@mcp-shark/mcp-shark 1.5.13 → 1.6.0

package/core/cli/symbols.js

@@ -0,0 +1,16 @@
+/**
+ * CLI Symbol Vocabulary
+ * Geometric symbols — consistent across all output.
+ * Inspired by Biome/Astro/@clack aesthetic.
+ */
+
+export const S = {
+  pass: '◇',
+  fail: '◆',
+  warn: '▲',
+  info: '│',
+  dot: '·',
+  bar: '─',
+  arrow: '→',
+  pointer: '▸',
+};

package/core/container/DependencyContainer.js

@@ -33,6 +33,7 @@ import {
   StatisticsService,
   TokenService,
   TrafficAnalysisService,
+  TrafficToxicFlowService,
   YaraEngineService,
 } from '#core/services/index.js';
 import { ConfigParserFactory } from '#core/services/parsers/ConfigParserFactory.js';
@@ -160,10 +161,12 @@ export class DependencyContainer {
         this._services.yaraEngine,
         libs.logger
       );
+      this._services.trafficToxicFlow = new TrafficToxicFlowService(repos.packet, libs.logger);
       this._services.trafficAnalysis = new TrafficAnalysisService(
         this._services.staticRules,
         repos.securityFindings,
-        libs.logger
+        libs.logger,
+        this._services.trafficToxicFlow
       );
       this._services.rulesManager = new RulesManagerService(
         repos.securityRules,

package/core/repositories/PacketRepository.js

@@ -234,4 +234,20 @@ export class PacketRepository {
     const stmt = this.db.prepare('SELECT MAX(timestamp_ns) as max_ts FROM packets');
     return stmt.get();
   }
+
+  /**
+   * Response packets whose JSON-RPC result likely includes a tools array (tools/list success).
+   * Used to replay cross-server toxic-flow analysis from captured proxy traffic.
+   */
+  listResponsesWithToolsList() {
+    const stmt = this.db.prepare(`
+      SELECT frame_number, session_id, remote_address, jsonrpc_result, body_json, body_raw, timestamp_ns
+      FROM packets
+      WHERE direction = 'response'
+        AND jsonrpc_result IS NOT NULL
+        AND jsonrpc_result LIKE '%"tools"%'
+      ORDER BY timestamp_ns ASC
+    `);
+    return stmt.all();
+  }
 }

package/core/services/AuditService.js

@@ -97,6 +97,7 @@ export class AuditService {
           frameNumber: result.frameNumber,
           body: options.body,
           sessionId: result.sessionId,
+          mcpServerName: options.remoteAddress || null,
         });
       } catch (error) {
         // Log but don't fail the request
@@ -172,6 +173,7 @@ export class AuditService {
           frameNumber: result.frameNumber,
           body: options.body,
           sessionId: result.sessionId,
+          mcpServerName: options.remoteAddress || null,
         });
       } catch (error) {
         // Log but don't fail the response

package/core/services/security/StaticRulesService.js

@@ -1,9 +1,72 @@
 /**
  * Static Rules Service
- * Executes pattern-based security rules against MCP server definitions and traffic
+ * Executes pattern-based security rules against MCP server definitions and traffic.
+ *
+ * Combines two rule sources:
+ *   1. JS plugin rules (structural/scored — from rules/index.js)
+ *   2. Declarative JSON rule packs (pattern-based — from DeclarativeRuleEngine)
  */
+import { loadDeclarativeRules } from '#core/cli/DeclarativeRuleEngine.js';
 import { getAllRuleMetadata, getEnabledRules } from './rules/index.js';
 
+let cachedCombinedRules = null;
+
+/**
+ * Clear cached combined rules (e.g. after downloading new declarative packs, or before watch re-scan).
+ */
+export function resetStaticRulesCache() {
+  cachedCombinedRules = null;
+}
+
+/**
+ * Load and cache the combined set of JS plugin + declarative rules.
+ */
+function getCombinedRules() {
+  if (cachedCombinedRules) {
+    return cachedCombinedRules;
+  }
+
+  const jsRules = getEnabledRules();
+  const declarativeRules = loadDeclarativeRules().map((rule) => ({
+    id: rule.ruleMetadata.id,
+    ...rule.ruleMetadata,
+    analyzeTool: rule.analyzeTool,
+    analyzePrompt: rule.analyzePrompt,
+    analyzeResource: rule.analyzeResource,
+    analyzePacket: rule.analyzePacket,
+  }));
+
+  const ruleMap = new Map();
+  for (const rule of jsRules) {
+    ruleMap.set(rule.id, rule);
+  }
+  for (const rule of declarativeRules) {
+    ruleMap.set(rule.id, rule);
+  }
+
+  cachedCombinedRules = [...ruleMap.values()];
+  return cachedCombinedRules;
+}
+
+/**
+ * Get combined metadata from JS plugins + declarative packs.
+ */
+function getCombinedMetadata() {
+  const jsMetadata = getAllRuleMetadata();
+  const declarativeRules = loadDeclarativeRules();
+  const declarativeMetadata = declarativeRules.map((r) => r.ruleMetadata);
+
+  const metaMap = new Map();
+  for (const m of jsMetadata) {
+    metaMap.set(m.id, m);
+  }
+  for (const m of declarativeMetadata) {
+    metaMap.set(m.id, m);
+  }
+
+  return [...metaMap.values()];
+}
+
 export class StaticRulesService {
   constructor(logger) {
     this.logger = logger;
@@ -13,7 +76,7 @@ export class StaticRulesService {
    * Get all available rule metadata
    */
   getRuleMetadata() {
-    return getAllRuleMetadata();
+    return getCombinedMetadata();
   }
 
   /**
@@ -21,7 +84,7 @@ export class StaticRulesService {
    */
   analyzeTool(tool, serverName = null) {
     const findings = [];
-    const rules = getEnabledRules();
+    const rules = getCombinedRules();
 
     for (const rule of rules) {
       try {
@@ -49,7 +112,7 @@ export class StaticRulesService {
    */
   analyzePrompt(prompt, serverName = null) {
     const findings = [];
-    const rules = getEnabledRules();
+    const rules = getCombinedRules();
 
     for (const rule of rules) {
       try {
@@ -77,7 +140,7 @@ export class StaticRulesService {
    */
   analyzeResource(resource, serverName = null) {
     const findings = [];
-    const rules = getEnabledRules();
+    const rules = getCombinedRules();
 
     for (const rule of rules) {
       try {
@@ -105,7 +168,7 @@ export class StaticRulesService {
    */
   analyzePacket(packet, sessionId = null) {
     const findings = [];
-    const rules = getEnabledRules();
+    const rules = getCombinedRules();
 
     for (const rule of rules) {
       try {
@@ -136,21 +199,18 @@ export class StaticRulesService {
     const serverName = serverConfig.name || 'unknown';
     const findings = [];
 
-    // Analyze tools
     if (serverConfig.tools && Array.isArray(serverConfig.tools)) {
       for (const tool of serverConfig.tools) {
         findings.push(...this.analyzeTool(tool, serverName));
       }
     }
 
-    // Analyze prompts
     if (serverConfig.prompts && Array.isArray(serverConfig.prompts)) {
       for (const prompt of serverConfig.prompts) {
         findings.push(...this.analyzePrompt(prompt, serverName));
       }
     }
 
-    // Analyze resources
     if (serverConfig.resources && Array.isArray(serverConfig.resources)) {
       for (const resource of serverConfig.resources) {
         findings.push(...this.analyzeResource(resource, serverName));
@@ -196,22 +256,18 @@ export class StaticRulesService {
     };
 
     for (const finding of findings) {
-      // By severity
       if (summary.bySeverity[finding.severity] !== undefined) {
         summary.bySeverity[finding.severity]++;
       }
 
-      // By OWASP ID
       if (finding.owasp_id) {
         summary.byOwasp[finding.owasp_id] = (summary.byOwasp[finding.owasp_id] || 0) + 1;
       }
 
-      // By server
       if (finding.server_name) {
         summary.byServer[finding.server_name] = (summary.byServer[finding.server_name] || 0) + 1;
       }
 
-      // By type
       if (summary.byType[finding.finding_type] !== undefined) {
         summary.byType[finding.finding_type]++;
       }

package/core/services/security/TrafficAnalysisService.js

@@ -4,10 +4,16 @@
  * Hooks into the audit logging pipeline
  */
 export class TrafficAnalysisService {
-  constructor(staticRulesService, securityFindingsRepository, logger) {
+  constructor(
+    staticRulesService,
+    securityFindingsRepository,
+    logger,
+    trafficToxicFlowService = null
+  ) {
     this.staticRulesService = staticRulesService;
     this.findingsRepository = securityFindingsRepository;
     this.logger = logger;
+    this.trafficToxicFlowService = trafficToxicFlowService;
     this.enabled = true;
   }
 
@@ -96,6 +102,18 @@ export class TrafficAnalysisService {
         );
       }
 
+      if (this.trafficToxicFlowService) {
+        try {
+          this.trafficToxicFlowService.ingestFromTrafficResponse({
+            mcpServerName: packetData.mcpServerName ?? null,
+            sessionId: packetData.sessionId ?? null,
+            body: packetData.body,
+          });
+        } catch (err) {
+          this.logger?.error({ error: err.message }, 'Traffic toxic flow ingest failed');
+        }
+      }
+
       return findings;
     } catch (error) {
       this.logger?.error({ error: error.message }, 'Error analyzing response packet');

package/core/services/security/TrafficToxicFlowService.js

@@ -0,0 +1,154 @@
+/**
+ * Cross-server toxic-flow analysis from observed MCP traffic (tools/list responses).
+ * Complements CLI static scan: same analyzeToxicFlows heuristics, fed by proxy captures.
+ */
+import { analyzeToxicFlows } from '#core/cli/ToxicFlowAnalyzer.js';
+import {
+  toolsFromJsonrpcResultString,
+  toolsFromTrafficResponseBody,
+} from './toolsListFromTrafficParser.js';
+
+const TRAFFIC_IDE = 'Traffic';
+const DEBOUNCE_MS = 400;
+
+function serverKey(mcpServerName, sessionId) {
+  if (mcpServerName && String(mcpServerName).trim()) {
+    return String(mcpServerName).trim();
+  }
+  if (sessionId && String(sessionId).trim()) {
+    return `session:${String(sessionId).trim()}`;
+  }
+  return null;
+}
+
+export class TrafficToxicFlowService {
+  constructor(packetRepository, logger) {
+    this.packetRepository = packetRepository;
+    this.logger = logger;
+    /** @type {Map<string, { tools: object[], updatedAt: number }>} */
+    this._byServer = new Map();
+    this._debounceTimer = null;
+    this._lastFlows = [];
+    this._lastComputedAt = null;
+    this._lastReplayPacketCount = 0;
+  }
+
+  /**
+   * Ingest a proxied JSON-RPC response (live path).
+   * @param {{ mcpServerName?: string|null, sessionId?: string|null, body?: unknown }} packetData
+   */
+  ingestFromTrafficResponse(packetData) {
+    const tools = toolsFromTrafficResponseBody(packetData?.body);
+    if (!tools?.length) {
+      return;
+    }
+    const key = serverKey(packetData?.mcpServerName, packetData?.sessionId);
+    if (!key) {
+      this.logger?.debug?.('Traffic toxic flow: skip tools/list — no server name or session');
+      return;
+    }
+    this._byServer.set(key, { tools, updatedAt: Date.now() });
+    this._scheduleRecompute();
+  }
+
+  _scheduleRecompute() {
+    if (this._debounceTimer) {
+      clearTimeout(this._debounceTimer);
+    }
+    this._debounceTimer = setTimeout(() => {
+      this._debounceTimer = null;
+      this._recomputeNow();
+    }, DEBOUNCE_MS);
+  }
+
+  _serversForAnalyzer() {
+    const servers = [];
+    for (const [name, entry] of this._byServer.entries()) {
+      servers.push({
+        name,
+        ide: TRAFFIC_IDE,
+        config: {},
+        tools: entry.tools,
+      });
+    }
+    return servers;
+  }
+
+  _recomputeNow() {
+    const servers = this._serversForAnalyzer();
+    this._lastFlows = servers.length >= 2 ? analyzeToxicFlows(servers) : [];
+    this._lastComputedAt = Date.now();
+    this.logger?.debug?.(
+      { serverCount: servers.length, flowCount: this._lastFlows.length },
+      'Traffic toxic flows recomputed'
+    );
+  }
+
+  /**
+   * Batch replay: rebuild registry from sqlite packets, then recompute.
+   * @returns {{ packetRows: number, serverCount: number, flowCount: number }}
+   */
+  rebuildFromDatabase() {
+    if (!this.packetRepository?.listResponsesWithToolsList) {
+      this.logger?.warn?.('Traffic toxic flow replay: packet repository unavailable');
+      return { packetRows: 0, serverCount: 0, flowCount: 0 };
+    }
+    const rows = this.packetRepository.listResponsesWithToolsList();
+    this._byServer.clear();
+    this._lastReplayPacketCount = rows.length;
+
+    for (const row of rows) {
+      let tools = toolsFromJsonrpcResultString(row.jsonrpc_result);
+      if (!tools?.length) {
+        tools = toolsFromTrafficResponseBody(row.body_json || row.body_raw);
+      }
+      if (!tools?.length) {
+        continue;
+      }
+      const key = serverKey(row.remote_address, row.session_id);
+      if (!key) {
+        continue;
+      }
+      this._byServer.set(key, { tools, updatedAt: Date.now() });
+    }
+
+    this._recomputeNow();
+    return {
+      packetRows: rows.length,
+      serverCount: this._byServer.size,
+      flowCount: this._lastFlows.length,
+    };
+  }
+
+  getSnapshot() {
+    const servers = [];
+    for (const [name, entry] of this._byServer.entries()) {
+      servers.push({
+        name,
+        toolCount: entry.tools.length,
+        updatedAt: entry.updatedAt,
+      });
+    }
+    return {
+      success: true,
+      toxicFlows: this._lastFlows,
+      servers,
+      computedAt: this._lastComputedAt,
+      lastReplayPacketCount: this._lastReplayPacketCount,
+      note:
+        'Heuristic cross-server pairs from tools seen in tools/list traffic (HTTP proxy). ' +
+        'Not runtime taint tracking. Requires at least two distinct server keys and overlapping capability rules.',
+    };
+  }
+
+  clear() {
+    this._byServer.clear();
+    this._lastFlows = [];
+    this._lastComputedAt = null;
+    this._lastReplayPacketCount = 0;
+    if (this._debounceTimer) {
+      clearTimeout(this._debounceTimer);
+      this._debounceTimer = null;
+    }
+  }
+}

package/core/services/security/index.js

@@ -2,9 +2,10 @@
  * Security services exports
  * All security-related services for OWASP vulnerability detection
  */
-export { StaticRulesService } from './StaticRulesService.js';
+export { StaticRulesService, resetStaticRulesCache } from './StaticRulesService.js';
 export { SecurityDetectionService } from './SecurityDetectionService.js';
 export { TrafficAnalysisService } from './TrafficAnalysisService.js';
+export { TrafficToxicFlowService } from './TrafficToxicFlowService.js';
 export { YaraEngineService } from './YaraEngineService.js';
 export { RulesManagerService } from './RulesManagerService.js';
 export * from './YaraMatchConverter.js';

package/core/services/security/rules/index.js

@@ -1,71 +1,37 @@
 /**
- * Static security rules index
+ * Static security rules index — AUTO-GENERATED
+ * Do not edit manually. Run: npm run generate:rules
+ *
  * Exports all OWASP MCP Top 10 + Agentic Security + General security rules
  */
 
-// MCP OWASP Top 10 Rules
-import * as mcp01 from './scans/mcp01TokenMismanagement.js';
-import * as mcp02 from './scans/mcp02ScopeCreep.js';
-import * as mcp03 from './scans/mcp03ToolPoisoning.js';
-import * as mcp04 from './scans/mcp04SupplyChain.js';
-import * as mcp05 from './scans/mcp05CommandInjection.js';
-import * as mcp06 from './scans/mcp06PromptInjection.js';
-import * as mcp07 from './scans/mcp07InsufficientAuth.js';
-import * as mcp08 from './scans/mcp08LackAudit.js';
-import * as mcp09 from './scans/mcp09ShadowServers.js';
-import * as mcp10 from './scans/mcp10ContextInjection.js';
-
-// Agentic Security Initiative (ASI) Rules
-import * as asi01 from './scans/agentic01GoalHijack.js';
-import * as asi02 from './scans/agentic02ToolMisuse.js';
-import * as asi03 from './scans/agentic03IdentityAbuse.js';
-import * as asi04 from './scans/agentic04SupplyChain.js';
-import * as asi05 from './scans/agentic05RCE.js';
-import * as asi06 from './scans/agentic06MemoryPoisoning.js';
-import * as asi07 from './scans/agentic07InsecureCommunication.js';
-import * as asi08 from './scans/agentic08CascadingFailures.js';
-import * as asi09 from './scans/agentic09TrustExploitation.js';
-import * as asi10 from './scans/agentic10RogueAgent.js';
-
-// General Security Rules
-import * as cmdInj from './scans/commandInjection.js';
-import * as crossServer from './scans/crossServerShadowing.js';
-import * as secrets from './scans/hardcodedSecrets.js';
-import * as nameAmbig from './scans/toolNameAmbiguity.js';
+import * as agentic05RCE from './scans/agentic05RCE.js';
+import * as commandInjection from './scans/commandInjection.js';
+import * as configPermissions from './scans/configPermissions.js';
+import * as crossServerShadowing from './scans/crossServerShadowing.js';
+import * as duplicateToolNames from './scans/duplicateToolNames.js';
+import * as insecureTransport from './scans/insecureTransport.js';
+import * as mcp05CommandInjection from './scans/mcp05CommandInjection.js';
+import * as missingContainment from './scans/missingContainment.js';
+import * as shellEnvInjection from './scans/shellEnvInjection.js';
+import * as toolNameAmbiguity from './scans/toolNameAmbiguity.js';
+import * as unsafeDefaults from './scans/unsafeDefaults.js';
 
 /**
  * All available static rules with their analysis functions
  */
 export const staticRules = {
-  // MCP OWASP Top 10
-  'mcp01-token-mismanagement': mcp01,
-  'mcp02-scope-creep': mcp02,
-  'mcp03-tool-poisoning': mcp03,
-  'mcp04-supply-chain': mcp04,
-  'mcp05-command-injection': mcp05,
-  'mcp06-prompt-injection': mcp06,
-  'mcp07-insufficient-auth': mcp07,
-  'mcp08-lack-audit': mcp08,
-  'mcp09-shadow-servers': mcp09,
-  'mcp10-context-injection': mcp10,
-
-  // Agentic Security Initiative
-  'asi01-goal-hijack': asi01,
-  'asi02-tool-misuse': asi02,
-  'asi03-identity-abuse': asi03,
-  'asi04-supply-chain': asi04,
-  'asi05-rce': asi05,
-  'asi06-memory-poisoning': asi06,
-  'asi07-insecure-communication': asi07,
-  'asi08-cascading-failures': asi08,
-  'asi09-trust-exploitation': asi09,
-  'asi10-rogue-agent': asi10,
-
-  // General Security
-  'command-injection': cmdInj,
-  'cross-server-shadowing': crossServer,
-  'hardcoded-secrets': secrets,
-  'tool-name-ambiguity': nameAmbig,
+  [agentic05RCE.ruleMetadata.id]: agentic05RCE,
+  [commandInjection.ruleMetadata.id]: commandInjection,
+  [configPermissions.ruleMetadata.id]: configPermissions,
+  [crossServerShadowing.ruleMetadata.id]: crossServerShadowing,
+  [duplicateToolNames.ruleMetadata.id]: duplicateToolNames,
+  [insecureTransport.ruleMetadata.id]: insecureTransport,
+  [mcp05CommandInjection.ruleMetadata.id]: mcp05CommandInjection,
+  [missingContainment.ruleMetadata.id]: missingContainment,
+  [shellEnvInjection.ruleMetadata.id]: shellEnvInjection,
+  [toolNameAmbiguity.ruleMetadata.id]: toolNameAmbiguity,
+  [unsafeDefaults.ruleMetadata.id]: unsafeDefaults,
 };
 
 /**

package/core/services/security/rules/scans/configPermissions.js

@@ -0,0 +1,91 @@
+/**
+ * Config File Permissions Check
+ * Detects world-readable MCP config files that may expose secrets.
+ * Only applicable on Unix-like systems.
+ */
+import { createRuleAdapter } from '../utils/adapter.js';
+
+const RULE_ID = 'config-permissions';
+const OWASP_ID = 'MCP01';
+const RECOMMENDATION =
+  'Set config file permissions to 600 (owner read/write only). Run: npx mcp-shark scan --fix';
+
+export function scanConfigPermissions(_mcpData = {}) {
+  return {
+    toolFindings: [],
+    resourceFindings: [],
+    promptFindings: [],
+    notablePatterns: [],
+    recommendations: [RECOMMENDATION],
+  };
+}
+
+/**
+ * Analyze a config file path for permission issues
+ * Called directly by ScanService, not through the adapter
+ * @param {string} configPath - Path to the config file
+ * @param {string} permissions - Octal permission string (e.g., '644')
+ * @returns {Array} Findings
+ */
+export function analyzeConfigPermissions(configPath, permissions) {
+  if (process.platform === 'win32') {
+    return [];
+  }
+  if (!permissions) {
+    return [];
+  }
+
+  const perms = Number.parseInt(permissions, 8);
+  const worldReadable = (perms & 0o004) !== 0;
+  const groupReadable = (perms & 0o040) !== 0;
+
+  const findings = [];
+
+  if (worldReadable) {
+    findings.push({
+      rule_id: RULE_ID,
+      severity: 'high',
+      owasp_id: OWASP_ID,
+      title: `Config file is world-readable (${permissions})`,
+      description: `${configPath} has permissions ${permissions} — any user on this system can read your MCP secrets.`,
+      recommendation: RECOMMENDATION,
+      config_path: configPath,
+      confidence: 'definite',
+      fixable: true,
+      fix_type: 'chmod',
+      fix_data: { oldPerms: permissions },
+    });
+  } else if (groupReadable) {
+    findings.push({
+      rule_id: RULE_ID,
+      severity: 'medium',
+      owasp_id: OWASP_ID,
+      title: `Config file is group-readable (${permissions})`,
+      description: `${configPath} has permissions ${permissions} — group members can read your MCP secrets.`,
+      recommendation: RECOMMENDATION,
+      config_path: configPath,
+      confidence: 'probable',
+      fixable: true,
+      fix_type: 'chmod',
+      fix_data: { oldPerms: permissions },
+    });
+  }
+
+  return findings;
+}
+
+const adapter = createRuleAdapter(scanConfigPermissions, RULE_ID, OWASP_ID, RECOMMENDATION);
+export const analyzeTool = adapter.analyzeTool;
+export const analyzePrompt = adapter.analyzePrompt;
+export const analyzeResource = adapter.analyzeResource;
+export const analyzePacket = adapter.analyzePacket;
+
+export const ruleMetadata = {
+  id: RULE_ID,
+  name: 'Config File Permissions',
+  owasp_id: OWASP_ID,
+  severity: 'high',
+  description: 'Detects world-readable or group-readable MCP configuration files.',
+  source: 'static',
+  type: 'general-security',
+};