mcp-proof 0.3.5 → 0.3.6

package/engine.js

@@ -123,8 +123,119 @@ const SUSPICIOUS_DECODED =
 const SKILL_BENIGN_MARKERS =
   /\b(?:warning|⚠️|example|demonstration|sample|illustration|not\s+safe|suspicious|malicious|attack)\b/i;
 
-function isBenignSkillContext(text) {
-  return SKILL_BENIGN_MARKERS.test(text);
+// Negation markers in the same clause as a sensitive-pattern match indicate a
+// warning/prohibition ("Never ask the model to read ~/.ssh/id_rsa") rather than
+// an attack directive.
+const SKILL_NEGATION_RE =
+  /\b(?:never|no|not|n't|nothing|none|do not|don't|doesn't|does not|won't|will not|wouldn't|would not|shouldn't|should not|mustn't|must not|without|avoid|prohibited|forbidden)\b/i;
+
+// Imperative/directive action verbs, including third-person/present/past
+// conjugations ("forwards", "reads", "forwarded") — real tool descriptions
+// are often written in descriptive third person ("this tool forwards data
+// to..."), not just the bare imperative. For sensitive patterns, the
+// pattern alone is downgraded unless an un-negated directive action
+// appears nearby. "leak" is deliberately kept bare-only (no "leaked"/
+// "leaking"): "leaked" is an extremely common adjective in security prose
+// describing already-exposed data ("leaked .env file", "leaked API key"),
+// not a live directive, and generalizing it produces exactly that false
+// match.
+const SKILL_DIRECTIVE_ACTION_RE =
+  /\b(?:read|write|send|upload|exfiltrate|include|append|attach|post|fetch|extract|copy|steal|forward|use|call|invoke|execute|run|ignore|disregard)(?:s|ed|ing)?\b|\bleak\b/gi;
+
+// A lone '\n' is markdown/prose line-wrapping, not a sentence end — SKILL.md
+// files and tool descriptions wrap constantly mid-sentence. Only a blank
+// line (a real paragraph break) should reset clause context; otherwise a
+// directive verb like "read" on one line and its target ("~/.ssh/id_rsa")
+// on the next would be silently treated as two different clauses.
+function isNewlineBoundary(text, i) {
+  let before = i - 1;
+  while (before >= 0 && (text[before] === ' ' || text[before] === '\t')) before--;
+  if (before >= 0 && text[before] === '\n') return true;
+  let after = i + 1;
+  while (after < text.length && (text[after] === ' ' || text[after] === '\t')) after++;
+  return after < text.length && text[after] === '\n';
+}
+
+function isClauseBoundary(text, i) {
+  const c = text[i];
+  return c === '.' || c === '!' || c === '?' || (c === '\n' && isNewlineBoundary(text, i));
+}
+
+function findClauseStart(text, idx) {
+  let start = 0;
+  for (let i = idx - 1; i >= 0; i--) {
+    if (isClauseBoundary(text, i)) {
+      start = i + 1;
+      break;
+    }
+  }
+  return start;
+}
+
+function findClauseEnd(text, idx) {
+  for (let i = idx; i < text.length; i++) {
+    if (isClauseBoundary(text, i)) {
+      return i;
+    }
+  }
+  return text.length;
+}
+
+const URL_RE = /https?:\/\/[^\s)]+/gi;
+
+// The local clause window around the match, plus the immediately adjacent
+// clause on either side — mirrors the "same sentence or adjacent clause"
+// co-occurrence rule used for the directive/negation check below. URLs are
+// stripped before the caller tests for benign markers: a URL's host/path is
+// an opaque data token, not authorial framing, and "example" (the RFC 2606
+// placeholder TLD, extremely common in exactly this kind of exfil URL) would
+// otherwise launder a real attack — whether "example" lands inside the
+// match itself ("https://attacker.example/collect") or elsewhere in the
+// same sentence, neither should count as the author signaling "this is
+// educational".
+function localClauseWindow(text, matchIndex, matchLen) {
+  const clauseStart = findClauseStart(text, matchIndex);
+  const prevClauseStart = clauseStart > 0 ? findClauseStart(text, clauseStart - 1) : 0;
+  const clauseEnd = findClauseEnd(text, matchIndex + matchLen);
+  const nextClauseEnd = clauseEnd < text.length ? findClauseEnd(text, clauseEnd + 1) : text.length;
+  return text.slice(prevClauseStart, nextClauseEnd);
+}
+
+function hasUnnegatedModelDirective(text, matchIndex, matchText) {
+  const sentStart = findClauseStart(text, matchIndex);
+  const before = text.slice(sentStart, matchIndex);
+  // If the clause is negated before the match, the action is a warning/prohibition.
+  if (SKILL_NEGATION_RE.test(before)) return false;
+  // Find the last directive action in the clause before the match.
+  let lastActionIndex = -1;
+  let m;
+  SKILL_DIRECTIVE_ACTION_RE.lastIndex = 0;
+  while ((m = SKILL_DIRECTIVE_ACTION_RE.exec(before)) !== null) {
+    lastActionIndex = m.index;
+  }
+  if (lastActionIndex === -1) return false;
+  // Action must be within 80 chars of the match to be co-located in the same clause.
+  return (matchIndex - (sentStart + lastActionIndex)) <= 100;
+}
+
+// sigName is the SIGNATURES entry name for the specific match being judged —
+// pass it (and the match position) whenever available so instruction-hijack
+// signatures are never downgraded and the benign-marker check stays scoped
+// to the local clause rather than the whole corpus.
+function isBenignSkillContext(text, matchIndex, matchText, sigName) {
+  const isHijackSig = sigName && (sigName.startsWith('instruction_hijack') || sigName === 'system_role_overwrite');
+  if (matchIndex === undefined || !matchText) {
+    return !isHijackSig && SKILL_BENIGN_MARKERS.test(text.replace(URL_RE, ' '));
+  }
+  const window = localClauseWindow(text, matchIndex, matchText.length);
+  if (SKILL_BENIGN_MARKERS.test(window.replace(URL_RE, ' '))) return true;
+  // Instruction-hijack and role-overwrite signatures ARE the directive; past
+  // this point do not downgrade them purely because they contain negation
+  // words ("Do not mention this to the user" is itself the attack phrase,
+  // negated or not) — only an explicit local benign marker, checked above,
+  // is a strong enough signal to treat one of these as quoted/educational.
+  if (isHijackSig) return false;
+  return !hasUnnegatedModelDirective(text, matchIndex, matchText);
 }
 
 function findAllMatches(corpus, re) {
@@ -334,9 +445,10 @@ function scanTools(tools, opts) {
         let sev = sig.sev;
         let downgraded = false;
         // For skill manifests, use the whole prompt for context framing. If the
-        // author has explicitly labeled the content as a warning/example, the
-        // match is treated as educational rather than an attack directive.
-        if (skillContext && isBenignSkillContext(corpus)) {
+        // author has explicitly labeled the content as a warning/example, or if
+        // a sensitive-pattern match appears in a negated/descriptive clause rather
+        // than an un-negated model directive, the match is treated as educational.
+        if (skillContext && isBenignSkillContext(corpus, m.index, m.text, sig.name)) {
           sev = 'low';
           downgraded = true;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-proof",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Unbranded, free MCP (Model Context Protocol) server verifier — detects tool poisoning, typosquats, hidden unicode, base64 payloads, exposed transports, and skill-manifest attacks. Same engine as the VyriAI control plane, no account required.",
   "main": "engine.js",
   "bin": {