mcp-proof 0.3.13 → 0.3.15

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.3.15
+
+Narrowed kubeconfig detection to require credential-content access language, avoiding false positives on Kubernetes context-selector parameters. Added regression coverage for both selector boilerplate and explicit kubeconfig-content access.
+
+## 0.3.14
+
+Severity-aware tool-poisoning summaries distinguish actionable patterns from low-severity URL mentions. Stdio launch errors now preserve server stderr for root-cause triage.
+
 ## 0.3.13
 
 Scanner-only release. Runtime authorization functionality is not included.

package/bin/mcp-proof.js

@@ -399,10 +399,14 @@ async function fetchToolsList({ command, args, env, timeoutMs }) {
       windowsHide: true,
     });
 
-    const timer = setTimeout(() => fail(new Error(`MCP server timed out after ${timeoutMs}ms`)), timeoutMs);
+    const timer = setTimeout(() => {
+      const tail = stderrBuf.trim() ? ` — stderr: ${stderrBuf.trim().slice(-500)}` : '';
+      fail(new Error(`MCP server timed out after ${timeoutMs}ms${tail}`));
+    }, timeoutMs);
 
+    let stderrBuf = '';
     child.on('error', fail);
-    child.stderr.on('data', () => {});
+    child.stderr.on('data', (chunk) => { stderrBuf += chunk.toString('utf8'); });
     child.stdout.on('data', (chunk) => {
       buffer = Buffer.concat([buffer, chunk]);
       buffer = consumeMessages(buffer, (msg) => {
@@ -426,9 +430,14 @@ async function fetchToolsList({ command, args, env, timeoutMs }) {
         }
       });
     });
+    function childErrorContext(base, code, signal) {
+      const tail = stderrBuf.trim() ? ` — stderr: ${stderrBuf.trim().slice(-500)}` : '';
+      return new Error(`${base} (code=${code}, signal=${signal})${tail}`);
+    }
+
     child.on('exit', (code, signal) => {
       if (!settled && pending.size > 0) {
-        fail(new Error(`MCP server exited before tools/list completed (code=${code}, signal=${signal})`));
+        fail(childErrorContext('MCP server exited before tools/list completed', code, signal));
       }
     });
 

package/engine.js

@@ -78,8 +78,8 @@ const SIGNATURES = [
   {
     name: 'path_kube_creds',
     sev: 'high',
-    re: /~?\/?\.kube(\/config)?|KUBECONFIG/i,
-    reason: 'description references kubeconfig',
+    re: /(?:\b(?:read|open|load|access|cat|copy|dump|print|display|extract|send|upload|exfiltrate|include)\b[^.!?\n]{0,120}(?:~?\/?\.kube\/config|KUBECONFIG)|(?:~?\/?\.kube\/config|KUBECONFIG)[^.!?\n]{0,120}\b(?:contents?|credentials?|secrets?|token)\b)/i,
+    reason: 'description instructs access to kubeconfig contents',
   },
   {
     name: 'cross_tool_invocation',
@@ -423,6 +423,37 @@ function hasSuspiciousBase64(s) {
   return false;
 }
 
+function summarizePatterns(perTool, severity) {
+  const counts = {};
+  for (const t of perTool) {
+    for (const p of t.patterns) {
+      if (p.severity === severity) counts[p.name] = (counts[p.name] || 0) + 1;
+    }
+  }
+  const entries = Object.entries(counts).sort((a, b) => b[1] - a[1]);
+  return entries.map(([name, count]) => count > 1 ? `${count} ${name} mentions` : `1 ${name} pattern`);
+}
+
+function formatToolPoisoningReason(perTool) {
+  if (perTool.length === 0) return 'no instruction-hijacking patterns detected';
+  const sevOrder = ['critical', 'high', 'medium', 'low'];
+  const bySev = {};
+  for (const t of perTool) {
+    for (const p of t.patterns) {
+      bySev[p.severity] = bySev[p.severity] || [];
+      bySev[p.severity].push({ patterns: [p] });
+    }
+  }
+  const parts = [];
+  for (const sev of sevOrder) {
+    const list = bySev[sev];
+    if (!list || list.length === 0) continue;
+    const names = summarizePatterns(list, sev);
+    parts.push(`${names.join(', ')} at ${sev} severity`);
+  }
+  return parts.join('; ');
+}
+
 function scanTools(tools, opts) {
   const skillContext = (opts || {}).skillContext === true;
   if (!tools || tools.length === 0) {
@@ -499,9 +530,7 @@ function scanTools(tools, opts) {
   return {
     detected: perTool.length > 0,
     severity: maxSev,
-    reason: perTool.length > 0
-      ? `${perTool.length}/${tools.length} tools contain instruction-hijacking or sensitive-path references`
-      : 'no instruction-hijacking patterns detected',
+    reason: formatToolPoisoningReason(perTool),
     perTool,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-proof",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "description": "Auditable, privacy-preserving MCP (Model Context Protocol) server verifier with local Trust Cards and SARIF output — test servers before connecting them to an AI system.",
   "main": "engine.js",
   "bin": {