agent-security-scanner-mcp 3.14.0 → 3.16.0

package/analyzer.py

@@ -12,6 +12,7 @@ import warnings
 
 # Suppress regex deprecation warnings for patterns with inline flags
 warnings.filterwarnings('ignore', category=DeprecationWarning)
+import fnmatch
 import json
 import os
 import re
@@ -70,12 +71,54 @@ def detect_language(file_path):
     return EXTENSION_MAP.get(ext, 'generic')
 
 
+def _matches_path_filter(file_path, rule):
+    """Check if file_path matches a rule's paths.include/exclude filter.
+
+    Returns True if the rule should be applied to this file.
+    Rules without paths metadata apply to all files.
+    """
+    paths = rule.metadata.get('paths') if hasattr(rule, 'metadata') else None
+    if not paths or not isinstance(paths, dict):
+        return True
+
+    basename = os.path.basename(file_path)
+
+    # If include patterns exist, file must match at least one
+    include = paths.get('include')
+    if include and isinstance(include, list):
+        if not any(fnmatch.fnmatch(basename, p) or fnmatch.fnmatch(file_path, p) for p in include):
+            return False
+
+    # If exclude patterns exist, file must NOT match any
+    exclude = paths.get('exclude')
+    if exclude and isinstance(exclude, list):
+        if any(fnmatch.fnmatch(basename, p) or fnmatch.fnmatch(file_path, p) for p in exclude):
+            return False
+
+    return True
+
+
 def analyze_file_regex(file_path):
     """Original regex-based analysis (fallback when tree-sitter unavailable)."""
     issues = []
     try:
         language = detect_language(file_path)
-        rules = get_rules_for_language(language)
+        all_rules = get_rules_for_language(language)
+        # Filter out rules whose paths.include/exclude don't match this file
+        rules = {}
+        basename = os.path.basename(file_path)
+        for rid, r in all_rules.items():
+            rule_paths = r.get('metadata', {}).get('paths')
+            if rule_paths and isinstance(rule_paths, dict):
+                include = rule_paths.get('include')
+                if include and isinstance(include, list):
+                    if not any(fnmatch.fnmatch(basename, p) or fnmatch.fnmatch(file_path, p) for p in include):
+                        continue
+                exclude = rule_paths.get('exclude')
+                if exclude and isinstance(exclude, list):
+                    if any(fnmatch.fnmatch(basename, p) or fnmatch.fnmatch(file_path, p) for p in exclude):
+                        continue
+            rules[rid] = r
         print(f"[REGEX] Language: {language}, rules loaded: {len(rules)}", file=sys.stderr)
         with open(file_path, 'r', encoding='utf-8') as f:
             lines = f.readlines()
@@ -170,6 +213,7 @@ def analyze_file_ast(file_path):
             if (parse_result.language in r.languages or 'generic' in r.languages)
             and r.metadata.get('category', 'unknown') in SECURITY_CATEGORIES
             and r.id not in NOISY_RULES
+            and _matches_path_filter(file_path, r)
         ]
 
         findings = engine.apply_rules(applicable_rules, ast)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-security-scanner-mcp",
-  "version": "3.14.0",
+  "version": "3.16.0",
   "mcpName": "io.github.sinewaveai/agent-security-scanner-mcp",
   "description": "Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix. For Claude Code, Cursor, Windsurf, Cline, OpenClaw.",
   "main": "index.js",
@@ -64,7 +64,7 @@
     "type": "git",
     "url": "git+https://github.com/sinewaveai/agent-security-scanner-mcp.git"
   },
-  "homepage": "https://github.com/sinewaveai/agent-security-scanner-mcp#readme",
+  "homepage": "https://www.proof-layer.com/",
   "bugs": {
     "url": "https://github.com/sinewaveai/agent-security-scanner-mcp/issues"
   },

package/rules/__init__.py

@@ -109,6 +109,12 @@ def load_yaml_rules():
                         if not extracted:
                             continue
 
+                        metadata = rule.get('metadata', {})
+                        # Preserve paths.include/exclude for file-level filtering
+                        paths = rule.get('paths')
+                        if paths and isinstance(paths, dict):
+                            metadata['paths'] = paths
+
                         rules[rule_id] = {
                             'id': rule_id,
                             'name': rule_id.split('.')[-1].replace('-', ' ').title(),
@@ -116,7 +122,7 @@ def load_yaml_rules():
                             'message': rule.get('message', ''),
                             'severity': rule.get('severity', 'WARNING').lower(),
                             'languages': rule.get('languages', ['generic']),
-                            'metadata': rule.get('metadata', {})
+                            'metadata': metadata
                         }
             except Exception as e:
                 print(f"Error loading {filepath}: {e}")

package/semgrep_loader.py

@@ -252,7 +252,12 @@ class SemgrepRuleLoader:
             languages.append('generic')
 
         metadata = rule_data.get('metadata', {})
-        
+
+        # Preserve paths.include/exclude for file-level filtering
+        paths = rule_data.get('paths')
+        if paths and isinstance(paths, dict):
+            metadata['paths'] = paths
+
         # Convert Semgrep patterns to our AST patterns
         patterns = self._extract_patterns(rule_data)
         pattern_nots = self._extract_pattern_nots(rule_data)

package/src/tools/scan-mcp.js

@@ -21,6 +21,17 @@ const MANIFEST_INJECTION_PHRASES = /ignore\s+previous|exfiltrat|override\s+.*ins
 const MANIFEST_ZERO_WIDTH = /[\u200B\u200C\u200D\uFEFF\u2060]/;
 const MANIFEST_BIDI = /[\u202A-\u202E\u2066-\u2069\u200E\u200F\u061C]/;
 
+// Suspicious default values in inputSchema (shell commands, URLs, injection phrases)
+const SUSPICIOUS_DEFAULT = /\b(curl|wget|nc|bash|sh|powershell|cmd)\b.*[|>]|https?:\/\/[^\s'"]+|ignore\s+previous|exfiltrat|override\s+.*instruction|do\s+not\s+tell|hidden\s+instruction|bypass\s+.*filter/i;
+
+// URL patterns for tool description scanning
+const URL_IN_DESCRIPTION = /https?:\/\/[^\s'"<>]+/gi;
+const SAFE_URL_DOMAINS = /^https?:\/\/(github\.com|npmjs\.com|pypi\.org|docs\.|api\.)/i;
+const TUNNELING_URL = /https?:\/\/[^\s'"]*\b(ngrok|serveo|localtunnel|localhost|127\.0\.0\.1|webhook\.site|requestbin|pipedream|interact\.sh|burp|oast)\b/i;
+
+// Cross-tool priority/exclusivity patterns
+const PRIORITY_PATTERNS = /\b(before\s+calling\s+any\s+other\s+tool|do\s+not\s+use\s+any\s+other\s+tool|replaces?\s+the\s+function\s+of|must\s+be\s+(called|used|run|invoked)\s+(first|before)|always\s+(call|use|run|invoke)\s+this\s+(first|before)|instead\s+of\s+(using|calling))\b/i;
+
 // Directories to skip when walking
 const SKIP_DIRS = new Set([
   'node_modules', '.git', 'dist', 'build', '__pycache__',
@@ -567,6 +578,14 @@ function generateRecommendations(findings) {
     recommendations.push('Tool schema changed since baseline. Run with update_baseline:true only after manually verifying all changes. Rug pull attacks modify tool behavior after initial user approval (Adversa TOP25 #6).');
   }
 
+  if (categories.has('schema-manipulation')) {
+    recommendations.push('Inspect all inputSchema property descriptions, defaults, and enum values for hidden instructions. Attackers embed injection in schema metadata that reaches the LLM but is invisible to users.');
+  }
+
+  if (categories.has('cross-tool-manipulation')) {
+    recommendations.push('Tool descriptions must not direct the LLM to invoke other tools or claim execution priority. This is a cross-tool manipulation attack that can chain tool calls without user consent.');
+  }
+
   if (recommendations.length === 0) {
     recommendations.push('No critical issues found. Continue following security best practices.');
   }
@@ -744,6 +763,139 @@ function checkRugPull(manifestPath, serverDir) {
   return findings;
 }
 
+// ============================================================
+// Schema-level inspection (Task 1)
+// ============================================================
+
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function checkSchemaManipulation(tool, manifestPath) {
+  const findings = [];
+  const name = tool.name || '';
+  const schema = tool.inputSchema;
+  if (!schema || typeof schema !== 'object') return findings;
+
+  const properties = schema.properties || {};
+
+  // Flag additionalProperties: true with no defined properties
+  if (schema.additionalProperties === true && Object.keys(properties).length === 0) {
+    findings.push({
+      rule: 'mcp.schema-open-additionalProperties',
+      severity: 'WARNING',
+      category: 'schema-manipulation',
+      message: `Tool "${name}" has additionalProperties:true with no defined properties — accepts arbitrary hidden parameters.`,
+      file: manifestPath,
+      line: 1,
+      match: name
+    });
+  }
+
+  // Walk each property
+  for (const [propName, propDef] of Object.entries(properties)) {
+    if (!propDef || typeof propDef !== 'object') continue;
+
+    const desc = propDef.description || '';
+    const defaultVal = propDef.default !== undefined ? String(propDef.default) : '';
+    const enumValues = Array.isArray(propDef.enum) ? propDef.enum.map(String) : [];
+
+    // Check description for injection phrases or hidden chars
+    if (desc && (MANIFEST_INJECTION_PHRASES.test(desc) || MANIFEST_ZERO_WIDTH.test(desc) || MANIFEST_BIDI.test(desc))) {
+      findings.push({
+        rule: 'mcp.schema-description-injection',
+        severity: 'ERROR',
+        category: 'schema-manipulation',
+        message: `Tool "${name}" property "${propName}" description contains injection language or hidden characters.`,
+        file: manifestPath,
+        line: 1,
+        match: desc.substring(0, 100)
+      });
+    }
+
+    // Check default for suspicious content
+    if (defaultVal && SUSPICIOUS_DEFAULT.test(defaultVal)) {
+      findings.push({
+        rule: 'mcp.schema-suspicious-default',
+        severity: 'ERROR',
+        category: 'schema-manipulation',
+        message: `Tool "${name}" property "${propName}" has a suspicious default value containing shell commands, URLs, or injection patterns.`,
+        file: manifestPath,
+        line: 1,
+        match: defaultVal.substring(0, 100)
+      });
+    }
+
+    // Check enum values for injection/suspicious content
+    for (const val of enumValues) {
+      if (MANIFEST_INJECTION_PHRASES.test(val) || SUSPICIOUS_DEFAULT.test(val)) {
+        findings.push({
+          rule: 'mcp.schema-suspicious-default',
+          severity: 'ERROR',
+          category: 'schema-manipulation',
+          message: `Tool "${name}" property "${propName}" has a suspicious enum value.`,
+          file: manifestPath,
+          line: 1,
+          match: val.substring(0, 100)
+        });
+        break;
+      }
+    }
+  }
+
+  return findings;
+}
+
+// ============================================================
+// Cross-tool manipulation detection (Task 2)
+// ============================================================
+
+function checkCrossToolManipulation(tools, manifestPath) {
+  const findings = [];
+  const toolNames = new Set(tools.map(t => (t.name || '').toLowerCase()).filter(Boolean));
+
+  for (const tool of tools) {
+    const name = tool.name || '';
+    const description = tool.description || '';
+    if (!description) continue;
+
+    // Check for cross-tool reference with action directives
+    for (const otherName of toolNames) {
+      if (otherName === name.toLowerCase()) continue;
+      const escaped = escapeRegex(otherName);
+      const refPattern1 = new RegExp(`\\b(before\\s+using|always\\s+(call|use|run|invoke)|after\\s+calling|instead\\s+of)\\s+\\w*${escaped}\\b`, 'i');
+      const refPattern2 = new RegExp(`\\b(call|use|invoke|run|execute|trigger)\\s+\\w*${escaped}\\b.*\\b(first|before|always)\\b`, 'i');
+      if (refPattern1.test(description) || refPattern2.test(description)) {
+        findings.push({
+          rule: 'mcp.cross-tool-reference',
+          severity: 'ERROR',
+          category: 'cross-tool-manipulation',
+          message: `Tool "${name}" description contains action directive referencing tool "${otherName}". This may be a cross-tool manipulation attack.`,
+          file: manifestPath,
+          line: 1,
+          match: description.substring(0, 100)
+        });
+        break;
+      }
+    }
+
+    // Check for generic priority/exclusivity patterns
+    if (PRIORITY_PATTERNS.test(description)) {
+      findings.push({
+        rule: 'mcp.cross-tool-priority-override',
+        severity: 'ERROR',
+        category: 'cross-tool-manipulation',
+        message: `Tool "${name}" description demands execution priority or exclusivity over other tools.`,
+        file: manifestPath,
+        line: 1,
+        match: description.substring(0, 100)
+      });
+    }
+  }
+
+  return findings;
+}
+
 // ============================================================
 // Manifest scanning (server.json)
 // ============================================================
@@ -793,6 +945,40 @@ function scanManifest(manifestPath) {
     if (description.length > 500) {
       findings.push({ rule: 'mcp.manifest-description-too-long', severity: 'WARNING', category: 'description-injection', message: `Tool "${name}" description is ${description.length} chars — unusually long descriptions often contain hidden instructions.`, file: manifestPath, line: 1, match: description.substring(0, 100) });
     }
+
+    // Schema-level inspection (Task 1)
+    findings.push(...checkSchemaManipulation(tool, manifestPath));
+
+    // URL detection in descriptions (Task 4)
+    const urls = description.match(URL_IN_DESCRIPTION);
+    if (urls) {
+      for (const url of urls) {
+        if (TUNNELING_URL.test(url)) {
+          findings.push({ rule: 'mcp.description-tunneling-url', severity: 'ERROR', category: 'description-injection', message: `Tool "${name}" description contains a dev/tunneling URL. No legitimate production tool should reference tunneling services.`, file: manifestPath, line: 1, match: url.substring(0, 100) });
+        } else if (!SAFE_URL_DOMAINS.test(url)) {
+          findings.push({ rule: 'mcp.description-suspicious-url', severity: 'WARNING', category: 'description-injection', message: `Tool "${name}" description contains an external URL that the LLM might follow.`, file: manifestPath, line: 1, match: url.substring(0, 100) });
+        }
+      }
+    }
+  }
+
+  // Cross-tool manipulation detection (Task 2)
+  findings.push(...checkCrossToolManipulation(tools, manifestPath));
+
+  // Z-score anomaly detection for description length (Task 3)
+  if (tools.length >= 5) {
+    const lengths = tools.map(t => (t.description || '').length);
+    const mean = lengths.reduce((a, b) => a + b, 0) / lengths.length;
+    const stddev = Math.sqrt(lengths.reduce((sum, l) => sum + (l - mean) ** 2, 0) / lengths.length);
+    if (stddev > 0) {
+      for (const tool of tools) {
+        const len = (tool.description || '').length;
+        const zScore = (len - mean) / stddev;
+        if (zScore > 2.5) {
+          findings.push({ rule: 'mcp.description-length-anomaly', severity: 'WARNING', category: 'description-injection', message: `Tool "${tool.name}" description length (${len} chars) is a statistical outlier (z-score: ${zScore.toFixed(1)}) compared to other tools. May hide injected instructions.`, file: manifestPath, line: 1, match: (tool.description || '').substring(0, 100) });
+        }
+      }
+    }
   }
 
   return findings;

package/src/tools/scan-prompt.js

@@ -622,6 +622,55 @@ export async function scanAgentPrompt({ prompt_text, context, verbosity }) {
               }
             }
           }
+
+          // 2.8b: Nested base64 detection (double encoding)
+          const innerB64Matches = decoded.match(base64Regex);
+          if (innerB64Matches) {
+            for (const innerB64 of innerB64Matches) {
+              try {
+                const innerDecoded = Buffer.from(innerB64, 'base64').toString('utf-8');
+                const innerPrintable = innerDecoded.split('').filter(c => c.charCodeAt(0) >= 32 && c.charCodeAt(0) <= 126).length;
+                if (innerPrintable / innerDecoded.length > 0.5) {
+                  findings.push({
+                    rule_id: 'nested-base64',
+                    category: 'obfuscation',
+                    severity: 'ERROR',
+                    message: 'Nested base64 encoding detected — double encoding is a strong indicator of intentional obfuscation.',
+                    matched_text: innerDecoded.substring(0, 100),
+                    confidence: 'HIGH',
+                    risk_score: '85',
+                    action: 'BLOCK'
+                  });
+                  // Re-scan doubly-decoded text
+                  for (const rule of allRules) {
+                    for (const pattern of rule.patterns) {
+                      try {
+                        const regex = new RegExp(pattern, 'i');
+                        const match = innerDecoded.match(regex);
+                        if (match) {
+                          findings.push({
+                            rule_id: rule.id + '.nested-base64-decoded',
+                            category: rule.metadata.category || 'unknown',
+                            severity: rule.severity,
+                            message: rule.message + ' (detected in nested base64-decoded content)',
+                            matched_text: match[0].substring(0, 100),
+                            confidence: 'HIGH',
+                            risk_score: rule.metadata.risk_score || '50',
+                            action: rule.metadata.action || 'BLOCK'
+                          });
+                          break;
+                        }
+                      } catch (e) {
+                        // Skip invalid regex
+                      }
+                    }
+                  }
+                }
+              } catch (e) {
+                // Skip invalid inner base64
+              }
+            }
+          }
         }
       } catch (e) {
         // Skip invalid base64