correctover-scan 2.1.0 → 2.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +30 -16
  2. package/package.json +7 -4
package/README.md CHANGED
@@ -1,31 +1,45 @@
1
1
  # correctover-scan
2
2
 
3
- This package name is retained for npm search compatibility.
3
+ MCP / DSH configuration security scanner — part of the
4
+ [Correctover](https://www.npmjs.com/package/correctover) runtime verification
5
+ suite. Delegates core checks to the maintained `correctover` engine.
4
6
 
5
- The maintained MCP security scanner runtime is in the zero-dependency [`correctover`](https://www.npmjs.com/package/correctover) package.
7
+ ## Quick try (no install)
6
8
 
7
- ## CLI
8
-
9
- ```bash
10
- npm install -g correctover-scan
11
- correctover-scan mcp.json
12
- correctover-scan mcp.json --format json
9
+ ```sh
10
+ npx correctover-scan
13
11
  ```
14
12
 
15
- The wrapper installs `correctover` and delegates static checks to `MCPSecurityValidator`.
13
+ Runs a built-in demo against 5 sample MCP server configurations and prints
14
+ every CRITICAL / HIGH issue it finds.
16
15
 
17
- ## Programmatic API
16
+ ## Scan your own config
18
17
 
19
- ```javascript
20
- const { MCPSecurityValidator, GuardrailProvider } = require('correctover-scan');
18
+ ```sh
19
+ npx correctover-scan ./mcp.json
20
+ npx correctover-scan ./mcp.json --format json
21
21
  ```
22
22
 
23
- These exports are forwarded from `correctover`.
23
+ ## What it detects
24
+
25
+ - **CRITICAL** — `curl | sh`, `wget | sh`, `rm -rf /`, `eval(...)`,
26
+ `os.system`, `subprocess`, `chmod 777`, `sudo`, command substitution with
27
+ network calls
28
+ - **HIGH** — stdio transport leaking env vars, sensitive env names
29
+ (`API_KEY` / `SECRET` / `TOKEN` / `PASSWORD` / ...), plaintext HTTP URLs
30
+ - Engine-delegated schema / transport checks from `correctover`
31
+
32
+ ## Runtime protection
24
33
 
25
- ## For DSH runtime protection
34
+ The scanner is the static front door. For runtime enforcement inside
35
+ DeepSeek Harness (DSH) or any MCP-based agent:
26
36
 
27
- ```bash
37
+ ```sh
28
38
  npm install correctover
39
+ # DSH users:
40
+ dsh plugin add dsh-correctover
29
41
  ```
30
42
 
31
- Enable the DSH plugin via `correctover/dsh`.
43
+ CCS 7-dimension verification standard (IETF draft
44
+ [draft-correctover-ccs](https://datatracker.ietf.org/doc/draft-correctover-ccs/)):
45
+ Structure · Schema · Latency · Cost · Identity · Integrity · Security.
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "correctover-scan",
3
- "version": "2.1.0",
4
- "description": "Compatibility CLI/package name for Correctover MCP security scanning. The maintained scanner runtime lives in correctover.",
3
+ "version": "2.1.2",
4
+ "description": "MCP security scanner CLI \u2014 scan your MCP server configs for SSRF, command injection, credential exposure, and overprivileged commands. 30-second demo: npx correctover-scan --demo",
5
5
  "main": "index.js",
6
6
  "bin": {
7
7
  "correctover-scan": "./cli.js"
@@ -44,9 +44,12 @@
44
44
  },
45
45
  "homepage": "https://www.npmjs.com/package/correctover",
46
46
  "dependencies": {
47
- "correctover": "^2.4.6"
47
+ "correctover": "^2.4.7"
48
48
  },
49
49
  "engines": {
50
50
  "node": ">=16.0.0"
51
+ },
52
+ "bugs": {
53
+ "url": "https://codeberg.org/correctover-labs/correctover/issues"
51
54
  }
52
- }
55
+ }