agentseed-mcp 0.3.0

package/server/engine/config.py

@@ -0,0 +1,131 @@
+"""AgentSeed config loading — zero dependencies."""
+
+from __future__ import annotations
+
+import json
+import os
+
+CONFIG_FILENAME = "agentseed.config.json"
+_VALID_SEVERITIES = {"error", "warning", "info"}
+VALID_GROUPS = {"stub_code", "oversold", "fabricated"}
+
+# Every key load_config() understands; anything else is a likely typo and
+# callers should surface a warning (silently ignoring typos = silent no-op).
+KNOWN_CONFIG_KEYS = {
+    "allowlist",
+    "severities",
+    "timeout",
+    "extra_tokens",
+    "suppress_symbols",
+    "sandbox_allowed_prefixes",
+    "sandbox_env",
+    "known_packages",
+}
+
+SANDBOX_ENV_MODES = ("inherit", "scrub")
+
+
+def sandbox_env_mode(config: dict, default: str = "inherit") -> str:
+    """Validated sandbox_env mode from config ("inherit" | "scrub")."""
+    value = config.get("sandbox_env", default)
+    return value if value in SANDBOX_ENV_MODES else default
+
+
+def load_config(explicit_path: str | None = None) -> dict:
+    """Load the effective AgentSeed config (zero dependencies).
+
+    Search order (first hit wins):
+      1. ``explicit_path`` argument
+      2. ``AGENTSEED_CONFIG`` environment variable
+      3. ``${PLUGIN_DATA}/agentseed.config.json``
+      4. ``./agentseed.config.json`` in the current working directory.
+
+    Recognized keys (all optional):
+      allowlist                : list[str] - scan exclusions (replaces DEFAULT_ALLOWLIST)
+      severities               : dict[str, str] - group -> error|warning|info
+      timeout                  : int - default sandbox_run timeout in seconds
+      extra_tokens             : dict[group, list[str]] - extra hallucination words
+      suppress_symbols         : list[str] - names verify_code never flags
+      known_packages           : list[str] - packages check_imports treats as known
+                                    (project-local / trusted third-party), beyond stdlib
+      sandbox_allowed_prefixes : list[str] - executable allowlist for sandbox_run
+                                                 (absent/empty = unrestricted)
+
+    Returns {} when no config file exists or it cannot be parsed.
+    """
+    candidates: list[str] = []
+    if explicit_path:
+        candidates.append(explicit_path)
+    env_path = os.environ.get("AGENTSEED_CONFIG")
+    if env_path:
+        candidates.append(env_path)
+    plugin_data = os.environ.get("PLUGIN_DATA")
+    if plugin_data:
+        candidates.append(os.path.join(plugin_data, CONFIG_FILENAME))
+    candidates.append(CONFIG_FILENAME)
+
+    for path in candidates:
+        if path and os.path.isfile(path):
+            try:
+                with open(path, encoding="utf-8") as fh:
+                    data = json.load(fh)
+                if isinstance(data, dict):
+                    return data
+            except (OSError, ValueError):
+                continue
+    return {}
+
+
+def config_str_list(config: dict, key: str) -> list[str] | None:
+    """Extract a validated string-list value from config, or None."""
+    value = config.get(key)
+    if isinstance(value, list) and all(isinstance(v, str) for v in value):
+        return value
+    return None
+
+
+def config_severities(config: dict) -> dict[str, str] | None:
+    """Extract a validated severities map from config, or None."""
+    value = config.get("severities")
+    if isinstance(value, dict) and all(
+        isinstance(k, str) and isinstance(v, str) and v in _VALID_SEVERITIES
+        for k, v in value.items()
+    ):
+        return value
+    return None
+
+
+def parse_timeout(config: dict, default: int = 30) -> int:
+    """Extract and validate timeout from config dict."""
+    try:
+        return int(config.get("timeout", default))
+    except (TypeError, ValueError):
+        return default
+
+
+def unknown_config_keys(config: dict) -> list[str]:
+    """Keys present in ``config`` that load_config() does not understand.
+
+    A typo'd key is silently ignored by every consumer — surfacing it turns
+    a silent no-op into an actionable warning.
+    """
+    if not isinstance(config, dict):
+        return []
+    return sorted(k for k in config if k not in KNOWN_CONFIG_KEYS)
+
+
+def config_extra_tokens(config: dict) -> dict[str, list[str]] | None:
+    """Validate the extra_tokens mapping {group: [words]}, or None."""
+    value = config.get("extra_tokens")
+    if not isinstance(value, dict):
+        return None
+    out: dict[str, list[str]] = {}
+    for group, words in value.items():
+        if (
+            group in VALID_GROUPS
+            and isinstance(words, list)
+            and all(isinstance(w, str) and w for w in words)
+            and words
+        ):
+            out[group] = words
+    return out or None

package/server/engine/hallucination.py

@@ -0,0 +1,254 @@
+"""AgentSeed hallucination word scanning.
+
+Flags tokens across three signal groups:
+  - stub_code:     stub/mock/fake/placeholder/dummy/todo/...
+  - oversold:      guaranteed/"all tests pass"/"production ready"/...
+  - fabricated:    simulated/invented/fabricated/...
+"""
+
+from __future__ import annotations
+
+import re
+
+from .config import _VALID_SEVERITIES
+
+# ---------------------------------------------------------------------------
+# Hallucination token pools (grouped by signal type).
+# ---------------------------------------------------------------------------
+
+STUB_TOKENS = [
+    "stub",
+    "mock",
+    "fake",
+    "placeholder",
+    "dummy",
+    "todo",
+    "fixme",
+    "xxx",
+    "tbd",
+    "tba",
+    "wip",
+    "not implemented",
+    "coming soon",
+    "to be implemented",
+    "not implemented yet",
+    "pending implementation",
+]
+
+# CJK tokens: \b word boundaries are meaningless between CJK chars, so these
+# are matched as substrings (they are specific enough to stay low-noise).
+STUB_TOKENS_ZH = [
+    "占位",
+    "待实现",
+    "未实现",
+    "待补充",
+    "稍后补",
+    "假数据",
+    "模拟数据",
+    "临时方案",
+    "先这样",
+    "待完成",
+    "尚未实现",
+]
+
+OVERSOLD_TOKENS = [
+    "guaranteed",
+    "definitely works",
+    "all tests pass",
+    "everything works",
+    "fully tested",
+    "production ready",
+    "no bugs",
+    "works perfectly",
+    "should work",
+    "trust me",
+    "works on my machine",
+    "100% correct",
+    "bug free",
+    "zero errors",
+    "foolproof",
+    "bulletproof",
+    "cannot fail",
+    "guaranteed to pass",
+    "impossible to break",
+]
+
+OVERSOLD_TOKENS_ZH = [
+    "保证通过",
+    "绝对没问题",
+    "肯定能跑",
+    "万无一失",
+    "完美运行",
+    "零缺陷",
+    "无需测试",
+    "包过",
+    "绝无问题",
+    "不可能失败",
+    "绝对可靠",
+    "稳过",
+]
+
+FABRICATED_TOKENS = [
+    "simulated",
+    "invented",
+    "fabricated",
+    "fictional",
+    "pretend",
+    "made up",
+    "fictitious",
+    "nonexistent",
+    "non-existent",
+    "mythical",
+]
+
+FABRICATED_TOKENS_ZH = [
+    "虚构",
+    "编造",
+    "凭空捏造",
+    "子虚乌有",
+]
+
+# Full pool: token -> group (kept for backward compatibility).
+HALLUCINATION_WORDS: dict[str, str] = {}
+for _tokens, _group in [
+    (STUB_TOKENS + STUB_TOKENS_ZH, "stub_code"),
+    (OVERSOLD_TOKENS + OVERSOLD_TOKENS_ZH, "oversold"),
+    (FABRICATED_TOKENS + FABRICATED_TOKENS_ZH, "fabricated"),
+]:
+    for _t in _tokens:
+        HALLUCINATION_WORDS[_t] = _group
+
+_GROUP_LABELS = {
+    "stub_code": "placeholder / not-really-done code",
+    "oversold": "unverified confidence claim",
+    "fabricated": "fabricated / invented content",
+}
+
+# Tokens that are legitimate in common testing/idiomatic contexts.
+DEFAULT_ALLOWLIST = [
+    "unittest.mock",
+    "Mock(",
+    "MagicMock(",
+    "AsyncMock(",
+    "PropertyMock(",
+    "patch(",
+    "monkeypatch",
+    "mocker",
+]
+
+_IMPORT_LINE_RE = re.compile(r"^\s*(?:from\s+[\w.]+\s+import\b|import\s+\w)", re.IGNORECASE)
+
+# Default severity per signal group.
+DEFAULT_SEVERITIES: dict[str, str] = {
+    "stub_code": "warning",
+    "oversold": "error",
+    "fabricated": "error",
+}
+
+# ---------------------------------------------------------------------------
+# Precompiled regex patterns (one per group, compiled once at import time).
+# ASCII tokens use \b word boundaries; CJK tokens are substring matches
+# (\b never fires between two CJK chars, so boundaries would miss 占位符 etc).
+# ---------------------------------------------------------------------------
+
+_CJK_RE = re.compile(r"[\u4e00-\u9fff\u3040-\u30ff\uac00-\ud7af]")
+
+
+def _compile_group(tokens: list[str]) -> re.Pattern:
+    ascii_alts = [re.escape(t).replace(r"\ ", r"\s+") for t in tokens if not _CJK_RE.search(t)]
+    cjk_alts = [re.escape(t) for t in tokens if _CJK_RE.search(t)]
+    parts = []
+    if ascii_alts:
+        parts.append(rf"\b(?:{'|'.join(ascii_alts)})\b")
+    if cjk_alts:
+        parts.append("|".join(cjk_alts))
+    return re.compile("(?:" + "|".join(parts) + ")", re.IGNORECASE)
+
+
+_HALLUCINATION_PATTERNS: list[tuple[re.Pattern, str]] = [
+    (_compile_group(STUB_TOKENS + STUB_TOKENS_ZH), "stub_code"),
+    (_compile_group(OVERSOLD_TOKENS + OVERSOLD_TOKENS_ZH), "oversold"),
+    (_compile_group(FABRICATED_TOKENS + FABRICATED_TOKENS_ZH), "fabricated"),
+]
+
+
+def scan_hallucination_words(
+    source: str,
+    allowlist: list[str] | None = None,
+    severities: dict[str, str] | None = None,
+    extra_tokens: dict[str, list[str]] | None = None,
+) -> dict:
+    """Scan source for tokens in the grouped hallucination pool.
+
+    To avoid flagging legitimate code, matches are skipped when:
+      - the line is an import statement;
+      - the match is part of a dotted path (``unittest.mock``, ``os.path``);
+      - the matched text starts with an entry of the effective allowlist.
+
+    ``extra_tokens`` extends the pool at runtime (config: ``extra_tokens``
+    mapping group -> [words]); unknown groups are ignored.
+
+    Each hit carries a severity (``error`` | ``warning`` | ``info``) taken
+    from ``severities`` (group -> severity), falling back to
+    DEFAULT_SEVERITIES.
+
+    Returns:
+        {
+          "hits": [{"word": "stub", "group": "stub_code", "line": 12,
+                    "severity": "warning"}, ...],
+          "clean": bool,
+          "blocking": bool,
+          "groups": {"stub_code": 2, "oversold": 1, "fabricated": 0},
+          "severities": {"error": 1, "warning": 2, "info": 0}
+        }
+    """
+    if allowlist is None:
+        allowlist = DEFAULT_ALLOWLIST
+    elif isinstance(allowlist, str):
+        # MCP clients sometimes send a bare string instead of a list; a raw
+        # string would iterate characters and silently suppress every match.
+        allowlist = [allowlist]
+    elif not isinstance(allowlist, list):
+        allowlist = (
+            [a for a in allowlist if isinstance(a, str)] if hasattr(allowlist, "__iter__") else []
+        )
+    allowlist = [a for a in allowlist if isinstance(a, str) and a]
+    sev = dict(DEFAULT_SEVERITIES)
+    if severities:
+        for g, s in severities.items():
+            if g in _GROUP_LABELS and s in _VALID_SEVERITIES:
+                sev[g] = s
+    patterns = list(_HALLUCINATION_PATTERNS)
+    if extra_tokens:
+        for g, words in extra_tokens.items():
+            if g in _GROUP_LABELS and isinstance(words, list):
+                words = [w for w in words if isinstance(w, str) and w]
+                if words:
+                    patterns.append((_compile_group(words), g))
+    hits: list[dict] = []
+    group_counts: dict[str, int] = {g: 0 for g in _GROUP_LABELS}
+    severity_counts: dict[str, int] = {"error": 0, "warning": 0, "info": 0}
+    for i, line in enumerate(source.splitlines(), start=1):
+        if _IMPORT_LINE_RE.match(line):
+            continue
+        for pattern, group in patterns:
+            for m in pattern.finditer(line):
+                before = line[max(0, m.start() - 1) : m.start()]
+                after = line[m.end() : m.end() + 1]
+                if before == "." or after == ".":
+                    continue  # part of a dotted path (module/attribute)
+                rest = line[m.start() :]
+                if any(rest.lower().startswith(a.lower()) for a in allowlist):
+                    continue
+                word = m.group(0).lower()
+                severity = sev.get(group, "warning")
+                hits.append({"word": word, "group": group, "line": i, "severity": severity})
+                group_counts[group] += 1
+                severity_counts[severity] += 1
+    return {
+        "hits": hits,
+        "clean": len(hits) == 0,
+        "blocking": severity_counts["error"] > 0,
+        "groups": group_counts,
+        "severities": severity_counts,
+    }

package/server/engine/imports.py

@@ -0,0 +1,136 @@
+"""AgentSeed import verification — package-hallucination (slopsquatting) guard.
+
+Motivated by "We Have a Package for You!" (USENIX Security 2025,
+arXiv:2406.10279): across 576k generated samples, LLMs invented non-existent
+package names in ~5.2% (commercial) to ~21.7% (open-source) of outputs, and
+~58% of those names recurred across runs — predictable enough that attackers
+pre-register the exact hallucinated names with malicious payloads
+("slopsquatting").
+
+``check_imports`` flags top-level imports that are neither Python stdlib nor
+in the project's ``known_packages`` allowlist, so a model-suggested phantom
+package cannot reach a lockfile silently. It is a REPORT, not a hard gate:
+a legit long-tail package will also be flagged for the human to confirm —
+that is the intended cost. Python (AST) only; other languages return an
+honest empty result.
+"""
+
+from __future__ import annotations
+
+import ast
+import sys
+
+# Fallback for Python < 3.10 (``sys.stdlib_module_names`` is 3.10+): a curated
+# list of the most commonly imported stdlib modules. On 3.10+ the exact set is
+# used and this list is never consulted.
+_STDLIB_FALLBACK = frozenset(
+    {
+        "abc", "argparse", "array", "ast", "asyncio", "atexit", "base64",
+        "bisect", "builtins", "collections", "concurrent", "configparser",
+        "contextlib", "copy", "csv", "ctypes", "dataclasses", "datetime",
+        "decimal", "difflib", "enum", "errno", "functools", "gc", "getpass",
+        "glob", "gzip", "hashlib", "heapq", "hmac", "html", "http", "importlib",
+        "inspect", "io", "ipaddress", "itertools", "json", "logging", "math",
+        "multiprocessing", "os", "pathlib", "pickle", "platform", "queue",
+        "random", "re", "readline", "secrets", "shlex", "shutil", "signal",
+        "site", "socket", "sqlite3", "ssl", "stat", "statistics", "string",
+        "struct", "subprocess", "sys", "tempfile", "textwrap", "threading",
+        "time", "timeit", "token", "tokenize", "traceback", "types", "typing",
+        "unicodedata", "unittest", "urllib", "uuid", "venv", "warnings",
+        "weakref", "xml", "zipfile", "zoneinfo",
+    }
+)
+
+# Common third-party packages treated as known by default (beyond stdlib).
+# The full resolution for anything not listed is: user config ``known_packages``.
+_DEFAULT_COMMON = frozenset(
+    {
+        "numpy", "pandas", "scipy", "sklearn", "matplotlib", "seaborn", "plotly",
+        "requests", "httpx", "aiohttp", "urllib3", "beautifulsoup4", "bs4",
+        "scrapy", "selenium", "playwright", "flask", "fastapi", "django",
+        "starlette", "uvicorn", "gunicorn", "jinja2", "sqlalchemy", "pymysql",
+        "psycopg2", "redis", "pymongo", "elasticsearch", "celery", "kafka",
+        "pydantic", "pydantic_settings", "click", "typer", "rich", "tqdm",
+        "pytest", "coverage", "black", "ruff", "mypy", "flake8", "isort",
+        "tox", "nox", "hypothesis", "unittest", "jupyter", "notebook",
+        "ipykernel", "ipython", "nbformat", "nbconvert", "tensorflow", "torch",
+        "keras", "transformers", "datasets", "tokenizers", "accelerate",
+        "sentence_transformers", "openai", "anthropic", "google", "googleapiclient",
+        "boto3", "botocore", "azure", "awscli", "paramiko", "cryptography",
+        "pycryptodome", "bcrypt", "jwt", "pyjwt", "passlib", "yaml", "pyyaml",
+        "tomllib", "tomli", "tomlkit", "jsonschema", "setuptools", "wheel",
+        "pip", "pipenv", "poetry", "uv", "pre_commit", "arrow", "pendulum",
+        "dateutil", "python_dateutil", "pytz", "tzlocal", "zoneinfo", "natsort",
+        "more_itertools", "toolz", "pydash", "tenacity", "structlog", "loguru",
+        "colorama", "clickhouse_driver", "duckdb", "polars", "dask", "ray",
+    }
+)
+
+
+def _stdlib_modules() -> frozenset[str]:
+    names = getattr(sys, "stdlib_module_names", None)
+    return frozenset(names) if names is not None else _STDLIB_FALLBACK
+
+
+def _imported_top_level(source: str) -> list[tuple[str, int]]:
+    """(top-level module name, lineno) for every import / from-import."""
+    try:
+        tree = ast.parse(source)
+    except SyntaxError:
+        return []
+    out: list[tuple[str, int]] = []
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                out.append((alias.name.split(".")[0], node.lineno))
+        elif isinstance(node, ast.ImportFrom) and node.level == 0 and node.module:
+            out.append((node.module.split(".")[0], node.lineno))
+    return out
+
+
+def check_imports(
+    source: str,
+    language: str = "python",
+    known_packages: list[str] | None = None,
+) -> dict:
+    """Flag top-level imports neither in stdlib nor in the known-package set.
+
+    ``known_packages`` (config key of the same name) extends the default
+    common third-party allowlist with project-local packages. Python only
+    (AST); other languages return an honest empty result.
+
+    Returns:
+        {"language", "imports_ok", "suspicious": [{"package", "line"}, ...],
+         "note"}
+    """
+    lang = (language or "python").strip().lower()
+    if lang != "python":
+        return {
+            "language": lang,
+            "imports_ok": True,
+            "suspicious": [],
+            "note": "Import verification is implemented for python (AST); "
+            "other languages are not covered yet.",
+        }
+    known = set(_DEFAULT_COMMON)
+    for pkg in known_packages or []:
+        if isinstance(pkg, str) and pkg.strip():
+            known.add(pkg.strip())
+    stdlib = _stdlib_modules()
+    suspicious = [
+        {"package": pkg, "line": line}
+        for pkg, line in _imported_top_level(source)
+        if pkg not in stdlib and pkg not in known
+    ]
+    note = (
+        "Top-level import is neither Python stdlib nor in the known-package "
+        "set (stdlib + common third-party + config `known_packages`) — a "
+        "possible hallucinated package (slopsquatting). Verify the name exists "
+        "in the registry before installing. This is a report, not a gate."
+    )
+    return {
+        "language": "python",
+        "imports_ok": not suspicious,
+        "suspicious": suspicious,
+        "note": note,
+    }