@yawlabs/mcp-compliance 0.5.0 → 0.6.0

package/dist/{chunk-Z7VLPYIO.js → chunk-QLFYT4I7.js}

@@ -494,15 +494,259 @@ var TEST_DEFINITIONS = [
     specRef: "server/resources#data-types",
     description: "Validates every resource has a valid URI (parseable as a URL) and a name field.",
     recommendation: "Ensure every resource has a valid, parseable URI and a name field. Add description and mimeType for better client integration."
+  },
+  // ── Security: Auth & Transport (8 tests) ─────────────────────────
+  {
+    id: "security-auth-required",
+    name: "Rejects unauthenticated requests",
+    category: "security",
+    required: false,
+    specRef: "basic/authorization",
+    description: "Sends a request without an Authorization header and verifies the server returns HTTP 401. Servers exposed over the network should require authentication.",
+    recommendation: "Implement authentication on your MCP endpoint. Return HTTP 401 Unauthorized for requests without valid credentials. Use OAuth 2.1 or Bearer tokens as recommended by the MCP spec."
+  },
+  {
+    id: "security-auth-malformed",
+    name: "Rejects malformed auth credentials",
+    category: "security",
+    required: false,
+    specRef: "basic/authorization",
+    description: "Sends a request with a malformed Authorization header (garbage value) and verifies the server returns HTTP 401 or 403. Servers must validate auth tokens, not just check for presence.",
+    recommendation: "Validate the format and signature of Authorization header values. Reject malformed or invalid tokens with HTTP 401. Do not treat any non-empty Authorization header as valid."
+  },
+  {
+    id: "security-tls-required",
+    name: "Enforces HTTPS/TLS",
+    category: "security",
+    required: false,
+    specRef: "basic/authorization",
+    description: "If the server URL uses HTTPS, attempts an HTTP (plaintext) connection and verifies it is rejected or redirected. Production MCP servers should not accept plaintext connections.",
+    recommendation: "Configure your server to reject HTTP connections or redirect to HTTPS. Use TLS 1.2 or higher. The MCP spec requires HTTPS for production deployments."
+  },
+  {
+    id: "security-session-entropy",
+    name: "Session IDs are high-entropy",
+    category: "security",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Analyzes the MCP-Session-Id returned by the server. Session IDs should be cryptographically random and not sequential or predictable.",
+    recommendation: "Generate session IDs using a cryptographically secure random source (e.g., crypto.randomUUID()). Session IDs should be at least 128 bits of entropy. Do not use sequential counters or timestamps."
+  },
+  {
+    id: "security-session-not-auth",
+    name: "Session ID does not bypass auth",
+    category: "security",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Verifies that presenting a valid MCP-Session-Id without an Authorization header is still rejected. Per spec, servers MUST NOT use sessions for authentication.",
+    recommendation: "Always validate the Authorization header independently of the MCP-Session-Id. Sessions are for request routing, not authentication. Reject requests that lack valid auth even if they have a valid session ID."
+  },
+  {
+    id: "security-oauth-metadata",
+    name: "OAuth metadata endpoint exists",
+    category: "security",
+    required: false,
+    specRef: "basic/authorization",
+    description: "Checks for a well-known OAuth authorization server metadata endpoint at /.well-known/oauth-authorization-server. If the server requires auth, it should advertise how to obtain tokens.",
+    recommendation: "Publish an OAuth 2.0 Authorization Server Metadata document at /.well-known/oauth-authorization-server on your server's origin. Include issuer, token_endpoint, and supported grant types."
+  },
+  {
+    id: "security-token-in-uri",
+    name: "Rejects auth tokens in query string",
+    category: "security",
+    required: false,
+    specRef: "basic/authorization",
+    description: "Sends a request with the auth token in the URL query string instead of the Authorization header. The MCP spec forbids transmitting credentials in URIs.",
+    recommendation: "Never accept authentication tokens from URL query parameters. Tokens in URIs are logged by proxies, appear in browser history, and leak via the Referer header. Only accept tokens in the Authorization header."
+  },
+  {
+    id: "security-cors-headers",
+    name: "CORS headers are restrictive",
+    category: "security",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "If the server returns CORS headers, verifies that Access-Control-Allow-Origin is not set to wildcard (*). Wildcard CORS on an authenticated API allows cross-origin credential theft.",
+    recommendation: 'Set Access-Control-Allow-Origin to specific trusted origins, not "*". If CORS is not needed (server-to-server only), do not send CORS headers at all.'
+  },
+  // ── Security: Input Validation (6 tests) ─────────────────────────
+  {
+    id: "security-command-injection",
+    name: "Resists command injection in tool params",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: "Calls each tool with OS command injection payloads in string parameters (e.g., '; cat /etc/passwd', '$(whoami)'). Verifies the server does not execute injected commands.",
+    recommendation: "Never pass tool argument values directly to shell commands. Use parameterized APIs, execFile() instead of exec(), or allowlists. Sanitize all user-provided input before use in system calls."
+  },
+  {
+    id: "security-sql-injection",
+    name: "Resists SQL injection in tool params",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: `Calls each tool with SQL injection payloads in string parameters (e.g., "' OR 1=1 --"). Verifies the server does not return database errors or unexpected data.`,
+    recommendation: "Use parameterized queries or prepared statements for all database operations. Never concatenate user input into SQL strings. Return generic error messages that do not reveal database structure."
+  },
+  {
+    id: "security-path-traversal",
+    name: "Resists path traversal in tool params",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: "Calls each tool with path traversal payloads in string parameters (e.g., '../../etc/passwd', '..\\\\..\\\\windows\\\\system.ini'). Verifies the server does not expose files outside its intended scope.",
+    recommendation: "Validate and sanitize file paths. Use path.resolve() and verify the result is within the allowed directory. Reject paths containing '..' segments. Use a chroot or sandboxed filesystem for file operations."
+  },
+  {
+    id: "security-ssrf-internal",
+    name: "Resists SSRF to internal networks",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: "For tools that accept URL parameters, submits internal IP addresses (169.254.169.254, 127.0.0.1, 10.0.0.0/8) and cloud metadata endpoints. Verifies the server blocks requests to internal networks.",
+    recommendation: "Validate and restrict URLs in tool parameters. Block requests to private IP ranges (10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x), link-local addresses, and cloud metadata endpoints. Use an allowlist of permitted domains."
+  },
+  {
+    id: "security-oversized-input",
+    name: "Handles oversized inputs gracefully",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: "Sends a tools/call request with an extremely large argument value (1MB+ string). Verifies the server rejects it with an error instead of crashing or consuming excessive resources.",
+    recommendation: "Implement request body size limits. Return HTTP 413 or JSON-RPC error for oversized payloads. Set explicit maxBodyLength in your HTTP server configuration."
+  },
+  {
+    id: "security-extra-params",
+    name: "Rejects or ignores extra tool params",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: "Calls a tool with unexpected additional parameters beyond what the schema defines. Verifies the server either rejects them (strict) or silently ignores them (permissive) without errors.",
+    recommendation: "Use JSON Schema validation with additionalProperties: false to reject unexpected parameters, or strip unknown properties before processing. Do not pass unvalidated properties to internal functions."
+  },
+  // ── Security: Tool Integrity (4 tests) ───────────────────────────
+  {
+    id: "security-tool-schema-defined",
+    name: "All tools define inputSchema",
+    category: "security",
+    required: false,
+    specRef: "server/tools#data-types",
+    description: "Verifies all tools have an inputSchema with type 'object'. Tools without schemas cannot have their inputs validated, creating an injection risk.",
+    recommendation: "Define a complete JSON Schema (inputSchema with type: 'object') for every tool. Specify all expected properties, their types, and constraints. This enables input validation and prevents parameter injection."
+  },
+  {
+    id: "security-tool-rug-pull",
+    name: "Tool definitions are stable across calls",
+    category: "security",
+    required: false,
+    specRef: "server/tools#listing-tools",
+    description: "Calls tools/list twice and compares the results. Tool definitions should not change between calls within the same session, which could indicate a rug-pull attack.",
+    recommendation: "Ensure tools/list returns consistent results within a session. If tools change dynamically, send a tools/list_changed notification. Never silently alter tool definitions \u2014 this is a known MCP attack vector (tool poisoning)."
+  },
+  {
+    id: "security-tool-description-poisoning",
+    name: "Tool descriptions free of injection patterns",
+    category: "security",
+    required: false,
+    specRef: "server/tools#data-types",
+    description: "Scans all tool names, descriptions, and parameter descriptions for prompt injection patterns: 'ignore previous', 'override', 'system prompt', hidden Unicode characters, and Base64-encoded strings.",
+    recommendation: "Review all tool descriptions for prompt injection patterns. Remove any text that attempts to override LLM instructions, references system prompts, or contains hidden characters. Tool descriptions are rendered to LLMs and can be used for prompt injection."
+  },
+  {
+    id: "security-tool-cross-reference",
+    name: "Tools do not reference other tools by name",
+    category: "security",
+    required: false,
+    specRef: "server/tools#data-types",
+    description: "Checks that tool descriptions do not reference other tool names. Cross-references between tools can be used to manipulate LLM tool selection and create implicit execution chains.",
+    recommendation: "Avoid referencing other tool names in tool descriptions. Each tool should be self-contained. If tools have dependencies, document them in server instructions, not in individual tool descriptions."
+  },
+  // ── Security: Information Disclosure (3 tests) ───────────────────
+  {
+    id: "security-error-no-stacktrace",
+    name: "Error responses do not leak stack traces",
+    category: "security",
+    required: false,
+    specRef: "basic",
+    description: "Triggers various error conditions and inspects responses for stack traces, file paths, and internal implementation details. Error responses should not reveal server internals.",
+    recommendation: "Sanitize error responses before returning them to clients. Remove stack traces, file paths, database connection strings, and internal IP addresses. Use generic error messages for unexpected failures."
+  },
+  {
+    id: "security-error-no-internal-ip",
+    name: "Error responses do not leak internal IPs",
+    category: "security",
+    required: false,
+    specRef: "basic",
+    description: "Inspects error response bodies for private IP addresses (10.x, 172.16-31.x, 192.168.x, 127.x) that would reveal internal network topology.",
+    recommendation: "Strip internal IP addresses from error responses. Configure your reverse proxy to not forward X-Real-IP or internal addressing. Use a centralized error handler that sanitizes responses."
+  },
+  {
+    id: "security-rate-limiting",
+    name: "Rate limiting is enforced",
+    category: "security",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Sends a burst of rapid requests and checks if the server eventually returns HTTP 429 Too Many Requests. Production servers should implement rate limiting to prevent abuse.",
+    recommendation: "Implement rate limiting on your MCP endpoint. Return HTTP 429 with a Retry-After header when limits are exceeded. Consider per-IP, per-token, and per-session rate limits."
   }
 ];
 
 // src/runner.ts
+var TEST_DEFINITIONS_MAP = new Map(TEST_DEFINITIONS.map((t) => [t.id, t]));
 var _require = createRequire(import.meta.url);
 var { version: TOOL_VERSION } = _require("../package.json");
 var SPEC_VERSION = "2025-11-25";
 var SPEC_BASE = `https://modelcontextprotocol.io/specification/${SPEC_VERSION}`;
 var VALID_CONTENT_TYPES = ["text", "image", "audio", "resource", "resource_link"];
+var INJECTION_PAYLOADS = {
+  command: ["; cat /etc/passwd", "$(whoami)", "| ls -la", "`id`", "&& echo pwned"],
+  sql: ["' OR 1=1 --", "'; DROP TABLE users; --", "1 UNION SELECT * FROM information_schema.tables--"],
+  pathTraversal: ["../../etc/passwd", "..\\..\\windows\\system.ini", "%2e%2e%2f%2e%2e%2fetc%2fpasswd"],
+  ssrf: ["http://169.254.169.254/latest/meta-data/", "http://127.0.0.1:22", "http://[::1]/", "http://10.0.0.1/"]
+};
+var STACK_TRACE_PATTERNS = [
+  /at\s+\S+\s+\(.*:\d+:\d+\)/i,
+  // Node.js: "at Function (file.js:10:5)"
+  /Traceback\s+\(most recent/i,
+  // Python
+  /\.py",\s+line\s+\d+/i,
+  // Python file reference
+  /\.java:\d+\)/i,
+  // Java
+  /\.go:\d+/i,
+  // Go
+  /from\s+\S+\.rb:\d+/i,
+  // Ruby
+  /\.cs:line\s+\d+/i,
+  // C#/.NET
+  /#\d+\s+\/.*\.php\(\d+\)/i,
+  // PHP
+  /panicked\s+at\s+'/i,
+  // Rust
+  /ENOENT|EACCES|EPERM/,
+  // Node.js system errors
+  /node_modules\//,
+  // Node.js module paths
+  /\/usr\/local\/|\/home\//,
+  // Unix paths
+  /[A-Z]:\\.*\\/,
+  // Windows paths
+  /password|passwd|secret|credential/i,
+  // Sensitive terms
+  /jdbc:|mysql:|postgres:|mongodb:/i
+  // DB connection strings
+];
+var INTERNAL_IP_PATTERNS = [
+  /\b10\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/,
+  /\b172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}\b/,
+  /\b192\.168\.\d{1,3}\.\d{1,3}\b/,
+  /\b127\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/,
+  /\b::1\b/,
+  // IPv6 loopback
+  /\bfe80:/i,
+  // IPv6 link-local
+  /\bf[cd][0-9a-f]{2}:/i
+  // IPv6 unique local (fc00::/fd00::)
+];
 function createIdCounter(start = 0) {
   let id = start;
   return () => ++id;
@@ -1811,6 +2055,696 @@ async function runComplianceSuite(url, options = {}) {
     }
     return { passed: false, details: `HTTP ${res.statusCode} \u2014 expected error code -32600` };
   });
+  const hasAuth = !!userHeaders.Authorization || !!userHeaders.authorization;
+  await test(
+    "security-auth-required",
+    "Rejects unauthenticated requests",
+    "security",
+    false,
+    "basic/authorization",
+    async () => {
+      if (!hasAuth) {
+        return {
+          passed: false,
+          details: "Server does not require auth (no --auth provided and server accepted unauthenticated requests)"
+        };
+      }
+      const noAuthHeaders = {};
+      if (sessionId) noAuthHeaders["mcp-session-id"] = sessionId;
+      try {
+        const res = await mcpRequest(backendUrl, "ping", void 0, nextId, noAuthHeaders, timeout);
+        if (res.statusCode === 401 || res.statusCode === 403) {
+          return { passed: true, details: `HTTP ${res.statusCode} (unauthenticated request rejected)` };
+        }
+        return { passed: false, details: `HTTP ${res.statusCode} \u2014 server accepted unauthenticated request` };
+      } catch (err) {
+        return { passed: true, details: "Connection rejected (acceptable)" };
+      }
+    }
+  );
+  await test(
+    "security-auth-malformed",
+    "Rejects malformed auth credentials",
+    "security",
+    false,
+    "basic/authorization",
+    async () => {
+      if (!hasAuth) {
+        return { passed: false, details: "Skipped: server does not require auth" };
+      }
+      const malformedHeaders = {
+        Authorization: "Bearer INVALID_GARBAGE_TOKEN_!@#$%^&*()"
+      };
+      if (sessionId) malformedHeaders["mcp-session-id"] = sessionId;
+      try {
+        const res = await mcpRequest(backendUrl, "ping", void 0, nextId, malformedHeaders, timeout);
+        if (res.statusCode === 401 || res.statusCode === 403) {
+          return { passed: true, details: `HTTP ${res.statusCode} (malformed auth rejected)` };
+        }
+        return { passed: false, details: `HTTP ${res.statusCode} \u2014 server accepted malformed auth token` };
+      } catch (err) {
+        return { passed: true, details: "Connection rejected (acceptable)" };
+      }
+    }
+  );
+  await test("security-tls-required", "Enforces HTTPS/TLS", "security", false, "basic/authorization", async () => {
+    const parsedUrl = new URL(url);
+    if (parsedUrl.protocol !== "https:") {
+      return { passed: false, details: `Server URL uses ${parsedUrl.protocol} \u2014 production servers should use HTTPS` };
+    }
+    const httpUrl = url.replace(/^https:/, "http:");
+    try {
+      const res = await request(httpUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 99950, method: "ping" }),
+        signal: AbortSignal.timeout(Math.min(timeout, 5e3))
+      });
+      await res.body.text();
+      if (res.statusCode === 301 || res.statusCode === 302 || res.statusCode === 308) {
+        return { passed: true, details: `HTTP ${res.statusCode} redirect to HTTPS (good)` };
+      }
+      if (res.statusCode >= 400) {
+        return { passed: true, details: `HTTP ${res.statusCode} (plaintext rejected)` };
+      }
+      return { passed: false, details: `HTTP ${res.statusCode} \u2014 server accepts plaintext HTTP connections` };
+    } catch {
+      return { passed: true, details: "HTTP connection refused (HTTPS enforced)" };
+    }
+  });
+  await test(
+    "security-session-entropy",
+    "Session IDs are high-entropy",
+    "security",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      if (!sessionId) {
+        return { passed: true, details: "Server does not issue session IDs (skipped)" };
+      }
+      if (sessionId.length < 16) {
+        return {
+          passed: false,
+          details: `Session ID too short (${sessionId.length} chars): "${sessionId}" \u2014 should be \u226516 chars`
+        };
+      }
+      if (/^\d+$/.test(sessionId)) {
+        return {
+          passed: false,
+          details: `Session ID is purely numeric: "${sessionId}" \u2014 likely sequential, not random`
+        };
+      }
+      const uniqueChars = new Set(sessionId.toLowerCase()).size;
+      if (uniqueChars < 8) {
+        return {
+          passed: false,
+          details: `Session ID has low character diversity (${uniqueChars} unique chars): "${sessionId}"`
+        };
+      }
+      return {
+        passed: true,
+        details: `Session ID has good entropy (${sessionId.length} chars, ${uniqueChars} unique): "${sessionId.substring(0, 16)}..."`
+      };
+    }
+  );
+  await test(
+    "security-session-not-auth",
+    "Session ID does not bypass auth",
+    "security",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      if (!hasAuth) {
+        return { passed: true, details: "Skipped: server does not require auth" };
+      }
+      if (!sessionId) {
+        return { passed: true, details: "Skipped: server does not issue session IDs" };
+      }
+      const sessionOnlyHeaders = {
+        "mcp-session-id": sessionId
+      };
+      try {
+        const res = await mcpRequest(backendUrl, "ping", void 0, nextId, sessionOnlyHeaders, timeout);
+        if (res.statusCode === 401 || res.statusCode === 403) {
+          return { passed: true, details: `HTTP ${res.statusCode} (session ID alone not sufficient for auth)` };
+        }
+        return {
+          passed: false,
+          details: `HTTP ${res.statusCode} \u2014 server accepted session ID without auth (spec: MUST NOT use sessions for authentication)`
+        };
+      } catch {
+        return { passed: true, details: "Connection rejected (acceptable)" };
+      }
+    }
+  );
+  await test(
+    "security-oauth-metadata",
+    "OAuth metadata endpoint exists",
+    "security",
+    false,
+    "basic/authorization",
+    async () => {
+      if (!hasAuth) {
+        return { passed: true, details: "Skipped: server does not require auth" };
+      }
+      const parsedUrl = new URL(url);
+      const metadataUrl = `${parsedUrl.protocol}//${parsedUrl.host}/.well-known/oauth-authorization-server`;
+      try {
+        const res = await request(metadataUrl, {
+          method: "GET",
+          headers: { Accept: "application/json" },
+          signal: AbortSignal.timeout(Math.min(timeout, 5e3))
+        });
+        const text = await res.body.text();
+        if (res.statusCode === 200) {
+          try {
+            const meta = JSON.parse(text);
+            if (meta.issuer && meta.token_endpoint) {
+              return { passed: true, details: `OAuth metadata found: issuer=${meta.issuer}` };
+            }
+            return {
+              passed: false,
+              details: "OAuth metadata response missing required fields (issuer, token_endpoint)"
+            };
+          } catch {
+            return { passed: false, details: "OAuth metadata endpoint returned non-JSON response" };
+          }
+        }
+        return { passed: false, details: `OAuth metadata endpoint returned HTTP ${res.statusCode}` };
+      } catch {
+        return { passed: false, details: "OAuth metadata endpoint unreachable" };
+      }
+    }
+  );
+  await test(
+    "security-token-in-uri",
+    "Rejects auth tokens in query string",
+    "security",
+    false,
+    "basic/authorization",
+    async () => {
+      if (!hasAuth) {
+        return { passed: true, details: "Skipped: server does not require auth" };
+      }
+      const authValue = userHeaders.Authorization || userHeaders.authorization || "";
+      const token = authValue.replace(/^Bearer\s+/i, "");
+      if (!token) {
+        return { passed: true, details: "Skipped: could not extract token from auth header" };
+      }
+      const uriWithToken = `${url}${url.includes("?") ? "&" : "?"}access_token=${encodeURIComponent(token)}`;
+      try {
+        const noAuthHeaders = {};
+        if (sessionId) noAuthHeaders["mcp-session-id"] = sessionId;
+        const res = await mcpRequest(uriWithToken, "ping", void 0, nextId, noAuthHeaders, timeout);
+        if (res.statusCode === 401 || res.statusCode === 403) {
+          return { passed: true, details: `HTTP ${res.statusCode} (token in query string rejected)` };
+        }
+        if (res.statusCode >= 200 && res.statusCode < 300) {
+          return {
+            passed: false,
+            details: "Server accepted auth token in query string (spec: MUST NOT transmit credentials in URIs)"
+          };
+        }
+        return { passed: true, details: `HTTP ${res.statusCode} (token in query string not accepted)` };
+      } catch {
+        return { passed: true, details: "Connection rejected (acceptable)" };
+      }
+    }
+  );
+  await test(
+    "security-cors-headers",
+    "CORS headers are restrictive",
+    "security",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      try {
+        const res = await request(backendUrl, {
+          method: "OPTIONS",
+          headers: {
+            Origin: "https://evil.example.com",
+            "Access-Control-Request-Method": "POST",
+            ...buildHeaders()
+          },
+          signal: AbortSignal.timeout(Math.min(timeout, 5e3))
+        });
+        await res.body.text();
+        const acao = res.headers["access-control-allow-origin"];
+        if (!acao) {
+          return { passed: true, details: "No CORS headers returned (server-to-server only, acceptable)" };
+        }
+        if (acao === "*") {
+          return {
+            passed: false,
+            details: 'Access-Control-Allow-Origin is "*" (wildcard) \u2014 allows cross-origin credential theft'
+          };
+        }
+        if (acao === "https://evil.example.com") {
+          return { passed: false, details: "Server reflects arbitrary Origin in CORS \u2014 effectively wildcard" };
+        }
+        return { passed: true, details: `CORS restricted to: ${acao}` };
+      } catch {
+        return { passed: true, details: "OPTIONS request failed (no CORS, acceptable)" };
+      }
+    }
+  );
+  async function runInjectionTest(toolName, paramName, payloads, detectPattern, label) {
+    const issues = [];
+    for (const payload of payloads) {
+      try {
+        const res = await rpc("tools/call", { name: toolName, arguments: { [paramName]: payload } });
+        const content = res.body?.result?.content;
+        if (Array.isArray(content)) {
+          const text = content.map((c) => c.text || "").join(" ");
+          if (detectPattern.test(text)) {
+            issues.push(`Payload "${payload}" ${label} (output: ${text.substring(0, 100)})`);
+          }
+        }
+      } catch {
+      }
+    }
+    if (issues.length > 0) return { passed: false, details: issues.join("; ") };
+    return {
+      passed: true,
+      details: `Tested ${payloads.length} payloads against ${toolName}.${paramName} \u2014 no ${label.split(" ")[0]} detected`
+    };
+  }
+  if (toolNames.length > 0) {
+    const allTools = cachedToolsList ?? [];
+    const toolsWithStringParams = allTools.filter((t) => {
+      const props = t.inputSchema?.properties;
+      if (!props) return false;
+      return Object.values(props).some((p) => p.type === "string");
+    });
+    const injectionTarget = toolsWithStringParams[0] || allTools[0];
+    const targetStringParam = injectionTarget?.inputSchema?.properties ? Object.entries(injectionTarget.inputSchema.properties).find(
+      ([_, v]) => v.type === "string"
+    )?.[0] ?? null : null;
+    await test(
+      "security-command-injection",
+      "Resists command injection in tool params",
+      "security",
+      false,
+      "server/tools#calling-tools",
+      async () => {
+        if (!injectionTarget || !targetStringParam)
+          return { passed: true, details: "No tools with string parameters to test" };
+        return runInjectionTest(
+          injectionTarget.name,
+          targetStringParam,
+          INJECTION_PAYLOADS.command,
+          /root:.*:\d+:\d+:.*:\/|uid=\d+\(\w+\)|drwxr|pwned/i,
+          "appears to have executed"
+        );
+      }
+    );
+    await test(
+      "security-sql-injection",
+      "Resists SQL injection in tool params",
+      "security",
+      false,
+      "server/tools#calling-tools",
+      async () => {
+        if (!injectionTarget || !targetStringParam)
+          return { passed: true, details: "No tools with string parameters to test" };
+        return runInjectionTest(
+          injectionTarget.name,
+          targetStringParam,
+          INJECTION_PAYLOADS.sql,
+          /syntax error|sql|mysql|postgres|sqlite|information_schema|table_name/i,
+          "triggered database error"
+        );
+      }
+    );
+    await test(
+      "security-path-traversal",
+      "Resists path traversal in tool params",
+      "security",
+      false,
+      "server/tools#calling-tools",
+      async () => {
+        if (!injectionTarget || !targetStringParam)
+          return { passed: true, details: "No tools with string parameters to test" };
+        return runInjectionTest(
+          injectionTarget.name,
+          targetStringParam,
+          INJECTION_PAYLOADS.pathTraversal,
+          /root:.*:0:0|\[boot loader\]|\[extensions\]/i,
+          "returned sensitive file content"
+        );
+      }
+    );
+    await test(
+      "security-ssrf-internal",
+      "Resists SSRF to internal networks",
+      "security",
+      false,
+      "server/tools#calling-tools",
+      async () => {
+        const urlParamTool = allTools.find((t) => {
+          const props = t.inputSchema?.properties;
+          if (!props) return false;
+          return Object.entries(props).some(
+            ([k, v]) => v.type === "string" && /url|uri|endpoint|link|href/i.test(k)
+          );
+        });
+        if (!urlParamTool) return { passed: true, details: "No tools with URL parameters found (skipped)" };
+        const urlParam = Object.entries(urlParamTool.inputSchema.properties).find(
+          ([k, v]) => v.type === "string" && /url|uri|endpoint|link|href/i.test(k)
+        )?.[0];
+        if (!urlParam) return { passed: true, details: "No URL parameter found" };
+        return runInjectionTest(
+          urlParamTool.name,
+          urlParam,
+          INJECTION_PAYLOADS.ssrf,
+          /ami-|instance-id|hostname|iam|security-credentials/i,
+          "returned internal data"
+        );
+      }
+    );
+  } else {
+    for (const testId of [
+      "security-command-injection",
+      "security-sql-injection",
+      "security-path-traversal",
+      "security-ssrf-internal"
+    ]) {
+      await test(
+        testId,
+        TEST_DEFINITIONS_MAP.get(testId)?.name || testId,
+        "security",
+        false,
+        "server/tools#calling-tools",
+        async () => ({ passed: true, details: "No tools available to test (skipped)" })
+      );
+    }
+  }
+  await test(
+    "security-oversized-input",
+    "Handles oversized inputs gracefully",
+    "security",
+    false,
+    "server/tools#calling-tools",
+    async () => {
+      const largeValue = "A".repeat(1048576);
+      try {
+        const res = await request(backendUrl, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+            ...buildHeaders()
+          },
+          body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: nextId(),
+            method: "tools/call",
+            params: { name: toolNames[0] || "test", arguments: { data: largeValue } }
+          }),
+          signal: AbortSignal.timeout(timeout)
+        });
+        await res.body.text();
+        if (res.statusCode === 413) {
+          return { passed: true, details: "HTTP 413 Payload Too Large (good)" };
+        }
+        if (res.statusCode >= 400) {
+          return { passed: true, details: `HTTP ${res.statusCode} (oversized input rejected)` };
+        }
+        return { passed: true, details: `HTTP ${res.statusCode} \u2014 server handled 1MB payload without crashing` };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes("timeout") || msg.includes("abort")) {
+          return { passed: false, details: "Request timed out \u2014 server may be struggling with oversized input" };
+        }
+        return { passed: true, details: "Connection rejected (acceptable for oversized input)" };
+      }
+    }
+  );
+  await test(
+    "security-extra-params",
+    "Rejects or ignores extra tool params",
+    "security",
+    false,
+    "server/tools#calling-tools",
+    async () => {
+      if (toolNames.length === 0) {
+        return { passed: true, details: "No tools available to test (skipped)" };
+      }
+      try {
+        const res = await rpc("tools/call", {
+          name: toolNames[0],
+          arguments: { __injected_param__: "malicious_value", __proto__: { admin: true } }
+        });
+        const error = res.body?.error;
+        if (error) {
+          return { passed: true, details: `Extra params rejected with error: ${error.code} \u2014 ${error.message}` };
+        }
+        return { passed: true, details: "Server processed request (extra params likely ignored)" };
+      } catch {
+        return { passed: true, details: "Request rejected (acceptable)" };
+      }
+    }
+  );
+  await test(
+    "security-tool-schema-defined",
+    "All tools define inputSchema",
+    "security",
+    false,
+    "server/tools#data-types",
+    async () => {
+      if (!toolsListOk) return { passed: true, details: "Skipped: tools/list not available" };
+      const tools = cachedToolsList ?? [];
+      if (tools.length === 0) return { passed: true, details: "No tools to validate" };
+      const missing = tools.filter((t) => !t.inputSchema || t.inputSchema.type !== "object");
+      if (missing.length > 0) {
+        return {
+          passed: false,
+          details: `${missing.length} tool(s) missing inputSchema: ${missing.map((t) => t.name).join(", ")}`
+        };
+      }
+      return { passed: true, details: `All ${tools.length} tool(s) have inputSchema defined` };
+    }
+  );
+  await test(
+    "security-tool-rug-pull",
+    "Tool definitions are stable across calls",
+    "security",
+    false,
+    "server/tools#listing-tools",
+    async () => {
+      if (!toolsListOk) return { passed: true, details: "Skipped: tools/list not available" };
+      try {
+        const res = await rpc("tools/list");
+        const tools2 = res.body?.result?.tools;
+        if (!Array.isArray(tools2)) return { passed: false, details: "Second tools/list call failed" };
+        const tools1 = cachedToolsList ?? [];
+        if (tools1.length !== tools2.length) {
+          return {
+            passed: false,
+            details: `Tool count changed: ${tools1.length} \u2192 ${tools2.length} (possible rug-pull)`
+          };
+        }
+        const names1 = tools1.map((t) => t.name).sort().join(",");
+        const names2 = tools2.map((t) => t.name).sort().join(",");
+        if (names1 !== names2) {
+          return { passed: false, details: "Tool names changed between calls (possible rug-pull)" };
+        }
+        for (const t1 of tools1) {
+          const t2 = tools2.find((t) => t.name === t1.name);
+          if (t2 && t1.description !== t2.description) {
+            return {
+              passed: false,
+              details: `Tool "${t1.name}" description changed between calls (possible rug-pull)`
+            };
+          }
+        }
+        return { passed: true, details: `${tools1.length} tool(s) consistent across 2 calls` };
+      } catch {
+        return { passed: false, details: "Second tools/list call threw an error" };
+      }
+    }
+  );
+  await test(
+    "security-tool-description-poisoning",
+    "Tool descriptions free of injection patterns",
+    "security",
+    false,
+    "server/tools#data-types",
+    async () => {
+      if (!toolsListOk) return { passed: true, details: "Skipped: tools/list not available" };
+      const tools = cachedToolsList ?? [];
+      if (tools.length === 0) return { passed: true, details: "No tools to validate" };
+      const suspiciousPatterns = [
+        { pattern: /ignore\s+(all\s+)?previous/i, label: "ignore previous instructions" },
+        { pattern: /override\s+(system|instructions|rules)/i, label: "override instructions" },
+        { pattern: /system\s+prompt/i, label: "system prompt reference" },
+        { pattern: /you\s+must\s+(always|never)/i, label: "behavioral override" },
+        { pattern: /do\s+not\s+(tell|inform|mention)/i, label: "concealment instruction" },
+        { pattern: /\b[A-Za-z0-9+/]{40,}={0,2}\b/, label: "possible Base64-encoded payload" },
+        // Zero-width characters (U+200B, U+200C, U+200D, U+FEFF)
+        { pattern: /\u200B|\u200C|\u200D|\uFEFF/, label: "hidden Unicode characters" }
+      ];
+      const issues = [];
+      for (const tool of tools) {
+        const textsToCheck = [
+          tool.description || "",
+          ...tool.inputSchema?.properties ? Object.values(tool.inputSchema.properties).map((p) => p.description || "") : []
+        ];
+        const combined = textsToCheck.join(" ");
+        for (const { pattern, label } of suspiciousPatterns) {
+          if (pattern.test(combined)) {
+            issues.push(`Tool "${tool.name}": ${label}`);
+          }
+        }
+      }
+      if (issues.length > 0) return { passed: false, details: issues.join("; ") };
+      return { passed: true, details: `${tools.length} tool(s) scanned \u2014 no injection patterns found` };
+    }
+  );
+  await test(
+    "security-tool-cross-reference",
+    "Tools do not reference other tools by name",
+    "security",
+    false,
+    "server/tools#data-types",
+    async () => {
+      if (!toolsListOk) return { passed: true, details: "Skipped: tools/list not available" };
+      const tools = cachedToolsList ?? [];
+      if (tools.length < 2)
+        return { passed: true, details: "Fewer than 2 tools \u2014 cross-reference check not applicable" };
+      const names = tools.map((t) => t.name).filter(Boolean);
+      const issues = [];
+      for (const tool of tools) {
+        const desc = (tool.description || "").toLowerCase();
+        for (const otherName of names) {
+          if (otherName === tool.name) continue;
+          if (desc.includes(otherName.toLowerCase())) {
+            issues.push(`Tool "${tool.name}" description references "${otherName}"`);
+          }
+        }
+      }
+      if (issues.length > 0) {
+        warnings.push(`Cross-tool references found: ${issues.join("; ")}`);
+        return { passed: false, details: issues.join("; ") };
+      }
+      return { passed: true, details: `${tools.length} tool(s) checked \u2014 no cross-references found` };
+    }
+  );
+  await test(
+    "security-error-no-stacktrace",
+    "Error responses do not leak stack traces",
+    "security",
+    false,
+    "basic",
+    async () => {
+      const errorResponses = [];
+      const errorPayloads = [
+        "{this is not valid json!!!",
+        JSON.stringify({ jsonrpc: "2.0", id: nextId(), method: "nonexistent/___crash___test___" }),
+        JSON.stringify({
+          jsonrpc: "2.0",
+          id: nextId(),
+          method: "tools/call",
+          params: { name: "___nonexistent___tool___" }
+        })
+      ];
+      for (const payload of errorPayloads) {
+        try {
+          const res = await request(backendUrl, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              Accept: "application/json, text/event-stream",
+              ...buildHeaders()
+            },
+            body: payload,
+            signal: AbortSignal.timeout(timeout)
+          });
+          const text = await res.body.text();
+          errorResponses.push(text);
+        } catch {
+        }
+      }
+      const issues = [];
+      for (const text of errorResponses) {
+        for (const pattern of STACK_TRACE_PATTERNS) {
+          if (pattern.test(text)) {
+            issues.push(`Response contains: ${pattern.source} (matched in: ${text.substring(0, 80)}...)`);
+            break;
+          }
+        }
+      }
+      if (issues.length > 0) return { passed: false, details: issues.slice(0, 3).join("; ") };
+      return {
+        passed: true,
+        details: `${errorResponses.length} error responses checked \u2014 no stack traces or sensitive data found`
+      };
+    }
+  );
+  await test(
+    "security-error-no-internal-ip",
+    "Error responses do not leak internal IPs",
+    "security",
+    false,
+    "basic",
+    async () => {
+      try {
+        const res = await request(backendUrl, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+            ...buildHeaders()
+          },
+          body: JSON.stringify({ jsonrpc: "2.0", id: nextId(), method: "___trigger_error___" }),
+          signal: AbortSignal.timeout(timeout)
+        });
+        const text = await res.body.text();
+        for (const pattern of INTERNAL_IP_PATTERNS) {
+          const match = text.match(pattern);
+          if (match) {
+            return { passed: false, details: `Error response contains internal IP: ${match[0]}` };
+          }
+        }
+        return { passed: true, details: "No internal IP addresses found in error responses" };
+      } catch {
+        return { passed: true, details: "No response to check (connection error)" };
+      }
+    }
+  );
+  await test(
+    "security-rate-limiting",
+    "Rate limiting is enforced",
+    "security",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      const burstSize = 50;
+      let got429 = false;
+      const promises = Array.from(
+        { length: burstSize },
+        () => mcpRequest(backendUrl, "ping", void 0, nextId, buildHeaders(), timeout).then((res) => {
+          if (res.statusCode === 429) got429 = true;
+          return res.statusCode;
+        }).catch(() => 0)
+      );
+      const statusCodes = await Promise.all(promises);
+      if (got429) {
+        return { passed: true, details: `Rate limiting detected (429 returned after ${burstSize} rapid requests)` };
+      }
+      const errorCount = statusCodes.filter((c) => c >= 500).length;
+      if (errorCount > burstSize / 2) {
+        return {
+          passed: false,
+          details: `Server returned ${errorCount}/${burstSize} 5xx errors under load \u2014 should return 429 instead of crashing`
+        };
+      }
+      return {
+        passed: false,
+        details: `No rate limiting detected (${burstSize} rapid requests all returned ${[...new Set(statusCodes)].join(",")})`
+      };
+    }
+  );
   await test(
     "transport-delete",
     "DELETE accepted or returns 405",