ai-install-guard 0.0.0 → 0.2.0

package/hooks/scan/checks/hooks.ts

@@ -0,0 +1,156 @@
+import type { HookCommand, ScanContext } from './context'
+import {
+  CLAUDE_LOAD_DIR,
+  CLAUDE_SETTINGS,
+  CODE_FROM_TEXT,
+  NETWORK_CODE,
+  PROCESS_CODE,
+  PYTHON_CODE_FROM_TEXT,
+  PYTHON_PROCESS,
+  CREDENTIAL_PATH,
+  DOWNLOAD_AND_RUN,
+  NETWORK_COMMAND,
+  PERSISTENCE_TARGET,
+  SECRET_ENV,
+  SHELL_EVAL,
+  UNPINNED_RUNNER,
+  WRITE_CODE,
+  WRITE_SHELL,
+} from './patterns'
+import { languageOf, secretName } from './code'
+import { promptConcerns } from './prompts'
+import { findAll, findFirst, spanKinds, type Match } from './text'
+import { row, type CheckResult, type Evidence } from './types'
+
+const GROUP = 'hooks' as const
+
+/** What makes a shell hook a FAIL, in the order the report names them. */
+const DANGERS: readonly { pattern: RegExp; what: string }[] = [
+  { pattern: DOWNLOAD_AND_RUN, what: 'downloads or decodes code and runs it' },
+  { pattern: UNPINNED_RUNNER, what: 'fetches and runs an unpinned package' },
+  { pattern: NETWORK_COMMAND, what: 'uses a network tool' },
+  { pattern: SHELL_EVAL, what: 'evaluates text as shell code' },
+  { pattern: CREDENTIAL_PATH, what: 'touches a credential file' },
+  { pattern: SECRET_ENV, what: 'reads secret environment variables' },
+]
+
+/** Hook output that approves a tool call without asking you. */
+const AUTO_APPROVE = /["']?permissionDecision["']?\s*[:=]\s*["']allow["']|\bdecision["']?\s*:\s*["']approve["']|\bpermissionDecision\b[^\n]{0,40}\ballow\b/
+
+export function hookChecks(ctx: ScanContext): CheckResult[] {
+  if (ctx.hookCommands.length === 0) return []
+  const commands: Evidence[] = []
+  const approvals: Evidence[] = []
+
+  for (const hook of ctx.hookCommands) {
+    const where = `${hook.event}${hook.matcher === undefined || hook.matcher === '' ? '' : ` (${hook.matcher})`}`
+    if (hook.type === 'command') {
+      const dangers = dangersIn(hook.command)
+      commands.push({
+        file: hook.file,
+        line: hook.line,
+        excerpt: `on ${where}: ${hook.command}${dangers.length > 0 ? `  [${dangers.join('; ')}]` : ''}`,
+        status: dangers.length > 0 ? 'fail' : 'warn',
+      })
+      const approval = findFirst(hook.command, AUTO_APPROVE)
+      if (approval !== undefined) approvals.push({ file: hook.file, line: hook.line, excerpt: approval.excerpt, status: 'fail' })
+    } else if (hook.type === 'http') {
+      const isLocal = /^https?:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?(?:[/?#]|$)/.test(hook.command)
+      commands.push({
+        file: hook.file,
+        line: hook.line,
+        excerpt: `on ${where}: sends each event, with tool inputs and outputs, to ${hook.command}`,
+        status: isLocal ? 'warn' : 'fail',
+      })
+    } else {
+      // A prompt or agent hook is instructions the model follows: judged as a prompt.
+      const concerns = promptConcerns(hook.command)
+      commands.push({
+        file: hook.file,
+        line: hook.line,
+        excerpt: `on ${where}: asks a model (${hook.type}): ${hook.command}${concerns.reasons.length > 0 ? `  [${concerns.reasons.join('; ')}]` : ''}`,
+        status: concerns.status,
+      })
+    }
+  }
+
+  // Scripts the hooks run are part of the hook. A match in a comment is only reported.
+  for (const file of ctx.files) {
+    // Every script a hook runs, even one a hooks module also imports.
+    if (!ctx.hookScripts.has(file.path) && ctx.roleOf(file.path) !== 'hook-script') continue
+    const text = ctx.text(file.path)
+    if (text === undefined) continue
+    // Read as the interpreter the hook runs it with, not as its name suggests.
+    const kindAt = spanKinds(text, ctx.interpreters.get(file.path) ?? languageOf(file.path, text))
+    const isInert = (match: Match): boolean => ['comment', 'regex', 'trailing-comment'].includes(kindAt(match.index))
+    const found = (match: Match, what: string): Evidence => {
+      const shown = `${what}: ${what === 'reads secret environment variables' ? secretName(match) : match.excerpt}`
+      const kind = kindAt(match.index)
+      if (kind === 'comment' || kind === 'regex') return { file: file.path, line: match.line, excerpt: `${shown} (in a comment)`, status: 'info' }
+      // After code on the same line, a comment may be hiding a command: a warning at least.
+      if (kind === 'trailing-comment') return { file: file.path, line: match.line, excerpt: `${shown} (in a comment after code)`, status: 'warn' }
+      return { file: file.path, line: match.line, excerpt: shown, status: 'fail' }
+    }
+    // Gates (does the script write at all?) count every match but those in
+    // whole-line comments or real patterns: a trailing comment is no proof.
+    const live = (pattern: RegExp): boolean => findAll(text, pattern, 1, index => !['comment', 'regex'].includes(kindAt(index))).length > 0
+    // Live matches first, so comments cannot crowd out a real command.
+    const matches = (pattern: RegExp): Match[] => {
+      const all = findAll(text, pattern, 10_000)
+      return [...all.filter(match => !isInert(match)).slice(0, 3), ...all.filter(isInert).slice(0, 2)]
+    }
+    for (const { pattern, what } of DANGERS) {
+      for (const match of matches(pattern)) commands.push(found(match, what))
+    }
+    for (const match of matches(AUTO_APPROVE)) approvals.push(found(match, 'approves the tool call'))
+    const writes = live(WRITE_SHELL) || live(WRITE_CODE)
+    if (writes) {
+      for (const match of matches(PERSISTENCE_TARGET)) commands.push(found(match, 'writes to a startup or persistence location'))
+      for (const match of matches(CLAUDE_LOAD_DIR)) commands.push(found(match, 'writes where Claude Code loads plugins, skills or memory'))
+    }
+    // Reading settings is not changing them: a FAIL needs a write.
+    for (const match of matches(CLAUDE_SETTINGS)) {
+      const item = found(match, writes ? 'changes Claude Code settings or permissions' : 'reads Claude Code settings or permissions')
+      commands.push(writes || item.status === 'info' ? item : { ...item, status: 'warn' })
+    }
+  }
+
+  return [
+    row(
+      {
+        id: 'hooks.commands',
+        group: GROUP,
+        title: 'Shell hooks and the scripts they run',
+        advice: 'A classic hook runs with your permissions on every matching event, outside any mod sandbox, and cannot be blocked per plugin. Read each command; never install one that reaches the network, runs downloaded code or touches your keys.',
+      },
+      commands,
+    ),
+    row(
+      {
+        id: 'hooks.auto-approve',
+        group: GROUP,
+        title: 'Hooks that approve tool calls for you',
+        advice: 'A hook that answers "allow" skips your permission prompt for every matching tool call.',
+      },
+      approvals,
+      'fail',
+    ),
+  ]
+}
+
+/** Code passed inline to an interpreter (`python3 -c "..."`, `node -e "..."`). */
+const INLINE_CODE = /\b(?:python[23]?|node|deno|bun|perl|ruby|php|osascript|pwsh|powershell)(?:\.exe)?\s+(?:-[A-Za-z]*\s+)*-(?:c|e|E|r|Command)\b/
+
+function dangersIn(command: string): string[] {
+  const found = DANGERS.filter(({ pattern }) => pattern.test(command)).map(({ what }) => what)
+  // Inline code is judged as code: a socket, a process or a network call in it fails.
+  if (INLINE_CODE.test(command) && [NETWORK_CODE, PROCESS_CODE, PYTHON_PROCESS, CODE_FROM_TEXT, PYTHON_CODE_FROM_TEXT, /\bsocket\b/].some(pattern => pattern.test(command))) {
+    found.push('runs inline code that reaches the network or starts programs')
+  }
+  if (PERSISTENCE_TARGET.test(command) && WRITE_SHELL.test(command)) found.push('writes to a startup or persistence location')
+  if (CLAUDE_SETTINGS.test(command)) found.push('changes Claude Code settings or permissions')
+  if (CLAUDE_LOAD_DIR.test(command) && WRITE_SHELL.test(command)) found.push('writes where Claude Code loads plugins, skills or memory')
+  return found
+}
+
+export type { HookCommand }

package/hooks/scan/checks/magic.ts

@@ -0,0 +1,40 @@
+// Recognising files by their first bytes rather than their names.
+
+export type Magic = 'elf' | 'mach-o' | 'pe' | 'wasm' | 'zip' | 'gzip' | 'bzip2' | 'xz' | '7z' | 'rar' | 'zstd' | 'tar' | 'png' | 'jpeg' | 'gif' | 'webp' | 'pdf'
+
+export const EXECUTABLE: ReadonlySet<Magic> = new Set(['elf', 'mach-o', 'pe', 'wasm'])
+export const ARCHIVE: ReadonlySet<Magic> = new Set(['zip', 'gzip', 'bzip2', 'xz', '7z', 'rar', 'zstd', 'tar'])
+export const IMAGE_EXTENSIONS: Record<string, Magic> = { png: 'png', jpg: 'jpeg', jpeg: 'jpeg', gif: 'gif', webp: 'webp' }
+export const NATIVE_EXTENSIONS = new Set(['so', 'dylib', 'dll', 'node', 'exe', 'o', 'a', 'pyc', 'pyo', 'class', 'jar', 'wasm'])
+export const TEXT_EXTENSIONS = new Set(['md', 'mdx', 'txt', 'json', 'jsonc', 'yaml', 'yml', 'toml', 'ini', 'env', 'js', 'mjs', 'cjs', 'ts', 'tsx', 'jsx', 'py', 'sh', 'bash', 'zsh', 'rb', 'html', 'css', 'svg', 'xml', 'csv'])
+export const ARCHIVE_EXTENSIONS = new Set(['zip', 'gz', 'tgz', 'bz2', 'xz', '7z', 'rar', 'zst', 'tar', 'jar', 'whl', 'docx', 'xlsx', 'pptx', 'skill'])
+
+export function magicOf(bytes: Uint8Array): Magic | undefined {
+  const at = (offset: number, ...values: number[]): boolean => values.every((value, i) => bytes[offset + i] === value)
+  if (at(0, 0x7f, 0x45, 0x4c, 0x46)) return 'elf'
+  if (at(0, 0xfe, 0xed, 0xfa, 0xce) || at(0, 0xfe, 0xed, 0xfa, 0xcf) || at(0, 0xce, 0xfa, 0xed, 0xfe) || at(0, 0xcf, 0xfa, 0xed, 0xfe) || at(0, 0xca, 0xfe, 0xba, 0xbe)) return 'mach-o'
+  if (at(0, 0x4d, 0x5a) && isPortableExecutable(bytes)) return 'pe'
+  if (at(0, 0x00, 0x61, 0x73, 0x6d)) return 'wasm'
+  if (at(0, 0x50, 0x4b, 0x03, 0x04) || at(0, 0x50, 0x4b, 0x05, 0x06)) return 'zip'
+  if (at(0, 0x1f, 0x8b)) return 'gzip'
+  if (at(0, 0x42, 0x5a, 0x68)) return 'bzip2'
+  if (at(0, 0xfd, 0x37, 0x7a, 0x58, 0x5a, 0x00)) return 'xz'
+  if (at(0, 0x37, 0x7a, 0xbc, 0xaf, 0x27, 0x1c)) return '7z'
+  if (at(0, 0x52, 0x61, 0x72, 0x21)) return 'rar'
+  if (at(0, 0x28, 0xb5, 0x2f, 0xfd)) return 'zstd'
+  if (at(257, 0x75, 0x73, 0x74, 0x61, 0x72)) return 'tar'
+  if (at(0, 0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a)) return 'png'
+  if (at(0, 0xff, 0xd8, 0xff)) return 'jpeg'
+  if (at(0, 0x47, 0x49, 0x46, 0x38)) return 'gif'
+  if (at(0, 0x52, 0x49, 0x46, 0x46) && at(8, 0x57, 0x45, 0x42, 0x50)) return 'webp'
+  if (at(0, 0x25, 0x50, 0x44, 0x46)) return 'pdf'
+  return undefined
+}
+
+/** An MZ header whose e_lfanew field points at a `PE\0\0` signature, not just text that starts with "MZ". */
+function isPortableExecutable(bytes: Uint8Array): boolean {
+  if (bytes.length < 0x40) return false
+  const offset = ((bytes[0x3c] as number) | ((bytes[0x3d] as number) << 8) | ((bytes[0x3e] as number) << 16) | ((bytes[0x3f] as number) << 24)) >>> 0
+  return offset + 4 <= bytes.length && bytes[offset] === 0x50 && bytes[offset + 1] === 0x45 && bytes[offset + 2] === 0 && bytes[offset + 3] === 0
+}
+

package/hooks/scan/checks/mcp.ts

@@ -0,0 +1,271 @@
+import type { McpServer, ScanContext } from './context'
+import { COLLECTION_HOST, CREDENTIAL_PATH, DOWNLOAD_AND_RUN, NETWORK_COMMAND, SECRET_ENV, UNPINNED_RUNNER } from './patterns'
+import { capEvidence, row, type CheckResult, type Evidence, type Status } from './types'
+
+const GROUP = 'mcp' as const
+
+/** Words in a variable's name that say nothing about whose credential it is. */
+const GENERIC_WORDS = new Set(['api', 'key', 'keys', 'token', 'tokens', 'auth', 'oauth', 'secret', 'access', 'session', 'client', 'bot', 'app', 'personal', 'private', 'password', 'credentials', 'application', 'hub', 'code'])
+
+/** Short or product names in a variable, and the service they belong to. */
+const SERVICE_WORDS: Record<string, string> = { gh: 'github', hf: 'huggingface', hugging: 'huggingface', face: 'huggingface', claude: 'anthropic', node: 'npm' }
+
+/** The domains each service's keys belong on. A host must be one of them or below one. */
+const SERVICE_DOMAINS: Record<string, readonly string[]> = {
+  github: ['github.com', 'githubcopilot.com', 'githubusercontent.com', 'ghe.com'],
+  gitlab: ['gitlab.com'],
+  anthropic: ['anthropic.com', 'claude.ai', 'claude.com'],
+  openai: ['openai.com'],
+  aws: ['amazonaws.com', 'aws.amazon.com', 'aws.dev'],
+  google: ['googleapis.com', 'google.com'],
+  azure: ['azure.com', 'microsoft.com', 'windows.net', 'azure.net'],
+  slack: ['slack.com'],
+  stripe: ['stripe.com'],
+  huggingface: ['huggingface.co'],
+  npm: ['npmjs.org', 'npmjs.com'],
+}
+
+/** A `${NAME}` or `$NAME` reference to an environment variable. */
+const ENV_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]{0,100})(?::-[^}]{0,200})?\}|\$([A-Za-z_][A-Za-z0-9_]{0,100})/g
+
+/** An address anywhere in a command line, a shell script's included. */
+const ADDRESS = /\b(?:https?|wss?):\/\/[^\s'"`<>)]{1,500}/gi
+
+/** Container options that take the next argument as their value. */
+const VALUE_FLAGS = new Set([
+  '-a', '--attach', '-e', '--env', '--env-file', '-v', '--volume', '--mount', '-l', '--label', '--label-file', '--name', '-p', '--publish', '--network', '--net',
+  '-w', '--workdir', '--entrypoint', '-u', '--user', '--platform', '--pull', '-h', '--hostname', '--cpus', '-m', '--memory', '--add-host', '--device', '--cap-add',
+  '--cap-drop', '--restart', '--log-driver', '--log-opt', '--security-opt', '--tmpfs', '--ulimit', '--gpus', '--shm-size', '--runtime', '--ipc', '--pid', '--uts',
+  '--userns', '--cgroupns', '--dns', '--expose', '--group-add', '--cidfile', '--stop-signal', '--stop-timeout', '--health-cmd', '--memory-swap', '--cpuset-cpus',
+])
+
+/** Group 5: what each MCP server runs or talks to, and what it is handed. */
+export function mcpChecks(ctx: ScanContext): CheckResult[] {
+  if (ctx.mcpServers.length === 0) return []
+  return [inventoryCheck(ctx.mcpServers), launchCheck(ctx.mcpServers), remoteCheck(ctx.mcpServers), credentialsCheck(ctx.mcpServers)]
+}
+
+function place(server: McpServer, excerpt: string, status: Status): Evidence {
+  return { file: server.file, line: server.line, excerpt: `${server.name}: ${excerpt}`, status }
+}
+
+function commandLine(server: McpServer): string {
+  return [server.command ?? '', ...server.args].join(' ').trim()
+}
+
+/**
+ * Every remote address a server talks to or is given: its own URL, and any
+ * address in its arguments (inside a shell script too), environment and
+ * headers. Local ones are left out. All are judged; the rows cap what they list.
+ */
+function remoteUrls(server: McpServer): { url: URL; given: boolean }[] {
+  const found: { url: URL; given: boolean }[] = []
+  const texts = [
+    ...(server.url === undefined ? [] : [{ text: server.url, given: false }]),
+    ...[...server.args, ...Object.values(server.env), ...Object.values(server.headers)].map(text => ({ text, given: true })),
+  ]
+  for (const { text, given } of texts) {
+    for (const match of text.matchAll(ADDRESS)) {
+      // Bounded work for a config written to exhaust it.
+      if (found.length >= 500) return found
+      try {
+        const url = new URL(match[0])
+        if (!isLocal(url.hostname)) found.push({ url, given })
+      } catch {
+        continue
+      }
+    }
+  }
+  return found
+}
+
+function isLocal(host: string): boolean {
+  return /^(?:localhost|127(?:\.\d{1,3}){3}|\[::1\]|::1|0\.0\.0\.0)$/i.test(host)
+}
+
+function inventoryCheck(servers: readonly McpServer[]): CheckResult {
+  const evidence = servers.map(server => {
+    const what = server.url !== undefined ? `${server.type ?? 'http'} server at ${server.url}` : `runs ${commandLine(server) || '(no command)'}`
+    const env = Object.keys(server.env)
+    return place(server, `${what}${env.length > 0 ? `; environment: ${env.slice(0, 10).join(', ')}` : ''}`, 'info')
+  })
+  return row(
+    {
+      id: 'mcp.servers',
+      group: GROUP,
+      title: 'MCP servers it adds',
+      advice: 'Each MCP server runs as a program on your machine or talks to a server elsewhere, and Claude can call every tool it offers.',
+    },
+    capEvidence(evidence, 30, 'info'),
+    'info',
+  )
+}
+
+function launchCheck(servers: readonly McpServer[]): CheckResult {
+  const evidence: Evidence[] = []
+  for (const server of servers) {
+    if (server.command === undefined) continue
+    const line = commandLine(server)
+    const program = baseName(server.command)
+    if (DOWNLOAD_AND_RUN.test(line)) {
+      evidence.push(place(server, `downloads code and runs it: ${line}`, 'fail'))
+      continue
+    }
+    if (UNPINNED_RUNNER.test(line)) {
+      evidence.push(place(server, `fetches a package that is not pinned to an exact version each time it starts: ${line}`, 'warn'))
+    } else if (/^(?:npx|bunx|pnpx|uvx|pipx|npm|pnpm|yarn|bun|deno)$/.test(program)) {
+      evidence.push(place(server, `fetches or runs a package when it starts; the package is not part of this scan: ${line}`, 'info'))
+    }
+    if (runsInlineScript(program, server.args)) evidence.push(place(server, `runs an inline shell script: ${line}`, 'warn'))
+    if (/^(?:docker|podman|nerdctl)$/.test(program) && server.args.includes('run')) {
+      const image = containerImage(server.args)
+      if (image === undefined) evidence.push(place(server, `runs a container whose image could not be told apart: ${line}`, 'warn'))
+      else if (!/@sha256:[0-9a-f]{64}$/.test(image)) evidence.push(place(server, `runs the container image ${image}, not pinned by digest`, 'warn'))
+    }
+  }
+  return row(
+    {
+      id: 'mcp.launch',
+      group: GROUP,
+      title: 'How each server starts',
+      advice: 'A server that downloads code when it starts runs whatever is published then, not what was scanned. Prefer an exact version or a digest.',
+    },
+    capEvidence(evidence, 30),
+  )
+}
+
+/** A shell given a script as text: -c (alone or with other letters, -ec), /c, -Command. */
+function runsInlineScript(program: string, args: readonly string[]): boolean {
+  if (/^(?:ba|z|da|k|fi)?sh$/.test(program)) return args.some(arg => /^-[A-Za-z]*c[A-Za-z]*$/.test(arg))
+  if (/^cmd(?:\.exe)?$/.test(program)) return args.some(arg => /^\/[ck]$/i.test(arg))
+  if (/^(?:powershell|pwsh)(?:\.exe)?$/.test(program)) return args.some(arg => /^-(?:c|command|e|ec|enc|encodedcommand)$/i.test(arg))
+  return false
+}
+
+/** The image a `docker run` starts: the first argument after `run` that is not an option or its value. */
+function containerImage(args: readonly string[]): string | undefined {
+  let index = args.indexOf('run') + 1
+  while (index < args.length) {
+    const arg = args[index] as string
+    if (arg === '--') return args[index + 1]
+    if (!arg.startsWith('-')) return arg
+    index += !arg.includes('=') && VALUE_FLAGS.has(arg) ? 2 : 1
+  }
+  return undefined
+}
+
+function remoteCheck(servers: readonly McpServer[]): CheckResult {
+  const evidence: Evidence[] = []
+  for (const server of servers) {
+    for (const { url, given } of remoteUrls(server)) {
+      const host = url.hostname.toLowerCase()
+      const via = given ? ' (an address in its configuration)' : ''
+      if (url.protocol === 'http:' || url.protocol === 'ws:') {
+        evidence.push(place(server, `talks to ${host}${via} without encryption`, 'fail'))
+      } else if (COLLECTION_HOST.test(`${host}${url.pathname}`)) {
+        evidence.push(place(server, `talks to ${host}${via}, a host often used to collect data`, 'fail'))
+      } else if (/^\d{1,3}(?:\.\d{1,3}){3}$|^\[/.test(host)) {
+        evidence.push(place(server, `talks to a raw IP address${via}: ${host}`, 'warn'))
+      } else {
+        evidence.push(place(server, `talks to a remote server${via}: ${host}`, 'warn'))
+      }
+    }
+  }
+  return row(
+    {
+      id: 'mcp.remote',
+      group: GROUP,
+      title: 'Remote servers',
+      advice: 'A remote server sees what Claude sends its tools and can change its tools at any time. Check that each host belongs to the publisher.',
+    },
+    capEvidence(evidence, 30),
+  )
+}
+
+function credentialsCheck(servers: readonly McpServer[]): CheckResult {
+  const evidence: Evidence[] = []
+  for (const server of servers) {
+    const urls = remoteUrls(server)
+    const line = commandLine(server)
+    const runner = server.command !== undefined && UNPINNED_RUNNER.test(line)
+    // A command that reads a credential file, and can send it somewhere.
+    if (server.command !== undefined && CREDENTIAL_PATH.test(line)) {
+      const sends = urls.length > 0 || NETWORK_COMMAND.test(line)
+      evidence.push(place(server, `${sends ? 'reads a credential file and talks to the network' : 'reads a credential file'}: ${line}`, sends ? 'fail' : 'warn'))
+    }
+    const handed = new Map<string, string>()
+    for (const [key, value] of [...Object.entries(server.env), ...Object.entries(server.headers)]) {
+      for (const name of referencedVariables(value)) handed.set(name, key)
+      if (SECRET_ENV.test(key)) handed.set(key, key)
+    }
+    for (const arg of server.args) for (const name of referencedVariables(arg)) if (!handed.has(name)) handed.set(name, 'its arguments')
+    for (const name of referencedVariables(server.url ?? '')) handed.set(name, 'url')
+    for (const [name, via] of handed) {
+      if (!SECRET_ENV.test(name)) continue
+      if (urls.length > 0) {
+        for (const { url } of urls) {
+          const host = url.hostname.toLowerCase()
+          evidence.push(
+            belongsTo(name, host)
+              ? place(server, `sends ${name} (in ${via}) to ${host}`, 'warn')
+              : place(server, `sends ${name} (in ${via}) to ${host}, which is not the service it belongs to`, 'fail'),
+          )
+        }
+      } else if (runner) {
+        evidence.push(place(server, `hands ${name} (in ${via}) to a package fetched when it starts, which this scan cannot read`, 'warn'))
+      } else {
+        evidence.push(place(server, `is given ${name} (in ${via})`, 'info'))
+      }
+    }
+  }
+  return row(
+    {
+      id: 'mcp.credentials',
+      group: GROUP,
+      title: 'Secrets given to servers',
+      advice: 'A server given a key can use it as you. A key sent to a host that is not its own service is a common way to steal it.',
+    },
+    capEvidence(evidence, 30),
+  )
+}
+
+function referencedVariables(text: string): string[] {
+  const names: string[] = []
+  for (const match of text.matchAll(ENV_REFERENCE)) {
+    const name = match[1] ?? match[2]
+    if (name !== undefined) names.push(name)
+  }
+  return names
+}
+
+/**
+ * Whether a key named `name` belongs on `host`: the host is one of its
+ * service's own domains or below one. For a service with no list, the
+ * service's word must be the host's own name (notion for mcp.notion.so), not
+ * any label: github.evil.example is evil.example's.
+ */
+function belongsTo(name: string, host: string): boolean {
+  const labels = host.split('.')
+  for (const word of vendorWords(name)) {
+    const domains = SERVICE_DOMAINS[word]
+    if (domains !== undefined) {
+      if (domains.some(domain => host === domain || host.endsWith(`.${domain}`))) return true
+    } else if (labels.length >= 2 && labels[labels.length - 2] === word) {
+      return true
+    }
+  }
+  return false
+}
+
+/** The words of a variable's name that name a service: GITHUB_TOKEN gives github. */
+function vendorWords(name: string): string[] {
+  return name
+    .toLowerCase()
+    .split('_')
+    .map(word => SERVICE_WORDS[word] ?? word)
+    .filter(word => word.length >= 3 && !GENERIC_WORDS.has(word))
+}
+
+function baseName(command: string): string {
+  return (command.split(/[\\/]/).pop() ?? command).toLowerCase()
+}