npm - @runsec/mcp - Versions diffs - 1.0.1 - Mend

@runsec/mcp 1.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (40) hide show

package/dist/index.js +578 -0
package/package.json +43 -0
package/src/rules/data/rule-compliance-map.json +43563 -0
package/src/rules/data/semgrep-rules/README-taint-overlays.md +21 -0
package/src/rules/data/semgrep-rules/advanced-agent-cloud.yaml +802 -0
package/src/rules/data/semgrep-rules/app-logic.yaml +445 -0
package/src/rules/data/semgrep-rules/auth-keycloak.yaml +831 -0
package/src/rules/data/semgrep-rules/browser-agent.yaml +260 -0
package/src/rules/data/semgrep-rules/cloud-secrets.yaml +316 -0
package/src/rules/data/semgrep-rules/csharp-dotnet.yaml +4864 -0
package/src/rules/data/semgrep-rules/desktop-electron-pro.yaml +30 -0
package/src/rules/data/semgrep-rules/desktop-vsto-suite.yaml +2759 -0
package/src/rules/data/semgrep-rules/devops-security.yaml +393 -0
package/src/rules/data/semgrep-rules/domain-access-management.yaml +1023 -0
package/src/rules/data/semgrep-rules/domain-data-privacy.yaml +852 -0
package/src/rules/data/semgrep-rules/domain-input-validation.yaml +2894 -0
package/src/rules/data/semgrep-rules/domain-platform-hardening.yaml +1715 -0
package/src/rules/data/semgrep-rules/ds-ml-security.yaml +2431 -0
package/src/rules/data/semgrep-rules/fastapi-async.yaml +5953 -0
package/src/rules/data/semgrep-rules/frontend-react.yaml +4035 -0
package/src/rules/data/semgrep-rules/frontend-security.yaml +200 -0
package/src/rules/data/semgrep-rules/go-core.yaml +4959 -0
package/src/rules/data/semgrep-rules/hft-cpp-security.yaml +631 -0
package/src/rules/data/semgrep-rules/infra-k8s-helm.yaml +4968 -0
package/src/rules/data/semgrep-rules/integration-security.yaml +2362 -0
package/src/rules/data/semgrep-rules/java-enterprise.yaml +14756 -0
package/src/rules/data/semgrep-rules/java-spring.yaml +397 -0
package/src/rules/data/semgrep-rules/license-compliance.yaml +186 -0
package/src/rules/data/semgrep-rules/mobile-flutter.yaml +37 -0
package/src/rules/data/semgrep-rules/mobile-security.yaml +721 -0
package/src/rules/data/semgrep-rules/nodejs-nestjs.yaml +5164 -0
package/src/rules/data/semgrep-rules/nodejs-security.yaml +326 -0
package/src/rules/data/semgrep-rules/observability.yaml +381 -0
package/src/rules/data/semgrep-rules/php-security.yaml +3601 -0
package/src/rules/data/semgrep-rules/python-backend-pro.yaml +30 -0
package/src/rules/data/semgrep-rules/python-django.yaml +181 -0
package/src/rules/data/semgrep-rules/python-security.yaml +284 -0
package/src/rules/data/semgrep-rules/ru-regulatory.yaml +496 -0
package/src/rules/data/semgrep-rules/ruby-rails.yaml +3078 -0
package/src/rules/data/semgrep-rules/rust-security.yaml +2701 -0

package/src/rules/data/semgrep-rules/hft-cpp-security.yaml ADDED Viewed

@@ -0,0 +1,631 @@
+rules:
+  - id: runsec.hft-cpp-security.hft-001
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent overwrite in low-latency parsing path.
+    pattern-either:
+      - pattern: |-
+          strcpy(buf, input)
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-001\\b'
+    message: |-
+      RunSec Detection [HFT-001]: CWE-119
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-002
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Bound formatted writes in critical loops.
+    pattern-either:
+      - pattern: |-
+          sprintf(dst,"%s",src)
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-002\\b'
+    message: |-
+      RunSec Detection [HFT-002]: CWE-120
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-003
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent stale pointer dereference.
+    pattern-either:
+      - pattern: |-
+          access pointer after delete
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-003\\b'
+    message: |-
+      RunSec Detection [HFT-003]: CWE-416
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-004
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Avoid memory corruption by double free.
+    pattern-either:
+      - pattern: |-
+          delete p; ... delete p;
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-004\\b'
+    message: |-
+      RunSec Detection [HFT-004]: CWE-415
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-005
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent financial logic corruption.
+    pattern-either:
+      - pattern: |-
+          int64_t notional = price * volume; unchecked
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-005\\b'
+    message: |-
+      RunSec Detection [HFT-005]: CWE-190
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-006
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Avoid bypassed bounds logic.
+    pattern-either:
+      - pattern: |-
+          compare signed index to unsigned size
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-006\\b'
+    message: |-
+      RunSec Detection [HFT-006]: CWE-190
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-007
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Preserve memory safety in lock-free queues.
+    pattern-either:
+      - pattern: |-
+          buf[head++] without wrap guard
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-007\\b'
+    message: |-
+      RunSec Detection [HFT-007]: CWE-787
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-008
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Block packet-driven memory overwrite.
+    pattern-either:
+      - pattern: |-
+          memcpy(dst, pkt, len)
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-008\\b'
+    message: |-
+      RunSec Detection [HFT-008]: CWE-120
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-009
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent arbitrary memory disclosure/write.
+    pattern-either:
+      - pattern: |-
+          printf(userFmt)
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-009\\b'
+    message: |-
+      RunSec Detection [HFT-009]: CWE-134
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-010
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Keep engine stable under memory pressure.
+    pattern-either:
+      - pattern: |-
+          new T(...) unchecked
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-010\\b'
+    message: |-
+      RunSec Detection [HFT-010]: CWE-703
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-011
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Avoid crashes and undefined behavior.
+    pattern-either:
+      - pattern: |-
+          dereference optional pointer directly
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-011\\b'
+    message: |-
+      RunSec Detection [HFT-011]: CWE-476
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-012
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent inconsistent market state.
+    pattern-either:
+      - pattern: |-
+          mutable shared map without sync
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-012\\b'
+    message: |-
+      RunSec Detection [HFT-012]: CWE-362
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-013
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent stale CAS success conditions.
+    pattern-either:
+      - pattern: |-
+          CAS without ABA protection
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-013\\b'
+    message: |-
+      RunSec Detection [HFT-013]: CWE-367
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-014
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Ensure visibility and ordering correctness.
+    pattern-either:
+      - pattern: |-
+          relaxed ops for publication
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-014\\b'
+    message: |-
+      RunSec Detection [HFT-014]: CWE-362
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-015
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent use-after-scope.
+    pattern-either:
+      - pattern: |-
+          lambda captures local by reference
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-015\\b'
+    message: |-
+      RunSec Detection [HFT-015]: CWE-416
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-016
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Avoid UB and misparsed data.
+    pattern-either:
+      - pattern: |-
+          cast unaligned packet buffer to struct
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-016\\b'
+    message: |-
+      RunSec Detection [HFT-016]: CWE-704
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-017
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent symbol parsing overflow.
+    pattern-either:
+      - pattern: |-
+          write symbol blindly
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-017\\b'
+    message: |-
+      RunSec Detection [HFT-017]: CWE-120
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-018
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Avoid overflow in dynamic rule composition.
+    pattern-either:
+      - pattern: |-
+          strcat(rule, input)
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-018\\b'
+    message: |-
+      RunSec Detection [HFT-018]: CWE-120
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-019
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent thread/resource starvation.
+    pattern-either:
+      - pattern: |-
+          blocking read forever
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-019\\b'
+    message: |-
+      RunSec Detection [HFT-019]: CWE-400
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-020
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent FD exhaustion under churn.
+    pattern-either:
+      - pattern: |-
+          open sockets/files without close on retry
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-020\\b'
+    message: |-
+      RunSec Detection [HFT-020]: CWE-772
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-021
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Avoid self-inflicted DoS.
+    pattern-either:
+      - pattern: |-
+          while(true) reconnect()
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-021\\b'
+    message: |-
+      RunSec Detection [HFT-021]: CWE-400
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-022
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Stop malformed snapshot exploitation.
+    pattern-either:
+      - pattern: |-
+          trust snapshot blob layout blindly
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-022\\b'
+    message: |-
+      RunSec Detection [HFT-022]: CWE-502
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-023
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Protect privileged runtime controls.
+    pattern-either:
+      - pattern: |-
+          plain command socket without auth
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-023\\b'
+    message: |-
+      RunSec Detection [HFT-023]: CWE-306
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-024
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Remove embedded secrets from binaries.
+    pattern-either:
+      - pattern: |-
+          API keys in source constants
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-024\\b'
+    message: |-
+      RunSec Detection [HFT-024]: CWE-798
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-025
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Preserve financial precision/integrity.
+    pattern-either:
+      - pattern: |-
+          cast large value to narrow type
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-025\\b'
+    message: |-
+      RunSec Detection [HFT-025]: CWE-197
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-026
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent time drift and ordering faults.
+    pattern-either:
+      - pattern: |-
+          ts + latency_ns unchecked
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-026\\b'
+    message: |-
+      RunSec Detection [HFT-026]: CWE-190
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-027
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Block malformed protocol messages.
+    pattern-either:
+      - pattern: |-
+          switch without default reject
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-027\\b'
+    message: |-
+      RunSec Detection [HFT-027]: CWE-20
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-028
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent data leak and nondeterminism.
+    pattern-either:
+      - pattern: |-
+          stack buffer partially filled
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-028\\b'
+    message: |-
+      RunSec Detection [HFT-028]: CWE-457
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-029
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Protect interprocess market data integrity.
+    pattern-either:
+      - pattern: |-
+          world-readable/writable shm
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-029\\b'
+    message: |-
+      RunSec Detection [HFT-029]: CWE-732
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-030
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent identifier prediction attacks.
+    pattern-either:
+      - pattern: |-
+          rand()/std::mt19937 for security ids
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-030\\b'
+    message: |-
+      RunSec Detection [HFT-030]: CWE-330
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-031
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Defend against malformed FIX payloads.
+    pattern-either:
+      - pattern: |-
+          parse tag length from input unchecked
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-031\\b'
+    message: |-
+      RunSec Detection [HFT-031]: CWE-130
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-032
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Prevent temp file race/tampering.
+    pattern-either:
+      - pattern: |-
+          predictable temp filename
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-032\\b'
+    message: |-
+      RunSec Detection [HFT-032]: CWE-377
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-033
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Reduce operational information leakage.
+    pattern-either:
+      - pattern: |-
+          dumps keys/endpoints in logs
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-033\\b'
+    message: |-
+      RunSec Detection [HFT-033]: CWE-532
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-034
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Enable controlled crypto migration.
+    pattern-either:
+      - pattern: |-
+          fixed outdated cipher list
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-034\\b'
+    message: |-
+      RunSec Detection [HFT-034]: CWE-327
+    languages:
+      - generic
+    severity: WARNING
+  - id: runsec.hft-cpp-security.hft-035
+    metadata:
+      runsec_version: v1.0
+      confidence: |-
+        0.9
+      exploit_scenario: |-
+        N/A
+      fix_template: |-
+        Minimize secret retention in memory.
+    pattern-either:
+      - pattern: |-
+          key buffers persist after use
+      - pattern-regex: 'Vulnerable:\\s*HFT\\-035\\b'
+    message: |-
+      RunSec Detection [HFT-035]: CWE-1037
+    languages:
+      - generic
+    severity: WARNING