@weave_protocol/mund 0.1.10 → 0.1.12

package/dist/analyzers/mcp-server-analyzer.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Mund - The Guardian Protocol
+ * MCP Server Analyzer - Scans MCP server manifests for security issues
+ *
+ * Detects:
+ * - Prompt injection in tool descriptions ("line jumping" attacks)
+ * - Hidden Unicode characters
+ * - Dangerous permission patterns
+ * - Embedded secrets
+ * - Typosquatting of legitimate server names
+ */
+import { type DetectionRule, type SecurityIssue, type IAnalyzer } from '../types.js';
+export interface McpServerManifest {
+    name: string;
+    version: string;
+    description?: string;
+    tools?: McpToolDefinition[];
+    resources?: McpResourceDefinition[];
+    prompts?: McpPromptDefinition[];
+    repository?: string;
+    author?: string;
+}
+export interface McpToolDefinition {
+    name: string;
+    description?: string;
+    inputSchema?: Record<string, unknown>;
+}
+export interface McpResourceDefinition {
+    name: string;
+    description?: string;
+    uri?: string;
+    mimeType?: string;
+}
+export interface McpPromptDefinition {
+    name: string;
+    description?: string;
+    arguments?: Array<{
+        name: string;
+        description?: string;
+        required?: boolean;
+    }>;
+}
+export interface McpScanResult {
+    server_name: string;
+    version: string;
+    scanned_at: string;
+    source?: string;
+    issue_count: number;
+    by_severity: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+    };
+    recommendation: 'DO_NOT_INSTALL' | 'REVIEW_CAREFULLY' | 'CAUTION' | 'APPEARS_SAFE';
+    capabilities: McpCapabilities;
+    issues: SecurityIssue[];
+}
+export interface McpCapabilities {
+    network: boolean;
+    filesystem: boolean;
+    execution: boolean;
+    environment: boolean;
+    database: boolean;
+    crypto: boolean;
+}
+export declare class McpServerAnalyzer implements IAnalyzer {
+    name: string;
+    type: string;
+    analyze(content: string, _rules: DetectionRule[]): Promise<SecurityIssue[]>;
+    /**
+     * Scan tool descriptions for injection attacks
+     */
+    private scanToolDescriptions;
+    /**
+     * Scan resource descriptions
+     */
+    private scanResourceDescriptions;
+    /**
+     * Scan prompt template descriptions
+     */
+    private scanPromptDescriptions;
+    /**
+     * Scan input schema for suspicious default values
+     */
+    private scanInputSchema;
+    /**
+     * Audit tool permissions and capabilities
+     */
+    auditPermissions(manifest: McpServerManifest): SecurityIssue[];
+    /**
+     * Scan manifest content for embedded secrets
+     */
+    private scanForSecrets;
+    /**
+     * Check for typosquatting of known legitimate servers
+     */
+    checkTyposquatting(manifest: McpServerManifest): SecurityIssue[];
+    /**
+     * Check metadata for suspicious patterns
+     */
+    private checkMetadata;
+    /**
+     * Find hidden Unicode characters in a string
+     */
+    private findHiddenUnicode;
+    /**
+     * Check for common typosquatting patterns
+     */
+    private hasTyposquatPattern;
+    /**
+     * Calculate Shannon entropy of a string
+     */
+    private calculateEntropy;
+    /**
+     * Calculate Levenshtein distance between two strings
+     */
+    private levenshteinDistance;
+    /**
+     * Create a location object
+     */
+    private createLocation;
+    /**
+     * Truncate string for display
+     */
+    private truncate;
+    /**
+     * Redact a secret for safe display
+     */
+    private redactSecret;
+    /**
+     * Parse and validate an MCP manifest
+     */
+    static parseManifest(content: string): McpServerManifest | null;
+    /**
+     * Analyze capabilities of a manifest
+     */
+    static analyzeCapabilities(manifest: McpServerManifest): McpCapabilities;
+    /**
+     * Get risk level based on capabilities
+     */
+    static getRiskLevel(capabilities: McpCapabilities): 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
+}
+export default McpServerAnalyzer;
+//# sourceMappingURL=mcp-server-analyzer.d.ts.map

package/dist/analyzers/mcp-server-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-analyzer.d.ts","sourceRoot":"","sources":["../../src/analyzers/mcp-server-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAMrB,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,cAAc,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,SAAS,GAAG,cAAc,CAAC;IACnF,YAAY,EAAE,eAAe,CAAC;IAC9B,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB;AAmHD,qBAAa,iBAAkB,YAAW,SAAS;IACjD,IAAI,SAAuB;IAC3B,IAAI,SAAgB;IAEd,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA6BjF;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA8D5B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAwChC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;OAEG;IACH,OAAO,CAAC,eAAe;IAsBvB;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,aAAa,EAAE;IAgE9D;;OAEG;IACH,OAAO,CAAC,cAAc;IA6BtB;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,aAAa,EAAE;IA4ChE;;OAEG;IACH,OAAO,CAAC,aAAa;IA0CrB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+BzB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgC3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAQtB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAKhB;;OAEG;IACH,OAAO,CAAC,YAAY;IAWpB;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAY/D;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,eAAe;IAuBxE;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK;CAM3F;AAED,eAAe,iBAAiB,CAAC"}