calllint 0.9.1 → 0.9.2

package/dist/index.js

@@ -4669,18 +4669,221 @@ function analyzePayment(descriptor) {
 }
 function analyzeRegistration(descriptor) {
   const findings = [];
+  const metadata = descriptor.metadata || {};
+  const serviceVerified = metadata.service_verified;
+  if (serviceVerified === false) {
+    findings.push({
+      id: "action.unverified-service",
+      title: "Unverified service registration",
+      severity: "high",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S3",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.service_verified",
+        value: "false"
+      }],
+      impact: "Account registration on unverified service",
+      fix: "Verify the service domain and reputation before registering"
+    });
+  }
+  const scopes = metadata.oauth_scopes || [];
+  const dangerousScopes = ["admin", "delete_account", "financial_data", "admin:org"];
+  const foundDangerous = scopes.filter(
+    (s) => dangerousScopes.some((d) => s.toLowerCase().includes(d.toLowerCase()))
+  );
+  if (foundDangerous.length > 0) {
+    findings.push({
+      id: "action.excessive-oauth-scopes",
+      title: "Excessive OAuth scopes requested",
+      severity: "medium",
+      blocker: false,
+      symbol: "SECRETS",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.oauth_scopes",
+        value: foundDangerous.join(", ")
+      }],
+      impact: `Registration requests sensitive scopes: ${foundDangerous.join(", ")}`,
+      fix: "Request only the minimum necessary OAuth scopes"
+    });
+  }
   return findings;
 }
 function analyzeGitHub(descriptor) {
   const findings = [];
+  const metadata = descriptor.metadata || {};
+  const repoVerified = metadata.repository_verified;
+  if (repoVerified === false) {
+    findings.push({
+      id: "action.unverified-repository",
+      title: "Unverified repository target",
+      severity: "medium",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S3",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.repository_verified",
+        value: "false"
+      }],
+      impact: "GitHub write operation to unverified repository",
+      fix: "Verify repository ownership before writing"
+    });
+  }
+  const scopes = metadata.oauth_scopes || [];
+  const dangerousScopes = ["delete_repo", "admin:org", "admin:repo_hook"];
+  const foundDangerous = scopes.filter(
+    (s) => dangerousScopes.some((d) => s.toLowerCase().includes(d.toLowerCase()))
+  );
+  if (foundDangerous.length > 0) {
+    findings.push({
+      id: "action.excessive-github-scopes",
+      title: "Excessive GitHub OAuth scopes",
+      severity: "medium",
+      blocker: false,
+      symbol: "SECRETS",
+      riskClass: "S3",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.oauth_scopes",
+        value: foundDangerous.join(", ")
+      }],
+      impact: `GitHub operation requests dangerous scopes: ${foundDangerous.join(", ")}`,
+      fix: "Request only necessary OAuth scopes for the operation"
+    });
+  }
+  const externalLinks = metadata.external_links || [];
+  if (externalLinks.length > 0) {
+    findings.push({
+      id: "action.external-links",
+      title: "External links in GitHub content",
+      severity: "low",
+      blocker: false,
+      symbol: "NETWORK",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "medium",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.external_links",
+        value: externalLinks.join(", ")
+      }],
+      impact: `Issue/PR contains external links: ${externalLinks.length} found`,
+      fix: "Review external links for safety"
+    });
+  }
   return findings;
 }
 function analyzeNpmPublish(descriptor) {
   const findings = [];
+  const metadata = descriptor.metadata || {};
+  const params = descriptor.parameters || {};
+  const similarTo = metadata.similar_to_popular || [];
+  if (similarTo.length > 0) {
+    findings.push({
+      id: "supply.name-squatting",
+      title: "Potential name squatting",
+      severity: "high",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S3",
+      mode: "INFERRED",
+      confidence: "medium",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.similar_to_popular",
+        value: similarTo.join(", ")
+      }],
+      impact: `Package name similar to popular packages: ${similarTo.join(", ")}`,
+      fix: "Verify this is not a typosquatting attempt"
+    });
+  }
+  const versionPinned = metadata.version_pinned;
+  const versionRange = metadata.version_range;
+  if (versionPinned === false || versionRange === true) {
+    findings.push({
+      id: "supply.version-float",
+      title: "Version not pinned",
+      severity: "medium",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "parameters.version",
+        value: String(params.version || "unknown")
+      }],
+      impact: "Publishing with floating version range instead of pinned version",
+      fix: 'Use pinned version (e.g., "1.2.3" not "^1.2.3")'
+    });
+  }
   return findings;
 }
 function analyzeCloud(descriptor) {
   const findings = [];
+  const metadata = descriptor.metadata || {};
+  const monthlyCost = metadata.estimated_monthly_cost;
+  if (typeof monthlyCost === "number" && monthlyCost > 1e3) {
+    findings.push({
+      id: "action.expensive-cloud-resource",
+      title: "Expensive cloud resource",
+      severity: "high",
+      blocker: false,
+      symbol: "MONEY",
+      riskClass: "S5",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.estimated_monthly_cost",
+        value: String(monthlyCost)
+      }],
+      impact: `Cloud resource estimated at $${monthlyCost}/month`,
+      fix: "Verify cost estimate and budget before creating"
+    });
+  }
+  const opensAllPorts = metadata.opens_all_ports;
+  if (opensAllPorts === true) {
+    findings.push({
+      id: "action.insecure-security-group",
+      title: "Insecure security group configuration",
+      severity: "high",
+      blocker: false,
+      symbol: "NETWORK",
+      riskClass: "S4",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence: [{
+        type: "config",
+        path: "metadata.opens_all_ports",
+        value: "true"
+      }],
+      impact: "Security group opens all ports to the internet (0.0.0.0/0)",
+      fix: "Restrict ports and source IPs to minimum necessary"
+    });
+  }
   return findings;
 }
 function analyzeSecretShapedHeaders(descriptor) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",