mcptrustchecker 1.0.0 → 1.2.0

package/dist/lockfile.js

@@ -14,6 +14,15 @@ import { METHODOLOGY_VERSION } from './version.js';
 function hashString(s) {
     return createHash('sha256').update(s).digest('hex');
 }
+/** The artifact's file name (last path segment, query/fragment stripped). */
+function artifactBasename(url) {
+    try {
+        return new URL(url).pathname.split('/').pop() ?? url;
+    }
+    catch {
+        return url.split(/[?#]/)[0].split('/').pop() ?? url;
+    }
+}
 export function emptyLockfile() {
     return { lockfileVersion: 1, methodologyVersion: METHODOLOGY_VERSION, servers: {} };
 }
@@ -35,19 +44,37 @@ export function entryFor(surface, pinnedAt) {
     const tools = {};
     for (const t of surface.tools)
         tools[t.name] = toolDigest(t);
+    const meta = surface.packageMeta;
     return {
         digest: surfaceDigest(surface),
         tools,
         instructionsDigest: hashString(surface.server.instructions ?? ''),
+        ...(typeof meta?.version === 'string' && meta.tarballSha256
+            ? { packageVersion: meta.version, tarballUrl: meta.tarballUrl ?? undefined, tarballSha256: meta.tarballSha256 }
+            : {}),
         ...(pinnedAt ? { pinnedAt } : {}),
     };
 }
 /** Add/update this surface's pin in the lockfile (returns a new object). */
 export function pinSurface(lock, surface, pinnedAt) {
+    const entry = entryFor(surface, pinnedAt);
+    // Never DROP an existing byte-level pin unless this scan positively verified a
+    // DIFFERENT version. An offline / metadata-only / failed-download re-pin has no
+    // fresh hash (and often no observed version at all) — carrying the previous pin
+    // forward keeps rug-pull protection alive rather than silently un-pinning it on
+    // a networkless CI re-pin or a transient outage.
+    const prev = lock.servers[surface.id];
+    const observedVersion = surface.packageMeta?.version;
+    const versionChanged = Boolean(observedVersion && prev?.packageVersion && observedVersion !== prev.packageVersion);
+    if (!entry.tarballSha256 && prev?.tarballSha256 && !versionChanged) {
+        entry.packageVersion = prev.packageVersion;
+        entry.tarballUrl = prev.tarballUrl;
+        entry.tarballSha256 = prev.tarballSha256;
+    }
     return {
         ...lock,
         methodologyVersion: METHODOLOGY_VERSION,
-        servers: { ...lock.servers, [surface.id]: entryFor(surface, pinnedAt) },
+        servers: { ...lock.servers, [surface.id]: entry },
     };
 }
 /** Compare the current surface against its pinned entry. */
@@ -56,7 +83,40 @@ export function checkIntegrity(surface, lock) {
     const entry = lock?.servers[surface.id];
     if (!entry)
         return { status: 'first-seen', currentDigest };
-    if (entry.digest === currentDigest)
+    // Byte-level rug pull: the SAME pinned version was republished with different
+    // content. The tool surface (and therefore the digest) may be identical —
+    // that is exactly what makes this attack invisible to a metadata-only check.
+    //
+    // Artifact identity is registry-aware, because the tarball URL comes from the
+    // (attacker-controllable) registry response and MUST NOT be trusted to gate
+    // the comparison:
+    //   • npm — a version maps to exactly ONE canonical tarball, so we compare by
+    //     VERSION only and ignore the URL entirely. That defeats a forged registry
+    //     that appends `?rev=2` (or any different path) to dodge the check.
+    //   • PyPI — a version legitimately has several immutable, differently-named
+    //     files (sdist + wheels), so we compare by the artifact FILE NAME (query
+    //     stripped) to avoid a false republish when a sibling file is added, while
+    //     still catching a same-file byte change (PyPI enforces file immutability,
+    //     so a same-name/different-bytes swap is itself the anomaly).
+    const meta = surface.packageMeta;
+    // Require a STRING version on both sides: a non-primitive `meta.version`
+    // (a hostile registry can make it an array/object) would never compare equal
+    // after the lockfile's JSON round-trip, silently suppressing the byte check.
+    const sameVersion = Boolean(typeof meta?.version === 'string' && meta.version === entry.packageVersion);
+    const sameArtifact = sameVersion &&
+        (meta?.registry !== 'pypi' ||
+            !entry.tarballUrl ||
+            !meta?.tarballUrl ||
+            artifactBasename(entry.tarballUrl) === artifactBasename(meta.tarballUrl));
+    const tarballChange = entry.tarballSha256 && entry.packageVersion && meta?.tarballSha256 && sameArtifact && meta.tarballSha256 !== entry.tarballSha256
+        ? {
+            kind: 'package-changed',
+            name: meta.name,
+            detail: `Version ${meta.version} was republished with different content: the verified artifact hash changed ` +
+                `from ${entry.tarballSha256.slice(0, 12)}… to ${meta.tarballSha256.slice(0, 12)}… since the pin (same version, different bytes).`,
+        }
+        : undefined;
+    if (entry.digest === currentDigest && !tarballChange)
         return { status: 'unchanged', currentDigest, previousDigest: entry.digest };
     const changes = [];
     const currentTools = {};
@@ -83,5 +143,7 @@ export function checkIntegrity(surface, lock) {
     if (entry.instructionsDigest !== hashString(surface.server.instructions ?? '')) {
         changes.push({ kind: 'instructions-changed', detail: 'Server instructions changed since the pin.' });
     }
+    if (tarballChange)
+        changes.push(tarballChange);
     return { status: 'drift', currentDigest, previousDigest: entry.digest, changes };
 }

package/dist/types.d.ts

@@ -102,6 +102,28 @@ export interface PackageMeta {
     pinned?: boolean;
     /** The raw version token from the install spec, if any (e.g. "latest", "^1.2.0"). */
     requestedSpec?: string;
+    /**
+     * True when an EXACT pinned version was requested but the registry does not
+     * list it (unpublished, yanked, or hidden by a hostile registry response). The
+     * artifact is deliberately left unresolved rather than silently substituting
+     * `latest`, and a finding is raised.
+     */
+    requestedVersionMissing?: boolean;
+    /** URL of the published artifact (npm dist.tarball / PyPI sdist or wheel). */
+    tarballUrl?: string | null;
+    /** Registry-declared artifact hash: SRI (`sha512-<b64>`) or `<algo>:<hex>`. */
+    tarballIntegrity?: string | null;
+    /** SHA-256 (hex) of the verified artifact the scan actually read — the byte-level pin. */
+    tarballSha256?: string;
+    /**
+     * Set when an `--online` artifact read was attempted but did not complete.
+     * `integrity`/`untrusted-redirect` are tamper evidence (a detector raises a
+     * finding); `network`/`other` mean the byte check simply could not run.
+     */
+    artifactError?: {
+        kind: 'integrity' | 'untrusted-redirect' | 'network' | 'other';
+        detail: string;
+    };
 }
 /** The single normalized object every detector operates on. */
 export interface ServerSurface {
@@ -237,7 +259,7 @@ export interface Score {
 }
 export type IntegrityStatus = 'first-seen' | 'unchanged' | 'drift';
 export interface SurfaceChange {
-    kind: 'tool-added' | 'tool-removed' | 'tool-changed' | 'instructions-changed';
+    kind: 'tool-added' | 'tool-removed' | 'tool-changed' | 'instructions-changed' | 'package-changed';
     name?: string;
     detail: string;
 }

package/dist/util/headers.d.ts

@@ -0,0 +1,16 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Parse repeated `--header "Name: Value"` CLI arguments into a header map.
+ * Used to authenticate against protected remote MCP endpoints (e.g. a Bearer
+ * token). Kept pure and separate from the CLI entrypoint so it stays testable.
+ */
+export declare function parseHeaderArgs(items?: string[]): Record<string, string> | undefined;
+/**
+ * Contain credentials to the target origin. On the target origin, keep the
+ * request's own headers and add any static `--header`s. On any OTHER origin
+ * (cross-host redirect, https→http downgrade, different port), strip the
+ * credential headers the caller/SDK attached (incl. the OAuth bearer) and drop
+ * the static headers — mirroring how a browser drops `Authorization` across
+ * origins, so a redirect can't exfiltrate a token.
+ */
+export declare function applyCredentialGate(rawHeaders: ConstructorParameters<typeof Headers>[0], sameOrigin: boolean, staticHeaders?: Record<string, string>): Headers;

package/dist/util/headers.js

@@ -0,0 +1,49 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Parse repeated `--header "Name: Value"` CLI arguments into a header map.
+ * Used to authenticate against protected remote MCP endpoints (e.g. a Bearer
+ * token). Kept pure and separate from the CLI entrypoint so it stays testable.
+ */
+export function parseHeaderArgs(items) {
+    if (!items || items.length === 0)
+        return undefined;
+    const out = {};
+    for (const raw of items) {
+        const item = raw.trim();
+        const idx = item.indexOf(':');
+        if (idx <= 0)
+            throw new Error(`Invalid --header "${raw}" — expected "Name: Value".`);
+        const name = item.slice(0, idx).trim();
+        const value = item.slice(idx + 1).trim();
+        if (!name)
+            throw new Error(`Invalid --header "${raw}" — empty header name.`);
+        out[name] = value;
+    }
+    return out;
+}
+/** Credential headers that must never cross an origin boundary on a redirect. */
+const CREDENTIAL_HEADERS = ['authorization', 'cookie', 'proxy-authorization', 'mcp-session-id'];
+/**
+ * Contain credentials to the target origin. On the target origin, keep the
+ * request's own headers and add any static `--header`s. On any OTHER origin
+ * (cross-host redirect, https→http downgrade, different port), strip the
+ * credential headers the caller/SDK attached (incl. the OAuth bearer) and drop
+ * the static headers — mirroring how a browser drops `Authorization` across
+ * origins, so a redirect can't exfiltrate a token.
+ */
+export function applyCredentialGate(rawHeaders, sameOrigin, staticHeaders) {
+    const headers = new Headers(rawHeaders);
+    if (sameOrigin) {
+        if (staticHeaders)
+            for (const [k, v] of Object.entries(staticHeaders))
+                headers.set(k, v);
+    }
+    else {
+        for (const h of CREDENTIAL_HEADERS)
+            headers.delete(h);
+        if (staticHeaders)
+            for (const k of Object.keys(staticHeaders))
+                headers.delete(k);
+    }
+    return headers;
+}

package/dist/version.d.ts

@@ -1,6 +1,6 @@
 /*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
 /** Package version. Keep in sync with package.json. */
-export declare const TOOL_VERSION = "1.0.0";
+export declare const TOOL_VERSION = "1.2.0";
 /**
  * Methodology version. Bump this whenever scoring weights, gates, rule
  * severities, or bundled threat data change in a way that could move a score.

package/dist/version.js

@@ -1,6 +1,6 @@
 /*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
 /** Package version. Keep in sync with package.json. */
-export const TOOL_VERSION = '1.0.0';
+export const TOOL_VERSION = '1.2.0';
 /**
  * Methodology version. Bump this whenever scoring weights, gates, rule
  * severities, or bundled threat data change in a way that could move a score.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcptrustchecker",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Local-first, deterministic security scanner for Model Context Protocol (MCP) servers. Cross-tool toxic-flow analysis, Unicode-smuggling decode, prompt-injection & supply-chain detection, with an auditable 0–100 Trust Score.",
   "type": "module",
   "license": "MIT",
@@ -51,7 +51,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "node --import tsx --test \"test/**/*.test.ts\"",
+    "test": "node scripts/run-tests.mjs",
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run clean && npm run build",
     "scan:self": "tsx src/cli/index.ts scan test/fixtures/clean-server.json",