mcptrustchecker 1.0.0

package/dist/util/ansi.js

@@ -0,0 +1,42 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Tiny zero-dependency ANSI helper. Respects NO_COLOR and non-TTY output.
+ * A security tool should not pull a coloring library into its dependency tree.
+ */
+const enabled = (() => {
+    if (process.env.NO_COLOR !== undefined)
+        return false;
+    if (process.env.FORCE_COLOR !== undefined && process.env.FORCE_COLOR !== '0')
+        return true;
+    return Boolean(process.stdout.isTTY);
+})();
+function wrap(open, close) {
+    return (s) => (enabled ? `[${open}m${s}[${close}m` : s);
+}
+export const c = {
+    enabled,
+    bold: wrap(1, 22),
+    dim: wrap(2, 22),
+    underline: wrap(4, 24),
+    red: wrap(31, 39),
+    green: wrap(32, 39),
+    yellow: wrap(33, 39),
+    blue: wrap(34, 39),
+    magenta: wrap(35, 39),
+    cyan: wrap(36, 39),
+    gray: wrap(90, 39),
+    white: wrap(37, 39),
+    bgRed: wrap(41, 49),
+    bgGreen: wrap(42, 49),
+    bgYellow: wrap(43, 49),
+};
+/** Visible length of a string, ignoring ANSI escapes. */
+export function visibleLength(s) {
+    // eslint-disable-next-line no-control-regex
+    return s.replace(/\[[0-9;]*m/g, '').length;
+}
+/** Pad a (possibly colored) string to a visible width. */
+export function padVisible(s, width) {
+    const pad = Math.max(0, width - visibleLength(s));
+    return s + ' '.repeat(pad);
+}

package/dist/util/capabilities.d.ts

@@ -0,0 +1,17 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Capability extraction: derive each tool's roles (untrusted-input,
+ * sensitive-source, external-sink, code-exec, file-write) from its name,
+ * description verbs, and parameter shape. This is the substrate the toxic-flow
+ * graph runs over. It is deliberately derived from behavior, never from the
+ * server's self-declared `annotations` (which are untrusted).
+ */
+import type { CapabilityTag, ResolvedConfig, ServerSurface, ToolCapability, ToolDef } from '../types.js';
+/** Extract capability tags + evidence for a single tool. */
+export declare function extractToolCapability(tool: ToolDef): ToolCapability;
+/** Extract capabilities for every tool in a surface (non-object tools skipped). */
+export declare function extractCapabilities(surface: ServerSurface, _config: ResolvedConfig): ToolCapability[];
+/** Tags that can act as an exfiltration/impact sink. */
+export declare const SINK_TAGS: CapabilityTag[];
+/** True if a capability set can serve as an external sink. */
+export declare function isSink(tags: CapabilityTag[]): boolean;

package/dist/util/capabilities.js

@@ -0,0 +1,68 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Capability extraction: derive each tool's roles (untrusted-input,
+ * sensitive-source, external-sink, code-exec, file-write) from its name,
+ * description verbs, and parameter shape. This is the substrate the toxic-flow
+ * graph runs over. It is deliberately derived from behavior, never from the
+ * server's self-declared `annotations` (which are untrusted).
+ */
+import { CAPABILITY_SIGNALS, PARAM_NAME_SIGNALS } from '../data/capabilityLexicon.js';
+import { normalizeForMatch } from './text.js';
+function tokenize(text) {
+    return new Set(normalizeForMatch(text).split(' ').filter(Boolean));
+}
+function keywordMatches(haystack, tokens, keyword) {
+    const k = normalizeForMatch(keyword);
+    if (k.includes(' '))
+        return haystack.includes(k);
+    return tokens.has(k);
+}
+function paramNames(tool) {
+    const props = tool.inputSchema?.properties;
+    if (!props)
+        return [];
+    return Object.keys(props);
+}
+/** Extract capability tags + evidence for a single tool. */
+export function extractToolCapability(tool) {
+    const name = typeof tool?.name === 'string' ? tool.name : '';
+    const desc = typeof tool?.description === 'string' ? tool.description : '';
+    const haystack = normalizeForMatch(`${name} ${desc}`);
+    const tokens = tokenize(`${name} ${desc}`);
+    const reasons = {};
+    const tags = new Set();
+    const addReason = (tag, why) => {
+        tags.add(tag);
+        (reasons[tag] ??= []).push(why);
+    };
+    for (const sig of CAPABILITY_SIGNALS) {
+        for (const kw of sig.keywords) {
+            if (keywordMatches(haystack, tokens, kw)) {
+                addReason(sig.tag, `keyword "${kw}"`);
+                break; // one reason per signal is enough
+            }
+        }
+    }
+    const pnames = paramNames(tool).map((n) => n.toLowerCase());
+    const pTokens = new Set(pnames.flatMap((n) => n.split(/[^a-z0-9]+/i).filter(Boolean)));
+    for (const sig of PARAM_NAME_SIGNALS) {
+        for (const pn of sig.names) {
+            if (pTokens.has(pn)) {
+                addReason(sig.tag, `parameter "${pn}"`);
+                break;
+            }
+        }
+    }
+    return { tool: name, tags: [...tags], reasons };
+}
+/** Extract capabilities for every tool in a surface (non-object tools skipped). */
+export function extractCapabilities(surface, _config) {
+    const tools = Array.isArray(surface.tools) ? surface.tools : [];
+    return tools.filter((t) => Boolean(t) && typeof t === 'object').map(extractToolCapability);
+}
+/** Tags that can act as an exfiltration/impact sink. */
+export const SINK_TAGS = ['external-sink', 'code-exec'];
+/** True if a capability set can serve as an external sink. */
+export function isSink(tags) {
+    return tags.some((t) => SINK_TAGS.includes(t));
+}

package/dist/util/distance.d.ts

@@ -0,0 +1,23 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * String-distance & version helpers for the supply-chain and posture stages.
+ * All pure and dependency-free.
+ */
+/**
+ * Damerau-Levenshtein (optimal string alignment) edit distance. Counts
+ * insertions, deletions, substitutions and adjacent transpositions each as 1.
+ * `swap` counting is what makes "sdk" vs "sdck"-style transposes cost 1.
+ */
+export declare function damerauLevenshtein(a: string, b: string): number;
+/** True if two single chars are physically adjacent on a QWERTY keyboard. */
+export declare function isKeyboardAdjacent(a: string, b: string): boolean;
+/**
+ * True when `candidate` differs from `target` by exactly one substitution and
+ * that substitution is a keyboard-adjacent slip (a classic typo, distinct from
+ * a deliberate homoglyph swap).
+ */
+export declare function isKeyboardTypo(candidate: string, target: string): boolean;
+/** Compare two versions. Returns -1 if a<b, 0 if equal, 1 if a>b. */
+export declare function compareVersions(a: string, b: string): number;
+/** Strip an npm scope, returning the bare package name. */
+export declare function bareName(pkg: string): string;

package/dist/util/distance.js

@@ -0,0 +1,119 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * String-distance & version helpers for the supply-chain and posture stages.
+ * All pure and dependency-free.
+ */
+/**
+ * Damerau-Levenshtein (optimal string alignment) edit distance. Counts
+ * insertions, deletions, substitutions and adjacent transpositions each as 1.
+ * `swap` counting is what makes "sdk" vs "sdck"-style transposes cost 1.
+ */
+export function damerauLevenshtein(a, b) {
+    const al = a.length;
+    const bl = b.length;
+    if (al === 0)
+        return bl;
+    if (bl === 0)
+        return al;
+    const d = Array.from({ length: al + 1 }, () => new Array(bl + 1).fill(0));
+    for (let i = 0; i <= al; i++)
+        d[i][0] = i;
+    for (let j = 0; j <= bl; j++)
+        d[0][j] = j;
+    for (let i = 1; i <= al; i++) {
+        for (let j = 1; j <= bl; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            let val = Math.min(d[i - 1][j] + 1, // deletion
+            d[i][j - 1] + 1, // insertion
+            d[i - 1][j - 1] + cost);
+            if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+                val = Math.min(val, d[i - 2][j - 2] + 1); // transposition
+            }
+            d[i][j] = val;
+        }
+    }
+    return d[al][bl];
+}
+/** QWERTY physical-adjacency map (lowercase). */
+const QWERTY_ADJ = {
+    q: 'wa',
+    w: 'qeas',
+    e: 'wrsd',
+    r: 'etdf',
+    t: 'ryfg',
+    y: 'tugh',
+    u: 'yihj',
+    i: 'uojk',
+    o: 'ipkl',
+    p: 'ol',
+    a: 'qwsz',
+    s: 'awedxz',
+    d: 'serfcx',
+    f: 'drtgvc',
+    g: 'ftyhbv',
+    h: 'gyujnb',
+    j: 'huikmn',
+    k: 'jiolm',
+    l: 'kop',
+    z: 'asx',
+    x: 'zsdc',
+    c: 'xdfv',
+    v: 'cfgb',
+    b: 'vghn',
+    n: 'bhjm',
+    m: 'njk',
+};
+/** True if two single chars are physically adjacent on a QWERTY keyboard. */
+export function isKeyboardAdjacent(a, b) {
+    return (QWERTY_ADJ[a.toLowerCase()] ?? '').includes(b.toLowerCase());
+}
+/**
+ * True when `candidate` differs from `target` by exactly one substitution and
+ * that substitution is a keyboard-adjacent slip (a classic typo, distinct from
+ * a deliberate homoglyph swap).
+ */
+export function isKeyboardTypo(candidate, target) {
+    if (candidate.length !== target.length)
+        return false;
+    let diffs = 0;
+    let adjacent = false;
+    for (let i = 0; i < candidate.length; i++) {
+        if (candidate[i] !== target[i]) {
+            diffs += 1;
+            adjacent = isKeyboardAdjacent(candidate[i], target[i]);
+            if (diffs > 1)
+                return false;
+        }
+    }
+    return diffs === 1 && adjacent;
+}
+/** Parse a dotted version into numeric segments (non-numeric parts → 0). */
+function parseVersion(v) {
+    return v
+        .replace(/^[v=]/, '')
+        .split(/[.+-]/)
+        .map((s) => {
+        const n = Number.parseInt(s, 10);
+        return Number.isNaN(n) ? 0 : n;
+    });
+}
+/** Compare two versions. Returns -1 if a<b, 0 if equal, 1 if a>b. */
+export function compareVersions(a, b) {
+    const pa = parseVersion(a);
+    const pb = parseVersion(b);
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+        const x = pa[i] ?? 0;
+        const y = pb[i] ?? 0;
+        if (x < y)
+            return -1;
+        if (x > y)
+            return 1;
+    }
+    return 0;
+}
+/** Strip an npm scope, returning the bare package name. */
+export function bareName(pkg) {
+    const slash = pkg.indexOf('/');
+    return pkg.startsWith('@') && slash >= 0 ? pkg.slice(slash + 1) : pkg;
+}

package/dist/util/hash.d.ts

@@ -0,0 +1,20 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Canonicalization & hashing for the rug-pull (TOFU) integrity fingerprint.
+ *
+ * Trust binds to *content*, not to a name (the MCPoison lesson). We therefore
+ * hash the full canonicalized tool surface — name + description + full schema +
+ * annotations + the spawn command — so any silent redefinition changes the
+ * digest and is caught on rescan.
+ */
+import type { ServerSurface, ToolDef } from '../types.js';
+/** Deterministic JSON: object keys sorted recursively. */
+export declare function stableStringify(value: unknown): string;
+/** Canonical per-tool projection used for both the digest and drift diffs. */
+export declare function canonicalTool(tool: ToolDef): Record<string, unknown>;
+/** The canonical, security-relevant projection of a whole surface. */
+export declare function canonicalSurface(surface: ServerSurface): Record<string, unknown>;
+/** SHA-256 over the canonical surface — the rug-pull fingerprint. */
+export declare function surfaceDigest(surface: ServerSurface): string;
+/** SHA-256 over a single canonical tool (used to diff which tools changed). */
+export declare function toolDigest(tool: ToolDef): string;

package/dist/util/hash.js

@@ -0,0 +1,80 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Canonicalization & hashing for the rug-pull (TOFU) integrity fingerprint.
+ *
+ * Trust binds to *content*, not to a name (the MCPoison lesson). We therefore
+ * hash the full canonicalized tool surface — name + description + full schema +
+ * annotations + the spawn command — so any silent redefinition changes the
+ * digest and is caught on rescan.
+ */
+import { createHash } from 'node:crypto';
+/** Deterministic JSON: object keys sorted recursively. */
+export function stableStringify(value) {
+    return JSON.stringify(sortDeep(value, 0, new WeakSet()));
+}
+// Bound the recursion so a hostile, deeply-nested schema can't overflow the
+// stack during hashing. 200 is far beyond any legitimate JSON-Schema depth.
+const MAX_HASH_DEPTH = 200;
+function sortDeep(value, depth, seen) {
+    if (depth > MAX_HASH_DEPTH)
+        return '__mcptrustchecker_truncated__';
+    if (value && typeof value === 'object') {
+        // A shared subtree (DAG) would otherwise expand exponentially even under the
+        // depth cap — visit each node once.
+        if (seen.has(value))
+            return '__mcptrustchecker_cycle__';
+        seen.add(value);
+    }
+    if (Array.isArray(value))
+        return value.map((v) => sortDeep(v, depth + 1, seen));
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            out[key] = sortDeep(value[key], depth + 1, seen);
+        }
+        return out;
+    }
+    return value;
+}
+/** Canonical per-tool projection used for both the digest and drift diffs. */
+export function canonicalTool(tool) {
+    return {
+        name: typeof tool.name === 'string' ? tool.name : String(tool.name ?? ''),
+        description: typeof tool.description === 'string' ? tool.description : '',
+        inputSchema: tool.inputSchema ?? null,
+        outputSchema: tool.outputSchema ?? null,
+        annotations: tool.annotations ?? null,
+    };
+}
+/** The canonical, security-relevant projection of a whole surface. */
+export function canonicalSurface(surface) {
+    const tools = (Array.isArray(surface.tools) ? [...surface.tools] : [])
+        .filter((t) => Boolean(t) && typeof t === 'object')
+        // Code-unit sort, NOT localeCompare — ICU collation is locale-dependent, so
+        // the same tool set could canonicalize differently on two machines and raise
+        // a false rug-pull DRIFT. This must be byte-reproducible everywhere.
+        .sort((a, b) => {
+        const x = String(a.name ?? '');
+        const y = String(b.name ?? '');
+        return x < y ? -1 : x > y ? 1 : 0;
+    })
+        .map(canonicalTool);
+    return {
+        server: {
+            name: surface.server.name ?? '',
+            instructions: surface.server.instructions ?? '',
+        },
+        tools,
+        transport: surface.transport
+            ? { kind: surface.transport.kind, command: surface.transport.command ?? '', args: surface.transport.args ?? [] }
+            : null,
+    };
+}
+/** SHA-256 over the canonical surface — the rug-pull fingerprint. */
+export function surfaceDigest(surface) {
+    return createHash('sha256').update(stableStringify(canonicalSurface(surface))).digest('hex');
+}
+/** SHA-256 over a single canonical tool (used to diff which tools changed). */
+export function toolDigest(tool) {
+    return createHash('sha256').update(stableStringify(canonicalTool(tool))).digest('hex');
+}

package/dist/util/text.d.ts

@@ -0,0 +1,45 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Text extraction & normalization helpers shared by the lexical detectors.
+ * The point of `collectTextFields` is that every human/LLM-facing string in the
+ * surface is scanned uniformly, each carrying a precise location so findings can
+ * point at exactly which field is poisoned.
+ */
+import type { FindingLocation, JsonSchema, ServerSurface } from '../types.js';
+import { INJECTION_PATTERNS } from '../data/injectionPatterns.js';
+export interface TextField {
+    text: string;
+    location: FindingLocation;
+    /** Which injection channel this field belongs to. */
+    channel: 'tool-description' | 'param-description' | 'server-instructions' | 'other';
+}
+/** Walk an inputSchema collecting every `description` string with a JSON path. */
+export declare function collectSchemaStrings(schema: JsonSchema | undefined, basePath: string): {
+    path: string;
+    text: string;
+}[];
+/**
+ * Collect every scannable text field across the whole surface. Defensive: only
+ * string values are emitted and non-object tools/prompts/resources are skipped,
+ * so a caller that hands us a hand-built (unnormalized) surface — or a live
+ * server returning junk — can never crash a text detector.
+ */
+export declare function collectTextFields(surface: ServerSurface): TextField[];
+/** Lowercased text with punctuation collapsed to spaces, for keyword matching. */
+export declare function normalizeForMatch(text: string): string;
+/** Count the longest run of consecutive shouted words (excluding tech acronyms). */
+export declare function longestAllCapsRun(text: string): number;
+/**
+ * Detect a long base64-looking blob (potential encoded payload). Deliberately
+ * rejects pure-hex runs (git SHAs, dash-stripped UUIDs, account/hex IDs) and
+ * requires genuine base64 shape (a padding/base64 symbol, or real mixed case
+ * with digits), so ordinary identifiers in descriptions don't misfire.
+ */
+export declare function hasBase64Blob(text: string): boolean;
+/** Re-export the compiled injection patterns as case-insensitive/global regexes. */
+export declare function compiledInjectionPatterns(): {
+    id: string;
+    kind: string;
+    regex: RegExp;
+    meta: (typeof INJECTION_PATTERNS)[number];
+}[];

package/dist/util/text.js

@@ -0,0 +1,170 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Text extraction & normalization helpers shared by the lexical detectors.
+ * The point of `collectTextFields` is that every human/LLM-facing string in the
+ * surface is scanned uniformly, each carrying a precise location so findings can
+ * point at exactly which field is poisoned.
+ */
+import { INJECTION_PATTERNS } from '../data/injectionPatterns.js';
+/** Walk an inputSchema collecting every `description` string with a JSON path. */
+export function collectSchemaStrings(schema, basePath) {
+    const out = [];
+    if (!schema || typeof schema !== 'object')
+        return out;
+    // Depth cap: an untrusted manifest can nest `properties`/`items` arbitrarily
+    // deep; bound the recursion so a hostile schema can't overflow the stack.
+    const MAX_DEPTH = 64;
+    const visit = (node, path, depth) => {
+        if (!node || typeof node !== 'object' || depth > MAX_DEPTH)
+            return;
+        if (typeof node.description === 'string' && node.description.length > 0) {
+            out.push({ path: `${path}.description`, text: node.description });
+        }
+        if (typeof node.title === 'string' && node.title.length > 0) {
+            out.push({ path: `${path}.title`, text: node.title });
+        }
+        if (Array.isArray(node.enum)) {
+            for (const [i, v] of node.enum.entries()) {
+                if (typeof v === 'string')
+                    out.push({ path: `${path}.enum[${i}]`, text: v });
+            }
+        }
+        if (node.properties) {
+            for (const [key, child] of Object.entries(node.properties)) {
+                visit(child, `${path}.properties.${key}`, depth + 1);
+            }
+        }
+        if (node.items && !Array.isArray(node.items))
+            visit(node.items, `${path}.items`, depth + 1);
+        if (Array.isArray(node.items))
+            node.items.forEach((it, i) => visit(it, `${path}.items[${i}]`, depth + 1));
+    };
+    visit(schema, basePath, 0);
+    return out;
+}
+function isObj(v) {
+    return Boolean(v) && typeof v === 'object' && !Array.isArray(v);
+}
+/**
+ * Collect every scannable text field across the whole surface. Defensive: only
+ * string values are emitted and non-object tools/prompts/resources are skipped,
+ * so a caller that hands us a hand-built (unnormalized) surface — or a live
+ * server returning junk — can never crash a text detector.
+ */
+export function collectTextFields(surface) {
+    const fields = [];
+    // Cap each field's length: a legit MCP description is never this long, and an
+    // uncapped multi-MB field is a DoS vector for the text detectors' regexes.
+    const MAX_FIELD = 100_000;
+    const add = (text, location, channel) => {
+        if (typeof text === 'string' && text.length > 0) {
+            fields.push({ text: text.length > MAX_FIELD ? text.slice(0, MAX_FIELD) : text, location, channel });
+        }
+    };
+    add(surface.server?.name, { kind: 'server', field: 'name' }, 'other');
+    add(surface.server?.instructions, { kind: 'server', field: 'instructions' }, 'server-instructions');
+    for (const tool of Array.isArray(surface.tools) ? surface.tools : []) {
+        if (!isObj(tool))
+            continue;
+        const name = typeof tool.name === 'string' ? tool.name : undefined;
+        add(tool.name, { kind: 'tool', name, field: 'name' }, 'other');
+        add(tool.title, { kind: 'tool', name, field: 'title' }, 'tool-description');
+        add(tool.description, { kind: 'tool', name, field: 'description' }, 'tool-description');
+        for (const s of collectSchemaStrings(tool.inputSchema, 'inputSchema')) {
+            add(s.text, { kind: 'tool', name, field: s.path }, 'param-description');
+        }
+    }
+    for (const prompt of Array.isArray(surface.prompts) ? surface.prompts : []) {
+        if (!isObj(prompt))
+            continue;
+        const name = typeof prompt.name === 'string' ? prompt.name : undefined;
+        add(prompt.description, { kind: 'prompt', name, field: 'description' }, 'tool-description');
+        for (const arg of Array.isArray(prompt.arguments) ? prompt.arguments : []) {
+            if (isObj(arg))
+                add(arg.description, { kind: 'prompt', name, field: `arguments.${String(arg.name)}.description` }, 'param-description');
+        }
+    }
+    for (const res of Array.isArray(surface.resources) ? surface.resources : []) {
+        if (!isObj(res))
+            continue;
+        const name = typeof res.name === 'string' ? res.name : typeof res.uri === 'string' ? res.uri : undefined;
+        add(res.description, { kind: 'resource', name, field: 'description' }, 'tool-description');
+    }
+    return fields;
+}
+/** Lowercased text with punctuation collapsed to spaces, for keyword matching. */
+export function normalizeForMatch(text) {
+    return text
+        .toLowerCase()
+        .replace(/[_\-./]+/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+// Common technical acronyms / HTTP verbs that are legitimately upper-case and
+// must not count toward a "shouting" run (e.g. "GET, POST, PUT, DELETE").
+const TECH_ACRONYMS = new Set([
+    'GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT',
+    'API', 'URL', 'URI', 'JSON', 'HTML', 'XML', 'CSV', 'YAML', 'SQL', 'HTTP', 'HTTPS',
+    'REST', 'RPC', 'GRPC', 'ID', 'UUID', 'UI', 'UX', 'OK', 'CRUD', 'JWT', 'CORS',
+    'CPU', 'GPU', 'RAM', 'PDF', 'PNG', 'JPG', 'GIF', 'SVG', 'TCP', 'UDP', 'DNS',
+    'SSH', 'TLS', 'SSL', 'AWS', 'GCP', 'IAM', 'S3', 'EC2', 'K8S', 'CI', 'CD', 'MCP',
+    'AND', 'OR', 'NOT', 'IN', 'IS', 'TODO', 'FIXME', 'NOTE', 'WARN', 'ISO', 'UTC',
+]);
+/** Count the longest run of consecutive shouted words (excluding tech acronyms). */
+export function longestAllCapsRun(text) {
+    if (typeof text !== 'string')
+        return 0;
+    const words = text.split(/\s+/);
+    let best = 0;
+    let run = 0;
+    for (const w of words) {
+        const letters = w.replace(/[^A-Za-z]/g, '');
+        if (letters.length >= 2 && letters === letters.toUpperCase() && !TECH_ACRONYMS.has(letters)) {
+            run += 1;
+            best = Math.max(best, run);
+        }
+        else {
+            run = 0;
+        }
+    }
+    return best;
+}
+/**
+ * Detect a long base64-looking blob (potential encoded payload). Deliberately
+ * rejects pure-hex runs (git SHAs, dash-stripped UUIDs, account/hex IDs) and
+ * requires genuine base64 shape (a padding/base64 symbol, or real mixed case
+ * with digits), so ordinary identifiers in descriptions don't misfire.
+ */
+export function hasBase64Blob(text) {
+    if (typeof text !== 'string')
+        return false;
+    // Bounded quantifier + input cap: an unbounded {24,} over a multi-MB run can
+    // overflow the regex engine's stack.
+    const t = text.length > 100_000 ? text.slice(0, 100_000) : text;
+    // Scan every candidate run (not just the first) so a genuine blob isn't masked
+    // by an earlier slash-separated word list appearing before it.
+    for (const m of t.matchAll(/(?:^|[^A-Za-z0-9+/])([A-Za-z0-9+/]{24,4096}={0,2})(?:[^A-Za-z0-9+/=]|$)/g)) {
+        const blob = m[1];
+        if (/^[0-9a-f]+$/i.test(blob))
+            continue; // pure hex → an ID, not base64
+        // `+` and `=` are prose-rare and a strong base64 signal. `/` alone is NOT —
+        // it is common in prose ("and/or", paths, slash-separated word lists like
+        // "methodology/results/structure"), so it must not qualify on its own.
+        const hasStrongSymbol = /[+=]/.test(blob);
+        // Without a strong symbol, require the high-entropy mix real encoded data has
+        // (lower + upper + digit). A slash-delimited word list is letters-only → excluded.
+        const mixedCaseDigits = /[a-z]/.test(blob) && /[A-Z]/.test(blob) && /[0-9]/.test(blob);
+        if (hasStrongSymbol || mixedCaseDigits)
+            return true;
+    }
+    return false;
+}
+/** Re-export the compiled injection patterns as case-insensitive/global regexes. */
+export function compiledInjectionPatterns() {
+    return INJECTION_PATTERNS.map((p) => ({
+        id: p.id,
+        kind: p.kind,
+        regex: new RegExp(p.pattern.source, 'gi'),
+        meta: p,
+    }));
+}

package/dist/version.d.ts

@@ -0,0 +1,13 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/** Package version. Keep in sync with package.json. */
+export declare const TOOL_VERSION = "1.0.0";
+/**
+ * Methodology version. Bump this whenever scoring weights, gates, rule
+ * severities, or bundled threat data change in a way that could move a score.
+ * The reproducibility contract is: same methodology version + same target ⇒
+ * identical Trust Score.
+ */
+export declare const METHODOLOGY_VERSION = "mcptrustchecker-1.0";
+/** Version of the bundled Unicode/confusables tables. */
+export declare const UNICODE_DATA_VERSION = "17.0.0";
+export declare const TOOL_NAME = "mcptrustchecker";

package/dist/version.js

@@ -0,0 +1,13 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/** Package version. Keep in sync with package.json. */
+export const TOOL_VERSION = '1.0.0';
+/**
+ * Methodology version. Bump this whenever scoring weights, gates, rule
+ * severities, or bundled threat data change in a way that could move a score.
+ * The reproducibility contract is: same methodology version + same target ⇒
+ * identical Trust Score.
+ */
+export const METHODOLOGY_VERSION = 'mcptrustchecker-1.0';
+/** Version of the bundled Unicode/confusables tables. */
+export const UNICODE_DATA_VERSION = '17.0.0';
+export const TOOL_NAME = 'mcptrustchecker';