mcp-proof 0.3.2 → 0.3.3

package/README.md

@@ -125,6 +125,7 @@ Options:
   --stdio <cmd>      launch a real stdio MCP server, call tools/list, scan returned tools
   --config <path>    scan every stdio server in an MCP client config with mcpServers
   --skill <path>     scan a Claude SKILL.md (educational/warning context aware)
+  --live             confirm npm publisher on registry.npmjs.org (one network call)
   --timeout <ms>     MCP launch/protocol timeout per server (default: 15000)
   --source <s>       npm:@scope/pkg, git+https://..., file://...
   --transport <t>    stdio | http | sse | http_streaming   (default: stdio)
@@ -190,7 +191,7 @@ console.log(skill.decision);
 
 ## Limits (honest scope)
 
-- **Publisher verification is lexical only.** npm scope match + Levenshtein typosquat. *No live npm-registry API calls, no GitHub-API lookup, no signature verification.* These are planned but not in this release.
+- **Publisher verification is lexical only by default.** npm scope match + Levenshtein typosquat. Pass `--live` to confirm npm packages against `registry.npmjs.org` with one network call. *No GitHub-API lookup, no signature verification.*
 - **No source-tree scan.** The full VyriAI gateway also runs a static scanner over the package source for `child_process`, postinstall scripts, obfuscation. That step needs the source unpacked locally and isn't shipped in this CLI.
 - **No dependency CVE check.** The full gateway wraps `npm audit`; this CLI doesn't shell out.
 - **Stdio discovery only.** `--stdio` / `--config` launches local stdio MCP servers and calls `tools/list`. It does not yet connect to HTTP/SSE MCP servers.

package/bin/mcp-proof.js

@@ -23,7 +23,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { spawn } = require('child_process');
-const { evaluate, scanSkillManifest } = require('../engine.js');
+const { evaluate, scanSkillManifest, verifyPublisherAsync } = require('../engine.js');
 
 const DEFAULT_MAX_INPUT_BYTES = 5 * 1024 * 1024;
 const DEFAULT_TIMEOUT_MS = 15000;
@@ -50,6 +50,7 @@ Options:
   --stdio <cmd>      launch a real stdio MCP server, call tools/list, scan returned tools
   --config <path>    scan every stdio server in an MCP client config with mcpServers
   --skill <path>     scan a Claude SKILL.md (educational/warning context aware)
+  --live             confirm npm publisher against registry.npmjs.org (one network call)
   --timeout <ms>     MCP launch/protocol timeout per server (default: 15000)
   --source <s>       npm:@scope/pkg, git+https://..., or file://...   (drives publisher verification)
   --transport <t>    stdio | http | sse | http_streaming               (default: stdio)
@@ -113,10 +114,13 @@ async function main() {
   if (args.stdio) {
     let result;
     try {
+      const stdioSource = args.source || deriveSourceFromCommandLine(args.stdio);
+      const publisher = args.live ? await verifyPublisherAsync(stdioSource) : null;
       result = await scanStdioCommand({
         name: args.source || args.stdio,
         commandLine: args.stdio,
-        source: args.source || deriveSourceFromCommandLine(args.stdio),
+        source: stdioSource,
+        publisher,
         timeoutMs: args.timeoutMs,
       });
     } catch (err) {
@@ -175,11 +179,14 @@ async function main() {
     process.exit(65);
   }
 
+  const sourceForPublisher = args.source || (parsed.source || '');
+  const publisher = args.live ? await verifyPublisherAsync(sourceForPublisher) : null;
   const result = evaluate({
-    source: args.source || (parsed.source || ''),
+    source: sourceForPublisher,
     transport: args.transport || (parsed.transport || 'stdio'),
     bind_address: args.bind || (parsed.bind_address || ''),
     tools,
+    publisher,
   });
   result.mode = 'manifest';
   result.name = args.file || 'stdin';
@@ -199,7 +206,7 @@ function parseArgs(argv) {
   const out = {
     source: '', transport: '', bind: '', json: false, selfTest: false,
     help: false, version: false, file: '', stdio: '', config: '', skill: '',
-    timeoutMs: DEFAULT_TIMEOUT_MS,
+    live: false, timeoutMs: DEFAULT_TIMEOUT_MS,
   };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
@@ -214,6 +221,7 @@ function parseArgs(argv) {
       case '--stdio': out.stdio = argv[++i] || ''; break;
       case '--config': out.config = expandHome(argv[++i] || ''); break;
       case '--skill': out.skill = expandHome(argv[++i] || ''); break;
+      case '--live': out.live = true; break;
       case '--timeout': out.timeoutMs = parseTimeout(argv[++i] || ''); break;
       default:
         if (a.startsWith('-')) {
@@ -312,13 +320,16 @@ async function scanConfig(args) {
       results.push(errorResult(name, 'config entry missing command'));
       continue;
     }
+    const serverSource = spec.source || deriveSourceFromCommand(spec.command, spec.args || []);
     try {
+      const publisher = args.live ? await verifyPublisherAsync(serverSource) : null;
       results.push(await scanStdioCommand({
         name,
         command: spec.command,
         args: Array.isArray(spec.args) ? spec.args : [],
         env: spec.env && typeof spec.env === 'object' ? spec.env : {},
-        source: spec.source || deriveSourceFromCommand(spec.command, spec.args || []),
+        source: serverSource,
+        publisher,
         timeoutMs: args.timeoutMs,
       }));
     } catch (err) {
@@ -349,6 +360,7 @@ async function scanStdioCommand(opts) {
     transport: 'stdio',
     bind_address: '',
     tools,
+    publisher: opts.publisher || null,
   });
   result.mode = 'stdio';
   result.name = opts.name || launch.command;

package/engine.js

@@ -11,6 +11,8 @@
 
 'use strict';
 
+const https = require('https');
+
 // ── Tool-poisoning signatures ───────────────────────────────────────────
 const SIGNATURES = [
   {
@@ -202,12 +204,18 @@ function verifyPublisher(source) {
   if (src.startsWith('npm:')) {
     const pkg = src.slice('npm:'.length);
     res.matchedRegistry = 'npm';
+    // A trusted scope only verifies packages that are actually on the
+    // known-name list. A package under a trusted scope but not on the list
+    // is either a typo or a new, unreviewed package, and is downgraded.
     for (const scope of TRUSTED_NPM_SCOPES) {
       if (pkg.startsWith(scope + '/')) {
-        res.trust = 'verified';
-        res.integrityScore = 9.0;
-        res.reason = `npm scope ${scope} is on the trusted publisher registry`;
-        return res;
+        if (KNOWN_NAMES.includes(pkg)) {
+          res.trust = 'verified';
+          res.integrityScore = 9.0;
+          res.reason = `npm package ${pkg} is on the trusted publisher registry`;
+          return res;
+        }
+        break;
       }
     }
     if (!KNOWN_NAMES.includes(pkg)) {
@@ -248,6 +256,48 @@ function verifyPublisher(source) {
   return res;
 }
 
+function npmPackageExists(pkg, timeoutMs = 5000) {
+  return new Promise((resolve) => {
+    const encoded = encodeURIComponent(pkg).replace(/%40/g, '@');
+    const url = `https://registry.npmjs.org/${encoded}`;
+    const req = https.get(url, { timeout: timeoutMs }, (res) => {
+      res.on('data', () => {});
+      res.on('end', () => {
+        resolve(res.statusCode === 200 ? true : res.statusCode === 404 ? false : null);
+      });
+    });
+    req.on('error', () => resolve(null));
+    req.on('timeout', () => { req.destroy(); resolve(null); });
+  });
+}
+
+async function verifyPublisherAsync(source) {
+  const res = verifyPublisher(source);
+  const src = (source || '').toLowerCase().trim();
+  if (src.startsWith('npm:')) {
+    const pkg = src.slice('npm:'.length);
+    const exists = await npmPackageExists(pkg);
+    if (exists === false) {
+      res.matchedRegistry = '';
+      res.trust = 'unverified';
+      res.integrityScore = Math.min(res.integrityScore, 2.0);
+      res.reason = `npm package "${pkg}" not found in the registry`;
+    } else if (exists === true) {
+      res.matchedRegistry = 'npm';
+      if (res.typosquat) {
+        res.reason = `${res.reason}; package exists but is a typosquat`;
+      } else if (res.trust !== 'verified') {
+        res.trust = 'verified';
+        res.integrityScore = Math.max(res.integrityScore, 8.0);
+        res.reason = res.reason === 'unrecognised source format'
+          ? `npm package "${pkg}" confirmed on registry`
+          : `${res.reason} — confirmed on npm registry`;
+      }
+    }
+  }
+  return res;
+}
+
 function hasSuspiciousBase64(s) {
   const matches = s.match(BASE64_RE);
   if (!matches) return false;
@@ -408,7 +458,7 @@ function validateTransport(transport, bind) {
 function evaluate(req) {
   const start = Date.now();
   const score = {
-    publisher: verifyPublisher(req.source),
+    publisher: req.publisher || verifyPublisher(req.source),
     toolPoisoning: scanTools(req.tools || [], { skillContext: !!req.skillContext }),
     transport: validateTransport(req.transport, req.bind_address),
     reasons: [],
@@ -472,4 +522,4 @@ function evaluate(req) {
 
 function round1(v) { return Math.round(v * 10) / 10; }
 
-module.exports = { evaluate, scanTools, scanSkillManifest, verifyPublisher, validateTransport, levenshtein };
+module.exports = { evaluate, scanTools, scanSkillManifest, verifyPublisher, verifyPublisherAsync, validateTransport, levenshtein };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-proof",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Unbranded, free MCP (Model Context Protocol) server verifier — detects tool poisoning, typosquats, hidden unicode, base64 payloads, exposed transports, and skill-manifest attacks. Same engine as the VyriAI control plane, no account required.",
   "main": "engine.js",
   "bin": {