codegate-ai 0.16.2 → 1.0.1

package/dist/layer2-static/data/popular-mcp-packages.js

@@ -0,0 +1,83 @@
+import { loadActiveContentBundle } from "../../content/content-store.js";
+/**
+ * Well-known MCP server packages used as the reference set for typosquat
+ * detection. Curated, not exhaustive: entries should be packages an
+ * attacker would plausibly imitate. Data-driven so the content feed can
+ * extend it without a release.
+ */
+export const POPULAR_MCP_PACKAGES = {
+    npm: [
+        "@modelcontextprotocol/server-brave-search",
+        "@modelcontextprotocol/server-everything",
+        "@modelcontextprotocol/server-filesystem",
+        "@modelcontextprotocol/server-github",
+        "@modelcontextprotocol/server-gitlab",
+        "@modelcontextprotocol/server-google-maps",
+        "@modelcontextprotocol/server-memory",
+        "@modelcontextprotocol/server-postgres",
+        "@modelcontextprotocol/server-puppeteer",
+        "@modelcontextprotocol/server-sequential-thinking",
+        "@modelcontextprotocol/server-slack",
+        "@modelcontextprotocol/server-sqlite",
+        "@modelcontextprotocol/inspector",
+        "@anthropic/mcp-server-filesystem",
+        "@playwright/mcp",
+        "@browserbasehq/mcp",
+        "@notionhq/notion-mcp-server",
+        "@supabase/mcp-server-supabase",
+        "@upstash/context7-mcp",
+        "@21st-dev/magic",
+        "@sentry/mcp-server",
+        "@elastic/mcp-server-elasticsearch",
+        "firecrawl-mcp",
+        "tavily-mcp",
+        "exa-mcp-server",
+        "mcp-remote",
+        "supergateway",
+        "figma-developer-mcp",
+        "chrome-devtools-mcp",
+        "graphlit-mcp-server",
+    ],
+    pypi: [
+        "mcp",
+        "mcp-server-git",
+        "mcp-server-fetch",
+        "mcp-server-time",
+        "mcp-server-sqlite",
+        "mcp-server-sentry",
+        "fastmcp",
+        "mcp-atlassian",
+        "awslabs.aws-documentation-mcp-server",
+    ],
+};
+let cachedActivePackages = null;
+export function resetActivePopularMcpPackagesCache() {
+    cachedActivePackages = null;
+}
+function feedList(value) {
+    return Array.isArray(value)
+        ? value.filter((entry) => typeof entry === "string" && entry.length > 0)
+        : [];
+}
+/** Bundled popular packages plus any extras delivered by the verified content feed. */
+export function activePopularMcpPackages() {
+    if (cachedActivePackages) {
+        return cachedActivePackages;
+    }
+    let npmExtra;
+    let pypiExtra;
+    try {
+        const bundle = loadActiveContentBundle();
+        npmExtra = feedList(bundle?.popular_packages?.npm);
+        pypiExtra = feedList(bundle?.popular_packages?.pypi);
+    }
+    catch {
+        npmExtra = [];
+        pypiExtra = [];
+    }
+    cachedActivePackages = {
+        npm: [...new Set([...POPULAR_MCP_PACKAGES.npm, ...npmExtra])],
+        pypi: [...new Set([...POPULAR_MCP_PACKAGES.pypi, ...pypiExtra])],
+    };
+    return cachedActivePackages;
+}

package/dist/layer2-static/detectors/known-bad.d.ts

@@ -0,0 +1,22 @@
+import { type ResolvedKnownBadIndicators } from "../../content/known-bad.js";
+import type { Finding } from "../../types/finding.js";
+export interface KnownBadDetectionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+    indicators: ResolvedKnownBadIndicators;
+}
+export declare const KNOWN_BAD_MATCH_KIND: {
+    readonly FileHash: "file-hash";
+    readonly PackageName: "package-name";
+    readonly UrlPattern: "url-pattern";
+};
+export type KnownBadMatchKind = (typeof KNOWN_BAD_MATCH_KIND)[keyof typeof KNOWN_BAD_MATCH_KIND];
+export declare const KNOWN_BAD_RULE_ID = "known-malicious-content";
+export declare function detectKnownBadContent(input: KnownBadDetectionInput): Finding[];
+/**
+ * Escalate findings whose stable fingerprint appears in the known-bad
+ * indicator set to CRITICAL. Runs on the assembled finding list so it also
+ * covers findings produced outside the static engine.
+ */
+export declare function escalateKnownBadFindings(findings: Finding[], indicators: ResolvedKnownBadIndicators): Finding[];

package/dist/layer2-static/detectors/known-bad.js

@@ -0,0 +1,116 @@
+import { createHash } from "node:crypto";
+import { hasKnownBadIndicators } from "../../content/known-bad.js";
+import { buildFindingFingerprint } from "../../report/finding-fingerprint.js";
+import { collectMcpPackageLaunches, parsePackageLocator } from "./mcp-package-hygiene.js";
+export const KNOWN_BAD_MATCH_KIND = {
+    FileHash: "file-hash",
+    PackageName: "package-name",
+    UrlPattern: "url-pattern",
+};
+export const KNOWN_BAD_RULE_ID = "known-malicious-content";
+const URL_PATTERN = /https?:\/\/[^\s"'`<>)\]}]+/giu;
+const MATCH_KIND_CATEGORY = {
+    [KNOWN_BAD_MATCH_KIND.FileHash]: "CONFIG_PRESENT",
+    [KNOWN_BAD_MATCH_KIND.PackageName]: "COMMAND_EXEC",
+    [KNOWN_BAD_MATCH_KIND.UrlPattern]: "CONFIG_PRESENT",
+};
+function makeKnownBadFinding(input, kind, field, description, evidence) {
+    return {
+        rule_id: KNOWN_BAD_RULE_ID,
+        finding_id: `KNOWN_MALICIOUS_CONTENT-${kind}-${input.filePath}-${field}-${evidence}`,
+        severity: "CRITICAL",
+        category: MATCH_KIND_CATEGORY[kind],
+        layer: "L2",
+        file_path: input.filePath,
+        location: { field },
+        description,
+        affected_tools: ["claude-code", "codex-cli", "opencode", "cursor", "windsurf"],
+        cve: null,
+        owasp: ["ASI05"],
+        cwe: "CWE-506",
+        confidence: "HIGH",
+        fixable: true,
+        remediation_actions: ["quarantine_file", "remove_field"],
+        metadata: {
+            sources: [input.filePath, field],
+            risk_tags: ["known-bad", kind],
+            origin: "known-bad",
+        },
+        evidence,
+        suppressed: false,
+    };
+}
+function detectFileHashMatch(input) {
+    const hash = createHash("sha256").update(input.textContent, "utf8").digest("hex");
+    if (!input.indicators.fileSha256.has(hash)) {
+        return [];
+    }
+    return [
+        makeKnownBadFinding(input, KNOWN_BAD_MATCH_KIND.FileHash, "content", `File content matches a known-malicious SHA-256 indicator (${hash}). ` +
+            "Quarantine this file and audit how it got here.", `sha256:${hash}`),
+    ];
+}
+function detectPackageNameMatches(input) {
+    const findings = [];
+    for (const launch of collectMcpPackageLaunches(input.parsed)) {
+        const { name } = parsePackageLocator(launch.registry, launch.locator);
+        if (!input.indicators.packageNames.has(name.toLowerCase())) {
+            continue;
+        }
+        findings.push(makeKnownBadFinding(input, KNOWN_BAD_MATCH_KIND.PackageName, launch.serverPath, `MCP server runs ${launch.registry} package "${name}", which is a known-malicious package. ` +
+            "Remove this server configuration immediately.", `${launch.serverPath}: ${launch.locator}`));
+    }
+    return findings;
+}
+function detectUrlPatternMatches(input) {
+    const findings = [];
+    const reported = new Set();
+    for (const match of input.textContent.matchAll(URL_PATTERN)) {
+        const url = match[0];
+        const normalized = url.toLowerCase();
+        const pattern = input.indicators.urlPatterns.find((entry) => normalized.includes(entry));
+        if (!pattern || reported.has(normalized)) {
+            continue;
+        }
+        reported.add(normalized);
+        findings.push(makeKnownBadFinding(input, KNOWN_BAD_MATCH_KIND.UrlPattern, "content", `File references "${url}", which matches the known-malicious URL indicator "${pattern}". ` +
+            "Remove the reference and audit anything fetched from it.", url));
+    }
+    return findings;
+}
+export function detectKnownBadContent(input) {
+    if (!hasKnownBadIndicators(input.indicators)) {
+        return [];
+    }
+    return [
+        ...detectFileHashMatch(input),
+        ...detectPackageNameMatches(input),
+        ...detectUrlPatternMatches(input),
+    ];
+}
+/**
+ * Escalate findings whose stable fingerprint appears in the known-bad
+ * indicator set to CRITICAL. Runs on the assembled finding list so it also
+ * covers findings produced outside the static engine.
+ */
+export function escalateKnownBadFindings(findings, indicators) {
+    if (indicators.findingFingerprints.size === 0) {
+        return findings;
+    }
+    return findings.map((finding) => {
+        const fingerprint = finding.fingerprint ?? buildFindingFingerprint(finding);
+        if (!indicators.findingFingerprints.has(fingerprint)) {
+            return finding;
+        }
+        return {
+            ...finding,
+            severity: "CRITICAL",
+            description: `${finding.description} This finding matches a known-malicious indicator ` +
+                "and has been escalated to CRITICAL.",
+            metadata: {
+                ...finding.metadata,
+                risk_tags: [...(finding.metadata?.risk_tags ?? []), "known-bad"],
+            },
+        };
+    });
+}

package/dist/layer2-static/detectors/mcp-package-hygiene.d.ts

@@ -0,0 +1,28 @@
+import type { Finding } from "../../types/finding.js";
+export interface McpPackageHygieneInput {
+    filePath: string;
+    parsed: unknown;
+    knownSafeMcpServers: string[];
+}
+export declare const PACKAGE_REGISTRY: {
+    readonly Npm: "npm";
+    readonly Pypi: "pypi";
+};
+export type PackageRegistry = (typeof PACKAGE_REGISTRY)[keyof typeof PACKAGE_REGISTRY];
+export interface PackageLaunch {
+    registry: PackageRegistry;
+    locator: string;
+    serverPath: string;
+    autoConfirm: boolean;
+}
+interface ParsedLocator {
+    name: string;
+    version: string | null;
+}
+export declare function parsePackageLocator(registry: PackageRegistry, locator: string): ParsedLocator;
+export declare function isPinnedLocator(registry: PackageRegistry, locator: string): boolean;
+export declare function findLikelyTyposquatTarget(registry: PackageRegistry, name: string): string | null;
+/** MCP server package launches (npx/uvx/pipx style) found in a parsed config. */
+export declare function collectMcpPackageLaunches(parsed: unknown): PackageLaunch[];
+export declare function detectMcpPackageHygiene(input: McpPackageHygieneInput): Finding[];
+export {};

package/dist/layer2-static/detectors/mcp-package-hygiene.js

@@ -0,0 +1,191 @@
+import { activePopularMcpPackages } from "../data/popular-mcp-packages.js";
+import { damerauLevenshtein } from "../text/edit-distance.js";
+const MCP_SERVER_CONTAINER_KEYS = ["mcpServers", "mcp_servers", "context_servers"];
+export const PACKAGE_REGISTRY = {
+    Npm: "npm",
+    Pypi: "pypi",
+};
+const NPM_LAUNCHERS = new Set(["npx", "pnpx", "bunx"]);
+const PYPI_LAUNCHERS = new Set(["uvx", "pipx"]);
+// Exact versions pin the executed code; tags and ranges resolve at launch time.
+const EXACT_NPM_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[\w.]+)?$/u;
+const EXACT_PYPI_VERSION_PATTERN = /^==\s*\d+(?:\.\d+)*(?:[a-z0-9.]*)$/iu;
+const MIN_TYPOSQUAT_NAME_LENGTH = 4;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseNpmLocator(locator) {
+    const versionIndex = locator.lastIndexOf("@");
+    if (versionIndex > 0) {
+        return { name: locator.slice(0, versionIndex), version: locator.slice(versionIndex + 1) };
+    }
+    return { name: locator, version: null };
+}
+function parsePypiLocator(locator) {
+    const specIndex = locator.search(/[=<>!~]/u);
+    if (specIndex > 0) {
+        return { name: locator.slice(0, specIndex), version: locator.slice(specIndex) };
+    }
+    return { name: locator, version: null };
+}
+export function parsePackageLocator(registry, locator) {
+    return registry === PACKAGE_REGISTRY.Npm ? parseNpmLocator(locator) : parsePypiLocator(locator);
+}
+export function isPinnedLocator(registry, locator) {
+    const { version } = parsePackageLocator(registry, locator);
+    if (version === null) {
+        return false;
+    }
+    return registry === PACKAGE_REGISTRY.Npm
+        ? EXACT_NPM_VERSION_PATTERN.test(version)
+        : EXACT_PYPI_VERSION_PATTERN.test(version);
+}
+function typosquatThreshold(name) {
+    return name.length >= 10 ? 2 : 1;
+}
+export function findLikelyTyposquatTarget(registry, name) {
+    const popular = activePopularMcpPackages()[registry];
+    const normalized = name.toLowerCase();
+    if (normalized.length < MIN_TYPOSQUAT_NAME_LENGTH || popular.includes(normalized)) {
+        return null;
+    }
+    let best = null;
+    for (const candidate of popular) {
+        const distance = damerauLevenshtein(normalized, candidate);
+        if (distance > 0 && distance <= typosquatThreshold(normalized)) {
+            if (!best || distance < best.distance) {
+                best = { target: candidate, distance };
+            }
+        }
+    }
+    return best?.target ?? null;
+}
+function commandTokens(config) {
+    if (Array.isArray(config.command) && config.command.every((entry) => typeof entry === "string")) {
+        return config.command;
+    }
+    if (typeof config.command === "string") {
+        const args = Array.isArray(config.args)
+            ? config.args.filter((entry) => typeof entry === "string")
+            : [];
+        return [config.command, ...args];
+    }
+    return [];
+}
+function firstNonFlag(tokens, startIndex) {
+    for (let index = startIndex; index < tokens.length; index += 1) {
+        const token = tokens[index];
+        if (typeof token !== "string" || token.length === 0 || token.startsWith("-")) {
+            continue;
+        }
+        return token;
+    }
+    return null;
+}
+function hasAutoConfirmFlag(tokens) {
+    return tokens.some((token) => token === "-y" || token === "--yes");
+}
+function collectPackageLaunches(value, path, launches) {
+    if (!isRecord(value)) {
+        return;
+    }
+    for (const containerKey of MCP_SERVER_CONTAINER_KEYS) {
+        const container = value[containerKey];
+        if (!isRecord(container)) {
+            continue;
+        }
+        for (const [serverName, serverConfig] of Object.entries(container)) {
+            if (!isRecord(serverConfig)) {
+                continue;
+            }
+            const tokens = commandTokens(serverConfig);
+            if (tokens.length === 0) {
+                continue;
+            }
+            const launcher = (tokens[0] ?? "").toLowerCase();
+            const registry = NPM_LAUNCHERS.has(launcher)
+                ? PACKAGE_REGISTRY.Npm
+                : PYPI_LAUNCHERS.has(launcher)
+                    ? PACKAGE_REGISTRY.Pypi
+                    : null;
+            if (!registry) {
+                continue;
+            }
+            const locator = firstNonFlag(tokens, 1);
+            if (!locator) {
+                continue;
+            }
+            launches.push({
+                registry,
+                locator,
+                serverPath: `${path}${containerKey}.${serverName}`,
+                autoConfirm: hasAutoConfirmFlag(tokens),
+            });
+        }
+    }
+    for (const [key, nested] of Object.entries(value)) {
+        if (MCP_SERVER_CONTAINER_KEYS.includes(key)) {
+            continue;
+        }
+        collectPackageLaunches(nested, `${path}${key}.`, launches);
+    }
+}
+function makeFinding(input, launch, ruleId, severity, description) {
+    return {
+        rule_id: ruleId,
+        finding_id: `${ruleId.toUpperCase().replaceAll("-", "_")}-${input.filePath}-${launch.serverPath}`,
+        severity,
+        category: "COMMAND_EXEC",
+        layer: "L2",
+        file_path: input.filePath,
+        location: { field: launch.serverPath },
+        description,
+        affected_tools: ["claude-code", "codex-cli", "opencode", "cursor", "windsurf"],
+        cve: null,
+        owasp: ["ASI05"],
+        cwe: "CWE-829",
+        confidence: "HIGH",
+        fixable: true,
+        remediation_actions: ["remove_field", "replace_with_default"],
+        metadata: {
+            sources: [input.filePath, launch.serverPath],
+            risk_tags: ["mcp", "supply-chain"],
+            origin: "mcp-package-hygiene",
+        },
+        evidence: `${launch.serverPath}: ${launch.locator}`,
+        suppressed: false,
+    };
+}
+/** MCP server package launches (npx/uvx/pipx style) found in a parsed config. */
+export function collectMcpPackageLaunches(parsed) {
+    const launches = [];
+    collectPackageLaunches(parsed, "", launches);
+    return launches;
+}
+export function detectMcpPackageHygiene(input) {
+    const launches = collectMcpPackageLaunches(input.parsed);
+    if (launches.length === 0) {
+        return [];
+    }
+    const knownSafe = new Set(input.knownSafeMcpServers.map((entry) => entry.toLowerCase()));
+    const findings = [];
+    for (const launch of launches) {
+        const { name } = parsePackageLocator(launch.registry, launch.locator);
+        if (knownSafe.has(name.toLowerCase())) {
+            continue;
+        }
+        if (!isPinnedLocator(launch.registry, launch.locator)) {
+            const autoConfirmNote = launch.autoConfirm
+                ? " The launcher auto-confirms installation (-y), so new versions run without any prompt."
+                : "";
+            findings.push(makeFinding(input, launch, "mcp-unpinned-package", "MEDIUM", `MCP server runs ${launch.registry} package "${launch.locator}" without an exact version pin, ` +
+                `so it executes whatever the registry serves at launch time.${autoConfirmNote}`));
+        }
+        const typosquatTarget = findLikelyTyposquatTarget(launch.registry, name);
+        if (typosquatTarget) {
+            findings.push(makeFinding(input, launch, "mcp-possible-typosquat", "HIGH", `MCP server package "${name}" is one edit away from the well-known package ` +
+                `"${typosquatTarget}". Verify this is the intended package and not a typosquat.`));
+        }
+    }
+    return findings;
+}