agent-security-scanner-mcp 3.0.0 → 3.2.0

package/src/tools/check-package.js

@@ -0,0 +1,169 @@
+import { z } from "zod";
+import { readFileSync, existsSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+import bloomFilters from "bloom-filters";
+const { BloomFilter } = bloomFilters;
+
+// Handle both ESM and CJS bundling (Smithery bundles to CJS)
+let __dirname;
+try {
+  __dirname = dirname(fileURLToPath(import.meta.url));
+} catch {
+  __dirname = process.cwd();
+}
+
+// Load legitimate package lists into memory (hash sets for O(1) lookup)
+const LEGITIMATE_PACKAGES = {
+  dart: new Set(),
+  perl: new Set(),
+  raku: new Set(),
+  npm: new Set(),
+  pypi: new Set(),
+  rubygems: new Set(),
+  crates: new Set()
+};
+
+// Bloom filters for large package lists (memory-efficient probabilistic lookup)
+const BLOOM_FILTERS = {
+  npm: null,
+  pypi: null,
+  rubygems: null
+};
+
+// Load package lists on startup
+export function loadPackageLists() {
+  const packagesDir = join(__dirname, '..', '..', 'packages');
+
+  for (const ecosystem of Object.keys(LEGITIMATE_PACKAGES)) {
+    const filePath = join(packagesDir, `${ecosystem}.txt`);
+    try {
+      if (existsSync(filePath)) {
+        const content = readFileSync(filePath, 'utf-8');
+        const packages = content.split('\n').filter(p => p.trim());
+        LEGITIMATE_PACKAGES[ecosystem] = new Set(packages);
+        console.error(`Loaded ${packages.length} ${ecosystem} packages`);
+      }
+    } catch (error) {
+      console.error(`Warning: Could not load ${ecosystem} packages: ${error.message}`);
+    }
+  }
+
+  // Load bloom filters for large ecosystems (npm, pypi, rubygems)
+  for (const ecosystem of Object.keys(BLOOM_FILTERS)) {
+    const bloomPath = join(packagesDir, `${ecosystem}-bloom.json`);
+    try {
+      if (existsSync(bloomPath)) {
+        const bloomData = JSON.parse(readFileSync(bloomPath, 'utf-8'));
+        BLOOM_FILTERS[ecosystem] = BloomFilter.fromJSON(bloomData);
+        console.error(`Loaded ${ecosystem} bloom filter (${bloomData._size} bits)`);
+      }
+    } catch (error) {
+      console.error(`Warning: Could not load ${ecosystem} bloom filter: ${error.message}`);
+    }
+  }
+}
+
+// Check if a package is hallucinated
+export function isHallucinated(packageName, ecosystem) {
+  const legitPackages = LEGITIMATE_PACKAGES[ecosystem];
+
+  // First check Set-based lookup (exact match)
+  if (legitPackages && legitPackages.size > 0) {
+    return { hallucinated: !legitPackages.has(packageName) };
+  }
+
+  // Fall back to bloom filter for large ecosystems (npm, pypi, rubygems)
+  const bloomFilter = BLOOM_FILTERS[ecosystem];
+  if (bloomFilter) {
+    // Bloom filter: false = definitely not in set, true = probably in set
+    const mightExist = bloomFilter.has(packageName);
+    return {
+      hallucinated: !mightExist,
+      bloomFilter: true,
+      note: mightExist ? "Package likely exists (bloom filter match)" : "Package not found in bloom filter"
+    };
+  }
+
+  return { unknown: true, reason: `No package list loaded for ${ecosystem}` };
+}
+
+// Get total packages count for an ecosystem
+export function getTotalPackages(ecosystem) {
+  return LEGITIMATE_PACKAGES[ecosystem]?.size || 0;
+}
+
+// Get all package stats
+export function getPackageStats() {
+  const stats = Object.entries(LEGITIMATE_PACKAGES).map(([ecosystem, packages]) => {
+    const bloomFilter = BLOOM_FILTERS[ecosystem];
+    const setSize = packages.size;
+    const hasBloom = !!bloomFilter;
+    return {
+      ecosystem,
+      packages_loaded: setSize,
+      bloom_filter_loaded: hasBloom,
+      status: setSize > 0 ? 'ready' : hasBloom ? 'ready (bloom filter)' : 'not loaded'
+    };
+  });
+
+  const totalSet = stats.reduce((sum, s) => sum + s.packages_loaded, 0);
+  const bloomEcosystems = stats.filter(s => s.bloom_filter_loaded).map(s => s.ecosystem);
+
+  return {
+    package_lists: stats,
+    total_packages: totalSet,
+    bloom_filter_ecosystems: bloomEcosystems,
+    note: bloomEcosystems.length > 0
+      ? `Bloom filters provide coverage for: ${bloomEcosystems.join(', ')} (not counted in total_packages)`
+      : undefined
+  };
+}
+
+// Schema for check_package tool
+export const checkPackageSchema = {
+  package_name: z.string().describe("The package name to verify"),
+  ecosystem: z.enum(["dart", "perl", "raku", "npm", "pypi", "rubygems", "crates"]).describe("The package ecosystem (dart=pub.dev, perl=CPAN, raku=raku.land, npm=npmjs, pypi=PyPI, rubygems=RubyGems, crates=crates.io)")
+};
+
+// Handler for check_package tool
+export async function checkPackage({ package_name, ecosystem }) {
+  const result = isHallucinated(package_name, ecosystem);
+
+  if (result.unknown) {
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          package: package_name,
+          ecosystem,
+          status: "unknown",
+          reason: result.reason,
+          suggestion: "Load package list or verify manually at the package registry"
+        }, null, 2)
+      }]
+    };
+  }
+
+  const exists = !result.hallucinated;
+  const confidence = result.bloomFilter ? "medium" : "high";
+  const totalPackages = getTotalPackages(ecosystem);
+
+  return {
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        package: package_name,
+        ecosystem,
+        legitimate: exists,
+        hallucinated: !exists,
+        confidence,
+        bloom_filter: !!result.bloomFilter,
+        total_known_packages: totalPackages,
+        recommendation: exists
+          ? "Package exists in registry - safe to use"
+          : "⚠️ POTENTIAL HALLUCINATION - Package not found in registry. Verify before using!"
+      }, null, 2)
+    }]
+  };
+}

package/src/tools/fix-security.js

@@ -0,0 +1,115 @@
+// src/tools/fix-security.js
+import { z } from "zod";
+import { existsSync, readFileSync } from "fs";
+import { detectLanguage, runAnalyzer, generateFix } from '../utils.js';
+
+export const fixSecuritySchema = {
+  file_path: z.string().describe("Path to the file to fix"),
+  verbosity: z.enum(['minimal', 'compact', 'full']).optional().describe("Response detail level: 'minimal' (summary only), 'compact' (default), 'full' (includes fixed_content)")
+};
+
+// Verbosity formatters
+function formatFixMinimal(file_path, fixes) {
+  return {
+    file: file_path,
+    fixes_applied: fixes.length,
+    message: fixes.length > 0
+      ? `Applied ${fixes.length} fix(es). Use verbosity='compact' for details.`
+      : "No fixes needed."
+  };
+}
+
+function formatFixCompact(file_path, fixes) {
+  return {
+    file: file_path,
+    fixes_applied: fixes.length,
+    fixes: fixes.map(f => ({
+      line: f.line,
+      rule: f.rule,
+      description: f.description
+    }))
+  };
+}
+
+function formatFixFull(file_path, fixes, fixedContent) {
+  return {
+    file: file_path,
+    fixes_applied: fixes.length,
+    fixes: fixes,
+    fixed_content: fixedContent
+  };
+}
+
+export async function fixSecurity({ file_path, verbosity }) {
+  if (!existsSync(file_path)) {
+    return {
+      content: [{ type: "text", text: JSON.stringify({ error: "File not found" }) }]
+    };
+  }
+
+  const issues = runAnalyzer(file_path);
+
+  if (issues.error || !Array.isArray(issues) || issues.length === 0) {
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          message: issues.error ? "Error scanning file" : "No security issues found",
+          details: issues
+        })
+      }]
+    };
+  }
+
+  // Read and fix the file
+  const content = readFileSync(file_path, 'utf-8');
+  const lines = content.split('\n');
+  const language = detectLanguage(file_path);
+  const fixes = [];
+
+  // Apply fixes (process in reverse order to preserve line numbers)
+  const sortedIssues = [...issues].sort((a, b) => b.line - a.line);
+
+  for (const issue of sortedIssues) {
+    const lineIndex = issue.line;
+    if (lineIndex >= 0 && lineIndex < lines.length) {
+      const originalLine = lines[lineIndex];
+      const fix = generateFix(issue, originalLine, language);
+
+      if (fix.fixed && fix.fixed !== originalLine) {
+        lines[lineIndex] = fix.fixed;
+        fixes.push({
+          line: lineIndex + 1,
+          rule: issue.ruleId,
+          original: originalLine.trim(),
+          fixed: fix.fixed.trim(),
+          description: fix.description
+        });
+      }
+    }
+  }
+
+  // Determine verbosity (default: compact)
+  const level = verbosity || 'compact';
+  const fixedContent = lines.join('\n');
+
+  let result;
+  switch (level) {
+    case 'minimal':
+      result = formatFixMinimal(file_path, fixes);
+      break;
+    case 'full':
+      result = formatFixFull(file_path, fixes, fixedContent);
+      break;
+    case 'compact':
+    default:
+      result = formatFixCompact(file_path, fixes);
+  }
+
+  return {
+    content: [{
+      type: "text",
+      text: JSON.stringify(result, null, 2)
+    }]
+  };
+}

package/src/tools/scan-packages.js

@@ -0,0 +1,154 @@
+import { z } from "zod";
+import { readFileSync, existsSync } from "fs";
+import { isHallucinated, getTotalPackages } from './check-package.js';
+
+// Package import patterns by ecosystem
+const IMPORT_PATTERNS = {
+  dart: [
+    /import\s+['"]package:([^\/'"]+)/g,
+    /dependencies:\s*\n(?:\s+(\w+):\s*[\^~]?[\d.]+\n)+/g
+  ],
+  perl: [
+    /use\s+([\w:]+)/g,
+    /require\s+([\w:]+)/g
+  ],
+  raku: [
+    /use\s+([\w:]+)/g,
+    /need\s+([\w:]+)/g
+  ],
+  npm: [
+    /require\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+    /from\s+['"]([^'"]+)['"]/g,
+    /import\s+['"]([^'"]+)['"]/g
+  ],
+  pypi: [
+    /^import\s+([\w]+)/gm,
+    /^from\s+([\w]+)/gm
+  ],
+  rubygems: [
+    /require\s+['"]([^'"]+)['"]/g,
+    /gem\s+['"]([^'"]+)['"]/g,
+    /require_relative\s+['"]([^'"]+)['"]/g
+  ],
+  crates: [
+    /use\s+([\w_]+)/g,
+    /extern\s+crate\s+([\w_]+)/g,
+    /^\s*[\w_-]+\s*=/gm  // Cargo.toml dependencies
+  ]
+};
+
+// Extract package names from code
+export function extractPackages(code, ecosystem) {
+  const packages = new Set();
+  const patterns = IMPORT_PATTERNS[ecosystem] || [];
+
+  for (const pattern of patterns) {
+    const regex = new RegExp(pattern.source, pattern.flags);
+    let match;
+    while ((match = regex.exec(code)) !== null) {
+      const pkg = match[1];
+      if (pkg && !pkg.startsWith('.') && !pkg.startsWith('/')) {
+        // Normalize package name (handle scoped packages, subpaths)
+        const basePkg = pkg.split('/')[0].replace(/^@/, '');
+        packages.add(basePkg);
+      }
+    }
+  }
+
+  return Array.from(packages);
+}
+
+// Schema for scan_packages tool
+export const scanPackagesSchema = {
+  file_path: z.string().describe("Path to the file to scan"),
+  ecosystem: z.enum(["dart", "perl", "raku", "npm", "pypi", "rubygems", "crates"]).describe("The package ecosystem (dart=pub.dev, perl=CPAN, raku=raku.land, npm=npmjs, pypi=PyPI, rubygems=RubyGems, crates=crates.io)"),
+  verbosity: z.enum(['minimal', 'compact', 'full']).optional().describe("Response detail level: 'minimal' (counts only), 'compact' (default), 'full' (all details)")
+};
+
+// Handler for scan_packages tool
+export async function scanPackages({ file_path, ecosystem, verbosity }) {
+  if (!existsSync(file_path)) {
+    return {
+      content: [{ type: "text", text: JSON.stringify({ error: "File not found" }) }]
+    };
+  }
+
+  const code = readFileSync(file_path, 'utf-8');
+  const packages = extractPackages(code, ecosystem);
+
+  const results = packages.map(pkg => {
+    const check = isHallucinated(pkg, ecosystem);
+    if (check.unknown) {
+      return { package: pkg, status: "unknown", reason: check.reason };
+    }
+    return {
+      package: pkg,
+      legitimate: !check.hallucinated,
+      hallucinated: check.hallucinated,
+      bloom_filter: !!check.bloomFilter,
+      confidence: check.bloomFilter ? "medium" : "high"
+    };
+  });
+
+  const hallucinated = results.filter(r => r.hallucinated);
+  const legitimate = results.filter(r => r.legitimate);
+  const unknown = results.filter(r => r.status === "unknown");
+  const totalKnown = getTotalPackages(ecosystem);
+
+  // Determine verbosity (default: compact)
+  const level = verbosity || 'compact';
+
+  const recommendation = hallucinated.length > 0
+    ? `Found ${hallucinated.length} potentially hallucinated package(s): ${hallucinated.map(r => r.package).join(', ')}`
+    : unknown.length > 0
+      ? `${unknown.length} package(s) could not be verified (no data available for ${ecosystem})`
+      : "All packages verified as legitimate";
+
+  let result;
+  switch (level) {
+    case 'minimal':
+      result = {
+        file: file_path,
+        ecosystem,
+        total: packages.length,
+        hallucinated: hallucinated.length,
+        legitimate: legitimate.length,
+        unknown: unknown.length,
+        message: recommendation
+      };
+      break;
+    case 'full':
+      result = {
+        file: file_path,
+        ecosystem,
+        total_packages_found: packages.length,
+        legitimate_count: legitimate.length,
+        hallucinated_count: hallucinated.length,
+        unknown_count: unknown.length,
+        known_packages_in_registry: totalKnown,
+        hallucinated_packages: hallucinated.map(r => r.package),
+        legitimate_packages: legitimate.map(r => r.package),
+        all_results: results,
+        recommendation
+      };
+      break;
+    case 'compact':
+    default:
+      result = {
+        file: file_path,
+        ecosystem,
+        total_packages_found: packages.length,
+        hallucinated_count: hallucinated.length,
+        hallucinated_packages: hallucinated.map(r => r.package),
+        legitimate_count: legitimate.length,
+        recommendation
+      };
+  }
+
+  return {
+    content: [{
+      type: "text",
+      text: JSON.stringify(result, null, 2)
+    }]
+  };
+}