mcptrustchecker 1.0.0

package/dist/cli/index.js

@@ -0,0 +1,396 @@
+#!/usr/bin/env node
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * MCP Trust Checker command-line interface.
+ *
+ *   mcptrustchecker scan <target>       scan a manifest / URL / package / client config
+ *   mcptrustchecker pin <target>        scan and (re)pin the integrity lockfile
+ *   mcptrustchecker diff <target>       fail if the surface drifted since the pin
+ *   mcptrustchecker rules               list every rule
+ *   mcptrustchecker explain <ruleId>    describe a rule
+ *   mcptrustchecker version | help
+ *
+ * Uses only Node built-ins (node:util parseArgs) — no arg-parsing dependency.
+ */
+import { parseArgs } from 'node:util';
+import { writeFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { resolveTargets } from '../acquire/index.js';
+import { discoverClientConfigs } from '../acquire/discover.js';
+import { scanSurface } from '../engine.js';
+import { loadConfigFile, loadConfigFromPath } from '../config.js';
+import { evaluatePolicy } from '../policy.js';
+import { readLockfile, writeLockfile, pinSurface, emptyLockfile } from '../lockfile.js';
+import { renderTerminal } from '../report/terminal.js';
+import { renderJson } from '../report/json.js';
+import { renderSarif } from '../report/sarif.js';
+import { renderMarkdown } from '../report/markdown.js';
+import { renderBadge } from '../report/badge.js';
+import { GRADE_RANK } from '../scoring/model.js';
+import { RULE_CATALOG, findRule } from '../data/ruleCatalog.js';
+import { METHODOLOGY_VERSION, TOOL_VERSION } from '../version.js';
+import { c } from '../util/ansi.js';
+const KNOWN_COMMANDS = new Set(['scan', 'pin', 'diff', 'rules', 'explain', 'version', 'help']);
+function fail(msg, code = 2) {
+    process.stderr.write(`${c.red('mcptrustchecker: error')} ${msg}\n`);
+    process.exit(code);
+}
+function printHelp() {
+    process.stdout.write(`${c.bold('MCP Trust Checker')} ${TOOL_VERSION} — local-first MCP security scanner (methodology ${METHODOLOGY_VERSION})
+
+${c.bold('Usage')}
+  mcptrustchecker                         scan every installed MCP client config (zero-config)
+  mcptrustchecker [scan] <target>         scan a specific target (see below)
+  mcptrustchecker pin <target>            scan and (re)pin the integrity lockfile
+  mcptrustchecker diff <target>           exit non-zero if the surface drifted since pin
+  mcptrustchecker rules                   list every rule
+  mcptrustchecker explain <ruleId>        describe a rule
+
+${c.bold('Targets')}
+  path/to/tools.json               a pre-generated manifest (offline)
+  https://host/mcp                 a live Streamable-HTTP / SSE endpoint
+  claude_desktop_config.json       a client config (scans each server)
+  @scope/package                   supply-chain / typosquat check (add --online for metadata)
+  --command "npx -y my-server"     spawn a local stdio server (sandboxed)
+  --env KEY=VALUE                  env var for --command (repeatable)
+
+${c.bold('Output')}
+  --json                           machine-readable JSON report
+  --sarif                          SARIF 2.1.0 (GitHub code scanning)
+  --md, --markdown                 Markdown (PR comments / summaries)
+  --badge                          shields.io endpoint JSON
+  -o, --output <file>              write output to a file
+
+${c.bold('CI gates')}
+  --fail-under <0-100>             exit 1 if the Trust Score is below N
+  --min-grade <A-F>                exit 1 if the grade is worse than this
+
+${c.bold('Options')}
+  --config <path>                  config file (default: auto-discovered)
+  --lockfile <path>                integrity lockfile (default: mcptrustchecker.lock)
+  --no-lock                        skip the integrity (rug-pull) check
+  --pin                            re-pin the lockfile after scanning
+  --include-builtins               assume client built-in tools in toxic-flow analysis
+  --online                         allow network lookups for package metadata
+  --run                            allow spawning servers found in a client config
+  --allow-any-command              permit stdio commands outside the allowlist (dangerous)
+  --allowed-hosts <a,b>            restrict live HTTP acquisition to these hosts
+  --registry <npm|pypi>            registry for bare package targets (default: npm)
+  --details                        include references and full evidence per finding
+  --no-pager                       don't page long output (also NO_PAGER / $PAGER)
+  --quiet                          only print the grade line
+  -h, --help                       show this help
+  -v, --version                    show version
+`);
+}
+async function main() {
+    let parsed;
+    try {
+        parsed = parseArgs({
+            allowPositionals: true,
+            options: {
+                json: { type: 'boolean' },
+                sarif: { type: 'boolean' },
+                md: { type: 'boolean' },
+                markdown: { type: 'boolean' },
+                badge: { type: 'boolean' },
+                output: { type: 'string', short: 'o' },
+                'fail-under': { type: 'string' },
+                'min-grade': { type: 'string' },
+                config: { type: 'string' },
+                lockfile: { type: 'string' },
+                'no-lock': { type: 'boolean' },
+                pin: { type: 'boolean' },
+                command: { type: 'string' },
+                args: { type: 'string' },
+                env: { type: 'string', multiple: true },
+                url: { type: 'string' },
+                online: { type: 'boolean' },
+                run: { type: 'boolean' },
+                'allow-any-command': { type: 'boolean' },
+                'allowed-hosts': { type: 'string' },
+                'include-builtins': { type: 'boolean' },
+                registry: { type: 'string' },
+                quiet: { type: 'boolean' },
+                details: { type: 'boolean' },
+                'no-pager': { type: 'boolean' },
+                help: { type: 'boolean', short: 'h' },
+                version: { type: 'boolean', short: 'v' },
+            },
+        });
+    }
+    catch (err) {
+        fail(`${err.message}. Run "mcptrustchecker --help" for usage.`);
+    }
+    const { values, positionals } = parsed;
+    if (values.version) {
+        process.stdout.write(`mcptrustchecker ${TOOL_VERSION} (methodology ${METHODOLOGY_VERSION})\n`);
+        return;
+    }
+    if (values.help) {
+        printHelp();
+        return;
+    }
+    // If the first positional is an explicit command, the target is the next one;
+    // otherwise the command defaults to `scan` and the first positional is the target.
+    const explicit = Boolean(positionals[0] && KNOWN_COMMANDS.has(positionals[0]));
+    const command = explicit ? positionals[0] : 'scan';
+    const target = explicit ? positionals[1] : positionals[0];
+    if (command === 'help')
+        return printHelp();
+    if (command === 'version') {
+        process.stdout.write(`mcptrustchecker ${TOOL_VERSION} (methodology ${METHODOLOGY_VERSION})\n`);
+        return;
+    }
+    if (command === 'rules')
+        return printRules();
+    if (command === 'explain')
+        return printExplain(target);
+    // scan / pin / diff
+    const scanTarget = target;
+    const autoDiscover = !scanTarget && !values.command && !values.url;
+    // Reject silently-dropped extra positional targets.
+    const extraFrom = explicit ? 2 : 1;
+    if (positionals.length > extraFrom) {
+        fail(`unexpected extra argument(s): ${positionals.slice(extraFrom).join(', ')}. ` +
+            `Scan one target at a time, or point at a client config to scan several servers.`);
+    }
+    // Validate CI-gate flags up front so a typo fails loudly, not silently.
+    if (values['fail-under'] !== undefined) {
+        const n = Number(values['fail-under']);
+        if (!Number.isFinite(n) || n < 0 || n > 100)
+            fail(`--fail-under must be a number 0–100 (got "${values['fail-under']}")`);
+    }
+    if (values['min-grade'] !== undefined && !(values['min-grade'].toUpperCase() in GRADE_RANK)) {
+        fail(`--min-grade must be one of A, B, C, D, F (got "${values['min-grade']}")`);
+    }
+    const fileConfig = values.config ? loadConfigFromPath(values.config) : loadConfigFile(process.cwd());
+    const config = {
+        ...fileConfig,
+        includeBuiltins: values['include-builtins'] ?? fileConfig.includeBuiltins,
+    };
+    const lockfilePath = values.lockfile ?? fileConfig.lockfile ?? 'mcptrustchecker.lock';
+    const lock = values['no-lock'] ? null : (readLockfile(lockfilePath) ?? null);
+    const resolveOpts = {
+        command: values.command ? values.command.trim().split(/\s+/)[0] : undefined,
+        args: buildArgs(values.command, values.args),
+        url: values.url,
+        online: values.online,
+        run: values.run,
+        envVars: parseEnvFlags(values.env),
+        allowAnyCommand: values['allow-any-command'],
+        allowedHosts: values['allowed-hosts'] ? values['allowed-hosts'].split(',').map((h) => h.trim()) : undefined,
+        registry: values.registry === 'pypi' ? 'pypi' : 'npm',
+    };
+    let resolved = [];
+    if (autoDiscover) {
+        // Zero-config: find and scan every installed MCP client config.
+        const configs = discoverClientConfigs();
+        if (configs.length === 0) {
+            process.stdout.write(`${c.bold('MCP Trust Checker')} — no MCP client configs found to scan.\n\n` +
+                `Point at something explicitly:\n` +
+                `  mcptrustchecker scan ./tools.json                  ${c.gray('# a manifest')}\n` +
+                `  mcptrustchecker scan https://host/mcp              ${c.gray('# a live endpoint')}\n` +
+                `  mcptrustchecker scan --command "npx -y <server>"   ${c.gray('# a local stdio server')}\n` +
+                `  mcptrustchecker scan <@scope/package> --online     ${c.gray('# a package name')}\n\n` +
+                `Run ${c.bold('mcptrustchecker --help')} for all options.\n`);
+            return;
+        }
+        process.stderr.write(`${c.gray('Discovered')} ${configs.length} MCP config(s): ${configs.map((x) => x.client).join(', ')}\n` +
+            (values.run ? '' : `${c.gray('(static scan; add')} ${c.bold('--run')}${c.gray(' to spawn servers and analyze tool descriptions)')}\n`));
+        for (const cfg of configs) {
+            try {
+                resolved.push(...(await resolveTargets(cfg.path, resolveOpts)));
+            }
+            catch (err) {
+                process.stderr.write(`${c.yellow('!')} skipped ${cfg.path}: ${err.message}\n`);
+            }
+        }
+        if (resolved.length === 0)
+            fail('no MCP servers found in the discovered configs.');
+    }
+    else {
+        try {
+            resolved = await resolveTargets(scanTarget, resolveOpts);
+        }
+        catch (err) {
+            fail(err.message);
+        }
+    }
+    // Flat tool inventory across all resolved servers, for cross-server collision.
+    const allTools = resolved.flatMap((r) => r.surface.tools.map((t) => ({ server: r.surface.id, name: t.name })));
+    const reports = [];
+    for (const { surface } of resolved) {
+        const siblingTools = allTools.filter((t) => t.server !== surface.id);
+        const report = await scanSurface(surface, {
+            config,
+            lockfile: values['no-lock'] ? undefined : lock,
+            scannedAt: new Date().toISOString(),
+            siblingTools,
+        });
+        reports.push(report);
+    }
+    // pin — always read the existing lockfile first (even under --no-lock) so we
+    // merge into it rather than clobbering previously-pinned servers.
+    if (command === 'pin' || values.pin) {
+        let updated = readLockfile(lockfilePath) ?? emptyLockfile();
+        for (const { surface } of resolved)
+            updated = pinSurface(updated, surface, new Date().toISOString());
+        writeLockfile(lockfilePath, updated);
+        process.stderr.write(`${c.green('✓')} pinned ${resolved.length} server(s) → ${lockfilePath}\n`);
+    }
+    // output
+    const rendered = render(reports, values);
+    if (values.output) {
+        try {
+            writeFileSync(values.output, rendered.endsWith('\n') ? rendered : rendered + '\n');
+        }
+        catch (err) {
+            fail(`could not write ${values.output}: ${err.message}`);
+        }
+        process.stderr.write(`${c.green('✓')} wrote ${values.output}\n`);
+        if (!values.json && !values.sarif && !values.badge)
+            process.stdout.write(summaryLine(reports) + '\n');
+    }
+    else {
+        // The human report can be long; page it (starting at the top, on the grade)
+        // rather than letting the terminal scroll to the end of the findings.
+        const isHumanReport = !values.json && !values.sarif && !values.badge && !values.md && !values.markdown && !values.quiet;
+        paginate(rendered, isHumanReport && !values['no-pager']);
+    }
+    // Return the exit code instead of process.exit() — exit() can truncate a large
+    // stdout write to a pipe before it flushes (invalid JSON/SARIF). Letting main
+    // resolve lets Node flush stdout, then the entrypoint sets process.exitCode.
+    return computeExitCode(command, reports, values, fileConfig);
+}
+/**
+ * Write to stdout, paging through $PAGER (default `less`) when the output is an
+ * interactive terminal and taller than the screen — so the view opens on the
+ * grade at the top instead of auto-scrolling to the last finding.
+ *
+ * We use plain `less -R` (raw colors) on the standard alternate screen. We
+ * deliberately avoid `-X`/`-F`: `-X` (no alternate screen) makes some terminals
+ * dump every repaint into scrollback while scrolling (duplicated output), and
+ * `-F` misbehaves on piped input. For default-less we also force `LESS=R` so a
+ * user's global `$LESS` (which may contain -X/-F) can't reintroduce the bug.
+ * Honors NO_PAGER / MCPTRUSTCHECKER_NO_PAGER and any custom $PAGER verbatim.
+ */
+function paginate(text, allow) {
+    const body = text.endsWith('\n') ? text : `${text}\n`;
+    const rows = process.stdout.rows || 24;
+    const tallerThanScreen = body.split('\n').length > rows - 1;
+    const wantPager = allow &&
+        Boolean(process.stdout.isTTY) &&
+        !process.env.NO_PAGER &&
+        !process.env.MCPTRUSTCHECKER_NO_PAGER &&
+        tallerThanScreen;
+    if (!wantPager) {
+        process.stdout.write(body);
+        return;
+    }
+    const pagerEnv = (process.env.PAGER ?? '').trim();
+    const [cmd, ...preArgs] = (pagerEnv || 'less').split(/\s+/);
+    const useDefaultLess = /(^|\/)less$/.test(cmd ?? '') && preArgs.length === 0;
+    const args = useDefaultLess ? ['-R'] : preArgs;
+    const env = useDefaultLess ? { ...process.env, LESS: 'R' } : process.env;
+    try {
+        const res = spawnSync(cmd ?? 'less', args, { input: body, stdio: ['pipe', 'inherit', 'inherit'], env });
+        if (res.error)
+            process.stdout.write(body); // pager missing → fall back
+    }
+    catch {
+        process.stdout.write(body);
+    }
+}
+function parseEnvFlags(list) {
+    if (!list || list.length === 0)
+        return undefined;
+    const out = {};
+    for (const kv of list) {
+        const i = kv.indexOf('=');
+        if (i > 0)
+            out[kv.slice(0, i)] = kv.slice(i + 1);
+    }
+    return Object.keys(out).length ? out : undefined;
+}
+function buildArgs(command, args) {
+    const fromCommand = command ? command.trim().split(/\s+/).slice(1) : [];
+    const fromArgs = args ? args.trim().split(/\s+/) : [];
+    const all = [...fromCommand, ...fromArgs];
+    return all.length ? all : undefined;
+}
+function render(reports, values) {
+    const single = reports.length === 1;
+    if (values.json)
+        return single ? renderJson(reports[0]) : JSON.stringify(reports, null, 2);
+    if (values.sarif)
+        return renderSarifMerged(reports);
+    if (values.badge)
+        return single ? renderBadge(reports[0]) : JSON.stringify(reports.map((r) => JSON.parse(renderBadge(r))));
+    if (values.md || values.markdown)
+        return reports.map(renderMarkdown).join('\n\n---\n\n');
+    if (values.quiet)
+        return summaryLine(reports);
+    return reports.map((r) => renderTerminal(r, { details: Boolean(values.details) })).join('\n');
+}
+function renderSarifMerged(reports) {
+    if (reports.length === 1)
+        return renderSarif(reports[0]);
+    const runs = reports.flatMap((r) => JSON.parse(renderSarif(r)).runs);
+    return JSON.stringify({ $schema: 'https://json.schemastore.org/sarif-2.1.0.json', version: '2.1.0', runs }, null, 2);
+}
+function summaryLine(reports) {
+    return reports
+        .map((r) => `${r.target.id}: Trust ${r.score.grade} (${r.score.score}/100) · Capability ${r.capabilityProfile.level.toUpperCase()}`)
+        .join('\n');
+}
+function computeExitCode(command, reports, values, fileConfig) {
+    if (command === 'diff') {
+        if (reports.some((r) => r.integrity?.status === 'drift'))
+            return 1;
+    }
+    const failUnder = values['fail-under'] !== undefined ? Number(values['fail-under']) : fileConfig.failUnder;
+    const rawMinGrade = values['min-grade'] ?? fileConfig.minGrade;
+    const minGrade = rawMinGrade ? String(rawMinGrade).toUpperCase() : undefined;
+    let gated = 0;
+    for (const r of reports) {
+        if (failUnder !== undefined && r.score.score < failUnder)
+            gated = 1;
+        if (minGrade && minGrade in GRADE_RANK && GRADE_RANK[r.score.grade] < GRADE_RANK[minGrade])
+            gated = 1;
+        // Policy-as-code: report every violation, then fail.
+        const violations = evaluatePolicy(r, fileConfig.policy);
+        for (const v of violations) {
+            process.stderr.write(`${c.red('policy')} ${r.target.id}: ${v.message}\n`);
+            gated = 1;
+        }
+    }
+    return gated;
+}
+function printRules() {
+    const lines = [`${c.bold('MCP Trust Checker rules')} (${RULE_CATALOG.length})`, ''];
+    let lastCat = '';
+    for (const r of RULE_CATALOG) {
+        if (r.category !== lastCat) {
+            lines.push(c.gray(`— ${r.category} —`));
+            lastCat = r.category;
+        }
+        lines.push(`  ${c.bold(r.id.padEnd(16))} ${c.gray(`[${r.severity}]`)} ${r.title}`);
+    }
+    process.stdout.write(lines.join('\n') + '\n');
+}
+function printExplain(id) {
+    if (!id)
+        fail('usage: mcptrustchecker explain <ruleId>');
+    const rule = findRule(id);
+    if (!rule)
+        fail(`unknown rule "${id}". Run "mcptrustchecker rules" to list them.`);
+    process.stdout.write(`${c.bold(rule.id)} — ${rule.title}\n` +
+        `  category: ${rule.category}\n  severity: ${rule.severity}\n\n  ${rule.summary}\n`);
+}
+main()
+    .then((code) => {
+    if (typeof code === 'number' && code !== 0)
+        process.exitCode = code;
+})
+    .catch((err) => fail(err.message ?? String(err), 2));

package/dist/config.d.ts

@@ -0,0 +1,15 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Config resolution. MCP Trust Checker runs with sensible zero-config defaults; a
+ * `mcptrustchecker.config.json` (or `.mcptrustcheckerrc.json`) can override any of them.
+ */
+import type { ResolvedConfig, McpTrustCheckerConfig } from './types.js';
+export declare const DEFAULT_CONFIG: ResolvedConfig;
+/** Load a config object from the first config file found in `cwd`, if any. */
+export declare function loadConfigFile(cwd?: string): McpTrustCheckerConfig;
+/** Load a config from an explicit file path (errors clearly if missing/malformed). */
+export declare function loadConfigFromPath(path: string): McpTrustCheckerConfig;
+/** Merge a partial config over the defaults into a fully-resolved config. */
+export declare function resolveConfig(partial?: McpTrustCheckerConfig): ResolvedConfig;
+/** Load a standalone `.mtcignore` baseline file (JSON array of suppressions), if present. */
+export declare function loadIgnoreFile(cwd?: string): McpTrustCheckerConfig['suppress'];

package/dist/config.js

@@ -0,0 +1,81 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Config resolution. MCP Trust Checker runs with sensible zero-config defaults; a
+ * `mcptrustchecker.config.json` (or `.mcptrustcheckerrc.json`) can override any of them.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+export const DEFAULT_CONFIG = {
+    disabledRules: [],
+    allowlist: [],
+    failUnder: 0,
+    includeBuiltins: false,
+    protectedPackages: [],
+    invisibleCharThreshold: 5,
+    suppress: [],
+    minGrade: undefined,
+    lockfile: undefined,
+    policy: undefined,
+};
+const CONFIG_FILENAMES = ['mcptrustchecker.config.json', '.mcptrustcheckerrc.json', '.mcptrustcheckerrc'];
+const IGNORE_FILE = '.mtcignore';
+/** Load a config object from the first config file found in `cwd`, if any. */
+export function loadConfigFile(cwd = process.cwd()) {
+    let cfg = {};
+    for (const name of CONFIG_FILENAMES) {
+        const path = join(cwd, name);
+        if (existsSync(path)) {
+            try {
+                cfg = JSON.parse(readFileSync(path, 'utf8'));
+            }
+            catch (err) {
+                throw new Error(`Failed to parse config file ${path}: ${err.message}`);
+            }
+            break;
+        }
+    }
+    // A standalone .mtcignore baseline merges into (and extends) config suppressions.
+    const ignore = loadIgnoreFile(cwd);
+    if (ignore && ignore.length)
+        cfg = { ...cfg, suppress: [...(cfg.suppress ?? []), ...ignore] };
+    return cfg;
+}
+/** Load a config from an explicit file path (errors clearly if missing/malformed). */
+export function loadConfigFromPath(path) {
+    if (!existsSync(path))
+        throw new Error(`Config file not found: ${path}`);
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (err) {
+        throw new Error(`Failed to parse config file ${path}: ${err.message}`);
+    }
+}
+/** Merge a partial config over the defaults into a fully-resolved config. */
+export function resolveConfig(partial = {}) {
+    return {
+        disabledRules: partial.disabledRules ?? DEFAULT_CONFIG.disabledRules,
+        allowlist: partial.allowlist ?? DEFAULT_CONFIG.allowlist,
+        failUnder: partial.failUnder ?? DEFAULT_CONFIG.failUnder,
+        includeBuiltins: partial.includeBuiltins ?? DEFAULT_CONFIG.includeBuiltins,
+        protectedPackages: partial.protectedPackages ?? DEFAULT_CONFIG.protectedPackages,
+        invisibleCharThreshold: partial.invisibleCharThreshold ?? DEFAULT_CONFIG.invisibleCharThreshold,
+        suppress: partial.suppress ?? DEFAULT_CONFIG.suppress,
+        minGrade: partial.minGrade,
+        lockfile: partial.lockfile,
+        policy: partial.policy,
+    };
+}
+/** Load a standalone `.mtcignore` baseline file (JSON array of suppressions), if present. */
+export function loadIgnoreFile(cwd = process.cwd()) {
+    const path = join(cwd, IGNORE_FILE);
+    if (!existsSync(path))
+        return [];
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch (err) {
+        throw new Error(`Failed to parse ${IGNORE_FILE}: ${err.message}`);
+    }
+}

package/dist/data/capabilityLexicon.d.ts

@@ -0,0 +1,51 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Capability lexicon — the vocabulary that maps a tool's name, description
+ * verbs, and parameter shape onto the roles used by the toxic-flow graph.
+ *
+ * The trifecta (the lethal-trifecta toxic flow) requires three roles
+ * to be simultaneously reachable in one agent session:
+ *   UNTRUSTED_INPUT  →  SENSITIVE_SOURCE  →  EXTERNAL_SINK
+ * We deliberately keep UNTRUSTED_INPUT and SENSITIVE_SOURCE separate — merging
+ * them (as a naive "sensitive source") both over- and under-flags.
+ */
+import type { CapabilityTag } from '../types.js';
+/** Keyword → tag rules matched against a tool's name and description. */
+export interface CapabilitySignal {
+    tag: CapabilityTag;
+    /** Lowercased keywords/phrases; matched as word-ish substrings. */
+    keywords: string[];
+}
+export declare const CAPABILITY_SIGNALS: CapabilitySignal[];
+/**
+ * Parameter-name → tag hints (schema-shape signals). Deliberately conservative:
+ * generic names like `body`/`data`/`content` are NOT mapped (an HTTP body is not
+ * a file write) — file mutation is detected from tool-name verbs instead, which
+ * avoids the most common capability false positive.
+ */
+export declare const PARAM_NAME_SIGNALS: {
+    tag: CapabilityTag;
+    names: string[];
+}[];
+/** URL/host-shaped parameter names — an unconstrained one is an SSRF precondition. */
+export declare const SSRF_PARAM_NAMES: string[];
+/** Path-shaped parameter names — an unconstrained one is a path-traversal precondition. */
+export declare const PATH_PARAM_NAMES: string[];
+/** Command-shaped parameter names — an unconstrained one is a command-injection precondition. */
+export declare const COMMAND_PARAM_NAMES: string[];
+/**
+ * Field names that must never be collected via MCP elicitation (the spec
+ * forbids it). Their presence alongside a declared elicitation capability is a
+ * credential-phishing signal.
+ */
+export declare const SECRET_FIELD_NAMES: string[];
+/**
+ * The virtual "client built-in" tools. When `includeBuiltins` is set, the
+ * toxic-flow graph assumes the host agent also exposes generic web-fetch (an
+ * untrusted-input source) and generic file/network tools (sinks), which can
+ * complete a trifecta together with a single-capability server.
+ */
+export declare const CLIENT_BUILTINS: {
+    tool: string;
+    tags: CapabilityTag[];
+}[];