chainwall 2.1.0 → 2.2.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (154) hide show
  1. package/LICENSE +44 -1
  2. package/README.md +216 -108
  3. package/dist/auditor/mcp-poison-detector.js +1 -1
  4. package/dist/auditor/mcp-poison-detector.js.map +1 -1
  5. package/dist/auditor/miner-detector.d.ts +16 -0
  6. package/dist/auditor/miner-detector.d.ts.map +1 -1
  7. package/dist/auditor/miner-detector.js +54 -10
  8. package/dist/auditor/miner-detector.js.map +1 -1
  9. package/dist/auditor/remediation.d.ts +9 -0
  10. package/dist/auditor/remediation.d.ts.map +1 -1
  11. package/dist/auditor/remediation.js +306 -6
  12. package/dist/auditor/remediation.js.map +1 -1
  13. package/dist/cli.js +30 -2
  14. package/dist/cli.js.map +1 -1
  15. package/dist/commands/monitor.d.ts +13 -0
  16. package/dist/commands/monitor.d.ts.map +1 -0
  17. package/dist/commands/monitor.js +102 -0
  18. package/dist/commands/monitor.js.map +1 -0
  19. package/dist/config.d.ts +4 -0
  20. package/dist/config.d.ts.map +1 -1
  21. package/dist/config.js +68 -1
  22. package/dist/config.js.map +1 -1
  23. package/dist/mcp-server/index.d.ts.map +1 -1
  24. package/dist/mcp-server/index.js +4 -0
  25. package/dist/mcp-server/index.js.map +1 -1
  26. package/dist/mcp-server/schemas.d.ts +2 -0
  27. package/dist/mcp-server/schemas.d.ts.map +1 -1
  28. package/dist/mcp-server/schemas.js +2 -0
  29. package/dist/mcp-server/schemas.js.map +1 -1
  30. package/dist/mcp-server/tools/capture-baseline.d.ts +3 -0
  31. package/dist/mcp-server/tools/capture-baseline.d.ts.map +1 -0
  32. package/dist/mcp-server/tools/capture-baseline.js +42 -0
  33. package/dist/mcp-server/tools/capture-baseline.js.map +1 -0
  34. package/dist/mcp-server/tools/monitor-snapshot.d.ts +3 -0
  35. package/dist/mcp-server/tools/monitor-snapshot.d.ts.map +1 -0
  36. package/dist/mcp-server/tools/monitor-snapshot.js +53 -0
  37. package/dist/mcp-server/tools/monitor-snapshot.js.map +1 -0
  38. package/dist/monitor/baseline.d.ts +6 -0
  39. package/dist/monitor/baseline.d.ts.map +1 -0
  40. package/dist/monitor/baseline.js +64 -0
  41. package/dist/monitor/baseline.js.map +1 -0
  42. package/dist/monitor/browser-scanner.d.ts +4 -0
  43. package/dist/monitor/browser-scanner.d.ts.map +1 -0
  44. package/dist/monitor/browser-scanner.js +141 -0
  45. package/dist/monitor/browser-scanner.js.map +1 -0
  46. package/dist/monitor/clipboard-scanner.d.ts +3 -0
  47. package/dist/monitor/clipboard-scanner.d.ts.map +1 -0
  48. package/dist/monitor/clipboard-scanner.js +49 -0
  49. package/dist/monitor/clipboard-scanner.js.map +1 -0
  50. package/dist/monitor/correlation.d.ts +9 -0
  51. package/dist/monitor/correlation.d.ts.map +1 -0
  52. package/dist/monitor/correlation.js +117 -0
  53. package/dist/monitor/correlation.js.map +1 -0
  54. package/dist/monitor/index.d.ts +13 -0
  55. package/dist/monitor/index.d.ts.map +1 -0
  56. package/dist/monitor/index.js +11 -0
  57. package/dist/monitor/index.js.map +1 -0
  58. package/dist/monitor/known-good.d.ts +24 -0
  59. package/dist/monitor/known-good.d.ts.map +1 -0
  60. package/dist/monitor/known-good.js +82 -0
  61. package/dist/monitor/known-good.js.map +1 -0
  62. package/dist/monitor/network-scanner.d.ts +4 -0
  63. package/dist/monitor/network-scanner.d.ts.map +1 -0
  64. package/dist/monitor/network-scanner.js +123 -0
  65. package/dist/monitor/network-scanner.js.map +1 -0
  66. package/dist/monitor/persistence-scanner.d.ts +4 -0
  67. package/dist/monitor/persistence-scanner.d.ts.map +1 -0
  68. package/dist/monitor/persistence-scanner.js +156 -0
  69. package/dist/monitor/persistence-scanner.js.map +1 -0
  70. package/dist/monitor/process-scanner.d.ts +6 -0
  71. package/dist/monitor/process-scanner.d.ts.map +1 -0
  72. package/dist/monitor/process-scanner.js +101 -0
  73. package/dist/monitor/process-scanner.js.map +1 -0
  74. package/dist/monitor/shadow-ai-scanner.d.ts +3 -0
  75. package/dist/monitor/shadow-ai-scanner.d.ts.map +1 -0
  76. package/dist/monitor/shadow-ai-scanner.js +70 -0
  77. package/dist/monitor/shadow-ai-scanner.js.map +1 -0
  78. package/dist/monitor/types.d.ts +79 -0
  79. package/dist/monitor/types.d.ts.map +1 -0
  80. package/dist/monitor/types.js +12 -0
  81. package/dist/monitor/types.js.map +1 -0
  82. package/dist/reporter/monitor-report.d.ts +3 -0
  83. package/dist/reporter/monitor-report.d.ts.map +1 -0
  84. package/dist/reporter/monitor-report.js +89 -0
  85. package/dist/reporter/monitor-report.js.map +1 -0
  86. package/dist/reporter/risk-scorer.d.ts +2 -0
  87. package/dist/reporter/risk-scorer.d.ts.map +1 -1
  88. package/dist/reporter/risk-scorer.js +12 -0
  89. package/dist/reporter/risk-scorer.js.map +1 -1
  90. package/dist/reporter/shared.d.ts.map +1 -1
  91. package/dist/reporter/shared.js +5 -3
  92. package/dist/reporter/shared.js.map +1 -1
  93. package/dist/rules/exfiltration-rules.d.ts +3 -0
  94. package/dist/rules/exfiltration-rules.d.ts.map +1 -0
  95. package/dist/rules/exfiltration-rules.js +181 -0
  96. package/dist/rules/exfiltration-rules.js.map +1 -0
  97. package/dist/rules/index.d.ts +2 -1
  98. package/dist/rules/index.d.ts.map +1 -1
  99. package/dist/rules/index.js +3 -1
  100. package/dist/rules/index.js.map +1 -1
  101. package/dist/rules/types.d.ts +9 -1
  102. package/dist/rules/types.d.ts.map +1 -1
  103. package/dist/scanner/filesystem-scanner.d.ts.map +1 -1
  104. package/dist/scanner/filesystem-scanner.js +27 -10
  105. package/dist/scanner/filesystem-scanner.js.map +1 -1
  106. package/dist/tui/App.d.ts.map +1 -1
  107. package/dist/tui/App.js +10 -2
  108. package/dist/tui/App.js.map +1 -1
  109. package/dist/tui/components/Footer.d.ts +2 -3
  110. package/dist/tui/components/Footer.d.ts.map +1 -1
  111. package/dist/tui/components/Footer.js +11 -5
  112. package/dist/tui/components/Footer.js.map +1 -1
  113. package/dist/tui/components/WelcomeScreen.d.ts.map +1 -1
  114. package/dist/tui/components/WelcomeScreen.js +1 -1
  115. package/dist/tui/components/WelcomeScreen.js.map +1 -1
  116. package/dist/tui/educational.d.ts +6 -0
  117. package/dist/tui/educational.d.ts.map +1 -1
  118. package/dist/tui/educational.js +37 -0
  119. package/dist/tui/educational.js.map +1 -1
  120. package/dist/tui/hooks/useLogs.d.ts +1 -1
  121. package/dist/tui/hooks/useLogs.d.ts.map +1 -1
  122. package/dist/tui/hooks/useMonitor.d.ts +28 -0
  123. package/dist/tui/hooks/useMonitor.d.ts.map +1 -0
  124. package/dist/tui/hooks/useMonitor.js +149 -0
  125. package/dist/tui/hooks/useMonitor.js.map +1 -0
  126. package/dist/tui/screens/AuditPanel.d.ts.map +1 -1
  127. package/dist/tui/screens/AuditPanel.js +109 -9
  128. package/dist/tui/screens/AuditPanel.js.map +1 -1
  129. package/dist/tui/screens/MonitorPanel.d.ts +2 -0
  130. package/dist/tui/screens/MonitorPanel.d.ts.map +1 -0
  131. package/dist/tui/screens/MonitorPanel.js +370 -0
  132. package/dist/tui/screens/MonitorPanel.js.map +1 -0
  133. package/dist/tui/screens/OverviewPanel.d.ts.map +1 -1
  134. package/dist/tui/screens/OverviewPanel.js +9 -3
  135. package/dist/tui/screens/OverviewPanel.js.map +1 -1
  136. package/dist/tui/screens/ScanPanel.d.ts.map +1 -1
  137. package/dist/tui/screens/ScanPanel.js +11 -6
  138. package/dist/tui/screens/ScanPanel.js.map +1 -1
  139. package/dist/tui/screens/ScanResultsPanel.d.ts.map +1 -1
  140. package/dist/tui/screens/ScanResultsPanel.js +104 -32
  141. package/dist/tui/screens/ScanResultsPanel.js.map +1 -1
  142. package/dist/tui/state.d.ts +7 -3
  143. package/dist/tui/state.d.ts.map +1 -1
  144. package/dist/tui/state.js +1 -0
  145. package/dist/tui/state.js.map +1 -1
  146. package/dist/tui/utils/open-file.d.ts +4 -0
  147. package/dist/tui/utils/open-file.d.ts.map +1 -0
  148. package/dist/tui/utils/open-file.js +29 -0
  149. package/dist/tui/utils/open-file.js.map +1 -0
  150. package/hooks/security-scanner.sh +28 -4
  151. package/install.sh +23 -12
  152. package/package.json +1 -1
  153. package/patterns/exfiltration.yaml +160 -0
  154. package/uninstall.sh +14 -10
package/LICENSE CHANGED
@@ -1,6 +1,7 @@
1
1
  MIT License
2
2
 
3
- Copyright (c) 2025 consulalialpric
3
+ Copyright (c) 2025-2026 ChainWall Contributors
4
+ Original author: girlintokyo (https://github.com/consulalialpric)
4
5
 
5
6
  Permission is hereby granted, free of charge, to any person obtaining a copy
6
7
  of this software and associated documentation files (the "Software"), to deal
@@ -19,3 +20,45 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
20
  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
21
  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
22
  SOFTWARE.
23
+
24
+ ---
25
+
26
+ ADDITIONAL NOTICES
27
+
28
+ Security Tool Disclaimer
29
+
30
+ ChainWall is a defensive security tool designed to detect exposed secrets,
31
+ audit AI tool access, and block threats. It is intended for use by developers
32
+ and security professionals to protect their own systems and codebases.
33
+
34
+ This software does not guarantee complete protection against all threats.
35
+ No security tool can provide absolute assurance. Users are responsible for
36
+ evaluating the suitability of this software for their specific security
37
+ requirements and for implementing additional safeguards as needed.
38
+
39
+ The detection patterns, rules, and heuristics included in this software are
40
+ provided for defensive purposes only. The authors disclaim any responsibility
41
+ for misuse of this software or its components.
42
+
43
+ Third-Party Components
44
+
45
+ This software includes or may interact with third-party components, each
46
+ governed by their own respective licenses. Notable dependencies include:
47
+
48
+ - Ink (MIT) — Terminal UI framework
49
+ - React (MIT) — Component library
50
+ - Vitest (MIT) — Test framework
51
+ - @modelcontextprotocol/sdk (MIT) — MCP protocol
52
+
53
+ Trademark Notice
54
+
55
+ "ChainWall" and the ChainWall logo are trademarks of the ChainWall project.
56
+ Use of these trademarks must comply with standard fair use guidelines. You
57
+ may use the name to refer to the software but may not imply endorsement or
58
+ affiliation without written permission.
59
+
60
+ Contribution
61
+
62
+ By submitting a pull request or contributing code to this project, you agree
63
+ to license your contribution under the same MIT License terms described above,
64
+ without any additional terms or conditions.
package/README.md CHANGED
@@ -8,21 +8,35 @@
8
8
  [![npm version](https://img.shields.io/npm/v/chainwall.svg)](https://www.npmjs.com/package/chainwall)
9
9
  [![npm downloads](https://img.shields.io/npm/dm/chainwall.svg)](https://www.npmjs.com/package/chainwall)
10
10
  [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
11
- [![Tests](https://img.shields.io/badge/tests-743_passing-brightgreen?logo=vitest&logoColor=white)](#reference)
11
+ [![Tests](https://img.shields.io/badge/tests-978_passing-brightgreen?logo=vitest&logoColor=white)](#reference)
12
12
  [![GitHub stars](https://img.shields.io/github/stars/consulalialpric/chainwall?style=social)](https://github.com/consulalialpric/chainwall)
13
13
 
14
- **Antivirus for AI agents.**
14
+ **Antivirus for AI tools.**
15
15
 
16
- Your AI tools have access to every secret on your machine. ChainWall scans your filesystem, maps which tools can reach your credentials, and blocks threats before they happen.
16
+ Your AI tools have access to every secret on your machine. ChainWall scans your filesystem, maps which tools can reach your credentials, and blocks threats before they happen. Keep your device safe.
17
17
 
18
- `178 detection patterns` · `18 AI tools audited` · `743 tests` · `<50ms hooks`
18
+ `241 detection patterns` · `18 AI tools audited` · `978 tests` · `<50ms hooks`
19
19
 
20
20
  </div>
21
21
 
22
+ ---
23
+
24
+ ## Get Started
25
+
26
+ ```bash
27
+ npm install -g chainwall
28
+ chainwall
29
+ ```
30
+
31
+ That's it. Two commands. The interactive dashboard opens and walks you through everything — scan for secrets, audit your AI tools, monitor runtime behavior, and configure protection. No flags to memorize, no config files to write.
32
+
22
33
  <p align="center">
23
34
  <img src=".github/images/dashboard.png" width="680" alt="ChainWall Dashboard">
24
35
  </p>
25
36
 
37
+ > [!TIP]
38
+ > The dashboard is the best way to use ChainWall. Navigate with `1`-`6`, run scans and audits from inside, toggle protection with `p`, remediate findings with `r`, and press `?` for all keybindings. Everything the CLI can do, the dashboard does better.
39
+
26
40
  <div align="center">
27
41
 
28
42
  [Twitter](https://x.com/Antivirus) · [GitHub](https://github.com/consulalialpric/chainwall) · [@girlintokyo](https://x.com/girlintokyo)
@@ -33,43 +47,93 @@ Your AI tools have access to every secret on your machine. ChainWall scans your
33
47
 
34
48
  ## Table of Contents
35
49
 
36
- - [Installation](#installation)
37
50
  - [The Problem](#the-problem)
38
51
  - [See It in Action](#see-it-in-action)
39
52
  - [What It Does](#what-it-does)
53
+ - [CLI Commands](#cli-commands)
40
54
  - [Detection Patterns](#detection-patterns)
41
55
  - [Supported AI Tools](#supported-ai-tools)
56
+ - [MCP Server](#mcp-server)
42
57
  - [Architecture](#architecture)
43
58
  - [Reference](#reference)
44
59
  - [License](#license)
45
60
 
46
61
  ---
47
62
 
48
- ## Installation
63
+ ## The Problem
64
+
65
+ > [!WARNING]
66
+ > **Your AI tools can read every secret on your machine right now.**
67
+
68
+ AI tools have broad filesystem access — coding agents, chat assistants, automation workflows, MCP servers — they can all reach your AWS credentials, SSH keys, `.env` files, crypto wallets, and browser cookies. Most users have no idea how exposed they are.
49
69
 
50
- ### Step 1Install
70
+ The threat isn't hypothetical. A single prompt injection buried in a dependency README. A hallucinated shell command that pipes your keys to a remote server. A compromised MCP server that exfiltrates environment variables on every call. The agent doesn't need to be malicious it just needs to be tricked.
51
71
 
52
- Run this once to install ChainWall globally:
72
+ There's no firewall between your AI tools and your secrets. No permission model. No audit trail. You're running autonomous software with the keys to your entire digital life, and hoping for the best.
53
73
 
54
- ```bash
55
- npm install -g chainwall
56
- ```
74
+ ChainWall closes the gap. Scan what's exposed, see which tools can reach it, and block threats before they execute — in under a minute.
75
+
76
+ ---
77
+
78
+ ## See It in Action
79
+
80
+ <p align="center">
81
+ <img src=".github/images/demo.gif" width="680" alt="ChainWall TUI Demo">
82
+ </p>
83
+
84
+ ---
85
+
86
+ ## What It Does
87
+
88
+ ### Scan
89
+
90
+ ChainWall walks your filesystem and matches every file against 241 detection patterns — credentials, private keys, crypto seeds, PII, dangerous commands, supply chain attacks, and cryptojacking. Entropy validation filters out false positives so you only see real secrets. System-level scans target the specific locations where credentials actually live: `~/.aws`, `~/.ssh`, `~/.gnupg`, browser profiles, and more.
91
+
92
+ <p align="center">
93
+ <img src=".github/images/scan.png" width="640" alt="ChainWall scan results">
94
+ </p>
95
+
96
+ ### Audit
97
+
98
+ The auditor detects every AI tool on your machine — 18 tools across three access levels — then cross-references each tool's filesystem reach against your discovered secrets. The result is an exposure map: which tools can read which secrets, ranked by risk. It also inspects MCP server configurations for poisoning attacks (description injection, typosquatting, rug-pull detection), VS Code extensions, CLI tools, environment variables, running cryptocurrency miners, and skill/instruction file threats.
99
+
100
+ Sections like MCP Servers, VS Code Extensions, and Environment Variables show "None found." when your system is clean — that's the goal. If something is lurking, ChainWall will surface it.
101
+
102
+ <p align="center">
103
+ <img src=".github/images/audit.png" width="640" alt="ChainWall audit results">
104
+ </p>
105
+
106
+ ### Monitor
107
+
108
+ Runtime behavioral analysis scans running processes, network connections, browser extensions, shadow AI tools, clipboard contents, and persistence mechanisms (crontab, launch agents, shell profiles). Findings are correlated using signal-based scoring with PID cross-referencing and optional baseline diffing to detect new activity since your last snapshot.
57
109
 
58
- ### Step 2 — Use
110
+ ### Protect
111
+
112
+ Real-time bash hooks intercept dangerous operations before they execute. Pre-commit hooks block secrets from entering your git history. Pre-push hooks catch force-pushes and branch deletions. PreToolUse and PostToolUse hooks run inline with Claude Code to block file reads and shell commands in real-time — under 50ms, every time.
59
113
 
60
- These are the commands you'll use day-to-day:
114
+ > [!IMPORTANT]
115
+ > The two layers are fully independent. Bash hooks work without Node.js installed. The TypeScript CLI works without hooks being configured. Use either or both.
116
+
117
+ ---
118
+
119
+ ## CLI Commands
120
+
121
+ The dashboard is the recommended way to use ChainWall, but every feature is also available as a standalone command:
61
122
 
62
123
  ```bash
124
+ chainwall # launch the interactive dashboard (recommended)
63
125
  chainwall scan # find secrets, keys, and PII on your machine
64
126
  chainwall audit # map which AI tools can reach those secrets
127
+ chainwall monitor # runtime behavioral analysis (processes, network, persistence)
65
128
  chainwall init # install real-time protection hooks (one-time setup)
66
- chainwall # launch interactive dashboard
67
129
  ```
68
130
 
69
131
  > [!NOTE]
70
- > `chainwall scan` and `chainwall audit` are your main tools — run them anytime to check your exposure. `chainwall init` only needs to run once per project to deploy hooks. After that, just launch `chainwall` for the full dashboard.
132
+ > `chainwall init` only needs to run once per project to deploy hooks. After that, just launch `chainwall` for the full dashboard.
71
133
 
72
- ### Where to run it
134
+ <details>
135
+ <summary><b>Platform guide</b></summary>
136
+ <br>
73
137
 
74
138
  <table>
75
139
  <tr>
@@ -113,6 +177,8 @@ chainwall # launch interactive dashboard
113
177
  </tr>
114
178
  </table>
115
179
 
180
+ </details>
181
+
116
182
  <details>
117
183
  <summary><b>Install from source</b></summary>
118
184
  <br>
@@ -139,62 +205,9 @@ Pure bash + jq, executes in under 50ms, zero network calls.
139
205
 
140
206
  ---
141
207
 
142
- ## The Problem
143
-
144
- > [!WARNING]
145
- > **Your AI tools can read every secret on your machine right now.**
146
-
147
- AI tools have broad filesystem access — coding agents, chat assistants, automation workflows, MCP servers — they can all reach your AWS credentials, SSH keys, `.env` files, crypto wallets, and browser cookies. Most users have no idea how exposed they are.
148
-
149
- The threat isn't hypothetical. A single prompt injection buried in a dependency README. A hallucinated shell command that pipes your keys to a remote server. A compromised MCP server that exfiltrates environment variables on every call. The agent doesn't need to be malicious — it just needs to be tricked.
150
-
151
- There's no firewall between your AI tools and your secrets. No permission model. No audit trail. You're running autonomous software with the keys to your entire digital life, and hoping for the best.
152
-
153
- ChainWall closes the gap. Scan what's exposed, see which tools can reach it, and block threats before they execute — in under a minute.
154
-
155
- ---
156
-
157
- ## See It in Action
158
-
159
- <p align="center">
160
- <img src=".github/images/demo.gif" width="680" alt="ChainWall TUI Demo">
161
- </p>
162
-
163
- > [!TIP]
164
- > Launch the interactive dashboard with `chainwall` (no arguments). Navigate panels with `1`-`5`, toggle protection with `p`, press `?` for help.
165
-
166
- ---
167
-
168
- ## What It Does
169
-
170
- ### Scan
171
-
172
- ChainWall walks your filesystem and matches every file against 178 compiled regex patterns — credentials, private keys, crypto seeds, PII, dangerous commands, supply chain attacks, and cryptojacking. Entropy validation filters out false positives so you only see real secrets. System-level scans target the specific locations where credentials actually live: `~/.aws`, `~/.ssh`, `~/.gnupg`, browser profiles, and more.
173
-
174
- <p align="center">
175
- <img src=".github/images/scan.png" width="640" alt="ChainWall scan results">
176
- </p>
177
-
178
- ### Audit
179
-
180
- The auditor detects every AI tool on your machine — 18 tools across three access levels — then cross-references each tool's filesystem reach against your discovered secrets. The result is an exposure map: which tools can read which secrets, ranked by risk. It also inspects MCP server configurations for poisoning attacks (description injection, typosquatting, rug-pull detection), VS Code extensions, CLI tools, environment variables, running cryptocurrency miners, and skill/instruction file threats.
181
-
182
- <p align="center">
183
- <img src=".github/images/audit.png" width="640" alt="ChainWall audit results">
184
- </p>
185
-
186
- ### Protect
187
-
188
- Real-time bash hooks intercept dangerous operations before they execute. Pre-commit hooks block secrets from entering your git history. Pre-push hooks catch force-pushes and branch deletions. PreToolUse and PostToolUse hooks run inline with Claude Code to block file reads and shell commands in real-time — under 50ms, every time.
189
-
190
- > [!IMPORTANT]
191
- > The two layers are fully independent. Bash hooks work without Node.js installed. The TypeScript CLI works without hooks being configured. Use either or both.
192
-
193
- ---
194
-
195
208
  ## Detection Patterns
196
209
 
197
- 178 patterns across 11 categories, with entropy validation to reduce false positives.
210
+ 241 patterns across 12 categories, with entropy validation to reduce false positives.
198
211
 
199
212
  | Category | Patterns |
200
213
  |:---------|:--------:|
@@ -205,12 +218,13 @@ Real-time bash hooks intercept dangerous operations before they execute. Pre-com
205
218
  | **PII** | 15 |
206
219
  | **Supply Chain** | 16 |
207
220
  | **Prompt Injection** | 18 |
208
- | **Cryptojacking** | 22 |
221
+ | **Cryptojacking** | 19 |
222
+ | **Exfiltration** | 19 |
209
223
  | **Skill File Threats** | 25 |
210
224
  | **MCP Poisoning** | 6 modules |
211
225
  | **Permissions** | 11 |
212
226
 
213
- > 178 compiled rules + 25 skill-file rules + 10 contextual injection patterns + 3 shell history patterns loaded separately.
227
+ > 241 total patterns across all detection systems: 194 compiled scanner rules + 25 skill-file rules + 10 contextual injection patterns + 6 MCP poisoning modules + 3 shell history + 11 permission checks, loaded separately per context.
214
228
 
215
229
  <details>
216
230
  <summary><b>Credentials (55)</b></summary>
@@ -312,7 +326,7 @@ RSA Private Key, DSA Private Key, EC Private Key, OpenSSH Private Key, PGP Priva
312
326
  </details>
313
327
 
314
328
  <details>
315
- <summary><b>Cryptojacking (22)</b></summary>
329
+ <summary><b>Cryptojacking (19)</b></summary>
316
330
  <br>
317
331
 
318
332
  **Mining Pools:** Stratum+TCP URL, Stratum+SSL URL, Known Pool Domains, Mining Pool Ports
@@ -373,15 +387,123 @@ Instruction files are deployed to 11 tools via `chainwall init`.
373
387
 
374
388
  ---
375
389
 
390
+ ## MCP Server
391
+
392
+ ChainWall includes an MCP server that AI agents can call directly for real-time security checks — scan files, validate commands, and query protection status without leaving the agent loop.
393
+
394
+ ### Tools
395
+
396
+ | Tool | Description |
397
+ |:-----|:-----------|
398
+ | `scan_file` | Scan a file for secrets (restricted to cwd) |
399
+ | `scan_content` | Scan arbitrary text for secrets |
400
+ | `check_command` | Check if a shell command is dangerous |
401
+ | `audit_status` | Get current protection status |
402
+ | `monitor_snapshot` | Runtime behavioral scan (processes, network, persistence) |
403
+ | `capture_baseline` | Capture system baseline for future diffing |
404
+
405
+ ### Setup
406
+
407
+ #### Automatic
408
+
409
+ ```bash
410
+ chainwall init
411
+ ```
412
+
413
+ This registers the MCP server in Claude Desktop and Cursor automatically.
414
+
415
+ #### Manual
416
+
417
+ Add the `chainwall` server to your MCP client config:
418
+
419
+ <table>
420
+ <tr>
421
+ <td width="60">
422
+
423
+ <img src="https://cdn.jsdelivr.net/gh/devicons/devicon/icons/apple/apple-original.svg" width="36" alt="macOS">
424
+
425
+ </td>
426
+ <td>
427
+
428
+ **Claude Desktop** — `~/Library/Application Support/Claude/claude_desktop_config.json`
429
+
430
+ </td>
431
+ </tr>
432
+ <tr>
433
+ <td>
434
+
435
+ <img src="https://cdn.jsdelivr.net/gh/devicons/devicon/icons/linux/linux-original.svg" width="36" alt="Linux">
436
+
437
+ </td>
438
+ <td>
439
+
440
+ **Claude Desktop** — `~/.config/Claude/claude_desktop_config.json`
441
+
442
+ </td>
443
+ </tr>
444
+ </table>
445
+
446
+ ```jsonc
447
+ {
448
+ "mcpServers": {
449
+ "chainwall": {
450
+ "command": "chainwall-mcp"
451
+ }
452
+ }
453
+ }
454
+ ```
455
+
456
+ <table>
457
+ <tr>
458
+ <td width="60">
459
+
460
+ <img src="https://cdn.jsdelivr.net/gh/devicons/devicon/icons/vscode/vscode-original.svg" width="36" alt="Cursor">
461
+
462
+ </td>
463
+ <td>
464
+
465
+ **Cursor** — `~/.cursor/mcp.json`
466
+
467
+ </td>
468
+ </tr>
469
+ </table>
470
+
471
+ ```jsonc
472
+ {
473
+ "mcpServers": {
474
+ "chainwall": {
475
+ "command": "chainwall-mcp"
476
+ }
477
+ }
478
+ }
479
+ ```
480
+
481
+ For **Windsurf** or other MCP clients, use the same JSON — the only requirement is that `chainwall-mcp` is on your PATH (installed via `npm install -g chainwall`).
482
+
483
+ ### Direct usage
484
+
485
+ ```bash
486
+ chainwall mcp
487
+ ```
488
+
489
+ Starts the MCP server on stdio for testing or debugging. Useful for verifying tool responses before wiring it into your AI client.
490
+
491
+ > [!TIP]
492
+ > The MCP **server** (above) lets agents call ChainWall for security checks. The MCP **detector** (part of `chainwall audit`) finds MCP servers already on your system and analyzes them for poisoning attacks — description injection, typosquatting, excessive permissions, and rug-pull detection. They're separate features.
493
+
494
+ ---
495
+
376
496
  ## Architecture
377
497
 
378
498
  ```mermaid
379
499
  graph TD
380
500
  CW["<b>CHAINWALL</b>"] --> BH["<b>Bash Hooks</b><br><i>real-time, &lt;50ms</i><br>PreToolUse · PostToolUse<br>pre-commit · pre-push"]
381
- CW --> CLI["<b>TypeScript CLI</b><br><i>scan / audit / TUI</i><br>178 patterns · 18 tools<br>exposure map · SARIF"]
382
- CW --> MCP["<b>MCP Server</b><br><i>agent-callable</i><br>scan_file · scan_content<br>check_command · audit_status"]
501
+ CW --> CLI["<b>TypeScript CLI</b><br><i>scan / audit / TUI</i><br>241 patterns · 18 tools<br>exposure map · SARIF"]
502
+ CW --> MON["<b>Runtime Monitor</b><br><i>behavioral analysis</i><br>process · network · browser<br>shadow AI · clipboard · persistence"]
503
+ CW --> MCP["<b>MCP Server</b><br><i>agent-callable</i><br>scan_file · scan_content<br>check_command · audit_status<br>monitor_snapshot · capture_baseline"]
383
504
  BH --> XR["<b>Cross-Reference</b><br><b>Exposure Map</b><br><i>secrets × tool access<br>= what's actually at risk</i>"]
384
505
  CLI --> XR
506
+ MON --> XR
385
507
  MCP --> XR
386
508
  ```
387
509
 
@@ -391,17 +513,18 @@ graph TD
391
513
 
392
514
  ```
393
515
  hooks/ Bash hooks (PreToolUse/PostToolUse, git pre-commit/pre-push)
394
- patterns/ YAML pattern databases (7 files)
516
+ patterns/ YAML pattern databases (8 files)
395
517
  rules/ Instruction files for 11 AI tools
396
518
  src/
397
- commands/ scan, audit, init, watch, allow handlers
398
- rules/ 178 patterns as pre-compiled RegExp
519
+ commands/ scan, audit, init, watch, monitor, allow handlers
520
+ rules/ 241 patterns as pre-compiled RegExp
399
521
  scanner/ Async filesystem walker + rule engine
400
522
  auditor/ 18-tool detector + MCP/CLI/VS Code scanner + MCP poison detector + miner detector
401
523
  reporter/ Terminal, JSON, SARIF, audit reports
524
+ monitor/ 6 runtime scanners + correlation + baseline
402
525
  tui/ Interactive TUI (Ink + React)
403
- mcp-server/ 4-tool MCP server (stdio transport)
404
- test/ Vitest tests (25 files)
526
+ mcp-server/ 6-tool MCP server (stdio transport)
527
+ test/ Vitest tests (35 files)
405
528
  tests/ Bash test suite (11 suites)
406
529
  install.sh Universal installer
407
530
  ```
@@ -418,11 +541,12 @@ install.sh Universal installer
418
541
 
419
542
  | Command | Description |
420
543
  |:--------|:-----------|
421
- | `chainwall` | Launch interactive TUI |
544
+ | `chainwall` | Launch interactive dashboard |
422
545
  | `chainwall scan [dir]` | Scan for secrets, keys, and PII |
423
546
  | `chainwall scan --system` | System credential locations only |
424
547
  | `chainwall audit [dir]` | Map AI tool access + cross-reference exposure |
425
548
  | `chainwall watch [dir]` | Real-time file monitoring |
549
+ | `chainwall monitor [dir]` | Runtime behavioral analysis |
426
550
  | `chainwall init [dir]` | Install hooks for detected AI tools |
427
551
  | `chainwall enable` / `disable` | Toggle real-time protection |
428
552
  | `chainwall status` | Show protection status |
@@ -446,6 +570,8 @@ install.sh Universal installer
446
570
  | `--grouped` | scan | Group findings by category |
447
571
  | `--remediate` | audit | Interactive remediation prompts |
448
572
  | `--deep` | audit | Full recursive home directory walk |
573
+ | `--baseline` | monitor | Compare against saved baseline |
574
+ | `--json` | monitor | Output as JSON |
449
575
 
450
576
  </details>
451
577
 
@@ -486,33 +612,14 @@ Launch with `chainwall` (no arguments) for a full-screen keyboard-driven dashboa
486
612
 
487
613
  | Panel | What it shows |
488
614
  |:------|:-------------|
489
- | **Overview** | Protection status, recent activity, system summary |
490
- | **Scan** | Mode selection, grouped results, severity/category filtering, search |
491
- | **Audit** | 9-section accordion (summary, tools, exposure, MCP, CLIs, VS Code, env, MCP poisoning, cryptojacking), remediation |
615
+ | **Overview** | Protection status, detected tools, risk score, system summary |
616
+ | **Scan** | Mode selection with duration estimates, grouped results, severity/category filtering, search, allowlisting |
617
+ | **Audit** | 9-section accordion (tools, exposure map, MCP, CLIs, VS Code, env, MCP poisoning, cryptojacking), remediation actions |
618
+ | **Monitor** | Runtime behavioral analysis — 6-scanner accordion with detail views, remediation, severity filtering |
492
619
  | **Settings** | Allowlist/blocklist/skipDirs, toggle protection, global/project scope |
493
620
  | **Logs** | Audit trail with severity filtering and real-time reload |
494
621
 
495
- Keyboard: `1`-`5` switch panels · `p` toggle protection · `?` help · `q` quit
496
-
497
- </details>
498
-
499
- <details>
500
- <summary><b>MCP Server</b></summary>
501
- <br>
502
-
503
- ChainWall includes an MCP server that AI agents can call directly for security checks.
504
-
505
- | Tool | Description |
506
- |:-----|:-----------|
507
- | `scan_file` | Scan a file for secrets (restricted to cwd) |
508
- | `scan_content` | Scan arbitrary text for secrets |
509
- | `check_command` | Check if a shell command is dangerous |
510
- | `audit_status` | Get current protection status |
511
-
512
- Start with `chainwall mcp` or configure in Claude Desktop / Cursor settings via `chainwall init`.
513
-
514
- > [!TIP]
515
- > The MCP **server** (above) lets agents call ChainWall for security checks. The MCP **detector** (part of `chainwall audit`) finds MCP servers already on your system and analyzes them for risky capabilities like filesystem access, exec, and network calls. They're separate features.
622
+ Keyboard: `1`-`6` switch panels · `p` toggle protection · `?` help · `q` quit
516
623
 
517
624
  </details>
518
625
 
@@ -529,6 +636,7 @@ Start with `chainwall mcp` or configure in Claude Desktop / Cursor settings via
529
636
  | MCP poisoning detection | :white_check_mark: | :x: | :x: | :x: |
530
637
  | Skill file threat scanning | :white_check_mark: | :x: | :x: | :x: |
531
638
  | Cryptojacking detection | :white_check_mark: | :x: | :x: | :x: |
639
+ | Runtime behavioral monitoring | :white_check_mark: | :x: | :x: | :x: |
532
640
  | Instruction file deployment | 11 tools | :x: | :x: | :x: |
533
641
  | Entropy validation | :white_check_mark: | :x: | :white_check_mark: | :white_check_mark: |
534
642
  | PII detection | :white_check_mark: | :x: | :x: | :x: |
@@ -547,11 +655,11 @@ Start with `chainwall mcp` or configure in Claude Desktop / Cursor settings via
547
655
  <br>
548
656
 
549
657
  ```bash
550
- ./tests/run-all.sh # 223 bash hook tests (11 suites)
551
- npm test # 520 vitest tests (25 test files)
658
+ ./tests/run-all.sh # 225 bash hook tests (11 suites)
659
+ npx vitest run # 753 vitest tests (35 test files)
552
660
  ```
553
661
 
554
- **743 tests total**, all passing.
662
+ **978 tests total**, all passing.
555
663
 
556
664
  </details>
557
665
 
@@ -261,7 +261,7 @@ function checkDefinitionChanges(servers, definitions) {
261
261
  if (!existsSync(dir))
262
262
  mkdirSync(dir, { recursive: true });
263
263
  const merged = { ...storedHashes, ...newHashes };
264
- const tmpPath = HASH_FILE_PATH + '.tmp';
264
+ const tmpPath = HASH_FILE_PATH + `.tmp.${process.pid}`;
265
265
  writeFileSync(tmpPath, JSON.stringify(merged, null, 2) + '\n');
266
266
  renameSync(tmpPath, HASH_FILE_PATH);
267
267
  }
@@ -1 +1 @@
1
- {"version":3,"file":"mcp-poison-detector.js","sourceRoot":"","sources":["../../src/auditor/mcp-poison-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AA8BlC,0EAA0E;AAE1E,MAAM,eAAe,GAAG;IACtB,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY;IACzD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;IACvD,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO;IACtD,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM;IACrD,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK;IAClD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ;CACnC,CAAC;AAEF,MAAM,qBAAqB,GAA8E;IACvG;QACE,KAAK,EAAE,iBAAiB;QACxB,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qEAAqE;KACnF;IACD;QACE,KAAK,EAAE,oCAAoC;QAC3C,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,kFAAkF;KAChG;IACD;QACE,KAAK,EAAE,oCAAoC;QAC3C,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,8DAA8D;KAC5E;CACF,CAAC;AAEF,mCAAmC;AACnC,MAAM,oBAAoB,GAAG;IAC3B,EAAE,OAAO,EAAE,2DAA2D,EAAE,KAAK,EAAE,uBAAuB,EAAE;IACxG,EAAE,OAAO,EAAE,4DAA4D,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACrG,EAAE,OAAO,EAAE,2EAA2E,EAAE,KAAK,EAAE,eAAe,EAAE;IAChH,EAAE,OAAO,EAAE,4DAA4D,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACrG,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAAqB,EAAE;IAC7D,EAAE,OAAO,EAAE,kDAAkD,EAAE,KAAK,EAAE,uBAAuB,EAAE;CAChG,CAAC;AAEF,0BAA0B;AAC1B,MAAM,uBAAuB,GAAG;IAC9B,EAAE,OAAO,EAAE,wCAAwC,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAC9E,EAAE,OAAO,EAAE,gEAAgE,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACtG,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,qBAAqB,EAAE;IAC9D,EAAE,OAAO,EAAE,yDAAyD,EAAE,KAAK,EAAE,eAAe,EAAE;IAC9F,EAAE,OAAO,EAAE,sCAAsC,EAAE,KAAK,EAAE,gBAAgB,EAAE;CAC7E,CAAC;AAEF,oCAAoC;AACpC,MAAM,gBAAgB,GAAgE;IACpF;QACE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QACrE,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,mFAAmF;KAC3F;IACD;QACE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QACjD,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,wEAAwE;KAChF;IACD;QACE,QAAQ,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;QAC/C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oEAAoE;KAC5E;CACF,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAErE,0EAA0E;AAE1E,SAAS,yBAAyB,CAAC,MAAiB,EAAE,UAAmC;IACvF,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAEzD,gDAAgD;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAK,UAAsC,CAAC,YAAY,CAAC;IACvF,MAAM,YAAY,GAAyC,EAAE,CAAC;IAE9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC9C,MAAM,CAAC,GAAG,IAA+B,CAAC;gBAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBAClC,IAAI,IAAI;oBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,YAAY,CAAC,IAAI,CAAC;QAChB,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9C,gCAAgC;QAChC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,QAAQ;gBACR,WAAW,EAAE,uCAAuC,IAAI,CAAC,MAAM,2CAA2C;aAC3G,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;YAC7C,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,uBAAuB;oBACjC,QAAQ,EAAE,MAAM;oBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ,EAAE,QAAQ,IAAI,SAAS;oBAC/B,WAAW,EAAE,GAAG,SAAS,CAAC,KAAK,gBAAgB,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,aAAa;oBACtG,MAAM,EAAE,YAAY,SAAS,CAAC,KAAK,EAAE;iBACtC,CAAC,CAAC;gBACH,MAAM,CAAC,mCAAmC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAa,CAAC,CAAC;IAE/F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CACjB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAiB;IAC3C,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAEvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,IAAI,KAAK,KAAK;YAAE,SAAS,CAAC,gCAAgC;QAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,gBAAgB,MAAM,CAAC,IAAI,yCAAyC,KAAK,4BAA4B;gBAClH,MAAM,EAAE,yBAAyB,IAAI,UAAU,KAAK,GAAG;aACxD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,gBAAgB,MAAM,CAAC,IAAI,8BAA8B,KAAK,gCAAgC;gBAC3G,MAAM,EAAE,yBAAyB,IAAI,UAAU,KAAK,GAAG;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAiB;IAClD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IAE/C,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,MAAM,EAAE,iBAAiB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACnD,CAAC,CAAC;YACH,MAAM,CAAC,4BAA4B;QACrC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAiB,EAAE,UAAmC;IACjF,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7C,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,GAAG,KAAK,+BAA+B;gBACpD,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO;aACvE,CAAC,CAAC;YACH,MAAM,CAAC,0CAA0C;QACnD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAiB,EAAE,UAAmC;IACvF,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,qBAAqB;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAoB,EACpB,WAAiD;IAEjD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,uBAAuB;IACvB,IAAI,YAAY,GAA2B,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAA2B,CAAC;QAC7F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,sBAAsB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAE9B,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,2EAA2E;gBACxF,MAAM,EAAE,kBAAkB,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;aACnG,CAAC,CAAC;YACH,aAAa,EAAE,CAAC;QAClB,CAAC;aAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,aAAa,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,SAAS,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,cAAc,GAAG,MAAM,CAAC;QACxC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AACrC,CAAC;AAED,0EAA0E;AAE1E,MAAM,UAAU,kBAAkB,CAChC,OAAoB,EACpB,WAAiD;IAEjD,MAAM,WAAW,GAAuB,EAAE,CAAC;IAC3C,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAEhC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAE/C,WAAW,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5D,WAAW,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,WAAW,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,WAAW,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACtD,WAAW,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,uCAAuC;IACvC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjG,WAAW,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;IACpC,uBAAuB,GAAG,aAAa,CAAC;IAExC,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,uBAAuB;KACxB,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"mcp-poison-detector.js","sourceRoot":"","sources":["../../src/auditor/mcp-poison-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AA8BlC,0EAA0E;AAE1E,MAAM,eAAe,GAAG;IACtB,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY;IACzD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;IACvD,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO;IACtD,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM;IACrD,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK;IAClD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ;CACnC,CAAC;AAEF,MAAM,qBAAqB,GAA8E;IACvG;QACE,KAAK,EAAE,iBAAiB;QACxB,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qEAAqE;KACnF;IACD;QACE,KAAK,EAAE,oCAAoC;QAC3C,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,kFAAkF;KAChG;IACD;QACE,KAAK,EAAE,oCAAoC;QAC3C,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,8DAA8D;KAC5E;CACF,CAAC;AAEF,mCAAmC;AACnC,MAAM,oBAAoB,GAAG;IAC3B,EAAE,OAAO,EAAE,2DAA2D,EAAE,KAAK,EAAE,uBAAuB,EAAE;IACxG,EAAE,OAAO,EAAE,4DAA4D,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACrG,EAAE,OAAO,EAAE,2EAA2E,EAAE,KAAK,EAAE,eAAe,EAAE;IAChH,EAAE,OAAO,EAAE,4DAA4D,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACrG,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAAqB,EAAE;IAC7D,EAAE,OAAO,EAAE,kDAAkD,EAAE,KAAK,EAAE,uBAAuB,EAAE;CAChG,CAAC;AAEF,0BAA0B;AAC1B,MAAM,uBAAuB,GAAG;IAC9B,EAAE,OAAO,EAAE,wCAAwC,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAC9E,EAAE,OAAO,EAAE,gEAAgE,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACtG,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,qBAAqB,EAAE;IAC9D,EAAE,OAAO,EAAE,yDAAyD,EAAE,KAAK,EAAE,eAAe,EAAE;IAC9F,EAAE,OAAO,EAAE,sCAAsC,EAAE,KAAK,EAAE,gBAAgB,EAAE;CAC7E,CAAC;AAEF,oCAAoC;AACpC,MAAM,gBAAgB,GAAgE;IACpF;QACE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QACrE,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,mFAAmF;KAC3F;IACD;QACE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QACjD,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,wEAAwE;KAChF;IACD;QACE,QAAQ,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;QAC/C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oEAAoE;KAC5E;CACF,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAErE,0EAA0E;AAE1E,SAAS,yBAAyB,CAAC,MAAiB,EAAE,UAAmC;IACvF,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAEzD,gDAAgD;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAK,UAAsC,CAAC,YAAY,CAAC;IACvF,MAAM,YAAY,GAAyC,EAAE,CAAC;IAE9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC9C,MAAM,CAAC,GAAG,IAA+B,CAAC;gBAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBAClC,IAAI,IAAI;oBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,YAAY,CAAC,IAAI,CAAC;QAChB,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9C,gCAAgC;QAChC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,QAAQ;gBACR,WAAW,EAAE,uCAAuC,IAAI,CAAC,MAAM,2CAA2C;aAC3G,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;YAC7C,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,uBAAuB;oBACjC,QAAQ,EAAE,MAAM;oBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ,EAAE,QAAQ,IAAI,SAAS;oBAC/B,WAAW,EAAE,GAAG,SAAS,CAAC,KAAK,gBAAgB,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,aAAa;oBACtG,MAAM,EAAE,YAAY,SAAS,CAAC,KAAK,EAAE;iBACtC,CAAC,CAAC;gBACH,MAAM,CAAC,mCAAmC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAa,CAAC,CAAC;IAE/F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CACjB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAChB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAiB;IAC3C,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAEvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,IAAI,KAAK,KAAK;YAAE,SAAS,CAAC,gCAAgC;QAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,gBAAgB,MAAM,CAAC,IAAI,yCAAyC,KAAK,4BAA4B;gBAClH,MAAM,EAAE,yBAAyB,IAAI,UAAU,KAAK,GAAG;aACxD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,gBAAgB,MAAM,CAAC,IAAI,8BAA8B,KAAK,gCAAgC;gBAC3G,MAAM,EAAE,yBAAyB,IAAI,UAAU,KAAK,GAAG;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAiB;IAClD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IAE/C,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,MAAM,EAAE,iBAAiB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACnD,CAAC,CAAC;YACH,MAAM,CAAC,4BAA4B;QACrC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAiB,EAAE,UAAmC;IACjF,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7C,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,GAAG,KAAK,+BAA+B;gBACpD,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO;aACvE,CAAC,CAAC;YACH,MAAM,CAAC,0CAA0C;QACnD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAiB,EAAE,UAAmC;IACvF,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,qBAAqB;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAoB,EACpB,WAAiD;IAEjD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,uBAAuB;IACvB,IAAI,YAAY,GAA2B,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAA2B,CAAC;QAC7F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,sBAAsB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAE9B,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,2EAA2E;gBACxF,MAAM,EAAE,kBAAkB,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;aACnG,CAAC,CAAC;YACH,aAAa,EAAE,CAAC;QAClB,CAAC;aAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,aAAa,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,SAAS,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,cAAc,GAAG,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACvD,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AACrC,CAAC;AAED,0EAA0E;AAE1E,MAAM,UAAU,kBAAkB,CAChC,OAAoB,EACpB,WAAiD;IAEjD,MAAM,WAAW,GAAuB,EAAE,CAAC;IAC3C,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAEhC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAE/C,WAAW,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5D,WAAW,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,WAAW,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,WAAW,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACtD,WAAW,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,uCAAuC;IACvC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjG,WAAW,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;IACpC,uBAAuB,GAAG,aAAa,CAAC;IAExC,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,uBAAuB;KACxB,CAAC;AACJ,CAAC"}
@@ -1,3 +1,4 @@
1
+ import type { ProcessInfo } from '../monitor/types.js';
1
2
  export interface RunningMiner {
2
3
  pid: number;
3
4
  name: string;
@@ -12,6 +13,21 @@ export interface MinerDetectionResult {
12
13
  runningMiners: RunningMiner[];
13
14
  suspiciousCrontabs: SuspiciousCrontab[];
14
15
  }
16
+ export declare const KNOWN_MINER_NAMES: string[];
17
+ export declare const MINER_PATTERN: RegExp;
18
+ export declare const CURL_BASH_PATTERN: RegExp;
19
+ export declare const STRATUM_PATTERN: RegExp;
20
+ export declare const POOL_PATTERN: RegExp;
21
+ /**
22
+ * Parse `ps -eo pid,ppid,user,%cpu,%mem,lstart,command` output into structured ProcessInfo[].
23
+ * Shared by miner-detector and monitor/process-scanner.
24
+ */
25
+ export declare function parseProcessList(output: string): ProcessInfo[];
26
+ /**
27
+ * Parse crontab -l output into non-comment, non-empty lines.
28
+ * Shared by miner-detector and monitor/persistence-scanner.
29
+ */
30
+ export declare function parseCrontabOutput(output: string): string[];
15
31
  /**
16
32
  * Detect running cryptocurrency mining processes and suspicious crontab entries.
17
33
  * Uses execFileSync (no shell injection risk) for both ps and crontab.
@@ -1 +1 @@
1
- {"version":3,"file":"miner-detector.d.ts","sourceRoot":"","sources":["../../src/auditor/miner-detector.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;CACzC;AAgBD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,oBAAoB,CAInD"}
1
+ {"version":3,"file":"miner-detector.d.ts","sourceRoot":"","sources":["../../src/auditor/miner-detector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;CACzC;AAED,eAAO,MAAM,iBAAiB,UAI7B,CAAC;AAEF,eAAO,MAAM,aAAa,QAEzB,CAAC;AAEF,eAAO,MAAM,iBAAiB,QAAmC,CAAC;AAClE,eAAO,MAAM,eAAe,QAA+B,CAAC;AAC5D,eAAO,MAAM,YAAY,QAAkD,CAAC;AAE5E;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CAoC9D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAI3D;AAED;;;GAGG;AACH,wBAAgB,YAAY,IAAI,oBAAoB,CAInD"}