dns-security-mcp 0.1.0

package/dist/privacy/index.js

@@ -0,0 +1,772 @@
+import { z } from "zod";
+import { json } from "../types/index.js";
+import { queryDoH, queryDoT, queryRaw } from "../utils/dns-client.js";
+import * as tls from "node:tls";
+import * as dgram from "node:dgram";
+import * as dns from "node:dns/promises";
+import * as dnsPacket from "dns-packet";
+// ─── Constants ───
+const DEFAULT_DOH_SERVERS = {
+    "1.1.1.1": "https://cloudflare-dns.com/dns-query",
+    "cloudflare": "https://cloudflare-dns.com/dns-query",
+    "8.8.8.8": "https://dns.google/dns-query",
+    "google": "https://dns.google/dns-query",
+    "dns.google": "https://dns.google/dns-query",
+    "9.9.9.9": "https://dns.quad9.net/dns-query",
+    "quad9": "https://dns.quad9.net/dns-query",
+};
+function resolveDoHUrl(server) {
+    const lower = server.toLowerCase().trim();
+    if (DEFAULT_DOH_SERVERS[lower])
+        return DEFAULT_DOH_SERVERS[lower];
+    if (server.startsWith("https://"))
+        return server;
+    return `https://${server}/dns-query`;
+}
+function resolveDoTHost(server) {
+    const lower = server.toLowerCase().trim();
+    if (lower === "1.1.1.1" || lower === "cloudflare")
+        return "1.1.1.1";
+    if (lower === "8.8.8.8" || lower === "google" || lower === "dns.google")
+        return "dns.google";
+    if (lower === "9.9.9.9" || lower === "quad9")
+        return "dns.quad9.net";
+    return server;
+}
+// ─── Tool 1: privacy_doh_test ───
+const privacyDohTest = {
+    name: "privacy_doh_test",
+    description: "Test DNS-over-HTTPS (DoH) endpoint connectivity and response. Sends a JSON API query and checks response format, status, and DNSSEC (AD bit) support. Supports Cloudflare, Google, Quad9 and custom servers.",
+    schema: {
+        server: z
+            .string()
+            .describe("DoH server address or name (e.g. '1.1.1.1', 'cloudflare', 'dns.google', or full URL 'https://dns.example.com/dns-query')"),
+    },
+    async execute(args) {
+        const server = args.server;
+        const dohUrl = resolveDoHUrl(server);
+        try {
+            const startTime = Date.now();
+            const result = await queryDoH("example.com", "A", dohUrl);
+            const latency = Date.now() - startTime;
+            const hasAnswers = result.answers && result.answers.length > 0;
+            // Test DNSSEC by querying a signed domain
+            let dnssecSupported = false;
+            try {
+                const dnssecUrl = `${dohUrl}?name=example.com&type=A&do=1`;
+                const dnssecRes = await fetch(dnssecUrl, {
+                    headers: { Accept: "application/dns-json" },
+                    signal: AbortSignal.timeout(5000),
+                });
+                if (dnssecRes.ok) {
+                    const dnssecData = (await dnssecRes.json());
+                    dnssecSupported = dnssecData.AD === true;
+                }
+            }
+            catch {
+                // DNSSEC check failed
+            }
+            const findings = [];
+            findings.push(`OK: DoH endpoint is reachable at ${dohUrl}`);
+            findings.push(`Latency: ${latency}ms`);
+            if (hasAnswers) {
+                findings.push(`Response contains ${result.answers.length} answer(s)`);
+            }
+            else {
+                findings.push("WARNING: No answers in response");
+            }
+            if (dnssecSupported) {
+                findings.push("OK: DNSSEC validation supported (AD bit set)");
+            }
+            else {
+                findings.push("INFO: DNSSEC AD bit not set in DoH response");
+            }
+            return json({
+                server,
+                doh_url: dohUrl,
+                reachable: true,
+                latency_ms: latency,
+                answers_count: result.answers?.length ?? 0,
+                dnssec_ad_bit: dnssecSupported,
+                sample_answers: result.answers?.slice(0, 5) ?? [],
+                findings,
+            });
+        }
+        catch (err) {
+            return json({
+                server,
+                doh_url: dohUrl,
+                reachable: false,
+                error: err.message,
+                findings: [`FAIL: DoH endpoint unreachable at ${dohUrl}: ${err.message}`],
+            });
+        }
+    },
+};
+// ─── Tool 2: privacy_dot_test ───
+const privacyDotTest = {
+    name: "privacy_dot_test",
+    description: "Test DNS-over-TLS (DoT) endpoint connectivity and security. Reports TLS version, cipher suite, certificate validity, and DNS response. Validates that encrypted DNS transport is properly configured.",
+    schema: {
+        server: z
+            .string()
+            .describe("DoT server address or name (e.g. '1.1.1.1', 'dns.google', 'quad9')"),
+        port: z
+            .number()
+            .optional()
+            .describe("DoT port number (default: 853)"),
+    },
+    async execute(args) {
+        const server = args.server;
+        const port = args.port ?? 853;
+        const dotHost = resolveDoTHost(server);
+        // First, probe TLS details
+        const tlsInfo = await new Promise((resolve) => {
+            const socket = tls.connect(port, dotHost, { servername: dotHost }, () => {
+                const cipher = socket.getCipher();
+                const cert = socket.getPeerCertificate();
+                const authorized = socket.authorized;
+                resolve({
+                    connected: true,
+                    tls_version: socket.getProtocol?.() ?? cipher?.version ?? null,
+                    cipher: cipher?.name ?? null,
+                    cert_valid: authorized,
+                    cert_issuer: cert?.issuer ? Object.values(cert.issuer).join(", ") : null,
+                    cert_subject: (Array.isArray(cert?.subject?.CN) ? cert.subject.CN[0] : cert?.subject?.CN) ?? null,
+                    cert_expires: cert?.valid_to ?? null,
+                    error: null,
+                });
+                socket.destroy();
+            });
+            const timer = setTimeout(() => {
+                socket.destroy();
+                resolve({
+                    connected: false,
+                    tls_version: null,
+                    cipher: null,
+                    cert_valid: false,
+                    cert_issuer: null,
+                    cert_subject: null,
+                    cert_expires: null,
+                    error: "Connection timeout",
+                });
+            }, 5000);
+            socket.on("error", (err) => {
+                clearTimeout(timer);
+                resolve({
+                    connected: false,
+                    tls_version: null,
+                    cipher: null,
+                    cert_valid: false,
+                    cert_issuer: null,
+                    cert_subject: null,
+                    cert_expires: null,
+                    error: err.message,
+                });
+            });
+            socket.on("secureConnect", () => {
+                clearTimeout(timer);
+            });
+        });
+        // Then test actual DNS query over DoT
+        let dnsResponseValid = false;
+        let latency = null;
+        let answersCount = 0;
+        if (tlsInfo.connected) {
+            try {
+                const startTime = Date.now();
+                const answers = await queryDoT("example.com", "A", dotHost, port);
+                latency = Date.now() - startTime;
+                dnsResponseValid = answers.length > 0;
+                answersCount = answers.length;
+            }
+            catch {
+                dnsResponseValid = false;
+            }
+        }
+        const findings = [];
+        if (!tlsInfo.connected) {
+            findings.push(`FAIL: Could not connect to DoT server ${dotHost}:${port}`);
+            if (tlsInfo.error)
+                findings.push(`Error: ${tlsInfo.error}`);
+        }
+        else {
+            findings.push(`OK: DoT server reachable at ${dotHost}:${port}`);
+            if (tlsInfo.tls_version) {
+                const ver = tlsInfo.tls_version;
+                if (ver === "TLSv1.3") {
+                    findings.push("OK: TLS 1.3 — optimal security");
+                }
+                else if (ver === "TLSv1.2") {
+                    findings.push("OK: TLS 1.2 — acceptable security");
+                }
+                else {
+                    findings.push(`WARNING: ${ver} — outdated TLS version, recommend TLS 1.2+`);
+                }
+            }
+            if (tlsInfo.cipher) {
+                findings.push(`Cipher: ${tlsInfo.cipher}`);
+            }
+            if (!tlsInfo.cert_valid) {
+                findings.push("WARNING: TLS certificate validation failed");
+            }
+            else {
+                findings.push("OK: TLS certificate is valid");
+            }
+            if (dnsResponseValid) {
+                findings.push(`OK: DNS query succeeded over DoT (${answersCount} answer(s), ${latency}ms)`);
+            }
+            else {
+                findings.push("WARNING: TLS connected but DNS query failed");
+            }
+        }
+        return json({
+            server,
+            dot_host: dotHost,
+            port,
+            connected: tlsInfo.connected,
+            tls_version: tlsInfo.tls_version,
+            cipher: tlsInfo.cipher,
+            cert_valid: tlsInfo.cert_valid,
+            cert_issuer: tlsInfo.cert_issuer,
+            cert_subject: tlsInfo.cert_subject,
+            cert_expires: tlsInfo.cert_expires,
+            dns_response_valid: dnsResponseValid,
+            dns_latency_ms: latency,
+            answers_count: answersCount,
+            findings,
+        });
+    },
+};
+// ─── Tool 3: privacy_doq_test ───
+const privacyDoqTest = {
+    name: "privacy_doq_test",
+    description: "Test DNS-over-QUIC (DoQ) support on a server. Since Node.js QUIC support is experimental, performs a connectivity probe by sending a DNS query to port 853/UDP and checking for any response. Reports availability status.",
+    schema: {
+        server: z
+            .string()
+            .describe("Server address to test DoQ support (e.g. 'dns.adguard-dns.com', '94.140.14.14')"),
+    },
+    async execute(args) {
+        const server = args.server;
+        // DoQ uses port 853 UDP (same as DoT uses TCP, but QUIC is UDP-based)
+        const doqPort = 853;
+        // Build a DNS query packet to send over UDP to port 853
+        const queryBuf = dnsPacket.encode({
+            type: "query",
+            id: Math.floor(Math.random() * 65535),
+            flags: dnsPacket.RECURSION_DESIRED,
+            questions: [{ type: "A", name: "example.com", class: "IN" }],
+        });
+        // DoQ uses QUIC framing, so a raw UDP DNS packet won't get a proper response,
+        // but we can detect if the port is open/responding at all
+        const result = await new Promise((resolve) => {
+            const socket = dgram.createSocket("udp4");
+            let responded = false;
+            const timer = setTimeout(() => {
+                socket.close();
+                if (!responded) {
+                    resolve({
+                        port_open: false,
+                        received_response: false,
+                        response_bytes: 0,
+                        error: "No response within timeout (port may be filtered or DoQ not supported)",
+                    });
+                }
+            }, 5000);
+            socket.on("message", (msg) => {
+                responded = true;
+                clearTimeout(timer);
+                socket.close();
+                resolve({
+                    port_open: true,
+                    received_response: true,
+                    response_bytes: msg.length,
+                    error: null,
+                });
+            });
+            socket.on("error", (err) => {
+                responded = true;
+                clearTimeout(timer);
+                socket.close();
+                resolve({
+                    port_open: false,
+                    received_response: false,
+                    response_bytes: 0,
+                    error: err.message,
+                });
+            });
+            socket.send(queryBuf, 0, queryBuf.length, doqPort, server);
+        });
+        // Also check if we can detect DoQ via a known-good DoQ resolver list
+        const knownDoqServers = [
+            "dns.adguard-dns.com",
+            "dns.adguard.com",
+            "unfiltered.adguard-dns.com",
+            "dns.nextdns.io",
+        ];
+        const isKnownDoq = knownDoqServers.some((s) => server.toLowerCase().includes(s) || s.includes(server.toLowerCase()));
+        const findings = [];
+        if (result.received_response) {
+            findings.push(`OK: Port ${doqPort}/UDP responded (${result.response_bytes} bytes)`);
+            findings.push("Note: Response may be a QUIC version negotiation or ICMP unreachable — further validation needed");
+        }
+        else if (result.error?.includes("ICMP") || result.error?.includes("ECONNREFUSED")) {
+            findings.push(`FAIL: Port ${doqPort}/UDP actively refused connection`);
+        }
+        else {
+            findings.push(`INCONCLUSIVE: No response from ${server}:${doqPort}/UDP within timeout`);
+            findings.push("Note: This may mean DoQ is not supported, or a firewall is filtering UDP 853");
+        }
+        if (isKnownDoq) {
+            findings.push(`INFO: ${server} is a known DoQ-capable resolver (based on known server list)`);
+        }
+        findings.push("Note: Full DoQ validation requires QUIC protocol support (experimental in Node.js)");
+        findings.push("Recommendation: Use tools like 'q' (DNS client) or 'kdig' for full DoQ testing");
+        return json({
+            server,
+            port: doqPort,
+            protocol: "QUIC/UDP",
+            port_responded: result.received_response,
+            response_bytes: result.response_bytes,
+            known_doq_server: isKnownDoq,
+            error: result.error,
+            findings,
+        });
+    },
+};
+// ─── Tool 4: privacy_ecs_leak ───
+const privacyEcsLeak = {
+    name: "privacy_ecs_leak",
+    description: "Test EDNS Client Subnet (ECS) leak on a DNS resolver. Sends a query with an ECS option containing a /24 subnet to check if the resolver forwards client subnet information to authoritative servers, potentially exposing client location.",
+    schema: {
+        resolver: z
+            .string()
+            .describe("IP address of the DNS resolver to test for ECS forwarding"),
+        test_domain: z
+            .string()
+            .optional()
+            .describe("Test domain to use (default: 'o-o.myaddr.l.google.com' which echoes resolver info)"),
+    },
+    async execute(args) {
+        const resolver = args.resolver;
+        const testDomain = args.test_domain ?? "o-o.myaddr.l.google.com";
+        try {
+            // Build query with ECS option (option code 8 = CLIENT_SUBNET)
+            // ECS format: family (2 bytes) + source prefix length (1 byte) + scope prefix length (1 byte) + address
+            const ecsData = Buffer.alloc(8);
+            ecsData.writeUInt16BE(1, 0); // Address family: IPv4
+            ecsData.writeUInt8(24, 2); // Source prefix length: /24
+            ecsData.writeUInt8(0, 3); // Scope prefix length: 0 (set by server)
+            // Use a test subnet 198.51.100.0/24 (TEST-NET-2, RFC 5737)
+            ecsData.writeUInt8(198, 4);
+            ecsData.writeUInt8(51, 5);
+            ecsData.writeUInt8(100, 6);
+            // Only 3 bytes needed for /24
+            const buf = dnsPacket.encode({
+                type: "query",
+                id: Math.floor(Math.random() * 65535),
+                flags: dnsPacket.RECURSION_DESIRED,
+                questions: [{ type: "TXT", name: testDomain, class: "IN" }],
+                additionals: [
+                    {
+                        type: "OPT",
+                        name: ".",
+                        udpPayloadSize: 4096,
+                        flags: 0,
+                        options: [
+                            {
+                                code: 8, // CLIENT_SUBNET
+                                data: ecsData.subarray(0, 7), // 4 header bytes + 3 address bytes
+                            },
+                        ],
+                    },
+                ],
+            });
+            const response = await new Promise((resolve, reject) => {
+                const socket = dgram.createSocket("udp4");
+                const timer = setTimeout(() => {
+                    socket.close();
+                    reject(new Error("Timeout waiting for DNS response"));
+                }, 5000);
+                socket.on("message", (msg) => {
+                    clearTimeout(timer);
+                    socket.close();
+                    resolve(msg);
+                });
+                socket.on("error", (err) => {
+                    clearTimeout(timer);
+                    socket.close();
+                    reject(err);
+                });
+                socket.send(buf, 0, buf.length, 53, resolver);
+            });
+            const decoded = dnsPacket.decode(response);
+            // Check if ECS was echoed back in the response
+            let ecsInResponse = false;
+            let ecsScopePrefix = 0;
+            let ecsSourcePrefix = 0;
+            for (const add of decoded.additionals ?? []) {
+                if (add.type === "OPT") {
+                    for (const opt of add.options ?? []) {
+                        if (opt.code === 8) {
+                            ecsInResponse = true;
+                            const optData = opt.data;
+                            if (optData.length >= 4) {
+                                ecsSourcePrefix = optData.readUInt8(2);
+                                ecsScopePrefix = optData.readUInt8(3);
+                            }
+                        }
+                    }
+                }
+            }
+            // Check TXT answers for resolver IP info (from Google's o-o.myaddr service)
+            const txtAnswers = [];
+            for (const answer of decoded.answers ?? []) {
+                if (answer.type === "TXT") {
+                    const data = answer.data;
+                    if (Buffer.isBuffer(data)) {
+                        txtAnswers.push(data.toString("utf-8"));
+                    }
+                    else if (Array.isArray(data)) {
+                        txtAnswers.push(data.map((d) => Buffer.isBuffer(d) ? d.toString("utf-8") : String(d)).join(""));
+                    }
+                    else if (typeof data === "string") {
+                        txtAnswers.push(data);
+                    }
+                }
+            }
+            const findings = [];
+            if (ecsInResponse) {
+                findings.push("WARNING: EDNS Client Subnet (ECS) is forwarded by this resolver");
+                findings.push(`Source prefix: /${ecsSourcePrefix}, Scope prefix: /${ecsScopePrefix}`);
+                findings.push("Impact: Your approximate network location is shared with authoritative DNS servers");
+                findings.push("Privacy risk: Authoritative servers can correlate queries to geographic regions");
+                findings.push("Remediation: Use a resolver that strips ECS (e.g., Cloudflare 1.1.1.1, Quad9)");
+            }
+            else {
+                findings.push("OK: Resolver does not appear to forward EDNS Client Subnet information");
+                findings.push("Your network location is not exposed to authoritative DNS servers via ECS");
+            }
+            if (txtAnswers.length > 0) {
+                findings.push(`Resolver identity from test domain: ${txtAnswers.join(", ")}`);
+            }
+            return json({
+                resolver,
+                test_domain: testDomain,
+                ecs_forwarded: ecsInResponse,
+                ecs_source_prefix: ecsInResponse ? ecsSourcePrefix : null,
+                ecs_scope_prefix: ecsInResponse ? ecsScopePrefix : null,
+                resolver_identity: txtAnswers,
+                findings,
+            });
+        }
+        catch (err) {
+            return json({
+                resolver,
+                test_domain: testDomain,
+                ecs_forwarded: null,
+                error: err.message,
+                findings: [`Could not test ECS: ${err.message}`],
+            });
+        }
+    },
+};
+// ─── Tool 5: privacy_resolver_audit ───
+const privacyResolverAudit = {
+    name: "privacy_resolver_audit",
+    description: "Comprehensive privacy audit of a DNS resolver. Tests DoH support, DoT support, DNSSEC validation, and DNS Cookie support. Returns a privacy score from 0-100 based on the combined results.",
+    schema: {
+        resolver: z
+            .string()
+            .describe("IP address or hostname of the DNS resolver to audit"),
+    },
+    async execute(args) {
+        const resolver = args.resolver;
+        let score = 0;
+        const maxScore = 100;
+        const checks = [];
+        // Check 1: DoH support (25 points)
+        let dohSupported = false;
+        try {
+            const dohUrl = resolveDoHUrl(resolver);
+            const dohResult = await queryDoH("example.com", "A", dohUrl);
+            dohSupported = (dohResult.answers?.length ?? 0) > 0;
+        }
+        catch {
+            // Try direct HTTPS
+            try {
+                const res = await fetch(`https://${resolver}/dns-query?name=example.com&type=A`, {
+                    headers: { Accept: "application/dns-json" },
+                    signal: AbortSignal.timeout(5000),
+                });
+                dohSupported = res.ok;
+            }
+            catch {
+                dohSupported = false;
+            }
+        }
+        checks.push({
+            name: "DNS-over-HTTPS (DoH)",
+            passed: dohSupported,
+            weight: 25,
+            detail: dohSupported ? "DoH endpoint accessible" : "DoH not available or unreachable",
+        });
+        if (dohSupported)
+            score += 25;
+        // Check 2: DoT support (25 points)
+        let dotSupported = false;
+        try {
+            const dotHost = resolveDoTHost(resolver);
+            await new Promise((resolve, reject) => {
+                const socket = tls.connect(853, dotHost, { servername: dotHost }, () => {
+                    dotSupported = true;
+                    socket.destroy();
+                    resolve();
+                });
+                const timer = setTimeout(() => {
+                    socket.destroy();
+                    reject(new Error("timeout"));
+                }, 5000);
+                socket.on("error", (err) => {
+                    clearTimeout(timer);
+                    reject(err);
+                });
+                socket.on("secureConnect", () => {
+                    clearTimeout(timer);
+                });
+            });
+        }
+        catch {
+            dotSupported = false;
+        }
+        checks.push({
+            name: "DNS-over-TLS (DoT)",
+            passed: dotSupported,
+            weight: 25,
+            detail: dotSupported ? "DoT port 853 accessible with valid TLS" : "DoT not available on port 853",
+        });
+        if (dotSupported)
+            score += 25;
+        // Check 3: DNSSEC validation (30 points)
+        let dnssecValidation = false;
+        try {
+            const result = await queryRaw("example.com", "A", resolver, 53, { rd: true, dnssec: true });
+            dnssecValidation = result.flags.authenticatedData;
+        }
+        catch {
+            dnssecValidation = false;
+        }
+        checks.push({
+            name: "DNSSEC Validation",
+            passed: dnssecValidation,
+            weight: 30,
+            detail: dnssecValidation ? "DNSSEC validation active (AD bit set)" : "DNSSEC validation not detected (AD bit not set)",
+        });
+        if (dnssecValidation)
+            score += 30;
+        // Check 4: DNS Cookie support (20 points)
+        let cookieSupported = false;
+        try {
+            const clientCookie = Buffer.alloc(8);
+            for (let i = 0; i < 8; i++)
+                clientCookie[i] = Math.floor(Math.random() * 256);
+            const cookieBuf = dnsPacket.encode({
+                type: "query",
+                id: Math.floor(Math.random() * 65535),
+                flags: dnsPacket.RECURSION_DESIRED,
+                questions: [{ type: "A", name: "example.com", class: "IN" }],
+                additionals: [
+                    {
+                        type: "OPT",
+                        name: ".",
+                        udpPayloadSize: 4096,
+                        flags: 0,
+                        options: [{ code: 10, data: clientCookie }],
+                    },
+                ],
+            });
+            const response = await new Promise((resolve, reject) => {
+                const socket = dgram.createSocket("udp4");
+                const timer = setTimeout(() => {
+                    socket.close();
+                    reject(new Error("timeout"));
+                }, 5000);
+                socket.on("message", (msg) => {
+                    clearTimeout(timer);
+                    socket.close();
+                    resolve(msg);
+                });
+                socket.on("error", (err) => {
+                    clearTimeout(timer);
+                    socket.close();
+                    reject(err);
+                });
+                socket.send(cookieBuf, 0, cookieBuf.length, 53, resolver);
+            });
+            const decoded = dnsPacket.decode(response);
+            for (const add of decoded.additionals ?? []) {
+                if (add.type === "OPT") {
+                    for (const opt of add.options ?? []) {
+                        if (opt.code === 10 && opt.data.length > 8) {
+                            cookieSupported = true;
+                        }
+                    }
+                }
+            }
+        }
+        catch {
+            cookieSupported = false;
+        }
+        checks.push({
+            name: "DNS Cookies (RFC 7873)",
+            passed: cookieSupported,
+            weight: 20,
+            detail: cookieSupported ? "DNS cookies supported (anti-spoofing protection)" : "DNS cookies not supported",
+        });
+        if (cookieSupported)
+            score += 20;
+        // Build findings
+        const findings = [];
+        findings.push(`Privacy Score: ${score}/${maxScore}`);
+        if (score >= 80) {
+            findings.push("EXCELLENT: This resolver has strong privacy protections");
+        }
+        else if (score >= 50) {
+            findings.push("MODERATE: This resolver has some privacy features but is missing key protections");
+        }
+        else if (score >= 25) {
+            findings.push("POOR: This resolver has limited privacy features");
+        }
+        else {
+            findings.push("CRITICAL: This resolver has virtually no privacy protections");
+        }
+        for (const check of checks) {
+            findings.push(`${check.passed ? "PASS" : "FAIL"}: ${check.name} (${check.weight} pts) — ${check.detail}`);
+        }
+        return json({
+            resolver,
+            privacy_score: score,
+            max_score: maxScore,
+            grade: score >= 80 ? "A" : score >= 60 ? "B" : score >= 40 ? "C" : score >= 20 ? "D" : "F",
+            checks,
+            findings,
+        });
+    },
+};
+// ─── Tool 6: privacy_leak_test ───
+const privacyLeakTest = {
+    name: "privacy_leak_test",
+    description: "DNS leak test: determines which resolver(s) your system is actually using by querying services that reveal resolver IP addresses. Compares observed resolver IPs against an expected resolver to detect leaks or misconfigurations.",
+    schema: {
+        expected_resolver: z
+            .string()
+            .optional()
+            .describe("Expected resolver IP address to compare against (e.g. '1.1.1.1'). If not provided, just reports which resolvers are seen."),
+    },
+    async execute(args) {
+        const expectedResolver = args.expected_resolver;
+        const resolverIps = [];
+        const probes = [];
+        // Probe 1: whoami.akamai.net TXT (returns the resolver IP that queried Akamai)
+        try {
+            const resolver = new dns.Resolver();
+            const results = await resolver.resolveTxt("whoami.akamai.net");
+            for (const r of results) {
+                const ip = r.join("").trim();
+                if (ip) {
+                    resolverIps.push(ip);
+                    probes.push({ source: "whoami.akamai.net TXT", result: ip, error: null });
+                }
+            }
+        }
+        catch (err) {
+            probes.push({ source: "whoami.akamai.net TXT", result: null, error: err.message });
+        }
+        // Probe 2: o-o.myaddr.l.google.com TXT (returns resolver IP info from Google)
+        try {
+            const resolver = new dns.Resolver();
+            const results = await resolver.resolveTxt("o-o.myaddr.l.google.com");
+            for (const r of results) {
+                const txt = r.join("").trim();
+                if (txt) {
+                    // Google returns "edns0-client-subnet <ip>/prefix" or just the resolver IP
+                    const ipMatch = txt.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/);
+                    if (ipMatch) {
+                        const ip = ipMatch[1];
+                        if (!resolverIps.includes(ip))
+                            resolverIps.push(ip);
+                    }
+                    probes.push({ source: "o-o.myaddr.l.google.com TXT", result: txt, error: null });
+                }
+            }
+        }
+        catch (err) {
+            probes.push({ source: "o-o.myaddr.l.google.com TXT", result: null, error: err.message });
+        }
+        // Probe 3: myip.opendns.com A (using OpenDNS resolver)
+        try {
+            const resolver = new dns.Resolver();
+            resolver.setServers(["208.67.222.222"]);
+            const results = await resolver.resolve4("myip.opendns.com");
+            for (const ip of results) {
+                probes.push({ source: "myip.opendns.com A (via OpenDNS)", result: ip, error: null });
+                // This returns YOUR public IP, not the resolver IP — still useful for leak detection
+            }
+        }
+        catch (err) {
+            probes.push({ source: "myip.opendns.com A (via OpenDNS)", result: null, error: err.message });
+        }
+        // Determine unique resolver IPs observed
+        const uniqueResolverIps = [...new Set(resolverIps)];
+        const findings = [];
+        if (uniqueResolverIps.length === 0) {
+            findings.push("WARNING: Could not determine resolver IPs from leak test probes");
+        }
+        else {
+            findings.push(`Detected resolver IP(s): ${uniqueResolverIps.join(", ")}`);
+        }
+        if (expectedResolver && uniqueResolverIps.length > 0) {
+            const matchesExpected = uniqueResolverIps.some((ip) => ip === expectedResolver);
+            const unexpectedIps = uniqueResolverIps.filter((ip) => ip !== expectedResolver);
+            if (matchesExpected && unexpectedIps.length === 0) {
+                findings.push(`OK: All observed resolver IPs match expected resolver (${expectedResolver})`);
+            }
+            else if (matchesExpected && unexpectedIps.length > 0) {
+                findings.push(`WARNING: DNS leak detected! Expected ${expectedResolver}, but also saw: ${unexpectedIps.join(", ")}`);
+                findings.push("Impact: DNS queries may be going to multiple resolvers, some unintended");
+                findings.push("Remediation: Check system DNS settings, VPN configuration, and browser DoH settings");
+            }
+            else {
+                findings.push(`WARNING: DNS leak detected! Expected ${expectedResolver}, but saw: ${uniqueResolverIps.join(", ")}`);
+                findings.push("Your DNS queries are NOT going through the expected resolver");
+                findings.push("Remediation: Verify DNS configuration in network settings and VPN client");
+            }
+        }
+        else if (!expectedResolver && uniqueResolverIps.length > 0) {
+            findings.push("INFO: No expected resolver specified — showing observed resolvers only");
+            if (uniqueResolverIps.length > 1) {
+                findings.push("NOTE: Multiple resolver IPs detected — queries may be load-balanced or leaked");
+            }
+        }
+        return json({
+            expected_resolver: expectedResolver ?? null,
+            observed_resolver_ips: uniqueResolverIps,
+            leak_detected: expectedResolver
+                ? !uniqueResolverIps.every((ip) => ip === expectedResolver) && uniqueResolverIps.length > 0
+                : null,
+            probes,
+            findings,
+        });
+    },
+};
+// ─── Export ───
+export const privacyTools = [
+    privacyDohTest,
+    privacyDotTest,
+    privacyDoqTest,
+    privacyEcsLeak,
+    privacyResolverAudit,
+    privacyLeakTest,
+];
+//# sourceMappingURL=index.js.map