mcp-security-lab 0.2.0

package/dist/src/environment.js

@@ -0,0 +1,145 @@
+const SAFE_ENV_KEYS = [
+    "COMSPEC",
+    "OS",
+    "PATH",
+    "PATHEXT",
+    "SYSTEMDRIVE",
+    "SYSTEMROOT",
+    "TEMP",
+    "TMP",
+    "WINDIR",
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "SHELL",
+];
+const NON_OVERRIDABLE_ENV_KEYS = [
+    "DYLD_INSERT_LIBRARIES",
+    "DYLD_LIBRARY_PATH",
+    "LD_LIBRARY_PATH",
+    "LD_PRELOAD",
+    "MCP_SECURITY_LAB",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+];
+export const RESERVED_ENV_KEYS = new Set([
+    ...SAFE_ENV_KEYS,
+    ...NON_OVERRIDABLE_ENV_KEYS,
+]);
+const SENSITIVE_FLAG_PATTERN = /^--?(?:api[-_]?key|authorization|credential|password|secret|token)$/i;
+const SENSITIVE_ASSIGNMENT_PATTERN = /^((?:--?)?(?:api[-_]?key|authorization|credential|password|secret|token)=).+$/i;
+const SENSITIVE_ENV_ASSIGNMENT_PATTERN = /^([A-Z0-9_]*(?:API_KEY|AUTHORIZATION|CREDENTIAL|PASSWORD|SECRET|TOKEN)=).+$/i;
+const URL_CREDENTIAL_PATTERN = /^([a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/i;
+export function createSanitizedEnvironment(source = process.env) {
+    const environment = {};
+    for (const key of SAFE_ENV_KEYS) {
+        const value = source[key];
+        if (value !== undefined) {
+            environment[key] = value;
+        }
+    }
+    environment.MCP_SECURITY_LAB = "1";
+    return environment;
+}
+function normalizeKey(key) {
+    return key.toLowerCase().replace(/[-_]/g, "");
+}
+// Compound names that are unambiguously credentials. Matched as substrings so
+// client_secret, refresh_token, id_token, X-Amz-Security-Token, X-Amz-Signature,
+// api_key, etc. are all caught.
+const CREDENTIAL_NEEDLES = [
+    "secret",
+    "password",
+    "passwd",
+    "credential",
+    "signature",
+    "apikey",
+    "accesskey",
+    "privatekey",
+    "accesstoken",
+    "refreshtoken",
+    "idtoken",
+    "securitytoken",
+    "sessiontoken",
+    "bearer",
+];
+// Additional bare keys redacted from reports (over-redaction is safe there) but
+// NOT treated as findings, since a bare ?token=/?key= is often an opaque cursor.
+const BROAD_REDACTION_KEYS = new Set(["token", "key", "auth", "authorization", "sig", "pwd"]);
+/** Strong, low-false-positive test used to RAISE a credentials-in-URL finding. */
+export function isCredentialQueryKey(key) {
+    const normalized = normalizeKey(key);
+    return CREDENTIAL_NEEDLES.some((needle) => normalized.includes(needle));
+}
+/** Broad test used only to REDACT report output, where over-redaction is safe. */
+function isRedactableQueryKey(key) {
+    return isCredentialQueryKey(key) || BROAD_REDACTION_KEYS.has(normalizeKey(key));
+}
+function redactParams(params) {
+    let changed = false;
+    for (const key of [...params.keys()]) {
+        if (isRedactableQueryKey(key)) {
+            params.set(key, "[REDACTED]");
+            changed = true;
+        }
+    }
+    return changed;
+}
+/**
+ * Remove credentials from a URL before it enters a report: strip any userinfo
+ * (`user:pass@`) and redact the value of sensitive query AND fragment parameters
+ * (OAuth implicit-flow tokens live in the fragment). Falls back to a coarse regex
+ * when the string is not a parseable URL.
+ */
+export function redactUrl(rawUrl) {
+    try {
+        const url = new URL(rawUrl);
+        if (url.username !== "" || url.password !== "") {
+            url.username = "[REDACTED]";
+            url.password = "";
+        }
+        redactParams(url.searchParams);
+        if (url.hash.length > 1) {
+            const fragment = new URLSearchParams(url.hash.slice(1));
+            if (redactParams(fragment)) {
+                url.hash = `#${fragment.toString()}`;
+            }
+        }
+        // URL percent-encodes the brackets of our sentinel; restore it for readability.
+        return url.toString().replace(/%5BREDACTED%5D/g, "[REDACTED]");
+    }
+    catch {
+        return rawUrl.replace(URL_CREDENTIAL_PATTERN, "$1[REDACTED]@");
+    }
+}
+export function redactArguments(args) {
+    const redacted = [];
+    let redactNext = false;
+    for (const argument of args) {
+        if (redactNext) {
+            redacted.push("[REDACTED]");
+            redactNext = false;
+            continue;
+        }
+        if (SENSITIVE_FLAG_PATTERN.test(argument)) {
+            redacted.push(argument);
+            redactNext = true;
+            continue;
+        }
+        if (SENSITIVE_ASSIGNMENT_PATTERN.test(argument)) {
+            redacted.push(argument.replace(SENSITIVE_ASSIGNMENT_PATTERN, "$1[REDACTED]"));
+            continue;
+        }
+        if (SENSITIVE_ENV_ASSIGNMENT_PATTERN.test(argument)) {
+            redacted.push(argument.replace(SENSITIVE_ENV_ASSIGNMENT_PATTERN, "$1[REDACTED]"));
+            continue;
+        }
+        if (URL_CREDENTIAL_PATTERN.test(argument)) {
+            redacted.push(argument.replace(URL_CREDENTIAL_PATTERN, "$1[REDACTED]@"));
+            continue;
+        }
+        redacted.push(argument);
+    }
+    return redacted;
+}
+//# sourceMappingURL=environment.js.map

package/dist/src/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../src/environment.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG;IACpB,SAAS;IACT,IAAI;IACJ,MAAM;IACN,SAAS;IACT,aAAa;IACb,YAAY;IACZ,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,QAAQ;IACR,OAAO;CACC,CAAC;AAEX,MAAM,wBAAwB,GAAG;IAC/B,uBAAuB;IACvB,mBAAmB;IACnB,iBAAiB;IACjB,YAAY;IACZ,kBAAkB;IAClB,cAAc;IACd,WAAW;CACH,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAS;IACpE,GAAG,aAAa;IAChB,GAAG,wBAAwB;CAC5B,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAC1B,sEAAsE,CAAC;AACzE,MAAM,4BAA4B,GAChC,gFAAgF,CAAC;AACnF,MAAM,gCAAgC,GACpC,8EAA8E,CAAC;AACjF,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AAErE,MAAM,UAAU,0BAA0B,CACxC,SAA4B,OAAO,CAAC,GAAG;IAEvC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAE/C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,WAAW,CAAC,gBAAgB,GAAG,GAAG,CAAC;IACnC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,iFAAiF;AACjF,gCAAgC;AAChC,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,aAAa;IACb,cAAc;IACd,SAAS;IACT,eAAe;IACf,cAAc;IACd,QAAQ;CACT,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9F,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,kFAAkF;AAClF,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,YAAY,CAAC,MAAuB;IAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACrC,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC9B,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC/C,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;YAC5B,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;QACD,gFAAgF;QAChF,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5B,UAAU,GAAG,KAAK,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,UAAU,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,4BAA4B,EAAE,cAAc,CAAC,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QACD,IAAI,gCAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gCAAgC,EAAE,cAAc,CAAC,CAAC,CAAC;YAClF,SAAS;QACX,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/reporter.d.ts

@@ -0,0 +1,4 @@
+import type { ScanReport } from "./types.js";
+export declare function reportAsJson(report: ScanReport): string;
+export declare function reportAsSarif(report: ScanReport, configPath: string, workspaceRoot?: string): string;
+export declare function reportAsText(report: ScanReport): string;

package/dist/src/reporter.js

@@ -0,0 +1,161 @@
+import { createHash } from "node:crypto";
+import { basename, isAbsolute, relative, resolve, sep } from "node:path";
+const ICONS = {
+    critical: "CRITICAL",
+    high: "HIGH",
+    medium: "MEDIUM",
+    low: "LOW",
+    info: "INFO",
+};
+export function reportAsJson(report) {
+    return `${JSON.stringify(report, null, 2)}\n`;
+}
+function sarifLevel(severity) {
+    if (severity === "critical" || severity === "high") {
+        return "error";
+    }
+    if (severity === "medium") {
+        return "warning";
+    }
+    if (severity === "low") {
+        return "note";
+    }
+    return "none";
+}
+function artifactUri(configPath, workspaceRoot) {
+    const absoluteConfigPath = resolve(configPath);
+    const absoluteWorkspaceRoot = resolve(workspaceRoot);
+    const relativePath = relative(absoluteWorkspaceRoot, absoluteConfigPath);
+    const outsideWorkspace = relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath);
+    return (outsideWorkspace ? basename(absoluteConfigPath) : relativePath || basename(absoluteConfigPath))
+        .split(sep)
+        .join("/");
+}
+function fingerprint(id, location, title, evidence) {
+    return createHash("sha256")
+        .update([id, location ?? "", title, evidence].join("\u0000"))
+        .digest("hex");
+}
+export function reportAsSarif(report, configPath, workspaceRoot = process.env.GITHUB_WORKSPACE ?? process.cwd()) {
+    const rules = new Map();
+    const uri = artifactUri(configPath, workspaceRoot);
+    for (const finding of report.findings) {
+        if (!rules.has(finding.id)) {
+            const tags = ["security", "mcp"];
+            if (finding.cwe !== undefined) {
+                tags.push(`external/cwe/${finding.cwe.toLowerCase()}`);
+            }
+            if (finding.owasp !== undefined) {
+                tags.push(`external/owasp-llm/${finding.owasp.toLowerCase()}`);
+            }
+            const taxonomy = [
+                finding.cwe === undefined ? undefined : `CWE: ${finding.cwe}`,
+                finding.owasp === undefined ? undefined : `OWASP LLM: ${finding.owasp}`,
+            ]
+                .filter((entry) => entry !== undefined)
+                .join(" | ");
+            rules.set(finding.id, {
+                id: finding.id,
+                shortDescription: { text: finding.title },
+                fullDescription: { text: finding.recommendation },
+                defaultConfiguration: { level: sarifLevel(finding.severity) },
+                help: {
+                    text: finding.recommendation,
+                    markdown: `**Recommendation:** ${finding.recommendation}${taxonomy === "" ? "" : `\n\n**Taxonomy:** ${taxonomy}`}`,
+                },
+                properties: {
+                    tags,
+                    ...(finding.cwe === undefined ? {} : { cwe: finding.cwe }),
+                    ...(finding.owasp === undefined ? {} : { owasp: finding.owasp }),
+                },
+            });
+        }
+    }
+    const sarif = {
+        $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: report.scanner.name,
+                        semanticVersion: report.scanner.version,
+                        rules: [...rules.values()],
+                    },
+                },
+                automationDetails: {
+                    id: "mcp-security-lab/",
+                },
+                invocations: [
+                    {
+                        executionSuccessful: true,
+                        properties: {
+                            connected: report.execution.connected,
+                            toolsInvoked: report.execution.toolsInvoked,
+                            osSandboxed: report.execution.osSandboxed,
+                        },
+                    },
+                ],
+                results: report.findings.map((finding) => ({
+                    ruleId: finding.id,
+                    level: sarifLevel(finding.severity),
+                    message: {
+                        text: `${finding.title}\n\nEvidence: ${finding.evidence}\n\nRecommendation: ${finding.recommendation}`,
+                    },
+                    locations: [
+                        {
+                            physicalLocation: {
+                                artifactLocation: { uri },
+                                region: { startLine: 1 },
+                            },
+                            logicalLocations: finding.location === undefined
+                                ? []
+                                : [{ fullyQualifiedName: finding.location, kind: "configuration" }],
+                        },
+                    ],
+                    partialFingerprints: {
+                        "mcpSecurityLab/v1": fingerprint(finding.id, finding.location, finding.title, finding.evidence),
+                    },
+                    properties: {
+                        severity: finding.severity,
+                        recommendation: finding.recommendation,
+                        scannerLocation: finding.location ?? "scan",
+                        ...(finding.cwe === undefined ? {} : { cwe: finding.cwe }),
+                        ...(finding.owasp === undefined ? {} : { owasp: finding.owasp }),
+                    },
+                })),
+            },
+        ],
+    };
+    return `${JSON.stringify(sarif, null, 2)}\n`;
+}
+export function reportAsText(report) {
+    const targetLabel = report.target.url !== undefined
+        ? report.target.url
+        : `${report.target.command} ${(report.target.args ?? []).join(" ")}`.trim();
+    const lines = [
+        "MCP Security Lab",
+        `Target: ${targetLabel}`,
+        `Connected: ${report.execution.connected ? "yes" : "no"} | Transport: ${report.execution.transport} | Tools invoked: ${report.execution.toolsInvoked} | OS sandbox: ${report.execution.osSandboxed ? "yes" : "no"}`,
+        `Findings: ${report.summary.critical} critical, ${report.summary.high} high, ${report.summary.medium} medium, ${report.summary.low} low, ${report.summary.info} info`,
+        "",
+    ];
+    for (const finding of report.findings) {
+        lines.push(`[${ICONS[finding.severity]}] ${finding.id} ${finding.title}`);
+        lines.push(`  Evidence: ${finding.evidence}`);
+        lines.push(`  Recommendation: ${finding.recommendation}`);
+        const taxonomy = [finding.cwe, finding.owasp].filter(Boolean).join(", ");
+        if (taxonomy !== "") {
+            lines.push(`  Taxonomy: ${taxonomy}`);
+        }
+        if (finding.location !== undefined) {
+            lines.push(`  Location: ${finding.location}`);
+        }
+        lines.push("");
+    }
+    lines.push(report.execution.osSandboxed
+        ? "Note: target ran inside a network-isolated Docker container."
+        : "Limitation: target processes are not isolated from the host filesystem or network.");
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=reporter.js.map

package/dist/src/reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../src/reporter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAIzE,MAAM,KAAK,GAA6B;IACtC,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAaD,SAAS,UAAU,CAAC,QAAkB;IACpC,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,aAAqB;IAC5D,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,QAAQ,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;IACzE,MAAM,gBAAgB,GACpB,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3F,OAAO,CACL,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC,kBAAkB,CAAC,CAC/F;SACE,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAClB,EAAU,EACV,QAA4B,EAC5B,KAAa,EACb,QAAgB;IAEhB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,CAAC,EAAE,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC5D,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAAkB,EAClB,UAAkB,EAClB,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE;IAE7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAEnD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACjC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,QAAQ,GAAG;gBACf,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,GAAG,EAAE;gBAC7D,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,KAAK,EAAE;aACxE;iBACE,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;iBACvD,IAAI,CAAC,KAAK,CAAC,CAAC;YACf,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;gBACpB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE;gBACzC,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE;gBACjD,oBAAoB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAC7D,IAAI,EAAE;oBACJ,IAAI,EAAE,OAAO,CAAC,cAAc;oBAC5B,QAAQ,EAAE,uBAAuB,OAAO,CAAC,cAAc,GACrD,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,QAAQ,EACtD,EAAE;iBACH;gBACD,UAAU,EAAE;oBACV,IAAI;oBACJ,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC1D,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;iBACjE;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;wBACzB,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;wBACvC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;qBAC3B;iBACF;gBACD,iBAAiB,EAAE;oBACjB,EAAE,EAAE,mBAAmB;iBACxB;gBACD,WAAW,EAAE;oBACX;wBACE,mBAAmB,EAAE,IAAI;wBACzB,UAAU,EAAE;4BACV,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;4BACrC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY;4BAC3C,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;yBAC1C;qBACF;iBACF;gBACD,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACzC,MAAM,EAAE,OAAO,CAAC,EAAE;oBAClB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACnC,OAAO,EAAE;wBACP,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,iBAAiB,OAAO,CAAC,QAAQ,uBAAuB,OAAO,CAAC,cAAc,EAAE;qBACvG;oBACD,SAAS,EAAE;wBACT;4BACE,gBAAgB,EAAE;gCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE;gCACzB,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;6BACzB;4BACD,gBAAgB,EACd,OAAO,CAAC,QAAQ,KAAK,SAAS;gCAC5B,CAAC,CAAC,EAAE;gCACJ,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;yBACxE;qBACF;oBACD,mBAAmB,EAAE;wBACnB,mBAAmB,EAAE,WAAW,CAC9B,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,CACjB;qBACF;oBACD,UAAU,EAAE;wBACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,eAAe,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM;wBAC3C,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;wBAC1D,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;qBACjE;iBACF,CAAC,CAAC;aACJ;SACF;KACF,CAAC;IAEF,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS;QAC7B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG;QACnB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhF,MAAM,KAAK,GAAG;QACZ,kBAAkB;QAClB,WAAW,WAAW,EAAE;QACxB,cAAc,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,iBAAiB,MAAM,CAAC,SAAS,CAAC,SAAS,qBAAqB,MAAM,CAAC,SAAS,CAAC,YAAY,kBAAkB,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACnN,aAAa,MAAM,CAAC,OAAO,CAAC,QAAQ,cAAc,MAAM,CAAC,OAAO,CAAC,IAAI,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,CAAC,GAAG,SAAS,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO;QACrK,EAAE;KACH,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,qBAAqB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,SAAS,CAAC,WAAW;QAC1B,CAAC,CAAC,8DAA8D;QAChE,CAAC,CAAC,oFAAoF,CACzF,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/src/rules/injection.d.ts

@@ -0,0 +1,16 @@
+import type { Finding } from "../types.js";
+/**
+ * Normalize untrusted text before pattern matching. NFKC folds homoglyph and
+ * fullwidth variants onto their canonical form so that, for example, fullwidth
+ * "ｉｇｎｏｒｅ" collapses to "ignore"; invisible characters are then stripped so
+ * they cannot break up a keyword mid-word.
+ */
+export declare function normalizeText(text: string): string;
+export declare function hasInvisibleCharacters(text: string): boolean;
+/**
+ * Scan a single untrusted string for prompt-injection-like instructions.
+ * Matching runs against the normalized form so evasion via Unicode tricks is
+ * defeated. `sourceLabel` names where the text came from (e.g. "description",
+ * "parameter data.query") for actionable evidence.
+ */
+export declare function scanTextForInjection(text: string, location: string, sourceLabel: string): Finding[];

package/dist/src/rules/injection.js

@@ -0,0 +1,91 @@
+const PROMPT_INJECTION_PATTERNS = [
+    {
+        pattern: /\bignore (?:all |any )?(?:previous|prior) instructions?\b/i,
+        label: "instruction override",
+    },
+    {
+        pattern: /\b(?:always|must) (?:call|invoke|use) (?:this|the) tool\b/i,
+        label: "forced invocation",
+    },
+    { pattern: /\bdo not (?:tell|inform|show) the user\b/i, label: "concealment" },
+    { pattern: /\b(?:system prompt|hidden instructions?)\b/i, label: "hidden prompt reference" },
+    { pattern: /\bdisable|bypass\b.{0,30}\b(?:safety|security|permission)/i, label: "safety bypass" },
+];
+// Characters an author never needs in a human-readable description but that an
+// attacker uses to smuggle instructions past a naive substring scan. Built from
+// explicit code-point ranges so this source file itself stays free of invisible
+// characters and remains reviewable.
+//   C0 controls (keep \t=0x09, \n=0x0A, \r=0x0D), DEL + C1 controls
+//   soft hyphen, zero-width space..RLM, bidi overrides, word joiner..BOM
+const INVISIBLE_CODEPOINT_RANGES = [
+    [0x0, 0x8],
+    [0xb, 0xc],
+    [0xe, 0x1f],
+    [0x7f, 0x9f],
+    [0xad, 0xad], // soft hyphen
+    [0x200b, 0x200f], // zero-width space, ZWNJ, ZWJ, LRM, RLM
+    [0x202a, 0x202e], // bidirectional embedding/override controls
+    [0x2060, 0x2064], // word joiner, invisible operators
+    [0xfeff, 0xfeff], // zero-width no-break space / BOM
+];
+function buildInvisibleCharPattern(flags) {
+    const body = INVISIBLE_CODEPOINT_RANGES.map(([start, end]) => start === end
+        ? `\\u{${start.toString(16)}}`
+        : `\\u{${start.toString(16)}}-\\u{${end.toString(16)}}`).join("");
+    return new RegExp(`[${body}]`, flags);
+}
+const INVISIBLE_CHAR_TEST = buildInvisibleCharPattern("u");
+const INVISIBLE_CHAR_STRIP = buildInvisibleCharPattern("gu");
+/**
+ * Normalize untrusted text before pattern matching. NFKC folds homoglyph and
+ * fullwidth variants onto their canonical form so that, for example, fullwidth
+ * "ｉｇｎｏｒｅ" collapses to "ignore"; invisible characters are then stripped so
+ * they cannot break up a keyword mid-word.
+ */
+export function normalizeText(text) {
+    return text.normalize("NFKC").replace(INVISIBLE_CHAR_STRIP, "");
+}
+export function hasInvisibleCharacters(text) {
+    return INVISIBLE_CHAR_TEST.test(text);
+}
+/**
+ * Scan a single untrusted string for prompt-injection-like instructions.
+ * Matching runs against the normalized form so evasion via Unicode tricks is
+ * defeated. `sourceLabel` names where the text came from (e.g. "description",
+ * "parameter data.query") for actionable evidence.
+ */
+export function scanTextForInjection(text, location, sourceLabel) {
+    const findings = [];
+    if (text.trim() === "") {
+        return findings;
+    }
+    if (hasInvisibleCharacters(text)) {
+        findings.push({
+            id: "TOOL012",
+            severity: "high",
+            title: "Text contains invisible or control characters",
+            evidence: `The ${sourceLabel} contains zero-width, bidirectional, or control characters that are invisible to a human reviewer.`,
+            recommendation: "Remove invisible and control characters; server-injected text must be exactly what a human reviewer sees.",
+            location,
+            cwe: "CWE-1007",
+            owasp: "LLM01",
+        });
+    }
+    const normalized = normalizeText(text);
+    for (const candidate of PROMPT_INJECTION_PATTERNS) {
+        if (candidate.pattern.test(normalized)) {
+            findings.push({
+                id: "TOOL003",
+                severity: "high",
+                title: "Text contains a prompt-injection-like instruction",
+                evidence: `The ${sourceLabel} matched the ${candidate.label} pattern.`,
+                recommendation: "Describe functionality only; remove behavioral or hidden instructions.",
+                location,
+                cwe: "CWE-77",
+                owasp: "LLM01",
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=injection.js.map

package/dist/src/rules/injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.js","sourceRoot":"","sources":["../../../src/rules/injection.ts"],"names":[],"mappings":"AAEA,MAAM,yBAAyB,GAA8C;IAC3E;QACE,OAAO,EAAE,4DAA4D;QACrE,KAAK,EAAE,sBAAsB;KAC9B;IACD;QACE,OAAO,EAAE,4DAA4D;QACrE,KAAK,EAAE,mBAAmB;KAC3B;IACD,EAAE,OAAO,EAAE,2CAA2C,EAAE,KAAK,EAAE,aAAa,EAAE;IAC9E,EAAE,OAAO,EAAE,6CAA6C,EAAE,KAAK,EAAE,yBAAyB,EAAE;IAC5F,EAAE,OAAO,EAAE,4DAA4D,EAAE,KAAK,EAAE,eAAe,EAAE;CAClG,CAAC;AAEF,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,qCAAqC;AACrC,oEAAoE;AACpE,yEAAyE;AACzE,MAAM,0BAA0B,GAA4B;IAC1D,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,GAAG,EAAE,IAAI,CAAC;IACX,CAAC,IAAI,EAAE,IAAI,CAAC;IACZ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,cAAc;IAC5B,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,wCAAwC;IAC1D,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,4CAA4C;IAC9D,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,mCAAmC;IACrD,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,kCAAkC;CACrD,CAAC;AAEF,SAAS,yBAAyB,CAAC,KAAa;IAC9C,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAC3D,KAAK,KAAK,GAAG;QACX,CAAC,CAAC,OAAO,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG;QAC9B,CAAC,CAAC,OAAO,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAC1D,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;AAC3D,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,QAAgB,EAChB,WAAmB;IAEnB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,+CAA+C;YACtD,QAAQ,EAAE,OAAO,WAAW,oGAAoG;YAChI,cAAc,EACZ,2GAA2G;YAC7G,QAAQ;YACR,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,KAAK,MAAM,SAAS,IAAI,yBAAyB,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,SAAS;gBACb,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,mDAAmD;gBAC1D,QAAQ,EAAE,OAAO,WAAW,gBAAgB,SAAS,CAAC,KAAK,WAAW;gBACtE,cAAc,EAAE,wEAAwE;gBACxF,QAAQ;gBACR,GAAG,EAAE,QAAQ;gBACb,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/rules/launch.d.ts

@@ -0,0 +1,2 @@
+import type { Finding, TargetConfig } from "../types.js";
+export declare function inspectLaunch(target: TargetConfig): Finding[];

package/dist/src/rules/launch.js

@@ -0,0 +1,102 @@
+import { basename } from "node:path";
+const SHELL_NAMES = new Set([
+    "bash",
+    "bash.exe",
+    "cmd",
+    "cmd.exe",
+    "pwsh",
+    "pwsh.exe",
+    "powershell",
+    "powershell.exe",
+    "sh",
+    "sh.exe",
+]);
+const NETWORK_INSTALLERS = new Set(["npx", "npx.cmd", "pipx", "uvx"]);
+const SUSPICIOUS_ARGUMENTS = [
+    { pattern: /\brm\s+-rf\b/i, label: "recursive deletion" },
+    { pattern: /\bremove-item\b.*\b-recurse\b/i, label: "recursive deletion" },
+    { pattern: /\bcurl\b|\bwget\b|invoke-webrequest/i, label: "network download" },
+    { pattern: /(?:^|[;&|])\s*(?:cmd|powershell|pwsh|bash|sh)\b/i, label: "nested shell" },
+    { pattern: /\b(?:sudo|runas)\b/i, label: "privilege escalation" },
+    { pattern: /\b(?:iex|invoke-expression)\b/i, label: "dynamic code execution" },
+    { pattern: /\bfrombase64string\b|base64\s+-d\b|base64\s+--decode\b/i, label: "encoded payload" },
+];
+// Interpreters paired with the flags that make them execute inline source
+// supplied on the command line, bypassing any reviewable script file.
+const INLINE_EVAL_RULES = [
+    {
+        executables: new Set(["node", "node.exe", "deno", "deno.exe", "bun", "bun.exe"]),
+        flags: /^(?:-e|--eval|-p|--print|eval)$/i,
+    },
+    {
+        executables: new Set(["python", "python.exe", "python3", "python3.exe"]),
+        flags: /^-c$/,
+    },
+    {
+        executables: new Set(["ruby", "ruby.exe", "perl", "perl.exe"]),
+        flags: /^-e$/,
+    },
+    {
+        executables: new Set(["pwsh", "pwsh.exe", "powershell", "powershell.exe"]),
+        flags: /^-(?:e|ec|enc|encodedcommand|command|c)$/i,
+    },
+];
+export function inspectLaunch(target) {
+    const findings = [];
+    if (target.command === undefined || target.args === undefined) {
+        return findings;
+    }
+    const executable = basename(target.command).toLowerCase();
+    const joinedArguments = target.args.join(" ");
+    if (SHELL_NAMES.has(executable)) {
+        findings.push({
+            id: "LAUNCH001",
+            severity: "high",
+            title: "Target is launched through a general-purpose shell",
+            evidence: `Configured executable is "${executable}".`,
+            recommendation: "Launch a fixed executable directly and pass arguments as an array.",
+            location: "target.command",
+            cwe: "CWE-78",
+        });
+    }
+    if (NETWORK_INSTALLERS.has(executable)) {
+        findings.push({
+            id: "LAUNCH002",
+            severity: "medium",
+            title: "Target may download executable code at startup",
+            evidence: `Configured executable is "${executable}".`,
+            recommendation: "Pin and install the package before scanning, then execute the local binary.",
+            location: "target.command",
+            cwe: "CWE-829",
+        });
+    }
+    for (const candidate of SUSPICIOUS_ARGUMENTS) {
+        if (candidate.pattern.test(joinedArguments)) {
+            findings.push({
+                id: "LAUNCH003",
+                severity: "high",
+                title: "Suspicious launcher argument",
+                evidence: `Arguments contain a pattern associated with ${candidate.label}.`,
+                recommendation: "Replace the launcher with a fixed, reviewable command.",
+                location: "target.args",
+                cwe: "CWE-78",
+            });
+        }
+    }
+    for (const rule of INLINE_EVAL_RULES) {
+        if (rule.executables.has(executable) && target.args.some((arg) => rule.flags.test(arg))) {
+            findings.push({
+                id: "LAUNCH004",
+                severity: "high",
+                title: "Target executes inline code from the command line",
+                evidence: `"${executable}" is invoked with an inline evaluation flag instead of a reviewable script file.`,
+                recommendation: "Move the code into a committed, reviewable script and launch that file directly.",
+                location: "target.args",
+                cwe: "CWE-95",
+            });
+            break;
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=launch.js.map

package/dist/src/rules/launch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch.js","sourceRoot":"","sources":["../../../src/rules/launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAIrC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM;IACN,UAAU;IACV,KAAK;IACL,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,IAAI;IACJ,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAEtE,MAAM,oBAAoB,GAA8C;IACtE,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACzD,EAAE,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,oBAAoB,EAAE;IAC1E,EAAE,OAAO,EAAE,sCAAsC,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAC9E,EAAE,OAAO,EAAE,kDAAkD,EAAE,KAAK,EAAE,cAAc,EAAE;IACtF,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,sBAAsB,EAAE;IACjE,EAAE,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,wBAAwB,EAAE;IAC9E,EAAE,OAAO,EAAE,yDAAyD,EAAE,KAAK,EAAE,iBAAiB,EAAE;CACjG,CAAC;AAEF,0EAA0E;AAC1E,sEAAsE;AACtE,MAAM,iBAAiB,GAAuD;IAC5E;QACE,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAChF,KAAK,EAAE,kCAAkC;KAC1C;IACD;QACE,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACxE,KAAK,EAAE,MAAM;KACd;IACD;QACE,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC9D,KAAK,EAAE,MAAM;KACd;IACD;QACE,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAC1E,KAAK,EAAE,2CAA2C;KACnD;CACF,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,MAAoB;IAChD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE9C,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,WAAW;YACf,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,oDAAoD;YAC3D,QAAQ,EAAE,6BAA6B,UAAU,IAAI;YACrD,cAAc,EAAE,oEAAoE;YACpF,QAAQ,EAAE,gBAAgB;YAC1B,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;IACL,CAAC;IAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,WAAW;YACf,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,gDAAgD;YACvD,QAAQ,EAAE,6BAA6B,UAAU,IAAI;YACrD,cAAc,EAAE,6EAA6E;YAC7F,QAAQ,EAAE,gBAAgB;YAC1B,GAAG,EAAE,SAAS;SACf,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;QAC7C,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,WAAW;gBACf,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,8BAA8B;gBACrC,QAAQ,EAAE,+CAA+C,SAAS,CAAC,KAAK,GAAG;gBAC3E,cAAc,EAAE,wDAAwD;gBACxE,QAAQ,EAAE,aAAa;gBACvB,GAAG,EAAE,QAAQ;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxF,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,WAAW;gBACf,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,mDAAmD;gBAC1D,QAAQ,EAAE,IAAI,UAAU,kFAAkF;gBAC1G,cAAc,EACZ,kFAAkF;gBACpF,QAAQ,EAAE,aAAa;gBACvB,GAAG,EAAE,QAAQ;aACd,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/rules/oauth.d.ts

@@ -0,0 +1,21 @@
+import type { Finding } from "../types.js";
+/**
+ * Decide whether it is safe for the scanner to fetch a URL taken from an
+ * untrusted server response.
+ * - "ok": public https (or loopback http when the operator's own target is local).
+ * - "ssrf": the host resolves to a private/loopback/link-local address the
+ *   server should not be able to steer the scanner toward.
+ * - "unsafe": unparseable, non-http(s), unresolvable, or plaintext to a
+ *   non-loopback host.
+ * `allowLoopback` is true only when the operator's target is itself local, so a
+ * local dev scan may follow local metadata.
+ */
+export declare function assessServerUrl(rawUrl: string, allowLoopback: boolean): Promise<"ok" | "ssrf" | "unsafe">;
+/**
+ * Audit the OAuth 2.1 authorization posture of a remote MCP endpoint, following
+ * the MCP authorization spec (RFC 9728 Protected Resource Metadata + RFC 8414
+ * Authorization Server Metadata). Only meaningful for a server that challenges
+ * unauthenticated requests; an open server is covered by REMOTE004. Every URL
+ * taken from a server response is SSRF-checked before it is fetched.
+ */
+export declare function inspectRemoteAuth(rawUrl: string, timeoutMs: number): Promise<Finding[]>;