mcp-proof 0.3.2

package/engine.js

@@ -0,0 +1,475 @@
+// mcp-proof trust engine — detection logic.
+//
+// Mirrors go/internal/mcptrust/tool_poisoning.go and publisher.go so the
+// JS verdict matches what the production gateway would return for the
+// same input. Pure CommonJS, zero dependencies — runs on any Node ≥ 18
+// and in the browser via require/import.
+//
+// API:
+//   const { evaluate, scanTools, verifyPublisher, validateTransport } = require('mcp-proof');
+//   const result = evaluate({ source, transport, bind_address, tools });
+
+'use strict';
+
+// ── Tool-poisoning signatures ───────────────────────────────────────────
+const SIGNATURES = [
+  {
+    name: 'instruction_hijack_ignore',
+    sev: 'high',
+    re: /\b(ignore|disregard|forget)\b[^.]{0,40}\b(previous|prior|above|earlier)\b[^.]{0,40}\b(instructions?|prompts?|rules?)\b/i,
+    reason: 'description tries to override previous instructions',
+  },
+  {
+    name: 'instruction_hijack_before',
+    sev: 'medium',
+    re: /\bbefore (returning|responding|answering|the (final )?(answer|result|response))\b/i,
+    reason: 'description injects a step before the model responds',
+  },
+  {
+    name: 'instruction_hijack_after',
+    sev: 'medium',
+    re: /\bafter (returning|responding|completing)\b[^.]{0,80}\b(also|additionally)\b/i,
+    reason: 'description appends additional behavior to the response',
+  },
+  {
+    name: 'instruction_hijack_silent',
+    sev: 'high',
+    re: /\b(do not|don't|never|silently|without (mentioning|telling))\b[^.]{0,80}\b(mention|tell|inform|notify|reveal|disclose)\b/i,
+    reason: 'description instructs the model to act silently',
+  },
+  {
+    name: 'system_role_overwrite',
+    sev: 'critical',
+    re: /\bSYSTEM\s*(:|prompt)\b|\b(you are now|act as|pretend (to be|you are))\b\s+[A-Za-z]+/i,
+    reason: 'description attempts to overwrite the system persona',
+  },
+  {
+    name: 'path_ssh_keys',
+    sev: 'critical',
+    re: /~?\/?\.ssh(\/|$)|id_rsa|id_ecdsa|id_ed25519|authorized_keys|known_hosts/i,
+    reason: 'description references SSH credentials',
+  },
+  {
+    name: 'path_aws_creds',
+    sev: 'critical',
+    re: /~?\/?\.aws(\/credentials|\/config)?|AWS_SECRET_ACCESS_KEY|AKIA[0-9A-Z]{12,}/i,
+    reason: 'description references AWS credentials',
+  },
+  {
+    name: 'path_env_files',
+    sev: 'high',
+    re: /(^|[/\s])\.env(\.[a-z0-9]+)?\b|process\.env/i,
+    reason: 'description references environment / dotenv files',
+  },
+  {
+    name: 'path_etc_secrets',
+    sev: 'critical',
+    re: /\/etc\/(passwd|shadow|sudoers|gshadow)/i,
+    reason: 'description references /etc credential files',
+  },
+  {
+    name: 'path_browser_storage',
+    sev: 'high',
+    re: /(Cookies|Login Data|Web Data|Local Storage)\b|~?\/\.config\/google-chrome|Application Support\/Google\/Chrome/i,
+    reason: 'description references browser credential stores',
+  },
+  {
+    name: 'path_kube_creds',
+    sev: 'high',
+    re: /~?\/?\.kube(\/config)?|KUBECONFIG/i,
+    reason: 'description references kubeconfig',
+  },
+  {
+    name: 'cross_tool_invocation',
+    sev: 'high',
+    re: /\b(call|invoke|use|execute|run)\b[^.]{0,60}\btool\b\s*[:'"]?\s*[a-zA-Z_][\w-]{1,40}/i,
+    reason: 'description references invoking another tool',
+  },
+  {
+    name: 'data_exfil_hint',
+    sev: 'high',
+    re: /\b(send|post|upload|exfiltrate|leak|forward)\b[^.]{0,80}\b(to|via)\b[^.]{0,40}\b(http|https|api|server|endpoint)\b/i,
+    reason: 'description hints at outbound exfiltration',
+  },
+  {
+    name: 'include_in_result',
+    sev: 'medium',
+    re: /\b(include|append|embed|attach)\b[^.]{0,80}\b(in (the )?(result|response|output)|to (the )?(output|response))\b/i,
+    reason: 'description tells the model to include extra data in the result',
+  },
+  {
+    name: 'inline_url',
+    sev: 'low',
+    re: /https?:\/\/[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}(:\d+)?(\/[^\s)]*)?/,
+    reason: 'description contains a URL',
+  },
+];
+
+const HIDDEN_CHARS = new RegExp(
+  "[\\u200B\\u200C\\u200D\\u2060\\u00AD\\uFEFF\\u2028\\u2029\\u202E\\u202D\\u2066\\u2067\\u2068\\u2069]",
+  "u"
+);
+
+
+const BASE64_RE = /[A-Za-z0-9+/]{40,}={0,2}/g;
+
+const SUSPICIOUS_DECODED =
+  /(ignore|system|instruction|\.ssh|\/bin\/)/i;
+
+// Skill / educational manifest context. A sensitive-path or instruction
+// reference inside a warning or example is not a real attack directive.
+const SKILL_BENIGN_MARKERS =
+  /\b(?:warning|⚠️|example|demonstration|sample|illustration|not\s+safe|suspicious|malicious|attack)\b/i;
+
+function isBenignSkillContext(text) {
+  return SKILL_BENIGN_MARKERS.test(text);
+}
+
+function findAllMatches(corpus, re) {
+  const flags = (re.flags || '') + 'g';
+  const g = new RegExp(re.source, flags.split('').filter((v, i, a) => a.indexOf(v) === i).join(''));
+  const out = [];
+  let m;
+  while ((m = g.exec(corpus)) !== null) {
+    out.push({ text: m[0], index: m.index });
+    if (m.index === g.lastIndex) g.lastIndex++;
+  }
+  return out;
+}
+
+// Trusted publisher registry ──────────────────────────────────────────
+const TRUSTED_NPM_SCOPES = ['@modelcontextprotocol'];
+const TRUSTED_GITHUB_ORGS = ['modelcontextprotocol'];
+const KNOWN_NAMES = [
+  '@modelcontextprotocol/server-filesystem',
+  '@modelcontextprotocol/server-github',
+  '@modelcontextprotocol/server-postgres',
+  '@modelcontextprotocol/server-slack',
+  '@modelcontextprotocol/server-brave-search',
+  '@modelcontextprotocol/server-puppeteer',
+  '@modelcontextprotocol/server-memory',
+  '@modelcontextprotocol/server-google-maps',
+  '@modelcontextprotocol/server-git',
+  '@modelcontextprotocol/server-google-drive',
+  '@modelcontextprotocol/server-gdrive',
+  '@modelcontextprotocol/server-everything',
+  '@modelcontextprotocol/server-fetch',
+  '@modelcontextprotocol/server-sqlite',
+  '@modelcontextprotocol/server-sentry',
+  '@modelcontextprotocol/server-sequential-thinking',
+  '@modelcontextprotocol/server-aws-kb-retrieval',
+  '@modelcontextprotocol/server-gitlab',
+  '@modelcontextprotocol/server-time',
+  '@modelcontextprotocol/server-redis',
+];
+
+const SEV_RANK = { low: 1, medium: 2, high: 3, critical: 4 };
+
+function levenshtein(a, b) {
+  if (a === b) return 0;
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = new Array(n + 1);
+  let curr = new Array(n + 1);
+  for (let j = 0; j <= n; j++) prev[j] = j;
+  for (let i = 1; i <= m; i++) {
+    curr[0] = i;
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + cost);
+    }
+    [prev, curr] = [curr, prev];
+  }
+  return prev[n];
+}
+
+function verifyPublisher(source) {
+  const src = (source || '').toLowerCase().trim();
+  const res = {
+    trust: 'unknown',
+    typosquat: false,
+    integrityScore: 5.0,
+    reason: '',
+    matchedRegistry: '',
+  };
+  if (!src) {
+    res.reason = 'no source supplied';
+    res.integrityScore = 3.0;
+    return res;
+  }
+  if (src.startsWith('npm:')) {
+    const pkg = src.slice('npm:'.length);
+    res.matchedRegistry = 'npm';
+    for (const scope of TRUSTED_NPM_SCOPES) {
+      if (pkg.startsWith(scope + '/')) {
+        res.trust = 'verified';
+        res.integrityScore = 9.0;
+        res.reason = `npm scope ${scope} is on the trusted publisher registry`;
+        return res;
+      }
+    }
+    if (!KNOWN_NAMES.includes(pkg)) {
+      for (const known of KNOWN_NAMES) {
+        if (levenshtein(pkg, known) <= 2) {
+          res.trust = 'suspicious';
+          res.typosquat = true;
+          res.integrityScore = 2.0;
+          res.reason = `package "${pkg}" resembles trusted package "${known}" — likely typosquat`;
+          return res;
+        }
+      }
+    }
+    res.reason = 'npm package not on the trusted registry — treat as untrusted';
+    res.integrityScore = 5.0;
+    return res;
+  }
+  if (src.startsWith('git+https://') || src.startsWith('https://github.com/')) {
+    const u = src.replace(/^git\+/, '').replace(/^https:\/\/github\.com\//, '');
+    const org = u.split('/')[0];
+    res.matchedRegistry = 'github';
+    if (TRUSTED_GITHUB_ORGS.includes(org)) {
+      res.trust = 'verified';
+      res.integrityScore = 8.5;
+      res.reason = `github org ${org} is on the trusted publisher registry`;
+    } else {
+      res.reason = `github org ${org} not on the trusted registry`;
+    }
+    return res;
+  }
+  if (src.startsWith('file://') || src.startsWith('/')) {
+    res.integrityScore = 4.0;
+    res.reason = 'local source — origin cannot be verified';
+    return res;
+  }
+  res.reason = 'unrecognised source format';
+  res.integrityScore = 3.0;
+  return res;
+}
+
+function hasSuspiciousBase64(s) {
+  const matches = s.match(BASE64_RE);
+  if (!matches) return false;
+  for (const m of matches) {
+    try {
+      const decoded = Buffer.from(m, 'base64').toString('utf8');
+      if (SUSPICIOUS_DECODED.test(decoded)) return true;
+    } catch (_) {
+      /* invalid base64, skip */
+    }
+  }
+  return false;
+}
+
+function scanTools(tools, opts) {
+  const skillContext = (opts || {}).skillContext === true;
+  if (!tools || tools.length === 0) {
+    return { detected: false, severity: 'low', reason: 'no tools supplied', perTool: [] };
+  }
+  let maxSev = 'low';
+  const perTool = [];
+  for (const t of tools) {
+    const corpus = [t.name || '', t.description || '', JSON.stringify(t.inputSchema || {})].join('\n');
+    const finding = { tool: t.name || '(unnamed)', severity: 'low', patterns: [], evidence: '', hidden: false };
+    for (const sig of SIGNATURES) {
+      const matches = findAllMatches(corpus, sig.re);
+      if (matches.length === 0) continue;
+      let selected = null;
+      for (const m of matches) {
+        const ctx = corpus.slice(
+          Math.max(0, m.index - 60),
+          Math.min(corpus.length, m.index + m.text.length + 60)
+        );
+        let sev = sig.sev;
+        let downgraded = false;
+        // For skill manifests, use the whole prompt for context framing. If the
+        // author has explicitly labeled the content as a warning/example, the
+        // match is treated as educational rather than an attack directive.
+        if (skillContext && isBenignSkillContext(corpus)) {
+          sev = 'low';
+          downgraded = true;
+        }
+        selected = { sev, downgraded, evidence: ctx.replace(/\n/g, ' ') };
+        if (!downgraded) break; // real attack wins over benign example
+      }
+      if (!selected) continue;
+      finding.patterns.push({
+        name: sig.name,
+        severity: selected.sev,
+        reason: sig.reason,
+        downgraded: selected.downgraded,
+      });
+      if (SEV_RANK[selected.sev] > SEV_RANK[finding.severity]) {
+        finding.severity = selected.sev;
+        finding.evidence = selected.evidence;
+      }
+    }
+    if (HIDDEN_CHARS.test(corpus)) {
+      finding.hidden = true;
+      finding.patterns.push({
+        name: 'hidden_unicode',
+        severity: 'high',
+        reason: 'description contains zero-width / bidi-override / soft-hyphen characters',
+      });
+      if (SEV_RANK.high > SEV_RANK[finding.severity]) finding.severity = 'high';
+    }
+    if (hasSuspiciousBase64(corpus)) {
+      finding.hidden = true;
+      finding.patterns.push({
+        name: 'embedded_base64_payload',
+        severity: 'high',
+        reason: 'description contains a base64 blob that decodes to instruction-like content',
+      });
+      if (SEV_RANK.high > SEV_RANK[finding.severity]) finding.severity = 'high';
+    }
+    const hijack = ['instruction_hijack_before', 'instruction_hijack_after', 'instruction_hijack_silent', 'include_in_result'];
+    const sensitive = ['path_ssh_keys', 'path_aws_creds', 'path_env_files', 'path_etc_secrets', 'path_kube_creds', 'path_browser_storage'];
+    const activeNames = finding.patterns.filter((p) => !p.downgraded).map((p) => p.name);
+    if (hijack.some((h) => activeNames.includes(h)) && sensitive.some((s) => activeNames.includes(s))) {
+      finding.severity = 'critical';
+    }
+    if (finding.patterns.length > 0) {
+      perTool.push(finding);
+      if (SEV_RANK[finding.severity] > SEV_RANK[maxSev]) maxSev = finding.severity;
+    }
+  }
+  return {
+    detected: perTool.length > 0,
+    severity: maxSev,
+    reason: perTool.length > 0
+      ? `${perTool.length}/${tools.length} tools contain instruction-hijacking or sensitive-path references`
+      : 'no instruction-hijacking patterns detected',
+    perTool,
+  };
+}
+
+function scanSkillManifest(markdown) {
+  const tools = [];
+  // If the skill manifest embeds a JSON tools array, use it.
+  const jsonBlock = markdown.match(/```(?:json)?\s*([\s\S]*?)```/);
+  if (jsonBlock) {
+    try {
+      const parsed = JSON.parse(jsonBlock[1].trim());
+      if (Array.isArray(parsed)) tools.push(...parsed);
+      else if (Array.isArray(parsed.tools)) tools.push(...parsed.tools);
+    } catch (_) { /* not a JSON block, fall through */ }
+  }
+  if (tools.length === 0) {
+    // Otherwise treat the entire SKILL.md prompt as one skill description.
+    tools.push({ name: 'skill', description: markdown });
+  }
+  return evaluate({
+    source: 'skill:local',
+    transport: 'stdio',
+    tools,
+    skillContext: true,
+  });
+}
+
+function validateTransport(transport, bind) {
+  const res = { transport, binding: bind || '', exposureRisk: 'low', reason: '' };
+  const t = (transport || '').toLowerCase();
+  if (!t || t === 'stdio') {
+    res.transport = 'stdio';
+    res.exposureRisk = 'low';
+    res.reason = 'stdio: local process, no network listener';
+    return res;
+  }
+  if (t === 'http' || t === 'sse' || t === 'http_streaming') {
+    let ip = (bind || '').trim();
+    if (!ip) {
+      res.exposureRisk = 'high';
+      res.reason = 'binding not specified — assuming public';
+      return res;
+    }
+    const portMatch = ip.match(/^(.+):(\d+)$/);
+    if (portMatch) ip = portMatch[1];
+    if (ip === '127.0.0.1' || ip === '::1' || ip === 'localhost') {
+      res.exposureRisk = 'low';
+      res.reason = 'loopback binding — local-only';
+    } else if (ip === '0.0.0.0' || ip === '::') {
+      res.exposureRisk = 'critical';
+      res.reason = '0.0.0.0 binding exposes MCP server to every network interface — BLOCK';
+    } else if (/^10\.|^192\.168\.|^172\.(1[6-9]|2\d|3[01])\./.test(ip)) {
+      res.exposureRisk = 'high';
+      res.reason = 'private network binding — exposed to LAN';
+    } else {
+      res.exposureRisk = 'critical';
+      res.reason = 'non-loopback binding — assume hostile network';
+    }
+    return res;
+  }
+  res.exposureRisk = 'high';
+  res.reason = 'unknown transport';
+  return res;
+}
+
+function evaluate(req) {
+  const start = Date.now();
+  const score = {
+    publisher: verifyPublisher(req.source),
+    toolPoisoning: scanTools(req.tools || [], { skillContext: !!req.skillContext }),
+    transport: validateTransport(req.transport, req.bind_address),
+    reasons: [],
+  };
+
+  const pubW = score.publisher.integrityScore;
+  let poisonW = 10.0;
+  switch (score.toolPoisoning.severity) {
+    case 'critical': poisonW = 0; break;
+    case 'high': poisonW = 3; break;
+    case 'medium': poisonW = 6; break;
+  }
+  let transportW = 10.0;
+  if (score.transport.exposureRisk === 'critical') transportW = 0;
+  else if (score.transport.exposureRisk === 'high') transportW = 5;
+
+  score.composite = round1(0.30 * pubW + 0.45 * poisonW + 0.25 * transportW);
+
+  let hardBlock = false;
+  if (score.toolPoisoning.detected && score.toolPoisoning.severity === 'critical') {
+    hardBlock = true;
+    score.reasons.push(`HARD BLOCK: critical tool-poisoning detected — ${score.toolPoisoning.reason}`);
+  }
+  if (score.transport.exposureRisk === 'critical') {
+    hardBlock = true;
+    score.reasons.push(`HARD BLOCK: ${score.transport.reason}`);
+  }
+  // Typosquat is also a hard-block: by definition, the package is
+  // pretending to be something it isn't. Composite score can't override.
+  if (score.publisher.typosquat) {
+    hardBlock = true;
+    score.reasons.push(`HARD BLOCK: ${score.publisher.reason}`);
+  }
+
+  if (hardBlock) score.decision = 'block';
+  else if (score.composite >= 7.0) score.decision = 'allow';
+  else if (score.composite >= 4.0) {
+    score.decision = 'warn';
+    score.reasons.push(`composite ${score.composite.toFixed(1)} below allow threshold 7.0 — operator review required`);
+  } else {
+    score.decision = 'block';
+    score.reasons.push(`composite ${score.composite.toFixed(1)} below block threshold 4.0`);
+  }
+
+  if (score.publisher.trust === 'verified') {
+    score.reasons.push(`publisher verified (${score.publisher.matchedRegistry})`);
+  }
+  if (score.publisher.typosquat) {
+    score.reasons.push(`typosquat risk: ${score.publisher.reason}`);
+  }
+  if (score.toolPoisoning.detected) {
+    score.reasons.push(`tool poisoning: ${score.toolPoisoning.reason}`);
+  }
+  if (score.transport.exposureRisk !== 'low') {
+    score.reasons.push(`transport: ${score.transport.reason}`);
+  }
+
+  score.durationMs = Date.now() - start;
+  return score;
+}
+
+function round1(v) { return Math.round(v * 10) / 10; }
+
+module.exports = { evaluate, scanTools, scanSkillManifest, verifyPublisher, validateTransport, levenshtein };

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "mcp-proof",
+  "version": "0.3.2",
+  "description": "Unbranded, free MCP (Model Context Protocol) server verifier — detects tool poisoning, typosquats, hidden unicode, base64 payloads, exposed transports, and skill-manifest attacks. Same engine as the VyriAI control plane, no account required.",
+  "main": "engine.js",
+  "bin": {
+    "mcp-proof": "bin/mcp-proof.js"
+  },
+  "files": [
+    "engine.js",
+    "bin/",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "test": "node test.js"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "security",
+    "ai-security",
+    "tool-poisoning",
+    "typosquat",
+    "scanner",
+    "vyriai",
+    "llm-security"
+  ],
+  "homepage": "https://github.com/rudranpatra/AI_MEMORY_CONTROL_PLANE/tree/main/tools/mcp-proof",
+  "author": "Vyriai <vyriaipro@gmail.com>",
+  "license": "MIT"
+}