mcp-proof 0.3.17 → 0.3.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +18 -0
- package/engine.js +9 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,23 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.3.18
|
|
4
|
+
|
|
5
|
+
Narrowed `system_role_overwrite`'s `SYSTEM\s*prompt` alternative to require
|
|
6
|
+
the colon-delimited fake-role-header shape (`SYSTEM:` followed by text) —
|
|
7
|
+
the bare phrase matched an ordinary JSON Schema parameter description
|
|
8
|
+
("System prompt override") as a tool's own configurable-parameter label,
|
|
9
|
+
false-positive on `opencode-mcp`, escalated to a **hard BLOCK at critical
|
|
10
|
+
severity** (the most severe false positive found this session; no confirmed
|
|
11
|
+
corpus attack relies on the bare phrase either). Found via a second
|
|
12
|
+
20-candidate real-world expansion (6 completed: `@knip/mcp`,
|
|
13
|
+
`@sveltejs/mcp`, `@browsermcp/mcp`, `@mui/mcp`, `@upstash/context7-mcp`,
|
|
14
|
+
`opencode-mcp`; 14 errored on the same documented taxonomy as before).
|
|
15
|
+
|
|
16
|
+
All 6 confirmed synthetic ground-truth attacks still produce byte-identical
|
|
17
|
+
decisions. Real-world total across all three benchmark rounds: **21 real
|
|
18
|
+
MCP servers scanned, 0 false positives, 0 confirmed true positives.** See
|
|
19
|
+
`BENCHMARK_GROUND_TRUTH.md`.
|
|
20
|
+
|
|
3
21
|
## 0.3.17
|
|
4
22
|
|
|
5
23
|
Downgraded four standalone signals whose severity had no corroborating
|
package/engine.js
CHANGED
|
@@ -48,9 +48,17 @@ const SIGNATURES = [
|
|
|
48
48
|
reason: 'description instructs the model to act silently',
|
|
49
49
|
},
|
|
50
50
|
{
|
|
51
|
+
// Narrowed 2026-09-10: `SYSTEM\s*prompt` (no colon required) matched
|
|
52
|
+
// an ordinary JSON Schema parameter description — "System prompt
|
|
53
|
+
// override" as a tool's own configurable-parameter label — false
|
|
54
|
+
// positive on opencode-mcp, escalated to a hard BLOCK at critical
|
|
55
|
+
// severity (the worst case of any FP found this session; no confirmed
|
|
56
|
+
// corpus attack relies on the bare "system prompt" phrase either).
|
|
57
|
+
// Real fake-role-header injection mimics a chat transcript's role
|
|
58
|
+
// delimiter — "SYSTEM:" followed by text — so now requires the colon.
|
|
51
59
|
name: 'system_role_overwrite',
|
|
52
60
|
sev: 'critical',
|
|
53
|
-
re: /\bSYSTEM\s
|
|
61
|
+
re: /\bSYSTEM\s*:\s*\S|\b(you are now|act as|pretend (to be|you are))\b\s+[A-Za-z]+/i,
|
|
54
62
|
reason: 'description attempts to overwrite the system persona',
|
|
55
63
|
},
|
|
56
64
|
{
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mcp-proof",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.18",
|
|
4
4
|
"description": "Auditable, privacy-preserving MCP (Model Context Protocol) server verifier with local Trust Cards and SARIF output — test servers before connecting them to an AI system.",
|
|
5
5
|
"main": "engine.js",
|
|
6
6
|
"bin": {
|