@socialneuron/mcp-server 1.9.1 → 1.9.2

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to `@socialneuron/mcp-server` will be documented in this fil
 
 ## [Unreleased]
 
+## [1.9.2] - 2026-07-26
+
+Security release. Upgrade is recommended for all users.
+
+### Security
+
+- **Prompt-injection scanner bypass via lookalike characters.** Instruction phrases written with Cyrillic or Greek characters that resemble Latin ones passed both existing scans and reached the model verbatim. Text is now also scanned in a confusable-folded form. Detection only — the folded form is never used for output, which would corrupt legitimate non-Latin text.
+- **Secret redaction failed open on common credential formats.** AWS access key IDs, Google API keys, Slack tokens, bearer tokens, and PEM private keys were not matched by the output scanner and could pass through unredacted. Patterns for each are now covered.
+- **SSRF guard missed IPv4-mapped IPv6 addresses.** URL parsing canonicalizes an embedded IPv4 literal to hexadecimal, so `http://[::ffff:169.254.169.254]/` reached the guard in a form the blocklist did not match, leaving cloud metadata endpoints and private ranges reachable. Mapped addresses are now expanded before the blocklist is applied.
+- **Scope attenuation could widen authority.** Requesting a narrower scope on the hosted endpoint used exact-string matching, so a token holding a parent scope that asked for one of its children matched nothing and was silently given its original scopes back. The request now resolves through the scope hierarchy and is refused when no requested scope is granted.
+
+### Fixed
+
+- **Instruction scanner no longer blocks ordinary copy.** "Forget everything you know about …" and similar phrasings were scored as prompt injection, discarding the entire tool result. The affected phrase now requires a qualifier such as "previous" or "above"; injection phrasings are unchanged.
+
 ## [1.9.1] - 2026-07-18
 
 ### Fixed
@@ -153,7 +168,7 @@ Released without changelog entries (see git history): OAuth connector flow + DCR
 
 ### Source
 
-Anchored by `memory-bank/audits/2026-05-13-pricing-consistency-audit.md` (PR #631). The same audit landed Phase 4b across `constants/pricing.ts`, `lib/currency.ts`, `data/answers.ts`, `pages/Pricing.tsx`, the docs-site llms.txt feeds, and the SEO comparison data — this release ships the corresponding MCP-protocol-level fix.
+Anchored by an internal pricing-consistency audit that aligned pricing, currency handling, and the published comparison data — this release ships the corresponding MCP-protocol-level fix.
 
 ## [1.7.6] - 2026-04-22
 

package/dist/http.js

@@ -2264,26 +2264,35 @@ function applyToolProfile(server, profile) {
 var constants_default = {
   ZERO_WIDTH_CHARS: "[\\u200B\\u200C\\u200D\\u2060\\uFEFF\\u{E0020}-\\u{E007F}]",
   INSTRUCTION_PHRASES: [
-    "(?:^|[^A-Za-z])ignore (?:all|previous|prior) instructions",
-    "(?:^|[^A-Za-z])disregard (?:the|all) (?:above|prior|previous)",
-    "(?:^|[^A-Za-z])forget (?:all|previous|prior|the above)",
+    "(?:^|[^A-Za-z])ignore (?:all |any |the )*(?:previous |prior |preceding |earlier |above )*instructions",
+    "(?:^|[^A-Za-z])disregard (?:all |any |the )*(?:previous |prior |preceding |earlier |above )*(?:instructions|prompts?|context)",
+    "(?:^|[^A-Za-z])forget (?:all |any |the )*(?:previous |prior |preceding |earlier |above )*instructions",
+    "(?:^|[^A-Za-z])forget (?:all |any |the )*(?:previous |prior |preceding |earlier |above )+(?:everything|context)",
+    "(?:^|[^A-Za-z])forget (?:all |any |the )*(?:everything|context) (?:above|previously|prior|before|you (?:were|have been))",
     "(?:^|[^A-Za-z])you are now (?:a |an )",
     "(?:^|[^A-Za-z])system:\\s",
     "<\\|im_start\\|>",
     "<\\|im_end\\|>",
     "</?im_(?:start|end)>",
     "<\\|assistant\\|>",
-    "(?:^|[^A-Za-z])\\[INST\\]"
+    "(?:^|[^A-Za-z])\\[INST\\]",
+    "(?:^|[^A-Za-z])disregard (?:the|all) (?:above|prior|previous)",
+    "(?:^|[^A-Za-z])forget (?:all|previous|prior|the above)"
   ],
   PII_PATTERNS: {
     email: "[\\w.+-]+@[\\w-]+\\.[\\w.-]+",
     phone_us: "(?<!\\d|-)(?:\\+?1[-\\s.])?\\(?\\d{3}\\)?[-\\s.]?\\d{3}[-\\s.]?\\d{4}(?!\\d|-)",
     phone_intl: "\\+\\d{1,3}[-\\s.]?\\d{1,4}[-\\s.]?\\d{1,4}[-\\s.]?\\d{4,}",
     jwt: "eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+",
-    api_key: "(?:sk|pk|snk|xoxb|ghp|github_pat)_[A-Za-z0-9_-]{16,}",
+    api_key: "(?:sk|pk|snk|sno|xoxb|ghp|github_pat)_[A-Za-z0-9_-]{16,}",
     credit_card: "(?<!\\d|-)(?:\\d{4}[ -]?){3}\\d{4}(?!\\d|-)",
     ssn: "\\d{3}-\\d{2}-\\d{4}",
-    ip: "(?<![\\d.])(?:\\d{1,3}\\.){3}\\d{1,3}(?![\\d.])"
+    ip: "(?<![\\d.])(?:\\d{1,3}\\.){3}\\d{1,3}(?![\\d.])",
+    aws_access_key: "AKIA[0-9A-Z]{16}",
+    google_api_key: "AIza[0-9A-Za-z_\\-]{35}",
+    slack_token: "xox[abprs]-[A-Za-z0-9-]{10,}|xapp-[0-9]-[A-Za-z0-9-]{10,}",
+    bearer_token: "Bearer\\s+[A-Za-z0-9._~+/=-]{20,}",
+    private_key_block: "-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----"
   },
   MAX_LENGTH: 1e4,
   MAX_OUTPUT_LENGTH: 1e6
@@ -2304,6 +2313,83 @@ function normalize(text) {
   out = out.replace(EXCESSIVE_WHITESPACE, " ");
   return out;
 }
+var CONFUSABLES = {
+  // Cyrillic, lowercase
+  \u0430: "a",
+  \u0432: "b",
+  \u0435: "e",
+  \u0455: "s",
+  \u0456: "i",
+  \u0458: "j",
+  \u043A: "k",
+  \u043C: "m",
+  \u043D: "h",
+  \u043E: "o",
+  \u0440: "p",
+  \u0441: "c",
+  \u0442: "t",
+  \u0443: "y",
+  \u0445: "x",
+  "\u0501": "d",
+  \u0451: "e",
+  \u04BB: "h",
+  \u0475: "v",
+  "\u051B": "q",
+  \u0461: "w",
+  "\u04CF": "l",
+  "\u051D": "w",
+  // Cyrillic, uppercase
+  \u0410: "A",
+  \u0412: "B",
+  \u0415: "E",
+  \u0405: "S",
+  \u0406: "I",
+  \u0408: "J",
+  \u041A: "K",
+  \u041C: "M",
+  \u041D: "H",
+  \u041E: "O",
+  \u0420: "P",
+  \u0421: "C",
+  \u0422: "T",
+  \u0423: "Y",
+  \u0425: "X",
+  // Greek, lowercase
+  \u03B1: "a",
+  \u03B2: "b",
+  \u03B5: "e",
+  \u03B9: "i",
+  \u03BA: "k",
+  \u03BD: "v",
+  \u03BF: "o",
+  \u03C1: "p",
+  \u03C4: "t",
+  \u03C5: "u",
+  \u03C7: "x",
+  \u03F2: "c",
+  \u03B3: "y",
+  \u03B7: "n",
+  // Greek, uppercase
+  \u0391: "A",
+  \u0392: "B",
+  \u0395: "E",
+  \u0396: "Z",
+  \u0397: "H",
+  \u0399: "I",
+  \u039A: "K",
+  \u039C: "M",
+  \u039D: "N",
+  \u039F: "O",
+  \u03A1: "P",
+  \u03A4: "T",
+  \u03A5: "Y",
+  \u03A7: "X"
+};
+var CONFUSABLE_RE = new RegExp(`[${Object.keys(CONFUSABLES).join("")}]`, "g");
+function skeleton(text) {
+  if (typeof text !== "string") return "";
+  return text.replace(CONFUSABLE_RE, (ch) => CONFUSABLES[ch] ?? ch);
+}
 
 // src/lib/agent-harness/detectors/zeroWidth.ts
 var ZERO_WIDTH_RE = new RegExp(CONSTANTS.ZERO_WIDTH_CHARS, "u");
@@ -2372,6 +2458,14 @@ function scan(text, options) {
     flagged.add(ipNorm.pattern);
     risk = Math.max(risk, 0.9);
   }
+  const skeletonText = skeleton(normalized);
+  if (skeletonText !== normalized) {
+    const ipSkel = detectInstructionPhrase(skeletonText);
+    if (ipSkel.found) {
+      flagged.add(ipSkel.pattern);
+      risk = Math.max(risk, 0.9);
+    }
+  }
   const flaggedArr = Array.from(flagged);
   if ((options.mode === "block" || options.mode === "sanitize") && flaggedArr.length > 0) {
     return { passed: false, risk_score: risk, flagged_patterns: flaggedArr, pii_redacted: false };
@@ -2509,7 +2603,7 @@ function checkRateLimit(category, key) {
 init_supabase();
 
 // src/lib/version.ts
-var MCP_VERSION = "1.9.1";
+var MCP_VERSION = "1.9.2";
 
 // src/tools/ideation.ts
 function asEnvelope(data) {
@@ -4203,9 +4297,22 @@ var BLOCKED_HOSTNAMES = [
 ];
 var ALLOWED_PROTOCOLS = ["http:", "https:"];
 var BLOCKED_PORTS = [22, 23, 25, 110, 143, 445, 3306, 5432, 6379, 27017, 11211];
+function expandIPv4Mapped(ip) {
+  const dotted = /^::ffff:((?:\d{1,3}\.){3}\d{1,3})$/i.exec(ip);
+  if (dotted) return dotted[1];
+  const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(ip);
+  if (hex) {
+    const high = parseInt(hex[1], 16);
+    const low = parseInt(hex[2], 16);
+    return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
+  }
+  return null;
+}
 function isBlockedIP(ip) {
   const normalized = ip.replace(/^\[/, "").replace(/\]$/, "");
   if (normalized.includes(":")) {
+    const mapped = expandIPv4Mapped(normalized);
+    if (mapped) return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(mapped));
     return BLOCKED_IPV6_PATTERNS.some((pattern) => pattern.test(normalized));
   }
   return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(normalized));
@@ -19336,8 +19443,14 @@ async function authenticateRequest(req, res, next) {
     const scopeParam = req.query.scope;
     if (scopeParam) {
       const requestedScopes = scopeParam.split(",").map((s) => s.trim()).filter(Boolean);
-      scopes = requestedScopes.filter((s) => authInfo.scopes.includes(s));
-      if (scopes.length === 0) scopes = authInfo.scopes;
+      scopes = requestedScopes.filter((s) => hasScope(authInfo.scopes, s));
+      if (scopes.length === 0) {
+        res.status(403).json({
+          error: "insufficient_scope",
+          error_description: "None of the requested scopes are granted by this token."
+        });
+        return;
+      }
     }
     req.auth = {
       userId: authInfo.extra?.userId ?? authInfo.clientId,

package/dist/index.js

@@ -19,7 +19,7 @@ var MCP_VERSION;
 var init_version = __esm({
   "src/lib/version.ts"() {
     "use strict";
-    MCP_VERSION = "1.9.1";
+    MCP_VERSION = "1.9.2";
   }
 });
 
@@ -2285,26 +2285,35 @@ var init_constants = __esm({
     constants_default = {
       ZERO_WIDTH_CHARS: "[\\u200B\\u200C\\u200D\\u2060\\uFEFF\\u{E0020}-\\u{E007F}]",
       INSTRUCTION_PHRASES: [
-        "(?:^|[^A-Za-z])ignore (?:all|previous|prior) instructions",
-        "(?:^|[^A-Za-z])disregard (?:the|all) (?:above|prior|previous)",
-        "(?:^|[^A-Za-z])forget (?:all|previous|prior|the above)",
+        "(?:^|[^A-Za-z])ignore (?:all |any |the )*(?:previous |prior |preceding |earlier |above )*instructions",
+        "(?:^|[^A-Za-z])disregard (?:all |any |the )*(?:previous |prior |preceding |earlier |above )*(?:instructions|prompts?|context)",
+        "(?:^|[^A-Za-z])forget (?:all |any |the )*(?:previous |prior |preceding |earlier |above )*instructions",
+        "(?:^|[^A-Za-z])forget (?:all |any |the )*(?:previous |prior |preceding |earlier |above )+(?:everything|context)",
+        "(?:^|[^A-Za-z])forget (?:all |any |the )*(?:everything|context) (?:above|previously|prior|before|you (?:were|have been))",
         "(?:^|[^A-Za-z])you are now (?:a |an )",
         "(?:^|[^A-Za-z])system:\\s",
         "<\\|im_start\\|>",
         "<\\|im_end\\|>",
         "</?im_(?:start|end)>",
         "<\\|assistant\\|>",
-        "(?:^|[^A-Za-z])\\[INST\\]"
+        "(?:^|[^A-Za-z])\\[INST\\]",
+        "(?:^|[^A-Za-z])disregard (?:the|all) (?:above|prior|previous)",
+        "(?:^|[^A-Za-z])forget (?:all|previous|prior|the above)"
       ],
       PII_PATTERNS: {
         email: "[\\w.+-]+@[\\w-]+\\.[\\w.-]+",
         phone_us: "(?<!\\d|-)(?:\\+?1[-\\s.])?\\(?\\d{3}\\)?[-\\s.]?\\d{3}[-\\s.]?\\d{4}(?!\\d|-)",
         phone_intl: "\\+\\d{1,3}[-\\s.]?\\d{1,4}[-\\s.]?\\d{1,4}[-\\s.]?\\d{4,}",
         jwt: "eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+",
-        api_key: "(?:sk|pk|snk|xoxb|ghp|github_pat)_[A-Za-z0-9_-]{16,}",
+        api_key: "(?:sk|pk|snk|sno|xoxb|ghp|github_pat)_[A-Za-z0-9_-]{16,}",
         credit_card: "(?<!\\d|-)(?:\\d{4}[ -]?){3}\\d{4}(?!\\d|-)",
         ssn: "\\d{3}-\\d{2}-\\d{4}",
-        ip: "(?<![\\d.])(?:\\d{1,3}\\.){3}\\d{1,3}(?![\\d.])"
+        ip: "(?<![\\d.])(?:\\d{1,3}\\.){3}\\d{1,3}(?![\\d.])",
+        aws_access_key: "AKIA[0-9A-Z]{16}",
+        google_api_key: "AIza[0-9A-Za-z_\\-]{35}",
+        slack_token: "xox[abprs]-[A-Za-z0-9-]{10,}|xapp-[0-9]-[A-Za-z0-9-]{10,}",
+        bearer_token: "Bearer\\s+[A-Za-z0-9._~+/=-]{20,}",
+        private_key_block: "-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----"
       },
       MAX_LENGTH: 1e4,
       MAX_OUTPUT_LENGTH: 1e6
@@ -2331,13 +2340,90 @@ function normalize(text) {
   out = out.replace(EXCESSIVE_WHITESPACE, " ");
   return out;
 }
-var OVERRIDE_CHARS, HTML_COMMENT, EXCESSIVE_WHITESPACE;
+function skeleton(text) {
+  if (typeof text !== "string") return "";
+  return text.replace(CONFUSABLE_RE, (ch) => CONFUSABLES[ch] ?? ch);
+}
+var OVERRIDE_CHARS, HTML_COMMENT, EXCESSIVE_WHITESPACE, CONFUSABLES, CONFUSABLE_RE;
 var init_normalize = __esm({
   "src/lib/agent-harness/normalize.ts"() {
     "use strict";
     OVERRIDE_CHARS = /[‪-‮⁦-⁩]/g;
     HTML_COMMENT = /<!--[\s\S]*?-->/g;
     EXCESSIVE_WHITESPACE = /\s{2,}/g;
+    CONFUSABLES = {
+      // Cyrillic, lowercase
+      \u0430: "a",
+      \u0432: "b",
+      \u0435: "e",
+      \u0455: "s",
+      \u0456: "i",
+      \u0458: "j",
+      \u043A: "k",
+      \u043C: "m",
+      \u043D: "h",
+      \u043E: "o",
+      \u0440: "p",
+      \u0441: "c",
+      \u0442: "t",
+      \u0443: "y",
+      \u0445: "x",
+      "\u0501": "d",
+      \u0451: "e",
+      \u04BB: "h",
+      \u0475: "v",
+      "\u051B": "q",
+      \u0461: "w",
+      "\u04CF": "l",
+      "\u051D": "w",
+      // Cyrillic, uppercase
+      \u0410: "A",
+      \u0412: "B",
+      \u0415: "E",
+      \u0405: "S",
+      \u0406: "I",
+      \u0408: "J",
+      \u041A: "K",
+      \u041C: "M",
+      \u041D: "H",
+      \u041E: "O",
+      \u0420: "P",
+      \u0421: "C",
+      \u0422: "T",
+      \u0423: "Y",
+      \u0425: "X",
+      // Greek, lowercase
+      \u03B1: "a",
+      \u03B2: "b",
+      \u03B5: "e",
+      \u03B9: "i",
+      \u03BA: "k",
+      \u03BD: "v",
+      \u03BF: "o",
+      \u03C1: "p",
+      \u03C4: "t",
+      \u03C5: "u",
+      \u03C7: "x",
+      \u03F2: "c",
+      \u03B3: "y",
+      \u03B7: "n",
+      // Greek, uppercase
+      \u0391: "A",
+      \u0392: "B",
+      \u0395: "E",
+      \u0396: "Z",
+      \u0397: "H",
+      \u0399: "I",
+      \u039A: "K",
+      \u039C: "M",
+      \u039D: "N",
+      \u039F: "O",
+      \u03A1: "P",
+      \u03A4: "T",
+      \u03A5: "Y",
+      \u03A7: "X"
+    };
+    CONFUSABLE_RE = new RegExp(`[${Object.keys(CONFUSABLES).join("")}]`, "g");
   }
 });
 
@@ -2429,6 +2515,14 @@ function scan(text, options) {
     flagged.add(ipNorm.pattern);
     risk = Math.max(risk, 0.9);
   }
+  const skeletonText = skeleton(normalized);
+  if (skeletonText !== normalized) {
+    const ipSkel = detectInstructionPhrase(skeletonText);
+    if (ipSkel.found) {
+      flagged.add(ipSkel.pattern);
+      risk = Math.max(risk, 0.9);
+    }
+  }
   const flaggedArr = Array.from(flagged);
   if ((options.mode === "block" || options.mode === "sanitize") && flaggedArr.length > 0) {
     return { passed: false, risk_score: risk, flagged_patterns: flaggedArr, pii_redacted: false };
@@ -4211,9 +4305,22 @@ var init_content = __esm({
 
 // src/lib/ssrf.ts
 import { promises as dnsPromises } from "node:dns";
+function expandIPv4Mapped(ip) {
+  const dotted = /^::ffff:((?:\d{1,3}\.){3}\d{1,3})$/i.exec(ip);
+  if (dotted) return dotted[1];
+  const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(ip);
+  if (hex) {
+    const high = parseInt(hex[1], 16);
+    const low = parseInt(hex[2], 16);
+    return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
+  }
+  return null;
+}
 function isBlockedIP(ip) {
   const normalized = ip.replace(/^\[/, "").replace(/\]$/, "");
   if (normalized.includes(":")) {
+    const mapped = expandIPv4Mapped(normalized);
+    if (mapped) return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(mapped));
     return BLOCKED_IPV6_PATTERNS.some((pattern) => pattern.test(normalized));
   }
   return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(normalized));

package/dist/sn.js

@@ -19,7 +19,7 @@ var MCP_VERSION;
 var init_version = __esm({
   "src/lib/version.ts"() {
     "use strict";
-    MCP_VERSION = "1.9.1";
+    MCP_VERSION = "1.9.2";
   }
 });
 
@@ -3688,26 +3688,35 @@ var init_constants = __esm({
     constants_default = {
       ZERO_WIDTH_CHARS: "[\\u200B\\u200C\\u200D\\u2060\\uFEFF\\u{E0020}-\\u{E007F}]",
       INSTRUCTION_PHRASES: [
-        "(?:^|[^A-Za-z])ignore (?:all|previous|prior) instructions",
-        "(?:^|[^A-Za-z])disregard (?:the|all) (?:above|prior|previous)",
-        "(?:^|[^A-Za-z])forget (?:all|previous|prior|the above)",
+        "(?:^|[^A-Za-z])ignore (?:all |any |the )*(?:previous |prior |preceding |earlier |above )*instructions",
+        "(?:^|[^A-Za-z])disregard (?:all |any |the )*(?:previous |prior |preceding |earlier |above )*(?:instructions|prompts?|context)",
+        "(?:^|[^A-Za-z])forget (?:all |any |the )*(?:previous |prior |preceding |earlier |above )*instructions",
+        "(?:^|[^A-Za-z])forget (?:all |any |the )*(?:previous |prior |preceding |earlier |above )+(?:everything|context)",
+        "(?:^|[^A-Za-z])forget (?:all |any |the )*(?:everything|context) (?:above|previously|prior|before|you (?:were|have been))",
         "(?:^|[^A-Za-z])you are now (?:a |an )",
         "(?:^|[^A-Za-z])system:\\s",
         "<\\|im_start\\|>",
         "<\\|im_end\\|>",
         "</?im_(?:start|end)>",
         "<\\|assistant\\|>",
-        "(?:^|[^A-Za-z])\\[INST\\]"
+        "(?:^|[^A-Za-z])\\[INST\\]",
+        "(?:^|[^A-Za-z])disregard (?:the|all) (?:above|prior|previous)",
+        "(?:^|[^A-Za-z])forget (?:all|previous|prior|the above)"
       ],
       PII_PATTERNS: {
         email: "[\\w.+-]+@[\\w-]+\\.[\\w.-]+",
         phone_us: "(?<!\\d|-)(?:\\+?1[-\\s.])?\\(?\\d{3}\\)?[-\\s.]?\\d{3}[-\\s.]?\\d{4}(?!\\d|-)",
         phone_intl: "\\+\\d{1,3}[-\\s.]?\\d{1,4}[-\\s.]?\\d{1,4}[-\\s.]?\\d{4,}",
         jwt: "eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+",
-        api_key: "(?:sk|pk|snk|xoxb|ghp|github_pat)_[A-Za-z0-9_-]{16,}",
+        api_key: "(?:sk|pk|snk|sno|xoxb|ghp|github_pat)_[A-Za-z0-9_-]{16,}",
         credit_card: "(?<!\\d|-)(?:\\d{4}[ -]?){3}\\d{4}(?!\\d|-)",
         ssn: "\\d{3}-\\d{2}-\\d{4}",
-        ip: "(?<![\\d.])(?:\\d{1,3}\\.){3}\\d{1,3}(?![\\d.])"
+        ip: "(?<![\\d.])(?:\\d{1,3}\\.){3}\\d{1,3}(?![\\d.])",
+        aws_access_key: "AKIA[0-9A-Z]{16}",
+        google_api_key: "AIza[0-9A-Za-z_\\-]{35}",
+        slack_token: "xox[abprs]-[A-Za-z0-9-]{10,}|xapp-[0-9]-[A-Za-z0-9-]{10,}",
+        bearer_token: "Bearer\\s+[A-Za-z0-9._~+/=-]{20,}",
+        private_key_block: "-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----"
       },
       MAX_LENGTH: 1e4,
       MAX_OUTPUT_LENGTH: 1e6
@@ -3734,13 +3743,90 @@ function normalize(text) {
   out = out.replace(EXCESSIVE_WHITESPACE, " ");
   return out;
 }
-var OVERRIDE_CHARS, HTML_COMMENT, EXCESSIVE_WHITESPACE;
+function skeleton(text) {
+  if (typeof text !== "string") return "";
+  return text.replace(CONFUSABLE_RE, (ch) => CONFUSABLES[ch] ?? ch);
+}
+var OVERRIDE_CHARS, HTML_COMMENT, EXCESSIVE_WHITESPACE, CONFUSABLES, CONFUSABLE_RE;
 var init_normalize = __esm({
   "src/lib/agent-harness/normalize.ts"() {
     "use strict";
     OVERRIDE_CHARS = /[‪-‮⁦-⁩]/g;
     HTML_COMMENT = /<!--[\s\S]*?-->/g;
     EXCESSIVE_WHITESPACE = /\s{2,}/g;
+    CONFUSABLES = {
+      // Cyrillic, lowercase
+      \u0430: "a",
+      \u0432: "b",
+      \u0435: "e",
+      \u0455: "s",
+      \u0456: "i",
+      \u0458: "j",
+      \u043A: "k",
+      \u043C: "m",
+      \u043D: "h",
+      \u043E: "o",
+      \u0440: "p",
+      \u0441: "c",
+      \u0442: "t",
+      \u0443: "y",
+      \u0445: "x",
+      "\u0501": "d",
+      \u0451: "e",
+      \u04BB: "h",
+      \u0475: "v",
+      "\u051B": "q",
+      \u0461: "w",
+      "\u04CF": "l",
+      "\u051D": "w",
+      // Cyrillic, uppercase
+      \u0410: "A",
+      \u0412: "B",
+      \u0415: "E",
+      \u0405: "S",
+      \u0406: "I",
+      \u0408: "J",
+      \u041A: "K",
+      \u041C: "M",
+      \u041D: "H",
+      \u041E: "O",
+      \u0420: "P",
+      \u0421: "C",
+      \u0422: "T",
+      \u0423: "Y",
+      \u0425: "X",
+      // Greek, lowercase
+      \u03B1: "a",
+      \u03B2: "b",
+      \u03B5: "e",
+      \u03B9: "i",
+      \u03BA: "k",
+      \u03BD: "v",
+      \u03BF: "o",
+      \u03C1: "p",
+      \u03C4: "t",
+      \u03C5: "u",
+      \u03C7: "x",
+      \u03F2: "c",
+      \u03B3: "y",
+      \u03B7: "n",
+      // Greek, uppercase
+      \u0391: "A",
+      \u0392: "B",
+      \u0395: "E",
+      \u0396: "Z",
+      \u0397: "H",
+      \u0399: "I",
+      \u039A: "K",
+      \u039C: "M",
+      \u039D: "N",
+      \u039F: "O",
+      \u03A1: "P",
+      \u03A4: "T",
+      \u03A5: "Y",
+      \u03A7: "X"
+    };
+    CONFUSABLE_RE = new RegExp(`[${Object.keys(CONFUSABLES).join("")}]`, "g");
   }
 });
 
@@ -3832,6 +3918,14 @@ function scan(text, options) {
     flagged.add(ipNorm.pattern);
     risk = Math.max(risk, 0.9);
   }
+  const skeletonText = skeleton(normalized);
+  if (skeletonText !== normalized) {
+    const ipSkel = detectInstructionPhrase(skeletonText);
+    if (ipSkel.found) {
+      flagged.add(ipSkel.pattern);
+      risk = Math.max(risk, 0.9);
+    }
+  }
   const flaggedArr = Array.from(flagged);
   if ((options.mode === "block" || options.mode === "sanitize") && flaggedArr.length > 0) {
     return { passed: false, risk_score: risk, flagged_patterns: flaggedArr, pii_redacted: false };
@@ -5614,9 +5708,22 @@ var init_content2 = __esm({
 
 // src/lib/ssrf.ts
 import { promises as dnsPromises } from "node:dns";
+function expandIPv4Mapped(ip) {
+  const dotted = /^::ffff:((?:\d{1,3}\.){3}\d{1,3})$/i.exec(ip);
+  if (dotted) return dotted[1];
+  const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(ip);
+  if (hex) {
+    const high = parseInt(hex[1], 16);
+    const low = parseInt(hex[2], 16);
+    return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
+  }
+  return null;
+}
 function isBlockedIP(ip) {
   const normalized = ip.replace(/^\[/, "").replace(/\]$/, "");
   if (normalized.includes(":")) {
+    const mapped = expandIPv4Mapped(normalized);
+    if (mapped) return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(mapped));
     return BLOCKED_IPV6_PATTERNS.some((pattern) => pattern.test(normalized));
   }
   return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(normalized));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@socialneuron/mcp-server",
   "mcpName": "com.socialneuron/mcp-server",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "description": "Official MCP server, REST API & CLI for Social Neuron — create, schedule, and optimize social content with 35+ AI models across YouTube, TikTok, and more.",
   "type": "module",
   "main": "dist/index.js",