mcp-proof 0.3.6 → 0.3.7

package/bin/mcp-proof.js

@@ -23,7 +23,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { spawn } = require('child_process');
-const { evaluate, scanSkillManifest, verifyPublisherAsync } = require('../engine.js');
+const { evaluate, evaluateCall, scanSkillManifest, verifyPublisherAsync } = require('../engine.js');
 
 const DEFAULT_MAX_INPUT_BYTES = 5 * 1024 * 1024;
 const DEFAULT_TIMEOUT_MS = 15000;
@@ -43,13 +43,15 @@ Usage:
   mcp-proof --stdio "<command to launch MCP server>"
   mcp-proof --config <claude-or-cursor-config.json>
   mcp-proof --skill <SKILL.md>
+  mcp-proof --execute [<call.json>]        runtime authorization of a tools/call payload
 
-  If <file.json> is omitted and --stdio/--config/--skill are not used, JSON is read from stdin.
+  If <file.json> is omitted and --stdio/--config/--skill/--execute are not used, JSON is read from stdin.
 
 Options:
   --stdio <cmd>      launch a real stdio MCP server, call tools/list, scan returned tools
   --config <path>    scan every stdio server in an MCP client config with mcpServers
   --skill <path>     scan a Claude SKILL.md (educational/warning context aware)
+  --execute [<path>] runtime authorization of a tools/call payload (reads stdin if path omitted)
   --live             confirm npm publisher against registry.npmjs.org (one network call)
   --timeout <ms>     MCP launch/protocol timeout per server (default: 15000)
   --source <s>       npm:@scope/pkg, git+https://..., or file://...   (drives publisher verification)
@@ -89,9 +91,9 @@ async function main() {
   if (args.selfTest) {
     return runSelfTest(args);
   }
-  const exclusiveModes = [args.stdio, args.config, args.skill].filter(Boolean).length;
+  const exclusiveModes = [args.stdio, args.config, args.skill, args.execute].filter(Boolean).length;
   if (exclusiveModes > 1) {
-    process.stderr.write('mcp-proof: use one of --stdio, --config, --skill at a time.\n');
+    process.stderr.write('mcp-proof: use one of --stdio, --config, --skill, --execute at a time.\n');
     process.exit(64);
   }
 
@@ -151,6 +153,22 @@ async function main() {
     process.exit(exitCodeForDecision(result.decision));
   }
 
+  if (args.execute) {
+    let result;
+    try {
+      result = runExecute(args);
+    } catch (err) {
+      process.stderr.write(`mcp-proof: ${err.message}\n`);
+      process.exit(err.exitCode || 65);
+    }
+    if (args.json) {
+      process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+    } else {
+      renderHumanReadable(result, 0, result.tool || 'execute');
+    }
+    process.exit(exitCodeForDecision(result.decision));
+  }
+
   let raw;
   try {
     raw = args.file ? readFileLimited(args.file) : readStdinLimited();
@@ -206,7 +224,7 @@ function parseArgs(argv) {
   const out = {
     source: '', transport: '', bind: '', json: false, selfTest: false,
     help: false, version: false, file: '', stdio: '', config: '', skill: '',
-    live: false, timeoutMs: DEFAULT_TIMEOUT_MS,
+    execute: false, live: false, timeoutMs: DEFAULT_TIMEOUT_MS,
   };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
@@ -221,6 +239,10 @@ function parseArgs(argv) {
       case '--stdio': out.stdio = argv[++i] || ''; break;
       case '--config': out.config = expandHome(argv[++i] || ''); break;
       case '--skill': out.skill = expandHome(argv[++i] || ''); break;
+      case '--execute':
+        out.execute = true;
+        if (argv[i + 1] && !argv[i + 1].startsWith('-')) out.file = argv[++i];
+        break;
       case '--live': out.live = true; break;
       case '--timeout': out.timeoutMs = parseTimeout(argv[++i] || ''); break;
       default:
@@ -577,6 +599,25 @@ function worstDecision(decisions) {
   return 'allow';
 }
 
+function runExecute(args) {
+  const raw = args.file ? readFileLimited(args.file) : readStdinLimited();
+  if (!raw.trim()) {
+    throw new Error('empty input. Pipe a tools/call JSON or pass a path.');
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    const e = new Error(`invalid JSON: ${err.message}`);
+    e.exitCode = 65;
+    throw e;
+  }
+  const result = evaluateCall(parsed);
+  result.mode = 'execute';
+  result.name = args.file || 'stdin';
+  return result;
+}
+
 function exitCodeForDecision(d) {
   return d === 'allow' ? 0 : d === 'warn' ? 1 : 2;
 }

package/engine.js

@@ -634,4 +634,67 @@ function evaluate(req) {
 
 function round1(v) { return Math.round(v * 10) / 10; }
 
-module.exports = { evaluate, scanTools, scanSkillManifest, verifyPublisher, verifyPublisherAsync, validateTransport, levenshtein };
+// ── Runtime tool-call authorization ──────────────────────────────────────────
+//
+// evaluateCall answers the execution-time question: given the exact tool and
+// the exact arguments, is this call still authorized? It applies the same
+// signatures used for static tool manifest scanning to the live payload.
+
+function flattenArgs(args) {
+  const values = [];
+  function walk(v) {
+    if (v == null) return;
+    if (typeof v === 'string') values.push(v);
+    else if (Array.isArray(v)) v.forEach(walk);
+    else if (typeof v === 'object') Object.values(v).forEach(walk);
+    else values.push(String(v));
+  }
+  walk(args);
+  return values.join('\n');
+}
+
+function scanCall(toolName, args) {
+  const hay = [toolName, flattenArgs(args)].join('\n');
+  for (const sig of SIGNATURES) {
+    if (sig.re.test(hay)) {
+      return { detected: true, severity: sig.sev, reason: sig.reason };
+    }
+  }
+  if (HIDDEN_CHARS.test(hay)) {
+    return { detected: true, severity: 'high', reason: 'arguments contain hidden unicode characters' };
+  }
+  const b64 = hay.match(BASE64_RE);
+  if (b64) {
+    for (const m of b64) {
+      try {
+        const decoded = Buffer.from(m, 'base64').toString('utf8');
+        if (SUSPICIOUS_DECODED.test(decoded)) {
+          return { detected: true, severity: 'high', reason: 'arguments contain base64 with suspicious decoded content' };
+        }
+      } catch (_) { /* ignore */ }
+    }
+  }
+  return { detected: false, severity: 'low', reason: 'clean' };
+}
+
+function evaluateCall(req) {
+  const start = Date.now();
+  const toolName = req.tool || (req.params && req.params.name) || '';
+  const args = req.arguments || (req.params && req.params.arguments) || {};
+  const scan = scanCall(toolName, args);
+  const score = {
+    tool: toolName,
+    call_scan: scan,
+    reasons: [],
+    decision: 'allow',
+  };
+  if (scan.detected) {
+    score.reasons.push(`${scan.severity}: ${scan.reason}`);
+    if (scan.severity === 'critical') score.decision = 'block';
+    else score.decision = 'warn';
+  }
+  score.durationMs = Date.now() - start;
+  return score;
+}
+
+module.exports = { evaluate, evaluateCall, scanTools, scanCall, scanSkillManifest, verifyPublisher, verifyPublisherAsync, validateTransport, levenshtein };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-proof",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Unbranded, free MCP (Model Context Protocol) server verifier — detects tool poisoning, typosquats, hidden unicode, base64 payloads, exposed transports, and skill-manifest attacks. Same engine as the VyriAI control plane, no account required.",
   "main": "engine.js",
   "bin": {