cbrowser 18.37.1 → 18.38.0

package/dist/mcp-tools/base/security-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp-tools/base/security-tools.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA0B7D"}
+{"version":3,"file":"security-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp-tools/base/security-tools.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAsH7D"}

package/dist/mcp-tools/base/security-tools.js

@@ -10,11 +10,15 @@ import { securityAuditHandler, } from "mcp-guardian";
  * Register security tools (1 tool: security_audit)
  */
 export function registerSecurityTools(server) {
-    server.tool("security_audit", "Audit MCP tool definitions for potential prompt injection attacks. Scans tool descriptions for cross-tool instructions, privilege escalation attempts, and data exfiltration patterns. Returns detailed report of any security issues found.", {
+    server.tool("security_audit", "Audit MCP tool definitions for potential prompt injection attacks. Scans tool descriptions for cross-tool instructions, privilege escalation attempts, and data exfiltration patterns. Works with: local config file (Claude Desktop), remote MCP URL (Claude.ai connectors), or self-scan of current server.", {
         config_path: z
             .string()
             .optional()
-            .describe("Path to claude_desktop_config.json. If not provided, scans the current CBrowser server's tools."),
+            .describe("Path to claude_desktop_config.json (Claude Desktop). If omitted, use mcp_url or self-scan."),
+        mcp_url: z
+            .string()
+            .optional()
+            .describe("URL of a remote MCP server to scan (e.g., 'https://demo.cbrowser.ai/mcp'). Fetches tool manifest directly — works from Claude.ai without a config file."),
         format: z
             .enum(["json", "text"])
             .optional()
@@ -26,7 +30,86 @@ export function registerSecurityTools(server) {
             .default(false)
             .describe("If true, connects to MCP servers to scan their tools (slower but more accurate)."),
     }, async (params) => {
-        return await securityAuditHandler(params);
+        const { mcp_url, ...baseParams } = params;
+        // v18.35.0: Support scanning remote MCP servers by URL
+        // Fetches the tool manifest via MCP initialize + tools/list, then passes
+        // the tool definitions directly to mcp-guardian for scanning
+        if (mcp_url) {
+            try {
+                // Connect to remote MCP server and fetch tool list
+                const initResponse = await fetch(mcp_url, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({
+                        jsonrpc: "2.0",
+                        id: 1,
+                        method: "initialize",
+                        params: {
+                            protocolVersion: "2024-11-05",
+                            capabilities: {},
+                            clientInfo: { name: "cbrowser-security-audit", version: "1.0" },
+                        },
+                    }),
+                });
+                // Parse SSE response
+                const initText = await initResponse.text();
+                const initData = initText.split("\n").find(l => l.startsWith("data: "));
+                if (!initData)
+                    throw new Error("No response from MCP server");
+                // Fetch tool list
+                const toolsResponse = await fetch(mcp_url, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({
+                        jsonrpc: "2.0",
+                        id: 2,
+                        method: "tools/list",
+                        params: {},
+                    }),
+                });
+                const toolsText = await toolsResponse.text();
+                const toolsData = toolsText.split("\n").find(l => l.startsWith("data: "));
+                if (!toolsData)
+                    throw new Error("No tools/list response from MCP server");
+                const parsed = JSON.parse(toolsData.replace("data: ", ""));
+                const tools = parsed.result?.tools || [];
+                if (tools.length === 0) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: "No tools found at " + mcp_url, suggestion: "Verify the URL is a valid MCP endpoint" }, null, 2),
+                            }],
+                    };
+                }
+                // Map to mcp-guardian's ToolDefinition format
+                const toolDefs = tools.map((t) => ({
+                    name: t.name,
+                    description: t.description || "",
+                    inputSchema: t.inputSchema || {},
+                }));
+                // Pass tools directly to handler
+                const options = {
+                    format: baseParams.format,
+                    tools: toolDefs,
+                    serverName: new URL(mcp_url).hostname,
+                };
+                return await securityAuditHandler(options);
+            }
+            catch (err) {
+                return {
+                    content: [{
+                            type: "text",
+                            text: JSON.stringify({
+                                error: `Failed to scan remote MCP server: ${err instanceof Error ? err.message : String(err)}`,
+                                mcp_url,
+                                suggestion: "Verify the URL is reachable and returns valid MCP responses. Example: https://demo.cbrowser.ai/mcp",
+                            }, null, 2),
+                        }],
+                };
+            }
+        }
+        // Original behavior: config_path or self-scan
+        return await securityAuditHandler(baseParams);
     });
 }
 //# sourceMappingURL=security-tools.js.map

package/dist/mcp-tools/base/security-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-tools.js","sourceRoot":"","sources":["../../../src/mcp-tools/base/security-tools.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oBAAoB,GAErB,MAAM,cAAc,CAAC;AAEtB;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiB;IACrD,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,8OAA8O,EAC9O;QACE,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,iGAAiG,CAClG;QACH,MAAM,EAAE,CAAC;aACN,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACtB,QAAQ,EAAE;aACV,OAAO,CAAC,MAAM,CAAC;aACf,QAAQ,CAAC,2DAA2D,CAAC;QACxE,UAAU,EAAE,CAAC;aACV,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CAAC,kFAAkF,CAAC;KAChG,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,OAAO,MAAM,oBAAoB,CAAC,MAA6B,CAAC,CAAC;IACnE,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"security-tools.js","sourceRoot":"","sources":["../../../src/mcp-tools/base/security-tools.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oBAAoB,GAErB,MAAM,cAAc,CAAC;AAEtB;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiB;IACrD,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,+SAA+S,EAC/S;QACE,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,4FAA4F,CAC7F;QACH,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,yJAAyJ,CAC1J;QACH,MAAM,EAAE,CAAC;aACN,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACtB,QAAQ,EAAE;aACV,OAAO,CAAC,MAAM,CAAC;aACf,QAAQ,CAAC,2DAA2D,CAAC;QACxE,UAAU,EAAE,CAAC;aACV,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CAAC,kFAAkF,CAAC;KAChG,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;QAE1C,uDAAuD;QACvD,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,mDAAmD;gBACnD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;oBACxC,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,CAAC;wBACL,MAAM,EAAE,YAAY;wBACpB,MAAM,EAAE;4BACN,eAAe,EAAE,YAAY;4BAC7B,YAAY,EAAE,EAAE;4BAChB,UAAU,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,KAAK,EAAE;yBAChE;qBACF,CAAC;iBACH,CAAC,CAAC;gBAEH,qBAAqB;gBACrB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxE,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBAE9D,kBAAkB;gBAClB,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;oBACzC,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,CAAC;wBACL,MAAM,EAAE,YAAY;wBACpB,MAAM,EAAE,EAAE;qBACX,CAAC;iBACH,CAAC,CAAC;gBAEH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;gBAC7C,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC1E,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBAE1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;gBAEzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,OAAO;wBACL,OAAO,EAAE,CAAC;gCACR,IAAI,EAAE,MAAe;gCACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,EAAE,UAAU,EAAE,wCAAwC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;6BAC/H,CAAC;qBACH,CAAC;gBACJ,CAAC;gBAED,8CAA8C;gBAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAgE,EAAE,EAAE,CAAC,CAAC;oBAChG,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;oBAChC,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;iBACjC,CAAC,CAAC,CAAC;gBAEJ,iCAAiC;gBACjC,MAAM,OAAO,GAAgC;oBAC3C,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,KAAK,EAAE,QAAQ;oBACf,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ;iBACtC,CAAC;gBAEF,OAAO,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,CAAC;4BACR,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gCAC9F,OAAO;gCACP,UAAU,EAAE,oGAAoG;6BACjH,EAAE,IAAI,EAAE,CAAC,CAAC;yBACZ,CAAC;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,OAAO,MAAM,oBAAoB,CAAC,UAAyC,CAAC,CAAC;IAC/E,CAAC,CACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cbrowser",
-  "version": "18.37.1",
+  "version": "18.38.0",
   "type": "module",
   "description": "Cognitive browser automation that thinks like your users—and helps AI agents navigate too. Simulate real user cognition with abandonment detection, constitutional safety, chaos engineering, and UX friction discovery. Sites that pass CBrowser's cognitive tests are easier for both humans and AI agents to navigate.",
   "main": "dist/index.js",