mcp-security-lab 0.2.0

package/dist/src/rules/oauth.js

@@ -0,0 +1,297 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
+// The scanner follows server-controlled OAuth metadata URLs. Bound how many
+// authorization servers it will fetch so a hostile server cannot use a long
+// authorization_servers list to amplify requests (SSRF/DoS) from the scanner.
+const MAX_AUTH_SERVERS = 5;
+function isLocal(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    return LOCAL_HOSTS.has(host) || host.endsWith(".localhost");
+}
+/** True for a plaintext http:// URL whose host is not local. */
+function isPlaintextNonLocal(rawUrl) {
+    try {
+        const url = new URL(rawUrl);
+        return url.protocol === "http:" && !isLocal(url.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function ipv4Of(ip) {
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(ip);
+    return mapped && mapped[1] !== undefined ? mapped[1] : ip;
+}
+function isLoopback(ip) {
+    const v4 = ipv4Of(ip);
+    return /^127\./.test(v4) || ip.toLowerCase() === "::1";
+}
+/**
+ * True for any address the scanner must not be steered toward by an untrusted
+ * server: RFC 1918 private ranges, loopback, link-local (incl. the cloud
+ * metadata address 169.254.169.254), unique-local IPv6, and unspecified.
+ */
+function isPrivateOrReserved(ip) {
+    const v4 = ipv4Of(ip);
+    if (/^(0|10|127)\./.test(v4))
+        return true;
+    if (/^169\.254\./.test(v4))
+        return true;
+    if (/^192\.168\./.test(v4))
+        return true;
+    if (/^172\.(1[6-9]|2\d|3[01])\./.test(v4))
+        return true;
+    if (v4 === "0.0.0.0" || v4 === "255.255.255.255")
+        return true;
+    const lower = ip.toLowerCase();
+    if (lower === "::" || lower === "::1")
+        return true;
+    if (/^f[cd]/.test(lower))
+        return true; // fc00::/7 unique local
+    if (/^fe[89ab]/.test(lower))
+        return true; // fe80::/10 link local
+    return false;
+}
+async function resolveHost(host) {
+    if (isIP(host) !== 0) {
+        return [host];
+    }
+    try {
+        const records = await lookup(host, { all: true });
+        return records.map((record) => record.address);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Decide whether it is safe for the scanner to fetch a URL taken from an
+ * untrusted server response.
+ * - "ok": public https (or loopback http when the operator's own target is local).
+ * - "ssrf": the host resolves to a private/loopback/link-local address the
+ *   server should not be able to steer the scanner toward.
+ * - "unsafe": unparseable, non-http(s), unresolvable, or plaintext to a
+ *   non-loopback host.
+ * `allowLoopback` is true only when the operator's target is itself local, so a
+ * local dev scan may follow local metadata.
+ */
+export async function assessServerUrl(rawUrl, allowLoopback) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return "unsafe";
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        return "unsafe";
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    const addresses = await resolveHost(host);
+    if (addresses.length === 0) {
+        return "unsafe";
+    }
+    let allLoopback = true;
+    for (const address of addresses) {
+        if (isLoopback(address)) {
+            if (!allowLoopback) {
+                return "ssrf";
+            }
+            continue;
+        }
+        allLoopback = false;
+        if (isPrivateOrReserved(address)) {
+            return "ssrf";
+        }
+    }
+    // Plaintext is only tolerated for a loopback dev target; anything else must be https.
+    if (url.protocol === "http:" && !(allLoopback && allowLoopback)) {
+        return "unsafe";
+    }
+    return "ok";
+}
+async function safeFetch(url, timeoutMs, init) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    timer.unref();
+    try {
+        // redirect: "manual" so a server cannot 3xx-hop past the SSRF pre-check.
+        const response = await fetch(url, { ...init, signal: controller.signal, redirect: "manual" });
+        let json;
+        try {
+            const parsed = await response.json();
+            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+                json = parsed;
+            }
+        }
+        catch {
+            json = undefined;
+        }
+        return { status: response.status, headers: response.headers, json };
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function stringArray(value) {
+    return Array.isArray(value)
+        ? value.filter((entry) => typeof entry === "string")
+        : [];
+}
+/**
+ * Audit the OAuth 2.1 authorization posture of a remote MCP endpoint, following
+ * the MCP authorization spec (RFC 9728 Protected Resource Metadata + RFC 8414
+ * Authorization Server Metadata). Only meaningful for a server that challenges
+ * unauthenticated requests; an open server is covered by REMOTE004. Every URL
+ * taken from a server response is SSRF-checked before it is fetched.
+ */
+export async function inspectRemoteAuth(rawUrl, timeoutMs) {
+    const findings = [];
+    let base;
+    try {
+        base = new URL(rawUrl);
+    }
+    catch {
+        return findings;
+    }
+    const targetIsLocal = isLocal(base.hostname);
+    const probe = await safeFetch(rawUrl, timeoutMs, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            accept: "application/json, text/event-stream",
+        },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: {} }),
+    });
+    // No response, or the server did not challenge: openness is REMOTE004's job.
+    if (probe === undefined || (probe.status !== 401 && probe.status !== 403)) {
+        return findings;
+    }
+    // RFC 9728: a protected resource must point to its metadata via WWW-Authenticate.
+    const wwwAuthenticate = probe.headers.get("www-authenticate") ?? "";
+    const pointer = /resource_metadata="?([^",\s]+)"?/i.exec(wwwAuthenticate);
+    let prmUrl;
+    if (pointer && pointer[1] !== undefined) {
+        prmUrl = pointer[1];
+    }
+    else {
+        findings.push({
+            id: "AUTH001",
+            severity: "medium",
+            title: "Protected server does not advertise its resource metadata",
+            evidence: `The server returned ${probe.status} without a WWW-Authenticate "resource_metadata" pointer (RFC 9728).`,
+            recommendation: 'Return WWW-Authenticate: Bearer resource_metadata="<url>" so clients can discover how to authenticate.',
+            location: "server",
+            cwe: "CWE-306",
+            owasp: "LLM08",
+        });
+        prmUrl = new URL("/.well-known/oauth-protected-resource", base).toString();
+    }
+    const prmSafety = await assessServerUrl(prmUrl, targetIsLocal);
+    if (prmSafety === "ssrf") {
+        findings.push(ssrfFinding("resource metadata", prmUrl));
+        return findings;
+    }
+    const prm = prmSafety === "ok" ? await safeFetch(prmUrl, timeoutMs) : undefined;
+    if (prm === undefined || prm.status >= 400 || prm.json === undefined) {
+        findings.push({
+            id: "AUTH002",
+            severity: "medium",
+            title: "OAuth Protected Resource Metadata is unreachable or malformed",
+            evidence: `Could not retrieve valid Protected Resource Metadata from ${prmUrl}.`,
+            recommendation: "Serve a valid RFC 9728 metadata document listing the authorization server(s).",
+            location: "server",
+            cwe: "CWE-306",
+            owasp: "LLM08",
+        });
+        return findings;
+    }
+    const authorizationServers = stringArray(prm.json.authorization_servers);
+    if (authorizationServers.length === 0) {
+        findings.push({
+            id: "AUTH002",
+            severity: "medium",
+            title: "Protected Resource Metadata lists no authorization server",
+            evidence: "The resource metadata does not contain a non-empty authorization_servers array.",
+            recommendation: "List at least one authorization server in the resource metadata.",
+            location: "server",
+            cwe: "CWE-306",
+            owasp: "LLM08",
+        });
+        return findings;
+    }
+    for (const authServer of authorizationServers.slice(0, MAX_AUTH_SERVERS)) {
+        if (isPlaintextNonLocal(authServer)) {
+            findings.push(plaintextEndpointFinding("authorization server", authServer));
+        }
+        const asMetaUrl = new URL("/.well-known/oauth-authorization-server", authServer).toString();
+        const asSafety = await assessServerUrl(asMetaUrl, targetIsLocal);
+        if (asSafety === "ssrf") {
+            findings.push(ssrfFinding("authorization server metadata", asMetaUrl));
+            continue;
+        }
+        const asMeta = asSafety === "ok" ? await safeFetch(asMetaUrl, timeoutMs) : undefined;
+        if (asMeta === undefined || asMeta.status >= 400 || asMeta.json === undefined) {
+            findings.push({
+                id: "AUTH002",
+                severity: "medium",
+                title: "Authorization Server Metadata is unreachable or malformed",
+                evidence: `Could not retrieve valid Authorization Server Metadata from ${asMetaUrl}.`,
+                recommendation: "Serve a valid RFC 8414 authorization server metadata document.",
+                location: "server",
+                cwe: "CWE-306",
+                owasp: "LLM08",
+            });
+            continue;
+        }
+        const pkceMethods = stringArray(asMeta.json.code_challenge_methods_supported);
+        if (!pkceMethods.includes("S256")) {
+            findings.push({
+                id: "AUTH003",
+                severity: "high",
+                title: "Authorization server does not advertise PKCE (S256)",
+                evidence: 'code_challenge_methods_supported does not include "S256".',
+                recommendation: "Require PKCE with S256; it is mandatory under OAuth 2.1 and the MCP authorization spec.",
+                location: "server",
+                cwe: "CWE-1188",
+                owasp: "LLM08",
+            });
+        }
+        for (const key of ["authorization_endpoint", "token_endpoint", "registration_endpoint"]) {
+            const endpoint = asMeta.json[key];
+            if (typeof endpoint === "string" && isPlaintextNonLocal(endpoint)) {
+                findings.push(plaintextEndpointFinding(key, endpoint));
+            }
+        }
+    }
+    return findings;
+}
+function ssrfFinding(label, url) {
+    return {
+        id: "AUTH005",
+        severity: "high",
+        title: "Server directed the scanner to a non-public address (possible SSRF)",
+        evidence: `The ${label} URL resolves to a loopback, link-local, or private address and was not fetched: ${url}`,
+        recommendation: "A remote server's OAuth metadata must reference publicly resolvable https endpoints, not internal addresses.",
+        location: "server",
+        cwe: "CWE-918",
+        owasp: "LLM08",
+    };
+}
+function plaintextEndpointFinding(label, endpoint) {
+    return {
+        id: "AUTH004",
+        severity: "high",
+        title: "OAuth endpoint uses plaintext HTTP",
+        evidence: `The ${label} is served over plaintext HTTP: ${endpoint}`,
+        recommendation: "Serve all OAuth endpoints over https://.",
+        location: "server",
+        cwe: "CWE-319",
+        owasp: "LLM08",
+    };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/src/rules/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/rules/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAIhC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAE1E,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,SAAS,OAAO,CAAC,QAAgB;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC9D,CAAC;AAED,gEAAgE;AAChE,SAAS,mBAAmB,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,EAAU;IACxB,MAAM,MAAM,GAAG,gCAAgC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACtB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,EAAU;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACtB,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IAC/D,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IACjE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,aAAsB;IAEtB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,SAAS;QACX,CAAC;QACD,WAAW,GAAG,KAAK,CAAC;QACpB,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,IAAI,aAAa,CAAC,EAAE,CAAC;QAChE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,KAAK,UAAU,SAAS,CACtB,GAAW,EACX,SAAiB,EACjB,IAAkB;IAElB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,IAAI,CAAC;QACH,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9F,IAAI,IAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5E,IAAI,GAAG,MAAiC,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,SAAiB;IACvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE;QAC/C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,qCAAqC;SAC9C;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;KAClF,CAAC,CAAC;IAEH,6EAA6E;IAC7E,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kFAAkF;IAClF,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,mCAAmC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1E,IAAI,MAAc,CAAC;IACnB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,2DAA2D;YAClE,QAAQ,EAAE,uBAAuB,KAAK,CAAC,MAAM,qEAAqE;YAClH,cAAc,EACZ,wGAAwG;YAC1G,QAAQ,EAAE,QAAQ;YAClB,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,uCAAuC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/D,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,+DAA+D;YACtE,QAAQ,EAAE,6DAA6D,MAAM,GAAG;YAChF,cAAc,EACZ,+EAA+E;YACjF,QAAQ,EAAE,QAAQ;YAClB,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,oBAAoB,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACzE,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,2DAA2D;YAClE,QAAQ,EAAE,iFAAiF;YAC3F,cAAc,EAAE,kEAAkE;YAClF,QAAQ,EAAE,QAAQ;YAClB,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACzE,IAAI,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5F,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9E,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,SAAS;gBACb,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,2DAA2D;gBAClE,QAAQ,EAAE,+DAA+D,SAAS,GAAG;gBACrF,cAAc,EAAE,gEAAgE;gBAChF,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,SAAS;gBACd,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,SAAS;gBACb,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,qDAAqD;gBAC5D,QAAQ,EAAE,2DAA2D;gBACrE,cAAc,EACZ,yFAAyF;gBAC3F,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,UAAU;gBACf,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,CAAC,wBAAwB,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,EAAE,CAAC;YACxF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,GAAW;IAC7C,OAAO;QACL,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,qEAAqE;QAC5E,QAAQ,EAAE,OAAO,KAAK,oFAAoF,GAAG,EAAE;QAC/G,cAAc,EACZ,8GAA8G;QAChH,QAAQ,EAAE,QAAQ;QAClB,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,OAAO;KACf,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa,EAAE,QAAgB;IAC/D,OAAO;QACL,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oCAAoC;QAC3C,QAAQ,EAAE,OAAO,KAAK,mCAAmC,QAAQ,EAAE;QACnE,cAAc,EAAE,0CAA0C;QAC1D,QAAQ,EAAE,QAAQ;QAClB,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,OAAO;KACf,CAAC;AACJ,CAAC"}

package/dist/src/rules/remote.d.ts

@@ -0,0 +1,12 @@
+import type { Finding, TargetConfig } from "../types.js";
+/**
+ * Static checks on a remote target URL, evaluated without connecting — the
+ * remote counterpart of the launch-configuration rules for stdio targets.
+ */
+export declare function inspectRemote(target: TargetConfig): Finding[];
+/**
+ * Finding for a remote server that accepted our connection without any
+ * authentication. Evaluated only after a successful `--execute` connect, since
+ * the scanner never supplies credentials.
+ */
+export declare function unauthenticatedAccessFinding(): Finding;

package/dist/src/rules/remote.js

@@ -0,0 +1,81 @@
+import { isCredentialQueryKey } from "../environment.js";
+const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
+function isLocal(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    return LOCAL_HOSTS.has(host) || host.endsWith(".localhost");
+}
+/**
+ * Static checks on a remote target URL, evaluated without connecting — the
+ * remote counterpart of the launch-configuration rules for stdio targets.
+ */
+export function inspectRemote(target) {
+    if (target.url === undefined) {
+        return [];
+    }
+    const findings = [];
+    let url;
+    try {
+        url = new URL(target.url);
+    }
+    catch {
+        findings.push({
+            id: "REMOTE001",
+            severity: "medium",
+            title: "Remote target URL is malformed",
+            evidence: "target.url could not be parsed as a URL.",
+            recommendation: "Provide a valid absolute URL for the MCP endpoint.",
+            location: "target.url",
+            cwe: "CWE-20",
+        });
+        return findings;
+    }
+    if (url.protocol === "http:" && !isLocal(url.hostname)) {
+        findings.push({
+            id: "REMOTE002",
+            severity: "high",
+            title: "Remote endpoint uses plaintext HTTP",
+            evidence: `The endpoint "${url.host}" is served over http://, so traffic and any tokens travel unencrypted.`,
+            recommendation: "Use https:// for any non-local MCP endpoint.",
+            location: "target.url",
+            cwe: "CWE-319",
+            owasp: "LLM08",
+        });
+    }
+    const hasUserInfo = url.username !== "" || url.password !== "";
+    const fragmentParams = new URLSearchParams(url.hash.replace(/^#/, ""));
+    const hasSensitiveQuery = [...url.searchParams.keys()].some(isCredentialQueryKey) ||
+        [...fragmentParams.keys()].some(isCredentialQueryKey);
+    if (hasUserInfo || hasSensitiveQuery) {
+        findings.push({
+            id: "REMOTE003",
+            severity: "high",
+            title: "Credentials are embedded in the target URL",
+            evidence: hasUserInfo
+                ? "The URL contains userinfo (user:password@), which leaks into logs and history."
+                : "The URL carries a credential in a query parameter, which leaks into logs and history.",
+            recommendation: "Pass credentials through an authentication header or OAuth flow, never in the URL.",
+            location: "target.url",
+            cwe: "CWE-522",
+            owasp: "LLM08",
+        });
+    }
+    return findings;
+}
+/**
+ * Finding for a remote server that accepted our connection without any
+ * authentication. Evaluated only after a successful `--execute` connect, since
+ * the scanner never supplies credentials.
+ */
+export function unauthenticatedAccessFinding() {
+    return {
+        id: "REMOTE004",
+        severity: "medium",
+        title: "Remote MCP server accepts unauthenticated connections",
+        evidence: "The server completed the MCP handshake and listed tools without any credentials.",
+        recommendation: "Require authentication (e.g. OAuth) for remote MCP servers unless anonymous access is intended.",
+        location: "server",
+        cwe: "CWE-306",
+        owasp: "LLM08",
+    };
+}
+//# sourceMappingURL=remote.js.map

package/dist/src/rules/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../src/rules/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAGzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAE1E,SAAS,OAAO,CAAC,QAAgB;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAoB;IAChD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,WAAW;YACf,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,gCAAgC;YACvC,QAAQ,EAAE,0CAA0C;YACpD,cAAc,EAAE,oDAAoD;YACpE,QAAQ,EAAE,YAAY;YACtB,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,WAAW;YACf,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,qCAAqC;YAC5C,QAAQ,EAAE,iBAAiB,GAAG,CAAC,IAAI,yEAAyE;YAC5G,cAAc,EAAE,8CAA8C;YAC9D,QAAQ,EAAE,YAAY;YACtB,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;IAC/D,MAAM,cAAc,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,iBAAiB,GACrB,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;QACvD,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxD,IAAI,WAAW,IAAI,iBAAiB,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,WAAW;YACf,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,4CAA4C;YACnD,QAAQ,EAAE,WAAW;gBACnB,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,uFAAuF;YAC3F,cAAc,EACZ,oFAAoF;YACtF,QAAQ,EAAE,YAAY;YACtB,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,uDAAuD;QAC9D,QAAQ,EAAE,kFAAkF;QAC5F,cAAc,EACZ,iGAAiG;QACnG,QAAQ,EAAE,QAAQ;QAClB,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,OAAO;KACf,CAAC;AACJ,CAAC"}

package/dist/src/rules/tools.d.ts

@@ -0,0 +1,9 @@
+import type { Finding, ToolMetadata } from "../types.js";
+export declare function inspectServerCapabilities(tools: ToolMetadata[]): Finding[];
+/**
+ * Inspect the server-level instructions returned during the MCP handshake.
+ * These are injected verbatim into the model's context, so injection here is
+ * as dangerous as in any tool description.
+ */
+export declare function inspectServerInstructions(instructions: string | undefined): Finding[];
+export declare function inspectTool(tool: ToolMetadata): Finding[];

package/dist/src/rules/tools.js

@@ -0,0 +1,216 @@
+import { scanTextForInjection } from "./injection.js";
+const DESTRUCTIVE_NAME_PATTERN = /(?:^|[_-])(delete|drop|destroy|remove|reset|purge|revoke|send|publish|deploy)(?:$|[_-])/i;
+const READ_NAME_PATTERN = /(?:^|[_-])(get|list|read|search|find|fetch|inspect|describe)(?:$|[_-])/i;
+function propertiesOf(schema) {
+    const properties = schema.properties;
+    if (typeof properties !== "object" || properties === null || Array.isArray(properties)) {
+        return {};
+    }
+    return properties;
+}
+function annotationBoolean(tool, key) {
+    const value = tool.annotations?.[key];
+    return typeof value === "boolean" ? value : undefined;
+}
+/**
+ * Collect every untrusted string a server places into the model's context for a
+ * tool: the description, the annotation title, and each parameter's name,
+ * description, and string-literal enum values. Injection can hide in any of
+ * these, not only in the top-level description.
+ */
+function injectionSurface(tool) {
+    const surface = [];
+    if (typeof tool.description === "string") {
+        surface.push({ text: tool.description, sourceLabel: "description" });
+    }
+    const title = tool.annotations?.title;
+    if (typeof title === "string") {
+        surface.push({ text: title, sourceLabel: "annotation title" });
+    }
+    for (const [name, schema] of Object.entries(propertiesOf(tool.inputSchema))) {
+        surface.push({ text: name, sourceLabel: `parameter name "${name}"` });
+        if (typeof schema === "object" && schema !== null && !Array.isArray(schema)) {
+            const record = schema;
+            if (typeof record.description === "string") {
+                surface.push({ text: record.description, sourceLabel: `parameter "${name}" description` });
+            }
+            if (Array.isArray(record.enum)) {
+                for (const value of record.enum) {
+                    if (typeof value === "string") {
+                        surface.push({ text: value, sourceLabel: `parameter "${name}" enum value` });
+                    }
+                }
+            }
+        }
+    }
+    return surface;
+}
+export function inspectServerCapabilities(tools) {
+    const findings = [];
+    let hasRead = false;
+    let hasWrite = false;
+    for (const tool of tools) {
+        if (READ_NAME_PATTERN.test(tool.name)) {
+            hasRead = true;
+        }
+        if (DESTRUCTIVE_NAME_PATTERN.test(tool.name) ||
+            tool.name.match(/^(?:write|update|set|put|post|create|insert)/i)) {
+            hasWrite = true;
+        }
+    }
+    if (hasRead && hasWrite) {
+        findings.push({
+            id: "TOOL011",
+            severity: "high",
+            title: "Dangerous Capability Combination (Least Privilege Violation)",
+            evidence: "The server exposes both broad READ tools and destructive WRITE tools.",
+            recommendation: "Separate read and write capabilities into different MCP servers or require explicit user confirmation for write operations.",
+            location: "server",
+            cwe: "CWE-250",
+            owasp: "LLM08",
+        });
+    }
+    return findings;
+}
+/**
+ * Inspect the server-level instructions returned during the MCP handshake.
+ * These are injected verbatim into the model's context, so injection here is
+ * as dangerous as in any tool description.
+ */
+export function inspectServerInstructions(instructions) {
+    if (typeof instructions !== "string") {
+        return [];
+    }
+    return scanTextForInjection(instructions, "server", "server instructions").map((finding) => ({
+        ...finding,
+        title: finding.id === "TOOL003"
+            ? "Server instructions contain a prompt-injection-like instruction"
+            : finding.title,
+    }));
+}
+export function inspectTool(tool) {
+    const findings = [];
+    const location = `tool:${tool.name}`;
+    const annotations = tool.annotations ?? {};
+    const description = tool.description ?? "";
+    if (tool.name.length > 64) {
+        findings.push({
+            id: "TOOL001",
+            severity: "high",
+            title: "Tool name exceeds the compatibility limit",
+            evidence: `Tool name has ${tool.name.length} characters.`,
+            recommendation: "Use a stable tool name with at most 64 characters.",
+            location,
+            cwe: "CWE-20",
+        });
+    }
+    if (description.trim() === "") {
+        findings.push({
+            id: "TOOL002",
+            severity: "medium",
+            title: "Tool description is missing",
+            evidence: "The server returned no description for this tool.",
+            recommendation: "Describe the tool's precise behavior and when it is appropriate.",
+            location,
+        });
+    }
+    for (const { text, sourceLabel } of injectionSurface(tool)) {
+        findings.push(...scanTextForInjection(text, location, sourceLabel));
+    }
+    if (typeof annotations.title !== "string" || annotations.title.trim() === "") {
+        findings.push({
+            id: "TOOL004",
+            severity: "medium",
+            title: "Tool annotation title is missing",
+            evidence: "annotations.title is absent or empty.",
+            recommendation: "Add a short human-readable title annotation.",
+            location,
+        });
+    }
+    const destructiveHint = annotationBoolean(tool, "destructiveHint");
+    const readOnlyHint = annotationBoolean(tool, "readOnlyHint");
+    if (destructiveHint === undefined && readOnlyHint === undefined) {
+        findings.push({
+            id: "TOOL005",
+            severity: "high",
+            title: "Tool safety hints are missing",
+            evidence: "Neither destructiveHint nor readOnlyHint is explicitly declared.",
+            recommendation: "Declare the applicable MCP safety annotations explicitly.",
+            location,
+            cwe: "CWE-1188",
+        });
+    }
+    if (DESTRUCTIVE_NAME_PATTERN.test(tool.name) && destructiveHint !== true) {
+        findings.push({
+            id: "TOOL006",
+            severity: "high",
+            title: "Potentially destructive tool is not marked destructive",
+            evidence: `Tool name "${tool.name}" implies an external side effect.`,
+            recommendation: "Set destructiveHint to true and keep the operation narrowly scoped.",
+            location,
+            cwe: "CWE-250",
+            owasp: "LLM08",
+        });
+    }
+    if (READ_NAME_PATTERN.test(tool.name) && readOnlyHint === false) {
+        findings.push({
+            id: "TOOL007",
+            severity: "medium",
+            title: "Read-like tool is explicitly marked as writable",
+            evidence: `Tool name "${tool.name}" appears read-only but readOnlyHint is false.`,
+            recommendation: "Split reading and mutation into separate tools with accurate hints.",
+            location,
+        });
+    }
+    const properties = propertiesOf(tool.inputSchema);
+    const methodSchema = properties.method;
+    if (typeof methodSchema === "object" && methodSchema !== null && !Array.isArray(methodSchema)) {
+        const methodEnum = methodSchema.enum;
+        if (Array.isArray(methodEnum)) {
+            const methods = new Set(methodEnum
+                .filter((value) => typeof value === "string")
+                .map((value) => value.toUpperCase()));
+            const hasSafe = ["GET", "HEAD", "OPTIONS"].some((method) => methods.has(method));
+            const hasUnsafe = ["POST", "PUT", "PATCH", "DELETE"].some((method) => methods.has(method));
+            if (hasSafe && hasUnsafe) {
+                findings.push({
+                    id: "TOOL008",
+                    severity: "high",
+                    title: "Tool mixes read and write HTTP operations",
+                    evidence: `method enum contains both safe and unsafe HTTP methods: ${[...methods].join(", ")}.`,
+                    recommendation: "Split read operations from create, update, and delete tools.",
+                    location,
+                    cwe: "CWE-250",
+                    owasp: "LLM08",
+                });
+            }
+        }
+    }
+    if (tool.inputSchema.additionalProperties !== false) {
+        findings.push({
+            id: "TOOL009",
+            severity: "low",
+            title: "Input schema accepts undeclared properties",
+            evidence: "inputSchema.additionalProperties is not explicitly false.",
+            recommendation: "Reject unknown input fields when the server framework supports it.",
+            location,
+            cwe: "CWE-20",
+        });
+    }
+    const paginationKeys = new Set(["limit", "offset", "cursor", "max_results", "page"]);
+    const hasPagination = Object.keys(properties).some((key) => paginationKeys.has(key.toLowerCase()));
+    if (!hasPagination && READ_NAME_PATTERN.test(tool.name)) {
+        findings.push({
+            id: "TOOL010",
+            severity: "medium",
+            title: "Context Exhaustion Risk: Missing pagination limits",
+            evidence: "Tool name implies reading, but inputSchema lacks limit, cursor, or offset fields.",
+            recommendation: "Implement pagination limits to prevent context window exhaustion attacks.",
+            location,
+            cwe: "CWE-400",
+            owasp: "LLM10",
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=tools.js.map

package/dist/src/rules/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/rules/tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,MAAM,wBAAwB,GAC5B,0FAA0F,CAAC;AAC7F,MAAM,iBAAiB,GAAG,yEAAyE,CAAC;AAEpG,SAAS,YAAY,CAAC,MAA+B;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,UAAqC,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAkB,EAAE,GAAW;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAkB;IAC1C,MAAM,OAAO,GAAiD,EAAE,CAAC;IAEjE,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,IAAI,GAAG,EAAE,CAAC,CAAC;QACtE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,MAAM,GAAG,MAAiC,CAAC;YACjD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,IAAI,eAAe,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,IAAI,cAAc,EAAE,CAAC,CAAC;oBAC/E,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAqB;IAC7D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IACE,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,+CAA+C,CAAC,EAChE,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,8DAA8D;YACrE,QAAQ,EAAE,uEAAuE;YACjF,cAAc,EACZ,6HAA6H;YAC/H,QAAQ,EAAE,QAAQ;YAClB,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAAgC;IACxE,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,oBAAoB,CAAC,YAAY,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3F,GAAG,OAAO;QACV,KAAK,EACH,OAAO,CAAC,EAAE,KAAK,SAAS;YACtB,CAAC,CAAC,iEAAiE;YACnE,CAAC,CAAC,OAAO,CAAC,KAAK;KACpB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IAE3C,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,2CAA2C;YAClD,QAAQ,EAAE,iBAAiB,IAAI,CAAC,IAAI,CAAC,MAAM,cAAc;YACzD,cAAc,EAAE,oDAAoD;YACpE,QAAQ;YACR,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,6BAA6B;YACpC,QAAQ,EAAE,mDAAmD;YAC7D,cAAc,EAAE,kEAAkE;YAClF,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,kCAAkC;YACzC,QAAQ,EAAE,uCAAuC;YACjD,cAAc,EAAE,8CAA8C;YAC9D,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC7D,IAAI,eAAe,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,+BAA+B;YACtC,QAAQ,EAAE,kEAAkE;YAC5E,cAAc,EAAE,2DAA2D;YAC3E,QAAQ;YACR,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,wDAAwD;YAC/D,QAAQ,EAAE,cAAc,IAAI,CAAC,IAAI,oCAAoC;YACrE,cAAc,EAAE,qEAAqE;YACrF,QAAQ;YACR,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;IAED,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,iDAAiD;YACxD,QAAQ,EAAE,cAAc,IAAI,CAAC,IAAI,gDAAgD;YACjF,cAAc,EAAE,qEAAqE;YACrF,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC;IACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9F,MAAM,UAAU,GAAI,YAAwC,CAAC,IAAI,CAAC;QAClE,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,UAAU;iBACP,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;iBAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CACvC,CAAC;YACF,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACjF,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3F,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,SAAS;oBACb,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,2CAA2C;oBAClD,QAAQ,EAAE,2DAA2D,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC/F,cAAc,EAAE,8DAA8D;oBAC9E,QAAQ;oBACR,GAAG,EAAE,SAAS;oBACd,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,CAAC,oBAAoB,KAAK,KAAK,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,4CAA4C;YACnD,QAAQ,EAAE,2DAA2D;YACrE,cAAc,EAAE,oEAAoE;YACpF,QAAQ;YACR,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACzD,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CACtC,CAAC;IAEF,IAAI,CAAC,aAAa,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,oDAAoD;YAC3D,QAAQ,EAAE,mFAAmF;YAC7F,cAAc,EAAE,2EAA2E;YAC3F,QAAQ;YACR,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/scanner.d.ts

@@ -0,0 +1,2 @@
+import type { ScanConfig, ScanReport } from "./types.js";
+export declare function scan(config: ScanConfig, execute: boolean, sandbox?: "docker" | "none", fuzz?: boolean): Promise<ScanReport>;