new URL(urlString);
+  } catch {
+    throw new Error('Invalid URL');
+  }
+
+  const allowHttp = process.env.MCP_SHARK_INSECURE_HTTP_REGISTRY === '1';
+
+  if (parsed.protocol === 'https:') {
+    // ok
+  } else if (parsed.protocol === 'http:' && allowHttp) {
+    // lab / air-gapped mirrors only — explicit env required
+  } else {
+    throw new Error(
+      'Registry URLs must use HTTPS. For trusted internal HTTP mirrors only, set MCP_SHARK_INSECURE_HTTP_REGISTRY=1.'
+    );
+  }
+
+  if (!parsed.hostname) {
+    throw new Error('Registry URL must have a hostname');
+  }
+
+  if (parsed.username !== '' || parsed.password !== '') {
+    throw new Error('Registry URL must not embed credentials');
+  }
+
+  return parsed.href;
+}
+
+/**
+ * Fetch JSON with size limit and safe redirects.
+ * @param {string} initialUrl
+ * @param {number} [maxBytes]
+ * @returns {Promise<object>}
+ */
+export async function fetchUtf8Secure(initialUrl, maxBytes = DEFAULT_MAX_BYTES) {
+  let url = assertAllowedRegistryUrl(initialUrl);
+
+  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+    const response = await fetch(url, {
+      redirect: 'manual',
+      headers: {
+        Accept: 'application/json, text/plain;q=0.9, */*;q=0.8',
+        'User-Agent': 'mcp-shark-rule-update',
+      },
+    });
+
+    if (response.status >= 300 && response.status < 400) {
+      const location = response.headers.get('location');
+      if (!location || hop === MAX_REDIRECTS) {
+        throw new Error('Too many HTTP redirects or missing Location header');
+      }
+      url = assertAllowedRegistryUrl(new URL(location, url).href);
+      continue;
+    }
+
+    if (!response.ok) {
+      throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+    }
+
+    return readBodyWithLimit(response, maxBytes);
+  }
+
+  throw new Error('Redirect loop');
+}
+
+/**
+ * @param {string} initialUrl
+ * @param {number} [maxBytes]
+ * @returns {Promise<object>}
+ */
+export async function fetchJsonSecure(initialUrl, maxBytes = DEFAULT_MAX_BYTES) {
+  const text = await fetchUtf8Secure(initialUrl, maxBytes);
+  return JSON.parse(text);
+}
+
+/**
+ * @param {Response} response
+ * @param {number} maxBytes
+ * @returns {Promise<string>}
+ */
+async function readBodyWithLimit(response, maxBytes) {
+  if (!response.body) {
+    const text = await response.text();
+    if (Buffer.byteLength(text, 'utf8') > maxBytes) {
+      throw new Error('Response body exceeds size limit');
+    }
+    return text;
+  }
+
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+    total += value.length;
+    if (total > maxBytes) {
+      throw new Error('Response body exceeds size limit');
+    }
+    chunks.push(value);
+  }
+
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+const SAFE_PACK_ID = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
+
+/**
+ * @param {string} id
+ */
+export function assertSafePackId(id) {
+  if (typeof id !== 'string' || !SAFE_PACK_ID.test(id)) {
+    throw new Error(
+      'Pack id must be 1–128 chars: letters, digits, dot, underscore, hyphen; no path segments.'
+    );
+  }
+}
+
+/**
+ * @param {string} expectedHex
+ * @param {string} utf8Body
+ */
+export function assertSha256(expectedHex, utf8Body) {
+  if (!expectedHex || typeof expectedHex !== 'string') {
+    return;
+  }
+  const normalized = expectedHex.trim().toLowerCase();
+  if (!/^[a-f0-9]{64}$/.test(normalized)) {
+    throw new Error('Invalid sha256 format in manifest');
+  }
+  const actual = createHash('sha256').update(utf8Body, 'utf8').digest('hex');
+  if (actual !== normalized) {
+    throw new Error('Downloaded pack failed SHA-256 verification');
+  }
+}