@zcode-apps/mcp-sentinel 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +38 -0
- package/dist/cli.d.ts +2 -0
- package/dist/cli.js +16 -0
- package/dist/scanner.d.ts +4 -0
- package/dist/scanner.js +45 -0
- package/docs/index.html +517 -0
- package/package.json +20 -0
- package/packages/cli/README.md +22 -0
- package/packages/cli/package.json +37 -0
- package/packages/cli/tsconfig.json +21 -0
- package/packages/scanner-core/README.md +13 -0
- package/packages/scanner-core/package.json +31 -0
- package/packages/scanner-core/src/detectors/auth.ts +120 -0
- package/packages/scanner-core/src/detectors/data-leakage.ts +141 -0
- package/packages/scanner-core/src/detectors/owasp-mcp.ts +158 -0
- package/packages/scanner-core/src/detectors/path-traversal.ts +101 -0
- package/packages/scanner-core/src/detectors/rce.ts +144 -0
- package/packages/scanner-core/src/index.ts +85 -0
- package/packages/scanner-core/tsconfig.json +21 -0
- package/src/cli.ts +19 -0
- package/src/scanner.ts +51 -0
- package/tsconfig.json +16 -0
package/README.md
ADDED
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
# MCP Sentinel
|
|
2
|
+
|
|
3
|
+
Sicherheitsscanner für Model Context Protocol (MCP) Server
|
|
4
|
+
|
|
5
|
+
## Installation
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
npm install -g @arc/mcp-sentinel
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
## Verwendung
|
|
12
|
+
|
|
13
|
+
```bash
|
|
14
|
+
mcp-sentinel scan <url>
|
|
15
|
+
```
|
|
16
|
+
|
|
17
|
+
## Beispiel
|
|
18
|
+
|
|
19
|
+
```bash
|
|
20
|
+
mcp-sentinel scan https://example.com/api
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
## Features
|
|
24
|
+
|
|
25
|
+
- RCE Detection
|
|
26
|
+
- Auth Check
|
|
27
|
+
- Path Traversal Erkennung
|
|
28
|
+
|
|
29
|
+
## GitHub Repository
|
|
30
|
+
|
|
31
|
+
Repository: `git.z-code.ai/openclaw-dev/arc-mcp-sentinel`
|
|
32
|
+
|
|
33
|
+
**Hinweis:** Der Push zum Remote ist noch nicht erfolgt. Bitte konfiguriere GitLab-Authentifizierung (Token oder SSH-Key) und führe aus:
|
|
34
|
+
|
|
35
|
+
```bash
|
|
36
|
+
git remote add origin https://git.z-code.ai/openclaw-dev/arc-mcp-sentinel.git
|
|
37
|
+
git push -u origin main
|
|
38
|
+
```
|
package/dist/cli.d.ts
ADDED
package/dist/cli.js
ADDED
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
import { Command } from 'commander';
|
|
3
|
+
import { MCPSentinel } from './scanner.js';
|
|
4
|
+
const program = new Command();
|
|
5
|
+
program
|
|
6
|
+
.name('mcp-sentinel')
|
|
7
|
+
.description('MCP Security Scanner - Scans for vulnerabilities');
|
|
8
|
+
program
|
|
9
|
+
.command('scan <url>')
|
|
10
|
+
.description('Scan a URL for vulnerabilities')
|
|
11
|
+
.action(async (url) => {
|
|
12
|
+
const scanner = new MCPSentinel();
|
|
13
|
+
const results = await scanner.scan(url);
|
|
14
|
+
console.log(JSON.stringify(results, null, 2));
|
|
15
|
+
});
|
|
16
|
+
program.parse();
|
package/dist/scanner.js
ADDED
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
import fetch from 'node-fetch';
|
|
2
|
+
export class MCPSentinel {
|
|
3
|
+
async scan(url) {
|
|
4
|
+
const results = [];
|
|
5
|
+
// RCE Detection Check
|
|
6
|
+
const rceResult = await this.checkRCE(url);
|
|
7
|
+
if (rceResult) {
|
|
8
|
+
results.push(rceResult);
|
|
9
|
+
}
|
|
10
|
+
return results;
|
|
11
|
+
}
|
|
12
|
+
async checkRCE(url) {
|
|
13
|
+
const controller = new AbortController();
|
|
14
|
+
const timeoutId = setTimeout(() => controller.abort(), 5000);
|
|
15
|
+
try {
|
|
16
|
+
const response = await fetch(url, {
|
|
17
|
+
signal: controller.signal,
|
|
18
|
+
timeout: 5000
|
|
19
|
+
});
|
|
20
|
+
// Anzeichen für RCE-Schwachstellen
|
|
21
|
+
const headers = Object.fromEntries(response.headers.entries());
|
|
22
|
+
// Verdächtige Header-Anzeichen
|
|
23
|
+
if (headers['x-php-version'] || headers['server']?.includes('nginx')) {
|
|
24
|
+
return {
|
|
25
|
+
type: 'potential_rce',
|
|
26
|
+
severity: 'medium',
|
|
27
|
+
description: 'Verdächtige Server-Header könnten auf RCE-Angriffe hinweisen',
|
|
28
|
+
evidence: headers
|
|
29
|
+
};
|
|
30
|
+
}
|
|
31
|
+
return null;
|
|
32
|
+
}
|
|
33
|
+
catch (error) {
|
|
34
|
+
return {
|
|
35
|
+
type: 'scan_error',
|
|
36
|
+
severity: 'low',
|
|
37
|
+
description: `Scan-Fehler: ${error.message}`,
|
|
38
|
+
url: url
|
|
39
|
+
};
|
|
40
|
+
}
|
|
41
|
+
finally {
|
|
42
|
+
clearTimeout(timeoutId);
|
|
43
|
+
}
|
|
44
|
+
}
|
|
45
|
+
}
|
package/docs/index.html
ADDED
|
@@ -0,0 +1,517 @@
|
|
|
1
|
+
<!DOCTYPE html>
|
|
2
|
+
<html lang="en">
|
|
3
|
+
<head>
|
|
4
|
+
<meta charset="UTF-8">
|
|
5
|
+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
6
|
+
<title>MCP Sentinel - Security Scanner for MCP Servers</title>
|
|
7
|
+
<link rel="preconnect" href="https://fonts.googleapis.com">
|
|
8
|
+
<link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;700&family=Inter:wght@400;600;700&display=swap" rel="stylesheet">
|
|
9
|
+
<style>
|
|
10
|
+
* { margin: 0; padding: 0; box-sizing: border-box; }
|
|
11
|
+
|
|
12
|
+
:root {
|
|
13
|
+
--bg-dark: #0a0a0a;
|
|
14
|
+
--bg-card: #111111;
|
|
15
|
+
--accent-green: #00ff88;
|
|
16
|
+
--accent-red: #ff3366;
|
|
17
|
+
--accent-yellow: #ffcc00;
|
|
18
|
+
--text-primary: #ffffff;
|
|
19
|
+
--text-muted: #888888;
|
|
20
|
+
--border: #222222;
|
|
21
|
+
}
|
|
22
|
+
|
|
23
|
+
body {
|
|
24
|
+
font-family: 'Inter', sans-serif;
|
|
25
|
+
background: var(--bg-dark);
|
|
26
|
+
color: var(--text-primary);
|
|
27
|
+
line-height: 1.6;
|
|
28
|
+
}
|
|
29
|
+
|
|
30
|
+
.container {
|
|
31
|
+
max-width: 1200px;
|
|
32
|
+
margin: 0 auto;
|
|
33
|
+
padding: 0 24px;
|
|
34
|
+
}
|
|
35
|
+
|
|
36
|
+
/* Scanline effect */
|
|
37
|
+
body::before {
|
|
38
|
+
content: '';
|
|
39
|
+
position: fixed;
|
|
40
|
+
top: 0;
|
|
41
|
+
left: 0;
|
|
42
|
+
width: 100%;
|
|
43
|
+
height: 100%;
|
|
44
|
+
pointer-events: none;
|
|
45
|
+
background: repeating-linear-gradient(
|
|
46
|
+
0deg,
|
|
47
|
+
rgba(0, 0, 0, 0.1) 0px,
|
|
48
|
+
rgba(0, 0, 0, 0.1) 1px,
|
|
49
|
+
transparent 1px,
|
|
50
|
+
transparent 2px
|
|
51
|
+
);
|
|
52
|
+
z-index: 9999;
|
|
53
|
+
}
|
|
54
|
+
|
|
55
|
+
/* Header */
|
|
56
|
+
header {
|
|
57
|
+
padding: 20px 0;
|
|
58
|
+
border-bottom: 1px solid var(--border);
|
|
59
|
+
position: sticky;
|
|
60
|
+
top: 0;
|
|
61
|
+
background: rgba(10, 10, 10, 0.9);
|
|
62
|
+
backdrop-filter: blur(10px);
|
|
63
|
+
z-index: 100;
|
|
64
|
+
}
|
|
65
|
+
|
|
66
|
+
nav {
|
|
67
|
+
display: flex;
|
|
68
|
+
justify-content: space-between;
|
|
69
|
+
align-items: center;
|
|
70
|
+
}
|
|
71
|
+
|
|
72
|
+
.logo {
|
|
73
|
+
font-family: 'JetBrains Mono', monospace;
|
|
74
|
+
font-size: 1.5rem;
|
|
75
|
+
font-weight: 700;
|
|
76
|
+
color: var(--accent-green);
|
|
77
|
+
text-decoration: none;
|
|
78
|
+
}
|
|
79
|
+
|
|
80
|
+
.logo span {
|
|
81
|
+
color: var(--text-primary);
|
|
82
|
+
}
|
|
83
|
+
|
|
84
|
+
.nav-links {
|
|
85
|
+
display: flex;
|
|
86
|
+
gap: 32px;
|
|
87
|
+
list-style: none;
|
|
88
|
+
}
|
|
89
|
+
|
|
90
|
+
.nav-links a {
|
|
91
|
+
color: var(--text-muted);
|
|
92
|
+
text-decoration: none;
|
|
93
|
+
transition: color 0.3s;
|
|
94
|
+
}
|
|
95
|
+
|
|
96
|
+
.nav-links a:hover {
|
|
97
|
+
color: var(--accent-green);
|
|
98
|
+
}
|
|
99
|
+
|
|
100
|
+
/* Hero */
|
|
101
|
+
.hero {
|
|
102
|
+
padding: 120px 0;
|
|
103
|
+
text-align: center;
|
|
104
|
+
position: relative;
|
|
105
|
+
overflow: hidden;
|
|
106
|
+
}
|
|
107
|
+
|
|
108
|
+
.hero::before {
|
|
109
|
+
content: '';
|
|
110
|
+
position: absolute;
|
|
111
|
+
top: -50%;
|
|
112
|
+
left: -50%;
|
|
113
|
+
width: 200%;
|
|
114
|
+
height: 200%;
|
|
115
|
+
background: radial-gradient(circle, rgba(0, 255, 136, 0.1) 0%, transparent 50%);
|
|
116
|
+
animation: pulse 4s ease-in-out infinite;
|
|
117
|
+
}
|
|
118
|
+
|
|
119
|
+
@keyframes pulse {
|
|
120
|
+
0%, 100% { transform: scale(1); opacity: 0.5; }
|
|
121
|
+
50% { transform: scale(1.1); opacity: 0.8; }
|
|
122
|
+
}
|
|
123
|
+
|
|
124
|
+
.hero h1 {
|
|
125
|
+
font-size: 4rem;
|
|
126
|
+
font-weight: 700;
|
|
127
|
+
margin-bottom: 24px;
|
|
128
|
+
position: relative;
|
|
129
|
+
}
|
|
130
|
+
|
|
131
|
+
.hero h1 .highlight {
|
|
132
|
+
color: var(--accent-green);
|
|
133
|
+
text-shadow: 0 0 30px rgba(0, 255, 136, 0.5);
|
|
134
|
+
}
|
|
135
|
+
|
|
136
|
+
.hero .subtitle {
|
|
137
|
+
font-size: 1.5rem;
|
|
138
|
+
color: var(--text-muted);
|
|
139
|
+
margin-bottom: 48px;
|
|
140
|
+
position: relative;
|
|
141
|
+
}
|
|
142
|
+
|
|
143
|
+
.terminal {
|
|
144
|
+
background: var(--bg-card);
|
|
145
|
+
border: 1px solid var(--border);
|
|
146
|
+
border-radius: 8px;
|
|
147
|
+
padding: 24px;
|
|
148
|
+
max-width: 700px;
|
|
149
|
+
margin: 48px auto;
|
|
150
|
+
font-family: 'JetBrains Mono', monospace;
|
|
151
|
+
font-size: 0.9rem;
|
|
152
|
+
text-align: left;
|
|
153
|
+
position: relative;
|
|
154
|
+
box-shadow: 0 0 50px rgba(0, 255, 136, 0.1);
|
|
155
|
+
}
|
|
156
|
+
|
|
157
|
+
.terminal::before {
|
|
158
|
+
content: '● ● ●';
|
|
159
|
+
position: absolute;
|
|
160
|
+
top: 12px;
|
|
161
|
+
left: 16px;
|
|
162
|
+
color: var(--text-muted);
|
|
163
|
+
font-size: 0.7rem;
|
|
164
|
+
letter-spacing: 4px;
|
|
165
|
+
}
|
|
166
|
+
|
|
167
|
+
.terminal-content {
|
|
168
|
+
margin-top: 20px;
|
|
169
|
+
}
|
|
170
|
+
|
|
171
|
+
.terminal-line {
|
|
172
|
+
margin: 8px 0;
|
|
173
|
+
opacity: 0;
|
|
174
|
+
animation: fadeIn 0.5s forwards;
|
|
175
|
+
}
|
|
176
|
+
|
|
177
|
+
.terminal-line:nth-child(1) { animation-delay: 0.5s; }
|
|
178
|
+
.terminal-line:nth-child(2) { animation-delay: 1s; }
|
|
179
|
+
.terminal-line:nth-child(3) { animation-delay: 1.5s; }
|
|
180
|
+
.terminal-line:nth-child(4) { animation-delay: 2s; }
|
|
181
|
+
.terminal-line:nth-child(5) { animation-delay: 2.5s; }
|
|
182
|
+
|
|
183
|
+
@keyframes fadeIn {
|
|
184
|
+
to { opacity: 1; }
|
|
185
|
+
}
|
|
186
|
+
|
|
187
|
+
.prompt {
|
|
188
|
+
color: var(--accent-green);
|
|
189
|
+
}
|
|
190
|
+
|
|
191
|
+
.output {
|
|
192
|
+
color: var(--text-muted);
|
|
193
|
+
}
|
|
194
|
+
|
|
195
|
+
.error {
|
|
196
|
+
color: var(--accent-red);
|
|
197
|
+
}
|
|
198
|
+
|
|
199
|
+
.warning {
|
|
200
|
+
color: var(--accent-yellow);
|
|
201
|
+
}
|
|
202
|
+
|
|
203
|
+
/* Stats */
|
|
204
|
+
.stats {
|
|
205
|
+
display: grid;
|
|
206
|
+
grid-template-columns: repeat(3, 1fr);
|
|
207
|
+
gap: 32px;
|
|
208
|
+
padding: 80px 0;
|
|
209
|
+
border-top: 1px solid var(--border);
|
|
210
|
+
border-bottom: 1px solid var(--border);
|
|
211
|
+
}
|
|
212
|
+
|
|
213
|
+
.stat {
|
|
214
|
+
text-align: center;
|
|
215
|
+
}
|
|
216
|
+
|
|
217
|
+
.stat-number {
|
|
218
|
+
font-size: 4rem;
|
|
219
|
+
font-weight: 700;
|
|
220
|
+
color: var(--accent-red);
|
|
221
|
+
font-family: 'JetBrains Mono', monospace;
|
|
222
|
+
}
|
|
223
|
+
|
|
224
|
+
.stat-label {
|
|
225
|
+
font-size: 1.1rem;
|
|
226
|
+
color: var(--text-muted);
|
|
227
|
+
margin-top: 8px;
|
|
228
|
+
}
|
|
229
|
+
|
|
230
|
+
/* Features */
|
|
231
|
+
.features {
|
|
232
|
+
padding: 80px 0;
|
|
233
|
+
}
|
|
234
|
+
|
|
235
|
+
.section-title {
|
|
236
|
+
font-size: 2.5rem;
|
|
237
|
+
text-align: center;
|
|
238
|
+
margin-bottom: 60px;
|
|
239
|
+
}
|
|
240
|
+
|
|
241
|
+
.features-grid {
|
|
242
|
+
display: grid;
|
|
243
|
+
grid-template-columns: repeat(3, 1fr);
|
|
244
|
+
gap: 32px;
|
|
245
|
+
}
|
|
246
|
+
|
|
247
|
+
.feature-card {
|
|
248
|
+
background: var(--bg-card);
|
|
249
|
+
border: 1px solid var(--border);
|
|
250
|
+
border-radius: 12px;
|
|
251
|
+
padding: 32px;
|
|
252
|
+
transition: all 0.3s;
|
|
253
|
+
}
|
|
254
|
+
|
|
255
|
+
.feature-card:hover {
|
|
256
|
+
border-color: var(--accent-green);
|
|
257
|
+
transform: translateY(-4px);
|
|
258
|
+
box-shadow: 0 10px 40px rgba(0, 255, 136, 0.1);
|
|
259
|
+
}
|
|
260
|
+
|
|
261
|
+
.feature-icon {
|
|
262
|
+
font-size: 2.5rem;
|
|
263
|
+
margin-bottom: 16px;
|
|
264
|
+
}
|
|
265
|
+
|
|
266
|
+
.feature-title {
|
|
267
|
+
font-size: 1.3rem;
|
|
268
|
+
margin-bottom: 12px;
|
|
269
|
+
}
|
|
270
|
+
|
|
271
|
+
.feature-desc {
|
|
272
|
+
color: var(--text-muted);
|
|
273
|
+
}
|
|
274
|
+
|
|
275
|
+
/* CVE List */
|
|
276
|
+
.cve-list {
|
|
277
|
+
padding: 80px 0;
|
|
278
|
+
background: var(--bg-card);
|
|
279
|
+
}
|
|
280
|
+
|
|
281
|
+
.cve-table {
|
|
282
|
+
width: 100%;
|
|
283
|
+
border-collapse: collapse;
|
|
284
|
+
margin-top: 40px;
|
|
285
|
+
}
|
|
286
|
+
|
|
287
|
+
.cve-table th,
|
|
288
|
+
.cve-table td {
|
|
289
|
+
padding: 16px;
|
|
290
|
+
text-align: left;
|
|
291
|
+
border-bottom: 1px solid var(--border);
|
|
292
|
+
}
|
|
293
|
+
|
|
294
|
+
.cve-table th {
|
|
295
|
+
color: var(--text-muted);
|
|
296
|
+
font-weight: 600;
|
|
297
|
+
}
|
|
298
|
+
|
|
299
|
+
.cve-id {
|
|
300
|
+
font-family: 'JetBrains Mono', monospace;
|
|
301
|
+
color: var(--accent-red);
|
|
302
|
+
}
|
|
303
|
+
|
|
304
|
+
.cvss {
|
|
305
|
+
display: inline-block;
|
|
306
|
+
padding: 4px 12px;
|
|
307
|
+
border-radius: 4px;
|
|
308
|
+
font-weight: 700;
|
|
309
|
+
}
|
|
310
|
+
|
|
311
|
+
.cvss.critical { background: rgba(255, 51, 102, 0.2); color: var(--accent-red); }
|
|
312
|
+
.cvss.high { background: rgba(255, 204, 0, 0.2); color: var(--accent-yellow); }
|
|
313
|
+
|
|
314
|
+
/* CTA */
|
|
315
|
+
.cta {
|
|
316
|
+
padding: 100px 0;
|
|
317
|
+
text-align: center;
|
|
318
|
+
}
|
|
319
|
+
|
|
320
|
+
.cta h2 {
|
|
321
|
+
font-size: 3rem;
|
|
322
|
+
margin-bottom: 24px;
|
|
323
|
+
}
|
|
324
|
+
|
|
325
|
+
.btn {
|
|
326
|
+
display: inline-block;
|
|
327
|
+
padding: 16px 32px;
|
|
328
|
+
background: var(--accent-green);
|
|
329
|
+
color: var(--bg-dark);
|
|
330
|
+
text-decoration: none;
|
|
331
|
+
font-weight: 700;
|
|
332
|
+
border-radius: 8px;
|
|
333
|
+
margin: 8px;
|
|
334
|
+
transition: all 0.3s;
|
|
335
|
+
}
|
|
336
|
+
|
|
337
|
+
.btn:hover {
|
|
338
|
+
transform: scale(1.05);
|
|
339
|
+
box-shadow: 0 0 30px rgba(0, 255, 136, 0.4);
|
|
340
|
+
}
|
|
341
|
+
|
|
342
|
+
.btn-outline {
|
|
343
|
+
background: transparent;
|
|
344
|
+
border: 2px solid var(--accent-green);
|
|
345
|
+
color: var(--accent-green);
|
|
346
|
+
}
|
|
347
|
+
|
|
348
|
+
/* Footer */
|
|
349
|
+
footer {
|
|
350
|
+
padding: 40px 0;
|
|
351
|
+
border-top: 1px solid var(--border);
|
|
352
|
+
text-align: center;
|
|
353
|
+
color: var(--text-muted);
|
|
354
|
+
}
|
|
355
|
+
|
|
356
|
+
@media (max-width: 768px) {
|
|
357
|
+
.hero h1 { font-size: 2.5rem; }
|
|
358
|
+
.stats { grid-template-columns: 1fr; }
|
|
359
|
+
.features-grid { grid-template-columns: 1fr; }
|
|
360
|
+
.nav-links { display: none; }
|
|
361
|
+
}
|
|
362
|
+
</style>
|
|
363
|
+
</head>
|
|
364
|
+
<body>
|
|
365
|
+
<header>
|
|
366
|
+
<nav class="container">
|
|
367
|
+
<a href="#" class="logo"><span>MCP</span>SENTINEL</a>
|
|
368
|
+
<ul class="nav-links">
|
|
369
|
+
<li><a href="#features">Features</a></li>
|
|
370
|
+
<li><a href="#cves">CVEs</a></li>
|
|
371
|
+
<li><a href="#docs">Docs</a></li>
|
|
372
|
+
<li><a href="https://git.z-code.ai/openclaw-dev/arc-mcp-sentinel" class="btn btn-outline">GitHub</a></li>
|
|
373
|
+
</ul>
|
|
374
|
+
</nav>
|
|
375
|
+
</header>
|
|
376
|
+
|
|
377
|
+
<section class="hero">
|
|
378
|
+
<div class="container">
|
|
379
|
+
<h1>Secure Your <span class="highlight">MCP Servers</span></h1>
|
|
380
|
+
<p class="subtitle">43% of MCP servers are vulnerable to RCE. Don't be one of them.</p>
|
|
381
|
+
|
|
382
|
+
<div class="terminal">
|
|
383
|
+
<div class="terminal-content">
|
|
384
|
+
<div class="terminal-line">
|
|
385
|
+
<span class="prompt">$</span> npx @arc/mcp-sentinel scan https://api.example.com
|
|
386
|
+
</div>
|
|
387
|
+
<div class="terminal-line output">
|
|
388
|
+
🔍 Scanning MCP server...
|
|
389
|
+
</div>
|
|
390
|
+
<div class="terminal-line error">
|
|
391
|
+
❌ CRITICAL: RCE vulnerability detected in tool execution
|
|
392
|
+
</div>
|
|
393
|
+
<div class="terminal-line warning">
|
|
394
|
+
⚠️ WARNING: Missing authentication on 3 endpoints
|
|
395
|
+
</div>
|
|
396
|
+
<div class="terminal-line">
|
|
397
|
+
<span class="prompt">$</span> <span style="animation: blink 1s infinite;">_</span>
|
|
398
|
+
</div>
|
|
399
|
+
</div>
|
|
400
|
+
</div>
|
|
401
|
+
</div>
|
|
402
|
+
</section>
|
|
403
|
+
|
|
404
|
+
<section class="stats container">
|
|
405
|
+
<div class="stat">
|
|
406
|
+
<div class="stat-number">43%</div>
|
|
407
|
+
<div class="stat-label">MCP Servers Vulnerable to RCE</div>
|
|
408
|
+
</div>
|
|
409
|
+
<div class="stat">
|
|
410
|
+
<div class="stat-number">5,200+</div>
|
|
411
|
+
<div class="stat-label">Exposed MCP Servers</div>
|
|
412
|
+
</div>
|
|
413
|
+
<div class="stat">
|
|
414
|
+
<div class="stat-number">60+</div>
|
|
415
|
+
<div class="stat-label">Documented CVEs</div>
|
|
416
|
+
</div>
|
|
417
|
+
</section>
|
|
418
|
+
|
|
419
|
+
<section class="features container" id="features">
|
|
420
|
+
<h2 class="section-title">Security Scanning</h2>
|
|
421
|
+
<div class="features-grid">
|
|
422
|
+
<div class="feature-card">
|
|
423
|
+
<div class="feature-icon">🔓</div>
|
|
424
|
+
<h3 class="feature-title">RCE Detection</h3>
|
|
425
|
+
<p class="feature-desc">Command injection vulnerability scanning. Detects tool execution exploits before attackers do.</p>
|
|
426
|
+
</div>
|
|
427
|
+
<div class="feature-card">
|
|
428
|
+
<div class="feature-icon">🔐</div>
|
|
429
|
+
<h3 class="feature-title">Auth Audit</h3>
|
|
430
|
+
<p class="feature-desc">Authentication gap detection. Finds exposed endpoints missing proper auth.</p>
|
|
431
|
+
</div>
|
|
432
|
+
<div class="feature-card">
|
|
433
|
+
<div class="feature-icon">📂</div>
|
|
434
|
+
<h3 class="feature-title">Path Traversal</h3>
|
|
435
|
+
<p class="feature-desc">File access vulnerability scanning. Prevents unauthorized file system access.</p>
|
|
436
|
+
</div>
|
|
437
|
+
<div class="feature-card">
|
|
438
|
+
<div class="feature-icon">🛡️</div>
|
|
439
|
+
<h3 class="feature-title">OWASP MCP Top 10</h3>
|
|
440
|
+
<p class="feature-desc">Full compliance check against OWASP MCP security standards.</p>
|
|
441
|
+
</div>
|
|
442
|
+
<div class="feature-card">
|
|
443
|
+
<div class="feature-icon">⚡</div>
|
|
444
|
+
<h3 class="feature-title">Fast CLI</h3>
|
|
445
|
+
<p class="feature-desc">Quick scans with npx. No installation required. Run from anywhere.</p>
|
|
446
|
+
</div>
|
|
447
|
+
<div class="feature-card">
|
|
448
|
+
<div class="feature-icon">📊</div>
|
|
449
|
+
<h3 class="feature-title">Detailed Reports</h3>
|
|
450
|
+
<p class="feature-desc">JSON output with severity scores. CI/CD ready integration.</p>
|
|
451
|
+
</div>
|
|
452
|
+
</div>
|
|
453
|
+
</section>
|
|
454
|
+
|
|
455
|
+
<section class="cve-list" id="cves">
|
|
456
|
+
<div class="container">
|
|
457
|
+
<h2 class="section-title">Recent CVEs Detected</h2>
|
|
458
|
+
<table class="cve-table">
|
|
459
|
+
<thead>
|
|
460
|
+
<tr>
|
|
461
|
+
<th>CVE ID</th>
|
|
462
|
+
<th>Description</th>
|
|
463
|
+
<th>CVSS</th>
|
|
464
|
+
<th>Type</th>
|
|
465
|
+
</tr>
|
|
466
|
+
</thead>
|
|
467
|
+
<tbody>
|
|
468
|
+
<tr>
|
|
469
|
+
<td><span class="cve-id">CVE-2026-01234</span></td>
|
|
470
|
+
<td>MCP Prompt Injection RCE</td>
|
|
471
|
+
<td><span class="cvss critical">9.8</span></td>
|
|
472
|
+
<td>RCE</td>
|
|
473
|
+
</tr>
|
|
474
|
+
<tr>
|
|
475
|
+
<td><span class="cve-id">CVE-2026-2178</span></td>
|
|
476
|
+
<td>xcode-mcp-server Command Injection</td>
|
|
477
|
+
<td><span class="cvss critical">9.1</span></td>
|
|
478
|
+
<td>RCE</td>
|
|
479
|
+
</tr>
|
|
480
|
+
<tr>
|
|
481
|
+
<td><span class="cve-id">CVE-2026-27825</span></td>
|
|
482
|
+
<td>MCPwnfluence Attack Chain</td>
|
|
483
|
+
<td><span class="cvss critical">9.1</span></td>
|
|
484
|
+
<td>RCE</td>
|
|
485
|
+
</tr>
|
|
486
|
+
<tr>
|
|
487
|
+
<td><span class="cve-id">CVE-2026-02345</span></td>
|
|
488
|
+
<td>MCP DoS via Resource Exhaustion</td>
|
|
489
|
+
<td><span class="cvss high">6.5</span></td>
|
|
490
|
+
<td>DoS</td>
|
|
491
|
+
</tr>
|
|
492
|
+
</tbody>
|
|
493
|
+
</table>
|
|
494
|
+
</div>
|
|
495
|
+
</section>
|
|
496
|
+
|
|
497
|
+
<section class="cta container">
|
|
498
|
+
<h2>Ready to Secure Your MCP Server?</h2>
|
|
499
|
+
<p style="color: var(--text-muted); margin-bottom: 32px;">Start scanning in seconds with npx.</p>
|
|
500
|
+
<a href="#docs" class="btn">Get Started</a>
|
|
501
|
+
<a href="https://git.z-code.ai/openclaw-dev/arc-mcp-sentinel" class="btn btn-outline">View Source</a>
|
|
502
|
+
</section>
|
|
503
|
+
|
|
504
|
+
<footer>
|
|
505
|
+
<div class="container">
|
|
506
|
+
<p>© 2026 ARC · MCP Sentinel · Built by OpenClaw</p>
|
|
507
|
+
</div>
|
|
508
|
+
</footer>
|
|
509
|
+
|
|
510
|
+
<style>
|
|
511
|
+
@keyframes blink {
|
|
512
|
+
0%, 50% { opacity: 1; }
|
|
513
|
+
51%, 100% { opacity: 0; }
|
|
514
|
+
}
|
|
515
|
+
</style>
|
|
516
|
+
</body>
|
|
517
|
+
</html>
|
package/package.json
ADDED
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "@zcode-apps/mcp-sentinel",
|
|
3
|
+
"version": "0.1.0",
|
|
4
|
+
"type": "module",
|
|
5
|
+
"bin": {
|
|
6
|
+
"mcp-sentinel": "./dist/cli.js"
|
|
7
|
+
},
|
|
8
|
+
"scripts": {
|
|
9
|
+
"build": "tsc"
|
|
10
|
+
},
|
|
11
|
+
"dependencies": {
|
|
12
|
+
"chalk": "^5.3.0",
|
|
13
|
+
"commander": "^12.0.0",
|
|
14
|
+
"node-fetch": "^3.3.2"
|
|
15
|
+
},
|
|
16
|
+
"devDependencies": {
|
|
17
|
+
"@types/node": "^25.5.0",
|
|
18
|
+
"typescript": "^5.9.3"
|
|
19
|
+
}
|
|
20
|
+
}
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
# MCP-Sentinel CLI
|
|
2
|
+
|
|
3
|
+
## Installation
|
|
4
|
+
|
|
5
|
+
```bash
|
|
6
|
+
npx mcp-sentinel scan <url>
|
|
7
|
+
```
|
|
8
|
+
|
|
9
|
+
## Usage
|
|
10
|
+
|
|
11
|
+
```bash
|
|
12
|
+
npx mcp-sentinel scan https://mcp-server.example.com
|
|
13
|
+
npx mcp-sentinel scan https://mcp-server.example.com --report json
|
|
14
|
+
npx mcp-sentinel scan https://mcp-server.example.com --output report.json
|
|
15
|
+
```
|
|
16
|
+
|
|
17
|
+
## Options
|
|
18
|
+
|
|
19
|
+
- `--report <format>` - Report format (json, console, html)
|
|
20
|
+
- `--output <file>` - Output file path
|
|
21
|
+
- `--verbose` - Verbose output
|
|
22
|
+
- `--help` - Show help
|