mcptrustchecker 1.0.0 → 1.1.0

package/README.md

@@ -24,7 +24,7 @@
 npx mcptrustchecker                # 🔍 scan every MCP server you already have installed — zero config
 ```
 
-<sub>· offline · deterministic · no account · no API key · <a href="#the-algorithm-the-capability-flow-trust-model">one novel core</a> ·</sub>
+<sub>· offline · deterministic · no account · OAuth browser login for protected servers · <a href="#the-algorithm-the-capability-flow-trust-model">one novel core</a> ·</sub>
 
 </div>
 
@@ -70,7 +70,8 @@ Toxic flows (untrusted-input → sensitive-source → external-sink)
 
 MCP Trust Checker's wedge is **accuracy + explainability + privacy**, with one genuinely novel core — the cross-tool toxic-flow graph. Every property below holds together in a single offline binary — no account, no LLM in the loop, no telemetry:
 
-- 🔒 **Runs 100% offline** — no account, token, API key, or hosted service; your data never leaves the machine.
+- 🔒 **Offline by default** — no account, token, API key, or hosted service; your data never leaves the machine.
+- 🔐 **Scans protected remote servers** — `--login` runs the full **OAuth 2.0 browser sign-in** (discovery → dynamic client registration → PKCE → token), so it can audit auth-gated remote MCP endpoints, not just public ones — something most scanners can't do. (Or pass a static `--header "Authorization: Bearer …"`.) Tokens stay in memory for the scan only.
 - 🎯 **Deterministic** — same input ⇒ byte-identical score, on every run and every machine.
 - 🕸️ **Cross-tool toxic-flow graph** — proves the lethal trifecta statically, composed across tools, not just within one.
 - 🔬 **Reads the code, not just the claim** — when the server's source is available (`scan ./path`), it grades what the implementation *does* (eval / shell-spawn / hardcoded egress / credential reads / obfuscated payloads), so a poisoned server can't hide behind honest-looking tool descriptions. Metadata **and** implementation, in one deterministic pass.
@@ -125,6 +126,8 @@ mcptrustchecker scan ./tools.json                          # an offline manifest
 mcptrustchecker scan ./path/to/mcp-server                  # a local package dir — analyzes the CODE too
 mcptrustchecker scan --command "npx -y @some/mcp-server"   # a local stdio server (sandboxed)
 mcptrustchecker scan https://mcp.example.com/mcp           # a live HTTP/SSE endpoint
+mcptrustchecker scan https://mcp.example.com/mcp --login   # an OAuth-protected endpoint (browser sign-in)
+mcptrustchecker scan https://mcp.example.com/mcp --header "Authorization: Bearer <token>"   # static auth
 mcptrustchecker scan @modelcontextprotocol/server-filesystem --online   # a package name (typosquat/CVE)
 ```
 

package/dist/acquire/live.d.ts

@@ -40,6 +40,20 @@ export interface LiveOptions {
     allowedHosts?: string[];
     /** Block private/loopback/link-local hosts (set for untrusted, config-derived URLs). */
     blockPrivateHosts?: boolean;
+    /**
+     * Extra request headers (e.g. `Authorization: Bearer …`) for HTTP acquisition
+     * of protected endpoints. Sent ONLY to the target host — never forwarded to a
+     * redirect on a different host, so the credential can't leak.
+     */
+    headers?: Record<string, string>;
+    /**
+     * Perform an interactive OAuth 2.0 browser sign-in for endpoints that require
+     * it (the MCP authorization flow). Opens the user's browser; tokens live in
+     * memory for the scan only.
+     */
+    login?: boolean;
+    /** Optional OAuth scope to request during `login` (e.g. `mcp:tools`). */
+    scope?: string;
 }
 /** Acquire a surface by spawning a local stdio MCP server. */
 export declare function acquireStdio(spec: StdioSpec, opts?: LiveOptions): Promise<ServerSurface>;

package/dist/acquire/live.js

@@ -19,6 +19,8 @@
  * it loaded; live scanning requires `@modelcontextprotocol/sdk` at runtime.
  */
 import { surfaceFromManifest } from './manifest.js';
+import { TOOL_VERSION } from '../version.js';
+import { applyCredentialGate } from '../util/headers.js';
 /** Executables permitted for stdio acquisition (the canonical safe set). */
 export const ALLOWED_COMMANDS = new Set(['npx', 'uvx', 'python', 'python3', 'node', 'docker', 'deno']);
 /**
@@ -143,17 +145,19 @@ function withTimeout(p, ms, label) {
 /* eslint-disable @typescript-eslint/no-explicit-any */
 async function loadSdk() {
     try {
-        const [{ Client }, stdio, http, sse] = await Promise.all([
+        const [{ Client }, stdio, http, sse, auth] = await Promise.all([
             import('@modelcontextprotocol/sdk/client/index.js'),
             import('@modelcontextprotocol/sdk/client/stdio.js'),
             import('@modelcontextprotocol/sdk/client/streamableHttp.js'),
             import('@modelcontextprotocol/sdk/client/sse.js'),
+            import('@modelcontextprotocol/sdk/client/auth.js'),
         ]);
         return {
             Client,
             StdioClientTransport: stdio.StdioClientTransport,
             StreamableHTTPClientTransport: http.StreamableHTTPClientTransport,
             SSEClientTransport: sse.SSEClientTransport,
+            UnauthorizedError: auth.UnauthorizedError,
         };
     }
     catch (err) {
@@ -270,7 +274,7 @@ export async function acquireStdio(spec, opts = {}) {
         cwd: spec.cwd ?? process.cwd(),
         stderr: 'pipe',
     });
-    const client = new sdk.Client({ name: 'mcptrustchecker', version: '1.0.0' }, { capabilities: {} });
+    const client = new sdk.Client({ name: 'mcptrustchecker', version: TOOL_VERSION }, { capabilities: {} });
     try {
         await withTimeout(client.connect(transport), CONNECT_TIMEOUT_MS, 'stdio connect');
         const enumd = await enumerate(client);
@@ -310,25 +314,42 @@ export async function acquireHttp(url, opts = {}) {
             `Use --allowed-hosts to permit specific hosts.`);
     }
     const sdk = await loadSdk();
-    const client = new sdk.Client({ name: 'mcptrustchecker', version: '1.0.0' }, { capabilities: {} });
+    const client = new sdk.Client({ name: 'mcptrustchecker', version: TOOL_VERSION }, { capabilities: {} });
     // Re-validate every redirect hop: the initial-URL SSRF check is useless if the
     // server 302s to http://[::ffff:169.254.169.254]/. We follow redirects
     // manually (capped) and run each hop's host back through the same guard.
+    // Re-validate every hop AND contain credentials. The SDK routes ALL its
+    // requests — including OAuth discovery / registration / token endpoints, whose
+    // hosts come from the *server's* metadata — through this fetch, so every hop
+    // (not just 3xx targets) must pass the SSRF guard, and credentials must never
+    // cross to a different origin.
     const guardedFetch = async (input, init) => {
         let current = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
         for (let hop = 0; hop < 6; hop++) {
-            const res = await fetch(current, { ...init, redirect: 'manual' });
+            let cur;
+            try {
+                cur = new URL(current);
+            }
+            catch {
+                throw new Error(`Invalid request URL "${current}".`);
+            }
+            // SSRF guard on THIS hop's host — covers the initial request too, not just
+            // redirect targets (an OAuth authorization-server host is server-chosen).
+            if (cur.protocol !== 'http:' && cur.protocol !== 'https:')
+                throw new Error(`Blocked request to non-http scheme "${cur.protocol}".`);
+            if (opts.allowedHosts && !opts.allowedHosts.includes(cur.hostname))
+                throw new Error(`Blocked request to disallowed host "${cur.hostname}".`);
+            if (opts.blockPrivateHosts && isBlockedHost(cur.hostname))
+                throw new Error(`SSRF: blocked request to private/loopback host "${cur.hostname}".`);
+            // Credentials (the SDK-injected OAuth bearer in init.headers, and any
+            // static --header) go ONLY to the exact target ORIGIN; stripped on any
+            // cross-origin hop (redirect, downgrade, different port).
+            const headers = applyCredentialGate(init?.headers, cur.origin === parsed.origin, opts.headers);
+            const res = await fetch(current, { ...init, headers, redirect: 'manual' });
             const loc = res.status >= 300 && res.status < 400 ? res.headers.get('location') : null;
             if (!loc)
                 return res;
-            const next = new URL(loc, current);
-            if (next.protocol !== 'http:' && next.protocol !== 'https:')
-                throw new Error(`Blocked redirect to non-http scheme "${next.protocol}".`);
-            if (opts.allowedHosts && !opts.allowedHosts.includes(next.hostname))
-                throw new Error(`Blocked redirect to disallowed host "${next.hostname}".`);
-            if (opts.blockPrivateHosts && isBlockedHost(next.hostname))
-                throw new Error(`SSRF: blocked redirect to private/loopback host "${next.hostname}".`);
-            current = next.href;
+            current = new URL(loc, current).href;
         }
         throw new Error('Too many redirects.');
     };
@@ -342,8 +363,58 @@ export async function acquireHttp(url, opts = {}) {
             await withTimeout(client.connect(sseT), CONNECT_TIMEOUT_MS, 'sse connect');
         }
     };
+    // Interactive OAuth: register a client, open the browser, catch the redirect,
+    // exchange the code for a token, then reconnect authenticated.
+    const connectWithOAuth = async () => {
+        const { CliOAuthProvider, startCallbackServer, openBrowser } = await import('./oauth.js');
+        const cb = await startCallbackServer();
+        // Flips true the instant the browser sign-in is triggered. After that, a
+        // failure (denied consent, callback timeout, token-exchange error) is NOT a
+        // transport mismatch — we must not restart the flow on SSE (a second browser
+        // window + reuse of the already-settled single-shot callback promise).
+        let authStarted = false;
+        const provider = new CliOAuthProvider(cb.redirectUrl, opts.scope, (authUrl) => {
+            authStarted = true;
+            process.stderr.write(`\n${'→'} This MCP server requires sign-in. Opening your browser…\n` +
+                `  If it doesn't open, paste this URL:\n  ${authUrl.href}\n\n`);
+            openBrowser(authUrl.href);
+        }, cb.state);
+        const attempt = async (TransportCtor) => {
+            let transport = new TransportCtor(parsed, { authProvider: provider, fetch: guardedFetch });
+            try {
+                await withTimeout(client.connect(transport), CONNECT_TIMEOUT_MS, 'oauth connect');
+            }
+            catch (err) {
+                if (sdk.UnauthorizedError && err instanceof sdk.UnauthorizedError) {
+                    const code = await cb.waitForCode();
+                    await transport.finishAuth(code);
+                    transport = new TransportCtor(parsed, { authProvider: provider, fetch: guardedFetch });
+                    await withTimeout(client.connect(transport), CONNECT_TIMEOUT_MS, 'oauth reconnect');
+                }
+                else {
+                    throw err;
+                }
+            }
+        };
+        try {
+            try {
+                await attempt(sdk.StreamableHTTPClientTransport);
+            }
+            catch (primary) {
+                // Fall back to SSE ONLY for a pre-auth transport/protocol mismatch; once
+                // the browser has opened, surface the real error instead of re-running
+                // the whole sign-in on a second transport.
+                if (authStarted || (sdk.UnauthorizedError && primary instanceof sdk.UnauthorizedError))
+                    throw primary;
+                await attempt(sdk.SSEClientTransport);
+            }
+        }
+        finally {
+            cb.close();
+        }
+    };
     try {
-        await connect();
+        await (opts.login ? connectWithOAuth() : connect());
         const enumd = await enumerate(client);
         const surface = surfaceFromManifest({ ...enumd }, url, url);
         surface.source = { kind: 'http', origin: url };

package/dist/acquire/oauth.d.ts

@@ -0,0 +1,49 @@
+import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientMetadata, OAuthTokens, OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+/** How long to wait for the user to finish signing in in their browser. */
+export declare const OAUTH_CALLBACK_TIMEOUT_MS = 180000;
+/** Open a URL in the user's default browser (best-effort, cross-platform). */
+export declare function openBrowser(url: string): void;
+/** Parse an OAuth redirect request URL into a code (+ state), or a descriptive error. */
+export declare function parseCallback(reqUrl: string | undefined): {
+    code?: string;
+    state?: string;
+    error?: Error;
+};
+export interface CallbackServer {
+    /** The loopback redirect URI to register and redirect back to. */
+    redirectUrl: string;
+    /** The CSRF `state` value the authorization request must echo back. */
+    state: string;
+    /** Resolves with the authorization code once the browser redirects back. */
+    waitForCode(): Promise<string>;
+    /** Shut the loopback server down. */
+    close(): void;
+}
+/** Start a loopback HTTP server on a free port to receive the OAuth redirect. */
+export declare function startCallbackServer(): Promise<CallbackServer>;
+/**
+ * In-memory `OAuthClientProvider`. Holds the dynamically-registered client,
+ * tokens and PKCE verifier for a single scan; opens the browser on redirect.
+ */
+export declare class CliOAuthProvider implements OAuthClientProvider {
+    private readonly _redirectUrl;
+    private readonly _scope;
+    private readonly _onAuthorize;
+    private readonly _state;
+    private _clientInformation?;
+    private _tokens?;
+    private _codeVerifier?;
+    constructor(_redirectUrl: string, _scope: string | undefined, _onAuthorize: (url: URL) => void, _state: string);
+    get redirectUrl(): string;
+    /** CSRF nonce echoed through the authorization request (OAuth 2.1 hardening). */
+    state(): string;
+    get clientMetadata(): OAuthClientMetadata;
+    clientInformation(): OAuthClientInformationFull | undefined;
+    saveClientInformation(info: OAuthClientInformationFull): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    redirectToAuthorization(authorizationUrl: URL): void;
+    saveCodeVerifier(codeVerifier: string): void;
+    codeVerifier(): string;
+}

package/dist/acquire/oauth.js

@@ -0,0 +1,190 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Interactive OAuth 2.0 login for scanning protected remote MCP servers.
+ *
+ * Modern remote MCP servers gate their `/mcp` endpoint behind OAuth (the MCP
+ * authorization spec: discovery → dynamic client registration → authorization-
+ * code + PKCE). A static header can't authenticate there. This implements the
+ * client half of that flow for the CLI: a loopback callback server catches the
+ * redirect, the browser is opened for the user's sign-in, and the SDK exchanges
+ * the code for an access token — which it then attaches to the MCP handshake.
+ *
+ * Tokens are held in memory for the duration of one scan only — nothing is
+ * written to disk, consistent with the tool's local-first, no-account stance.
+ */
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+const CLIENT_NAME = 'MCP Trust Checker';
+/** How long to wait for the user to finish signing in in their browser. */
+export const OAUTH_CALLBACK_TIMEOUT_MS = 180_000;
+/** Open a URL in the user's default browser (best-effort, cross-platform). */
+export function openBrowser(url) {
+    const [cmd, args] = process.platform === 'darwin'
+        ? ['open', [url]]
+        : process.platform === 'win32'
+            ? ['cmd', ['/c', 'start', '', url]]
+            : ['xdg-open', [url]];
+    try {
+        const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => {
+            /* the URL is also printed, so the user can open it manually */
+        });
+        child.unref();
+    }
+    catch {
+        /* ignore — non-fatal, the URL is printed for manual use */
+    }
+}
+/** Parse an OAuth redirect request URL into a code (+ state), or a descriptive error. */
+export function parseCallback(reqUrl) {
+    const parsed = new URL(reqUrl || '', 'http://127.0.0.1');
+    const code = parsed.searchParams.get('code');
+    const state = parsed.searchParams.get('state') || undefined;
+    if (code)
+        return { code, state };
+    const error = parsed.searchParams.get('error');
+    if (error) {
+        const desc = parsed.searchParams.get('error_description');
+        return { error: new Error(`OAuth authorization failed: ${error}${desc ? ` — ${desc}` : ''}`) };
+    }
+    return { error: new Error('OAuth callback carried no authorization code.') };
+}
+const OK_PAGE = '<!doctype html><meta charset="utf-8"><title>Authorized</title>' +
+    '<body style="font-family:system-ui,sans-serif;background:#07080b;color:#eef1f6;text-align:center;padding:64px 24px">' +
+    '<h1 style="color:#c4f542">✓ Authorized</h1>' +
+    '<p>You can close this tab and return to the terminal.</p>' +
+    '<script>setTimeout(function(){window.close()},1500)</script></body>';
+/** Start a loopback HTTP server on a free port to receive the OAuth redirect. */
+export async function startCallbackServer() {
+    let resolveCode;
+    let rejectCode;
+    const codePromise = new Promise((res, rej) => {
+        resolveCode = res;
+        rejectCode = rej;
+    });
+    const expectedState = randomUUID();
+    const server = createServer((req, res) => {
+        const parsed = new URL(req.url || '', 'http://127.0.0.1');
+        if (parsed.pathname !== '/callback') {
+            res.writeHead(404);
+            res.end();
+            return;
+        }
+        const { code, state, error } = parseCallback(req.url);
+        // Require the CSRF state to match before settling — a stray/forged local
+        // request (or a page spraying the ephemeral port) can neither complete NOR
+        // abort the sign-in.
+        if (state !== expectedState) {
+            res.writeHead(400, { 'content-type': 'text/html' });
+            res.end('<!doctype html><meta charset="utf-8"><body>Invalid OAuth state.</body>');
+            return;
+        }
+        if (code) {
+            res.writeHead(200, { 'content-type': 'text/html' });
+            res.end(OK_PAGE);
+            resolveCode(code);
+        }
+        else {
+            res.writeHead(400, { 'content-type': 'text/html' });
+            res.end(`<!doctype html><meta charset="utf-8"><body>${error.message}</body>`);
+            rejectCode(error);
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            server.off('error', reject);
+            resolve();
+        });
+    });
+    const addr = server.address();
+    const port = typeof addr === 'object' && addr ? addr.port : 0;
+    const redirectUrl = `http://127.0.0.1:${port}/callback`;
+    // Race the callback against a timeout, but ALWAYS clear the timer once the
+    // code arrives — a lingering setTimeout would keep the event loop (and the
+    // whole CLI, after the scan finishes) alive until it fires.
+    const waitForCode = () => new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error('Timed out waiting for the browser sign-in (3 min). Re-run to try again.')), OAUTH_CALLBACK_TIMEOUT_MS);
+        timer.unref?.();
+        codePromise.then((code) => {
+            clearTimeout(timer);
+            resolve(code);
+        }, (err) => {
+            clearTimeout(timer);
+            reject(err);
+        });
+    });
+    return {
+        redirectUrl,
+        state: expectedState,
+        waitForCode,
+        close: () => {
+            try {
+                server.close();
+            }
+            catch {
+                /* already closed */
+            }
+        },
+    };
+}
+/**
+ * In-memory `OAuthClientProvider`. Holds the dynamically-registered client,
+ * tokens and PKCE verifier for a single scan; opens the browser on redirect.
+ */
+export class CliOAuthProvider {
+    _redirectUrl;
+    _scope;
+    _onAuthorize;
+    _state;
+    _clientInformation;
+    _tokens;
+    _codeVerifier;
+    constructor(_redirectUrl, _scope, _onAuthorize, _state) {
+        this._redirectUrl = _redirectUrl;
+        this._scope = _scope;
+        this._onAuthorize = _onAuthorize;
+        this._state = _state;
+    }
+    get redirectUrl() {
+        return this._redirectUrl;
+    }
+    /** CSRF nonce echoed through the authorization request (OAuth 2.1 hardening). */
+    state() {
+        return this._state;
+    }
+    get clientMetadata() {
+        return {
+            client_name: CLIENT_NAME,
+            redirect_uris: [this._redirectUrl],
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: 'client_secret_post',
+            ...(this._scope ? { scope: this._scope } : {}),
+        };
+    }
+    clientInformation() {
+        return this._clientInformation;
+    }
+    saveClientInformation(info) {
+        this._clientInformation = info;
+    }
+    tokens() {
+        return this._tokens;
+    }
+    saveTokens(tokens) {
+        this._tokens = tokens;
+    }
+    redirectToAuthorization(authorizationUrl) {
+        this._onAuthorize(authorizationUrl);
+    }
+    saveCodeVerifier(codeVerifier) {
+        this._codeVerifier = codeVerifier;
+    }
+    codeVerifier() {
+        if (!this._codeVerifier)
+            throw new Error('No PKCE code verifier saved.');
+        return this._codeVerifier;
+    }
+}

package/dist/cli/index.js

@@ -30,6 +30,7 @@ import { GRADE_RANK } from '../scoring/model.js';
 import { RULE_CATALOG, findRule } from '../data/ruleCatalog.js';
 import { METHODOLOGY_VERSION, TOOL_VERSION } from '../version.js';
 import { c } from '../util/ansi.js';
+import { parseHeaderArgs } from '../util/headers.js';
 const KNOWN_COMMANDS = new Set(['scan', 'pin', 'diff', 'rules', 'explain', 'version', 'help']);
 function fail(msg, code = 2) {
     process.stderr.write(`${c.red('mcptrustchecker: error')} ${msg}\n`);
@@ -49,6 +50,9 @@ ${c.bold('Usage')}
 ${c.bold('Targets')}
   path/to/tools.json               a pre-generated manifest (offline)
   https://host/mcp                 a live Streamable-HTTP / SSE endpoint
+  --login                          OAuth browser sign-in for a protected endpoint (opens your browser)
+  --scope <scope>                  OAuth scope to request with --login (e.g. mcp:tools)
+  --header "Authorization: Bearer …"   static auth header instead of --login (repeatable)
   claude_desktop_config.json       a client config (scans each server)
   @scope/package                   supply-chain / typosquat check (add --online for metadata)
   --command "npx -y my-server"     spawn a local stdio server (sandboxed)
@@ -104,6 +108,9 @@ async function main() {
                 command: { type: 'string' },
                 args: { type: 'string' },
                 env: { type: 'string', multiple: true },
+                header: { type: 'string', multiple: true },
+                login: { type: 'boolean' },
+                scope: { type: 'string' },
                 url: { type: 'string' },
                 online: { type: 'boolean' },
                 run: { type: 'boolean' },
@@ -180,8 +187,18 @@ async function main() {
         envVars: parseEnvFlags(values.env),
         allowAnyCommand: values['allow-any-command'],
         allowedHosts: values['allowed-hosts'] ? values['allowed-hosts'].split(',').map((h) => h.trim()) : undefined,
+        headers: parseHeaderArgs(values.header),
+        login: values.login,
+        scope: values.scope,
         registry: values.registry === 'pypi' ? 'pypi' : 'npm',
     };
+    // --login and a static Authorization header are alternative auth methods;
+    // combining them would silently clobber the freshly-minted OAuth token.
+    if (values.login &&
+        resolveOpts.headers &&
+        Object.keys(resolveOpts.headers).some((h) => h.toLowerCase() === 'authorization')) {
+        fail('--login cannot be combined with a static --header "Authorization: …" — choose one auth method.');
+    }
     let resolved = [];
     if (autoDiscover) {
         // Zero-config: find and scan every installed MCP client config.

package/dist/util/headers.d.ts

@@ -0,0 +1,16 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Parse repeated `--header "Name: Value"` CLI arguments into a header map.
+ * Used to authenticate against protected remote MCP endpoints (e.g. a Bearer
+ * token). Kept pure and separate from the CLI entrypoint so it stays testable.
+ */
+export declare function parseHeaderArgs(items?: string[]): Record<string, string> | undefined;
+/**
+ * Contain credentials to the target origin. On the target origin, keep the
+ * request's own headers and add any static `--header`s. On any OTHER origin
+ * (cross-host redirect, https→http downgrade, different port), strip the
+ * credential headers the caller/SDK attached (incl. the OAuth bearer) and drop
+ * the static headers — mirroring how a browser drops `Authorization` across
+ * origins, so a redirect can't exfiltrate a token.
+ */
+export declare function applyCredentialGate(rawHeaders: ConstructorParameters<typeof Headers>[0], sameOrigin: boolean, staticHeaders?: Record<string, string>): Headers;

package/dist/util/headers.js

@@ -0,0 +1,49 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Parse repeated `--header "Name: Value"` CLI arguments into a header map.
+ * Used to authenticate against protected remote MCP endpoints (e.g. a Bearer
+ * token). Kept pure and separate from the CLI entrypoint so it stays testable.
+ */
+export function parseHeaderArgs(items) {
+    if (!items || items.length === 0)
+        return undefined;
+    const out = {};
+    for (const raw of items) {
+        const item = raw.trim();
+        const idx = item.indexOf(':');
+        if (idx <= 0)
+            throw new Error(`Invalid --header "${raw}" — expected "Name: Value".`);
+        const name = item.slice(0, idx).trim();
+        const value = item.slice(idx + 1).trim();
+        if (!name)
+            throw new Error(`Invalid --header "${raw}" — empty header name.`);
+        out[name] = value;
+    }
+    return out;
+}
+/** Credential headers that must never cross an origin boundary on a redirect. */
+const CREDENTIAL_HEADERS = ['authorization', 'cookie', 'proxy-authorization', 'mcp-session-id'];
+/**
+ * Contain credentials to the target origin. On the target origin, keep the
+ * request's own headers and add any static `--header`s. On any OTHER origin
+ * (cross-host redirect, https→http downgrade, different port), strip the
+ * credential headers the caller/SDK attached (incl. the OAuth bearer) and drop
+ * the static headers — mirroring how a browser drops `Authorization` across
+ * origins, so a redirect can't exfiltrate a token.
+ */
+export function applyCredentialGate(rawHeaders, sameOrigin, staticHeaders) {
+    const headers = new Headers(rawHeaders);
+    if (sameOrigin) {
+        if (staticHeaders)
+            for (const [k, v] of Object.entries(staticHeaders))
+                headers.set(k, v);
+    }
+    else {
+        for (const h of CREDENTIAL_HEADERS)
+            headers.delete(h);
+        if (staticHeaders)
+            for (const k of Object.keys(staticHeaders))
+                headers.delete(k);
+    }
+    return headers;
+}

package/dist/version.d.ts

@@ -1,6 +1,6 @@
 /*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
 /** Package version. Keep in sync with package.json. */
-export declare const TOOL_VERSION = "1.0.0";
+export declare const TOOL_VERSION = "1.1.0";
 /**
  * Methodology version. Bump this whenever scoring weights, gates, rule
  * severities, or bundled threat data change in a way that could move a score.

package/dist/version.js

@@ -1,6 +1,6 @@
 /*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
 /** Package version. Keep in sync with package.json. */
-export const TOOL_VERSION = '1.0.0';
+export const TOOL_VERSION = '1.1.0';
 /**
  * Methodology version. Bump this whenever scoring weights, gates, rule
  * severities, or bundled threat data change in a way that could move a score.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcptrustchecker",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Local-first, deterministic security scanner for Model Context Protocol (MCP) servers. Cross-tool toxic-flow analysis, Unicode-smuggling decode, prompt-injection & supply-chain detection, with an auditable 0–100 Trust Score.",
   "type": "module",
   "license": "MIT",
@@ -51,7 +51,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "node --import tsx --test \"test/**/*.test.ts\"",
+    "test": "node scripts/run-tests.mjs",
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run clean && npm run build",
     "scan:self": "tsx src/cli/index.ts scan test/fixtures/clean-server.json",