@securecode-ai/mcp 0.1.0

package/dist/attack/executor.js

@@ -0,0 +1,162 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeHttpRequest = executeHttpRequest;
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const policy_1 = require("./policy");
+async function executeHttpRequest(req, budget, signal) {
+    const startTime = Date.now();
+    return new Promise((resolve) => {
+        const bodyData = req.body ? JSON.stringify(req.body) : undefined;
+        const isHttps = false; // localhost only, HTTP by default
+        const lib = isHttps ? https : http;
+        const requestOptions = {
+            hostname: req.host,
+            port: req.port,
+            path: req.path,
+            method: req.method,
+            headers: {
+                ...(req.headers || {}),
+                ...(bodyData ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(bodyData) } : {}),
+            },
+            timeout: budget.requestTimeoutMs,
+        };
+        const onRequest = (res) => {
+            if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400) {
+                const location = res.headers.location;
+                if ((0, policy_1.isRedirectToNonLocal)(res.statusCode, location)) {
+                    resolve({
+                        statusCode: res.statusCode,
+                        headers: res.headers,
+                        body: '',
+                        latencyMs: Date.now() - startTime,
+                        error: `Redirect to non-localhost blocked: ${location}`,
+                    });
+                    res.destroy();
+                    return;
+                }
+            }
+            let body = '';
+            let aborted = false;
+            let totalBytes = 0;
+            res.on('data', (chunk) => {
+                totalBytes += chunk.length;
+                if (totalBytes > budget.maxResponseBytes) {
+                    aborted = true;
+                    res.destroy();
+                    resolve({
+                        statusCode: res.statusCode || 0,
+                        headers: res.headers,
+                        body: body + chunk.toString('utf8').slice(0, budget.maxResponseBytes - body.length),
+                        latencyMs: Date.now() - startTime,
+                        error: `Response exceeded ${budget.maxResponseBytes} bytes`,
+                    });
+                    return;
+                }
+                body += chunk.toString('utf8');
+            });
+            res.on('end', () => {
+                if (aborted)
+                    return;
+                resolve({
+                    statusCode: res.statusCode || 0,
+                    headers: res.headers,
+                    body,
+                    latencyMs: Date.now() - startTime,
+                });
+            });
+            res.on('error', (err) => {
+                if (aborted)
+                    return;
+                resolve({
+                    statusCode: 0,
+                    headers: {},
+                    body: '',
+                    latencyMs: Date.now() - startTime,
+                    error: err.message,
+                });
+            });
+        };
+        const request = lib.request(requestOptions, onRequest);
+        request.on('error', (err) => {
+            resolve({
+                statusCode: 0,
+                headers: {},
+                body: '',
+                latencyMs: Date.now() - startTime,
+                error: err.message,
+            });
+        });
+        request.on('timeout', () => {
+            request.destroy();
+            resolve({
+                statusCode: 0,
+                headers: {},
+                body: '',
+                latencyMs: Date.now() - startTime,
+                error: `Request timed out after ${budget.requestTimeoutMs}ms`,
+            });
+        });
+        if (signal) {
+            if (signal.aborted) {
+                request.destroy();
+                resolve({
+                    statusCode: 0,
+                    headers: {},
+                    body: '',
+                    latencyMs: Date.now() - startTime,
+                    error: 'Cancelled by abort signal',
+                });
+                return;
+            }
+            signal.addEventListener('abort', () => {
+                request.destroy();
+                resolve({
+                    statusCode: 0,
+                    headers: {},
+                    body: '',
+                    latencyMs: Date.now() - startTime,
+                    error: 'Cancelled by abort signal',
+                });
+            });
+        }
+        if (bodyData) {
+            request.write(bodyData);
+        }
+        request.end();
+    });
+}
+//# sourceMappingURL=executor.js.map

package/dist/attack/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../src/attack/executor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,gDAuIC;AA7JD,2CAA6B;AAC7B,6CAA+B;AAE/B,qCAAgD;AAmBzC,KAAK,UAAU,kBAAkB,CACpC,GAAgB,EAChB,MAAoB,EACpB,MAAoB;IAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,kCAAkC;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAEnC,MAAM,cAAc,GAAwB;YACxC,QAAQ,EAAE,GAAG,CAAC,IAAI;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE;gBACL,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7G;YACD,OAAO,EAAE,MAAM,CAAC,gBAAgB;SACnC,CAAC;QAEF,MAAM,SAAS,GAAG,CAAC,GAAyB,EAAE,EAAE;YAC5C,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;gBAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACtC,IAAI,IAAA,6BAAoB,EAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACjD,OAAO,CAAC;wBACJ,UAAU,EAAE,GAAG,CAAC,UAAU;wBAC1B,OAAO,EAAE,GAAG,CAAC,OAAiC;wBAC9C,IAAI,EAAE,EAAE;wBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;wBACjC,KAAK,EAAE,sCAAsC,QAAQ,EAAE;qBAC1D,CAAC,CAAC;oBACH,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,OAAO;gBACX,CAAC;YACL,CAAC;YAED,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,UAAU,GAAG,CAAC,CAAC;YAEnB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC7B,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC3B,IAAI,UAAU,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBACvC,OAAO,GAAG,IAAI,CAAC;oBACf,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,OAAO,CAAC;wBACJ,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;wBAC/B,OAAO,EAAE,GAAG,CAAC,OAAiC;wBAC9C,IAAI,EAAE,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;wBACnF,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;wBACjC,KAAK,EAAE,qBAAqB,MAAM,CAAC,gBAAgB,QAAQ;qBAC9D,CAAC,CAAC;oBACH,OAAO;gBACX,CAAC;gBACD,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACf,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,CAAC;oBACJ,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;oBAC/B,OAAO,EAAE,GAAG,CAAC,OAAiC;oBAC9C,IAAI;oBACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACpC,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,CAAC;oBACJ,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE,EAAE;oBACX,IAAI,EAAE,EAAE;oBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACjC,KAAK,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAEvD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC;gBACJ,UAAU,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,EAAE;gBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBACjC,KAAK,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACvB,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC;gBACJ,UAAU,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,EAAE;gBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBACjC,KAAK,EAAE,2BAA2B,MAAM,CAAC,gBAAgB,IAAI;aAChE,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,IAAI,MAAM,EAAE,CAAC;YACT,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO,CAAC;oBACJ,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE,EAAE;oBACX,IAAI,EAAE,EAAE;oBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACjC,KAAK,EAAE,2BAA2B;iBACrC,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;gBAClC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO,CAAC;oBACJ,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE,EAAE;oBACX,IAAI,EAAE,EAAE;oBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACjC,KAAK,EAAE,2BAA2B;iBACrC,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;QACP,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/attack/policy.d.ts

@@ -0,0 +1,26 @@
+export interface AttackBudget {
+    maxSteps: number;
+    maxRequests: number;
+    wallClockMs: number;
+    maxResponseBytes: number;
+    requestTimeoutMs: number;
+}
+export declare const DEFAULT_BUDGET: AttackBudget;
+export declare class PolicyError extends Error {
+    constructor(message: string);
+}
+export declare function isLocalhostHost(host: string): boolean;
+export declare function validateTarget(target: {
+    host: string;
+    port: number;
+    path: string;
+}): void;
+export declare function isRedirectToNonLocal(statusCode: number, location: string | undefined): boolean;
+export declare function checkBudget(budget: AttackBudget, state: {
+    stepsTaken: number;
+    requestsMade: number;
+    startTime: number;
+}): {
+    exhausted: boolean;
+    reason?: string;
+};

package/dist/attack/policy.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyError = exports.DEFAULT_BUDGET = void 0;
+exports.isLocalhostHost = isLocalhostHost;
+exports.validateTarget = validateTarget;
+exports.isRedirectToNonLocal = isRedirectToNonLocal;
+exports.checkBudget = checkBudget;
+exports.DEFAULT_BUDGET = {
+    maxSteps: 12,
+    maxRequests: 50,
+    wallClockMs: 90_000,
+    maxResponseBytes: 1_000_000,
+    requestTimeoutMs: 10_000,
+};
+const ALLOWED_HOSTS = new Set(['127.0.0.1', 'localhost', '::1', '0:0:0:0:0:0:0:1']);
+class PolicyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PolicyError';
+    }
+}
+exports.PolicyError = PolicyError;
+function isLocalhostHost(host) {
+    const lower = host.toLowerCase();
+    return ALLOWED_HOSTS.has(lower);
+}
+function validateTarget(target) {
+    if (!isLocalhostHost(target.host)) {
+        throw new PolicyError(`Target host '${target.host}' is not allowed. Only localhost targets (127.0.0.1, localhost, ::1) are permitted.`);
+    }
+    if (!target.port || target.port < 1 || target.port > 65535) {
+        throw new PolicyError(`Port ${target.port} is invalid. Must be 1-65535.`);
+    }
+    if (!target.path.startsWith('/')) {
+        throw new PolicyError(`Path '${target.path}' must start with '/'.`);
+    }
+    if (target.path.includes('..')) {
+        throw new PolicyError(`Path '${target.path}' contains path traversal sequence.`);
+    }
+}
+function isRedirectToNonLocal(statusCode, location) {
+    if (!location)
+        return false;
+    if (statusCode < 300 || statusCode >= 400)
+        return false;
+    try {
+        if (location.startsWith('http://') || location.startsWith('https://')) {
+            const parsed = new URL(location);
+            return !isLocalhostHost(parsed.hostname);
+        }
+        if (location.startsWith('//')) {
+            const host = location.slice(2).split('/')[0].split(':')[0];
+            return !isLocalhostHost(host);
+        }
+    }
+    catch {
+        return true;
+    }
+    return false;
+}
+function checkBudget(budget, state) {
+    if (state.stepsTaken >= budget.maxSteps) {
+        return { exhausted: true, reason: `Max steps (${budget.maxSteps}) reached.` };
+    }
+    if (state.requestsMade >= budget.maxRequests) {
+        return { exhausted: true, reason: `Max requests (${budget.maxRequests}) reached.` };
+    }
+    if (Date.now() - state.startTime > budget.wallClockMs) {
+        return { exhausted: true, reason: `Wall clock limit (${budget.wallClockMs}ms) exceeded.` };
+    }
+    return { exhausted: false };
+}
+//# sourceMappingURL=policy.js.map

package/dist/attack/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/attack/policy.ts"],"names":[],"mappings":";;;AA2BA,0CAGC;AAED,wCAeC;AAED,oDAgBC;AAED,kCAcC;AAvEY,QAAA,cAAc,GAAiB;IACxC,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE,EAAE;IACf,WAAW,EAAE,MAAM;IACnB,gBAAgB,EAAE,SAAS;IAC3B,gBAAgB,EAAE,MAAM;CAC3B,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEpF,MAAa,WAAY,SAAQ,KAAK;IAClC,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,CAAC;CACJ;AALD,kCAKC;AAED,SAAgB,eAAe,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,SAAgB,cAAc,CAAC,MAAoD;IAC/E,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CACjB,gBAAgB,MAAM,CAAC,IAAI,qFAAqF,CACnH,CAAC;IACN,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,WAAW,CAAC,QAAQ,MAAM,CAAC,IAAI,+BAA+B,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,WAAW,CAAC,SAAS,MAAM,CAAC,IAAI,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,WAAW,CAAC,SAAS,MAAM,CAAC,IAAI,qCAAqC,CAAC,CAAC;IACrF,CAAC;AACL,CAAC;AAED,SAAgB,oBAAoB,CAAC,UAAkB,EAAE,QAA4B;IACjF,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAgB,WAAW,CACvB,MAAoB,EACpB,KAAsE;IAEtE,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,MAAM,CAAC,QAAQ,YAAY,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,WAAW,YAAY,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACpD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,MAAM,CAAC,WAAW,eAAe,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC"}

package/dist/attack/protocol.d.ts

@@ -0,0 +1,64 @@
+export type AgentHttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';
+export interface AgentHttpRequestAction {
+    type: 'http_request';
+    method: AgentHttpMethod;
+    path: string;
+    headers?: Record<string, string>;
+    body?: unknown;
+    rationale: string;
+}
+export interface AgentFinding {
+    category: string;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    title: string;
+    description: string;
+    evidenceStepIndex: number;
+}
+export interface AgentFinishAction {
+    type: 'finish';
+    findings: AgentFinding[];
+    summary: string;
+}
+export type AgentAction = AgentHttpRequestAction | AgentFinishAction;
+export interface AgentObservation {
+    statusCode: number;
+    headers: Record<string, string>;
+    body: string;
+    latencyMs: number;
+    error?: string;
+}
+export interface AgentTranscriptStep {
+    action: AgentHttpRequestAction;
+    observation: AgentObservation;
+}
+export interface AgentStartResponse {
+    runId: string;
+    budget: {
+        stepsRemaining: number;
+        costSpentUsd: number;
+        costCapUsd: number;
+    };
+    attackerCredits: number;
+}
+export interface AgentStepRequest {
+    runId: string;
+    endpointContext: unknown;
+    language: string;
+    framework?: string;
+    handlerSource?: string;
+    transcript: AgentTranscriptStep[];
+    budget: {
+        stepsRemaining: number;
+        costSpentUsd: number;
+        costCapUsd: number;
+    };
+}
+export interface AgentStepResponse {
+    next: AgentAction | null;
+    costUsd: number;
+    tokens: number;
+    degraded: boolean;
+    costCapped: boolean;
+    stepsRemaining: number;
+}
+export type AgentRunStatus = 'completed' | 'capped' | 'degraded' | 'spawn_failed' | 'cancelled';

package/dist/attack/protocol.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=protocol.js.map

package/dist/attack/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/attack/protocol.ts"],"names":[],"mappings":""}

package/dist/attack/report.d.ts

@@ -0,0 +1,16 @@
+import type { AgentTranscriptStep, AgentFinding, AgentRunStatus } from './protocol';
+export interface ReportedAgentFinding extends AgentFinding {
+    confirmation: 'confirmed' | 'suspected';
+    rule?: string;
+    reason?: string;
+}
+export interface AttackReport {
+    status: AgentRunStatus;
+    findings: ReportedAgentFinding[];
+    transcript: AgentTranscriptStep[];
+    summary?: string;
+    stepsUsed: number;
+    costSpentUsd: number;
+}
+export declare function redactText(text: string): string;
+export declare function buildReport(status: AgentRunStatus, findings: AgentFinding[], transcript: AgentTranscriptStep[], stepsUsed: number, costSpentUsd: number, summary?: string): AttackReport;

package/dist/attack/report.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactText = redactText;
+exports.buildReport = buildReport;
+const JWT_RE = /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
+const API_KEY_RE = /\b[A-Za-z0-9]{32,}\b/g;
+const EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+const BEARER_RE = /Bearer\s+[A-Za-z0-9._-]+/gi;
+function redactText(text) {
+    return text
+        .replace(BEARER_RE, 'Bearer [REDACTED]')
+        .replace(JWT_RE, '[JWT_REDACTED]')
+        .replace(EMAIL_RE, '[EMAIL_REDACTED]')
+        .replace(API_KEY_RE, (match) => (match.length === 32 || match.length === 40 || match.length === 64 ? '[REDACTED]' : match));
+}
+function buildReport(status, findings, transcript, stepsUsed, costSpentUsd, summary) {
+    return {
+        status,
+        findings: findings.map((f) => ({
+            ...f,
+            confirmation: 'suspected',
+            reason: 'Agent-reported finding (deterministic verification not yet implemented)',
+        })),
+        transcript: transcript.map((step) => ({
+            action: {
+                ...step.action,
+                headers: redactHeaders(step.action.headers),
+            },
+            observation: {
+                ...step.observation,
+                headers: redactHeaders(step.observation.headers),
+                body: redactText(step.observation.body),
+            },
+        })),
+        summary,
+        stepsUsed,
+        costSpentUsd,
+    };
+}
+function redactHeaders(headers) {
+    if (!headers)
+        return {};
+    const out = {};
+    for (const [k, v] of Object.entries(headers)) {
+        if (/authorization|cookie|x-api-key|api-key/i.test(k)) {
+            out[k] = '[REDACTED]';
+        }
+        else {
+            out[k] = v;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=report.js.map

package/dist/attack/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/attack/report.ts"],"names":[],"mappings":";;AAsBA,gCAMC;AAED,kCA8BC;AA3CD,MAAM,MAAM,GAAG,oDAAoD,CAAC;AACpE,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,MAAM,QAAQ,GAAG,iDAAiD,CAAC;AACnE,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C,SAAgB,UAAU,CAAC,IAAY;IACnC,OAAO,IAAI;SACN,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC;SACvC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC;SACjC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC;SACrC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACpI,CAAC;AAED,SAAgB,WAAW,CACvB,MAAsB,EACtB,QAAwB,EACxB,UAAiC,EACjC,SAAiB,EACjB,YAAoB,EACpB,OAAgB;IAEhB,OAAO;QACH,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,GAAG,CAAC;YACJ,YAAY,EAAE,WAAoB;YAClC,MAAM,EAAE,yEAAyE;SACpF,CAAC,CAAC;QACH,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,EAAE;gBACJ,GAAG,IAAI,CAAC,MAAM;gBACd,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;aAC9C;YACD,WAAW,EAAE;gBACT,GAAG,IAAI,CAAC,WAAW;gBACnB,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;gBAChD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;aAC1C;SACJ,CAAC,CAAC;QACH,OAAO;QACP,SAAS;QACT,YAAY;KACf,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,yCAAyC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;QAC1B,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/auth/credentialStore.d.ts

@@ -0,0 +1,20 @@
+export interface StoredCredentials {
+    apiToken: string;
+    apiUrl: string;
+    storedAt: string;
+}
+export declare class CredentialStore {
+    static get(): StoredCredentials | null;
+    static save(credentials: StoredCredentials): {
+        method: string;
+        warning?: string;
+    };
+    static clear(): boolean;
+    static getOrThrow(): StoredCredentials;
+    private static saveMetadata;
+    static getMetadata(): {
+        apiUrl: string;
+        storedAt: string;
+        method: string;
+    } | null;
+}

package/dist/auth/credentialStore.js

@@ -0,0 +1,148 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialStore = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const keychain_1 = require("./keychain");
+const CRED_DIR = path.join(os.homedir(), '.securecode');
+const CRED_FILE = path.join(CRED_DIR, 'credentials.json');
+const DEFAULT_API_URL = 'https://api.usesecurecode.tech';
+class CredentialStore {
+    static get() {
+        const envToken = process.env.SECURECODE_API_TOKEN;
+        const envUrl = process.env.SECURECODE_API_URL || DEFAULT_API_URL;
+        if (envToken) {
+            return { apiToken: envToken, apiUrl: envUrl, storedAt: 'env' };
+        }
+        const token = keychain_1.Keychain.get();
+        if (token) {
+            return {
+                apiToken: token,
+                apiUrl: DEFAULT_API_URL,
+                storedAt: 'keychain',
+            };
+        }
+        try {
+            if (!fs.existsSync(CRED_FILE))
+                return null;
+            const stat = fs.statSync(CRED_FILE);
+            if (stat.mode & 0o077) {
+                console.error(`[securecode] Warning: ${CRED_FILE} is group/world accessible. Run: chmod 600 ${CRED_FILE}`);
+            }
+            const raw = fs.readFileSync(CRED_FILE, 'utf8');
+            const parsed = JSON.parse(raw);
+            if (!parsed.apiToken || !parsed.apiUrl)
+                return null;
+            return parsed;
+        }
+        catch {
+            return null;
+        }
+    }
+    static save(credentials) {
+        const kcResult = keychain_1.Keychain.set(credentials.apiToken);
+        if (kcResult.success) {
+            this.saveMetadata(credentials);
+            return { method: 'keychain' };
+        }
+        if (!fs.existsSync(CRED_DIR)) {
+            fs.mkdirSync(CRED_DIR, { recursive: true, mode: 0o700 });
+        }
+        fs.writeFileSync(CRED_FILE, JSON.stringify(credentials, null, 2), { mode: 0o600 });
+        return {
+            method: 'file',
+            warning: kcResult.error
+                ? `OS keychain unavailable (${kcResult.error}). Credentials stored in ${CRED_FILE} (mode 0600).`
+                : undefined,
+        };
+    }
+    static clear() {
+        let removed = keychain_1.Keychain.delete();
+        try {
+            if (fs.existsSync(CRED_FILE)) {
+                fs.unlinkSync(CRED_FILE);
+                removed = true;
+            }
+        }
+        catch {
+            // best effort
+        }
+        try {
+            const metaFile = path.join(CRED_DIR, 'metadata.json');
+            if (fs.existsSync(metaFile)) {
+                fs.unlinkSync(metaFile);
+                removed = true;
+            }
+        }
+        catch {
+            // best effort
+        }
+        return removed;
+    }
+    static getOrThrow() {
+        const creds = CredentialStore.get();
+        if (!creds) {
+            throw new Error('Not authenticated. Run `securecode-mcp login` or set SECURECODE_API_TOKEN environment variable.');
+        }
+        return creds;
+    }
+    static saveMetadata(credentials) {
+        if (!fs.existsSync(CRED_DIR)) {
+            fs.mkdirSync(CRED_DIR, { recursive: true, mode: 0o700 });
+        }
+        const metaFile = path.join(CRED_DIR, 'metadata.json');
+        const metadata = {
+            apiUrl: credentials.apiUrl,
+            storedAt: credentials.storedAt,
+            method: 'keychain',
+        };
+        fs.writeFileSync(metaFile, JSON.stringify(metadata, null, 2), { mode: 0o600 });
+    }
+    static getMetadata() {
+        const metaFile = path.join(CRED_DIR, 'metadata.json');
+        try {
+            if (!fs.existsSync(metaFile))
+                return null;
+            return JSON.parse(fs.readFileSync(metaFile, 'utf8'));
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.CredentialStore = CredentialStore;
+//# sourceMappingURL=credentialStore.js.map

package/dist/auth/credentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialStore.js","sourceRoot":"","sources":["../../src/auth/credentialStore.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,yCAAsC;AAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACxD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAQ1D,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAEzD,MAAa,eAAe;IACxB,MAAM,CAAC,GAAG;QACN,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,eAAe,CAAC;QACjE,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACnE,CAAC;QAED,MAAM,KAAK,GAAG,mBAAQ,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,KAAK,EAAE,CAAC;YACR,OAAO;gBACH,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,eAAe;gBACvB,QAAQ,EAAE,UAAU;aACvB,CAAC;QACN,CAAC;QAED,IAAI,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,yBAAyB,SAAS,8CAA8C,SAAS,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACpD,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,WAA8B;QACtC,MAAM,QAAQ,GAAG,mBAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO;YACH,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,QAAQ,CAAC,KAAK;gBACnB,CAAC,CAAC,4BAA4B,QAAQ,CAAC,KAAK,4BAA4B,SAAS,eAAe;gBAChG,CAAC,CAAC,SAAS;SAClB,CAAC;IACN,CAAC;IAED,MAAM,CAAC,KAAK;QACR,IAAI,OAAO,GAAG,mBAAQ,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,cAAc;QAClB,CAAC;QACD,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;YACtD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACxB,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,cAAc;QAClB,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,UAAU;QACb,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,iGAAiG,CACpG,CAAC;QACN,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,WAA8B;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG;YACb,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE,UAAU;SACrB,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,CAAC,WAAW;QACd,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACtD,IAAI,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAzGD,0CAyGC"}

package/dist/auth/keychain.d.ts

@@ -0,0 +1,14 @@
+export type Platform = 'darwin' | 'win32' | 'linux';
+export interface KeychainResult {
+    success: boolean;
+    method: 'keychain' | 'file';
+    platform: Platform;
+    error?: string;
+}
+export declare class Keychain {
+    static isAvailable(): boolean;
+    static get(): string | null;
+    static set(token: string): KeychainResult;
+    static delete(): boolean;
+    static getPlatform(): Platform;
+}