mcp-proof 0.3.5 → 0.3.7

package/bin/mcp-proof.js

@@ -23,7 +23,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { spawn } = require('child_process');
-const { evaluate, scanSkillManifest, verifyPublisherAsync } = require('../engine.js');
+const { evaluate, evaluateCall, scanSkillManifest, verifyPublisherAsync } = require('../engine.js');
 
 const DEFAULT_MAX_INPUT_BYTES = 5 * 1024 * 1024;
 const DEFAULT_TIMEOUT_MS = 15000;
@@ -43,13 +43,15 @@ Usage:
   mcp-proof --stdio "<command to launch MCP server>"
   mcp-proof --config <claude-or-cursor-config.json>
   mcp-proof --skill <SKILL.md>
+  mcp-proof --execute [<call.json>]        runtime authorization of a tools/call payload
 
-  If <file.json> is omitted and --stdio/--config/--skill are not used, JSON is read from stdin.
+  If <file.json> is omitted and --stdio/--config/--skill/--execute are not used, JSON is read from stdin.
 
 Options:
   --stdio <cmd>      launch a real stdio MCP server, call tools/list, scan returned tools
   --config <path>    scan every stdio server in an MCP client config with mcpServers
   --skill <path>     scan a Claude SKILL.md (educational/warning context aware)
+  --execute [<path>] runtime authorization of a tools/call payload (reads stdin if path omitted)
   --live             confirm npm publisher against registry.npmjs.org (one network call)
   --timeout <ms>     MCP launch/protocol timeout per server (default: 15000)
   --source <s>       npm:@scope/pkg, git+https://..., or file://...   (drives publisher verification)
@@ -89,9 +91,9 @@ async function main() {
   if (args.selfTest) {
     return runSelfTest(args);
   }
-  const exclusiveModes = [args.stdio, args.config, args.skill].filter(Boolean).length;
+  const exclusiveModes = [args.stdio, args.config, args.skill, args.execute].filter(Boolean).length;
   if (exclusiveModes > 1) {
-    process.stderr.write('mcp-proof: use one of --stdio, --config, --skill at a time.\n');
+    process.stderr.write('mcp-proof: use one of --stdio, --config, --skill, --execute at a time.\n');
     process.exit(64);
   }
 
@@ -151,6 +153,22 @@ async function main() {
     process.exit(exitCodeForDecision(result.decision));
   }
 
+  if (args.execute) {
+    let result;
+    try {
+      result = runExecute(args);
+    } catch (err) {
+      process.stderr.write(`mcp-proof: ${err.message}\n`);
+      process.exit(err.exitCode || 65);
+    }
+    if (args.json) {
+      process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+    } else {
+      renderHumanReadable(result, 0, result.tool || 'execute');
+    }
+    process.exit(exitCodeForDecision(result.decision));
+  }
+
   let raw;
   try {
     raw = args.file ? readFileLimited(args.file) : readStdinLimited();
@@ -206,7 +224,7 @@ function parseArgs(argv) {
   const out = {
     source: '', transport: '', bind: '', json: false, selfTest: false,
     help: false, version: false, file: '', stdio: '', config: '', skill: '',
-    live: false, timeoutMs: DEFAULT_TIMEOUT_MS,
+    execute: false, live: false, timeoutMs: DEFAULT_TIMEOUT_MS,
   };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
@@ -221,6 +239,10 @@ function parseArgs(argv) {
       case '--stdio': out.stdio = argv[++i] || ''; break;
       case '--config': out.config = expandHome(argv[++i] || ''); break;
       case '--skill': out.skill = expandHome(argv[++i] || ''); break;
+      case '--execute':
+        out.execute = true;
+        if (argv[i + 1] && !argv[i + 1].startsWith('-')) out.file = argv[++i];
+        break;
       case '--live': out.live = true; break;
       case '--timeout': out.timeoutMs = parseTimeout(argv[++i] || ''); break;
       default:
@@ -577,6 +599,25 @@ function worstDecision(decisions) {
   return 'allow';
 }
 
+function runExecute(args) {
+  const raw = args.file ? readFileLimited(args.file) : readStdinLimited();
+  if (!raw.trim()) {
+    throw new Error('empty input. Pipe a tools/call JSON or pass a path.');
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    const e = new Error(`invalid JSON: ${err.message}`);
+    e.exitCode = 65;
+    throw e;
+  }
+  const result = evaluateCall(parsed);
+  result.mode = 'execute';
+  result.name = args.file || 'stdin';
+  return result;
+}
+
 function exitCodeForDecision(d) {
   return d === 'allow' ? 0 : d === 'warn' ? 1 : 2;
 }

package/engine.js

@@ -123,8 +123,119 @@ const SUSPICIOUS_DECODED =
 const SKILL_BENIGN_MARKERS =
   /\b(?:warning|⚠️|example|demonstration|sample|illustration|not\s+safe|suspicious|malicious|attack)\b/i;
 
-function isBenignSkillContext(text) {
-  return SKILL_BENIGN_MARKERS.test(text);
+// Negation markers in the same clause as a sensitive-pattern match indicate a
+// warning/prohibition ("Never ask the model to read ~/.ssh/id_rsa") rather than
+// an attack directive.
+const SKILL_NEGATION_RE =
+  /\b(?:never|no|not|n't|nothing|none|do not|don't|doesn't|does not|won't|will not|wouldn't|would not|shouldn't|should not|mustn't|must not|without|avoid|prohibited|forbidden)\b/i;
+
+// Imperative/directive action verbs, including third-person/present/past
+// conjugations ("forwards", "reads", "forwarded") — real tool descriptions
+// are often written in descriptive third person ("this tool forwards data
+// to..."), not just the bare imperative. For sensitive patterns, the
+// pattern alone is downgraded unless an un-negated directive action
+// appears nearby. "leak" is deliberately kept bare-only (no "leaked"/
+// "leaking"): "leaked" is an extremely common adjective in security prose
+// describing already-exposed data ("leaked .env file", "leaked API key"),
+// not a live directive, and generalizing it produces exactly that false
+// match.
+const SKILL_DIRECTIVE_ACTION_RE =
+  /\b(?:read|write|send|upload|exfiltrate|include|append|attach|post|fetch|extract|copy|steal|forward|use|call|invoke|execute|run|ignore|disregard)(?:s|ed|ing)?\b|\bleak\b/gi;
+
+// A lone '\n' is markdown/prose line-wrapping, not a sentence end — SKILL.md
+// files and tool descriptions wrap constantly mid-sentence. Only a blank
+// line (a real paragraph break) should reset clause context; otherwise a
+// directive verb like "read" on one line and its target ("~/.ssh/id_rsa")
+// on the next would be silently treated as two different clauses.
+function isNewlineBoundary(text, i) {
+  let before = i - 1;
+  while (before >= 0 && (text[before] === ' ' || text[before] === '\t')) before--;
+  if (before >= 0 && text[before] === '\n') return true;
+  let after = i + 1;
+  while (after < text.length && (text[after] === ' ' || text[after] === '\t')) after++;
+  return after < text.length && text[after] === '\n';
+}
+
+function isClauseBoundary(text, i) {
+  const c = text[i];
+  return c === '.' || c === '!' || c === '?' || (c === '\n' && isNewlineBoundary(text, i));
+}
+
+function findClauseStart(text, idx) {
+  let start = 0;
+  for (let i = idx - 1; i >= 0; i--) {
+    if (isClauseBoundary(text, i)) {
+      start = i + 1;
+      break;
+    }
+  }
+  return start;
+}
+
+function findClauseEnd(text, idx) {
+  for (let i = idx; i < text.length; i++) {
+    if (isClauseBoundary(text, i)) {
+      return i;
+    }
+  }
+  return text.length;
+}
+
+const URL_RE = /https?:\/\/[^\s)]+/gi;
+
+// The local clause window around the match, plus the immediately adjacent
+// clause on either side — mirrors the "same sentence or adjacent clause"
+// co-occurrence rule used for the directive/negation check below. URLs are
+// stripped before the caller tests for benign markers: a URL's host/path is
+// an opaque data token, not authorial framing, and "example" (the RFC 2606
+// placeholder TLD, extremely common in exactly this kind of exfil URL) would
+// otherwise launder a real attack — whether "example" lands inside the
+// match itself ("https://attacker.example/collect") or elsewhere in the
+// same sentence, neither should count as the author signaling "this is
+// educational".
+function localClauseWindow(text, matchIndex, matchLen) {
+  const clauseStart = findClauseStart(text, matchIndex);
+  const prevClauseStart = clauseStart > 0 ? findClauseStart(text, clauseStart - 1) : 0;
+  const clauseEnd = findClauseEnd(text, matchIndex + matchLen);
+  const nextClauseEnd = clauseEnd < text.length ? findClauseEnd(text, clauseEnd + 1) : text.length;
+  return text.slice(prevClauseStart, nextClauseEnd);
+}
+
+function hasUnnegatedModelDirective(text, matchIndex, matchText) {
+  const sentStart = findClauseStart(text, matchIndex);
+  const before = text.slice(sentStart, matchIndex);
+  // If the clause is negated before the match, the action is a warning/prohibition.
+  if (SKILL_NEGATION_RE.test(before)) return false;
+  // Find the last directive action in the clause before the match.
+  let lastActionIndex = -1;
+  let m;
+  SKILL_DIRECTIVE_ACTION_RE.lastIndex = 0;
+  while ((m = SKILL_DIRECTIVE_ACTION_RE.exec(before)) !== null) {
+    lastActionIndex = m.index;
+  }
+  if (lastActionIndex === -1) return false;
+  // Action must be within 80 chars of the match to be co-located in the same clause.
+  return (matchIndex - (sentStart + lastActionIndex)) <= 100;
+}
+
+// sigName is the SIGNATURES entry name for the specific match being judged —
+// pass it (and the match position) whenever available so instruction-hijack
+// signatures are never downgraded and the benign-marker check stays scoped
+// to the local clause rather than the whole corpus.
+function isBenignSkillContext(text, matchIndex, matchText, sigName) {
+  const isHijackSig = sigName && (sigName.startsWith('instruction_hijack') || sigName === 'system_role_overwrite');
+  if (matchIndex === undefined || !matchText) {
+    return !isHijackSig && SKILL_BENIGN_MARKERS.test(text.replace(URL_RE, ' '));
+  }
+  const window = localClauseWindow(text, matchIndex, matchText.length);
+  if (SKILL_BENIGN_MARKERS.test(window.replace(URL_RE, ' '))) return true;
+  // Instruction-hijack and role-overwrite signatures ARE the directive; past
+  // this point do not downgrade them purely because they contain negation
+  // words ("Do not mention this to the user" is itself the attack phrase,
+  // negated or not) — only an explicit local benign marker, checked above,
+  // is a strong enough signal to treat one of these as quoted/educational.
+  if (isHijackSig) return false;
+  return !hasUnnegatedModelDirective(text, matchIndex, matchText);
 }
 
 function findAllMatches(corpus, re) {
@@ -334,9 +445,10 @@ function scanTools(tools, opts) {
         let sev = sig.sev;
         let downgraded = false;
         // For skill manifests, use the whole prompt for context framing. If the
-        // author has explicitly labeled the content as a warning/example, the
-        // match is treated as educational rather than an attack directive.
-        if (skillContext && isBenignSkillContext(corpus)) {
+        // author has explicitly labeled the content as a warning/example, or if
+        // a sensitive-pattern match appears in a negated/descriptive clause rather
+        // than an un-negated model directive, the match is treated as educational.
+        if (skillContext && isBenignSkillContext(corpus, m.index, m.text, sig.name)) {
           sev = 'low';
           downgraded = true;
         }
@@ -522,4 +634,67 @@ function evaluate(req) {
 
 function round1(v) { return Math.round(v * 10) / 10; }
 
-module.exports = { evaluate, scanTools, scanSkillManifest, verifyPublisher, verifyPublisherAsync, validateTransport, levenshtein };
+// ── Runtime tool-call authorization ──────────────────────────────────────────
+//
+// evaluateCall answers the execution-time question: given the exact tool and
+// the exact arguments, is this call still authorized? It applies the same
+// signatures used for static tool manifest scanning to the live payload.
+
+function flattenArgs(args) {
+  const values = [];
+  function walk(v) {
+    if (v == null) return;
+    if (typeof v === 'string') values.push(v);
+    else if (Array.isArray(v)) v.forEach(walk);
+    else if (typeof v === 'object') Object.values(v).forEach(walk);
+    else values.push(String(v));
+  }
+  walk(args);
+  return values.join('\n');
+}
+
+function scanCall(toolName, args) {
+  const hay = [toolName, flattenArgs(args)].join('\n');
+  for (const sig of SIGNATURES) {
+    if (sig.re.test(hay)) {
+      return { detected: true, severity: sig.sev, reason: sig.reason };
+    }
+  }
+  if (HIDDEN_CHARS.test(hay)) {
+    return { detected: true, severity: 'high', reason: 'arguments contain hidden unicode characters' };
+  }
+  const b64 = hay.match(BASE64_RE);
+  if (b64) {
+    for (const m of b64) {
+      try {
+        const decoded = Buffer.from(m, 'base64').toString('utf8');
+        if (SUSPICIOUS_DECODED.test(decoded)) {
+          return { detected: true, severity: 'high', reason: 'arguments contain base64 with suspicious decoded content' };
+        }
+      } catch (_) { /* ignore */ }
+    }
+  }
+  return { detected: false, severity: 'low', reason: 'clean' };
+}
+
+function evaluateCall(req) {
+  const start = Date.now();
+  const toolName = req.tool || (req.params && req.params.name) || '';
+  const args = req.arguments || (req.params && req.params.arguments) || {};
+  const scan = scanCall(toolName, args);
+  const score = {
+    tool: toolName,
+    call_scan: scan,
+    reasons: [],
+    decision: 'allow',
+  };
+  if (scan.detected) {
+    score.reasons.push(`${scan.severity}: ${scan.reason}`);
+    if (scan.severity === 'critical') score.decision = 'block';
+    else score.decision = 'warn';
+  }
+  score.durationMs = Date.now() - start;
+  return score;
+}
+
+module.exports = { evaluate, evaluateCall, scanTools, scanCall, scanSkillManifest, verifyPublisher, verifyPublisherAsync, validateTransport, levenshtein };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-proof",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Unbranded, free MCP (Model Context Protocol) server verifier — detects tool poisoning, typosquats, hidden unicode, base64 payloads, exposed transports, and skill-manifest attacks. Same engine as the VyriAI control plane, no account required.",
   "main": "engine.js",
   "bin": {