mcp-proof 0.3.15 → 0.3.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +4 -0
- package/engine.js +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,9 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.3.16
|
|
4
|
+
|
|
5
|
+
Fixed kubeconfig detection crossing JSON Schema field boundaries, which could still flag benign Kubernetes context-selector boilerplate when nearby schema text contained action verbs. Regression coverage remains in place for both selector boilerplate and explicit kubeconfig-content access.
|
|
6
|
+
|
|
3
7
|
## 0.3.15
|
|
4
8
|
|
|
5
9
|
Narrowed kubeconfig detection to require credential-content access language, avoiding false positives on Kubernetes context-selector parameters. Added regression coverage for both selector boilerplate and explicit kubeconfig-content access.
|
package/engine.js
CHANGED
|
@@ -78,7 +78,7 @@ const SIGNATURES = [
|
|
|
78
78
|
{
|
|
79
79
|
name: 'path_kube_creds',
|
|
80
80
|
sev: 'high',
|
|
81
|
-
re: /(?:\b(?:read|open|load|access|cat|copy|dump|print|display|extract|send|upload|exfiltrate|include)\b[^.!?\n]{0,120}(?:~?\/?\.kube\/config|KUBECONFIG)|(?:~?\/?\.kube\/config|KUBECONFIG)[^.!?\n]{0,120}\b(?:contents?|credentials?|secrets?|token)\b)/i,
|
|
81
|
+
re: /(?:\b(?:read|open|load|access|cat|copy|dump|print|display|extract|send|upload|exfiltrate|include)\b[^.!?\n"{}]{0,120}(?:~?\/?\.kube\/config|KUBECONFIG)|(?:~?\/?\.kube\/config|KUBECONFIG)[^.!?\n"{}]{0,120}\b(?:contents?|credentials?|secrets?|token)\b)/i,
|
|
82
82
|
reason: 'description instructs access to kubeconfig contents',
|
|
83
83
|
},
|
|
84
84
|
{
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mcp-proof",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.16",
|
|
4
4
|
"description": "Auditable, privacy-preserving MCP (Model Context Protocol) server verifier with local Trust Cards and SARIF output — test servers before connecting them to an AI system.",
|
|
5
5
|
"main": "engine.js",
|
|
6
6
|
"bin": {
|