@mcp-shark/mcp-shark 1.5.13 → 1.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (158) hide show
  1. package/README.md +482 -56
  2. package/bin/mcp-shark.js +146 -52
  3. package/core/cli/AutoFixEngine.js +93 -0
  4. package/core/cli/ConfigScanner.js +193 -0
  5. package/core/cli/DataLoader.js +200 -0
  6. package/core/cli/DeclarativeRuleEngine.js +363 -0
  7. package/core/cli/DoctorCommand.js +218 -0
  8. package/core/cli/FixHandlers.js +222 -0
  9. package/core/cli/HtmlReportGenerator.js +203 -0
  10. package/core/cli/IdeConfigPaths.js +175 -0
  11. package/core/cli/ListCommand.js +255 -0
  12. package/core/cli/LockCommand.js +164 -0
  13. package/core/cli/LockDiffEngine.js +152 -0
  14. package/core/cli/RuleRegistryConfig.js +131 -0
  15. package/core/cli/ScanCommand.js +244 -0
  16. package/core/cli/ScanService.js +200 -0
  17. package/core/cli/SecretDetector.js +92 -0
  18. package/core/cli/SharkScoreCalculator.js +109 -0
  19. package/core/cli/ToolClassifications.js +51 -0
  20. package/core/cli/ToxicFlowAnalyzer.js +212 -0
  21. package/core/cli/UpdateCommand.js +188 -0
  22. package/core/cli/WalkthroughGenerator.js +195 -0
  23. package/core/cli/WatchCommand.js +129 -0
  24. package/core/cli/YamlRuleEngine.js +197 -0
  25. package/core/cli/data/rule-packs/aauth-visibility.json +117 -0
  26. package/core/cli/data/rule-packs/agentic-security-2026.json +180 -0
  27. package/core/cli/data/rule-packs/general-security.json +173 -0
  28. package/core/cli/data/rule-packs/owasp-mcp-2026.json +244 -0
  29. package/core/cli/data/rule-packs/toxic-flow-heuristics.json +21 -0
  30. package/core/cli/data/rule-sources.json +5 -0
  31. package/core/cli/data/secret-patterns.json +18 -0
  32. package/core/cli/data/tool-classifications.json +111 -0
  33. package/core/cli/data/toxic-flow-rules.json +47 -0
  34. package/core/cli/index.js +23 -0
  35. package/core/cli/output/Banner.js +52 -0
  36. package/core/cli/output/Formatter.js +183 -0
  37. package/core/cli/output/JsonFormatter.js +106 -0
  38. package/core/cli/output/index.js +16 -0
  39. package/core/cli/secureRegistryFetch.js +157 -0
  40. package/core/cli/symbols.js +16 -0
  41. package/core/configs/environment.js +3 -1
  42. package/core/configs/index.js +3 -64
  43. package/core/container/DependencyContainer.js +4 -1
  44. package/core/mcp-server/index.js +4 -1
  45. package/core/mcp-server/server/external/all.js +10 -3
  46. package/core/mcp-server/server/external/config.js +62 -5
  47. package/core/models/RequestFilters.js +3 -0
  48. package/core/repositories/PacketRepository.js +16 -0
  49. package/core/services/AuditService.js +2 -0
  50. package/core/services/ConfigService.js +9 -1
  51. package/core/services/ConfigTransformService.js +34 -2
  52. package/core/services/RequestService.js +58 -5
  53. package/core/services/ServerManagementService.js +59 -4
  54. package/core/services/security/StaticRulesService.js +69 -13
  55. package/core/services/security/TrafficAnalysisService.js +19 -1
  56. package/core/services/security/TrafficToxicFlowService.js +154 -0
  57. package/core/services/security/aauthGraph.js +199 -0
  58. package/core/services/security/aauthParser.js +274 -0
  59. package/core/services/security/aauthSelfTest.js +346 -0
  60. package/core/services/security/index.js +2 -1
  61. package/core/services/security/rules/index.js +25 -59
  62. package/core/services/security/rules/scans/configPermissions.js +91 -0
  63. package/core/services/security/rules/scans/duplicateToolNames.js +85 -0
  64. package/core/services/security/rules/scans/insecureTransport.js +148 -0
  65. package/core/services/security/rules/scans/missingContainment.js +123 -0
  66. package/core/services/security/rules/scans/shellEnvInjection.js +101 -0
  67. package/core/services/security/rules/scans/unsafeDefaults.js +99 -0
  68. package/core/services/security/toolsListFromTrafficParser.js +70 -0
  69. package/core/tui/App.js +144 -0
  70. package/core/tui/FindingsPanel.js +115 -0
  71. package/core/tui/FixPanel.js +132 -0
  72. package/core/tui/Header.js +51 -0
  73. package/core/tui/HelpBar.js +42 -0
  74. package/core/tui/ServersPanel.js +109 -0
  75. package/core/tui/ToxicFlowsPanel.js +100 -0
  76. package/core/tui/h.js +8 -0
  77. package/core/tui/index.js +11 -0
  78. package/core/tui/render.js +22 -0
  79. package/package.json +24 -16
  80. package/ui/dist/assets/index-D6zDrtMV.js +81 -0
  81. package/ui/dist/index.html +1 -1
  82. package/ui/server/controllers/AauthController.js +279 -0
  83. package/ui/server/controllers/RequestController.js +12 -1
  84. package/ui/server/controllers/SecurityFindingsController.js +46 -1
  85. package/ui/server/routes/aauth.js +18 -0
  86. package/ui/server/routes/requests.js +8 -1
  87. package/ui/server/routes/security.js +5 -1
  88. package/ui/server/setup.js +224 -6
  89. package/ui/server/swagger/paths/components.js +55 -0
  90. package/ui/server/swagger/paths/securityTrafficFlows.js +59 -0
  91. package/ui/server/swagger/paths.js +2 -2
  92. package/ui/server/swagger/swagger.js +5 -2
  93. package/ui/server.js +1 -1
  94. package/ui/src/App.jsx +26 -52
  95. package/ui/src/PacketFilters.jsx +31 -1
  96. package/ui/src/PacketList.jsx +2 -2
  97. package/ui/src/Security.jsx +10 -0
  98. package/ui/src/TabNavigation.jsx +8 -0
  99. package/ui/src/components/AAuthBadge.jsx +92 -0
  100. package/ui/src/components/AauthExplorer/AauthExplorerGraph.jsx +231 -0
  101. package/ui/src/components/AauthExplorer/AauthExplorerView.jsx +387 -0
  102. package/ui/src/components/AauthExplorer/NodeDetailPanel.jsx +272 -0
  103. package/ui/src/components/App/ActionMenu.jsx +4 -31
  104. package/ui/src/components/App/ApiDocsButton.jsx +0 -1
  105. package/ui/src/components/App/ShutdownButton.jsx +0 -1
  106. package/ui/src/components/App/useAppState.js +19 -26
  107. package/ui/src/components/DetailsTab/AAuthIdentitySection.jsx +119 -0
  108. package/ui/src/components/DetailsTab/RequestDetailsSection.jsx +2 -0
  109. package/ui/src/components/DetailsTab/ResponseDetailsSection.jsx +2 -0
  110. package/ui/src/components/DetectedPathsList.jsx +1 -5
  111. package/ui/src/components/FileInput.jsx +0 -1
  112. package/ui/src/components/PacketFilters/AAuthPostureFilter.jsx +81 -0
  113. package/ui/src/components/RequestRow/RequestRowMain.jsx +7 -1
  114. package/ui/src/components/Security/AAuthPosturePanel.jsx +360 -0
  115. package/ui/src/components/Security/ScannerContent.jsx +33 -1
  116. package/ui/src/components/Security/TrafficToxicFlowsPanel.jsx +253 -0
  117. package/ui/src/components/Security/securityApi.js +15 -0
  118. package/ui/src/components/Security/useSecurity.js +60 -3
  119. package/ui/src/components/ServerControl.jsx +0 -1
  120. package/ui/src/components/TabNavigation/DesktopTabs.jsx +0 -11
  121. package/ui/src/components/TabNavigationIcons.jsx +5 -0
  122. package/ui/src/components/ViewModeTabs.jsx +0 -1
  123. package/ui/src/utils/animations.js +26 -9
  124. package/core/services/security/rules/scans/agentic01GoalHijack.js +0 -130
  125. package/core/services/security/rules/scans/agentic02ToolMisuse.js +0 -129
  126. package/core/services/security/rules/scans/agentic03IdentityAbuse.js +0 -130
  127. package/core/services/security/rules/scans/agentic04SupplyChain.js +0 -130
  128. package/core/services/security/rules/scans/agentic06MemoryPoisoning.js +0 -130
  129. package/core/services/security/rules/scans/agentic07InsecureCommunication.js +0 -135
  130. package/core/services/security/rules/scans/agentic08CascadingFailures.js +0 -135
  131. package/core/services/security/rules/scans/agentic09TrustExploitation.js +0 -135
  132. package/core/services/security/rules/scans/agentic10RogueAgent.js +0 -130
  133. package/core/services/security/rules/scans/hardcodedSecrets.js +0 -130
  134. package/core/services/security/rules/scans/mcp01TokenMismanagement.js +0 -127
  135. package/core/services/security/rules/scans/mcp02ScopeCreep.js +0 -130
  136. package/core/services/security/rules/scans/mcp03ToolPoisoning.js +0 -132
  137. package/core/services/security/rules/scans/mcp04SupplyChain.js +0 -131
  138. package/core/services/security/rules/scans/mcp06PromptInjection.js +0 -200
  139. package/core/services/security/rules/scans/mcp07InsufficientAuth.js +0 -130
  140. package/core/services/security/rules/scans/mcp08LackAudit.js +0 -129
  141. package/core/services/security/rules/scans/mcp09ShadowServers.js +0 -129
  142. package/core/services/security/rules/scans/mcp10ContextInjection.js +0 -130
  143. package/ui/dist/assets/index-CiCSDYf-.js +0 -97
  144. package/ui/server/routes/help.js +0 -44
  145. package/ui/server/swagger/paths/help.js +0 -82
  146. package/ui/src/HelpGuide/HelpGuideContent.jsx +0 -118
  147. package/ui/src/HelpGuide/HelpGuideFooter.jsx +0 -59
  148. package/ui/src/HelpGuide/HelpGuideHeader.jsx +0 -57
  149. package/ui/src/HelpGuide.jsx +0 -78
  150. package/ui/src/IntroTour.jsx +0 -154
  151. package/ui/src/components/App/HelpButton.jsx +0 -90
  152. package/ui/src/components/TourOverlay.jsx +0 -117
  153. package/ui/src/components/TourTooltip/TourTooltipButtons.jsx +0 -120
  154. package/ui/src/components/TourTooltip/TourTooltipHeader.jsx +0 -71
  155. package/ui/src/components/TourTooltip/TourTooltipIcons.jsx +0 -54
  156. package/ui/src/components/TourTooltip/useTooltipPosition.js +0 -135
  157. package/ui/src/components/TourTooltip.jsx +0 -91
  158. package/ui/src/config/tourSteps.jsx +0 -140
@@ -1,140 +0,0 @@
1
- export const tourSteps = [
2
- {
3
- target: '[data-tour="tabs"]',
4
- title: 'Welcome to MCP Shark!',
5
- content: (
6
- <div>
7
- <p style={{ margin: '0 0 12px 0' }}>
8
- MCP Shark is a powerful tool for monitoring and analyzing Model Context Protocol (MCP)
9
- communications. Let's get you started!
10
- </p>
11
- <p style={{ margin: 0 }}>
12
- First, you'll need to set up the MCP Shark server. Click on the{' '}
13
- <strong>MCP Server Setup</strong> tab to begin.
14
- </p>
15
- </div>
16
- ),
17
- position: 'bottom',
18
- },
19
- {
20
- target: '[data-tour="setup-tab"]',
21
- title: 'Step 1: Open MCP Server Setup',
22
- content: (
23
- <div>
24
- <p style={{ margin: '0 0 8px 0' }}>
25
- Click on the <strong>MCP Server Setup</strong> tab to configure and start the MCP Shark
26
- server.
27
- </p>
28
- <p style={{ margin: 0, fontSize: '12px', color: '#858585' }}>
29
- This is where you'll configure your MCP servers and start monitoring.
30
- </p>
31
- </div>
32
- ),
33
- position: 'bottom',
34
- },
35
- {
36
- target: '[data-tour="detected-editors"]',
37
- title: 'Step 2: Select Your Configuration',
38
- content: (
39
- <div>
40
- <p style={{ margin: '0 0 8px 0' }}>
41
- MCP Shark automatically detects your IDE's MCP configuration files. You have two options:
42
- </p>
43
- <ul style={{ margin: '0 0 8px 0', paddingLeft: '20px', fontSize: '13px' }}>
44
- <li>
45
- Click on any <strong>detected editor</strong> (like Cursor or Windsurf) to use its
46
- config
47
- </li>
48
- <li>
49
- Or click <strong>"Select File"</strong> to upload your own config file
50
- </li>
51
- </ul>
52
- <p style={{ margin: 0, fontSize: '12px', color: '#858585' }}>
53
- When you click a detected editor, the file path will automatically populate in the text
54
- box.
55
- </p>
56
- </div>
57
- ),
58
- position: 'bottom',
59
- },
60
- {
61
- target: '[data-tour="select-file"]',
62
- title: 'Alternative: Upload Your Config',
63
- content: (
64
- <div>
65
- <p style={{ margin: '0 0 8px 0' }}>
66
- If you prefer, you can click <strong>"Select File"</strong> to upload your MCP
67
- configuration file directly.
68
- </p>
69
- <p style={{ margin: 0, fontSize: '12px', color: '#858585' }}>
70
- Or manually enter the file path in the text box next to it.
71
- </p>
72
- </div>
73
- ),
74
- position: 'bottom',
75
- },
76
- {
77
- target: '[data-tour="start-button"]',
78
- title: 'Step 3: Start MCP Shark',
79
- content: (
80
- <div>
81
- <p style={{ margin: '0 0 8px 0' }}>
82
- Once you've selected a configuration file (either from detected editors or uploaded),
83
- click <strong>"Start MCP Shark"</strong> to begin monitoring.
84
- </p>
85
- <p style={{ margin: 0, fontSize: '12px', color: '#858585' }}>
86
- The server will start and begin capturing all MCP traffic between your IDE and servers.
87
- </p>
88
- </div>
89
- ),
90
- position: 'top',
91
- },
92
- {
93
- target: '[data-tour="traffic-tab"]',
94
- title: 'View Your Traffic',
95
- content: (
96
- <div>
97
- <p style={{ margin: '0 0 8px 0' }}>
98
- After starting the server, switch to the <strong>Traffic Capture</strong> tab to see all
99
- HTTP requests and responses in real-time.
100
- </p>
101
- <p style={{ margin: 0, fontSize: '12px', color: '#858585' }}>
102
- You can view traffic as a flat list, grouped by session, or grouped by server.
103
- </p>
104
- </div>
105
- ),
106
- position: 'bottom',
107
- },
108
- {
109
- target: '[data-tour="smart-scan-tab"]',
110
- title: 'Smart Scan - AI Security Analysis',
111
- content: (
112
- <div>
113
- <p style={{ margin: '0 0 8px 0' }}>
114
- <strong>Smart Scan</strong> uses AI-powered analysis via remote API to detect security
115
- vulnerabilities in your MCP servers. For offline scanning, use the{' '}
116
- <strong>Local Analysis</strong> tab.
117
- </p>
118
- <p style={{ margin: 0, fontSize: '12px', color: '#858585' }}>
119
- Scan results are cached automatically, so you won't waste API calls on unchanged servers.
120
- </p>
121
- </div>
122
- ),
123
- position: 'bottom',
124
- },
125
- {
126
- target: '[data-tour="help-button"]',
127
- title: 'Need Help?',
128
- content: (
129
- <div>
130
- <p style={{ margin: '0 0 8px 0' }}>
131
- Click the <strong>Start Tour</strong> button anytime to restart this guide or get help.
132
- </p>
133
- <p style={{ margin: 0, fontSize: '12px', color: '#858585' }}>
134
- You're all set! Start by configuring your MCP server, then watch the traffic flow.
135
- </p>
136
- </div>
137
- ),
138
- position: 'left',
139
- },
140
- ];