contextguard 0.1.7 → 0.1.8

package/dist/mcp-security-wrapper.js

@@ -319,20 +319,48 @@ class MCPSecurityWrapper {
         }
     }
     handleServerOutput(output) {
-        // Forward output immediately
-        process.stdout.write(output);
-        // Buffer and parse for logging
+        // Buffer and parse for security scanning
         this.serverMessageBuffer += output;
         const lines = this.serverMessageBuffer.split("\n");
         this.serverMessageBuffer = lines.pop() || "";
         for (const line of lines) {
             if (line.trim()) {
+                let shouldForward = true;
                 try {
                     const message = JSON.parse(line);
-                    this.logger.logEvent("SERVER_RESPONSE", "LOW", {
-                        id: message.id,
-                        hasError: !!message.error,
-                    }, this.sessionId);
+                    // Check for sensitive data in response
+                    const violations = [];
+                    const responseStr = JSON.stringify(message.result || message);
+                    const sensitiveViolations = this.policy.checkSensitiveData(responseStr);
+                    violations.push(...sensitiveViolations);
+                    if (violations.length > 0) {
+                        this.logger.logEvent("SENSITIVE_DATA_LEAK", "CRITICAL", {
+                            violations,
+                            responseId: message.id,
+                        }, this.sessionId);
+                        console.error(`\n🚨 SENSITIVE DATA DETECTED IN RESPONSE:\n${violations.join("\n")}\n`);
+                        console.error("🚫 RESPONSE BLOCKED\n");
+                        // Send sanitized error response instead
+                        if (message.id !== undefined) {
+                            const errorResponse = {
+                                jsonrpc: message.jsonrpc,
+                                id: message.id,
+                                error: {
+                                    code: -32001,
+                                    message: "Security violation: Response contains sensitive data",
+                                    data: { violations },
+                                },
+                            };
+                            process.stdout.write(JSON.stringify(errorResponse) + "\n");
+                        }
+                        shouldForward = false;
+                    }
+                    else {
+                        this.logger.logEvent("SERVER_RESPONSE", "LOW", {
+                            id: message.id,
+                            hasError: !!message.error,
+                        }, this.sessionId);
+                    }
                 }
                 catch (err) {
                     // Log parse errors for server output
@@ -341,6 +369,10 @@ class MCPSecurityWrapper {
                         line: line.substring(0, 100),
                     }, this.sessionId);
                 }
+                // Forward the line if not blocked
+                if (shouldForward) {
+                    process.stdout.write(line + "\n");
+                }
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "contextguard",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Security monitoring wrapper for MCP servers",
   "main": "dist/mcp-security-wrapper.js",
   "types": "dist/mcp-security-wrapper.d.ts",
@@ -15,7 +15,8 @@
     "start": "node dist/server.js",
     "dev": "ts-node src/mcp-security-wrapper.ts",
     "test": "jest",
-    "lint": "eslint ."
+    "lint": "eslint .",
+    "release": "npm publish & npm install -g contextguard"
   },
   "keywords": [
     "mcp",

package/src/mcp-security-wrapper.ts

@@ -427,27 +427,63 @@ class MCPSecurityWrapper {
   }
 
   private handleServerOutput(output: string): void {
-    // Forward output immediately
-    process.stdout.write(output);
-
-    // Buffer and parse for logging
+    // Buffer and parse for security scanning
     this.serverMessageBuffer += output;
     const lines = this.serverMessageBuffer.split("\n");
     this.serverMessageBuffer = lines.pop() || "";
 
     for (const line of lines) {
       if (line.trim()) {
+        let shouldForward = true;
         try {
           const message: MCPMessage = JSON.parse(line);
-          this.logger.logEvent(
-            "SERVER_RESPONSE",
-            "LOW",
-            {
-              id: message.id,
-              hasError: !!message.error,
-            },
-            this.sessionId
-          );
+          
+          // Check for sensitive data in response
+          const violations: string[] = [];
+          const responseStr = JSON.stringify(message.result || message);
+          const sensitiveViolations = this.policy.checkSensitiveData(responseStr);
+          violations.push(...sensitiveViolations);
+
+          if (violations.length > 0) {
+            this.logger.logEvent(
+              "SENSITIVE_DATA_LEAK",
+              "CRITICAL",
+              {
+                violations,
+                responseId: message.id,
+              },
+              this.sessionId
+            );
+            console.error(
+              `\n🚨 SENSITIVE DATA DETECTED IN RESPONSE:\n${violations.join("\n")}\n`
+            );
+            console.error("🚫 RESPONSE BLOCKED\n");
+            
+            // Send sanitized error response instead
+            if (message.id !== undefined) {
+              const errorResponse: MCPMessage = {
+                jsonrpc: message.jsonrpc,
+                id: message.id,
+                error: {
+                  code: -32001,
+                  message: "Security violation: Response contains sensitive data",
+                  data: { violations },
+                },
+              };
+              process.stdout.write(JSON.stringify(errorResponse) + "\n");
+            }
+            shouldForward = false;
+          } else {
+            this.logger.logEvent(
+              "SERVER_RESPONSE",
+              "LOW",
+              {
+                id: message.id,
+                hasError: !!message.error,
+              },
+              this.sessionId
+            );
+          }
         } catch (err) {
           // Log parse errors for server output
           this.logger.logEvent(
@@ -460,6 +496,11 @@ class MCPSecurityWrapper {
             this.sessionId
           );
         }
+        
+        // Forward the line if not blocked
+        if (shouldForward) {
+          process.stdout.write(line + "\n");
+        }
       }
     }
   }