claude-flow 3.32.14 → 3.32.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.32.14",
+  "version": "3.32.15",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 1,
-  "generatedAt": "2026-07-27T02:19:54.128Z",
-  "gitSha": "8a884a06",
+  "generatedAt": "2026-07-27T02:28:39.254Z",
+  "gitSha": "fc88555f",
   "catalog": {
     "agents": 164,
     "tools": 387,

package/v3/@claude-flow/cli/dist/src/commands/security.js

@@ -977,15 +977,101 @@ const defendCommand = {
         return { success: safe, exitCode: safe ? 0 : 1 };
     },
 };
+// #2783 dream-cycle — MCP Composition Inspector subcommand.
+// Standalone scanner (no LLM) that reads the registered MCP tool
+// descriptors and flags cross-tool signals of Shamir-split prompt
+// injection (arXiv 2606.27027 ShareLock) + typo-squat lookalikes
+// against trusted ruflo prefixes.
+const compositionScanCommand = {
+    name: 'composition-scan',
+    description: 'Scan registered MCP tool descriptions for cross-tool prompt-injection signatures (dream-cycle #2783)',
+    options: [
+        { name: 'min-fragment', type: 'number', default: 20, description: 'Minimum shared-substring length to flag (default: 20 chars)' },
+        { name: 'top', type: 'number', default: 20, description: 'Show top N suspects (default: 20)' },
+        { name: 'tools-json', type: 'string', description: 'Path to a JSON file of {name, description}[] to scan (default: scan the CLI\'s own registered MCP tools)' },
+    ],
+    examples: [
+        { command: 'claude-flow security composition-scan', description: 'Scan the CLI\'s own registered MCP tool descriptions' },
+        { command: 'claude-flow security composition-scan --tools-json ./external-mcp-registry.json --top 50', description: 'Scan a third-party MCP registry' },
+    ],
+    action: async (ctx) => {
+        const minFragment = ctx.flags.minFragment || 20;
+        const top = ctx.flags.top || 20;
+        const toolsJson = ctx.flags.toolsJson;
+        let tools = [];
+        try {
+            if (toolsJson) {
+                const fs = await import('node:fs');
+                const path = await import('node:path');
+                const raw = fs.readFileSync(path.resolve(toolsJson), 'utf-8');
+                const parsed = JSON.parse(raw);
+                if (!Array.isArray(parsed))
+                    throw new Error(`${toolsJson} must contain a JSON array of {name, description}`);
+                tools = parsed
+                    .filter((t) => typeof t === 'object' && t !== null &&
+                    typeof t.name === 'string' &&
+                    typeof t.description === 'string')
+                    .map((t) => ({ name: t.name, description: t.description }));
+            }
+            else {
+                // Scan the CLI's own registered MCP tools via the client registry.
+                const { listMCPTools } = await import('../mcp-client.js');
+                tools = listMCPTools().map((t) => ({ name: t.name, description: t.description }));
+            }
+        }
+        catch (err) {
+            output.printError(`Failed to load tools: ${err instanceof Error ? err.message : String(err)}`);
+            return { success: false, exitCode: 1 };
+        }
+        const { scanToolDescriptions } = await import('../security/mcp-composition-inspector.js');
+        const result = scanToolDescriptions(tools, { minFragment });
+        output.writeln();
+        output.printBox(`Scanned ${result.stats.toolsScanned} MCP tools; compared ${result.stats.pairsCompared} pairs.\n` +
+            `Suspects: ${result.suspects.length}`, 'MCP Composition Inspector (#2783)');
+        if (ctx.flags.format === 'json') {
+            output.printJson(result);
+            return { success: true, data: result };
+        }
+        if (result.suspects.length === 0) {
+            output.writeln();
+            output.printSuccess('No cross-tool prompt-injection signatures detected.');
+            output.writeln(output.dim('Note: heuristic scanner. Absence of hits does not prove safety — MCP tools you didn\'t audit yourself should still be treated as untrusted.'));
+            return { success: true, data: result };
+        }
+        const sorted = [...result.suspects].sort((a, b) => b.score - a.score).slice(0, top);
+        output.writeln();
+        output.writeln(output.bold(`Top ${sorted.length} suspects (sorted by score)`));
+        output.printTable({
+            columns: [
+                { key: 'kind', header: 'Kind', width: 18 },
+                { key: 'tool', header: 'Tool', width: 30 },
+                { key: 'peer', header: 'Peer', width: 30 },
+                { key: 'score', header: 'Score', width: 8, align: 'right', format: (v) => (Number(v)).toFixed(2) },
+                { key: 'fragment', header: 'Fragment', width: 40 },
+            ],
+            data: sorted.map((s) => ({
+                kind: s.kind,
+                tool: s.tool,
+                peer: s.peer ?? '',
+                score: s.score,
+                fragment: s.fragment.length > 40 ? s.fragment.slice(0, 37) + '…' : s.fragment,
+            })),
+        });
+        output.writeln();
+        output.writeln(output.dim('Score ≥ 0.9 = high (likely real). 0.5–0.9 = investigate. < 0.5 = probably benign coincidence.'));
+        return { success: true, data: result };
+    },
+};
 // Main security command
 export const securityCommand = {
     name: 'security',
     description: 'Security scanning, CVE detection, threat modeling, AI defense',
-    subcommands: [scanCommand, cveCommand, threatsCommand, auditCommand, secretsCommand, defendCommand],
+    subcommands: [scanCommand, cveCommand, threatsCommand, auditCommand, secretsCommand, defendCommand, compositionScanCommand],
     examples: [
         { command: 'claude-flow security scan', description: 'Run security scan' },
         { command: 'claude-flow security cve --list', description: 'List known CVEs' },
         { command: 'claude-flow security threats', description: 'Run threat analysis' },
+        { command: 'claude-flow security composition-scan', description: 'Scan MCP tool descriptions for cross-tool injection (dream-cycle #2783)' },
     ],
     action: async () => {
         output.writeln();
@@ -994,12 +1080,13 @@ export const securityCommand = {
         output.writeln();
         output.writeln('Subcommands:');
         output.printList([
-            'scan     - Run security scans on code, deps, containers',
-            'cve      - Check and manage CVE vulnerabilities',
-            'threats  - Threat modeling (STRIDE, DREAD, PASTA)',
-            'audit    - Security audit logging and compliance',
-            'secrets  - Detect and manage secrets in codebase',
-            'defend   - AI manipulation defense (prompt injection, jailbreaks, PII)',
+            'scan              - Run security scans on code, deps, containers',
+            'cve               - Check and manage CVE vulnerabilities',
+            'threats           - Threat modeling (STRIDE, DREAD, PASTA)',
+            'audit             - Security audit logging and compliance',
+            'secrets           - Detect and manage secrets in codebase',
+            'defend            - AI manipulation defense (prompt injection, jailbreaks, PII)',
+            'composition-scan  - Cross-tool prompt-injection scan on MCP registry (dream-cycle #2783)',
         ]);
         output.writeln();
         output.writeln('Use --help with subcommands for more info');

package/v3/@claude-flow/cli/dist/src/security/mcp-composition-inspector.d.ts

@@ -0,0 +1,72 @@
+/**
+ * MCP Composition Inspector (#2783 dream-cycle, arXiv 2606.27027 ShareLock).
+ *
+ * The attack: an adversary registers N seemingly-benign MCP tools whose
+ * INDIVIDUAL descriptions look fine, but whose CONCATENATION forms an
+ * injection payload targeting a specific downstream agent. Per-tool
+ * inspection misses this (each fragment is under the detection threshold).
+ * The inspector composes them and looks for cross-tool signal.
+ *
+ * SCOPE: heuristic detector, not a security boundary. Reports SUSPECTS —
+ * the operator decides. No blocking, no rewriting. This is the "MCP
+ * Composition Inspector" surface from dream-cycle #2783's ADR-320
+ * recommendation, delivered as a bounded engineering fix rather than
+ * an ADR-scope subsystem.
+ *
+ * Detection method (v1 — deterministic, no LLM):
+ *   1. Common-substring scan: for every pair of tools, find shared
+ *      substrings of length ≥ minFragment (default 20). Attacker
+ *      fragments would repeat identically or near-identically across
+ *      the split tools; benign tools rarely share 20+ char sequences
+ *      that aren't proper nouns or well-known phrases.
+ *   2. Suspicious-phrase catalog: strings that appear in known
+ *      prompt-injection templates ("ignore previous instructions",
+ *      "you are now", "system prompt", "delete all", etc.) — even
+ *      inside one tool, flagged.
+ *   3. Tool-name lookalikes: names that differ by ≤ 2 chars from a
+ *      known-trusted ruflo tool (typosquatting mitigation).
+ *
+ * Future v2: SimHash + LSH for scale (arXiv 2606.27027's proposal),
+ * OWASP LLM07 alignment.
+ */
+export interface ToolDescriptor {
+    name: string;
+    description: string;
+}
+export interface CompositionSuspect {
+    /** Suspect category — `shared-fragment`, `injection-phrase`, `name-lookalike`. */
+    kind: 'shared-fragment' | 'injection-phrase' | 'name-lookalike';
+    /** Tool name that carries the suspicious content. */
+    tool: string;
+    /** Peer tool (for shared-fragment / name-lookalike) or empty. */
+    peer?: string;
+    /** The offending substring or phrase (truncated for display). */
+    fragment: string;
+    /** Heuristic score, 0..1. Higher = more suspicious. */
+    score: number;
+    /** Human-readable explanation. */
+    reason: string;
+}
+export interface CompositionScanResult {
+    suspects: CompositionSuspect[];
+    stats: {
+        toolsScanned: number;
+        pairsCompared: number;
+        fragmentsCompared: number;
+    };
+}
+export declare function scanToolDescriptions(tools: ToolDescriptor[], options?: {
+    minFragment?: number;
+    trustedPrefixes?: readonly string[];
+    injectionPhrases?: readonly string[];
+    /**
+     * Maximum number of tools a fragment may appear in before we treat it
+     * as "template language" and stop flagging it. Attack fragments live
+     * in small conspiracies (2–3 tools); template language shows up in
+     * dozens. Default 3 catches Shamir-split attacks without flooding on
+     * legitimate ruflo tools that share the same MCP-tool-description
+     * template.
+     */
+    maxFragmentPopulation?: number;
+}): CompositionScanResult;
+//# sourceMappingURL=mcp-composition-inspector.d.ts.map

package/v3/@claude-flow/cli/dist/src/security/mcp-composition-inspector.js

@@ -0,0 +1,209 @@
+/**
+ * MCP Composition Inspector (#2783 dream-cycle, arXiv 2606.27027 ShareLock).
+ *
+ * The attack: an adversary registers N seemingly-benign MCP tools whose
+ * INDIVIDUAL descriptions look fine, but whose CONCATENATION forms an
+ * injection payload targeting a specific downstream agent. Per-tool
+ * inspection misses this (each fragment is under the detection threshold).
+ * The inspector composes them and looks for cross-tool signal.
+ *
+ * SCOPE: heuristic detector, not a security boundary. Reports SUSPECTS —
+ * the operator decides. No blocking, no rewriting. This is the "MCP
+ * Composition Inspector" surface from dream-cycle #2783's ADR-320
+ * recommendation, delivered as a bounded engineering fix rather than
+ * an ADR-scope subsystem.
+ *
+ * Detection method (v1 — deterministic, no LLM):
+ *   1. Common-substring scan: for every pair of tools, find shared
+ *      substrings of length ≥ minFragment (default 20). Attacker
+ *      fragments would repeat identically or near-identically across
+ *      the split tools; benign tools rarely share 20+ char sequences
+ *      that aren't proper nouns or well-known phrases.
+ *   2. Suspicious-phrase catalog: strings that appear in known
+ *      prompt-injection templates ("ignore previous instructions",
+ *      "you are now", "system prompt", "delete all", etc.) — even
+ *      inside one tool, flagged.
+ *   3. Tool-name lookalikes: names that differ by ≤ 2 chars from a
+ *      known-trusted ruflo tool (typosquatting mitigation).
+ *
+ * Future v2: SimHash + LSH for scale (arXiv 2606.27027's proposal),
+ * OWASP LLM07 alignment.
+ */
+/** Known prompt-injection phrases (case-insensitive substring match). */
+const INJECTION_PHRASES = [
+    'ignore previous instructions',
+    'ignore all prior',
+    'disregard the above',
+    'you are now',
+    'act as',
+    'system prompt',
+    'system:',
+    'assistant:',
+    'delete all',
+    'rm -rf',
+    'exfiltrate',
+    'send me the',
+    'reveal your',
+    'reveal the',
+    'override',
+    'jailbreak',
+];
+/** Known-trusted ruflo tool-name prefixes for typosquatting comparison. */
+const TRUSTED_PREFIXES = [
+    'memory_', 'hooks_', 'swarm_', 'agent_', 'claims_', 'coordination_',
+    'session_', 'workflow_', 'neural_', 'browser_', 'daemon_', 'agentdb_',
+    'aidefence_', 'analyze_', 'autopilot_', 'business_pod_', 'config_',
+    'embeddings_', 'federation_', 'github_', 'guidance_', 'hive-mind_',
+    'http_', 'managed_agent_', 'mcp_', 'metaharness_', 'performance_',
+    'progress_', 'ruvllm_', 'system_', 'task_', 'terminal_', 'transfer_',
+    'wasm_', 'wasm_gallery_', 'agenticow_',
+];
+function normalize(s) {
+    return s.toLowerCase().replace(/\s+/g, ' ').trim();
+}
+/** Levenshtein distance (bounded — returns Infinity past `max`). */
+function editDistance(a, b, max = 3) {
+    if (Math.abs(a.length - b.length) > max)
+        return Infinity;
+    const m = a.length, n = b.length;
+    const dp = Array.from({ length: n + 1 }, (_, i) => i);
+    for (let i = 1; i <= m; i++) {
+        let prev = dp[0];
+        dp[0] = i;
+        let minRow = dp[0];
+        for (let j = 1; j <= n; j++) {
+            const cur = dp[j];
+            dp[j] = a[i - 1] === b[j - 1] ? prev : Math.min(prev, dp[j - 1], dp[j]) + 1;
+            prev = cur;
+            if (dp[j] < minRow)
+                minRow = dp[j];
+        }
+        if (minRow > max)
+            return Infinity;
+    }
+    return dp[n];
+}
+/** Find all common substrings of length ≥ minLen between a and b. */
+function commonSubstrings(a, b, minLen, cap = 20) {
+    const out = new Set();
+    const aLen = a.length, bLen = b.length;
+    if (aLen < minLen || bLen < minLen)
+        return [];
+    // Sliding-window: hash each a[i..i+minLen] and check if it appears in b.
+    // Then expand greedily. Cheap and deterministic.
+    const seen = new Map();
+    for (let i = 0; i + minLen <= aLen; i++) {
+        seen.set(a.slice(i, i + minLen), i);
+    }
+    for (let j = 0; j + minLen <= bLen; j++) {
+        const window = b.slice(j, j + minLen);
+        const aIdx = seen.get(window);
+        if (aIdx === undefined)
+            continue;
+        // Expand greedily forward
+        let len = minLen;
+        while (aIdx + len < aLen &&
+            j + len < bLen &&
+            a[aIdx + len] === b[j + len])
+            len++;
+        out.add(a.slice(aIdx, aIdx + len));
+        if (out.size >= cap)
+            break;
+    }
+    return Array.from(out);
+}
+export function scanToolDescriptions(tools, options = {}) {
+    const minFragment = options.minFragment ?? 20;
+    const trustedPrefixes = options.trustedPrefixes ?? TRUSTED_PREFIXES;
+    const injectionPhrases = options.injectionPhrases ?? INJECTION_PHRASES;
+    const maxPopulation = options.maxFragmentPopulation ?? 3;
+    const suspects = [];
+    const stats = { toolsScanned: tools.length, pairsCompared: 0, fragmentsCompared: 0 };
+    const normalized = tools.map((t) => ({
+        name: t.name,
+        raw: t.description,
+        norm: normalize(t.description),
+    }));
+    // 1) Injection-phrase scan (per tool)
+    for (const t of normalized) {
+        for (const phrase of injectionPhrases) {
+            const idx = t.norm.indexOf(phrase);
+            if (idx >= 0) {
+                suspects.push({
+                    kind: 'injection-phrase',
+                    tool: t.name,
+                    fragment: t.raw.slice(Math.max(0, idx - 10), idx + phrase.length + 20).trim(),
+                    score: 0.9,
+                    reason: `Description contains known prompt-injection phrase "${phrase}"`,
+                });
+            }
+        }
+    }
+    // 2) Cross-tool shared-fragment scan — first collect ALL candidate
+    //    fragments and count how many distinct tools each appears in. Only
+    //    flag pairs where the fragment shows up in ≤ maxPopulation tools
+    //    (template language across N tools is not an attack signature).
+    const fragmentToTools = new Map();
+    const rawPairs = [];
+    for (let i = 0; i < normalized.length; i++) {
+        for (let j = i + 1; j < normalized.length; j++) {
+            stats.pairsCompared++;
+            const shared = commonSubstrings(normalized[i].norm, normalized[j].norm, minFragment);
+            stats.fragmentsCompared += shared.length;
+            for (const frag of shared) {
+                const wordCount = new Set(frag.split(/\s+/).filter(w => w.length > 2)).size;
+                if (wordCount < 3)
+                    continue;
+                const set = fragmentToTools.get(frag) ?? new Set();
+                set.add(normalized[i].name);
+                set.add(normalized[j].name);
+                fragmentToTools.set(frag, set);
+                rawPairs.push({ i, j, frag });
+            }
+        }
+    }
+    // Emit only fragments that live in a SMALL conspiracy of tools (≤ maxPop).
+    const emittedPair = new Set();
+    for (const { i, j, frag } of rawPairs) {
+        const population = fragmentToTools.get(frag)?.size ?? 0;
+        if (population > maxPopulation)
+            continue;
+        const key = `${normalized[i].name}||${normalized[j].name}||${frag}`;
+        if (emittedPair.has(key))
+            continue;
+        emittedPair.add(key);
+        const wordCount = new Set(frag.split(/\s+/).filter(w => w.length > 2)).size;
+        suspects.push({
+            kind: 'shared-fragment',
+            tool: normalized[i].name,
+            peer: normalized[j].name,
+            fragment: frag.slice(0, 80),
+            score: Math.min(1, frag.length / 100),
+            reason: `Shared substring (${frag.length} chars, ${wordCount} words, appears in ${population} tools) with ${normalized[j].name} — possible Shamir-split fragment`,
+        });
+    }
+    // 3) Name-lookalike scan (typosquat detection against trusted prefixes)
+    for (const t of normalized) {
+        for (const prefix of trustedPrefixes) {
+            // Exact-prefix match is fine (that's a legitimate ruflo tool)
+            if (t.name.startsWith(prefix))
+                break;
+            // Near-match to a trusted prefix (1-2 char edit distance)
+            const nameHead = t.name.slice(0, prefix.length);
+            const dist = editDistance(nameHead, prefix, 2);
+            if (dist > 0 && dist <= 2) {
+                suspects.push({
+                    kind: 'name-lookalike',
+                    tool: t.name,
+                    peer: prefix,
+                    fragment: nameHead,
+                    score: 0.7,
+                    reason: `Tool name prefix "${nameHead}" is ${dist} edit(s) from trusted ruflo prefix "${prefix}" — possible typosquat`,
+                });
+                break;
+            }
+        }
+    }
+    return { suspects, stats };
+}
+//# sourceMappingURL=mcp-composition-inspector.js.map

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.14",
+  "version": "3.32.15",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",