calllint 0.3.0-preview.1 → 0.3.0-rc.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/index.js +24 -10
  2. package/logo-mark-128.png +0 -0
  3. package/package.json +1 -1
package/dist/index.js CHANGED
@@ -621,6 +621,18 @@ function detectSecretEnvKeys(ctx) {
621
621
 
622
622
  // ../../packages/static-analyzer/src/detectors/dangerousCommand.ts
623
623
  var INLINE_EXEC_FLAGS = /* @__PURE__ */ new Set(["-c", "-e", "--eval", "--command"]);
624
+ var INLINE_EVAL_INTERPRETERS = /* @__PURE__ */ new Set([
625
+ "node",
626
+ "nodejs",
627
+ "deno",
628
+ "bun",
629
+ "python",
630
+ "python2",
631
+ "python3",
632
+ "ruby",
633
+ "perl",
634
+ "php"
635
+ ]);
624
636
  function detectDangerousCommand(ctx) {
625
637
  const { server } = ctx;
626
638
  const command = server.command;
@@ -637,15 +649,17 @@ function detectDangerousCommand(ctx) {
637
649
  value: command
638
650
  });
639
651
  }
640
- const inlineFlag = server.args.find((a) => INLINE_EXEC_FLAGS.has(a));
641
- if (inlineFlag) {
642
- reason = reason ?? `Server runs an inline command via ${inlineFlag}.`;
643
- evidence.push({
644
- type: "config",
645
- path: server.sourceConfigPath,
646
- key: "args",
647
- value: inlineFlag
648
- });
652
+ if (INLINE_EVAL_INTERPRETERS.has(cmd)) {
653
+ const inlineFlag = server.args.find((a) => INLINE_EXEC_FLAGS.has(a));
654
+ if (inlineFlag) {
655
+ reason = reason ?? `Server runs an inline command via ${command} ${inlineFlag}.`;
656
+ evidence.push({
657
+ type: "config",
658
+ path: server.sourceConfigPath,
659
+ key: "args",
660
+ value: inlineFlag
661
+ });
662
+ }
649
663
  }
650
664
  if (evidence.length === 0) return [];
651
665
  return [
@@ -1860,7 +1874,7 @@ function renderSarif(summary) {
1860
1874
  }
1861
1875
 
1862
1876
  // ../../packages/report-renderer/src/logoBase64.ts
1863
- var LOGO_REPORT_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAADAFBMVEX+/v7+/v3VAADbChn+///9/f39+/v////+/f3+/Pz9/PzYAAraChn+/f7++/zWAADXAAfbDRzXAAraCxn9+vvbDBv9+vrZARHaDh3YAA7aCxvaDRz87O7bDhzZAQ/fKDXZBhTXAA3bEB/XAAX99vfcGCbaAxLaBhXYAAj9+fnnXmfZBQ/aCRb9/f7bChnZBBTaDRrfJTHZAA387u7eIC763+DcFiL519r41tjYAA3wnKLxqK3YAAvWAAbiPUjcEyD9+Pn76evZAxDZBRP3ys3pcXnnY2zkS1b//v776+zcGSbiO0biRE/ulJvqcnvXAALjQk39/v7tipHZCRj++vvaCRj+/P3qdn7pbXXcFCL75+noanPUAADkUlzxpqzoZ3D76Or409bYAAz2xsn53d/++vr3yczyrbH41NfnYmzfKjb52NrlVWD++PjmYGjWAAPyqq/dIy/86uzsgIfZCBbWAALaDhnkTVjiPUnyr7P89PXiQEzYAAPkRlL2xMjlU17hOUX1wcX2x8rtjJLjSVTpb3jcDh3lTFfgMT30trvsgorlUVzqe4Ppa3P0ub3siZDtjpTZAArth43ztLjre4P64eT75ebdJDHaExvvkZjeJDD98vPdHyz++frreIDtjJPvmaD5293qd3/vmqDnY23fMz/rfYbnYGraFiLmX2jdGyfaFh/gLTnkUVvnZW740dPhPUjpbnbumJ7reYL87u/hOUTiSVLlVmHbEB753N/fLzzcER/eLDbiQEr64OL88PH52dvnaHHXAAnbCRn0vcHzsrb+//7zsbbjUFfwpKnjTFLrdn71ur7lW2X++fr89fbqdH398/PztbndHivzrbP0trzuipHwnqT3ztH75ujwo6jgNUHyqq/52tzwoabtjpX2zND//f7vkpjqfYTeMz3vlZv1vMDdJjTdJzPnXWjzsrfdIi3tjJXzsrnqdHzhOEL1vMHkVWDZEB7ulZvVAALnbXXaFiTdGCbtkpnWAQr99fXZDBbshIv1wcblWGPhP0ryJPiiAAAACXBIWXMAAAsSAAALEgHS3X78AAAEpUlEQVRIx41WB1QUVxSdnf0798/u4hbqsouURYrAAQkR6bjUpYurBBQFg6DYIFgCBhRL7L1jj6iADdTYY0mvJ72YnPQeU000MYkxw4ZDwB0W35wz55+ZV+79/857wzA9TcaEdK8YRsLYsRHC1W0hzAgZZbqDRcw2lyXRTnZq84TDR3tgkTH9WLcDT05u2fEQ4Xs/p31X5HBFrZ4Mjt5Teoa64I8ZmXd+2w0nagd2dxDPIfpWwuWzLbHHwcnvzmbjT10csPbWX7cvljXM1q4B40QldjfVSQ5D86xDjdPOXfizoWXWt2bwTg72mIB+56laenl7u6sp89Le/ew3tRR9HoGMEt+KemNQjiXy8MCZwa6Vw+hjQXFZFa8SKutypN3grazkOBvsPa8U+6576drzooLdjmPSae+wYeBtklvXlJK6r88hea7WpPAs21SpMGnby8n+al8iE6fBJZISn0xfT6PGM6WIkJLXKvXGLYHtCZtJIifOOB3L2Y3m82ED18Mil3NYo3MvvPq5qgbp6XdroRMSX5U91dhm+HKds1dCKXieRBZ6eaz77GSb8ZfscYTa6IFhnshNqr8YmRGqdFM8gAEcFj+pcfQfNOX+eq8ZP4G3lTjJcjtGGiNM7k9JQyMMhBiaQh1HOSdVNyK58GHRgLk+6TlqL41SKpX6LQOednUUVhovdUpixuM2ATJrQOCcCR6mkXqlR0A+kB+ll2pG6dyi0uoGzRevcJ47bYxfaQr393BdBYyJOuM/wXTiTu483wzxgDwf7h/Verw8p9BP9SLB82OTbqatxt/sPN/OChImRCahXTslk1hJn+GO/G4mDMqeWTuOkJiFz5XhUzI8I833Zry1gqSHvCmlmONYl1oLjnNhAEGiwu1ZF4sctdMvXT/VG5L13DgcDDd0HAXHAwPMBobcZ5YDcidcuVHi3WrLQeaCA4+UZrNfwbLgpUVbXiGYHLGoYMFE/Mz+OomtAdf7y5R0VhinimlQDb66IlRhiksjKJ5hig1dUdKqul3FxnQGSHoIXJAvjymxq8xuGUMCpGFuusFAqtZHo1Q0tfkYxnuX2kJiKHE5fG3nEkWwcNRh2gJgpVavlDoHK5YEVlfyRKTNcDiRWx4T+6hSKagvGnhB5y6oxENRlazaCLEPgscxReu0piRnqaC5ZGCY80ip1NlvyLTWCe+JIOoEhSPasugAvdLddWmg0L/jB7pLNQHRe72LIbf1ttJuCJjqEK/ThymWg3PCQoVGr8scPVX9oEiA5L+uMV71RmTYTP+hZeBHY3OGv9SxdAM7XhyQFVPRm0OHv69z3YZAygRin1/4u+aWHUXos4tzeFudhwNxg8vBy/FJs3oXyVKvhqV3O6b/y1BmQT6bisXszI+BbEd2DI6O3Q3OzqijctLBpuBHtbZimc7YgQL2RheBviYqpfx0Ngc1xmueubsE/+kWGe1nztGJzQKqPUGKbbjCHtzJ0P4mI09pzthTEzdUORSzKTzlmX6N8vg+7sKmki9mvYPRlLkHE4boD1u3Hpr9VtcY7T9IGKMfzv9gCuwPq17Tl8Pr2+3tvyh1eZ8vHWz+PCRdnUTM/gUe0BB8YRiSMgAAAABJRU5ErkJggg==";
1877
+ var LOGO_REPORT_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAKdElEQVRo3u1aeXAT1xlf35cs2bJ8yJYtbGxjG+rgkJCjdaBMSYBAhstAhwSYZDJ105CGnBwNSUlKmibNJDR0GJrJQELb1C2kgQ6dtJwFAgFyTAB7tVpprdvyjW3Zkvb4+r2nAzVtZ/qHhO2ZLrOjZd/bx/f73u87Hwzz/+u/X8AwSeSezABSgJmVNikFJ7+m3PINnLq8NfbdpKAN+f1So8kTVAarNbfM9YWqpDB2bFJo36Iu32tP14EDb4umYh9510YpNYFBoHCp5JfTGTc5GA103vU9qbN5gWTHZ0tB1WYydhLnTDgQRKCTYeHZwurHhLRC4HVTZD/LKX7eqpiLqmQhTQfmgsofRUC8yDDJE0H2pFhacAVVzwtIGXNOsTxy6qwS7LRDwCLAyJlPFbNKL9sQBKub8sI3QY+jiwxp0W5o0Jq0Vb91JuUBX2CURk6eUZQxPwgzm8E64w6QfT4EcV7hdZWSMxnnaCvbWH2tLrxOctt4eiizvnYpn1NmcTLZ0Nl4t0hoIw8Ng+2ehWBKzgdTSj7Yvn0vSIPXwc/xSmfTd0Qy15xTKphLqlvGxR44pjqD05St4LJLT9iIsabrlK4nt0iKKIG/gwNhxl3A4m6YMouAyyqmQKwNs8HfzoIiy+B9drskZOgUG6MGNlt/ukNTtlJgjJkRWiZM8IjhsZqKSkd26ag7txycyx6Sxr6+KgNeA3v3AZdXAaaMQmBRONs9C8A+bwk+5wKXWQycphz697xHpsLYlQ7ZuWKd5FYZwJZTOnxFa6yPUCrhQepqwxwVarjdOWsukUUeu/g52Ocuhg4mh1KGRYpY62+HgLUTgjYHCA130HcsjpE5tuaFMPrZZUDUsvPO+fhOY/bMfzAnocGOGNpVhkmnQapyRjHL5PW65iwC0TeqWOtvQyHSwZxrAKHudvBu2gqixwsKoiO36O2G7mdeAKF+NnA4h8y11MwEyR9QXN8lwNU9jurZBqoc/DcSZtQR7VhLan9mYzLAu/WnstjTA3y+EThVKZiYPOh99ZeUIooogixJoRufydX72lu4E3k4twy9VRUEPV3g3fYyBroM6CyZ9mosTePOffQaq0xq/UY2u/SQBenAl9UqYm8fDOz+DQqeg9ovA1N6IQlW4L/aHgKBwtMbnwNo3GZdVWiOuhy/yYaBXXtA7OsHS9k0wDUVdAqHTGrDRlOO4ftxoVPsAi5V6YnBHAO4NBWSY/5SOSjYqMfh9bVgwgDFZeuRHuWU696Nz4Z34Yb2vU9uRqpkUZpxOaXApRcBX1ILAZaDINqK/d7lijvPKA2gUbtVZefiYtCxAFDIY47iGhj78usA0ajv9DmwVjZSo+VyysCcpUffrgdTqo6+l3B3ojaAWrZWN9ExKnxWCZiRRqbUArBMvQV8p85SkL4LlwLOiukITncm7gDY5PwTbkMDKIoieZ/ahtrMoO6SahS1b47eKGCKFoaP/h0i18jx0xgLtFR4c+xc/Jas0cFk4g5tQXc2JnVV34pz884lAID2hAcBoOeQnA+sQaqokMsGYDE1MKFGuQgQNaFRJvT94u0oAPJMYwHSw0xAkLn4DZusprGBjDnvXwXSyEgYgDb+ALhk7fGu8umE05Jr9cOotTSwNy+A7m0vI40QBBEQeW0mAiXlg/exp6MAPPhMhDRrKugcAp5NzYPuLTvAhq64A9Mq18p1IPl8CKApQQBStcc9BgQQDEquNY9AOw73hV2m728nwLVkDfCFU4FL09Ixx+LllP/kcixdDejf0QMVgLmwGsdWwcgnx0Ou9ZXX4RqORQFMRQApCQGgO+Ypa8AdCErOZWvBgh5E7OkNGaoSEpVE3uHDR6HvzXdg8Hd/jBrx4IcHoe+NXTD88VE6h16yEjLw7h7qyQgoaXRUclfeQmzoH3FLKyIg0IN87CmZBuLwsOR+5HEYOnQkJAcJWOQOBqNAIhf5+7+9wz90bjjQkWvooyPg2tAK4uCgRByFKa3gaNwARMK6Ob14X7fGCGJvr+h94nnwPPpEFIASFiTi+0mAE3v7QwCIlvv76Ts5Zh6N0MFQjPC0PgUejB3Brm7Jie4VM9j347kDtGrC7sIrXiwVx65cE/t/tZfy1nfsVEhoFGT0/EXoeW47OBauBB557Fr7aNQG3A8/DpYpjeBY1ALdOIfMVXAXqP0cO03X6seIPnrlmuQk9bOmfEes8uLSZbAXVa/txEg6+Ps/yaNnL1BD9az7AYjuLnAtexDQRsIZpwbHMsFxf0sUgHPFQ/guhXoelmSsGLnJN2JXN7jXt9K1fGc+xbUPSS70UILOuCZuvaTINrprmuo5JjtI0gQ0XgUbVmh800CovRWFyqL+ncN8KOTX1eBGcFE3ijbTQaqwPGM08NGUu3om5lR1YM4n1OxTvEgljCFjjsoZjXE34qstLel8Uv4XHqysJL9fdi1eTYXgsopionEJBUGEJVSJXCRWkDqAi43auZTrdA0X8UC4pnvGncAzmq/a2tpSEtKs6sw17PRgkPKdvyhdR9dI6MDjTtBELnKHE7rBd/dHAQwe+AO+09A0+l/SDnVo7lDbRzBy4RLSB8tTjWFn3Pj/TRo5jQ0zeSY74EHeYt6iWGuaaEJGEjMiUGyiNvrZ51EA/mtsKN3OihGegMFvrUhBspZ7XSuYmWy/raJuVkJKy2gxk1lyyIUC+M0WaeDd9yn/I9QgGiYFfGdTM8iBQDQOEJ9P0g5TeBdCFCqn3w7iGmMmXnJhEtiZrT+YsLIyohGLvr7ZwqhE16r1GJFkxd58HzVaCgK1TCjRu+O1G0Eu7OtJJCZj1F7wJt/Ysd0CkqQ4V64HsqZJX9Oc0MI+srCQa9jrRm0OHfmrGOgwoUBYTpKuQwYWKUVVtBt3oyKjDQsQnS7gS2swmSsM0U2Fu3ilHa4fPioS7pM1b1pXQjA2lAipOqvDUA+BLq98/YMPqUZNaOD9b+8JaZ9QCHtAhELkOdp2SSlAKqlg8L0DEPR2yzZcA9fi2yvq9DelBR9tnxfXLRYYteyYt4SoWOnZvpMGMOL/ScsksgOR9GH08lcYDzbS4qVn80ukpaLY5j2gWBm1xJfULEq49v9TfmTRVm4lkdOz4YeU6N4fb6ZpgQljQ9+bu6NeqP8dLPyx3CRjXeE6AYMbthixKNJWbhmXE5yoUedX/NqDgmCCR5Ob7md+QrVMAtfQwcMwgqUloRfpBXk3PgfhOUE3juPBx56EtVL+1xPItpaWFHSJBzwoEO5AkNLppZ+HmldV36IdOlJxEdqQMe/TRHgV8JryAyfnzCGJ4vidZEZAnGTmpPKaiv0ERJhOysDe/cCma7C8xP7PW9Swla7WTVTzGL0/uDyLnl6O/zEsEYBQABhI4jXGXU4U0HnfckkKBOThv3yCacKfMVzIsmvZWnSXGAfyp+wG3LUJdYYcFibUucazMIFRyY7GuxW/zS4FPF2S/ba5ikAMVjd1W8R+JuJhX1LEO+Hpy1ILo+l1ldaBGzsZPJPbz+qmrposJ5UhF1vaWMum6y5g5L0kGKfXT7bDbkonL54jcNWz1XFPj2/GRQz7xTDXYYIcqU7I/63yT1NyvbeodjVcAAAAAElFTkSuQmCC";
1864
1878
 
1865
1879
  // ../../packages/report-renderer/src/renderHtml.ts
1866
1880
  function esc(value) {
package/logo-mark-128.png CHANGED
Binary file
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "calllint",
3
- "version": "0.3.0-preview.1",
3
+ "version": "0.3.0-rc.0",
4
4
  "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
5
5
  "keywords": [
6
6
  "mcp",