@mcp-shark/mcp-shark 1.5.13 → 1.6.0

package/core/services/security/rules/scans/duplicateToolNames.js

@@ -0,0 +1,85 @@
+/**
+ * Duplicate Tool Names Detection (Config-Level)
+ * Detects tools with identical names across different servers,
+ * which enables cross-server shadowing attacks.
+ * Catalog reference: §1.4 (tool name collision)
+ */
+import { createRuleAdapter } from '../utils/adapter.js';
+
+const RULE_ID = 'duplicate-tool-names';
+const OWASP_ID = 'MCP09';
+const RECOMMENDATION =
+  'Rename tools to be unique across all servers, or isolate conflicting servers into separate agent sessions.';
+
+export function scanDuplicateToolNames(_mcpData = {}) {
+  return {
+    toolFindings: [],
+    resourceFindings: [],
+    promptFindings: [],
+    notablePatterns: [],
+    recommendations: [RECOMMENDATION],
+  };
+}
+
+/**
+ * Analyze all servers for duplicate tool names
+ * Called directly by ScanService with the full server list
+ * @param {Array} servers - Flat array of server objects
+ * @returns {Array} Findings for duplicate tool names
+ */
+export function analyzeAllServerToolNames(servers) {
+  const toolMap = new Map();
+
+  for (const server of servers) {
+    const tools = Array.isArray(server.tools) ? server.tools : [];
+    for (const tool of tools) {
+      const name = typeof tool === 'string' ? tool : tool?.name;
+      if (!name) {
+        continue;
+      }
+      if (!toolMap.has(name)) {
+        toolMap.set(name, []);
+      }
+      toolMap.get(name).push(server.name);
+    }
+  }
+
+  const findings = [];
+  for (const [toolName, serverNames] of toolMap) {
+    if (serverNames.length <= 1) {
+      continue;
+    }
+    const uniqueServers = [...new Set(serverNames)];
+    if (uniqueServers.length <= 1) {
+      continue;
+    }
+
+    findings.push({
+      rule_id: RULE_ID,
+      severity: 'high',
+      owasp_id: OWASP_ID,
+      title: `Duplicate tool "${toolName}" across ${uniqueServers.length} servers`,
+      description: `Tool "${toolName}" exists in ${uniqueServers.join(', ')}. An attacker could shadow one server's tool with another.`,
+      recommendation: RECOMMENDATION,
+      confidence: 'definite',
+    });
+  }
+
+  return findings;
+}
+
+const adapter = createRuleAdapter(scanDuplicateToolNames, RULE_ID, OWASP_ID, RECOMMENDATION);
+export const analyzeTool = adapter.analyzeTool;
+export const analyzePrompt = adapter.analyzePrompt;
+export const analyzeResource = adapter.analyzeResource;
+export const analyzePacket = adapter.analyzePacket;
+
+export const ruleMetadata = {
+  id: RULE_ID,
+  name: 'Duplicate Tool Names',
+  owasp_id: OWASP_ID,
+  severity: 'high',
+  description: 'Detects identical tool names across servers enabling shadowing attacks.',
+  source: 'static',
+  type: 'general-security',
+};

package/core/services/security/rules/scans/insecureTransport.js

@@ -0,0 +1,148 @@
+/**
+ * Insecure Transport Detection
+ * Detects MCP servers using HTTP instead of HTTPS, or SSE/WebSocket
+ * connections without TLS, exposing traffic to interception.
+ * Catalog reference: §1.7
+ */
+import { createRuleAdapter } from '../utils/adapter.js';
+import { toolToText } from '../utils/text.js';
+
+const RULE_ID = 'insecure-transport';
+const OWASP_ID = 'MCP07';
+const RECOMMENDATION =
+  'Use HTTPS/WSS for all remote MCP server connections. localhost HTTP is acceptable for local-only servers.';
+
+const HTTP_URL_IN_TEXT = /http:\/\/[^\s'"<>]+/gi;
+const WS_URL_IN_TEXT = /ws:\/\/[^\s'"<>]+/gi;
+
+/**
+ * True when URL host is loopback / local bind only (exact host match, not localhost.evil.com).
+ */
+function isLocalhostUrl(urlString) {
+  try {
+    const u = new URL(urlString);
+    const h = u.hostname.toLowerCase();
+    return (
+      h === 'localhost' || h === '127.0.0.1' || h === '0.0.0.0' || h === '[::1]' || h === '::1'
+    );
+  } catch {
+    return false;
+  }
+}
+
+function textHasNonLocalHttp(text) {
+  for (const m of text.matchAll(HTTP_URL_IN_TEXT)) {
+    if (!isLocalhostUrl(m[0])) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function textHasNonLocalWs(text) {
+  for (const m of text.matchAll(WS_URL_IN_TEXT)) {
+    if (!isLocalhostUrl(m[0])) {
+      return true;
+    }
+  }
+  return false;
+}
+
+export function scanInsecureTransport(mcpData = {}) {
+  const results = {
+    toolFindings: [],
+    resourceFindings: [],
+    promptFindings: [],
+    notablePatterns: [],
+    recommendations: [RECOMMENDATION],
+  };
+
+  for (const tool of mcpData.tools || []) {
+    const text = toolToText(tool);
+
+    if (textHasNonLocalHttp(text)) {
+      results.toolFindings.push({
+        issueType: 'Insecure Transport (HTTP)',
+        name: tool?.name || 'tool',
+        severity: 'medium',
+        reasons: [
+          `Tool "${tool?.name || 'unknown'}" references a non-localhost HTTP URL. Traffic can be intercepted.`,
+        ],
+        tags: ['transport', 'tls'],
+        safeUseNotes: RECOMMENDATION,
+      });
+    }
+
+    if (textHasNonLocalWs(text)) {
+      results.toolFindings.push({
+        issueType: 'Insecure Transport (WebSocket)',
+        name: tool?.name || 'tool',
+        severity: 'medium',
+        reasons: [
+          `Tool "${tool?.name || 'unknown'}" references a non-localhost WS URL. Traffic can be intercepted.`,
+        ],
+        tags: ['transport', 'websocket'],
+        safeUseNotes: RECOMMENDATION,
+      });
+    }
+  }
+
+  return results;
+}
+
+/**
+ * Analyze a server config for insecure transport
+ * Called directly by ScanService
+ */
+export function analyzeServerTransport(serverName, config) {
+  if (!config?.url) {
+    return [];
+  }
+
+  const findings = [];
+  const urlStr = config.url;
+
+  if (urlStr.startsWith('http://') && !isLocalhostUrl(urlStr)) {
+    findings.push({
+      rule_id: RULE_ID,
+      severity: 'high',
+      owasp_id: OWASP_ID,
+      title: `Insecure transport: ${serverName} uses HTTP`,
+      description: `${serverName} connects to ${config.url} over plain HTTP. Credentials and data are transmitted in cleartext.`,
+      recommendation: RECOMMENDATION,
+      server_name: serverName,
+      confidence: 'definite',
+    });
+  }
+
+  if (urlStr.startsWith('ws://') && !isLocalhostUrl(urlStr)) {
+    findings.push({
+      rule_id: RULE_ID,
+      severity: 'high',
+      owasp_id: OWASP_ID,
+      title: `Insecure transport: ${serverName} uses WS`,
+      description: `${serverName} connects to ${config.url} over plain WebSocket. Upgrade to WSS.`,
+      recommendation: RECOMMENDATION,
+      server_name: serverName,
+      confidence: 'definite',
+    });
+  }
+
+  return findings;
+}
+
+const adapter = createRuleAdapter(scanInsecureTransport, RULE_ID, OWASP_ID, RECOMMENDATION);
+export const analyzeTool = adapter.analyzeTool;
+export const analyzePrompt = adapter.analyzePrompt;
+export const analyzeResource = adapter.analyzeResource;
+export const analyzePacket = adapter.analyzePacket;
+
+export const ruleMetadata = {
+  id: RULE_ID,
+  name: 'Insecure Transport',
+  owasp_id: OWASP_ID,
+  severity: 'medium',
+  description: 'Detects non-localhost HTTP/WS connections that expose traffic to interception.',
+  source: 'static',
+  type: 'general-security',
+};

package/core/services/security/rules/scans/missingContainment.js

@@ -0,0 +1,123 @@
+/**
+ * Missing Directory Containment Detection
+ * Detects filesystem-type MCP servers without directory restrictions,
+ * granting full filesystem access to the agent.
+ * Catalog reference: §1.1 (unrestricted file access)
+ */
+import { createRuleAdapter } from '../utils/adapter.js';
+import { toolToText } from '../utils/text.js';
+
+const RULE_ID = 'missing-containment';
+const OWASP_ID = 'MCP10';
+const RECOMMENDATION =
+  'Restrict filesystem servers to specific directories using allowlist args (e.g., --allow-dir /path/to/project).';
+
+const FS_SERVER_PATTERNS = [
+  /filesystem/i,
+  /file.?system/i,
+  /fs.?server/i,
+  /read_file|write_file|list_directory/i,
+];
+
+const CONTAINMENT_INDICATORS = [
+  /--allow/i,
+  /--root/i,
+  /--sandbox/i,
+  /allowedDirectories/i,
+  /rootPath/i,
+  /basePath/i,
+];
+
+function isFilesystemServer(serverName, config) {
+  const text = `${serverName} ${JSON.stringify(config || {})}`;
+  for (const pattern of FS_SERVER_PATTERNS) {
+    if (pattern.test(text)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function hasContainment(config) {
+  const text = JSON.stringify(config || {});
+  for (const pattern of CONTAINMENT_INDICATORS) {
+    if (pattern.test(text)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+export function scanMissingContainment(mcpData = {}) {
+  const results = {
+    toolFindings: [],
+    resourceFindings: [],
+    promptFindings: [],
+    notablePatterns: [],
+    recommendations: [RECOMMENDATION],
+  };
+
+  for (const tool of mcpData.tools || []) {
+    const text = toolToText(tool);
+    const hasFilesystem = FS_SERVER_PATTERNS.some((p) => p.test(text));
+    if (hasFilesystem) {
+      const contained = CONTAINMENT_INDICATORS.some((p) => p.test(text));
+      if (!contained) {
+        results.toolFindings.push({
+          issueType: 'Missing Directory Containment',
+          name: tool?.name || 'tool',
+          severity: 'medium',
+          reasons: [
+            `Tool "${tool?.name || 'unknown'}" has filesystem access without directory containment.`,
+          ],
+          tags: ['containment', 'filesystem'],
+          safeUseNotes: RECOMMENDATION,
+        });
+      }
+    }
+  }
+
+  return results;
+}
+
+/**
+ * Analyze a server config for missing containment
+ * Called directly by ScanService
+ */
+export function analyzeServerContainment(serverName, config) {
+  if (!isFilesystemServer(serverName, config)) {
+    return [];
+  }
+  if (hasContainment(config)) {
+    return [];
+  }
+
+  return [
+    {
+      rule_id: RULE_ID,
+      severity: 'medium',
+      owasp_id: OWASP_ID,
+      title: `No directory containment on ${serverName}`,
+      description: `${serverName} has filesystem access without directory restrictions. The agent can read/write any file.`,
+      recommendation: RECOMMENDATION,
+      server_name: serverName,
+      confidence: 'possible',
+    },
+  ];
+}
+
+const adapter = createRuleAdapter(scanMissingContainment, RULE_ID, OWASP_ID, RECOMMENDATION);
+export const analyzeTool = adapter.analyzeTool;
+export const analyzePrompt = adapter.analyzePrompt;
+export const analyzeResource = adapter.analyzeResource;
+export const analyzePacket = adapter.analyzePacket;
+
+export const ruleMetadata = {
+  id: RULE_ID,
+  name: 'Missing Directory Containment',
+  owasp_id: OWASP_ID,
+  severity: 'medium',
+  description: 'Detects filesystem servers without directory restrictions.',
+  source: 'static',
+  type: 'general-security',
+};

package/core/services/security/rules/scans/shellEnvInjection.js

@@ -0,0 +1,101 @@
+/**
+ * Shell/Environment Injection Detection
+ * Detects MCP server configs using shell: true or unsanitized
+ * environment variable interpolation in commands, which can
+ * enable command injection via environment variables.
+ * Catalog reference: §1.9 (env-based command injection)
+ */
+import { createRuleAdapter } from '../utils/adapter.js';
+
+const RULE_ID = 'shell-env-injection';
+const OWASP_ID = 'MCP05';
+const RECOMMENDATION =
+  'Avoid shell: true in server spawn configs. Use direct command arrays instead of shell string interpolation.';
+
+export function scanShellEnvInjection(_mcpData = {}) {
+  return {
+    toolFindings: [],
+    resourceFindings: [],
+    promptFindings: [],
+    notablePatterns: [],
+    recommendations: [RECOMMENDATION],
+  };
+}
+
+/**
+ * Analyze a server config for shell injection risks
+ * Called directly by ScanService
+ * @param {string} serverName
+ * @param {object} config - Server config with command, args, env
+ * @returns {Array} Findings
+ */
+export function analyzeServerShellRisk(serverName, config) {
+  const findings = [];
+
+  if (!config) {
+    return findings;
+  }
+
+  const command = config.command || '';
+  const args = config.args || [];
+  const argsStr = Array.isArray(args) ? args.join(' ') : String(args);
+  const fullCommand = `${command} ${argsStr}`;
+
+  if (hasShellInterpolation(fullCommand)) {
+    findings.push({
+      rule_id: RULE_ID,
+      severity: 'high',
+      owasp_id: OWASP_ID,
+      title: `Shell interpolation in ${serverName} command`,
+      description: `Server "${serverName}" command contains shell variable interpolation that could be exploited if env vars are attacker-controlled.`,
+      recommendation: RECOMMENDATION,
+      server_name: serverName,
+      confidence: 'probable',
+    });
+  }
+
+  if (hasPipeOrChain(fullCommand)) {
+    findings.push({
+      rule_id: RULE_ID,
+      severity: 'critical',
+      owasp_id: OWASP_ID,
+      title: `Shell pipe/chain in ${serverName} command`,
+      description: `Server "${serverName}" command uses shell pipes or chains (|, &&, ;) which are dangerous with shell: true.`,
+      recommendation: 'Remove shell operators from server command. Use direct process spawning.',
+      server_name: serverName,
+      confidence: 'definite',
+    });
+  }
+
+  return findings;
+}
+
+/**
+ * Check for shell variable interpolation patterns
+ */
+function hasShellInterpolation(text) {
+  return /\$\([^)]+\)/.test(text) || /`[^`]+`/.test(text);
+}
+
+/**
+ * Check for shell pipe or chain operators
+ */
+function hasPipeOrChain(text) {
+  return /[|&;]/.test(text) && !/https?:\/\//.test(text);
+}
+
+const adapter = createRuleAdapter(scanShellEnvInjection, RULE_ID, OWASP_ID, RECOMMENDATION);
+export const analyzeTool = adapter.analyzeTool;
+export const analyzePrompt = adapter.analyzePrompt;
+export const analyzeResource = adapter.analyzeResource;
+export const analyzePacket = adapter.analyzePacket;
+
+export const ruleMetadata = {
+  id: RULE_ID,
+  name: 'Shell/Environment Injection',
+  owasp_id: OWASP_ID,
+  severity: 'high',
+  description: 'Detects shell interpolation and pipe operators in server commands.',
+  source: 'static',
+  type: 'general-security',
+};

package/core/services/security/rules/scans/unsafeDefaults.js

@@ -0,0 +1,99 @@
+/**
+ * Unsafe Default Configuration Detection
+ * Detects MCP servers running with insecure default settings
+ * such as debug mode, verbose logging of secrets, or disabled auth.
+ */
+import { createRuleAdapter } from '../utils/adapter.js';
+import { toolToText } from '../utils/text.js';
+
+const RULE_ID = 'unsafe-defaults';
+const OWASP_ID = 'MCP07';
+const RECOMMENDATION =
+  'Disable debug mode and verbose logging in production. Enable authentication on all server endpoints.';
+
+const UNSAFE_DEFAULT_PATTERNS = [
+  { pattern: /debug[=:]\s*true/i, label: 'debug mode enabled' },
+  { pattern: /--debug\b/i, label: 'debug flag' },
+  { pattern: /NODE_ENV[=:]\s*development/i, label: 'NODE_ENV=development' },
+  { pattern: /verbose[=:]\s*true/i, label: 'verbose logging enabled' },
+  { pattern: /log[_-]?level[=:]\s*(debug|trace)/i, label: 'debug-level logging' },
+  { pattern: /auth[=:]\s*false/i, label: 'authentication disabled' },
+  { pattern: /--no-auth\b/i, label: 'no-auth flag' },
+  { pattern: /disable[_-]?auth/i, label: 'auth disabled' },
+  { pattern: /tls[=:]\s*false/i, label: 'TLS disabled' },
+  { pattern: /--insecure\b/i, label: 'insecure flag' },
+];
+
+export function scanUnsafeDefaults(mcpData = {}) {
+  const results = {
+    toolFindings: [],
+    resourceFindings: [],
+    promptFindings: [],
+    notablePatterns: [],
+    recommendations: [RECOMMENDATION],
+  };
+
+  for (const tool of mcpData.tools || []) {
+    const text = toolToText(tool);
+    for (const { pattern, label } of UNSAFE_DEFAULT_PATTERNS) {
+      if (pattern.test(text)) {
+        results.toolFindings.push({
+          issueType: 'Unsafe Default Configuration',
+          name: tool?.name || 'tool',
+          severity: 'medium',
+          reasons: [
+            `Tool "${tool?.name || 'unknown'}" has ${label} — this is insecure for production use.`,
+          ],
+          tags: ['defaults', 'configuration'],
+          safeUseNotes: RECOMMENDATION,
+        });
+        break;
+      }
+    }
+  }
+
+  return results;
+}
+
+/**
+ * Analyze a server config for unsafe defaults
+ * Called directly by ScanService
+ */
+export function analyzeServerDefaults(serverName, config) {
+  const text = JSON.stringify(config || {});
+  const findings = [];
+
+  for (const { pattern, label } of UNSAFE_DEFAULT_PATTERNS) {
+    if (pattern.test(text)) {
+      findings.push({
+        rule_id: RULE_ID,
+        severity: 'medium',
+        owasp_id: OWASP_ID,
+        title: `Unsafe default: ${label} on ${serverName}`,
+        description: `${serverName} has ${label}. This may expose sensitive data or weaken security.`,
+        recommendation: RECOMMENDATION,
+        server_name: serverName,
+        confidence: 'probable',
+      });
+    }
+  }
+
+  return findings;
+}
+
+const adapter = createRuleAdapter(scanUnsafeDefaults, RULE_ID, OWASP_ID, RECOMMENDATION);
+export const analyzeTool = adapter.analyzeTool;
+export const analyzePrompt = adapter.analyzePrompt;
+export const analyzeResource = adapter.analyzeResource;
+export const analyzePacket = adapter.analyzePacket;
+
+export const ruleMetadata = {
+  id: RULE_ID,
+  name: 'Unsafe Default Configuration',
+  owasp_id: OWASP_ID,
+  severity: 'medium',
+  description:
+    'Detects servers running with insecure default settings like debug mode or disabled auth.',
+  source: 'static',
+  type: 'general-security',
+};

package/core/services/security/toolsListFromTrafficParser.js

@@ -0,0 +1,70 @@
+/**
+ * Extract MCP tools/list (or equivalent) tool arrays from proxied JSON-RPC traffic.
+ */
+
+function normalizeTools(tools) {
+  if (!Array.isArray(tools)) {
+    return null;
+  }
+  const out = [];
+  for (const t of tools) {
+    if (!t || typeof t !== 'object') {
+      continue;
+    }
+    const name = t.name;
+    if (typeof name !== 'string' || !name) {
+      continue;
+    }
+    out.push({
+      name,
+      description: typeof t.description === 'string' ? t.description : null,
+    });
+  }
+  return out.length > 0 ? out : null;
+}
+
+function parseJson(value) {
+  if (value == null) {
+    return null;
+  }
+  if (typeof value === 'object') {
+    return value;
+  }
+  if (typeof value !== 'string' || value === '') {
+    return null;
+  }
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Parse stored jsonrpc_result column (stringified `result` object).
+ * @param {string|null} jsonrpcResultStr
+ * @returns {Array<{name: string, description: string|null}>|null}
+ */
+export function toolsFromJsonrpcResultString(jsonrpcResultStr) {
+  const obj = parseJson(jsonrpcResultStr);
+  if (!obj || !Array.isArray(obj.tools)) {
+    return null;
+  }
+  return normalizeTools(obj.tools);
+}
+
+/**
+ * Parse live or raw response body for tools/list success.
+ * @param {string|object|null|undefined} body
+ * @returns {Array<{name: string, description: string|null}>|null}
+ */
+export function toolsFromTrafficResponseBody(body) {
+  const parsed = parseJson(body);
+  if (!parsed || typeof parsed !== 'object') {
+    return null;
+  }
+  if (parsed.result && Array.isArray(parsed.result.tools)) {
+    return normalizeTools(parsed.result.tools);
+  }
+  return null;
+}