mcp-security-scanner 1.0.0

package/dist/config/env-scanner.js

@@ -0,0 +1,85 @@
+import { discoverFiles, safeReadFile, getFileStat } from "../utils/fs-helpers.js";
+import { SECRET_PATTERNS } from "../data/secret-patterns.js";
+const ENV_FILE_PATTERN = /^\.env(\..+)?$/;
+export async function scanEnvFiles(dirPath) {
+    const findings = [];
+    let counter = 0;
+    const envFiles = await discoverFiles(dirPath, ENV_FILE_PATTERN);
+    for (const filePath of envFiles) {
+        const content = await safeReadFile(filePath);
+        if (!content)
+            continue;
+        const lines = content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i].trim();
+            if (!line || line.startsWith("#"))
+                continue;
+            const eqIndex = line.indexOf("=");
+            if (eqIndex === -1)
+                continue;
+            const key = line.substring(0, eqIndex).trim();
+            const value = line.substring(eqIndex + 1).trim().replace(/^['"]|['"]$/g, "");
+            if (!value || value.length < 4)
+                continue;
+            // Check against secret patterns
+            for (const pattern of SECRET_PATTERNS) {
+                if (pattern.pattern.test(value) || pattern.pattern.test(line)) {
+                    counter++;
+                    findings.push({
+                        id: `CFG-ENV-${String(counter).padStart(3, "0")}`,
+                        title: `${pattern.name} in Environment File`,
+                        severity: pattern.severity,
+                        owasp_mcp: "MCP01",
+                        owasp_mcp_title: "Excessive Privilege & Token Mismanagement",
+                        category: "config",
+                        file: filePath,
+                        line: i + 1,
+                        evidence: `${key}=${value.substring(0, 4)}${"*".repeat(Math.min(value.length - 4, 20))}`,
+                        remediation: "Ensure .env files are in .gitignore. Use secret management tools for production. Restrict file permissions to owner-only (chmod 600).",
+                        cwe: "CWE-522",
+                    });
+                    break;
+                }
+            }
+            // Check for default/weak credentials
+            if (/^(admin|password|pass|root|test|default|changeme|12345|password123|letmein|welcome)$/i.test(value)) {
+                counter++;
+                findings.push({
+                    id: `CFG-ENV-${String(counter).padStart(3, "0")}`,
+                    title: "Default/Weak Credential in Environment File",
+                    severity: "high",
+                    owasp_mcp: "MCP01",
+                    owasp_mcp_title: "Excessive Privilege & Token Mismanagement",
+                    category: "config",
+                    file: filePath,
+                    line: i + 1,
+                    evidence: `${key}=<default credential>`,
+                    remediation: "Replace default credentials with strong, unique values. Never use common passwords.",
+                    cwe: "CWE-798",
+                });
+            }
+        }
+        // Check file permissions (Unix/macOS)
+        const stat = await getFileStat(filePath);
+        if (stat) {
+            const mode = stat.mode & 0o777;
+            if (mode & 0o044) { // World or group readable
+                counter++;
+                findings.push({
+                    id: `CFG-ENV-${String(counter).padStart(3, "0")}`,
+                    title: "Environment File Has Overly Permissive Permissions",
+                    severity: "medium",
+                    owasp_mcp: "MCP01",
+                    owasp_mcp_title: "Excessive Privilege & Token Mismanagement",
+                    category: "config",
+                    file: filePath,
+                    evidence: `File permissions: ${mode.toString(8)} — readable by group/others`,
+                    remediation: "Set file permissions to 600 (owner read/write only): chmod 600 " + filePath,
+                    cwe: "CWE-732",
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=env-scanner.js.map

package/dist/config/env-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-scanner.js","sourceRoot":"","sources":["../../src/config/env-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAEhE,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAE5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,CAAC,CAAC;gBAAE,SAAS;YAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAE7E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAEzC,gCAAgC;YAChC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9D,OAAO,EAAE,CAAC;oBACV,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;wBACjD,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,sBAAsB;wBAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,SAAS,EAAE,OAAO;wBAClB,eAAe,EAAE,2CAA2C;wBAC5D,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,QAAQ,EAAE,GAAG,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE;wBACxF,WAAW,EAAE,uIAAuI;wBACpJ,GAAG,EAAE,SAAS;qBACf,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;YAED,qCAAqC;YACrC,IAAI,uFAAuF,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxG,OAAO,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBACjD,KAAK,EAAE,6CAA6C;oBACpD,QAAQ,EAAE,MAAM;oBAChB,SAAS,EAAE,OAAO;oBAClB,eAAe,EAAE,2CAA2C;oBAC5D,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,QAAQ,EAAE,GAAG,GAAG,uBAAuB;oBACvC,WAAW,EAAE,qFAAqF;oBAClG,GAAG,EAAE,SAAS;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAC/B,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,0BAA0B;gBAC5C,OAAO,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBACjD,KAAK,EAAE,oDAAoD;oBAC3D,QAAQ,EAAE,QAAQ;oBAClB,SAAS,EAAE,OAAO;oBAClB,eAAe,EAAE,2CAA2C;oBAC5D,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,qBAAqB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,6BAA6B;oBAC5E,WAAW,EAAE,iEAAiE,GAAG,QAAQ;oBACzF,GAAG,EAAE,SAAS;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/config/index.d.ts

@@ -0,0 +1,3 @@
+import type { ToolDef } from "../types/index.js";
+export declare const configTools: ToolDef[];
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAkLjD,eAAO,MAAM,WAAW,EAAE,OAAO,EAQhC,CAAC"}

package/dist/config/index.js

@@ -0,0 +1,169 @@
+import { z } from "zod";
+import { text } from "../types/index.js";
+import { discoverConfigs, parseConfigFile } from "./mcp-config-parser.js";
+import { scanEnvFiles } from "./env-scanner.js";
+import { auditServerEntry, checkContextOversharing } from "./server-verification.js";
+import { fileExists, getFileStat } from "../utils/fs-helpers.js";
+function formatFindings(findings) {
+    if (findings.length === 0)
+        return "No findings.";
+    const bySeverity = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const f of findings)
+        bySeverity[f.severity]++;
+    let output = `${findings.length} finding(s): ${bySeverity.critical} critical, ${bySeverity.high} high, ${bySeverity.medium} medium, ${bySeverity.low} low, ${bySeverity.info} info\n\n`;
+    for (const f of findings) {
+        output += `[${f.severity.toUpperCase()}] ${f.id}: ${f.title}\n`;
+        if (f.file)
+            output += `  File: ${f.file}${f.line ? `:${f.line}` : ""}\n`;
+        output += `  OWASP: ${f.owasp_mcp} — ${f.owasp_mcp_title}\n`;
+        output += `  Evidence: ${f.evidence}\n`;
+        output += `  Remediation: ${f.remediation}\n\n`;
+    }
+    return output.trim();
+}
+const cfgAutoDiscover = {
+    name: "cfg_auto_discover",
+    description: "Auto-discover all MCP configuration files on the system. Checks Claude Desktop, Claude Code, Cursor, VS Code, Windsurf locations. Returns found config files with server counts.",
+    schema: {
+        scan_home: z.boolean().optional().describe("Scan home directory for configs (default: true)"),
+    },
+    async execute(args) {
+        const configs = await discoverConfigs();
+        if (configs.length === 0)
+            return text("No MCP configuration files found.");
+        let output = `Found ${configs.length} MCP configuration file(s):\n\n`;
+        for (const cfg of configs) {
+            output += `${cfg.client}: ${cfg.path}\n`;
+            output += `  Servers: ${cfg.servers.length}\n`;
+            for (const s of cfg.servers) {
+                output += `    - ${s.name}: ${s.command ?? s.url ?? "unknown"}\n`;
+            }
+            output += "\n";
+        }
+        return text(output.trim());
+    },
+};
+const cfgAuditMcpConfig = {
+    name: "cfg_audit_mcp_config",
+    description: "Deep audit of a single MCP config file. Checks for: API keys in args, secrets in env, npx -y auto-install, unknown binaries, HTTP without TLS, missing auth headers, wildcard env passthrough.",
+    schema: {
+        path: z.string().describe("Path to MCP configuration file"),
+    },
+    async execute(args) {
+        const config = await parseConfigFile(args.path);
+        if (!config)
+            return text(`Could not parse config file: ${args.path}`);
+        const allFindings = [];
+        for (const server of config.servers) {
+            allFindings.push(...auditServerEntry(server, args.path));
+        }
+        let output = `Config: ${args.path}\nServers: ${config.servers.length}\n\n`;
+        output += formatFindings(allFindings);
+        return text(output);
+    },
+};
+const cfgScanEnvFiles = {
+    name: "cfg_scan_env_files",
+    description: "Recursively scan directory for .env files. Detect: high-value API keys, database credentials, private keys, default/weak credentials, overly permissive file permissions.",
+    schema: {
+        path: z.string().describe("Directory to scan for .env files"),
+    },
+    async execute(args) {
+        const findings = await scanEnvFiles(args.path);
+        return text(formatFindings(findings));
+    },
+};
+const cfgCheckShadowServers = {
+    name: "cfg_check_shadow_servers",
+    description: "Analyze each server in MCP config for shadow server indicators: unverified npm packages via npx -y, binaries in writable directories (/tmp), suspicious command paths.",
+    schema: {
+        path: z.string().describe("Path to MCP configuration file"),
+    },
+    async execute(args) {
+        const config = await parseConfigFile(args.path);
+        if (!config)
+            return text(`Could not parse config file: ${args.path}`);
+        const findings = [];
+        for (const server of config.servers) {
+            const serverFindings = auditServerEntry(server, args.path);
+            findings.push(...serverFindings.filter(f => f.owasp_mcp === "MCP09"));
+        }
+        return text(formatFindings(findings));
+    },
+};
+const cfgCheckContextOversharing = {
+    name: "cfg_check_context_oversharing",
+    description: "Check for excessive context exposure: servers inheriting all env vars, sensitive vars shared across unrelated servers, broad resource access patterns.",
+    schema: {
+        path: z.string().describe("Path to MCP configuration file"),
+    },
+    async execute(args) {
+        const config = await parseConfigFile(args.path);
+        if (!config)
+            return text(`Could not parse config file: ${args.path}`);
+        const findings = checkContextOversharing(config.servers, args.path);
+        return text(formatFindings(findings));
+    },
+};
+const cfgCheckTransportSecurity = {
+    name: "cfg_check_transport_security",
+    description: "Verify transport security: HTTP vs HTTPS, SSE without TLS, WebSocket without WSS, servers bound to 0.0.0.0, tunnel URLs (ngrok, localtunnel), missing Authorization headers.",
+    schema: {
+        path: z.string().describe("Path to MCP configuration file"),
+    },
+    async execute(args) {
+        const config = await parseConfigFile(args.path);
+        if (!config)
+            return text(`Could not parse config file: ${args.path}`);
+        const findings = [];
+        for (const server of config.servers) {
+            const serverFindings = auditServerEntry(server, args.path);
+            findings.push(...serverFindings.filter(f => f.owasp_mcp === "MCP07"));
+        }
+        return text(formatFindings(findings));
+    },
+};
+const cfgCheckFilePermissions = {
+    name: "cfg_check_file_permissions",
+    description: "Check file permissions on MCP config files and related credential files. Flag configs readable by other users (mode > 600), world-readable .env files.",
+    schema: {
+        path: z.string().describe("Path to MCP configuration file or directory"),
+    },
+    async execute(args) {
+        const findings = [];
+        let counter = 0;
+        const exists = await fileExists(args.path);
+        if (!exists)
+            return text(`Path not found: ${args.path}`);
+        const stat = await getFileStat(args.path);
+        if (stat && stat.isFile()) {
+            const mode = stat.mode & 0o777;
+            if (mode & 0o044) {
+                counter++;
+                findings.push({
+                    id: `CFG-PERM-${String(counter).padStart(3, "0")}`,
+                    title: "Config File Has Overly Permissive Permissions",
+                    severity: "medium",
+                    owasp_mcp: "MCP01",
+                    owasp_mcp_title: "Excessive Privilege & Token Mismanagement",
+                    category: "config",
+                    file: args.path,
+                    evidence: `File permissions: ${mode.toString(8)} — readable by group/others`,
+                    remediation: `Set restrictive permissions: chmod 600 ${args.path}`,
+                    cwe: "CWE-732",
+                });
+            }
+        }
+        return text(formatFindings(findings));
+    },
+};
+export const configTools = [
+    cfgAutoDiscover,
+    cfgAuditMcpConfig,
+    cfgScanEnvFiles,
+    cfgCheckShadowServers,
+    cfgCheckContextOversharing,
+    cfgCheckTransportSecurity,
+    cfgCheckFilePermissions,
+];
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAQ,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAEjE,SAAS,cAAc,CAAC,QAAmB;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IACjD,MAAM,UAAU,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnD,IAAI,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,gBAAgB,UAAU,CAAC,QAAQ,cAAc,UAAU,CAAC,IAAI,UAAU,UAAU,CAAC,MAAM,YAAY,UAAU,CAAC,GAAG,SAAS,UAAU,CAAC,IAAI,WAAW,CAAC;IACxL,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC;QAChE,IAAI,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QACzE,MAAM,IAAI,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,eAAe,IAAI,CAAC;QAC7D,MAAM,IAAI,eAAe,CAAC,CAAC,QAAQ,IAAI,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAAC,CAAC,WAAW,MAAM,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,eAAe,GAAY;IAC/B,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACT,kLAAkL;IACpL,MAAM,EAAE;QACN,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;KAC9F;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAE3E,IAAI,MAAM,GAAG,SAAS,OAAO,CAAC,MAAM,iCAAiC,CAAC;QACtE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC;YACzC,MAAM,IAAI,cAAc,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC;YAC/C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,SAAS,IAAI,CAAC;YACpE,CAAC;YACD,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAY;IACjC,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,gMAAgM;IAClM,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;KAC5D;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,gCAAgC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEtE,MAAM,WAAW,GAAc,EAAE,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAc,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,MAAM,GAAG,WAAW,IAAI,CAAC,IAAI,cAAc,MAAM,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC;QAC3E,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;CACF,CAAC;AAEF,MAAM,eAAe,GAAY;IAC/B,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EACT,2KAA2K;IAC7K,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;KAC9D;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC;AAEF,MAAM,qBAAqB,GAAY;IACrC,IAAI,EAAE,0BAA0B;IAChC,WAAW,EACT,wKAAwK;IAC1K,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;KAC5D;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,gCAAgC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEtE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAc,CAAC,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC;AAEF,MAAM,0BAA0B,GAAY;IAC1C,IAAI,EAAE,+BAA+B;IACrC,WAAW,EACT,wJAAwJ;IAC1J,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;KAC5D;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,gCAAgC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEtE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAc,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC;AAEF,MAAM,yBAAyB,GAAY;IACzC,IAAI,EAAE,8BAA8B;IACpC,WAAW,EACT,8KAA8K;IAChL,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;KAC5D;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,gCAAgC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEtE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAc,CAAC,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC;AAEF,MAAM,uBAAuB,GAAY;IACvC,IAAI,EAAE,4BAA4B;IAClC,WAAW,EACT,wJAAwJ;IAC1J,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;KACzE;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEzD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;QACpD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAC/B,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACjB,OAAO,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,YAAY,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBAClD,KAAK,EAAE,+CAA+C;oBACtD,QAAQ,EAAE,QAAQ;oBAClB,SAAS,EAAE,OAAO;oBAClB,eAAe,EAAE,2CAA2C;oBAC5D,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,IAAI,CAAC,IAAc;oBACzB,QAAQ,EAAE,qBAAqB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,6BAA6B;oBAC5E,WAAW,EAAE,0CAA0C,IAAI,CAAC,IAAI,EAAE;oBAClE,GAAG,EAAE,SAAS;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,eAAe;IACf,iBAAiB;IACjB,eAAe;IACf,qBAAqB;IACrB,0BAA0B;IAC1B,yBAAyB;IACzB,uBAAuB;CACxB,CAAC"}

package/dist/config/mcp-config-parser.d.ts

@@ -0,0 +1,16 @@
+export interface McpConfigFile {
+    path: string;
+    client: string;
+    servers: McpServerEntry[];
+}
+export interface McpServerEntry {
+    name: string;
+    command?: string;
+    args?: string[];
+    env?: Record<string, string>;
+    url?: string;
+    headers?: Record<string, string>;
+}
+export declare function discoverConfigs(): Promise<McpConfigFile[]>;
+export declare function parseConfigFile(path: string): Promise<McpConfigFile | null>;
+//# sourceMappingURL=mcp-config-parser.d.ts.map

package/dist/config/mcp-config-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config-parser.d.ts","sourceRoot":"","sources":["../../src/config/mcp-config-parser.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAkED,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAmBhE;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAQjF"}

package/dist/config/mcp-config-parser.js

@@ -0,0 +1,86 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { safeReadJson, fileExists } from "../utils/fs-helpers.js";
+const CONFIG_LOCATIONS = [
+    {
+        client: "Claude Desktop",
+        paths: [
+            join(homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json"),
+            join(homedir(), ".config", "claude", "claude_desktop_config.json"),
+            join(homedir(), "AppData", "Roaming", "Claude", "claude_desktop_config.json"),
+        ],
+    },
+    {
+        client: "Claude Code",
+        paths: [
+            join(homedir(), ".claude.json"),
+        ],
+    },
+    {
+        client: "Cursor",
+        paths: [
+            join(homedir(), ".cursor", "mcp.json"),
+        ],
+    },
+    {
+        client: "VS Code",
+        paths: [
+            join(homedir(), ".vscode", "mcp.json"),
+            join(homedir(), "Library", "Application Support", "Code", "User", "settings.json"),
+        ],
+    },
+    {
+        client: "Windsurf",
+        paths: [
+            join(homedir(), ".windsurf", "mcp.json"),
+            join(homedir(), ".codeium", "windsurf", "mcp_config.json"),
+        ],
+    },
+];
+function parseServers(raw) {
+    if (!raw || typeof raw !== "object")
+        return [];
+    const servers = [];
+    const obj = raw;
+    for (const [name, value] of Object.entries(obj)) {
+        if (!value || typeof value !== "object")
+            continue;
+        const entry = value;
+        servers.push({
+            name,
+            command: entry.command,
+            args: Array.isArray(entry.args) ? entry.args.map(String) : undefined,
+            env: entry.env && typeof entry.env === "object" ? entry.env : undefined,
+            url: entry.url,
+            headers: entry.headers && typeof entry.headers === "object" ? entry.headers : undefined,
+        });
+    }
+    return servers;
+}
+export async function discoverConfigs() {
+    const results = [];
+    for (const loc of CONFIG_LOCATIONS) {
+        for (const path of loc.paths) {
+            if (await fileExists(path)) {
+                const data = await safeReadJson(path);
+                if (data) {
+                    const serversRaw = data.mcpServers ?? data.mcp_servers ?? data.servers;
+                    const servers = parseServers(serversRaw);
+                    if (servers.length > 0) {
+                        results.push({ path, client: loc.client, servers });
+                    }
+                }
+            }
+        }
+    }
+    return results;
+}
+export async function parseConfigFile(path) {
+    const data = await safeReadJson(path);
+    if (!data)
+        return null;
+    const serversRaw = data.mcpServers ?? data.mcp_servers ?? data.servers;
+    const servers = parseServers(serversRaw);
+    return { path, client: "unknown", servers };
+}
+//# sourceMappingURL=mcp-config-parser.js.map

package/dist/config/mcp-config-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config-parser.js","sourceRoot":"","sources":["../../src/config/mcp-config-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAqBlE,MAAM,gBAAgB,GAA0C;IAC9D;QACE,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE;YACL,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC;YACzF,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC;YAClE,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC;SAC9E;KACF;IACD;QACE,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE;YACL,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC;SAChC;KACF;IACD;QACE,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE;YACL,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC;SACvC;KACF;IACD;QACE,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE;YACL,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC;SACnF;KACF;IACD;QACE,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE;YACL,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC;SAC3D;KACF;CACF,CAAC;AAEF,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAE/C,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,KAAK,GAAG,KAAgC,CAAC;QAE/C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,OAAO,EAAE,KAAK,CAAC,OAA6B;YAC5C,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACpE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAA6B,CAAC,CAAC,CAAC,SAAS;YACjG,GAAG,EAAE,KAAK,CAAC,GAAyB;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAiC,CAAC,CAAC,CAAC,SAAS;SAClH,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,MAAM,YAAY,CAA0B,IAAI,CAAC,CAAC;gBAC/D,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC;oBACvE,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;oBACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,IAAI,GAAG,MAAM,YAAY,CAA0B,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC;IACvE,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAEzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC"}

package/dist/config/server-verification.d.ts

@@ -0,0 +1,5 @@
+import type { McpServerEntry } from "./mcp-config-parser.js";
+import type { Finding } from "../types/findings.js";
+export declare function auditServerEntry(server: McpServerEntry, configPath: string): Finding[];
+export declare function checkContextOversharing(servers: McpServerEntry[], configPath: string): Finding[];
+//# sourceMappingURL=server-verification.d.ts.map

package/dist/config/server-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-verification.d.ts","sourceRoot":"","sources":["../../src/config/server-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAUpD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,EAAE,CAuKtF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,EAAE,CAwDhG"}

package/dist/config/server-verification.js

@@ -0,0 +1,221 @@
+import { SECRET_PATTERNS } from "../data/secret-patterns.js";
+const SUSPICIOUS_PATHS = ["/tmp", "/var/tmp", "\\temp\\", "\\tmp\\"];
+const KNOWN_NPX_PREFIXES = [
+    "@modelcontextprotocol/", "darknet-mcp-server", "supply-chain-mcp-server",
+    "osint-mcp-server", "cve-mcp-server", "mcp-security-scanner",
+    "@anthropic-ai/", "@cloudflare/", "wrangler",
+];
+export function auditServerEntry(server, configPath) {
+    const findings = [];
+    let counter = 0;
+    // Check for npx -y (auto-install without confirmation)
+    if (server.command === "npx" && server.args?.includes("-y")) {
+        const pkgName = server.args.find(a => !a.startsWith("-") && a !== "npx") ?? "unknown";
+        const isKnown = KNOWN_NPX_PREFIXES.some(p => pkgName.startsWith(p));
+        if (!isKnown) {
+            counter++;
+            findings.push({
+                id: `CFG-SRV-${String(counter).padStart(3, "0")}`,
+                title: `npx -y Auto-Install for Unverified Package: ${pkgName}`,
+                severity: "high",
+                owasp_mcp: "MCP09",
+                owasp_mcp_title: "Shadow Servers & Unauthorized MCP Endpoints",
+                category: "config",
+                file: configPath,
+                evidence: `Server "${server.name}": npx -y ${pkgName} — auto-installs without confirmation`,
+                remediation: "Install the package explicitly with npm install first, then use the installed binary. Verify the package on npmjs.com before use.",
+                cwe: "CWE-829",
+            });
+        }
+    }
+    // Check for secrets in args (visible in process list)
+    if (server.args) {
+        for (const arg of server.args) {
+            for (const pattern of SECRET_PATTERNS) {
+                if (pattern.pattern.test(arg)) {
+                    counter++;
+                    findings.push({
+                        id: `CFG-SRV-${String(counter).padStart(3, "0")}`,
+                        title: `${pattern.name} Exposed in CLI Arguments`,
+                        severity: "critical",
+                        owasp_mcp: "MCP01",
+                        owasp_mcp_title: "Excessive Privilege & Token Mismanagement",
+                        category: "config",
+                        file: configPath,
+                        evidence: `Server "${server.name}": secret in args visible via process list (ps aux)`,
+                        remediation: "Move secrets from CLI arguments to the env block or use environment variables. CLI args are visible to all users via ps.",
+                        cwe: "CWE-214",
+                    });
+                    break;
+                }
+            }
+        }
+    }
+    // Check for secrets in env block (acceptable but flag high-value)
+    if (server.env) {
+        for (const [key, value] of Object.entries(server.env)) {
+            for (const pattern of SECRET_PATTERNS) {
+                if (pattern.pattern.test(value)) {
+                    counter++;
+                    findings.push({
+                        id: `CFG-SRV-${String(counter).padStart(3, "0")}`,
+                        title: `${pattern.name} in Server Environment Config`,
+                        severity: "medium",
+                        owasp_mcp: "MCP01",
+                        owasp_mcp_title: "Excessive Privilege & Token Mismanagement",
+                        category: "config",
+                        file: configPath,
+                        evidence: `Server "${server.name}": ${key}=<${pattern.name}> in env block`,
+                        remediation: "Consider using a secret manager or encrypted env files instead of plaintext in config files.",
+                        cwe: "CWE-522",
+                    });
+                    break;
+                }
+            }
+        }
+    }
+    // Check for suspicious binary paths
+    if (server.command) {
+        for (const suspicious of SUSPICIOUS_PATHS) {
+            if (server.command.includes(suspicious)) {
+                counter++;
+                findings.push({
+                    id: `CFG-SRV-${String(counter).padStart(3, "0")}`,
+                    title: `Server Binary in Writable Directory`,
+                    severity: "high",
+                    owasp_mcp: "MCP09",
+                    owasp_mcp_title: "Shadow Servers & Unauthorized MCP Endpoints",
+                    category: "config",
+                    file: configPath,
+                    evidence: `Server "${server.name}": command "${server.command}" is in a world-writable directory`,
+                    remediation: "Move server binaries to a protected directory. Writable directories allow binary replacement attacks.",
+                    cwe: "CWE-427",
+                });
+                break;
+            }
+        }
+    }
+    // Check for HTTP URLs (no TLS)
+    if (server.url) {
+        if (server.url.startsWith("http://")) {
+            counter++;
+            findings.push({
+                id: `CFG-SRV-${String(counter).padStart(3, "0")}`,
+                title: "Remote Server Using HTTP (No TLS)",
+                severity: "high",
+                owasp_mcp: "MCP07",
+                owasp_mcp_title: "Insufficient Authentication & Transport Security",
+                category: "config",
+                file: configPath,
+                evidence: `Server "${server.name}": ${server.url} — unencrypted transport`,
+                remediation: "Use HTTPS for all remote MCP server connections. HTTP allows eavesdropping and MITM attacks.",
+                cwe: "CWE-319",
+            });
+        }
+        // Check for tunnel URLs
+        if (/ngrok|localtunnel|serveo|bore\.pub|loca\.lt/.test(server.url)) {
+            counter++;
+            findings.push({
+                id: `CFG-SRV-${String(counter).padStart(3, "0")}`,
+                title: "Remote Server Using Tunnel URL",
+                severity: "medium",
+                owasp_mcp: "MCP07",
+                owasp_mcp_title: "Insufficient Authentication & Transport Security",
+                category: "config",
+                file: configPath,
+                evidence: `Server "${server.name}": ${server.url} — tunnel URL that could be hijacked`,
+                remediation: "Avoid using tunnel URLs for production MCP servers. Tunnel URLs can be hijacked when they expire.",
+                cwe: "CWE-346",
+            });
+        }
+        // Check for missing auth headers on remote servers
+        if (!server.headers?.Authorization && !server.headers?.authorization) {
+            counter++;
+            findings.push({
+                id: `CFG-SRV-${String(counter).padStart(3, "0")}`,
+                title: "Remote Server Without Authorization Header",
+                severity: "medium",
+                owasp_mcp: "MCP07",
+                owasp_mcp_title: "Insufficient Authentication & Transport Security",
+                category: "config",
+                file: configPath,
+                evidence: `Server "${server.name}": no Authorization header configured for remote server`,
+                remediation: "Add an Authorization header with a bearer token or API key for remote MCP servers.",
+                cwe: "CWE-287",
+            });
+        }
+        // Check for 0.0.0.0 binding
+        if (/0\.0\.0\.0|::/.test(server.url)) {
+            counter++;
+            findings.push({
+                id: `CFG-SRV-${String(counter).padStart(3, "0")}`,
+                title: "Server Bound to All Interfaces",
+                severity: "high",
+                owasp_mcp: "MCP07",
+                owasp_mcp_title: "Insufficient Authentication & Transport Security",
+                category: "config",
+                file: configPath,
+                evidence: `Server "${server.name}": bound to 0.0.0.0 — accessible from network`,
+                remediation: "Bind to localhost (127.0.0.1) for local-only servers. Use 0.0.0.0 only with proper authentication and firewall rules.",
+                cwe: "CWE-668",
+            });
+        }
+    }
+    return findings;
+}
+export function checkContextOversharing(servers, configPath) {
+    const findings = [];
+    let counter = 0;
+    // Check for servers with no explicit env (inherits everything)
+    for (const server of servers) {
+        if (!server.env && server.command) {
+            // Stdio servers without explicit env inherit ALL env vars
+            counter++;
+            findings.push({
+                id: `CFG-CTX-${String(counter).padStart(3, "0")}`,
+                title: "Server Inherits All Environment Variables",
+                severity: "medium",
+                owasp_mcp: "MCP10",
+                owasp_mcp_title: "Context Over-sharing & Data Exposure",
+                category: "config",
+                file: configPath,
+                evidence: `Server "${server.name}": no explicit env block — inherits all parent process env vars`,
+                remediation: "Add an explicit env block listing only the environment variables this server needs.",
+                cwe: "CWE-200",
+            });
+        }
+    }
+    // Check for high-value secrets shared across multiple servers
+    const secretServers = {};
+    for (const server of servers) {
+        if (!server.env)
+            continue;
+        for (const [key] of Object.entries(server.env)) {
+            const lk = key.toLowerCase();
+            if (/key|secret|token|password|credential/.test(lk)) {
+                if (!secretServers[key])
+                    secretServers[key] = [];
+                secretServers[key].push(server.name);
+            }
+        }
+    }
+    for (const [key, serverNames] of Object.entries(secretServers)) {
+        if (serverNames.length > 1) {
+            counter++;
+            findings.push({
+                id: `CFG-CTX-${String(counter).padStart(3, "0")}`,
+                title: `Secret Shared Across ${serverNames.length} Servers`,
+                severity: "medium",
+                owasp_mcp: "MCP10",
+                owasp_mcp_title: "Context Over-sharing & Data Exposure",
+                category: "config",
+                file: configPath,
+                evidence: `${key} is configured in servers: ${serverNames.join(", ")}`,
+                remediation: "Each server should have its own unique credentials. Sharing secrets increases blast radius if one server is compromised.",
+                cwe: "CWE-200",
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=server-verification.js.map

package/dist/config/server-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-verification.js","sourceRoot":"","sources":["../../src/config/server-verification.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACrE,MAAM,kBAAkB,GAAG;IACzB,wBAAwB,EAAE,oBAAoB,EAAE,yBAAyB;IACzE,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB;IAC5D,gBAAgB,EAAE,cAAc,EAAE,UAAU;CAC7C,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,MAAsB,EAAE,UAAkB;IACzE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,uDAAuD;IACvD,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,SAAS,CAAC;QACtF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACjD,KAAK,EAAE,+CAA+C,OAAO,EAAE;gBAC/D,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,OAAO;gBAClB,eAAe,EAAE,6CAA6C;gBAC9D,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,WAAW,MAAM,CAAC,IAAI,aAAa,OAAO,uCAAuC;gBAC3F,WAAW,EAAE,mIAAmI;gBAChJ,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,OAAO,EAAE,CAAC;oBACV,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;wBACjD,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,2BAA2B;wBACjD,QAAQ,EAAE,UAAU;wBACpB,SAAS,EAAE,OAAO;wBAClB,eAAe,EAAE,2CAA2C;wBAC5D,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,WAAW,MAAM,CAAC,IAAI,qDAAqD;wBACrF,WAAW,EAAE,0HAA0H;wBACvI,GAAG,EAAE,SAAS;qBACf,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,OAAO,EAAE,CAAC;oBACV,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;wBACjD,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,+BAA+B;wBACrD,QAAQ,EAAE,QAAQ;wBAClB,SAAS,EAAE,OAAO;wBAClB,eAAe,EAAE,2CAA2C;wBAC5D,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,WAAW,MAAM,CAAC,IAAI,MAAM,GAAG,KAAK,OAAO,CAAC,IAAI,gBAAgB;wBAC1E,WAAW,EAAE,8FAA8F;wBAC3G,GAAG,EAAE,SAAS;qBACf,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBACjD,KAAK,EAAE,qCAAqC;oBAC5C,QAAQ,EAAE,MAAM;oBAChB,SAAS,EAAE,OAAO;oBAClB,eAAe,EAAE,6CAA6C;oBAC9D,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,WAAW,MAAM,CAAC,IAAI,eAAe,MAAM,CAAC,OAAO,oCAAoC;oBACjG,WAAW,EAAE,uGAAuG;oBACpH,GAAG,EAAE,SAAS;iBACf,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACjD,KAAK,EAAE,mCAAmC;gBAC1C,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,OAAO;gBAClB,eAAe,EAAE,kDAAkD;gBACnE,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,WAAW,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,GAAG,0BAA0B;gBAC1E,WAAW,EAAE,8FAA8F;gBAC3G,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;QAED,wBAAwB;QACxB,IAAI,6CAA6C,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACjD,KAAK,EAAE,gCAAgC;gBACvC,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,OAAO;gBAClB,eAAe,EAAE,kDAAkD;gBACnE,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,WAAW,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,GAAG,sCAAsC;gBACtF,WAAW,EAAE,mGAAmG;gBAChH,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;YACrE,OAAO,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACjD,KAAK,EAAE,4CAA4C;gBACnD,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,OAAO;gBAClB,eAAe,EAAE,kDAAkD;gBACnE,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,WAAW,MAAM,CAAC,IAAI,yDAAyD;gBACzF,WAAW,EAAE,oFAAoF;gBACjG,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACjD,KAAK,EAAE,gCAAgC;gBACvC,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,OAAO;gBAClB,eAAe,EAAE,kDAAkD;gBACnE,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,WAAW,MAAM,CAAC,IAAI,+CAA+C;gBAC/E,WAAW,EAAE,uHAAuH;gBACpI,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAyB,EAAE,UAAkB;IACnF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,+DAA+D;IAC/D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,0DAA0D;YAC1D,OAAO,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACjD,KAAK,EAAE,2CAA2C;gBAClD,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,OAAO;gBAClB,eAAe,EAAE,sCAAsC;gBACvD,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,WAAW,MAAM,CAAC,IAAI,iEAAiE;gBACjG,WAAW,EAAE,qFAAqF;gBAClG,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM,aAAa,GAA6B,EAAE,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,SAAS;QAC1B,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAC7B,IAAI,sCAAsC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;oBAAE,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACjD,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACjD,KAAK,EAAE,wBAAwB,WAAW,CAAC,MAAM,UAAU;gBAC3D,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,OAAO;gBAClB,eAAe,EAAE,sCAAsC;gBACvD,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,GAAG,GAAG,8BAA8B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACtE,WAAW,EAAE,0HAA0H;gBACvI,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}