@mcp-shark/mcp-shark 1.5.13 → 1.6.0

package/core/cli/data/rule-packs/agentic-security-2026.json

@@ -0,0 +1,180 @@
+{
+  "schema_version": "1.0",
+  "pack_id": "agentic-security-2026",
+  "pack_name": "Agentic Security Initiative (2026)",
+  "version": "1.0.0",
+  "updated": "2026-03-15",
+  "source_url": "https://owasp.org/www-project-agentic-security/",
+  "rules": [
+    {
+      "id": "asi01-goal-hijack",
+      "name": "Agent Goal Hijack Detection",
+      "owasp_id": "ASI01",
+      "severity": "high",
+      "type": "agentic-security",
+      "description": "Detects attempts to hijack or modify agent goals.",
+      "recommendation": "Implement goal validation and verification. Monitor for unauthorized goal changes. Use goal isolation and protection mechanisms.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "critical" },
+      "patterns": [
+        "(?:hijack|override|replace|change|modify)\\s+(?:goal|objective|purpose|mission|task)",
+        "(?:ignore|forget|disregard)\\s+(?:original|initial|intended|primary)\\s+(?:goal|objective|purpose)",
+        "(?:new|different|alternative|malicious)\\s+(?:goal|objective|purpose|mission)",
+        "(?:steer|redirect|manipulate)\\s+(?:agent|system)\\s+(?:toward|to|into)",
+        "(?:unauthorized|malicious|harmful)\\s+(?:goal|objective|purpose|action)"
+      ]
+    },
+    {
+      "id": "asi02-tool-misuse",
+      "name": "Tool Misuse Detection",
+      "owasp_id": "ASI02",
+      "severity": "high",
+      "type": "agentic-security",
+      "description": "Detects tool misuse and exploitation patterns.",
+      "recommendation": "Implement tool usage monitoring and restrictions. Enforce scope boundaries for tool usage. Monitor for unauthorized tool combinations.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "resource": "medium" },
+      "patterns": [
+        "(?:misuse|abuse|exploit|manipulate)\\s+(?:tool|function|capability|feature)",
+        "(?:use|utilize|invoke)\\s+(?:tool|function)\\s+(?:outside|beyond|outside\\s+of)\\s+(?:intended|authorized|allowed)\\s+(?:scope|purpose|context)",
+        "(?:unauthorized|illegitimate|improper)\\s+(?:tool|function)\\s+(?:usage|use|invocation)",
+        "(?:combine|chain|sequence)\\s+(?:tools|functions)\\s+(?:to|for)\\s+(?:achieve|perform|execute)\\s+(?:unauthorized|malicious)"
+      ]
+    },
+    {
+      "id": "asi03-identity-abuse",
+      "name": "Identity Abuse Detection",
+      "owasp_id": "ASI03",
+      "severity": "high",
+      "type": "agentic-security",
+      "description": "Detects identity and privilege abuse patterns.",
+      "recommendation": "Implement strict identity and privilege management. Monitor for privilege escalation. Enforce least privilege principles.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "medium" },
+      "patterns": [
+        "(?:abuse|misuse|exploit|impersonate|spoof)\\s+(?:identity|privilege|permission|access|role)",
+        "(?:escalate|elevate|raise|upgrade)\\s+(?:privilege|permission|access|authority)",
+        "(?:assume|take|steal|hijack)\\s+(?:identity|role|privilege|permission)",
+        "(?:unauthorized|illegitimate|improper)\\s+(?:privilege|permission|access|authority)\\s+(?:use|usage|exercise)",
+        "(?:bypass|circumvent|override)\\s+(?:identity|authentication|authorization|access\\s+control)"
+      ]
+    },
+    {
+      "id": "asi04-supply-chain",
+      "name": "Agentic Supply Chain Detection",
+      "owasp_id": "ASI04",
+      "severity": "high",
+      "type": "agentic-security",
+      "description": "Detects agentic supply chain vulnerabilities.",
+      "recommendation": "Verify agent framework and model integrity. Use signed and verified dependencies. Monitor for supply chain attacks.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "medium" },
+      "patterns": [
+        "(?:compromised|vulnerable|malicious)\\s+(?:agent|framework|model|dependency|package)",
+        "(?:supply\\s+chain|dependency)\\s+(?:attack|vulnerability|compromise|tampering)",
+        "(?:unsigned|unverified|untrusted)\\s+(?:agent|framework|model|dependency)",
+        "(?:tampered|modified|altered)\\s+(?:agent|framework|model|dependency)",
+        "(?:typosquatting|brandjacking|namespace)\\s+(?:agent|framework|model|package)"
+      ]
+    },
+    {
+      "id": "asi06-memory-poisoning",
+      "name": "Memory Poisoning Detection",
+      "owasp_id": "ASI06",
+      "severity": "high",
+      "type": "agentic-security",
+      "description": "Detects memory and context poisoning patterns.",
+      "recommendation": "Implement memory and context validation. Monitor for data poisoning. Use memory isolation and sanitization.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "critical" },
+      "patterns": [
+        "(?:poison|corrupt|taint|contaminate|manipulate)\\s+(?:memory|context|data|information)",
+        "(?:inject|insert)\\s+(?:malicious|harmful|poisoned|corrupted)\\s+(?:data|information|memory|context)",
+        "(?:memory|context|data)\\s+(?:poisoning|corruption|manipulation|tampering)",
+        "(?:compromise|compromised)\\s+(?:memory|context|data|information)",
+        "(?:tainted|poisoned|corrupted)\\s+(?:memory|context|data|information)"
+      ]
+    },
+    {
+      "id": "asi07-insecure-communication",
+      "name": "Insecure Communication Detection",
+      "owasp_id": "ASI07",
+      "severity": "high",
+      "type": "agentic-security",
+      "description": "Detects insecure inter-agent communication patterns.",
+      "recommendation": "Implement encrypted communication channels. Use TLS/SSL for all inter-agent communications. Authenticate all agent interactions.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "medium" },
+      "patterns": [
+        "(?:unencrypted|plaintext|cleartext|unsecured)\\s+(?:communication|channel|connection|transmission)",
+        "(?:http:\\/\\/|ftp:\\/\\/|ws:\\/\\/)\\s+(?:instead\\s+of|without|missing)",
+        "(?:no|missing|lack|without)\\s+(?:encryption|tls|ssl|https|authentication|auth)",
+        "(?:insecure|vulnerable|weak)\\s+(?:communication|channel|protocol|connection)",
+        "(?:intercept|eavesdrop|man-in-the-middle|mitm)\\s+(?:communication|channel|message)"
+      ]
+    },
+    {
+      "id": "asi08-cascading-failures",
+      "name": "Cascading Failures Detection",
+      "owasp_id": "ASI08",
+      "severity": "medium",
+      "type": "agentic-security",
+      "description": "Detects cascading failure vulnerabilities.",
+      "recommendation": "Implement failure isolation and containment. Use circuit breakers and failover mechanisms. Design for graceful degradation.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "low" },
+      "patterns": [
+        "(?:cascade|cascading|chain|domino)\\s+(?:failure|error|exception|outage|breakdown)",
+        "(?:propagate|spread|ripple|amplify)\\s+(?:failure|error|exception|outage)",
+        "(?:single\\s+point\\s+of\\s+failure|spof)",
+        "(?:no|missing|lack|without)\\s+(?:isolation|containment|circuit\\s+breaker|failover|redundancy)",
+        "(?:unhandled|uncaught|unrecoverable)\\s+(?:failure|error|exception)"
+      ]
+    },
+    {
+      "id": "asi09-trust-exploitation",
+      "name": "Trust Exploitation Detection",
+      "owasp_id": "ASI09",
+      "severity": "high",
+      "type": "agentic-security",
+      "description": "Detects human-agent trust exploitation patterns.",
+      "recommendation": "Implement trust verification mechanisms. Educate users about agent limitations. Monitor for trust exploitation patterns.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "critical" },
+      "patterns": [
+        "(?:exploit|abuse|manipulate|misuse)\\s+(?:trust|confidence|reliance|relationship)",
+        "(?:social\\s+engineering|phishing|deception|manipulation)\\s+(?:to|for|in\\s+order\\s+to)",
+        "(?:impersonate|spoof|pretend|masquerade)\\s+(?:as|to\\s+be)",
+        "(?:exploit|abuse)\\s+(?:human|user|operator)\\s+(?:trust|confidence|reliance)",
+        "(?:mislead|deceive|trick|fool)\\s+(?:human|user|operator|agent)"
+      ]
+    },
+    {
+      "id": "asi10-rogue-agent",
+      "name": "Rogue Agent Detection",
+      "owasp_id": "ASI10",
+      "severity": "critical",
+      "type": "agentic-security",
+      "description": "Detects rogue agent vulnerabilities.",
+      "recommendation": "Implement agent registration and approval processes. Monitor for unauthorized agent creation. Enforce agent lifecycle management.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "high" },
+      "patterns": [
+        "(?:rogue|unauthorized|unapproved|malicious|harmful)\\s+(?:agent|bot|automation|system)",
+        "(?:unauthorized|unapproved|unmanaged)\\s+(?:agent|bot)\\s+(?:creation|deployment|execution|activation)",
+        "(?:bypass|circumvent|avoid)\\s+(?:approval|authorization|review|governance)\\s+(?:for|to\\s+create|to\\s+deploy)",
+        "(?:hidden|concealed|undocumented|unregistered)\\s+(?:agent|bot|automation)",
+        "(?:self-replicating|self-propagating|autonomous)\\s+(?:agent|bot)\\s+(?:without|lacking)"
+      ]
+    }
+  ]
+}

package/core/cli/data/rule-packs/general-security.json

@@ -0,0 +1,173 @@
+{
+  "schema_version": "1.0",
+  "pack_id": "general-security",
+  "pack_name": "General Security Rules",
+  "version": "1.0.0",
+  "updated": "2026-03-15",
+  "source_url": "https://github.com/mcp-shark/rule-packs",
+  "rules": [
+    {
+      "id": "hardcoded-secrets",
+      "name": "Hardcoded Secrets Detection",
+      "owasp_id": "SECRET",
+      "severity": "high",
+      "type": "general-security",
+      "description": "Detects hardcoded secrets and API tokens in metadata.",
+      "recommendation": "Move secrets or API tokens to secure storage; never embed them directly in tool or resource metadata.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "first",
+      "severity_overrides": { "prompt": "medium" },
+      "patterns": [
+        { "regex": "sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}", "label": "OpenAI", "flags": "" },
+        { "regex": "github_pat_[0-9A-Za-z_]{40,90}", "label": "GitHub PAT", "flags": "" },
+        { "regex": "(ghp|gho|ghs|ghu)_[A-Za-z0-9]{36}", "label": "GitHub Token", "flags": "" },
+        { "regex": "glpat-[0-9A-Za-z\\-_]{20}", "label": "GitLab Token", "flags": "" },
+        { "regex": "xox[baprs]-[A-Za-z0-9-]{10,120}", "label": "Slack Token", "flags": "" },
+        {
+          "regex": "https:\\/\\/hooks\\.slack\\.com\\/services\\/[A-Za-z0-9+/]{30,}",
+          "label": "Slack Webhook",
+          "flags": ""
+        },
+        {
+          "regex": "[A-Za-z0-9]{24}\\.[A-Za-z0-9]{6}\\.[A-Za-z0-9_-]{27}",
+          "label": "Discord Token",
+          "flags": ""
+        },
+        { "regex": "AKIA[0-9A-Z]{16}", "label": "AWS Access Key", "flags": "" },
+        {
+          "regex": "(?<![A-Za-z0-9])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9])",
+          "label": "AWS Secret Key",
+          "flags": ""
+        },
+        { "regex": "AIza[0-9A-Za-z\\-_]{35}", "label": "Google API Key", "flags": "" },
+        { "regex": "sk_live_[0-9a-zA-Z]{24}", "label": "Stripe Secret", "flags": "" },
+        { "regex": "rk_live_[0-9a-zA-Z]{24}", "label": "Stripe Restricted", "flags": "" },
+        { "regex": "SK[0-9a-fA-F]{32}", "label": "Twilio API Key", "flags": "" },
+        {
+          "regex": "SG\\.[0-9A-Za-z\\-_]{22}\\.[0-9A-Za-z\\-_]{43}",
+          "label": "SendGrid",
+          "flags": ""
+        },
+        { "regex": "key-[0-9a-fA-F]{32}", "label": "Mailgun", "flags": "" },
+        { "regex": "[A-Z0-9]{32}-[A-Z0-9]{10}", "label": "Algolia", "flags": "" },
+        {
+          "regex": "heroku[_a-z]*[:=]\\s*['\\\"]?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}",
+          "label": "Heroku API token",
+          "flags": "i"
+        },
+        {
+          "regex": "pscale_(?:tkn|pw|oauth)_[A-Za-z0-9._=-]{30,60}",
+          "label": "PlanetScale",
+          "flags": ""
+        },
+        { "regex": "PMAK-[0-9a-f]{24}-[0-9a-f]{34}", "label": "Postman", "flags": "" },
+        { "regex": "AAAA[a-zA-Z0-9_-]{7}:[a-zA-Z0-9_-]{140}", "label": "Firebase", "flags": "" }
+      ]
+    },
+    {
+      "id": "ansi-escape-sequences",
+      "name": "ANSI Escape Sequence Detection",
+      "owasp_id": "MCP03",
+      "severity": "medium",
+      "type": "general-security",
+      "description": "Detects ANSI escape codes in tool descriptions that could hide malicious content.",
+      "recommendation": "Strip ANSI escape sequences from tool descriptions. Run: npx mcp-shark scan --fix",
+      "scope": ["tool"],
+      "match_mode": "first",
+      "text_field": "description",
+      "patterns": [
+        { "regex": "\u001b\\[[0-9;]*[a-zA-Z]", "label": "ANSI escape sequence", "flags": "" }
+      ],
+      "severity_escalation_patterns": [
+        { "regex": "\u001b\\[\\d*[ABCDHJ]", "label": "ANSI cursor movement", "severity": "high" }
+      ]
+    },
+    {
+      "id": "dns-rebinding",
+      "name": "DNS Rebinding Detection",
+      "owasp_id": "MCP07",
+      "severity": "high",
+      "type": "network-security",
+      "description": "Detects servers bound to 0.0.0.0 vulnerable to DNS rebinding attacks.",
+      "recommendation": "Bind MCP servers to 127.0.0.1 or localhost instead of 0.0.0.0. Use --host 127.0.0.1 flag.",
+      "scope": ["tool"],
+      "match_mode": "first",
+      "patterns": [
+        { "regex": "0\\.0\\.0\\.0", "flags": "" },
+        { "regex": "--host\\s+0\\.0\\.0\\.0", "flags": "i" },
+        { "regex": "HOST[=:]\\s*0\\.0\\.0\\.0", "flags": "" },
+        { "regex": "listen\\(['\"]0\\.0\\.0\\.0['\"]\\)", "flags": "" },
+        { "regex": "INADDR_ANY", "flags": "" }
+      ]
+    },
+    {
+      "id": "sensitive-data-exposure",
+      "name": "Sensitive Data Exposure",
+      "owasp_id": "MCP08",
+      "severity": "high",
+      "type": "general-security",
+      "description": "Detects tools that may expose PII, credentials, or secrets without redaction.",
+      "recommendation": "Tools that access sensitive data should redact PII, credentials, and secrets from responses. Apply output filtering.",
+      "scope": ["tool"],
+      "match_mode": "first",
+      "exclude_patterns": ["redact", "mask", "filter", "sanitize", "censor", "strip", "scrub"],
+      "patterns": [
+        { "regex": "password", "label": "password field" },
+        { "regex": "credit[_\\s]?card", "label": "credit card data" },
+        { "regex": "social[_\\s]?security", "label": "social security number" },
+        { "regex": "ssn\\b", "label": "SSN field" },
+        { "regex": "private[_\\s]?key", "label": "private key" },
+        { "regex": "secret[_\\s]?key", "label": "secret key" },
+        { "regex": "bearer[_\\s]?token", "label": "bearer token" },
+        { "regex": "access[_\\s]?token", "label": "access token" },
+        { "regex": "refresh[_\\s]?token", "label": "refresh token" },
+        { "regex": "database[_\\s]?url", "label": "database URL" },
+        { "regex": "connection[_\\s]?string", "label": "connection string" }
+      ]
+    },
+    {
+      "id": "excessive-permissions",
+      "name": "Excessive Permissions",
+      "owasp_id": "MCP02",
+      "severity": "high",
+      "type": "general-security",
+      "description": "Detects servers or tools with overly broad permission scopes.",
+      "recommendation": "Apply the principle of least privilege. Restrict server permissions to only what is needed for its function.",
+      "scope": ["tool"],
+      "match_mode": "first",
+      "patterns": [
+        { "regex": "\\*:\\*", "label": "wildcard scope (*:*)", "flags": "" },
+        { "regex": "admin[_:]?access", "label": "admin access" },
+        { "regex": "full[_-]?access", "label": "full access" },
+        { "regex": "root[_:]?access", "label": "root access" },
+        { "regex": "sudo\\s", "label": "sudo usage" },
+        { "regex": "--privileged", "label": "privileged flag" },
+        { "regex": "--no-sandbox", "label": "no-sandbox flag" },
+        { "regex": "chmod\\s+777", "label": "chmod 777" },
+        { "regex": "allowAll|allow_all", "label": "allow-all policy" },
+        { "regex": "unrestricted", "label": "unrestricted mode" }
+      ]
+    },
+    {
+      "id": "path-traversal",
+      "name": "Path Traversal Detection",
+      "owasp_id": "MCP05",
+      "severity": "high",
+      "type": "general-security",
+      "description": "Detects tools that accept file paths without sanitization, enabling directory traversal.",
+      "recommendation": "Validate and sanitize all file paths. Reject paths containing \"..\" or absolute paths outside allowed directories.",
+      "scope": ["tool"],
+      "match_mode": "first",
+      "patterns": [
+        { "regex": "\\.\\.[\\/\\\\]", "label": "literal path traversal (../)", "flags": "" },
+        { "regex": "path[_\\s]*traversal", "label": "path traversal mention" },
+        { "regex": "any\\s+file\\s+path", "label": "unrestricted file path" },
+        { "regex": "arbitrary\\s+(file|path)", "label": "arbitrary file access" },
+        { "regex": "absolute[_\\s]*path", "label": "absolute path accepted" }
+      ],
+      "param_patterns": [
+        { "regex": "^(file_?path|filepath|path|filename|file)$", "label": "file path parameter" }
+      ]
+    }
+  ]
+}

package/core/cli/data/rule-packs/owasp-mcp-2026.json

@@ -0,0 +1,244 @@
+{
+  "schema_version": "1.0",
+  "pack_id": "owasp-mcp-2026",
+  "pack_name": "OWASP MCP Top 10 (2026)",
+  "version": "1.0.0",
+  "updated": "2026-03-15",
+  "source_url": "https://owasp.org/www-project-mcp-top-10/",
+  "rules": [
+    {
+      "id": "mcp01-token-mismanagement",
+      "name": "Token Mismanagement & Secret Exposure",
+      "owasp_id": "MCP01",
+      "severity": "high",
+      "type": "owasp-mcp",
+      "description": "Detects hard-coded credentials, API keys, and secrets that could be exposed through prompt injection or compromised context.",
+      "recommendation": "Move all tokens and secrets to secure storage (environment variables, secret managers). Never embed credentials in MCP server configurations.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "medium" },
+      "patterns": [
+        { "regex": "sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}", "label": "OpenAI", "flags": "" },
+        { "regex": "github_pat_[0-9A-Za-z_]{40,90}", "label": "GitHub PAT", "flags": "" },
+        { "regex": "(ghp|gho|ghs|ghu)_[A-Za-z0-9]{36}", "label": "GitHub Token", "flags": "" },
+        { "regex": "glpat-[0-9A-Za-z\\-_]{20}", "label": "GitLab Token", "flags": "" },
+        { "regex": "xox[baprs]-[A-Za-z0-9-]{10,120}", "label": "Slack Token", "flags": "" },
+        {
+          "regex": "https:\\/\\/hooks\\.slack\\.com\\/services\\/[A-Za-z0-9+/]{30,}",
+          "label": "Slack Webhook",
+          "flags": ""
+        },
+        {
+          "regex": "[A-Za-z0-9]{24}\\.[A-Za-z0-9]{6}\\.[A-Za-z0-9_-]{27}",
+          "label": "Discord Token",
+          "flags": ""
+        },
+        { "regex": "AKIA[0-9A-Z]{16}", "label": "AWS Access Key", "flags": "" },
+        {
+          "regex": "(?<![A-Za-z0-9])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9])",
+          "label": "AWS Secret Key",
+          "flags": ""
+        },
+        { "regex": "AIza[0-9A-Za-z\\-_]{35}", "label": "Google API Key", "flags": "" },
+        { "regex": "sk_live_[0-9a-zA-Z]{24}", "label": "Stripe Secret", "flags": "" },
+        { "regex": "rk_live_[0-9a-zA-Z]{24}", "label": "Stripe Restricted", "flags": "" },
+        { "regex": "SK[0-9a-fA-F]{32}", "label": "Twilio API Key", "flags": "" },
+        {
+          "regex": "SG\\.[0-9A-Za-z\\-_]{22}\\.[0-9A-Za-z\\-_]{43}",
+          "label": "SendGrid",
+          "flags": ""
+        },
+        { "regex": "key-[0-9a-fA-F]{32}", "label": "Mailgun", "flags": "" },
+        { "regex": "[A-Z0-9]{32}-[A-Z0-9]{10}", "label": "Algolia", "flags": "" },
+        {
+          "regex": "heroku[_a-z]*[:=]\\s*['\\\"]?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}",
+          "label": "Heroku API token",
+          "flags": "i"
+        },
+        {
+          "regex": "pscale_(?:tkn|pw|oauth)_[A-Za-z0-9._=-]{30,60}",
+          "label": "PlanetScale",
+          "flags": ""
+        },
+        { "regex": "PMAK-[0-9a-f]{24}-[0-9a-f]{34}", "label": "Postman", "flags": "" },
+        { "regex": "AAAA[a-zA-Z0-9_-]{7}:[a-zA-Z0-9_-]{140}", "label": "Firebase", "flags": "" }
+      ]
+    },
+    {
+      "id": "mcp02-scope-creep",
+      "name": "Scope Creep Detection",
+      "owasp_id": "MCP02",
+      "severity": "medium",
+      "type": "owasp-mcp",
+      "description": "Detects potential privilege escalation via scope creep in tool definitions.",
+      "recommendation": "Implement strict scope boundaries for tools. Monitor for unauthorized scope expansion and enforce least privilege principles.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "low" },
+      "patterns": [
+        "(?:expand|extend|increase|broaden|widen)\\s+(?:scope|permission|access|capability|authority)",
+        "(?:additional|extra|more|further)\\s+(?:privilege|permission|access|right)",
+        "(?:escalate|elevate|raise|upgrade)\\s+(?:privilege|permission|access|level)",
+        "(?:unrestricted|unlimited|full|complete|total)\\s+(?:access|permission|privilege|control)",
+        "(?:bypass|override|circumvent)\\s+(?:restriction|limit|constraint|control)"
+      ]
+    },
+    {
+      "id": "mcp03-tool-poisoning",
+      "name": "Tool Poisoning Detection",
+      "owasp_id": "MCP03",
+      "severity": "high",
+      "type": "owasp-mcp",
+      "description": "Detects malicious patterns that could indicate tool poisoning attacks.",
+      "recommendation": "Verify tool authenticity and integrity. Implement tool signing and verification mechanisms. Monitor for suspicious tool behavior.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "medium" },
+      "patterns": [
+        "(?:malicious|harmful|dangerous|exploit|attack|backdoor|trojan|virus)",
+        "(?:unauthorized|illegitimate|fake|spoofed|forged|tampered)",
+        "(?:steal|exfiltrate|leak|extract)\\s+(?:data|information|credentials|secrets)",
+        "(?:delete|remove|destroy|wipe|erase)\\s+(?:file|data|information)",
+        "(?:override|bypass|disable)\\s+(?:security|protection|safeguard|control)",
+        "(?:hidden|concealed|obfuscated|encoded)\\s+(?:functionality|behavior|action)"
+      ]
+    },
+    {
+      "id": "mcp04-supply-chain",
+      "name": "Supply Chain Vulnerability Detection",
+      "owasp_id": "MCP04",
+      "severity": "high",
+      "type": "owasp-mcp",
+      "description": "Detects potential supply chain vulnerabilities in MCP configurations.",
+      "recommendation": "Pin all dependencies to specific versions. Verify package integrity and signatures. Use trusted repositories and registries.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "medium" },
+      "patterns": [
+        "(?:unsigned|unverified|untrusted|unauthenticated)\\s+(?:package|dependency|module|library)",
+        "(?:tampered|modified|altered|compromised)\\s+(?:package|dependency|module|library)",
+        "(?:dependency|package|module)\\s+(?:confusion|substitution|hijacking)",
+        "(?:typosquatting|brandjacking|namespace)\\s+(?:package|dependency|module)",
+        "(?:unpinned|floating|wildcard)\\s+(?:version|dependency|package)",
+        "(?:from|source)\\s+(?:unknown|unverified|suspicious|untrusted)\\s+(?:source|repository|registry)"
+      ]
+    },
+    {
+      "id": "mcp06-prompt-injection",
+      "name": "Prompt Injection Detection",
+      "owasp_id": "MCP06",
+      "severity": "high",
+      "type": "owasp-mcp",
+      "description": "Detects prompt injection attempts via contextual payloads and suspicious tool names.",
+      "recommendation": "Implement prompt injection defenses. Validate and sanitize all user inputs. Use prompt isolation and output filtering.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "critical" },
+      "patterns": [
+        "(?:ignore|forget|disregard)\\s+(?:\\w+\\s+)*(?:previous|prior|earlier|above|instructions|prompts|system)",
+        "(?:new|different|override|replace)\\s+(?:instructions|prompt|system|rules)",
+        "(?:you\\s+are|act\\s+as|pretend\\s+to\\s+be|roleplay\\s+as)",
+        "(?:system|admin|root|sudo)\\s+(?:access|privilege|permission|command)",
+        "(?:extract|reveal|show|display|output)\\s+(?:system|prompt|instruction|secret|password|token)",
+        "(?:execute|run|perform)\\s+(?:arbitrary|any|unrestricted|unlimited)\\s+(?:command|action|code)"
+      ],
+      "tool_name_patterns": [
+        {
+          "regex": "instruction_?override",
+          "label": "Instruction Override Tool",
+          "severity": "critical"
+        },
+        {
+          "regex": "system_?prompt|systemprompt",
+          "label": "System Prompt Access Tool",
+          "severity": "critical"
+        },
+        {
+          "regex": "ignore_?instruction",
+          "label": "Ignore Instruction Tool",
+          "severity": "critical"
+        },
+        { "regex": "bypass_?security", "label": "Security Bypass Tool", "severity": "critical" },
+        { "regex": "admin_?override", "label": "Admin Override Tool", "severity": "critical" },
+        { "regex": "privilege_?escalat", "label": "Privilege Escalation Tool", "severity": "high" },
+        { "regex": "sudo|root_?access", "label": "Elevated Privilege Tool", "severity": "high" },
+        { "regex": "hidden_?command", "label": "Hidden Command Tool", "severity": "high" },
+        { "regex": "secret_?access", "label": "Secret Access Tool", "severity": "high" }
+      ]
+    },
+    {
+      "id": "mcp07-insufficient-auth",
+      "name": "Insufficient Authentication Detection",
+      "owasp_id": "MCP07",
+      "severity": "high",
+      "type": "owasp-mcp",
+      "description": "Detects potential authentication and authorization weaknesses.",
+      "recommendation": "Implement proper authentication and authorization mechanisms. Enforce access controls for all tools and resources.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "medium" },
+      "patterns": [
+        "(?:no|missing|lack|absent|without)\\s+(?:authentication|auth|authorization|authz|access\\s+control)",
+        "(?:public|open|unrestricted|unprotected|unsecured)\\s+(?:access|endpoint|api|tool|resource)",
+        "(?:anonymous|guest|unauthenticated)\\s+(?:user|access|request)",
+        "(?:skip|bypass|ignore|disable)\\s+(?:authentication|auth|authorization|check|validation)",
+        "(?:weak|insecure|poor|insufficient)\\s+(?:authentication|auth|authorization|security)"
+      ]
+    },
+    {
+      "id": "mcp08-lack-audit",
+      "name": "Lack of Audit Detection",
+      "owasp_id": "MCP08",
+      "severity": "medium",
+      "type": "owasp-mcp",
+      "description": "Detects potential lack of audit trails and telemetry.",
+      "recommendation": "Implement comprehensive logging, audit trails, and telemetry. Monitor all tool usage and resource access.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "low" },
+      "patterns": [
+        "(?:no|missing|lack|absent|without)\\s+(?:logging|log|audit|telemetry|monitoring|tracking)",
+        "(?:disable|turn\\s+off|remove)\\s+(?:logging|log|audit|telemetry|monitoring)",
+        "(?:silent|quiet|no\\s+output)\\s+(?:mode|operation|execution)",
+        "(?:unlogged|unmonitored|untracked)\\s+(?:action|operation|event|access)"
+      ]
+    },
+    {
+      "id": "mcp09-shadow-servers",
+      "name": "Shadow Server Detection",
+      "owasp_id": "MCP09",
+      "severity": "high",
+      "type": "owasp-mcp",
+      "description": "Detects potential unauthorized or shadow MCP server deployments.",
+      "recommendation": "Maintain an inventory of all MCP servers. Implement server registration and approval processes. Monitor for unauthorized deployments.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "medium" },
+      "patterns": [
+        "(?:unauthorized|unmanaged|unapproved|unofficial)\\s+(?:server|service|instance|deployment)",
+        "(?:shadow|rogue|hidden|concealed|undocumented)\\s+(?:server|service|instance|deployment)",
+        "(?:bypass|circumvent|avoid)\\s+(?:approval|review|governance|management|control)",
+        "(?:unregistered|unlisted|unmonitored)\\s+(?:server|service|instance|deployment)"
+      ]
+    },
+    {
+      "id": "mcp10-context-injection",
+      "name": "Context Injection Detection",
+      "owasp_id": "MCP10",
+      "severity": "medium",
+      "type": "owasp-mcp",
+      "description": "Detects context injection and over-sharing vulnerabilities.",
+      "recommendation": "Implement context isolation and filtering. Limit context sharing between tools and servers. Validate all context data.",
+      "scope": ["tool", "prompt", "resource", "packet"],
+      "match_mode": "all_matches",
+      "severity_overrides": { "prompt": "high" },
+      "patterns": [
+        "(?:over-share|overshare|excessive|too\\s+much)\\s+(?:context|information|data|details)",
+        "(?:share|expose|reveal|leak)\\s+(?:all|entire|full|complete|everything)\\s+(?:context|information|data)",
+        "(?:inject|insert)\\s+(?:context|information|data|payload)\\s+(?:into|to|in)",
+        "(?:context|information|data)\\s+(?:injection|manipulation|tampering|poisoning)",
+        "(?:unrestricted|unlimited|unfiltered)\\s+(?:context|information|data)\\s+(?:sharing|access|transfer)"
+      ]
+    }
+  ]
+}

package/core/cli/data/rule-packs/toxic-flow-heuristics.json

@@ -0,0 +1,21 @@
+{
+  "schema_version": "1.0",
+  "pack_id": "toxic-flow-heuristics",
+  "pack_name": "Toxic flow capability-pair heuristics",
+  "version": "1.0.0",
+  "updated": "2026-04-05",
+  "source_url": "https://github.com/mcp-shark/rule-packs",
+  "description": "Cross-server toxic flow rules consumed by analyzeToxicFlows (CLI, HTML report, proxy traffic panel). Declarative rules[] is empty; heuristics live in toxic_flow_rules.",
+  "rules": [],
+  "toxic_flow_rules": [
+    {
+      "source": "writes_code",
+      "target": "sends_external",
+      "risk": "HIGH",
+      "title": "Code change \u2192 external disclosure",
+      "scenario": "The agent could alter code or repos via {source} and leak implementation details, tokens, or other sensitive context through {target}.",
+      "catalog": "\u00a71.2, \u00a71.10",
+      "owasp": "MCP03 + MCP06"
+    }
+  ]
+}

package/core/cli/data/rule-sources.json

@@ -0,0 +1,5 @@
+{
+  "registry_url": "https://raw.githubusercontent.com/mcp-shark/rule-packs/main/manifest.json",
+  "cache_dir": ".mcp-shark/rule-packs",
+  "default_auto_update_max_age_hours": 168
+}

package/core/cli/data/secret-patterns.json

@@ -0,0 +1,18 @@
+[
+  { "pattern": "^ghp_[a-zA-Z0-9]{36,}$", "name": "GitHub PAT", "severity": "high" },
+  { "pattern": "^gho_[a-zA-Z0-9]{36,}$", "name": "GitHub OAuth", "severity": "high" },
+  { "pattern": "^sk-[a-zA-Z0-9]{20,}$", "name": "API Key (sk-)", "severity": "high" },
+  { "pattern": "^xoxb-", "name": "Slack Bot Token", "severity": "high" },
+  { "pattern": "^xoxp-", "name": "Slack User Token", "severity": "critical" },
+  { "pattern": "^AKIA[A-Z0-9]{16}$", "name": "AWS Access Key", "severity": "critical" },
+  { "pattern": "^glpat-", "name": "GitLab PAT", "severity": "high" },
+  { "pattern": "^npm_[a-zA-Z0-9]{36,}$", "name": "npm Token", "severity": "high" },
+  { "pattern": "^[a-f0-9]{40}$", "name": "Hex Token (40 chars)", "severity": "medium" },
+  { "pattern": "^AIza[a-zA-Z0-9_-]{35}$", "name": "Google API Key", "severity": "high" },
+  {
+    "pattern": "^SG\\.[a-zA-Z0-9_-]+\\.[a-zA-Z0-9_-]+$",
+    "name": "SendGrid Key",
+    "severity": "high"
+  },
+  { "pattern": "^sk_live_[a-zA-Z0-9]+$", "name": "Stripe Live Key", "severity": "critical" }
+]