@oculum/scanner 1.0.9 → 1.0.11

package/src/layer1/config-mcp-audit.ts

@@ -0,0 +1,276 @@
+/**
+ * Layer 1: MCP Configuration Audit
+ * Detects security issues in MCP configuration files
+ *
+ * Scans:
+ * - mcp.json, *.mcp.json
+ * - .mcp/config.json
+ * - mcpServers in package.json
+ *
+ * Detects:
+ * - Secrets in MCP config (API keys, tokens in args)
+ * - Overpermissive settings (disabled approval, infinite timeouts)
+ * - Insecure transport (http:// instead of https://)
+ */
+
+import type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory } from '../types'
+import {
+  isComment,
+  isTestOrMockFile,
+  isDocumentationFile,
+  isScannerOrFixtureFile,
+  isExampleDirectory,
+} from '../utils/context-helpers'
+
+// ============================================================================
+// Configuration File Detection
+// ============================================================================
+
+/**
+ * Check if file is an MCP configuration file
+ */
+function isMCPConfigFile(filePath: string): boolean {
+  const mcpConfigPatterns = [
+    /mcp\.json$/i,
+    /\.mcp\.json$/i,
+    /\.mcp\/config\.json$/i,
+    /mcp[-_]?config\.json$/i,
+    /claude[-_]?desktop[-_]?config\.json$/i,
+  ]
+  return mcpConfigPatterns.some(p => p.test(filePath))
+}
+
+/**
+ * Check if file might contain mcpServers configuration (package.json, etc.)
+ */
+function mightContainMCPConfig(filePath: string, content: string): boolean {
+  if (filePath.endsWith('package.json')) {
+    return content.includes('mcpServers') || content.includes('mcp')
+  }
+  if (filePath.endsWith('.json')) {
+    return content.includes('mcpServers') || content.includes('"command"') ||
+           content.includes('"args"') || content.includes('"url"')
+  }
+  return false
+}
+
+// ============================================================================
+// Pattern Definitions
+// ============================================================================
+
+interface MCPConfigPattern {
+  name: string
+  pattern: RegExp
+  category: VulnerabilityCategory
+  baseSeverity: VulnerabilitySeverity
+  description: string
+  suggestedFix: string
+}
+
+/**
+ * MCP Configuration Security Patterns
+ */
+const MCP_CONFIG_PATTERNS: MCPConfigPattern[] = [
+  // Secrets in args array
+  {
+    name: 'API key in MCP server args',
+    pattern: /"args"\s*:\s*\[[^\]]*(?:api[_-]?key|API[_-]?KEY|apiKey)[=:]["'][^"']+["'][^\]]*\]/gi,
+    category: 'ai_mcp_config_secrets',
+    baseSeverity: 'critical',
+    description: 'API key found in MCP server arguments. Secrets should not be stored in configuration files.',
+    suggestedFix: 'Use environment variables for secrets: ["--api-key", "${ANTHROPIC_API_KEY}"] or use a secrets manager.',
+  },
+  // Secret/token in args
+  {
+    name: 'Secret token in MCP server args',
+    pattern: /"args"\s*:\s*\[[^\]]*(?:secret|token|password|credential|auth)[=:]["'][^"']+["'][^\]]*\]/gi,
+    category: 'ai_mcp_config_secrets',
+    baseSeverity: 'critical',
+    description: 'Secret or token found in MCP server arguments. This could be exposed in logs or version control.',
+    suggestedFix: 'Move secrets to environment variables or a secrets manager.',
+  },
+  // Hardcoded bearer token
+  {
+    name: 'Bearer token in MCP config',
+    pattern: /"(?:auth|authorization|header)"\s*:\s*["'][Bb]earer\s+[A-Za-z0-9_-]+["']/gi,
+    category: 'ai_mcp_config_secrets',
+    baseSeverity: 'critical',
+    description: 'Bearer token hardcoded in MCP configuration. This is a security risk.',
+    suggestedFix: 'Use environment variable reference: "Bearer ${MCP_TOKEN}"',
+  },
+  // Environment variable with actual value (not reference)
+  {
+    name: 'Environment variable with hardcoded value',
+    pattern: /"env"\s*:\s*\{[^}]*(?:KEY|TOKEN|SECRET|PASSWORD)\s*"\s*:\s*"(?!\$\{)[^"]+"/gi,
+    category: 'ai_mcp_config_secrets',
+    baseSeverity: 'high',
+    description: 'Environment variable set to hardcoded secret value in MCP config.',
+    suggestedFix: 'Set environment variables outside the config file or use a secrets manager.',
+  },
+  // Disabled approval requirement
+  {
+    name: 'Tool approval disabled',
+    pattern: /"requireApproval"\s*:\s*false/gi,
+    category: 'ai_mcp_config_permissions',
+    baseSeverity: 'medium',
+    description: 'Tool approval is disabled. AI can execute tools without user confirmation.',
+    suggestedFix: 'Enable tool approval for sensitive operations: "requireApproval": true',
+  },
+  // Auto-approve all
+  {
+    name: 'Auto-approve all tools',
+    pattern: /"autoApprove"\s*:\s*(?:true|"\*"|"all"|\["\*"\])/gi,
+    category: 'ai_mcp_config_permissions',
+    baseSeverity: 'high',
+    description: 'All tools are auto-approved. This bypasses user confirmation for all operations.',
+    suggestedFix: 'Limit auto-approval to specific safe tools: "autoApprove": ["read_file", "list_files"]',
+  },
+  // Infinite or very long timeout
+  {
+    name: 'Unlimited tool timeout',
+    pattern: /"(?:toolTimeout|timeout)"\s*:\s*(?:0|null|"infinite"|999999+)/gi,
+    category: 'ai_mcp_config_permissions',
+    baseSeverity: 'medium',
+    description: 'Tool timeout is disabled or very long. Tools could run indefinitely.',
+    suggestedFix: 'Set a reasonable timeout: "toolTimeout": 30000 (30 seconds)',
+  },
+  // HTTP URL (not HTTPS)
+  {
+    name: 'Insecure HTTP transport',
+    pattern: /"(?:url|endpoint|server)"\s*:\s*"http:\/\/(?!localhost|127\.0\.0\.1)[^"]+"/gi,
+    category: 'ai_mcp_config_permissions',
+    baseSeverity: 'medium',
+    description: 'MCP server uses insecure HTTP transport. Data could be intercepted.',
+    suggestedFix: 'Use HTTPS for MCP server URLs: "url": "https://..."',
+  },
+  // Wildcard allowed tools
+  {
+    name: 'Wildcard tool permissions',
+    pattern: /"(?:allowedTools|tools|permissions)"\s*:\s*(?:\["\*"\]|"\*"|"all")/gi,
+    category: 'ai_mcp_config_permissions',
+    baseSeverity: 'medium',
+    description: 'All tools are allowed without restriction. Consider limiting to specific tools.',
+    suggestedFix: 'Explicitly list allowed tools: "allowedTools": ["search", "read_file"]',
+  },
+  // Privileged mode enabled
+  {
+    name: 'Privileged mode enabled',
+    pattern: /"(?:privileged|sudo|admin|root)"\s*:\s*true/gi,
+    category: 'ai_mcp_config_permissions',
+    baseSeverity: 'high',
+    description: 'MCP server running in privileged mode. This grants elevated permissions.',
+    suggestedFix: 'Disable privileged mode unless absolutely necessary. Apply principle of least privilege.',
+  },
+  // Disabled security features
+  {
+    name: 'Security feature disabled',
+    pattern: /"(?:secure|tls|verify|validation|sandbox)"\s*:\s*false/gi,
+    category: 'ai_mcp_config_permissions',
+    baseSeverity: 'medium',
+    description: 'Security feature is explicitly disabled in MCP configuration.',
+    suggestedFix: 'Enable security features: "secure": true, "validation": true',
+  },
+  // Command injection risk in args
+  {
+    name: 'Shell command in MCP args',
+    pattern: /"args"\s*:\s*\[[^\]]*(?:sh\s+-c|bash\s+-c|cmd\s+\/c|powershell)[^\]]*\]/gi,
+    category: 'ai_mcp_config_permissions',
+    baseSeverity: 'high',
+    description: 'MCP server args contain shell command execution. This is a command injection risk.',
+    suggestedFix: 'Avoid shell command execution in MCP args. Use direct command invocation.',
+  },
+]
+
+// ============================================================================
+// Main Detection Function
+// ============================================================================
+
+/**
+ * Main detection function for MCP configuration audit
+ */
+export function detectMCPConfigIssues(
+  content: string,
+  filePath: string
+): Vulnerability[] {
+  const vulnerabilities: Vulnerability[] = []
+
+  // Skip non-applicable files
+  if (isScannerOrFixtureFile(filePath)) return vulnerabilities
+  if (isDocumentationFile(filePath)) return vulnerabilities
+
+  // Only scan MCP config files or files that might contain MCP config
+  if (!isMCPConfigFile(filePath) && !mightContainMCPConfig(filePath, content)) {
+    return vulnerabilities
+  }
+
+  const lines = content.split('\n')
+  const isTestFile = isTestOrMockFile(filePath)
+  const isExample = isExampleDirectory(filePath)
+
+  // Track findings to avoid duplicates
+  const seenFindings = new Set<string>()
+
+  for (const pattern of MCP_CONFIG_PATTERNS) {
+    const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags)
+    let match
+
+    while ((match = regex.exec(content)) !== null) {
+      const lineNumber = content.substring(0, match.index).split('\n').length
+      const lineContent = lines[lineNumber - 1]?.trim() || ''
+
+      // Skip comments
+      if (isComment(lineContent)) continue
+
+      // Create dedup key
+      const dedupKey = `${filePath}:${lineNumber}:${pattern.category}`
+      if (seenFindings.has(dedupKey)) continue
+      seenFindings.add(dedupKey)
+
+      let severity = pattern.baseSeverity
+      let description = pattern.description
+      const notes: string[] = []
+
+      // Check if value is an environment variable reference (safer)
+      if (/\$\{[A-Z_]+\}|\$[A-Z_]+/.test(lineContent)) {
+        if (pattern.category === 'ai_mcp_config_secrets') {
+          severity = 'low'
+          notes.push('Uses environment variable reference (safer pattern)')
+        }
+      }
+
+      // Downgrade test files
+      if (isTestFile) {
+        severity = 'info'
+        notes.push('in test file')
+      }
+
+      // Downgrade example/demo directories
+      if (isExample && severity !== 'info') {
+        severity = 'info'
+        notes.push('in example/demo directory')
+      }
+
+      // Build final description
+      if (notes.length > 0) {
+        description += ` (${notes.join('; ')})`
+      }
+
+      vulnerabilities.push({
+        id: `mcp-config-${filePath}-${lineNumber}-${pattern.name.replace(/\s+/g, '-')}`,
+        filePath,
+        lineNumber,
+        lineContent,
+        severity,
+        category: pattern.category,
+        title: pattern.name,
+        description,
+        suggestedFix: pattern.suggestedFix,
+        confidence: pattern.category === 'ai_mcp_config_secrets' ? 'high' : 'medium',
+        layer: 1,
+        requiresAIValidation: severity !== 'info' && severity !== 'low',
+      })
+    }
+  }
+
+  return vulnerabilities
+}

package/src/layer1/index.ts

@@ -13,6 +13,7 @@ import { detectDangerousFiles } from './file-flags'
 import { detectAICommentPatterns } from './comments'
 import { detectSensitiveURLs } from './urls'
 import { detectWeakCrypto } from './weak-crypto'
+import { detectMCPConfigIssues } from './config-mcp-audit'
 import {
   type TierStats,
   computeTierStats,
@@ -47,12 +48,15 @@ export interface Layer1Result {
   stats: Layer1Stats
 }
 
+// Extended stats type to include MCP config detector
+type Layer1StatsRecord = Record<Layer1DetectorName, number> & { mcp_config: number }
+
 // Process a single file through all Layer 1 detectors
-function processFileLayer1(file: ScanFile): { 
-  findings: Vulnerability[], 
-  stats: Record<Layer1DetectorName, number> 
+function processFileLayer1(file: ScanFile): {
+  findings: Vulnerability[],
+  stats: Layer1StatsRecord
 } {
-  const stats: Record<Layer1DetectorName, number> = {
+  const stats: Layer1StatsRecord = {
     known_secrets: 0,
     weak_crypto: 0,
     sensitive_urls: 0,
@@ -60,6 +64,7 @@ function processFileLayer1(file: ScanFile): {
     config_audit: 0,
     file_flags: 0,
     ai_comments: 0,
+    mcp_config: 0,
   }
 
   const entropyFindings = detectHighEntropyStrings(file.content, file.path)
@@ -69,6 +74,7 @@ function processFileLayer1(file: ScanFile): {
   const commentFindings = detectAICommentPatterns(file.content, file.path)
   const urlFindings = detectSensitiveURLs(file.content, file.path)
   const cryptoFindings = detectWeakCrypto(file.content, file.path)
+  const mcpConfigFindings = detectMCPConfigIssues(file.content, file.path)
 
   stats.entropy = entropyFindings.length
   stats.known_secrets = patternFindings.length
@@ -77,6 +83,7 @@ function processFileLayer1(file: ScanFile): {
   stats.ai_comments = commentFindings.length
   stats.sensitive_urls = urlFindings.length
   stats.weak_crypto = cryptoFindings.length
+  stats.mcp_config = mcpConfigFindings.length
 
   return {
     findings: [
@@ -87,6 +94,7 @@ function processFileLayer1(file: ScanFile): {
       ...commentFindings,
       ...urlFindings,
       ...cryptoFindings,
+      ...mcpConfigFindings,
     ],
     stats,
   }
@@ -106,7 +114,7 @@ export async function runLayer1Scan(
   const vulnerabilities: Vulnerability[] = []
 
   // Track raw counts per detector (before dedupe)
-  const rawStats: Record<Layer1DetectorName, number> = {
+  const rawStats: Layer1StatsRecord = {
     known_secrets: 0,
     weak_crypto: 0,
     sensitive_urls: 0,
@@ -114,6 +122,7 @@ export async function runLayer1Scan(
     config_audit: 0,
     file_flags: 0,
     ai_comments: 0,
+    mcp_config: 0,
   }
 
   // Track progress for frequent updates
@@ -132,7 +141,7 @@ export async function runLayer1Scan(
       vulnerabilities.push(...result.findings)
       // Accumulate stats
       for (const [key, value] of Object.entries(result.stats)) {
-        rawStats[key as Layer1DetectorName] += value
+        rawStats[key as keyof Layer1StatsRecord] += value
       }
     }
 
@@ -221,3 +230,4 @@ export { detectDangerousFiles } from './file-flags'
 export { detectAICommentPatterns } from './comments'
 export { detectSensitiveURLs } from './urls'
 export { detectWeakCrypto } from './weak-crypto'
+export { detectMCPConfigIssues } from './config-mcp-audit'