ccs-mcp-server 1.3.0 → 1.4.0

package/dsh/injection.js

@@ -0,0 +1,75 @@
+/**
+ * @file Prompt injection detection — identifies injection attempts in tool inputs.
+ *
+ * Detects patterns commonly used in indirect prompt injection:
+ *  - "ignore previous instructions" / "disregard" / "forget"
+ *  - Role override ("you are now", "system:")
+ *  - Instruction leakage ("reveal your system prompt")
+ *  - Markup/comment-based injection in fetched content
+ *  - Encoded/obfuscated injection attempts
+ */
+
+const INJECTION_PATTERNS = [
+  // Direct instruction override
+  { pattern: /\b(?:ignore|disregard|forget|override)\b.{0,40}\b(?:previous|prior|above|all)\b.{0,20}\b(?:instruction|prompt|rule|system|context)/i, weight: 5, label: 'instruction override' },
+  { pattern: /\b(?:ignore|disregard|forget)\b.{0,20}\b(?:all|previous|prior|above)/i, weight: 4, label: 'instruction override attempt' },
+
+  // Role/system override
+  { pattern: /\b(?:you are now|you're now|new (?:persona|role|identity)|act as|pretend (?:to be|you are))\b/i, weight: 4, label: 'role override attempt' },
+  { pattern: /\b(?:system|assistant|developer)\s*:\s*(?:you|ignore|new|override|do not)/i, weight: 4, label: 'fake role marker' },
+  { pattern: /\[(?:SYSTEM|ADMIN|OVERRIDE|INSTRUCTION)\]/i, weight: 5, label: 'fake system/override tag' },
+
+  // Prompt exfiltration
+  { pattern: /\b(?:reveal|show|print|leak|expose|dump|output|repeat)\b.{0,30}\b(?:system|initial|original|developer|hidden)\b.{0,20}\b(?:prompt|instruction|message|rule)/i, weight: 5, label: 'prompt exfiltration attempt' },
+  { pattern: /\b(?:what are|what were|tell me)\b.{0,20}\b(?:your|the)\b.{0,20}\b(?:instruction|rule|system prompt|developer message)/i, weight: 3, label: 'prompt probing' },
+
+  // HTML/XML comment injection (in fetched web content)
+  { pattern: /<!--[\s\S]{0,200}(?:ignore|system|instruction|assistant|secret|password|token|key)/i, weight: 3, label: 'hidden comment injection' },
+  { pattern: /<(?:script|meta|template)[^>]*>[\s\S]{0,200}(?:ignore|instruction|system|assistant)/i, weight: 3, label: 'markup-based injection' },
+
+  // Markdown image-based exfiltration
+  { pattern: /!\[[^\]]{0,100}\]\s*\(\s*https?:\/\/[^\s)]{10,}/i, weight: 2, label: 'markdown image (potential data exfil via URL)' },
+
+  // Unicode/bidi tricks
+  { pattern: /[\u200b-\u200f\u202a-\u202e\u2066-\u2069]/, weight: 2, label: 'invisible/override Unicode character' },
+
+  // Base64-encoded instructions
+  { pattern: /(?:decode|base64|atob|btoa)\s*\(?['"`][A-Za-z0-9+/=]{20,}/i, weight: 3, label: 'encoded payload reference' },
+
+  // Social engineering urgency
+  { pattern: /\b(?:urgent|emergency|critical|immediately)\b.{0,30}\b(?:must|need to|have to|do it now|no questions)/i, weight: 1, label: 'urgency/social engineering' },
+];
+
+/**
+ * Scan text for prompt injection patterns.
+ * @param {string} text - the text to scan.
+ * @param {object} [opts]
+ * @param {number} [opts.threshold=6] - total weight to trigger block.
+ * @returns {{ score: number, hits: Array<{label: string, weight: number, snippet: string}>, blocked: boolean, reason?: string }}
+ */
+export function detectInjection(text, opts = {}) {
+  if (!text || typeof text !== 'string') return { score: 0, hits: [], blocked: false };
+
+  const threshold = opts.threshold ?? 6;
+  const hits = [];
+  let score = 0;
+
+  for (const { pattern, weight, label } of INJECTION_PATTERNS) {
+    pattern.lastIndex = 0;
+    const match = pattern.exec(text);
+    if (match) {
+      score += weight;
+      const start = Math.max(0, match.index - 20);
+      const end = Math.min(text.length, match.index + match[0].length + 20);
+      hits.push({ label, weight, snippet: text.slice(start, end).trim() });
+    }
+  }
+
+  const blocked = score >= threshold;
+  return {
+    score,
+    hits,
+    blocked,
+    reason: blocked ? `prompt injection detected (score ${score} ≥ ${threshold}): ${hits.map(h => h.label).join(', ')}` : undefined,
+  };
+}

package/dsh/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "agent-runtime-guard-dsh-plugin",
+  "private": true,
+  "type": "module"
+}

package/dsh/policy.js

@@ -0,0 +1,359 @@
+/**
+ * @file CCS policy engine — combines all detectors into a unified decision.
+ *
+ * The 7 CCS dimensions enforced at runtime:
+ *  1. Structure  — tool call arguments match declared JSON Schema
+ *  2. Schema     — input/output types are well-formed
+ *  3. Latency    — call duration within budget (observability only)
+ *  4. Cost       — token/API cost within budget (observability only)
+ *  5. Identity   — caller and tool identity are known and trusted
+ *  6. Integrity  — no prompt injection, no credential exfiltration
+ *  7. Security   — no SSRF, command injection, path traversal, destructive ops
+ */
+
+import { validateFetchUrl } from './ssrf.js';
+import { scanForSecrets, isCredentialPath, scanSubprocessForCredentials } from './credentials.js';
+import { detectInjection } from './injection.js';
+import { inspectSpawn } from './cmdi.js';
+
+/** Default policy configuration. */
+export const DEFAULT_POLICY = {
+  // Dimension 7: Security
+  ssrf: { enabled: true, allowPrivate: false },
+  commandInjection: { enabled: true, threshold: 6 },
+  credentialExfil: { enabled: true },
+  pathTraversal: { enabled: true, blockedPaths: ['/etc/shadow', '/etc/passwd', '/etc/sudoers'] },
+  destructiveTools: {
+    enabled: true,
+    // Tool names that require explicit approval (case-insensitive substring match)
+    requireApproval: [
+      'execute_payment', 'pay', 'transfer', 'send_transaction',
+      'delete', 'drop', 'truncate', 'destroy', 'rm',
+      'deploy', 'apply', 'push', 'merge',
+      'revoke', 'disable', 'shutdown', 'terminate',
+    ],
+  },
+
+  // Dimension 6: Integrity
+  promptInjection: { enabled: true, threshold: 6 },
+
+  // Dimension 5: Identity
+  requireToolAnnotations: { enabled: false }, // warn-only by default
+
+  // Observability (dimensions 3, 4)
+  latencyBudgetMs: 30000,
+  costBudgetTokens: 100000,
+
+  // Output scanning
+  scanOutput: { enabled: true, maxScanLength: 100000 },
+
+  // Allowlist for safe tools (skip deep scanning)
+  safeToolAllowlist: [],
+};
+
+/**
+ * Deep-merge user config with defaults.
+ */
+function mergeConfig(defaults, user) {
+  if (!user) return structuredClone(defaults);
+  const out = structuredClone(defaults);
+  for (const [k, v] of Object.entries(user)) {
+    if (v && typeof v === 'object' && !Array.isArray(v) && k in out && typeof out[k] === 'object') {
+      out[k] = mergeConfig(out[k], v);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
+/**
+ * Check for path traversal in string arguments.
+ */
+function checkPathTraversal(args, blockedPaths) {
+  const findings = [];
+  const seen = new WeakSet();
+
+  function walk(val) {
+    if (typeof val === 'string') {
+      // Directory traversal
+      if (val.includes('../') || val.includes('..\\')) {
+        // Check if it targets a blocked absolute path
+        for (const blocked of blockedPaths) {
+          if (val.includes(blocked) || val.endsWith(blocked)) {
+            findings.push(`path traversal targeting ${blocked}: ${val.slice(0, 100)}`);
+          }
+        }
+        // Even without a specific target, flag obvious traversal
+        if (/\.\.\/(?:etc|root|home|var|usr|proc|sys)\//.test(val)) {
+          findings.push(`directory traversal to system path: ${val.slice(0, 100)}`);
+        }
+      }
+      // Absolute sensitive paths
+      if (/^\/(?:etc\/shadow|etc\/passwd|etc\/sudoers|root\/\.ssh)/.test(val)) {
+        findings.push(`direct access to sensitive path: ${val}`);
+      }
+    } else if (val && typeof val === 'object') {
+      if (seen.has(val)) return;
+      seen.add(val);
+      if (Array.isArray(val)) val.forEach(walk);
+      else Object.values(val).forEach(walk);
+    }
+  }
+
+  walk(args);
+  return findings;
+}
+
+/**
+ * Determine whether a tool name matches the destructive list.
+ */
+function isDestructive(toolName, requireApproval) {
+  const lower = toolName.toLowerCase();
+  return requireApproval.some(d => lower.includes(d.toLowerCase()));
+}
+
+/**
+ * Evaluate a tool call against the CCS policy.
+ *
+ * @param {object} call - { name, arguments, agent? }
+ * @param {object} [userConfig] - policy overrides.
+ * @returns {Promise<{ allow: boolean, reason?: string, warnings: string[], dimension: string }>}
+ */
+export async function evaluateToolCall(call, userConfig) {
+  const config = mergeConfig(DEFAULT_POLICY, userConfig);
+  const warnings = [];
+  const { name, arguments: args } = call;
+
+  // Skip deep scanning for allowlisted safe tools
+  if (config.safeToolAllowlist.includes(name)) {
+    return { allow: true, warnings, dimension: 'allowlist' };
+  }
+
+  // Dimension 7: Destructive tool check
+  if (config.destructiveTools.enabled && isDestructive(name, config.destructiveTools.requireApproval)) {
+    return {
+      allow: false,
+      reason: `[CCS/Security] destructive tool "${name}" requires explicit human approval (auto-approve is blocked by CCS policy)`,
+      warnings,
+      dimension: 'Security',
+    };
+  }
+
+  // Scan string arguments for various threats
+  const argStrings = [];
+  const seen = new WeakSet();
+  function collectStrings(val) {
+    if (typeof val === 'string') argStrings.push(val);
+    else if (val && typeof val === 'object') {
+      if (seen.has(val)) return;
+      seen.add(val);
+      if (Array.isArray(val)) val.forEach(collectStrings);
+      else Object.values(val).forEach(collectStrings);
+    }
+  }
+  collectStrings(args);
+
+  // Dimension 7: SSRF — check URL arguments
+  if (config.ssrf.enabled) {
+    for (const str of argStrings) {
+      if (/^https?:\/\//i.test(str)) {
+        const ssrfReason = await validateFetchUrl(str, { allowPrivate: config.ssrf.allowPrivate });
+        if (ssrfReason) {
+          return { allow: false, reason: `[CCS/Security] ${ssrfReason}`, warnings, dimension: 'Security' };
+        }
+      }
+    }
+  }
+
+  // Dimension 7: Command injection — check arguments that look like commands
+  if (config.commandInjection.enabled) {
+    for (const str of argStrings) {
+      if (str.length > 5000) continue; // skip very long strings (likely data, not commands)
+      // Only scan strings that look like they could contain shell commands
+      if (/[;&|`$]|\b(?:curl|wget|bash|sh|nc|python|perl|ruby|chmod|rm)\b/.test(str)) {
+        const result = inspectSpawn({ command: str }, config.commandInjection.threshold);
+        if (result.blocked) {
+          return { allow: false, reason: `[CCS/Security] ${result.reason}`, warnings, dimension: 'Security' };
+        }
+      }
+    }
+  }
+
+  // Dimension 7: Credential exfiltration
+  if (config.credentialExfil.enabled) {
+    const secrets = scanForSecrets(args);
+    if (secrets.length > 0) {
+      // If the tool is network-facing (fetch, request, send), block
+      const networkFacing = /^(fetch|request|web|http|send|post|put|upload|curl|api_call|call)/i.test(name);
+      if (networkFacing) {
+        return {
+          allow: false,
+          reason: `[CCS/Security] credential pattern detected in network-facing tool "${name}" arguments: ${secrets.map(s => s.label).join(', ')}`,
+          warnings,
+          dimension: 'Security',
+        };
+      }
+      // For non-network tools, warn only
+      warnings.push(`credential pattern detected: ${secrets.map(s => s.label).join(', ')}`);
+    }
+
+    // Check for credential file paths
+    for (const str of argStrings) {
+      const credPath = isCredentialPath(str);
+      if (credPath) {
+        const readTool = /^(read|cat|get|fetch|open|load|view|show|list)/i.test(name);
+        if (readTool) {
+          return {
+            allow: false,
+            reason: `[CCS/Security] tool "${name}" attempting to read credential file: ${str}`,
+            warnings,
+            dimension: 'Security',
+          };
+        }
+        warnings.push(`credential file path referenced: ${str}`);
+      }
+    }
+  }
+
+  // Dimension 7: Path traversal
+  if (config.pathTraversal.enabled) {
+    const traversal = checkPathTraversal(args, config.pathTraversal.blockedPaths);
+    if (traversal.length > 0) {
+      return {
+        allow: false,
+        reason: `[CCS/Security] path traversal detected: ${traversal[0]}`,
+        warnings,
+        dimension: 'Security',
+      };
+    }
+  }
+
+  // Dimension 6: Prompt injection — scan all string arguments concatenated
+  if (config.promptInjection.enabled) {
+    const combined = argStrings.join('\n').slice(0, 50000);
+    if (combined.length > 10) {
+      const injection = detectInjection(combined, { threshold: config.promptInjection.threshold });
+      if (injection.blocked) {
+        return {
+          allow: false,
+          reason: `[CCS/Integrity] ${injection.reason}`,
+          warnings,
+          dimension: 'Integrity',
+        };
+      }
+      if (injection.hits.length > 0) {
+        warnings.push(`prompt injection pattern (score ${injection.score}): ${injection.hits.map(h => h.label).join(', ')}`);
+      }
+    }
+  }
+
+  return { allow: true, warnings, dimension: 'pass' };
+}
+
+/**
+ * Evaluate a tool result/output for credential leakage.
+ *
+ * @param {object} result - { content?, isError? }
+ * @param {object} [userConfig]
+ * @returns {{ allow: boolean, reason?: string, warnings: string[] }}
+ */
+export function evaluateToolResult(result, userConfig) {
+  const config = mergeConfig(DEFAULT_POLICY, userConfig);
+  const warnings = [];
+
+  if (!config.scanOutput.enabled || result.isError) return { allow: true, warnings };
+
+  // Extract text from content blocks
+  let text = '';
+  if (Array.isArray(result.content)) {
+    for (const block of result.content) {
+      if (block?.type === 'text' && typeof block.text === 'string') {
+        text += block.text + '\n';
+      }
+    }
+  } else if (typeof result.content === 'string') {
+    text = result.content;
+  }
+
+  if (text.length > config.scanOutput.maxScanLength) {
+    text = text.slice(0, config.scanOutput.maxScanLength);
+  }
+
+  if (!text) return { allow: true, warnings };
+
+  // Scan output for leaked secrets
+  const secrets = scanForSecrets(text);
+  if (secrets.length > 0) {
+    warnings.push(`output contains credential patterns: ${secrets.map(s => s.label).join(', ')}`);
+    // Redact in a future version; for now warn
+  }
+
+  // Scan output for injection attempts (fetched web content trying to hijack)
+  if (config.promptInjection.enabled) {
+    const injection = detectInjection(text, { threshold: config.promptInjection.threshold });
+    if (injection.blocked) {
+      return {
+        allow: false,
+        reason: `[CCS/Integrity] tool output contains prompt injection: ${injection.reason}`,
+        warnings,
+      };
+    }
+  }
+
+  return { allow: true, warnings };
+}
+
+/**
+ * Evaluate a subprocess spawn for security violations.
+ *
+ * @param {object} spec - spawn spec
+ * @param {object} [userConfig]
+ * @returns {{ allow: boolean, reason?: string, warnings: string[] }}
+ */
+export function evaluateSubprocess(spec, userConfig) {
+  const config = mergeConfig(DEFAULT_POLICY, userConfig);
+  const warnings = [];
+
+  // Command injection
+  if (config.commandInjection.enabled) {
+    const result = inspectSpawn(spec, config.commandInjection.threshold);
+    if (result.blocked) {
+      return { allow: false, reason: `[CCS/Security] ${result.reason}`, warnings };
+    }
+    if (result.hits.length > 0) {
+      warnings.push(`command patterns: ${result.hits.map(h => h.label).join(', ')}`);
+    }
+  }
+
+  // Credential exposure
+  if (config.credentialExfil.enabled) {
+    const credFindings = scanSubprocessForCredentials(spec);
+    if (credFindings.length > 0) {
+      return {
+        allow: false,
+        reason: `[CCS/Security] credential exposure in subprocess: ${credFindings.map(f => f.label).join(', ')}`,
+        warnings,
+      };
+    }
+  }
+
+  // Check argv for URLs (SSRF via subprocess)
+  if (config.ssrf.enabled) {
+    const argv = Array.isArray(spec?.argv) ? spec.argv : [];
+    for (const arg of argv) {
+      if (typeof arg === 'string' && /^https?:\/\//i.test(arg)) {
+        // Synchronous URL check for common private IP patterns (no DNS lookup in sync path)
+        if (/^https?:\/\/(?:127\.|10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|localhost|0\.0\.0\.0|\[::1\])/i.test(arg)) {
+          return {
+            allow: false,
+            reason: `[CCS/Security] subprocess targets private/internal network: ${arg}`,
+            warnings,
+          };
+        }
+      }
+    }
+  }
+
+  return { allow: true, warnings };
+}

package/dsh/ssrf.js

@@ -0,0 +1,170 @@
+/**
+ * @file SSRF protection — validates URLs against private network ranges.
+ *
+ * DeepSeek Harness's built-in web-fetch-http explicitly defers SSRF blocking
+ * (see packages/web/web-fetch-http/src/policy.ts line 18: "SSRF / private-network
+ * blocking is deferred"). This module fills that gap.
+ *
+ * Covers: IPv4 private ranges, loopback, link-local, carrier-grade NAT,
+ * IPv6 loopback/unique-local/link-local, decimal/octal/hex IP encoding,
+ * and DNS rebinding via TTL=0 detection (best-effort).
+ */
+
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+/** IPv4 CIDR ranges that must never be reachable from a plugin/tool fetch. */
+const V4_BLOCKLIST = [
+  { network: 0n, broadcast: 255n, label: 'this network (0.0.0.0/8)' },
+  { network: 167772160n, broadcast: 184549375n, label: 'private (10.0.0.0/8)' },
+  { network: 2130706432n, broadcast: 2147483647n, label: 'loopback (127.0.0.0/8)' },
+  { network: 2851995648n, broadcast: 2852061183n, label: 'link-local (169.254.0.0/16)' },
+  { network: 2886729728n, broadcast: 2887778303n, label: 'private (172.16.0.0/12)' },
+  { network: 3221225472n, broadcast: 3221225727n, label: 'documentation (192.0.2.0/24)' },
+  { network: 3221225984n, broadcast: 3221226239n, label: 'documentation (192.0.2.0/24)' },
+  { network: 3232235520n, broadcast: 3232301055n, label: 'private (192.168.0.0/16)' },
+  { network: 3272853504n, broadcast: 3272919039n, label: 'benchmarking (198.18.0.0/15)' },
+  { network: 3323068416n, broadcast: 3323199487n, label: 'documentation (203.0.113.0/24)' },
+  { network: 3325256704n, broadcast: 3325256959n, label: 'reserved (224.0.0.0/4 multicast)' },
+  { network: 3758096384n, broadcast: 4026531839n, label: 'reserved (224.0.0.0/4)' },
+  { network: 4026531840n, broadcast: 4294967295n, label: 'reserved (240.0.0.0/4)' },
+  // Cloud metadata endpoints
+  { network: ipToLong('169.254.169.254'), broadcast: ipToLong('169.254.169.254'), label: 'cloud metadata (169.254.169.254)' },
+  { network: ipToLong('100.100.100.200'), broadcast: ipToLong('100.100.100.200'), label: 'Alibaba Cloud metadata (100.100.100.200)' },
+];
+
+/** Convert a dotted-quad IPv4 string to a 32-bit integer (as BigInt). */
+function ipToLong(ip) {
+  const parts = ip.split('.').map(Number);
+  return BigInt(parts[0] * 16777216 + parts[1] * 65536 + parts[2] * 256 + parts[3]);
+}
+
+/** Parse a numeric string that may be decimal, octal (0o), or hex (0x). */
+function parseNumericHost(raw) {
+  const trimmed = raw.trim().toLowerCase();
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(trimmed)) return trimmed;
+  // Handle decimal integer form (e.g. http://2130706433 = 127.0.0.1)
+  if (/^\d+$/.test(trimmed)) {
+    const num = BigInt(trimmed);
+    return `${(num >> 24n) & 255n}.${(num >> 16n) & 255n}.${(num >> 8n) & 255n}.${num & 255n}`;
+  }
+  // Hex form
+  if (trimmed.startsWith('0x')) {
+    const num = BigInt(trimmed);
+    return `${(num >> 24n) & 255n}.${(num >> 16n) & 255n}.${(num >> 8n) & 255n}.${num & 255n}`;
+  }
+  // Octal form per part
+  if (/^0[0-7]+(\.0[0-7]+){0,3}$/.test(trimmed)) {
+    const parts = trimmed.split('.').map(p => parseInt(p, 8));
+    while (parts.length < 4) parts.push(0);
+    return parts.join('.');
+  }
+  return null;
+}
+
+/** Check whether an IPv4 address string falls in a blocked range. */
+export function isBlockedIPv4(ip) {
+  const num = ipToLong(ip);
+  for (const range of V4_BLOCKLIST) {
+    if (num >= range.network && num <= range.broadcast) {
+      return range.label;
+    }
+  }
+  return null;
+}
+
+/** Check whether an IPv6 address is loopback, link-local, unique-local, or unspecified. */
+export function isBlockedIPv6(ip) {
+  const lower = ip.toLowerCase();
+  if (lower === '::1' || lower === '0:0:0:0:0:0:0:1') return 'loopback (::1)';
+  if (lower === '::' || lower === '0:0:0:0:0:0:0:0') return 'unspecified (::)';
+  if (lower.startsWith('fe80:')) return 'link-local (fe80::/10)';
+  if (lower.startsWith('fc') || lower.startsWith('fd')) return 'unique-local (fc00::/7)';
+  if (lower.startsWith('ff') || lower.startsWith('ff00:')) return 'multicast (ff00::/8)';
+  // IPv4-mapped IPv6 (::ffff:a.b.c.d)
+  const v4Mapped = lower.match(/::ffff:(\d+\.\d+\.\d+\.\d+)/);
+  if (v4Mapped) return isBlockedIPv4(v4Mapped[1]);
+  return null;
+}
+
+/**
+ * Validate a URL for SSRF. Returns a denial reason string if blocked,
+ * or undefined if safe.
+ *
+ * @param {string} urlString - the URL to validate.
+ * @param {object} [opts]
+ * @param {boolean} [opts.allowPrivate=false] - permit private IP targets.
+ * @returns {Promise<string|undefined>} denial reason, or undefined.
+ */
+export async function validateFetchUrl(urlString, opts = {}) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return `invalid URL: ${urlString}`;
+  }
+
+  // Scheme check
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    return `blocked scheme "${url.protocol}" — only http/https permitted`;
+  }
+
+  // Embedded credentials
+  if (url.username || url.password) {
+    return 'URL contains embedded credentials';
+  }
+
+  const hostname = url.hostname;
+
+  // IP literal? (URL.hostname already strips brackets for IPv6)
+  const ipVersion = isIP(hostname);
+  if (ipVersion === 4) {
+    const reason = isBlockedIPv4(hostname);
+    if (reason && !opts.allowPrivate) return `SSRF blocked: target is ${reason}`;
+    return undefined;
+  }
+  if (ipVersion === 6) {
+    const reason = isBlockedIPv6(hostname);
+    if (reason && !opts.allowPrivate) return `SSRF blocked: target is ${reason}`;
+    return undefined;
+  }
+
+  // Also check for bracketed IPv6 that isIP might reject
+  const bracketMatch = hostname.match(/^\[(.+)\]$/);
+  if (bracketMatch) {
+    const inner = bracketMatch[1];
+    if (isIP(inner) === 6) {
+      const reason = isBlockedIPv6(inner);
+      if (reason && !opts.allowPrivate) return `SSRF blocked: target is ${reason}`;
+      return undefined;
+    }
+  }
+
+  // Numeric encoding attempts
+  const numeric = parseNumericHost(hostname);
+  if (numeric) {
+    const reason = isBlockedIPv4(numeric);
+    if (reason && !opts.allowPrivate) return `SSRF blocked: numeric host "${hostname}" resolves to ${reason}`;
+    return undefined;
+  }
+
+  // DNS resolution — check resolved IPs
+  if (!opts.allowPrivate) {
+    try {
+      const addresses = await lookup(hostname, { all: true, verbatim: true });
+      for (const addr of addresses) {
+        if (addr.family === 4) {
+          const reason = isBlockedIPv4(addr.address);
+          if (reason) return `SSRF blocked: "${hostname}" resolves to ${reason} (${addr.address})`;
+        } else {
+          const reason = isBlockedIPv6(addr.address);
+          if (reason) return `SSRF blocked: "${hostname}" resolves to ${reason} (${addr.address})`;
+        }
+      }
+    } catch {
+      // DNS failure — allow (the fetch itself will fail)
+    }
+  }
+
+  return undefined;
+}

package/package.json

@@ -1,20 +1,23 @@
 {
   "name": "ccs-mcp-server",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "MCP security server for AI agents — runtime verification, receipt verification and field-level tamper localization for Claude Code, Cursor, Cline and Windsurf. 7-dimension CCS checks, Ed25519 tamper-evident receipts, offline verification, zero runtime dependencies.",
   "type": "commonjs",
   "bin": {
-    "ccs-mcp-server": "src/index.js"
+    "ccs-mcp-server": "src/index.js",
+    "agent-runtime-guard": "src/index.js"
   },
   "main": "src/index.js",
   "exports": {
     ".": "./src/index.js",
     "./receipts": "./src/receipts.js",
-    "./tamper": "./src/locate_tampering.js",
+    "./dsh": "./dsh/index.js",
+    "./dsh/cordis.patch.yml": "./dsh/cordis.patch.yml",
     "./package.json": "./package.json"
   },
   "files": [
     "src",
+    "dsh",
     "README.md",
     "LICENSE",
     "test"
@@ -57,16 +60,29 @@
     "type": "git",
     "url": "git+https://github.com/DSHCorrectover/ccs-mcp-server.git"
   },
-  "homepage": "https://github.com/DSHCorrectover/agent-runtime-guard#readme",
+  "homepage": "https://correctover.com",
   "bugs": {
-    "url": "https://github.com/DSHCorrectover/agent-runtime-guard/issues"
+    "url": "https://github.com/DSHCorrectover/ccs-mcp-server/issues"
   },
   "engines": {
     "node": ">=18"
   },
   "dependencies": {},
+  "peerDependencies": {
+    "@deepseek-ai/dsh": ">=0.2.1-alpha.1 <0.3.0-0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh": {
+      "optional": true
+    }
+  },
   "scripts": {
     "test": "node test/run-tests.js"
   },
+  "mcp": {
+    "name": "ccs-mcp-server",
+    "displayName": "CCS MCP Server",
+    "description": "Full-stack runtime interception for AI agents — blocks destructive commands, credential theft, SSRF and injection, with Ed25519 evidence receipts."
+  },
   "mcpName": "io.github.DSHCorrectover/ccs-mcp-server"
 }