@securecode-ai/mcp 0.1.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -3
- package/dist/api/client.d.ts +4 -0
- package/dist/api/client.js +49 -0
- package/dist/api/client.js.map +1 -1
- package/dist/api/types.d.ts +40 -0
- package/dist/index.js +64 -7
- package/dist/index.js.map +1 -1
- package/dist/mcp/server.js +16 -1
- package/dist/mcp/server.js.map +1 -1
- package/dist/poc/httpPocExecutor.d.ts +20 -0
- package/dist/poc/httpPocExecutor.js +247 -0
- package/dist/poc/httpPocExecutor.js.map +1 -0
- package/dist/poc/lightpandaExecutor.d.ts +41 -0
- package/dist/poc/lightpandaExecutor.js +263 -0
- package/dist/poc/lightpandaExecutor.js.map +1 -0
- package/dist/poc/pocExecutor.d.ts +46 -0
- package/dist/poc/pocExecutor.js +74 -0
- package/dist/poc/pocExecutor.js.map +1 -0
- package/dist/poc/pocRouter.d.ts +20 -0
- package/dist/poc/pocRouter.js +40 -0
- package/dist/poc/pocRouter.js.map +1 -0
- package/dist/poc/pocTypes.d.ts +54 -0
- package/dist/poc/pocTypes.js +16 -0
- package/dist/poc/pocTypes.js.map +1 -0
- package/dist/project-map/fixTester.d.ts +55 -0
- package/dist/project-map/fixTester.js +338 -0
- package/dist/project-map/fixTester.js.map +1 -0
- package/dist/project-map/guardEvaluator.d.ts +40 -0
- package/dist/project-map/guardEvaluator.js +216 -0
- package/dist/project-map/guardEvaluator.js.map +1 -0
- package/dist/project-map/guardPatterns.d.ts +43 -0
- package/dist/project-map/guardPatterns.js +173 -0
- package/dist/project-map/guardPatterns.js.map +1 -0
- package/dist/project-map/mapBuilder.js +44 -5
- package/dist/project-map/mapBuilder.js.map +1 -1
- package/dist/project-map/sanitizers.d.ts +34 -0
- package/dist/project-map/sanitizers.js +76 -0
- package/dist/project-map/sanitizers.js.map +1 -0
- package/dist/project-map/sinkFinder.d.ts +48 -0
- package/dist/project-map/sinkFinder.js +340 -0
- package/dist/project-map/sinkFinder.js.map +1 -0
- package/dist/project-map/sinkRegistry.d.ts +60 -0
- package/dist/project-map/sinkRegistry.js +246 -0
- package/dist/project-map/sinkRegistry.js.map +1 -0
- package/dist/project-map/taintSources.d.ts +30 -0
- package/dist/project-map/taintSources.js +77 -0
- package/dist/project-map/taintSources.js.map +1 -0
- package/dist/project-map/taintTracker.d.ts +42 -0
- package/dist/project-map/taintTracker.js +571 -0
- package/dist/project-map/taintTracker.js.map +1 -0
- package/dist/tools/map.js +13 -1
- package/dist/tools/map.js.map +1 -1
- package/dist/tools/scan.js +44 -0
- package/dist/tools/scan.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -14,7 +14,9 @@ npm install -g @securecode-ai/mcp
|
|
|
14
14
|
securecode-mcp login
|
|
15
15
|
```
|
|
16
16
|
|
|
17
|
-
|
|
17
|
+
Enter your email, receive a 6-digit verification code, and paste it back. Your JWT is stored in the OS keychain (Windows Credential Manager, macOS Keychain, or Linux Secret Service). If the keychain is unavailable, it falls back to `~/.securecode/credentials.json` (mode 0600).
|
|
18
|
+
|
|
19
|
+
Alternatively, set the `SECURECODE_API_TOKEN` environment variable.
|
|
18
20
|
|
|
19
21
|
## MCP client configuration
|
|
20
22
|
|
|
@@ -50,14 +52,14 @@ claude mcp add securecode -s user -- securecode-mcp serve --workspace /path/to/y
|
|
|
50
52
|
|
|
51
53
|
```bash
|
|
52
54
|
securecode-mcp serve [--workspace <path>] Start the MCP stdio server
|
|
53
|
-
securecode-mcp login [--api-url <url>]
|
|
55
|
+
securecode-mcp login [--api-url <url>] Authenticate via email + OTP
|
|
54
56
|
securecode-mcp status Show auth status
|
|
55
57
|
securecode-mcp logout Remove credentials
|
|
56
58
|
```
|
|
57
59
|
|
|
58
60
|
## Security
|
|
59
61
|
|
|
60
|
-
-
|
|
62
|
+
- Credentials stored in OS keychain (Windows Credential Manager, macOS Keychain, Linux Secret Service) with file fallback.
|
|
61
63
|
- File reads are confined to the `--workspace` root.
|
|
62
64
|
- Fixes are returned for review and never auto-applied.
|
|
63
65
|
- No telemetry.
|
package/dist/api/client.d.ts
CHANGED
|
@@ -19,4 +19,8 @@ export declare class ApiClient {
|
|
|
19
19
|
private readonly timeoutMs;
|
|
20
20
|
constructor(opts: ApiClientOptions);
|
|
21
21
|
postJson<T>(path: string, body: unknown): Promise<T>;
|
|
22
|
+
/**
|
|
23
|
+
* POST without an Authorization header — for login/OTP before a token exists.
|
|
24
|
+
*/
|
|
25
|
+
static postJsonNoAuth(baseUrl: string, path: string, body: unknown, timeoutMs?: number): Promise<any>;
|
|
22
26
|
}
|
package/dist/api/client.js
CHANGED
|
@@ -136,6 +136,55 @@ class ApiClient {
|
|
|
136
136
|
req.end();
|
|
137
137
|
});
|
|
138
138
|
}
|
|
139
|
+
/**
|
|
140
|
+
* POST without an Authorization header — for login/OTP before a token exists.
|
|
141
|
+
*/
|
|
142
|
+
static async postJsonNoAuth(baseUrl, path, body, timeoutMs = 30_000) {
|
|
143
|
+
const url = `${baseUrl.replace(/\/$/, '')}${path}`;
|
|
144
|
+
const payload = JSON.stringify(body);
|
|
145
|
+
const parsed = new URL(url);
|
|
146
|
+
const lib = parsed.protocol === 'https:' ? https : http;
|
|
147
|
+
return new Promise((resolve, reject) => {
|
|
148
|
+
const req = lib.request({
|
|
149
|
+
hostname: parsed.hostname,
|
|
150
|
+
port: parsed.port || (parsed.protocol === 'https:' ? 443 : 80),
|
|
151
|
+
path: parsed.pathname + parsed.search,
|
|
152
|
+
method: 'POST',
|
|
153
|
+
headers: {
|
|
154
|
+
'Content-Type': 'application/json',
|
|
155
|
+
'Content-Length': Buffer.byteLength(payload),
|
|
156
|
+
},
|
|
157
|
+
}, (res) => {
|
|
158
|
+
let raw = '';
|
|
159
|
+
res.on('data', (chunk) => { raw += chunk.toString('utf8'); });
|
|
160
|
+
res.on('end', () => {
|
|
161
|
+
let data;
|
|
162
|
+
try {
|
|
163
|
+
data = raw ? JSON.parse(raw) : {};
|
|
164
|
+
}
|
|
165
|
+
catch {
|
|
166
|
+
data = { raw };
|
|
167
|
+
}
|
|
168
|
+
const status = res.statusCode ?? 0;
|
|
169
|
+
if (status >= 200 && status < 300) {
|
|
170
|
+
resolve(data);
|
|
171
|
+
}
|
|
172
|
+
else {
|
|
173
|
+
reject(new ApiClientError(status, data.code, data.error || data.message || `HTTP ${status}`, data.remaining));
|
|
174
|
+
}
|
|
175
|
+
});
|
|
176
|
+
});
|
|
177
|
+
req.on('error', (err) => {
|
|
178
|
+
reject(new ApiClientError(0, undefined, `Network error: ${err.message}`, undefined));
|
|
179
|
+
});
|
|
180
|
+
req.setTimeout(timeoutMs, () => {
|
|
181
|
+
req.destroy();
|
|
182
|
+
reject(new ApiClientError(0, undefined, `Request timed out after ${timeoutMs}ms`, undefined));
|
|
183
|
+
});
|
|
184
|
+
req.write(payload);
|
|
185
|
+
req.end();
|
|
186
|
+
});
|
|
187
|
+
}
|
|
139
188
|
}
|
|
140
189
|
exports.ApiClient = ApiClient;
|
|
141
190
|
//# sourceMappingURL=client.js.map
|
package/dist/api/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,6CAA+B;AAG/B,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5C,MAAa,cAAe,SAAQ,KAAK;IAEjB;IACA;IAEA;IAJpB,YACoB,MAAc,EACd,OAA2B,EAC3C,OAAe,EACC,SAA6B;QAE7C,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAoB;QAE3B,cAAS,GAAT,SAAS,CAAoB;QAG7C,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,qBAAqB,CAAC,GAAY;QACrC,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,GAAY;QAC7B,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,GAAY;QAC3B,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,GAAY;QACnC,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;CACJ;AA1BD,wCA0BC;AAQD,MAAa,SAAS;IACD,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,SAAS,CAAS;IAEnC,YAAY,IAAsB;QAC9B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,IAAY,EAAE,IAAa;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAExD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACnB;gBACI,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACL,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC5C,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;iBACxC;aACJ,EACD,CAAC,GAAG,EAAE,EAAE;gBACJ,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC7B,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;wBACjD,OAAO,GAAG,IAAI,CAAC;wBACf,GAAG,CAAC,OAAO,EAAE,CAAC;wBACd,MAAM,CAAC,IAAI,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;wBAC5E,OAAO;oBACX,CAAC;oBACD,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACf,IAAI,OAAO;wBAAE,OAAO;oBACpB,IAAI,IAAS,CAAC;oBACd,IAAI,CAAC;wBACD,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,CAAC;oBAAC,MAAM,CAAC;wBACL,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;oBACnB,CAAC;oBACD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;oBACnC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAS,CAAC,CAAC;oBACvB,CAAC;yBAAM,CAAC;wBACJ,MAAM,MAAM,GAAa;4BACrB,MAAM;4BACN,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;4BAClC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,MAAM,EAAE;4BACvD,SAAS,EAAE,IAAI,CAAC,SAAS;yBAC5B,CAAC;wBACF,MAAM,CAAC,IAAI,cAAc,CACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,SAAS,CACnB,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC,CACJ,CAAC;YAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;gBAChC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,2BAA2B,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YACvG,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,6CAA+B;AAG/B,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5C,MAAa,cAAe,SAAQ,KAAK;IAEjB;IACA;IAEA;IAJpB,YACoB,MAAc,EACd,OAA2B,EAC3C,OAAe,EACC,SAA6B;QAE7C,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAoB;QAE3B,cAAS,GAAT,SAAS,CAAoB;QAG7C,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,qBAAqB,CAAC,GAAY;QACrC,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,GAAY;QAC7B,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,GAAY;QAC3B,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,GAAY;QACnC,OAAO,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC/D,CAAC;CACJ;AA1BD,wCA0BC;AAQD,MAAa,SAAS;IACD,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,SAAS,CAAS;IAEnC,YAAY,IAAsB;QAC9B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,IAAY,EAAE,IAAa;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAExD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACnB;gBACI,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACL,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC5C,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;iBACxC;aACJ,EACD,CAAC,GAAG,EAAE,EAAE;gBACJ,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC7B,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;wBACjD,OAAO,GAAG,IAAI,CAAC;wBACf,GAAG,CAAC,OAAO,EAAE,CAAC;wBACd,MAAM,CAAC,IAAI,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;wBAC5E,OAAO;oBACX,CAAC;oBACD,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACf,IAAI,OAAO;wBAAE,OAAO;oBACpB,IAAI,IAAS,CAAC;oBACd,IAAI,CAAC;wBACD,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,CAAC;oBAAC,MAAM,CAAC;wBACL,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;oBACnB,CAAC;oBACD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;oBACnC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAS,CAAC,CAAC;oBACvB,CAAC;yBAAM,CAAC;wBACJ,MAAM,MAAM,GAAa;4BACrB,MAAM;4BACN,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;4BAClC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,MAAM,EAAE;4BACvD,SAAS,EAAE,IAAI,CAAC,SAAS;yBAC5B,CAAC;wBACF,MAAM,CAAC,IAAI,cAAc,CACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,SAAS,CACnB,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC,CACJ,CAAC;YAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;gBAChC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,2BAA2B,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YACvG,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,IAAY,EAAE,IAAa,EAAE,SAAS,GAAG,MAAM;QACxF,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAExD,OAAO,IAAI,OAAO,CAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACnB;gBACI,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACL,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;iBAC/C;aACJ,EACD,CAAC,GAAG,EAAE,EAAE;gBACJ,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACf,IAAI,IAAS,CAAC;oBACd,IAAI,CAAC;wBAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC;wBAAC,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;oBAAC,CAAC;oBACpE,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;oBACnC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAClB,CAAC;yBAAM,CAAC;wBACJ,MAAM,CAAC,IAAI,cAAc,CACrB,MAAM,EACN,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,MAAM,EAAE,EAC9C,IAAI,CAAC,SAAS,CACjB,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC,CACJ,CAAC;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;gBAC3B,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,2BAA2B,SAAS,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YAClG,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAzID,8BAyIC"}
|
package/dist/api/types.d.ts
CHANGED
|
@@ -12,6 +12,46 @@ export interface ScanRequest {
|
|
|
12
12
|
}>;
|
|
13
13
|
endpointContext?: unknown;
|
|
14
14
|
};
|
|
15
|
+
/** Phase B/C/E: AST-derived sink findings + taint flows + guard evals. */
|
|
16
|
+
deterministicFacts?: {
|
|
17
|
+
sinks?: Array<{
|
|
18
|
+
line: number;
|
|
19
|
+
endLine: number;
|
|
20
|
+
sink: string;
|
|
21
|
+
canonicalType: string;
|
|
22
|
+
severity: string;
|
|
23
|
+
callExpression: string;
|
|
24
|
+
arguments: Array<{
|
|
25
|
+
kind: string;
|
|
26
|
+
value?: string;
|
|
27
|
+
interpolated?: boolean;
|
|
28
|
+
}>;
|
|
29
|
+
enclosingFunction?: string | null;
|
|
30
|
+
isInsideTryCatch: boolean;
|
|
31
|
+
}>;
|
|
32
|
+
taint?: Array<{
|
|
33
|
+
source: string;
|
|
34
|
+
sourceLine: number;
|
|
35
|
+
sink: string;
|
|
36
|
+
sinkLine: number;
|
|
37
|
+
canonicalType: string;
|
|
38
|
+
propagationPath: Array<{
|
|
39
|
+
line: number;
|
|
40
|
+
variable: string;
|
|
41
|
+
operation: string;
|
|
42
|
+
description: string;
|
|
43
|
+
}>;
|
|
44
|
+
isTainted: boolean;
|
|
45
|
+
}>;
|
|
46
|
+
guards?: Array<{
|
|
47
|
+
guardName: string;
|
|
48
|
+
guardType: string;
|
|
49
|
+
attackType: string;
|
|
50
|
+
effective: boolean;
|
|
51
|
+
reason: string;
|
|
52
|
+
bypassExample?: string;
|
|
53
|
+
}>;
|
|
54
|
+
};
|
|
15
55
|
}
|
|
16
56
|
export interface ScanFinding {
|
|
17
57
|
check_id?: string;
|
package/dist/index.js
CHANGED
|
@@ -37,12 +37,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
37
37
|
const path = __importStar(require("path"));
|
|
38
38
|
const credentialStore_1 = require("./auth/credentialStore");
|
|
39
39
|
const server_1 = require("./mcp/server");
|
|
40
|
+
const client_1 = require("./api/client");
|
|
40
41
|
function printUsage() {
|
|
41
42
|
console.log(`SecureCode MCP — standalone security scanner for AI coding tools
|
|
42
43
|
|
|
43
44
|
Usage:
|
|
44
45
|
securecode-mcp serve [--workspace <path>] Start the MCP stdio server
|
|
45
|
-
securecode-mcp login [--api-url <url>]
|
|
46
|
+
securecode-mcp login [--api-url <url>] Authenticate via email + OTP
|
|
46
47
|
securecode-mcp status Show current auth status
|
|
47
48
|
securecode-mcp logout Remove stored credentials
|
|
48
49
|
securecode-mcp --help Show this help
|
|
@@ -93,27 +94,83 @@ async function cmdLogin(args) {
|
|
|
93
94
|
console.log('SecureCode MCP Login');
|
|
94
95
|
console.log(`API URL: ${apiUrl}`);
|
|
95
96
|
console.log('');
|
|
96
|
-
|
|
97
|
+
// Step 1: Ask for email
|
|
98
|
+
const email = (await ask('Enter your email: ')).trim();
|
|
99
|
+
if (!email || !email.includes('@')) {
|
|
100
|
+
console.error('Error: A valid email is required.');
|
|
101
|
+
rl.close();
|
|
102
|
+
process.exit(1);
|
|
103
|
+
}
|
|
104
|
+
// Step 2: Check if the email exists
|
|
105
|
+
console.log('');
|
|
106
|
+
console.log('Checking account...');
|
|
107
|
+
try {
|
|
108
|
+
await client_1.ApiClient.postJsonNoAuth(apiUrl, '/auth/check-email', { email });
|
|
109
|
+
}
|
|
110
|
+
catch (err) {
|
|
111
|
+
if (err.status === 404 || err.message?.toLowerCase().includes('not')) {
|
|
112
|
+
console.error(`Error: No account found for ${email}. Sign up at https://usesecurecode.tech first.`);
|
|
113
|
+
}
|
|
114
|
+
else {
|
|
115
|
+
console.error(`Error: ${err.message || err}`);
|
|
116
|
+
}
|
|
117
|
+
rl.close();
|
|
118
|
+
process.exit(1);
|
|
119
|
+
}
|
|
120
|
+
// Step 3: Send OTP
|
|
121
|
+
console.log('Sending verification code...');
|
|
122
|
+
try {
|
|
123
|
+
await client_1.ApiClient.postJsonNoAuth(apiUrl, '/auth/send-otp', { email });
|
|
124
|
+
}
|
|
125
|
+
catch (err) {
|
|
126
|
+
console.error(`Error sending code: ${err.message || err}`);
|
|
127
|
+
rl.close();
|
|
128
|
+
process.exit(1);
|
|
129
|
+
}
|
|
130
|
+
// Step 4: Ask for the OTP code
|
|
131
|
+
console.log(`A 6-digit verification code was sent to ${email}.`);
|
|
132
|
+
const otp = (await ask('Enter the code: ')).trim();
|
|
133
|
+
if (!otp || otp.length < 4) {
|
|
134
|
+
console.error('Error: A valid verification code is required.');
|
|
135
|
+
rl.close();
|
|
136
|
+
process.exit(1);
|
|
137
|
+
}
|
|
97
138
|
rl.close();
|
|
98
|
-
|
|
99
|
-
|
|
139
|
+
// Step 5: Verify OTP → get JWT
|
|
140
|
+
console.log('Verifying...');
|
|
141
|
+
let token;
|
|
142
|
+
let plan;
|
|
143
|
+
try {
|
|
144
|
+
const resp = await client_1.ApiClient.postJsonNoAuth(apiUrl, '/auth/verify-otp', { email, otp });
|
|
145
|
+
token = resp.token;
|
|
146
|
+
plan = resp.plan || 'free';
|
|
147
|
+
if (!token) {
|
|
148
|
+
console.error('Error: No token returned from verification.');
|
|
149
|
+
process.exit(1);
|
|
150
|
+
}
|
|
151
|
+
}
|
|
152
|
+
catch (err) {
|
|
153
|
+
console.error(`Error: ${err.message || err}`);
|
|
100
154
|
process.exit(1);
|
|
101
155
|
}
|
|
156
|
+
// Step 6: Store the token
|
|
102
157
|
const result = credentialStore_1.CredentialStore.save({
|
|
103
|
-
apiToken: token
|
|
158
|
+
apiToken: token,
|
|
104
159
|
apiUrl,
|
|
105
160
|
storedAt: new Date().toISOString(),
|
|
106
161
|
});
|
|
107
162
|
console.log('');
|
|
163
|
+
console.log(`Authenticated (${plan} plan).`);
|
|
108
164
|
if (result.method === 'keychain') {
|
|
109
|
-
console.log('
|
|
165
|
+
console.log('Token saved to OS keychain.');
|
|
110
166
|
}
|
|
111
167
|
else {
|
|
112
|
-
console.log(
|
|
168
|
+
console.log('Token saved to ~/.securecode/credentials.json (mode 0600).');
|
|
113
169
|
if (result.warning) {
|
|
114
170
|
console.log(`Warning: ${result.warning}`);
|
|
115
171
|
}
|
|
116
172
|
}
|
|
173
|
+
console.log('');
|
|
117
174
|
console.log('You can now run: securecode-mcp serve --workspace /path/to/project');
|
|
118
175
|
}
|
|
119
176
|
function cmdStatus() {
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,2CAA6B;AAC7B,4DAAyD;AACzD,yCAA2C;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,2CAA6B;AAC7B,4DAAyD;AACzD,yCAA2C;AAE3C,yCAAyC;AAEzC,SAAS,UAAU;IACf,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;CAsBf,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc;IAClC,IAAI,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,iCAAe,CAAC,UAAU,EAAE,CAAC;IAE3C,MAAM,GAAG,GAAkB;QACvB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,SAAS;KAC3B,CAAC;IAEF,IAAA,oBAAW,EAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc;IAClC,IAAI,MAAM,GAAG,gCAAgC,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAErF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,wBAAwB;IACxB,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,oCAAoC;IACpC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnC,IAAI,CAAC;QACD,MAAM,kBAAS,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,KAAK,CAAC,+BAA+B,KAAK,gDAAgD,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,IAAI,CAAC;QACD,MAAM,kBAAS,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAC3D,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,+BAA+B;IAC/B,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,GAAG,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,EAAE,CAAC,KAAK,EAAE,CAAC;IAEX,+BAA+B;IAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,KAAa,CAAC;IAClB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,kBAAS,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;QAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,0BAA0B;IAC1B,MAAM,MAAM,GAAG,iCAAe,CAAC,IAAI,CAAC;QAChC,QAAQ,EAAE,KAAK;QACf,MAAM;QACN,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,SAAS;IACd,MAAM,KAAK,GAAG,iCAAe,CAAC,GAAG,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS;IACd,MAAM,OAAO,GAAG,iCAAe,CAAC,KAAK,EAAE,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAChD,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACf,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACvD,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9B,QAAQ,OAAO,EAAE,CAAC;QACd,KAAK,OAAO;YACR,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACV,KAAK,OAAO;YACR,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACV,KAAK,QAAQ;YACT,SAAS,EAAE,CAAC;YACZ,MAAM;QACV,KAAK,QAAQ;YACT,SAAS,EAAE,CAAC;YACZ,MAAM;QACV;YACI,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YAC7C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC"}
|
package/dist/mcp/server.js
CHANGED
|
@@ -42,7 +42,7 @@ const fix_1 = require("../tools/fix");
|
|
|
42
42
|
const attack_1 = require("../tools/attack");
|
|
43
43
|
const PROTOCOL_VERSION = '2025-03-26';
|
|
44
44
|
const SERVER_NAME = 'securecode-mcp';
|
|
45
|
-
const SERVER_VERSION = '0.
|
|
45
|
+
const SERVER_VERSION = '0.2.0';
|
|
46
46
|
let initialized = false;
|
|
47
47
|
function send(msg) {
|
|
48
48
|
process.stdout.write(JSON.stringify(msg) + '\n');
|
|
@@ -53,6 +53,16 @@ function result(id, value) {
|
|
|
53
53
|
function error(id, code, message, data) {
|
|
54
54
|
send({ jsonrpc: '2.0', id, error: { code, message, data } });
|
|
55
55
|
}
|
|
56
|
+
/** Send a progress notification so the MCP client knows the server is still working. */
|
|
57
|
+
function sendProgress(progressToken, progress, total, message) {
|
|
58
|
+
if (progressToken === undefined)
|
|
59
|
+
return;
|
|
60
|
+
send({
|
|
61
|
+
jsonrpc: '2.0',
|
|
62
|
+
method: 'notifications/progress',
|
|
63
|
+
params: { progressToken, progress, total, message },
|
|
64
|
+
});
|
|
65
|
+
}
|
|
56
66
|
const TOOL_HANDLERS = {
|
|
57
67
|
'securecode.scan': scan_1.toolScan,
|
|
58
68
|
'securecode.map': map_1.toolMap,
|
|
@@ -108,6 +118,7 @@ async function handleRequest(ctx, req) {
|
|
|
108
118
|
const params = (req.params || {});
|
|
109
119
|
const name = params.name;
|
|
110
120
|
const args = params.arguments || {};
|
|
121
|
+
const progressToken = params._meta?.progressToken;
|
|
111
122
|
const handler = name ? TOOL_HANDLERS[name] : undefined;
|
|
112
123
|
if (!handler) {
|
|
113
124
|
return { jsonrpc: '2.0', id, error: { code: -32601, message: `Unknown tool: ${name}` } };
|
|
@@ -120,6 +131,10 @@ async function handleRequest(ctx, req) {
|
|
|
120
131
|
if (invalid) {
|
|
121
132
|
return { jsonrpc: '2.0', id, error: { code: -32602, message: invalid } };
|
|
122
133
|
}
|
|
134
|
+
// Pass progress callback to the handler via args
|
|
135
|
+
if (progressToken !== undefined) {
|
|
136
|
+
args._progress = (progress, total, message) => sendProgress(progressToken, progress, total, message);
|
|
137
|
+
}
|
|
123
138
|
const result_data = await handler(ctx, args);
|
|
124
139
|
return {
|
|
125
140
|
jsonrpc: '2.0', id,
|
package/dist/mcp/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuIA,kCA4CC;AAnLD,mDAAqC;AAErC,mCAAgC;AAChC,wCAAyC;AACzC,sCAAuC;AACvC,sCAAuC;AACvC,4CAA6C;AAE7C,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAS,IAAI,CAAC,GAA2E;IACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,EAA0B,EAAE,KAAc;IACtD,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,EAA0B,EAAE,IAAY,EAAE,OAAe,EAAE,IAAc;IACpF,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,aAA0C,EAAE,QAAgB,EAAE,KAAa,EAAE,OAAe;IAC9G,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO;IACxC,IAAI,CAAC;QACD,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;KACtD,CAAC,CAAC;AACP,CAAC;AAED,MAAM,aAAa,GAAwE;IACvF,iBAAiB,EAAE,eAAQ;IAC3B,gBAAgB,EAAE,aAAO;IACzB,gBAAgB,EAAE,aAAO;IACzB,mBAAmB,EAAE,mBAAU;CAClC,CAAC;AAEF,SAAS,YAAY,CAAC,IAAa,EAAE,IAAS;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,WAGnB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,+BAA+B,IAAI,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC;QACpE,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACjE,MAAM,EAAE,GACJ,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;YACnD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7E,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC;oBACrD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC5E,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;4BAC7C,IAAI,CAAC;QACT,IAAI,CAAC,EAAE,EAAE,CAAC;YACN,OAAO,cAAc,IAAI,QAAQ,IAAI,CAAC,IAAI,cAAc,QAAQ,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC;QAC9H,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAmB;IAChE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,IAAI,CAAC;QACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,WAAW,GAAG,IAAI,CAAC;gBACnB,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,eAAe,EAAE,gBAAgB;wBACjC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;wBAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;qBAC7D;iBACJ,CAAC;YACN,CAAC;YACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,aAAK,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAChB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAoF,CAAC;gBACrH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;gBACpC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;gBAClD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,aAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC5C,IAAI,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBACD,iDAAiD;gBACjD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAC9B,IAAI,CAAC,SAAS,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,OAAe,EAAE,EAAE,CAClE,YAAY,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7C,OAAO;oBACH,OAAO,EAAE,KAAK,EAAE,EAAE;oBAClB,MAAM,EAAE;wBACJ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;qBAC1E;iBACJ,CAAC;YACN,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACN,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACxC,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACvG,CAAC;QACL,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;AACL,CAAC;AAED,SAAgB,WAAW,CAAC,GAAkB;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/E,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACL,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACnC,OAAO;QACX,CAAC;QAED,IACI,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,OAAQ,MAAyB,CAAC,MAAM,KAAK,QAAQ,EACvD,CAAC;YACC,MAAM,OAAO,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC1D,CAAC,CAAE,MAAyB,CAAC,EAAE,IAAI,IAAI;gBACvC,CAAC,CAAC,IAAI,CAAC;YACf,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QAED,MAAM,GAAG,GAAG,MAAwB,CAAC;QACrC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC"}
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Phase F — HTTP POC executor.
|
|
3
|
+
*
|
|
4
|
+
* Verifies server-side vulnerabilities (SQL injection, open redirect, SSRF,
|
|
5
|
+
* access control) by sending a single HTTP request with the attack payload
|
|
6
|
+
* and checking the response for the exploit signature.
|
|
7
|
+
*
|
|
8
|
+
* This is a thin layer — the existing SandboxRunner handles complex attack
|
|
9
|
+
* scenarios (baseline comparison, multi-request flows, dev server spawning).
|
|
10
|
+
* This executor assumes the dev server is already running and just does a
|
|
11
|
+
* quick payload injection + response check.
|
|
12
|
+
*/
|
|
13
|
+
import type { PocRequest, PocResult } from './pocTypes';
|
|
14
|
+
/**
|
|
15
|
+
* Execute a POC via a simple HTTP request.
|
|
16
|
+
*
|
|
17
|
+
* Sends the attack payload to the target endpoint and checks the response
|
|
18
|
+
* for the exploit signature. Returns a PocResult with the verdict.
|
|
19
|
+
*/
|
|
20
|
+
export declare function executeWithHttp(req: PocRequest): Promise<PocResult>;
|
|
@@ -0,0 +1,247 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Phase F — HTTP POC executor.
|
|
4
|
+
*
|
|
5
|
+
* Verifies server-side vulnerabilities (SQL injection, open redirect, SSRF,
|
|
6
|
+
* access control) by sending a single HTTP request with the attack payload
|
|
7
|
+
* and checking the response for the exploit signature.
|
|
8
|
+
*
|
|
9
|
+
* This is a thin layer — the existing SandboxRunner handles complex attack
|
|
10
|
+
* scenarios (baseline comparison, multi-request flows, dev server spawning).
|
|
11
|
+
* This executor assumes the dev server is already running and just does a
|
|
12
|
+
* quick payload injection + response check.
|
|
13
|
+
*/
|
|
14
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
15
|
+
exports.executeWithHttp = executeWithHttp;
|
|
16
|
+
// ── Exploit signature patterns ──────────────────────────────────────────────
|
|
17
|
+
/** SQL error messages that indicate a successful injection. */
|
|
18
|
+
const SQL_ERROR_PATTERNS = [
|
|
19
|
+
/SQL syntax.*MySQL/i,
|
|
20
|
+
/Warning.*mysql_/i,
|
|
21
|
+
/PostgreSQL.*ERROR/i,
|
|
22
|
+
/ORA-\d{5}/i,
|
|
23
|
+
/SQLite3?::query/i,
|
|
24
|
+
/Microsoft SQL Server/i,
|
|
25
|
+
/Incorrect syntax near/i,
|
|
26
|
+
/Unclosed quotation mark/i,
|
|
27
|
+
/PG::.*Error/i,
|
|
28
|
+
/psycopg2\.errors/i,
|
|
29
|
+
/SQL syntax error/i, // General — catches most SQL backends
|
|
30
|
+
/sqlite3\.OperationalError/i,
|
|
31
|
+
/You have an error in your SQL syntax/i,
|
|
32
|
+
];
|
|
33
|
+
/** Patterns that indicate the response reflected user input without sanitization. */
|
|
34
|
+
const XSS_PATTERNS = [
|
|
35
|
+
/<script[^>]*>.*?<\/script>/i,
|
|
36
|
+
/onerror\s*=/i,
|
|
37
|
+
/onload\s*=/i,
|
|
38
|
+
/javascript:/i,
|
|
39
|
+
];
|
|
40
|
+
/** Internal addresses that indicate SSRF. */
|
|
41
|
+
const SSRF_INTERNAL_PATTERNS = [
|
|
42
|
+
/169\.254\.169\.254/i, // AWS metadata
|
|
43
|
+
/127\.0\.0\.1/i,
|
|
44
|
+
/localhost/i,
|
|
45
|
+
/10\.\d+\.\d+\.\d+/i,
|
|
46
|
+
/192\.168\.\d+\.\d+/i,
|
|
47
|
+
];
|
|
48
|
+
// ── Execution ───────────────────────────────────────────────────────────────
|
|
49
|
+
/**
|
|
50
|
+
* Execute a POC via a simple HTTP request.
|
|
51
|
+
*
|
|
52
|
+
* Sends the attack payload to the target endpoint and checks the response
|
|
53
|
+
* for the exploit signature. Returns a PocResult with the verdict.
|
|
54
|
+
*/
|
|
55
|
+
async function executeWithHttp(req) {
|
|
56
|
+
const baseUrl = req.endpoint.baseUrl || 'http://127.0.0.1:3000';
|
|
57
|
+
const fullPath = req.endpoint.path.startsWith('/')
|
|
58
|
+
? req.endpoint.path
|
|
59
|
+
: '/' + req.endpoint.path;
|
|
60
|
+
const url = baseUrl + fullPath;
|
|
61
|
+
const payload = req.payload || '';
|
|
62
|
+
const injectionPoint = req.injectionPoint || 'query';
|
|
63
|
+
const paramName = req.paramName || 'q';
|
|
64
|
+
const method = req.endpoint.method || 'GET';
|
|
65
|
+
try {
|
|
66
|
+
// Build the request based on injection point
|
|
67
|
+
let requestUrl = url;
|
|
68
|
+
const headers = {};
|
|
69
|
+
let body;
|
|
70
|
+
if (injectionPoint === 'query') {
|
|
71
|
+
const sep = requestUrl.includes('?') ? '&' : '?';
|
|
72
|
+
requestUrl = `${requestUrl}${sep}${paramName}=${encodeURIComponent(payload)}`;
|
|
73
|
+
}
|
|
74
|
+
else if (injectionPoint === 'body') {
|
|
75
|
+
body = JSON.stringify({ [paramName]: payload });
|
|
76
|
+
headers['Content-Type'] = 'application/json';
|
|
77
|
+
}
|
|
78
|
+
else if (injectionPoint === 'header') {
|
|
79
|
+
headers[paramName] = payload;
|
|
80
|
+
}
|
|
81
|
+
else if (injectionPoint === 'path') {
|
|
82
|
+
// Replace a path parameter with the payload
|
|
83
|
+
requestUrl = url.replace(/:\w+/, encodeURIComponent(payload));
|
|
84
|
+
}
|
|
85
|
+
const init = {
|
|
86
|
+
method,
|
|
87
|
+
headers,
|
|
88
|
+
...(body ? { body } : {}),
|
|
89
|
+
signal: AbortSignal.timeout(10_000),
|
|
90
|
+
};
|
|
91
|
+
const startTime = Date.now();
|
|
92
|
+
const response = await fetch(requestUrl, init);
|
|
93
|
+
const responseTime = Date.now() - startTime;
|
|
94
|
+
const responseHeaders = {};
|
|
95
|
+
response.headers.forEach((v, k) => { responseHeaders[k] = v; });
|
|
96
|
+
const responseBody = await response.text().catch(() => '');
|
|
97
|
+
// ── Check exploit signatures based on vuln type ────────────────
|
|
98
|
+
if (req.vulnType === 'sql_injection' || req.vulnType === 'nosql_injection') {
|
|
99
|
+
// Check for SQL error messages or data leakage
|
|
100
|
+
for (const pattern of SQL_ERROR_PATTERNS) {
|
|
101
|
+
if (pattern.test(responseBody)) {
|
|
102
|
+
return {
|
|
103
|
+
exploitable: true,
|
|
104
|
+
output: responseBody.slice(0, 500),
|
|
105
|
+
timedOut: false,
|
|
106
|
+
evidence: `SQL error message detected in response (pattern: ${pattern.source})`,
|
|
107
|
+
backend: 'http',
|
|
108
|
+
};
|
|
109
|
+
}
|
|
110
|
+
}
|
|
111
|
+
// Check for unexpected 200 on a malformed query
|
|
112
|
+
if (response.status >= 200 && response.status < 300 && payload.includes("'")) {
|
|
113
|
+
return {
|
|
114
|
+
exploitable: true,
|
|
115
|
+
output: responseBody.slice(0, 500),
|
|
116
|
+
timedOut: false,
|
|
117
|
+
evidence: `Injection payload accepted (HTTP ${response.status}) — query did not error on the payload`,
|
|
118
|
+
backend: 'http',
|
|
119
|
+
};
|
|
120
|
+
}
|
|
121
|
+
return {
|
|
122
|
+
exploitable: false,
|
|
123
|
+
output: responseBody.slice(0, 500),
|
|
124
|
+
timedOut: false,
|
|
125
|
+
evidence: `No SQL error or data leakage detected (HTTP ${response.status})`,
|
|
126
|
+
backend: 'http',
|
|
127
|
+
};
|
|
128
|
+
}
|
|
129
|
+
if (req.vulnType === 'xss') {
|
|
130
|
+
// Check if the payload appears unescaped in the response
|
|
131
|
+
if (payload && responseBody.includes(payload)) {
|
|
132
|
+
return {
|
|
133
|
+
exploitable: true,
|
|
134
|
+
output: responseBody.slice(0, 500),
|
|
135
|
+
timedOut: false,
|
|
136
|
+
evidence: 'Payload reflected unescaped in HTTP response body',
|
|
137
|
+
backend: 'http',
|
|
138
|
+
};
|
|
139
|
+
}
|
|
140
|
+
for (const pattern of XSS_PATTERNS) {
|
|
141
|
+
if (pattern.test(responseBody)) {
|
|
142
|
+
return {
|
|
143
|
+
exploitable: true,
|
|
144
|
+
output: responseBody.slice(0, 500),
|
|
145
|
+
timedOut: false,
|
|
146
|
+
evidence: `XSS pattern detected in response: ${pattern.source}`,
|
|
147
|
+
backend: 'http',
|
|
148
|
+
};
|
|
149
|
+
}
|
|
150
|
+
}
|
|
151
|
+
return {
|
|
152
|
+
exploitable: false,
|
|
153
|
+
output: responseBody.slice(0, 500),
|
|
154
|
+
timedOut: false,
|
|
155
|
+
evidence: 'Payload not reflected in response (may be escaped or sanitized)',
|
|
156
|
+
backend: 'http',
|
|
157
|
+
};
|
|
158
|
+
}
|
|
159
|
+
if (req.vulnType === 'open_redirect') {
|
|
160
|
+
// Check the Location header for the redirect target
|
|
161
|
+
const location = responseHeaders['location'] || '';
|
|
162
|
+
if (location && payload && location.includes(payload)) {
|
|
163
|
+
return {
|
|
164
|
+
exploitable: true,
|
|
165
|
+
output: `Location: ${location}`,
|
|
166
|
+
timedOut: false,
|
|
167
|
+
evidence: `Redirected to ${location} — open redirect confirmed`,
|
|
168
|
+
backend: 'http',
|
|
169
|
+
};
|
|
170
|
+
}
|
|
171
|
+
if (response.status >= 300 && response.status < 400 && location) {
|
|
172
|
+
return {
|
|
173
|
+
exploitable: true,
|
|
174
|
+
output: `Location: ${location}`,
|
|
175
|
+
timedOut: false,
|
|
176
|
+
evidence: `HTTP ${response.status} redirect to ${location}`,
|
|
177
|
+
backend: 'http',
|
|
178
|
+
};
|
|
179
|
+
}
|
|
180
|
+
return {
|
|
181
|
+
exploitable: false,
|
|
182
|
+
timedOut: false,
|
|
183
|
+
evidence: `No redirect detected (HTTP ${response.status}, no Location header)`,
|
|
184
|
+
backend: 'http',
|
|
185
|
+
};
|
|
186
|
+
}
|
|
187
|
+
if (req.vulnType === 'ssrf') {
|
|
188
|
+
// Check if the response indicates an internal request was made
|
|
189
|
+
for (const pattern of SSRF_INTERNAL_PATTERNS) {
|
|
190
|
+
if (pattern.test(responseBody)) {
|
|
191
|
+
return {
|
|
192
|
+
exploitable: true,
|
|
193
|
+
output: responseBody.slice(0, 500),
|
|
194
|
+
timedOut: false,
|
|
195
|
+
evidence: `Internal address detected in response: ${pattern.source}`,
|
|
196
|
+
backend: 'http',
|
|
197
|
+
};
|
|
198
|
+
}
|
|
199
|
+
}
|
|
200
|
+
return {
|
|
201
|
+
exploitable: false,
|
|
202
|
+
timedOut: false,
|
|
203
|
+
evidence: 'No internal address detected in response',
|
|
204
|
+
backend: 'http',
|
|
205
|
+
};
|
|
206
|
+
}
|
|
207
|
+
if (req.vulnType === 'broken_access_control') {
|
|
208
|
+
// Check for auth bypass: expected 401/403 but got 200
|
|
209
|
+
if (response.status >= 200 && response.status < 300) {
|
|
210
|
+
return {
|
|
211
|
+
exploitable: true,
|
|
212
|
+
output: responseBody.slice(0, 500),
|
|
213
|
+
timedOut: false,
|
|
214
|
+
evidence: `Access control bypass: got HTTP ${response.status} (expected 401/403)`,
|
|
215
|
+
backend: 'http',
|
|
216
|
+
};
|
|
217
|
+
}
|
|
218
|
+
return {
|
|
219
|
+
exploitable: false,
|
|
220
|
+
timedOut: false,
|
|
221
|
+
evidence: `Access control held (HTTP ${response.status})`,
|
|
222
|
+
backend: 'http',
|
|
223
|
+
};
|
|
224
|
+
}
|
|
225
|
+
// Generic fallback
|
|
226
|
+
return {
|
|
227
|
+
exploitable: false,
|
|
228
|
+
output: responseBody.slice(0, 500),
|
|
229
|
+
timedOut: false,
|
|
230
|
+
evidence: `No specific signature check for ${req.vulnType} (HTTP ${response.status}, ${responseTime}ms)`,
|
|
231
|
+
backend: 'http',
|
|
232
|
+
};
|
|
233
|
+
}
|
|
234
|
+
catch (error) {
|
|
235
|
+
const timedOut = error.name === 'TimeoutError' || error.name === 'AbortError';
|
|
236
|
+
return {
|
|
237
|
+
exploitable: false,
|
|
238
|
+
error: error.message,
|
|
239
|
+
timedOut,
|
|
240
|
+
evidence: timedOut
|
|
241
|
+
? 'POC timed out after 10s — the endpoint may not be running'
|
|
242
|
+
: `HTTP request failed: ${error.message}`,
|
|
243
|
+
backend: 'http',
|
|
244
|
+
};
|
|
245
|
+
}
|
|
246
|
+
}
|
|
247
|
+
//# sourceMappingURL=httpPocExecutor.js.map
|