npm - @mcp-shark/mcp-shark - Versions diffs - 1.5.13 → 1.6.0 - Mend

@mcp-shark/mcp-shark 1.5.13 → 1.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (100) hide show

package/README.md +396 -59
package/bin/mcp-shark.js +146 -52
package/core/cli/AutoFixEngine.js +93 -0
package/core/cli/ConfigScanner.js +193 -0
package/core/cli/DataLoader.js +200 -0
package/core/cli/DeclarativeRuleEngine.js +363 -0
package/core/cli/DoctorCommand.js +218 -0
package/core/cli/FixHandlers.js +222 -0
package/core/cli/HtmlReportGenerator.js +203 -0
package/core/cli/IdeConfigPaths.js +175 -0
package/core/cli/ListCommand.js +224 -0
package/core/cli/LockCommand.js +164 -0
package/core/cli/LockDiffEngine.js +152 -0
package/core/cli/RuleRegistryConfig.js +131 -0
package/core/cli/ScanCommand.js +244 -0
package/core/cli/ScanService.js +200 -0
package/core/cli/SecretDetector.js +92 -0
package/core/cli/SharkScoreCalculator.js +109 -0
package/core/cli/ToolClassifications.js +51 -0
package/core/cli/ToxicFlowAnalyzer.js +212 -0
package/core/cli/UpdateCommand.js +188 -0
package/core/cli/WalkthroughGenerator.js +195 -0
package/core/cli/WatchCommand.js +129 -0
package/core/cli/YamlRuleEngine.js +197 -0
package/core/cli/data/rule-packs/agentic-security-2026.json +180 -0
package/core/cli/data/rule-packs/general-security.json +173 -0
package/core/cli/data/rule-packs/owasp-mcp-2026.json +244 -0
package/core/cli/data/rule-packs/toxic-flow-heuristics.json +21 -0
package/core/cli/data/rule-sources.json +5 -0
package/core/cli/data/secret-patterns.json +18 -0
package/core/cli/data/tool-classifications.json +111 -0
package/core/cli/data/toxic-flow-rules.json +47 -0
package/core/cli/index.js +23 -0
package/core/cli/output/Banner.js +52 -0
package/core/cli/output/Formatter.js +183 -0
package/core/cli/output/JsonFormatter.js +106 -0
package/core/cli/output/index.js +16 -0
package/core/cli/secureRegistryFetch.js +157 -0
package/core/cli/symbols.js +16 -0
package/core/container/DependencyContainer.js +4 -1
package/core/repositories/PacketRepository.js +16 -0
package/core/services/AuditService.js +2 -0
package/core/services/security/StaticRulesService.js +69 -13
package/core/services/security/TrafficAnalysisService.js +19 -1
package/core/services/security/TrafficToxicFlowService.js +154 -0
package/core/services/security/index.js +2 -1
package/core/services/security/rules/index.js +25 -59
package/core/services/security/rules/scans/configPermissions.js +91 -0
package/core/services/security/rules/scans/duplicateToolNames.js +85 -0
package/core/services/security/rules/scans/insecureTransport.js +148 -0
package/core/services/security/rules/scans/missingContainment.js +123 -0
package/core/services/security/rules/scans/shellEnvInjection.js +101 -0
package/core/services/security/rules/scans/unsafeDefaults.js +99 -0
package/core/services/security/toolsListFromTrafficParser.js +70 -0
package/core/tui/App.js +144 -0
package/core/tui/FindingsPanel.js +115 -0
package/core/tui/FixPanel.js +132 -0
package/core/tui/Header.js +51 -0
package/core/tui/HelpBar.js +42 -0
package/core/tui/ServersPanel.js +109 -0
package/core/tui/ToxicFlowsPanel.js +100 -0
package/core/tui/h.js +8 -0
package/core/tui/index.js +11 -0
package/core/tui/render.js +22 -0
package/package.json +24 -16
package/ui/dist/assets/{index-CiCSDYf-.js → index-Buah4fNS.js} +32 -32
package/ui/dist/index.html +1 -1
package/ui/server/controllers/RequestController.js +9 -1
package/ui/server/controllers/SecurityFindingsController.js +46 -1
package/ui/server/routes/requests.js +8 -1
package/ui/server/routes/security.js +5 -1
package/ui/server/setup.js +2 -0
package/ui/server/swagger/paths/components.js +55 -0
package/ui/server/swagger/paths/securityTrafficFlows.js +59 -0
package/ui/server/swagger/paths.js +2 -0
package/ui/server/swagger/swagger.js +5 -1
package/ui/src/Security.jsx +10 -0
package/ui/src/components/Security/ScannerContent.jsx +30 -1
package/ui/src/components/Security/TrafficToxicFlowsPanel.jsx +253 -0
package/ui/src/components/Security/securityApi.js +15 -0
package/ui/src/components/Security/useSecurity.js +60 -3
package/core/services/security/rules/scans/agentic01GoalHijack.js +0 -130
package/core/services/security/rules/scans/agentic02ToolMisuse.js +0 -129
package/core/services/security/rules/scans/agentic03IdentityAbuse.js +0 -130
package/core/services/security/rules/scans/agentic04SupplyChain.js +0 -130
package/core/services/security/rules/scans/agentic06MemoryPoisoning.js +0 -130
package/core/services/security/rules/scans/agentic07InsecureCommunication.js +0 -135
package/core/services/security/rules/scans/agentic08CascadingFailures.js +0 -135
package/core/services/security/rules/scans/agentic09TrustExploitation.js +0 -135
package/core/services/security/rules/scans/agentic10RogueAgent.js +0 -130
package/core/services/security/rules/scans/hardcodedSecrets.js +0 -130
package/core/services/security/rules/scans/mcp01TokenMismanagement.js +0 -127
package/core/services/security/rules/scans/mcp02ScopeCreep.js +0 -130
package/core/services/security/rules/scans/mcp03ToolPoisoning.js +0 -132
package/core/services/security/rules/scans/mcp04SupplyChain.js +0 -131
package/core/services/security/rules/scans/mcp06PromptInjection.js +0 -200
package/core/services/security/rules/scans/mcp07InsufficientAuth.js +0 -130
package/core/services/security/rules/scans/mcp08LackAudit.js +0 -129
package/core/services/security/rules/scans/mcp09ShadowServers.js +0 -129
package/core/services/security/rules/scans/mcp10ContextInjection.js +0 -130

package/ui/dist/index.html CHANGED Viewed

@@ -7,7 +7,7 @@
     <title>MCP Shark</title>
     <link rel="icon" type="image/png" href="/og-image.png" />
     <link rel="apple-touch-icon" href="/og-image.png" />
-    <script type="module" crossorigin src="/assets/index-CiCSDYf-.js"></script>
+    <script type="module" crossorigin src="/assets/index-Buah4fNS.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-Cc-IUa83.css">
   </head>
   <body>

package/ui/server/controllers/RequestController.js CHANGED Viewed

@@ -8,11 +8,18 @@ import { RequestFilters } from '#core/models/RequestFilters.js';
  */
 export class RequestController {
-  constructor(requestService, exportService, serializationLib, logger) {
+  constructor(
+    requestService,
+    exportService,
+    serializationLib,
+    logger,
+    trafficToxicFlowService = null
+  ) {
     this.requestService = requestService;
     this.exportService = exportService;
     this.serializationLib = serializationLib;
     this.logger = logger;
+    this.trafficToxicFlowService = trafficToxicFlowService;
   }
   /**
@@ -90,6 +97,7 @@ export class RequestController {
   clearRequests(_req, res) {
     try {
       const result = this.requestService.clearRequests();
+      this.trafficToxicFlowService?.clear();
       res.json({
         success: true,
         message: `Cleared ${result.clearedTables.length} table(s): ${result.clearedTables.join(', ')}. All captured traffic has been cleared.`,

package/ui/server/controllers/SecurityFindingsController.js CHANGED Viewed

@@ -5,10 +5,16 @@ import { handleError, handleValidationError } from '../utils/errorHandler.js';
  * Controller for Security Detection and Findings HTTP endpoints
  */
 export class SecurityFindingsController {
-  constructor(securityDetectionService, serverManagementService, logger) {
+  constructor(
+    securityDetectionService,
+    serverManagementService,
+    logger,
+    trafficToxicFlowService = null
+  ) {
     this.securityService = securityDetectionService;
     this.serverManagementService = serverManagementService;
     this.logger = logger;
+    this.trafficToxicFlowService = trafficToxicFlowService;
   }
   /**
@@ -198,6 +204,7 @@ export class SecurityFindingsController {
   clearFindings = (_req, res) => {
     try {
       const deletedCount = this.securityService.clearAllFindings();
+      this.trafficToxicFlowService?.clear();
       return res.json({
         success: true,
         message: `Cleared ${deletedCount} finding${deletedCount !== 1 ? 's' : ''}`,
@@ -229,4 +236,42 @@ export class SecurityFindingsController {
       handleError(error, res, this.logger, 'Error deleting scan findings');
     }
   };
+  /**
+   * Cross-server toxic flows from observed tools/list traffic (live registry + last recompute).
+   */
+  getTrafficToxicFlows = (_req, res) => {
+    try {
+      if (!this.trafficToxicFlowService) {
+        return res.status(StatusCodes.SERVICE_UNAVAILABLE).json({
+          success: false,
+          error: 'Traffic toxic flow service is not available',
+        });
+      }
+      return res.json(this.trafficToxicFlowService.getSnapshot());
+    } catch (error) {
+      handleError(error, res, this.logger, 'Error getting traffic toxic flows');
+    }
+  };
+  /**
+   * Rebuild toxic-flow model from stored response packets (batch replay).
+   */
+  replayTrafficToxicFlows = (_req, res) => {
+    try {
+      if (!this.trafficToxicFlowService) {
+        return res.status(StatusCodes.SERVICE_UNAVAILABLE).json({
+          success: false,
+          error: 'Traffic toxic flow service is not available',
+        });
+      }
+      const stats = this.trafficToxicFlowService.rebuildFromDatabase();
+      return res.json({
+        ...this.trafficToxicFlowService.getSnapshot(),
+        replay: stats,
+      });
+    } catch (error) {
+      handleError(error, res, this.logger, 'Error replaying traffic toxic flows');
+    }
+  };
 }

package/ui/server/routes/requests.js CHANGED Viewed

@@ -5,8 +5,15 @@ export function createRequestsRoutes(container) {
   const exportService = container.getService('export');
   const serializationLib = container.getLibrary('serialization');
   const logger = container.getLibrary('logger');
+  const trafficToxicFlowService = container.getService('trafficToxicFlow');
-  const controller = new RequestController(requestService, exportService, serializationLib, logger);
+  const controller = new RequestController(
+    requestService,
+    exportService,
+    serializationLib,
+    logger,
+    trafficToxicFlowService
+  );
   const router = {};

package/ui/server/routes/security.js CHANGED Viewed

@@ -13,10 +13,12 @@ export function createSecurityRoutes(container) {
   const yaraEngineService = container.getService('yaraEngine');
   const logger = container.getLibrary('logger');
+  const trafficToxicFlowService = container.getService('trafficToxicFlow');
   const findingsController = new SecurityFindingsController(
     securityDetectionService,
     serverManagementService,
-    logger
+    logger,
+    trafficToxicFlowService
   );
   const sourcesController = new RuleSourcesController(
@@ -40,6 +42,8 @@ export function createSecurityRoutes(container) {
   router.getScanHistory = findingsController.getScanHistory;
   router.clearFindings = findingsController.clearFindings;
   router.deleteScanFindings = findingsController.deleteScanFindings;
+  router.getTrafficToxicFlows = findingsController.getTrafficToxicFlows;
+  router.replayTrafficToxicFlows = findingsController.replayTrafficToxicFlows;
   // YARA engine (RuleSourcesController)
   router.getEngineStatus = sourcesController.getEngineStatus;

package/ui/server/setup.js CHANGED Viewed

@@ -147,6 +147,8 @@ export function createUIServer() {
   app.get('/api/security/history', securityRoutes.getScanHistory);
   app.post('/api/security/findings/clear', securityRoutes.clearFindings);
   app.delete('/api/security/scan/:scanId', securityRoutes.deleteScanFindings);
+  app.get('/api/security/traffic-toxic-flows', securityRoutes.getTrafficToxicFlows);
+  app.post('/api/security/traffic-toxic-flows/replay', securityRoutes.replayTrafficToxicFlows);
   // Security routes - YARA engine
   app.get('/api/security/engine/status', securityRoutes.getEngineStatus);

package/ui/server/swagger/paths/components.js CHANGED Viewed

@@ -72,5 +72,60 @@ export const components = {
         results: { type: 'object' },
       },
     },
+    TrafficToxicFlowItem: {
+      type: 'object',
+      properties: {
+        risk: { type: 'string', example: 'HIGH' },
+        title: { type: 'string' },
+        source: { type: 'string' },
+        target: { type: 'string' },
+        scenario: { type: 'string' },
+        sourceIde: { type: 'string' },
+        targetIde: { type: 'string' },
+      },
+    },
+    TrafficToxicFlowServerMeta: {
+      type: 'object',
+      properties: {
+        name: { type: 'string' },
+        toolCount: { type: 'integer' },
+        updatedAt: { type: 'integer' },
+      },
+    },
+    TrafficToxicFlowSnapshot: {
+      type: 'object',
+      properties: {
+        success: { type: 'boolean', example: true },
+        toxicFlows: {
+          type: 'array',
+          items: { $ref: '#/components/schemas/TrafficToxicFlowItem' },
+        },
+        servers: {
+          type: 'array',
+          items: { $ref: '#/components/schemas/TrafficToxicFlowServerMeta' },
+        },
+        computedAt: { type: 'integer', nullable: true },
+        lastReplayPacketCount: { type: 'integer' },
+        note: { type: 'string' },
+      },
+    },
+    TrafficToxicFlowReplayResponse: {
+      allOf: [
+        { $ref: '#/components/schemas/TrafficToxicFlowSnapshot' },
+        {
+          type: 'object',
+          properties: {
+            replay: {
+              type: 'object',
+              properties: {
+                packetRows: { type: 'integer' },
+                serverCount: { type: 'integer' },
+                flowCount: { type: 'integer' },
+              },
+            },
+          },
+        },
+      ],
+    },
   },
 };

package/ui/server/swagger/paths/securityTrafficFlows.js ADDED Viewed

@@ -0,0 +1,59 @@
+/**
+ * Local Analysis — traffic-derived toxic flow endpoints
+ */
+export const securityTrafficFlowsPaths = {
+  '/api/security/traffic-toxic-flows': {
+    get: {
+      tags: ['Security'],
+      summary: 'Get toxic flows from proxy traffic',
+      description:
+        'Returns the latest cross-server toxic-flow heuristics built from tools/list responses observed on the HTTP proxy. In-memory model; use replay to rebuild from the packet database.',
+      responses: {
+        200: {
+          description: 'Snapshot with toxicFlows, servers, computedAt, note',
+          content: {
+            'application/json': {
+              schema: { $ref: '#/components/schemas/TrafficToxicFlowSnapshot' },
+            },
+          },
+        },
+        503: {
+          description: 'Traffic toxic flow service unavailable',
+          content: {
+            'application/json': {
+              schema: {
+                type: 'object',
+                properties: {
+                  success: { type: 'boolean', example: false },
+                  error: { type: 'string' },
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+  '/api/security/traffic-toxic-flows/replay': {
+    post: {
+      tags: ['Security'],
+      summary: 'Replay toxic flows from stored packets',
+      description:
+        'Scans stored HTTP response packets for tools/list-style JSON-RPC results and rebuilds the toxic-flow registry.',
+      responses: {
+        200: {
+          description: 'Snapshot plus replay stats (packetRows, serverCount, flowCount)',
+          content: {
+            'application/json': {
+              schema: { $ref: '#/components/schemas/TrafficToxicFlowReplayResponse' },
+            },
+          },
+        },
+        503: {
+          description: 'Traffic toxic flow service unavailable',
+        },
+      },
+    },
+  },
+};

package/ui/server/swagger/paths.js CHANGED Viewed

@@ -11,6 +11,7 @@ import { helpPaths } from './paths/help.js';
 import { logsPaths } from './paths/logs.js';
 import { playgroundPaths } from './paths/playground.js';
 import { requestsPaths } from './paths/requests.js';
+import { securityTrafficFlowsPaths } from './paths/securityTrafficFlows.js';
 import { serverManagementPaths } from './paths/serverManagement.js';
 import { sessionsPaths } from './paths/sessions.js';
 import { settingsPaths } from './paths/settings.js';
@@ -22,6 +23,7 @@ import { statisticsPaths } from './paths/statistics.js';
  */
 export const paths = {
   ...requestsPaths,
+  ...securityTrafficFlowsPaths,
   ...sessionsPaths,
   ...conversationsPaths,
   ...statisticsPaths,

package/ui/server/swagger/swagger.js CHANGED Viewed

@@ -4,7 +4,7 @@ export const swaggerSpec = {
   openapi: '3.0.0',
   info: {
     title: 'MCP Shark API',
-    version: '1.5.4',
+    version: '1.6.0',
     description:
       'API documentation for MCP Shark - A powerful monitoring and debugging tool for Model Context Protocol (MCP) servers. Provides deep visibility into every request and response.',
     contact: {
@@ -31,6 +31,10 @@ export const swaggerSpec = {
     { name: 'Playground', description: 'MCP playground for testing tools and resources' },
     { name: 'Smart Scan', description: 'AI-powered security analysis for MCP servers' },
     { name: 'Settings', description: 'Application settings' },
+    {
+      name: 'Security',
+      description: 'Local static analysis findings and traffic-derived toxic flows (HTTP proxy)',
+    },
   ],
   paths,
   components,

package/ui/src/Security.jsx CHANGED Viewed

@@ -30,6 +30,11 @@ function Security({ onNavigateToSmartScan, onNavigateToSetup }) {
     runningServersCount,
     // Scan complete state
     scanComplete,
+    trafficToxicSnapshot,
+    trafficToxicLoading,
+    trafficToxicError,
+    loadTrafficToxicFlows,
+    replayTrafficToxicFlows,
     // YARA rules
     communityRules,
     engineStatus,
@@ -103,6 +108,11 @@ function Security({ onNavigateToSmartScan, onNavigateToSetup }) {
           showHistory={showHistory}
           serversAvailable={runningServersCount > 0}
           scanComplete={scanComplete}
+          trafficToxicSnapshot={trafficToxicSnapshot}
+          trafficToxicLoading={trafficToxicLoading}
+          trafficToxicError={trafficToxicError}
+          loadTrafficToxicFlows={loadTrafficToxicFlows}
+          replayTrafficToxicFlows={replayTrafficToxicFlows}
         />
       )}

package/ui/src/components/Security/ScannerContent.jsx CHANGED Viewed

@@ -7,7 +7,7 @@ import {
   IconSparkles,
   IconTool,
 } from '@tabler/icons-react';
-import { useState } from 'react';
+import { useEffect, useState } from 'react';
 import { colors, fonts } from '../../theme';
 import CategoryView from './CategoryView/index.js';
 import ErrorDisplay from './ErrorDisplay.jsx';
@@ -18,6 +18,10 @@ import ScanningProgress from './ScanningProgress.jsx';
 import SecurityCharts from './SecurityCharts/index.js';
 import SecuritySummary from './SecuritySummary.jsx';
 import TargetView from './TargetView/index.js';
+import TrafficToxicFlowsPanel from './TrafficToxicFlowsPanel.jsx';
+/** Keep proxy toxic-flow snapshot aligned when traffic/findings are cleared on other tabs. */
+const TRAFFIC_TOXIC_POLL_MS = 20_000;
 const VIEW_MODES = [
   { id: 'dashboard', label: 'Dashboard', icon: IconChartBar },
@@ -162,11 +166,26 @@ export default function ScannerContent({
   showHistory,
   serversAvailable,
   scanComplete,
+  trafficToxicSnapshot,
+  trafficToxicLoading,
+  trafficToxicError,
+  loadTrafficToxicFlows,
+  replayTrafficToxicFlows,
 }) {
   const [viewMode, setViewMode] = useState('dashboard');
   const hasFindings = findings && findings.length > 0;
   const showEmpty = !error && !scanning && !hasFindings && !showHistory;
+  useEffect(() => {
+    if (error || scanning) {
+      return undefined;
+    }
+    const id = setInterval(() => {
+      loadTrafficToxicFlows();
+    }, TRAFFIC_TOXIC_POLL_MS);
+    return () => clearInterval(id);
+  }, [error, scanning, loadTrafficToxicFlows]);
   return (
     <div
       style={{
@@ -184,6 +203,16 @@ export default function ScannerContent({
         <StaticAnalysisBanner onNavigateToSmartScan={onNavigateToSmartScan} />
       )}
+      {!error && !scanning && (
+        <TrafficToxicFlowsPanel
+          snapshot={trafficToxicSnapshot}
+          loading={trafficToxicLoading}
+          error={trafficToxicError}
+          onRefresh={loadTrafficToxicFlows}
+          onReplay={replayTrafficToxicFlows}
+        />
+      )}
       {/* History View */}
       {showHistory && !scanning && (
         <ScanHistory

package/ui/src/components/Security/TrafficToxicFlowsPanel.jsx ADDED Viewed

@@ -0,0 +1,253 @@
+import { IconDatabase, IconGitBranch, IconRefresh } from '@tabler/icons-react';
+import { colors, fonts } from '../../theme';
+function riskColor(risk) {
+  const r = (risk || '').toUpperCase();
+  if (r === 'HIGH') {
+    return colors.error;
+  }
+  if (r === 'MEDIUM') {
+    return colors.warning;
+  }
+  return colors.textSecondary;
+}
+export default function TrafficToxicFlowsPanel({ snapshot, loading, error, onRefresh, onReplay }) {
+  const flows = snapshot?.toxicFlows ?? [];
+  const servers = snapshot?.servers ?? [];
+  const replay = snapshot?.replay;
+  return (
+    <div
+      style={{
+        marginBottom: '20px',
+        padding: '14px 16px',
+        background: colors.bgSecondary,
+        border: `1px solid ${colors.borderLight}`,
+        borderRadius: '8px',
+      }}
+    >
+      <div
+        style={{
+          display: 'flex',
+          alignItems: 'flex-start',
+          justifyContent: 'space-between',
+          gap: '12px',
+          flexWrap: 'wrap',
+          marginBottom: '10px',
+        }}
+      >
+        <div style={{ display: 'flex', alignItems: 'center', gap: '10px', minWidth: 0 }}>
+          <IconGitBranch
+            size={18}
+            stroke={1.5}
+            style={{ color: colors.textMuted, flexShrink: 0 }}
+          />
+          <div>
+            <div
+              style={{
+                fontSize: '13px',
+                fontWeight: 600,
+                color: colors.textPrimary,
+                fontFamily: fonts.body,
+              }}
+            >
+              Toxic flows (proxy traffic)
+            </div>
+            <div
+              style={{
+                fontSize: '11px',
+                color: colors.textSecondary,
+                fontFamily: fonts.body,
+                marginTop: '2px',
+                maxWidth: '720px',
+                lineHeight: 1.45,
+              }}
+            >
+              Heuristic cross-server pairs from <strong>tools/list</strong> responses seen through
+              the HTTP proxy. Run MCP clients through mcp-shark, trigger tool discovery, then
+              refresh or replay from the packet database. Clearing findings or all captured traffic
+              resets this in-memory model.
+            </div>
+          </div>
+        </div>
+        <div style={{ display: 'flex', gap: '8px', flexShrink: 0 }}>
+          <button
+            type="button"
+            disabled={loading}
+            onClick={() => onRefresh()}
+            style={{
+              display: 'flex',
+              alignItems: 'center',
+              gap: '6px',
+              padding: '6px 12px',
+              fontSize: '11px',
+              fontWeight: 500,
+              fontFamily: fonts.body,
+              background: colors.buttonSecondary,
+              border: `1px solid ${colors.borderLight}`,
+              borderRadius: '4px',
+              cursor: loading ? 'wait' : 'pointer',
+              color: colors.textPrimary,
+            }}
+          >
+            <IconRefresh size={14} stroke={1.5} />
+            Refresh
+          </button>
+          <button
+            type="button"
+            disabled={loading}
+            onClick={() => onReplay()}
+            style={{
+              display: 'flex',
+              alignItems: 'center',
+              gap: '6px',
+              padding: '6px 12px',
+              fontSize: '11px',
+              fontWeight: 500,
+              fontFamily: fonts.body,
+              background: colors.buttonPrimary,
+              border: 'none',
+              borderRadius: '4px',
+              cursor: loading ? 'wait' : 'pointer',
+              color: colors.textInverse,
+            }}
+          >
+            <IconDatabase size={14} stroke={1.5} />
+            Replay from DB
+          </button>
+        </div>
+      </div>
+      {error && (
+        <div
+          style={{
+            fontSize: '12px',
+            color: colors.error,
+            background: colors.errorBg,
+            padding: '8px 10px',
+            borderRadius: '4px',
+            marginBottom: '10px',
+            fontFamily: fonts.body,
+          }}
+        >
+          {error}
+        </div>
+      )}
+      {loading && !snapshot && !error && (
+        <div style={{ fontSize: '12px', color: colors.textSecondary, fontFamily: fonts.body }}>
+          Loading…
+        </div>
+      )}
+      {snapshot && !error && (
+        <div style={{ fontSize: '11px', color: colors.textSecondary, fontFamily: fonts.body }}>
+          {servers.length > 0 ? (
+            <span>
+              <strong style={{ color: colors.textPrimary }}>{servers.length}</strong> server
+              {servers.length !== 1 ? 's' : ''} with tool metadata
+              {snapshot.computedAt
+                ? ` · updated ${new Date(snapshot.computedAt).toLocaleString()}`
+                : ''}
+              {replay != null
+                ? ` · replay scanned ${replay.packetRows} packet row${replay.packetRows !== 1 ? 's' : ''}`
+                : ''}
+            </span>
+          ) : (
+            <span>
+              No <code style={{ fontFamily: fonts.mono }}>tools/list</code> traffic captured yet.
+              Use the proxy, open a client that lists tools, then Refresh or Replay from DB.
+            </span>
+          )}
+        </div>
+      )}
+      {flows.length > 0 && (
+        <ul
+          style={{
+            listStyle: 'none',
+            margin: '12px 0 0',
+            padding: 0,
+            display: 'flex',
+            flexDirection: 'column',
+            gap: '10px',
+          }}
+        >
+          {flows.map((flow, idx) => (
+            <li
+              key={`${flow.source}-${flow.target}-${flow.title}-${idx}`}
+              style={{
+                padding: '10px 12px',
+                background: colors.bgCard,
+                border: `1px solid ${colors.borderLight}`,
+                borderRadius: '6px',
+              }}
+            >
+              <div style={{ display: 'flex', alignItems: 'center', gap: '8px', flexWrap: 'wrap' }}>
+                <span
+                  style={{
+                    fontSize: '10px',
+                    fontWeight: 700,
+                    letterSpacing: '0.04em',
+                    color: riskColor(flow.risk),
+                    fontFamily: fonts.body,
+                  }}
+                >
+                  {(flow.risk || '').toUpperCase()}
+                </span>
+                <span
+                  style={{
+                    fontSize: '12px',
+                    fontWeight: 600,
+                    color: colors.textPrimary,
+                    fontFamily: fonts.body,
+                  }}
+                >
+                  {flow.title}
+                </span>
+              </div>
+              <div
+                style={{
+                  fontSize: '11px',
+                  color: colors.accentBlue,
+                  fontFamily: fonts.mono,
+                  marginTop: '4px',
+                }}
+              >
+                {flow.source} → {flow.target}
+              </div>
+              {flow.scenario && (
+                <div
+                  style={{
+                    fontSize: '11px',
+                    color: colors.textSecondary,
+                    fontFamily: fonts.body,
+                    marginTop: '6px',
+                    lineHeight: 1.45,
+                  }}
+                >
+                  {flow.scenario}
+                </div>
+              )}
+            </li>
+          ))}
+        </ul>
+      )}
+      {snapshot && servers.length > 0 && (
+        <div
+          style={{
+            marginTop: '12px',
+            fontSize: '10px',
+            color: colors.textTertiary,
+            fontFamily: fonts.body,
+            lineHeight: 1.4,
+          }}
+        >
+          {snapshot.note}
+        </div>
+      )}
+    </div>
+  );
+}

package/ui/src/components/Security/securityApi.js CHANGED Viewed

@@ -66,6 +66,21 @@ export async function postClearFindings() {
   return response.json();
 }
+/** Cross-server toxic flows from observed tools/list proxy traffic */
+export async function fetchTrafficToxicFlows() {
+  const response = await fetch('/api/security/traffic-toxic-flows');
+  return response.json();
+}
+/** Rebuild toxic-flow model from stored response packets */
+export async function postReplayTrafficToxicFlows() {
+  const response = await fetch('/api/security/traffic-toxic-flows/replay', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+  });
+  return response.json();
+}
 export async function fetchCommunityRules() {
   const response = await fetch('/api/security/community-rules');
   return response.json();