chainwall 0.1.0 → 2.1.0

package/dist/auditor/mcp-detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-detector.d.ts","sourceRoot":"","sources":["../../src/auditor/mcp-detector.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IACxC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAyED,wBAAgB,gBAAgB,IAAI,kBAAkB,CAqBrD"}
+{"version":3,"file":"mcp-detector.d.ts","sourceRoot":"","sources":["../../src/auditor/mcp-detector.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IACxC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AA8ED,wBAAgB,gBAAgB,IAAI,kBAAkB,CAsBrD"}

package/dist/auditor/mcp-detector.js

@@ -21,7 +21,7 @@ function getMCPConfigPaths() {
     paths.push(join(home, '.cursor', 'mcp.json'));
     return paths;
 }
-function extractServers(config, sourceFile) {
+function extractServers(config, sourceFile, definitions) {
     const servers = [];
     const serverMap = (config.mcpServers ?? config.mcp_servers ?? config['mcpServers'] ?? {});
     if (typeof serverMap !== 'object' || serverMap === null)
@@ -49,6 +49,7 @@ function extractServers(config, sourceFile) {
         const hasFilesystemAccess = FS_TOOL_KEYWORDS.some((kw) => allText.includes(kw));
         const hasCommandExecution = EXEC_TOOL_KEYWORDS.some((kw) => allText.includes(kw));
         servers.push({ name, sourceFile, hasFilesystemAccess, hasCommandExecution, tools });
+        definitions?.set(name, serverDef);
         const analysis = analyzeMCPServer(servers[servers.length - 1], serverDef);
         servers[servers.length - 1].riskScore = analysis.riskScore;
         servers[servers.length - 1].riskLabel = analysis.riskLabel;
@@ -65,6 +66,7 @@ export function detectMCPServers() {
     const configPaths = getMCPConfigPaths();
     const allServers = [];
     const foundConfigFiles = [];
+    const allDefinitions = new Map();
     for (const configPath of configPaths) {
         if (!existsSync(configPath))
             continue;
@@ -75,12 +77,12 @@ export function detectMCPServers() {
             const raw = readFileSync(configPath, 'utf-8');
             const config = JSON.parse(raw);
             foundConfigFiles.push(configPath);
-            allServers.push(...extractServers(config, configPath));
+            allServers.push(...extractServers(config, configPath, allDefinitions));
         }
         catch {
             // skip malformed configs
         }
     }
-    return { servers: allServers, configFiles: foundConfigFiles };
+    return { servers: allServers, configFiles: foundConfigFiles, definitions: allDefinitions };
 }
 //# sourceMappingURL=mcp-detector.js.map

package/dist/auditor/mcp-detector.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-detector.js","sourceRoot":"","sources":["../../src/auditor/mcp-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAmBrD,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAC9G,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;AAEnF,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG;QACZ,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QACvB,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;KACvB,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC;IACnG,CAAC;SAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,oBAAoB;IACpB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAE9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B,EAAE,UAAkB;IACzE,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;IAErH,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAExE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,SAAS,GAAG,KAAgC,CAAC;QAEnD,iDAAiD;QACjD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,YAAmD,CAAC;QACnF,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,IAAI,YAAY,EAAE,KAAK,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;qBACpC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAE3E,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAElF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpF,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAC3B,SAAS,CACV,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;QACrE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;QACjE,4DAA4D;QAC5D,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QAEtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;YACvC,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;gBAAE,SAAS,CAAC,uBAAuB;YAC9D,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YAC1D,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAChE,CAAC"}
+{"version":3,"file":"mcp-detector.js","sourceRoot":"","sources":["../../src/auditor/mcp-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAoBrD,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAC9G,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;AAEnF,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG;QACZ,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QACvB,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;KACvB,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC;IACnG,CAAC;SAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,oBAAoB;IACpB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAE9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,MAA+B,EAC/B,UAAkB,EAClB,WAAkD;IAElD,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;IAErH,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAExE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,SAAS,GAAG,KAAgC,CAAC;QAEnD,iDAAiD;QACjD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,YAAmD,CAAC;QACnF,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,IAAI,YAAY,EAAE,KAAK,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;qBACpC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAE3E,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAElF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAC3B,SAAS,CACV,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;QACrE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;QACjE,4DAA4D;QAC5D,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAmC,CAAC;IAElE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QAEtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;YACvC,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;gBAAE,SAAS,CAAC,uBAAuB;YAC9D,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YAC1D,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAC7F,CAAC"}

package/dist/auditor/mcp-poison-detector.d.ts

@@ -0,0 +1,19 @@
+import type { MCPServer } from './mcp-detector.js';
+import type { Severity } from '../rules/types.js';
+export type PoisoningCategory = 'description-injection' | 'typosquatting' | 'excessive-permissions' | 'suspicious-url' | 'known-vulnerability' | 'definition-changed';
+export interface PoisoningFinding {
+    category: PoisoningCategory;
+    severity: Severity;
+    serverName: string;
+    toolName?: string;
+    description: string;
+    detail?: string;
+    cve?: string;
+}
+export interface MCPPoisoningResult {
+    findings: PoisoningFinding[];
+    serversAnalyzed: number;
+    definitionHashesUpdated: number;
+}
+export declare function detectMCPPoisoning(servers: MCPServer[], definitions: Map<string, Record<string, unknown>>): MCPPoisoningResult;
+//# sourceMappingURL=mcp-poison-detector.d.ts.map

package/dist/auditor/mcp-poison-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-poison-detector.d.ts","sourceRoot":"","sources":["../../src/auditor/mcp-poison-detector.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAIlD,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GACvB,eAAe,GACf,uBAAuB,GACvB,gBAAgB,GAChB,qBAAqB,GACrB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAqTD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,SAAS,EAAE,EACpB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAChD,kBAAkB,CAwBpB"}

package/dist/auditor/mcp-poison-detector.js

@@ -0,0 +1,295 @@
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync, mkdirSync, existsSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+// ── Constants ──────────────────────────────────────────────────────────
+const KNOWN_MCP_NAMES = [
+    'filesystem', 'github', 'slack', 'postgres', 'postgresql',
+    'playwright', 'puppeteer', 'sqlite', 'redis', 'mongodb',
+    'google-drive', 'google-maps', 'brave-search', 'fetch',
+    'everything', 'memory', 'sequential-thinking', 'time',
+    'filesystem-editor', 'docker', 'kubernetes', 'aws',
+    'azure', 'gcp', 'stripe', 'twilio',
+];
+const KNOWN_VULNERABILITIES = [
+    {
+        match: /\bmcp-remote\b/i,
+        cve: 'CVE-2025-68145',
+        severity: 'critical',
+        description: 'mcp-remote: authentication bypass allows unauthorized server access',
+    },
+    {
+        match: /\bgit\b.*\bmcp\b|\bmcp\b.*\bgit\b/i,
+        cve: 'CVE-2025-68143',
+        severity: 'critical',
+        description: 'Anthropic Git MCP server: path traversal allows reading files outside repository',
+    },
+    {
+        match: /\bgit\b.*\bmcp\b|\bmcp\b.*\bgit\b/i,
+        cve: 'CVE-2025-68144',
+        severity: 'high',
+        description: 'Anthropic Git MCP server: command injection via branch names',
+    },
+];
+// Description injection indicators
+const INJECTION_INDICATORS = [
+    { pattern: /\b(?:always|must)\s+use\s+this\s+tool\s+(?:first|before)/i, label: 'Priority manipulation' },
+    { pattern: /\b(?:instead\s+of|don'?t\s+use|never\s+use|replace)\s+\S+/i, label: 'Tool substitution' },
+    { pattern: /\b(?:ignore|bypass|skip|disable)\s+(?:safety|security|verification|auth)/i, label: 'Safety bypass' },
+    { pattern: /\b(?:send|post|upload|forward)\s+(?:to|via)\s+https?:\/\//i, label: 'Data exfiltration' },
+    { pattern: /<!--[\s\S]*?-->/i, label: 'Hidden HTML comment' },
+    { pattern: /[\u200B-\u200F\u2028-\u202F\u2060-\u206F\uFEFF]/i, label: 'Zero-width characters' },
+];
+// Suspicious URL patterns
+const SUSPICIOUS_URL_PATTERNS = [
+    { pattern: /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/, label: 'Raw IP address' },
+    { pattern: /\b(?:ngrok|localtunnel|serveo|bore\.digital|localhost\.run)\b/i, label: 'Tunnel service' },
+    { pattern: /\b[a-f0-9]{12,}\./, label: 'Hash-like subdomain' },
+    { pattern: /\b(?:pastebin|hastebin|ghostbin|rentry)\.(?:com|org)\b/i, label: 'Paste service' },
+    { pattern: /\.(?:tk|ml|ga|cf|gq|xyz|top|buzz)\b/i, label: 'Suspicious TLD' },
+];
+// Dangerous permission combinations
+const DANGEROUS_COMBOS = [
+    {
+        required: ['filesystem-write', 'command-execution', 'network-access'],
+        severity: 'critical',
+        label: 'Full exfiltration chain: can write files, execute commands, and reach the network',
+    },
+    {
+        required: ['command-execution', 'network-access'],
+        severity: 'high',
+        label: 'Remote code execution path: can execute commands and reach the network',
+    },
+    {
+        required: ['database-access', 'network-access'],
+        severity: 'high',
+        label: 'Data exfiltration path: can access databases and reach the network',
+    },
+];
+const HASH_FILE_PATH = join(homedir(), '.llm-av', 'mcp-hashes.json');
+// ── Detection Functions ────────────────────────────────────────────────
+function checkDescriptionInjection(server, definition) {
+    const findings = [];
+    const allText = JSON.stringify(definition).toLowerCase();
+    // Extract tool descriptions from the definition
+    const tools = definition.tools ?? definition.capabilities;
+    const descriptions = [];
+    if (Array.isArray(tools)) {
+        for (const tool of tools) {
+            if (typeof tool === 'object' && tool !== null) {
+                const t = tool;
+                const desc = String(t.description ?? t.desc ?? '');
+                const name = String(t.name ?? '');
+                if (desc)
+                    descriptions.push({ toolName: name, text: desc });
+            }
+        }
+    }
+    // Also check the overall server description/command text
+    descriptions.push({
+        toolName: '',
+        text: allText,
+    });
+    for (const { toolName, text } of descriptions) {
+        // Excessively long descriptions
+        if (text.length > 500 && toolName) {
+            findings.push({
+                category: 'description-injection',
+                severity: 'medium',
+                serverName: server.name,
+                toolName,
+                description: `Tool description is unusually long (${text.length} chars) — may contain hidden instructions`,
+            });
+        }
+        for (const indicator of INJECTION_INDICATORS) {
+            if (indicator.pattern.test(text)) {
+                findings.push({
+                    category: 'description-injection',
+                    severity: 'high',
+                    serverName: server.name,
+                    toolName: toolName || undefined,
+                    description: `${indicator.label} detected in ${toolName ? `tool "${toolName}"` : 'server'} definition`,
+                    detail: `Pattern: ${indicator.label}`,
+                });
+                break; // One finding per tool/description
+            }
+        }
+    }
+    return findings;
+}
+function levenshtein(a, b) {
+    const la = a.length;
+    const lb = b.length;
+    const dp = Array.from({ length: la + 1 }, () => Array(lb + 1).fill(0));
+    for (let i = 0; i <= la; i++)
+        dp[i][0] = i;
+    for (let j = 0; j <= lb; j++)
+        dp[0][j] = j;
+    for (let i = 1; i <= la; i++) {
+        for (let j = 1; j <= lb; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + cost);
+        }
+    }
+    return dp[la][lb];
+}
+function checkTyposquatting(server) {
+    const findings = [];
+    const name = server.name.toLowerCase();
+    if (name.length < 4)
+        return findings;
+    for (const known of KNOWN_MCP_NAMES) {
+        if (name === known)
+            continue; // Exact match — not a typosquat
+        const dist = levenshtein(name, known);
+        if (dist === 1) {
+            findings.push({
+                category: 'typosquatting',
+                severity: 'high',
+                serverName: server.name,
+                description: `Server name "${server.name}" is 1 character away from known MCP "${known}" — possible typosquatting`,
+                detail: `Levenshtein distance: ${dist} from "${known}"`,
+            });
+        }
+        else if (dist === 2) {
+            findings.push({
+                category: 'typosquatting',
+                severity: 'medium',
+                serverName: server.name,
+                description: `Server name "${server.name}" is similar to known MCP "${known}" — verify this is intentional`,
+                detail: `Levenshtein distance: ${dist} from "${known}"`,
+            });
+        }
+    }
+    return findings;
+}
+function checkExcessivePermissions(server) {
+    const findings = [];
+    const capabilities = server.capabilities ?? [];
+    for (const combo of DANGEROUS_COMBOS) {
+        if (combo.required.every(cap => capabilities.includes(cap))) {
+            findings.push({
+                category: 'excessive-permissions',
+                severity: combo.severity,
+                serverName: server.name,
+                description: combo.label,
+                detail: `Capabilities: ${capabilities.join(', ')}`,
+            });
+            break; // Only flag the worst combo
+        }
+    }
+    return findings;
+}
+function checkSuspiciousURLs(server, definition) {
+    const findings = [];
+    const command = String(definition.command ?? '');
+    const args = Array.isArray(definition.args) ? definition.args.map(String) : [];
+    const allText = [command, ...args].join(' ');
+    for (const { pattern, label } of SUSPICIOUS_URL_PATTERNS) {
+        if (pattern.test(allText)) {
+            findings.push({
+                category: 'suspicious-url',
+                severity: 'high',
+                serverName: server.name,
+                description: `${label} found in server command/args`,
+                detail: allText.length > 120 ? allText.slice(0, 120) + '...' : allText,
+            });
+            break; // One finding per server for URL patterns
+        }
+    }
+    return findings;
+}
+function checkKnownVulnerabilities(server, definition) {
+    const findings = [];
+    const command = String(definition.command ?? '');
+    const args = Array.isArray(definition.args) ? definition.args.map(String) : [];
+    const allText = [server.name, command, ...args].join(' ');
+    const seen = new Set();
+    for (const vuln of KNOWN_VULNERABILITIES) {
+        if (vuln.match.test(allText) && !seen.has(vuln.cve)) {
+            seen.add(vuln.cve);
+            findings.push({
+                category: 'known-vulnerability',
+                severity: vuln.severity,
+                serverName: server.name,
+                description: vuln.description,
+                cve: vuln.cve,
+            });
+        }
+    }
+    return findings;
+}
+function checkDefinitionChanges(servers, definitions) {
+    const findings = [];
+    let hashesUpdated = 0;
+    // Load existing hashes
+    let storedHashes = {};
+    try {
+        if (existsSync(HASH_FILE_PATH)) {
+            storedHashes = JSON.parse(readFileSync(HASH_FILE_PATH, 'utf-8'));
+        }
+    }
+    catch {
+        storedHashes = {};
+    }
+    const newHashes = {};
+    for (const server of servers) {
+        const def = definitions.get(server.name);
+        if (!def)
+            continue;
+        // Canonical JSON hash
+        const canonical = JSON.stringify(def, Object.keys(def).sort());
+        const hash = createHash('sha256').update(canonical).digest('hex');
+        newHashes[server.name] = hash;
+        if (storedHashes[server.name] && storedHashes[server.name] !== hash) {
+            findings.push({
+                category: 'definition-changed',
+                severity: 'high',
+                serverName: server.name,
+                description: `Server definition has changed since last audit — possible rug-pull attack`,
+                detail: `Previous hash: ${storedHashes[server.name].slice(0, 16)}... New: ${hash.slice(0, 16)}...`,
+            });
+            hashesUpdated++;
+        }
+        else if (!storedHashes[server.name]) {
+            hashesUpdated++;
+        }
+    }
+    // Write updated hashes atomically
+    try {
+        const dir = join(homedir(), '.llm-av');
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        const merged = { ...storedHashes, ...newHashes };
+        const tmpPath = HASH_FILE_PATH + '.tmp';
+        writeFileSync(tmpPath, JSON.stringify(merged, null, 2) + '\n');
+        renameSync(tmpPath, HASH_FILE_PATH);
+    }
+    catch {
+        // Non-critical — hash tracking is best-effort
+    }
+    return { findings, hashesUpdated };
+}
+// ── Entry Point ────────────────────────────────────────────────────────
+export function detectMCPPoisoning(servers, definitions) {
+    const allFindings = [];
+    let definitionHashesUpdated = 0;
+    for (const server of servers) {
+        const def = definitions.get(server.name) ?? {};
+        allFindings.push(...checkDescriptionInjection(server, def));
+        allFindings.push(...checkTyposquatting(server));
+        allFindings.push(...checkExcessivePermissions(server));
+        allFindings.push(...checkSuspiciousURLs(server, def));
+        allFindings.push(...checkKnownVulnerabilities(server, def));
+    }
+    // Rug-pull detection (compares hashes)
+    const { findings: changeFIndings, hashesUpdated } = checkDefinitionChanges(servers, definitions);
+    allFindings.push(...changeFIndings);
+    definitionHashesUpdated = hashesUpdated;
+    return {
+        findings: allFindings,
+        serversAnalyzed: servers.length,
+        definitionHashesUpdated,
+    };
+}
+//# sourceMappingURL=mcp-poison-detector.js.map

package/dist/auditor/mcp-poison-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-poison-detector.js","sourceRoot":"","sources":["../../src/auditor/mcp-poison-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AA8BlC,0EAA0E;AAE1E,MAAM,eAAe,GAAG;IACtB,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY;IACzD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;IACvD,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO;IACtD,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM;IACrD,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK;IAClD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ;CACnC,CAAC;AAEF,MAAM,qBAAqB,GAA8E;IACvG;QACE,KAAK,EAAE,iBAAiB;QACxB,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qEAAqE;KACnF;IACD;QACE,KAAK,EAAE,oCAAoC;QAC3C,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,kFAAkF;KAChG;IACD;QACE,KAAK,EAAE,oCAAoC;QAC3C,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,8DAA8D;KAC5E;CACF,CAAC;AAEF,mCAAmC;AACnC,MAAM,oBAAoB,GAAG;IAC3B,EAAE,OAAO,EAAE,2DAA2D,EAAE,KAAK,EAAE,uBAAuB,EAAE;IACxG,EAAE,OAAO,EAAE,4DAA4D,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACrG,EAAE,OAAO,EAAE,2EAA2E,EAAE,KAAK,EAAE,eAAe,EAAE;IAChH,EAAE,OAAO,EAAE,4DAA4D,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACrG,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAAqB,EAAE;IAC7D,EAAE,OAAO,EAAE,kDAAkD,EAAE,KAAK,EAAE,uBAAuB,EAAE;CAChG,CAAC;AAEF,0BAA0B;AAC1B,MAAM,uBAAuB,GAAG;IAC9B,EAAE,OAAO,EAAE,wCAAwC,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAC9E,EAAE,OAAO,EAAE,gEAAgE,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACtG,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,qBAAqB,EAAE;IAC9D,EAAE,OAAO,EAAE,yDAAyD,EAAE,KAAK,EAAE,eAAe,EAAE;IAC9F,EAAE,OAAO,EAAE,sCAAsC,EAAE,KAAK,EAAE,gBAAgB,EAAE;CAC7E,CAAC;AAEF,oCAAoC;AACpC,MAAM,gBAAgB,GAAgE;IACpF;QACE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QACrE,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,mFAAmF;KAC3F;IACD;QACE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QACjD,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,wEAAwE;KAChF;IACD;QACE,QAAQ,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;QAC/C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oEAAoE;KAC5E;CACF,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAErE,0EAA0E;AAE1E,SAAS,yBAAyB,CAAC,MAAiB,EAAE,UAAmC;IACvF,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAEzD,gDAAgD;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAK,UAAsC,CAAC,YAAY,CAAC;IACvF,MAAM,YAAY,GAAyC,EAAE,CAAC;IAE9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC9C,MAAM,CAAC,GAAG,IAA+B,CAAC;gBAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBAClC,IAAI,IAAI;oBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,YAAY,CAAC,IAAI,CAAC;QAChB,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9C,gCAAgC;QAChC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,QAAQ;gBACR,WAAW,EAAE,uCAAuC,IAAI,CAAC,MAAM,2CAA2C;aAC3G,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;YAC7C,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,uBAAuB;oBACjC,QAAQ,EAAE,MAAM;oBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ,EAAE,QAAQ,IAAI,SAAS;oBAC/B,WAAW,EAAE,GAAG,SAAS,CAAC,KAAK,gBAAgB,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,aAAa;oBACtG,MAAM,EAAE,YAAY,SAAS,CAAC,KAAK,EAAE;iBACtC,CAAC,CAAC;gBACH,MAAM,CAAC,mCAAmC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAa,CAAC,CAAC;IAE/F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CACjB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAiB;IAC3C,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAEvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,IAAI,KAAK,KAAK;YAAE,SAAS,CAAC,gCAAgC;QAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,gBAAgB,MAAM,CAAC,IAAI,yCAAyC,KAAK,4BAA4B;gBAClH,MAAM,EAAE,yBAAyB,IAAI,UAAU,KAAK,GAAG;aACxD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,gBAAgB,MAAM,CAAC,IAAI,8BAA8B,KAAK,gCAAgC;gBAC3G,MAAM,EAAE,yBAAyB,IAAI,UAAU,KAAK,GAAG;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAiB;IAClD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IAE/C,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,MAAM,EAAE,iBAAiB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACnD,CAAC,CAAC;YACH,MAAM,CAAC,4BAA4B;QACrC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAiB,EAAE,UAAmC;IACjF,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7C,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,GAAG,KAAK,+BAA+B;gBACpD,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO;aACvE,CAAC,CAAC;YACH,MAAM,CAAC,0CAA0C;QACnD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAiB,EAAE,UAAmC;IACvF,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,qBAAqB;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAoB,EACpB,WAAiD;IAEjD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,uBAAuB;IACvB,IAAI,YAAY,GAA2B,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAA2B,CAAC;QAC7F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,sBAAsB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAE9B,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,2EAA2E;gBACxF,MAAM,EAAE,kBAAkB,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;aACnG,CAAC,CAAC;YACH,aAAa,EAAE,CAAC;QAClB,CAAC;aAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,aAAa,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,SAAS,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,cAAc,GAAG,MAAM,CAAC;QACxC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AACrC,CAAC;AAED,0EAA0E;AAE1E,MAAM,UAAU,kBAAkB,CAChC,OAAoB,EACpB,WAAiD;IAEjD,MAAM,WAAW,GAAuB,EAAE,CAAC;IAC3C,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAEhC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAE/C,WAAW,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5D,WAAW,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,WAAW,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,WAAW,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACtD,WAAW,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,uCAAuC;IACvC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjG,WAAW,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;IACpC,uBAAuB,GAAG,aAAa,CAAC;IAExC,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,uBAAuB;KACxB,CAAC;AACJ,CAAC"}

package/dist/auditor/miner-detector.d.ts

@@ -0,0 +1,20 @@
+export interface RunningMiner {
+    pid: number;
+    name: string;
+    command: string;
+    cpuPercent?: number;
+}
+export interface SuspiciousCrontab {
+    line: string;
+    reason: string;
+}
+export interface MinerDetectionResult {
+    runningMiners: RunningMiner[];
+    suspiciousCrontabs: SuspiciousCrontab[];
+}
+/**
+ * Detect running cryptocurrency mining processes and suspicious crontab entries.
+ * Uses execFileSync (no shell injection risk) for both ps and crontab.
+ */
+export declare function detectMiners(): MinerDetectionResult;
+//# sourceMappingURL=miner-detector.d.ts.map

package/dist/auditor/miner-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"miner-detector.d.ts","sourceRoot":"","sources":["../../src/auditor/miner-detector.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;CACzC;AAgBD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,oBAAoB,CAInD"}

package/dist/auditor/miner-detector.js

@@ -0,0 +1,100 @@
+import { execFileSync } from 'node:child_process';
+const KNOWN_MINER_NAMES = [
+    'xmrig', 'ethminer', 'cgminer', 'bfgminer', 'phoenixminer',
+    'cpuminer', 'minerd', 'claymore', 't-rex', 'lolminer',
+    'nbminer', 'gminer', 'ccminer', 'kryptex', 'nicehash',
+];
+const MINER_PATTERN = new RegExp(`\\b(?:${KNOWN_MINER_NAMES.join('|')})\\b`, 'i');
+const CURL_BASH_PATTERN = /curl\s+.*\|\s*(?:bash|sh|zsh)/i;
+const STRATUM_PATTERN = /stratum\+(?:tcp|ssl):\/\//i;
+const POOL_PATTERN = /(?:pool|mining|miner)\S*\.(?:com|org|io|net)/i;
+/**
+ * Detect running cryptocurrency mining processes and suspicious crontab entries.
+ * Uses execFileSync (no shell injection risk) for both ps and crontab.
+ */
+export function detectMiners() {
+    const runningMiners = detectRunningMiners();
+    const suspiciousCrontabs = detectSuspiciousCrontabs();
+    return { runningMiners, suspiciousCrontabs };
+}
+function detectRunningMiners() {
+    const miners = [];
+    try {
+        const output = execFileSync('ps', ['aux'], {
+            timeout: 5000,
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const lines = output.split('\n');
+        // Skip header line
+        for (let i = 1; i < lines.length; i++) {
+            const line = lines[i].trim();
+            if (!line)
+                continue;
+            // Check if the process matches known miner names
+            if (!MINER_PATTERN.test(line) && !STRATUM_PATTERN.test(line))
+                continue;
+            // Parse ps aux output: USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
+            const parts = line.split(/\s+/);
+            if (parts.length < 11)
+                continue;
+            const pid = parseInt(parts[1], 10);
+            const cpuPercent = parseFloat(parts[2]);
+            const command = parts.slice(10).join(' ');
+            // Extract the process name from the command
+            const cmdName = parts[10].split('/').pop() ?? parts[10];
+            // Skip our own process
+            if (command.includes('chainwall') || command.includes('vitest'))
+                continue;
+            miners.push({
+                pid,
+                name: cmdName,
+                command: command.length > 120 ? command.slice(0, 120) + '...' : command,
+                cpuPercent: isNaN(cpuPercent) ? undefined : cpuPercent,
+            });
+        }
+    }
+    catch {
+        // ps not available or failed — graceful degradation
+    }
+    return miners;
+}
+function detectSuspiciousCrontabs() {
+    const suspicious = [];
+    try {
+        const output = execFileSync('crontab', ['-l'], {
+            timeout: 5000,
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const lines = output.split('\n');
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('#'))
+                continue;
+            if (MINER_PATTERN.test(trimmed)) {
+                suspicious.push({
+                    line: trimmed.length > 120 ? trimmed.slice(0, 120) + '...' : trimmed,
+                    reason: 'References known mining binary',
+                });
+            }
+            else if (CURL_BASH_PATTERN.test(trimmed)) {
+                suspicious.push({
+                    line: trimmed.length > 120 ? trimmed.slice(0, 120) + '...' : trimmed,
+                    reason: 'Downloads and executes remote script',
+                });
+            }
+            else if (STRATUM_PATTERN.test(trimmed) || POOL_PATTERN.test(trimmed)) {
+                suspicious.push({
+                    line: trimmed.length > 120 ? trimmed.slice(0, 120) + '...' : trimmed,
+                    reason: 'References mining pool or stratum protocol',
+                });
+            }
+        }
+    }
+    catch {
+        // crontab -l returns exit code 1 when there's no crontab = clean
+    }
+    return suspicious;
+}
+//# sourceMappingURL=miner-detector.js.map

package/dist/auditor/miner-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"miner-detector.js","sourceRoot":"","sources":["../../src/auditor/miner-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAmBlD,MAAM,iBAAiB,GAAG;IACxB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc;IAC1D,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU;IACrD,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU;CACtD,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,MAAM,CAC9B,SAAS,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAChD,CAAC;AAEF,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAC3D,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,YAAY,GAAG,+CAA+C,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAG,wBAAwB,EAAE,CAAC;IACtD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;YACzC,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,mBAAmB;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,iDAAiD;YACjD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEvE,8EAA8E;YAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;gBAAE,SAAS;YAEhC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1C,4CAA4C;YAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;YAExD,uBAAuB;YACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAE1E,MAAM,CAAC,IAAI,CAAC;gBACV,GAAG;gBACH,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO;gBACvE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,UAAU,GAAwB,EAAE,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE;YAC7C,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAElD,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO;oBACpE,MAAM,EAAE,gCAAgC;iBACzC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO;oBACpE,MAAM,EAAE,sCAAsC;iBAC/C,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvE,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO;oBACpE,MAAM,EAAE,4CAA4C;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/auditor/remediation.d.ts

@@ -2,6 +2,8 @@ import type { MCPServer } from './mcp-detector.js';
 import type { VSCodeExtension } from './vscode-extension-scanner.js';
 import type { EnvExposure } from './env-auditor.js';
 import type { ScanFinding } from '../rules/types.js';
+import type { PoisoningFinding } from './mcp-poison-detector.js';
+import type { RunningMiner } from './miner-detector.js';
 export type RiskLevel = 'safe' | 'caution';
 export interface RemediationAction {
     type: string;
@@ -23,4 +25,6 @@ export declare function getActionsForVSCodeExtension(ext: VSCodeExtension): Reme
 export declare function getActionsForEnvExposure(env: EnvExposure): RemediationAction[];
 export declare function getActionsForPermissionFinding(finding: ScanFinding): RemediationAction[];
 export declare function getActionsForExposure(filePath: string): RemediationAction[];
+export declare function getActionsForPoisoningFinding(finding: PoisoningFinding): RemediationAction[];
+export declare function getActionsForRunningMiner(miner: RunningMiner): RemediationAction[];
 //# sourceMappingURL=remediation.d.ts.map

package/dist/auditor/remediation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../src/auditor/remediation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,iBAAiB,CAazF;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,iBAAiB,EAAE,CAmD7E;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,eAAe,GAAG,iBAAiB,EAAE,CAwBtF;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,GAAG,iBAAiB,EAAE,CAgD9E;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,WAAW,GAAG,iBAAiB,EAAE,CAgCxF;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAuC3E"}
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../src/auditor/remediation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,iBAAiB,CAazF;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,iBAAiB,EAAE,CAmD7E;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,eAAe,GAAG,iBAAiB,EAAE,CAwBtF;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,GAAG,iBAAiB,EAAE,CAgD9E;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,WAAW,GAAG,iBAAiB,EAAE,CAgCxF;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAuC3E;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,gBAAgB,GAAG,iBAAiB,EAAE,CAiB5F;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,YAAY,GAAG,iBAAiB,EAAE,CAwBlF"}

package/dist/auditor/remediation.js

@@ -219,4 +219,46 @@ export function getActionsForExposure(filePath) {
         },
     ];
 }
+export function getActionsForPoisoningFinding(finding) {
+    const actions = [];
+    if (finding.category === 'known-vulnerability' || finding.category === 'description-injection') {
+        actions.push({
+            type: 'review-mcp-server',
+            riskLevel: 'caution',
+            label: `Review ${finding.serverName} config`,
+            description: `${finding.description}. Review and update the server configuration.`,
+            target: finding.serverName,
+            execute: async () => {
+                return { success: true, message: `Review recommended for ${finding.serverName}: ${finding.description}` };
+            },
+        });
+    }
+    return actions;
+}
+export function getActionsForRunningMiner(miner) {
+    return [
+        {
+            type: 'kill-miner-process',
+            riskLevel: 'caution',
+            label: `Kill ${miner.name} (PID ${miner.pid})`,
+            description: `Sends SIGTERM to process ${miner.pid} (${miner.name}). The process may restart if it has a supervisor.`,
+            target: String(miner.pid),
+            execute: async () => {
+                try {
+                    process.kill(miner.pid, 'SIGTERM');
+                    return { success: true, message: `Sent SIGTERM to PID ${miner.pid} (${miner.name})` };
+                }
+                catch (err) {
+                    if (err.code === 'ESRCH') {
+                        return { success: true, message: `Process ${miner.pid} already terminated` };
+                    }
+                    if (err.code === 'EPERM') {
+                        return { success: false, message: 'Permission denied — try running as root' };
+                    }
+                    return { success: false, message: `Error: ${err instanceof Error ? err.message : String(err)}` };
+                }
+            },
+        },
+    ];
+}
 //# sourceMappingURL=remediation.js.map