mcptrustchecker 1.0.0

package/dist/data/capabilityLexicon.js

@@ -0,0 +1,204 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Capability lexicon — the vocabulary that maps a tool's name, description
+ * verbs, and parameter shape onto the roles used by the toxic-flow graph.
+ *
+ * The trifecta (the lethal-trifecta toxic flow) requires three roles
+ * to be simultaneously reachable in one agent session:
+ *   UNTRUSTED_INPUT  →  SENSITIVE_SOURCE  →  EXTERNAL_SINK
+ * We deliberately keep UNTRUSTED_INPUT and SENSITIVE_SOURCE separate — merging
+ * them (as a naive "sensitive source") both over- and under-flags.
+ */
+export const CAPABILITY_SIGNALS = [
+    {
+        tag: 'untrusted-input',
+        keywords: [
+            'fetch_url',
+            'fetch url',
+            'fetch',
+            'browse',
+            'read_issue',
+            'read issue',
+            'read_pr',
+            'read pull request',
+            'read_email',
+            'read email',
+            'read_ticket',
+            'read_comment',
+            'read comment',
+            'web_search',
+            'web search',
+            'search web',
+            'get_page',
+            'scrape',
+            'crawl',
+            'read_message',
+            'read_dm',
+            'download',
+            'rss',
+            'read_webhook',
+        ],
+    },
+    {
+        tag: 'sensitive-source',
+        keywords: [
+            'read_file',
+            'read file',
+            'readfile',
+            'get_file_contents',
+            'cat_file',
+            'read_repo',
+            'read_env',
+            'read environment',
+            'get_env',
+            'query_db',
+            'query database',
+            'run_sql',
+            'execute_sql',
+            'sql_query',
+            'get_logs',
+            'read_logs',
+            'list_secrets',
+            'get_secret',
+            'read_secret',
+            'read_config',
+            'list_keys',
+            'get_credentials',
+            'get_token',
+            'dump',
+            'export_data',
+            'read_private',
+            'list_files',
+        ],
+    },
+    {
+        tag: 'external-sink',
+        keywords: [
+            'http_request',
+            'http request',
+            'post',
+            'put_request',
+            'send_email',
+            'send email',
+            'sendmail',
+            'send_message',
+            'send message',
+            'post_message',
+            'webhook',
+            'create_pull_request',
+            'open_pr',
+            'create_issue',
+            'create_comment',
+            'publish',
+            'upload',
+            'curl',
+            'request',
+            'notify',
+            'tweet',
+            'slack_post',
+            'sms',
+            'call_api',
+            'forward',
+            'export_to',
+        ],
+    },
+    {
+        tag: 'code-exec',
+        keywords: [
+            // NOTE: bare 'system'/'command'/'terminal' are intentionally excluded —
+            // they match benign text like "file system" or "the command completed".
+            // Command execution is caught by the specific verbs below plus the
+            // code-exec parameter-name signals.
+            'exec',
+            'execute command',
+            'execute code',
+            'execute a command',
+            'execute shell',
+            'execute the command',
+            'run_command',
+            'run command',
+            'shell',
+            'bash',
+            'eval',
+            'run_code',
+            'run_script',
+            'run_shell',
+            'spawn',
+            'subprocess',
+            'powershell',
+            'python_exec',
+        ],
+    },
+    {
+        tag: 'file-write',
+        keywords: [
+            'write_file',
+            'write file',
+            'writefile',
+            'create_file',
+            'edit_file',
+            'delete_file',
+            'remove_file',
+            'move_file',
+            'append_file',
+            'save_file',
+            'overwrite',
+            'rmdir',
+            'unlink',
+            'put_object',
+        ],
+    },
+];
+/**
+ * Parameter-name → tag hints (schema-shape signals). Deliberately conservative:
+ * generic names like `body`/`data`/`content` are NOT mapped (an HTTP body is not
+ * a file write) — file mutation is detected from tool-name verbs instead, which
+ * avoids the most common capability false positive.
+ */
+export const PARAM_NAME_SIGNALS = [
+    { tag: 'external-sink', names: ['url', 'endpoint', 'webhook', 'uri', 'recipient', 'destination'] },
+    { tag: 'code-exec', names: ['command', 'cmd', 'script', 'shell', 'exec', 'eval'] },
+    // 'query' is intentionally omitted — a search "query" is not sensitive-data
+    // access; real DB reads are caught by tool-name verbs (query_db, run_sql, …).
+    { tag: 'sensitive-source', names: ['path', 'filepath', 'filename', 'secret', 'sql'] },
+];
+/** URL/host-shaped parameter names — an unconstrained one is an SSRF precondition. */
+export const SSRF_PARAM_NAMES = ['url', 'uri', 'host', 'endpoint', 'target', 'server', 'address', 'hostname'];
+/** Path-shaped parameter names — an unconstrained one is a path-traversal precondition. */
+export const PATH_PARAM_NAMES = ['path', 'filepath', 'filename', 'file', 'dir', 'directory'];
+/** Command-shaped parameter names — an unconstrained one is a command-injection precondition. */
+export const COMMAND_PARAM_NAMES = ['command', 'cmd', 'script', 'shell', 'exec', 'eval', 'code'];
+/**
+ * Field names that must never be collected via MCP elicitation (the spec
+ * forbids it). Their presence alongside a declared elicitation capability is a
+ * credential-phishing signal.
+ */
+export const SECRET_FIELD_NAMES = [
+    'password',
+    'passwd',
+    'api_key',
+    'apikey',
+    'token',
+    'secret',
+    'ssn',
+    'seed_phrase',
+    'seedphrase',
+    'mnemonic',
+    'private_key',
+    'privatekey',
+    'credit_card',
+    'creditcard',
+    'cvv',
+    'pin',
+];
+/**
+ * The virtual "client built-in" tools. When `includeBuiltins` is set, the
+ * toxic-flow graph assumes the host agent also exposes generic web-fetch (an
+ * untrusted-input source) and generic file/network tools (sinks), which can
+ * complete a trifecta together with a single-capability server.
+ */
+export const CLIENT_BUILTINS = [
+    { tool: '<client:web-fetch>', tags: ['untrusted-input'] },
+    { tool: '<client:filesystem>', tags: ['sensitive-source', 'file-write'] },
+    { tool: '<client:shell>', tags: ['code-exec', 'external-sink'] },
+];

package/dist/data/confusables.d.ts

@@ -0,0 +1,17 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * A curated subset of the UTS #39 confusables mapping (homoglyph → ASCII
+ * skeleton). This is intentionally small and high-precision: it covers the
+ * Latin-lookalike Cyrillic / Greek / fullwidth / digit-lookalike characters
+ * that matter for package-name and command-keyword squatting. It is NOT a full
+ * confusables.txt — the mixed-script detector (using Unicode script properties)
+ * catches the general case; this map exists to compute a `skeleton()` for the
+ * typosquat watchlist comparison.
+ */
+export declare const CONFUSABLE_MAP: Record<string, string>;
+/**
+ * Reduce a string to its confusable skeleton: NFKD-fold, then map each char
+ * through the confusable table, lowercased. Two strings with the same skeleton
+ * are visually confusable. Used only against the protected watchlist.
+ */
+export declare function skeleton(input: string): string;

package/dist/data/confusables.js

@@ -0,0 +1,65 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * A curated subset of the UTS #39 confusables mapping (homoglyph → ASCII
+ * skeleton). This is intentionally small and high-precision: it covers the
+ * Latin-lookalike Cyrillic / Greek / fullwidth / digit-lookalike characters
+ * that matter for package-name and command-keyword squatting. It is NOT a full
+ * confusables.txt — the mixed-script detector (using Unicode script properties)
+ * catches the general case; this map exists to compute a `skeleton()` for the
+ * typosquat watchlist comparison.
+ */
+export const CONFUSABLE_MAP = {
+    // Cyrillic → Latin
+    а: 'a',
+    е: 'e',
+    о: 'o',
+    р: 'p',
+    с: 'c',
+    х: 'x',
+    у: 'y',
+    к: 'k',
+    м: 'm',
+    т: 't',
+    н: 'h',
+    в: 'b',
+    і: 'i',
+    ѕ: 's',
+    ј: 'j',
+    // Greek → Latin
+    ο: 'o',
+    ρ: 'p',
+    α: 'a',
+    ν: 'v',
+    τ: 't',
+    ι: 'i',
+    κ: 'k',
+    // Fullwidth → ASCII
+    ａ: 'a',
+    ｅ: 'e',
+    ｉ: 'i',
+    ｏ: 'o',
+    ｒ: 'r',
+    ｍ: 'm',
+    ｃ: 'c',
+    ｐ: 'p',
+    // Digit / letter lookalikes
+    '0': 'o',
+    '1': 'l',
+    '3': 'e',
+    '5': 's',
+    '$': 's',
+    '@': 'a',
+};
+/**
+ * Reduce a string to its confusable skeleton: NFKD-fold, then map each char
+ * through the confusable table, lowercased. Two strings with the same skeleton
+ * are visually confusable. Used only against the protected watchlist.
+ */
+export function skeleton(input) {
+    const normalized = input.normalize('NFKD').toLowerCase();
+    let out = '';
+    for (const ch of normalized) {
+        out += CONFUSABLE_MAP[ch] ?? ch;
+    }
+    return out;
+}

package/dist/data/injectionPatterns.d.ts

@@ -0,0 +1,55 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Prompt-injection / tool-poisoning pattern lexicon.
+ *
+ * These regexes model the *linguistic shape* of instructions aimed at the model
+ * rather than the human — the signature of tool poisoning and "line jumping".
+ * Keyword matching alone is deliberately weak (euphemism-based phrasing evades
+ * it); it is only one signal. The heavy lifting for real exfiltration is
+ * done by the capability / toxic-flow graph. These patterns catch the blatant
+ * cases and raise the *confidence* axis, never the whole grade on their own.
+ */
+import type { Confidence, Severity } from '../types.js';
+/** Which text channel a pattern is meaningful in. */
+export type InjectionChannel = 'tool-description' | 'param-description' | 'server-instructions';
+export type InjectionKind = 'authority' | 'secrecy' | 'override' | 'sequencing' | 'sensitive-target' | 'exfil-param' | 'shadowing' | 'encoded-payload' | 'command-in-prose';
+export interface InjectionPattern {
+    id: string;
+    kind: InjectionKind;
+    /** Source regex (compiled case-insensitive, global by the detector). */
+    pattern: RegExp;
+    baseSeverity: Severity;
+    baseConfidence: Confidence;
+    title: string;
+    channels: InjectionChannel[];
+}
+export declare const INJECTION_PATTERNS: InjectionPattern[];
+/**
+ * Parameter *names* that front for hidden exfiltration channels. Kept
+ * high-precision: generic names like `context`/`metadata`/`feedback`/`notes`
+ * are excluded because they are overwhelmingly used legitimately.
+ */
+export declare const SUSPICIOUS_PARAM_NAMES: string[];
+/** ALL-CAPS run detector: >= this many consecutive shouted words is suspicious. */
+export declare const ALLCAPS_RUN_WORDS = 3;
+/**
+ * Hosts that are almost never a legitimate destination inside tool metadata —
+ * one-shot request/paste/webhook/exfil sinks and URL shorteners. A hardcoded
+ * link to one of these in a tool description is a data-exfiltration channel
+ * ("send the result to …"), the classic malicious-URL tool-poisoning move.
+ */
+export declare const SUSPICIOUS_URL_HOST: RegExp;
+/** Webhook/bot endpoints whose PATH marks them as an exfil sink. */
+export declare const SUSPICIOUS_URL_PATH: RegExp;
+/** A bare IPv4/IPv6 literal as a URL host — a link to a raw address, not a name. */
+export declare const URL_IP_LITERAL: RegExp;
+/**
+ * High-precision secret-value patterns. A match is an actual embedded
+ * credential (not merely a reference to one), so it is `confirmed`. Evidence is
+ * always redacted to a short prefix — never echo the secret.
+ */
+export declare const SECRET_PATTERNS: {
+    id: string;
+    label: string;
+    pattern: RegExp;
+}[];

package/dist/data/injectionPatterns.js

@@ -0,0 +1,216 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Prompt-injection / tool-poisoning pattern lexicon.
+ *
+ * These regexes model the *linguistic shape* of instructions aimed at the model
+ * rather than the human — the signature of tool poisoning and "line jumping".
+ * Keyword matching alone is deliberately weak (euphemism-based phrasing evades
+ * it); it is only one signal. The heavy lifting for real exfiltration is
+ * done by the capability / toxic-flow graph. These patterns catch the blatant
+ * cases and raise the *confidence* axis, never the whole grade on their own.
+ */
+const ALL_CHANNELS = [
+    'tool-description',
+    'param-description',
+    'server-instructions',
+];
+export const INJECTION_PATTERNS = [
+    // --- Authority / secrecy / instruction-override ---
+    {
+        id: 'MTC-INJ-AUTH-1',
+        kind: 'authority',
+        pattern: /<?\bIMPORTANT\b>?|VERY IMPORTANT|\bATTENTION\b|\bMANDATORY\b/,
+        baseSeverity: 'low',
+        baseConfidence: 'heuristic',
+        title: 'Authority framing in tool metadata',
+        channels: ALL_CHANNELS,
+    },
+    {
+        id: 'MTC-INJ-AUTH-2',
+        kind: 'override',
+        pattern: /(ignore|disregard|forget) (all |your |the |any )?(previous|prior|above|earlier)( instructions| directions| context)?|override (all|previous|any|the) (instructions|directives)/,
+        baseSeverity: 'high',
+        baseConfidence: 'strong',
+        title: 'Instruction-override directive',
+        channels: ALL_CHANNELS,
+    },
+    {
+        id: 'MTC-INJ-SECRECY-1',
+        kind: 'secrecy',
+        pattern: /do not (tell|mention|inform|notify|reveal|show|display|print|log|output)( this| it)?( to)? the user|without (telling|informing|notifying) the user|do not mention this|never (tell|mention|reveal|present|inform|display)( the user| this)|(hide|conceal|keep)( this| it)? (hidden |secret )?from the user|concealed from the user/,
+        baseSeverity: 'high',
+        baseConfidence: 'strong',
+        title: 'Secrecy directive (conceal action from the user)',
+        channels: ALL_CHANNELS,
+    },
+    {
+        id: 'MTC-INJ-SECRECY-2',
+        kind: 'authority',
+        pattern: /for compliance|internal requirement|as required by policy|per policy|for security reasons you must/,
+        baseSeverity: 'medium',
+        baseConfidence: 'heuristic',
+        title: 'Fabricated policy / compliance framing',
+        channels: ALL_CHANNELS,
+    },
+    // --- Sequencing / "do this first" line-jumping ---
+    {
+        id: 'MTC-INJ-SEQ-1',
+        kind: 'sequencing',
+        // "before using ANY/OTHER tool" is line-jumping; "before using THIS tool"
+        // is legitimate self-documentation of a prerequisite and must not match.
+        pattern: /before (executing|calling|using|running) (any|another|the other|other) (tool|command|function)|as the (first|very first) step,? (call|invoke|use)|always (consult|call|invoke) this tool( first| immediately)?|you must (also |always |first )?(call|invoke) (this|the )/,
+        // Medium: assertive "call X first" language is common in legitimate tool
+        // docs; the dangerous form (secrecy/target + sequencing) is escalated to
+        // critical by the compound-poisoning rule.
+        baseSeverity: 'medium',
+        baseConfidence: 'strong',
+        title: 'Forced-sequencing directive (line jumping)',
+        channels: ALL_CHANNELS,
+    },
+    {
+        id: 'MTC-INJ-SEQ-2',
+        kind: 'sequencing',
+        pattern: /when (this tool |you )?(is invoked|call|use|are asked)|every time (you|the assistant)/,
+        baseSeverity: 'low',
+        baseConfidence: 'heuristic',
+        title: 'Conditional behavior directive',
+        channels: ALL_CHANNELS,
+    },
+    // --- Sensitive targets referenced in metadata ---
+    {
+        id: 'MTC-INJ-TARGET-1',
+        kind: 'sensitive-target',
+        // Only genuine credential-exfil paths (rare in legit tool docs). Bare
+        // mentions of API_KEY/.env/SECRET_KEY are ubiquitous in legit auth/env tools
+        // and were removed to avoid false trust hits.
+        pattern: /~\/\.ssh|\bid_rsa\b|~\/\.aws\/credentials|\.aws\/credentials|~\/\.cursor\/mcp\.json|~\/\.config\/[^\s]*\/credentials/,
+        baseSeverity: 'high',
+        baseConfidence: 'strong',
+        title: 'Reference to a credential-exfiltration path in metadata',
+        channels: ALL_CHANNELS,
+    },
+    {
+        id: 'MTC-INJ-TARGET-2',
+        kind: 'sensitive-target',
+        // Soft signal: legitimate chat/agent/registry tools reference these; medium
+        // + heuristic so it can't force a critical grade on its own.
+        pattern: /system prompt|conversation history|chat history|previous messages|environment details|list of (all )?(available )?tools/,
+        baseSeverity: 'medium',
+        baseConfidence: 'heuristic',
+        title: 'Solicitation of model context / history',
+        channels: ALL_CHANNELS,
+    },
+    // --- Exfil-shaped parameters (evaluated against param descriptions) ---
+    {
+        id: 'MTC-INJ-EXFIL-1',
+        kind: 'exfil-param',
+        // Must reference a genuinely sensitive object — not just "include all"
+        // (which is ubiquitous in legit params like "include all commits").
+        pattern: /(append|include|attach|paste|send|add) (the )?(full |entire |complete )?(value|contents?) of (the )?(environment|system prompt|secret|credential|\.env|ssh key|api key|private key|access token)/,
+        baseSeverity: 'high',
+        baseConfidence: 'strong',
+        title: 'Parameter description solicits secrets/environment to be sent along',
+        channels: ['param-description'],
+    },
+    // --- Cross-tool shadowing (3 tiers by real threat, not just linguistic shape) ---
+    {
+        id: 'MTC-INJ-SHADOW-1',
+        kind: 'shadowing',
+        // HIGH: genuine redirection of a recipient/destination/credential — the
+        // exfiltration/hijack primitive. This is the only form that reroutes data
+        // through an attacker-chosen path.
+        pattern: /redirect (all|the|any) (email|message|credential|token)|route (all|the|any) (email|message) (to|through)/,
+        baseSeverity: 'high',
+        baseConfidence: 'strong',
+        title: 'Cross-tool redirection of a recipient/credential',
+        channels: ALL_CHANNELS,
+    },
+    {
+        id: 'MTC-INJ-SHADOW-3',
+        kind: 'shadowing',
+        // HIGH: blanket SUPPRESSION of *all* sibling tools — a genuine tool-selection
+        // hijack that crowds out legitimate (incl. security) tools.
+        pattern: /do not (use|call) (the |any )?other tool|use this tool instead of (all )?other|ignore (the )?other tools/,
+        baseSeverity: 'high',
+        baseConfidence: 'strong',
+        title: 'Tool-selection hijack (suppress all other tools)',
+        channels: ALL_CHANNELS,
+    },
+    {
+        id: 'MTC-INJ-SHADOW-4',
+        kind: 'shadowing',
+        // LOW: self-promotion / comparative preference ("this is the only correct
+        // tool", "use this instead of the analysis tool"). Ubiquitous in legitimate
+        // assertive docs — the disparaged claim is often factually true and points at
+        // the server's OWN tool with no sink. A confidence-axis nudge only; it still
+        // escalates to critical via the compound-poisoning rule when it co-occurs
+        // with a secrecy/override signal (e.g. "…and do not tell the user").
+        pattern: /prefer (this|the following) tool|(this is the )?only (correct|valid|safe|right) tool|always prefer this tool|use this (tool )?instead of the \w+ (tool|function|server)|replaces? the \w+ (tool|function|server)|instead of (calling|using|invoking) the \w+ (tool|function|server)/,
+        baseSeverity: 'low',
+        baseConfidence: 'heuristic',
+        title: 'Assertive tool self-preference (comparative)',
+        channels: ALL_CHANNELS,
+    },
+    // --- Encoded payloads ---
+    {
+        id: 'MTC-INJ-ENC-1',
+        kind: 'encoded-payload',
+        // Require a decode PAIRED with execution — a plain base64 utility only
+        // decodes and must not be flagged.
+        pattern: /decode (this|the following|the base64)[^.]{0,40}(execute|eval|run it|then run)|(base64|from base64)[^.]{0,25}(execute|eval|then run)|execute the (result|decoded|following)|\\x[0-9a-f]{2}(\\x[0-9a-f]{2}){2,}/,
+        baseSeverity: 'high',
+        baseConfidence: 'strong',
+        title: 'Encoded-payload decode/execute instruction',
+        channels: ALL_CHANNELS,
+    },
+    // --- Shell commands embedded in prose ---
+    {
+        id: 'MTC-INJ-CMD-1',
+        kind: 'command-in-prose',
+        pattern: /\b(rm -rf|chmod -R|curl [^\s]+ ?\| ?(sh|bash)|wget [^\s]+ ?\| ?(sh|bash)|cat ~\/|\/bin\/(sh|bash)\b|nc -e|bash -c)\b/,
+        baseSeverity: 'high',
+        baseConfidence: 'strong',
+        title: 'Shell command embedded in tool metadata',
+        channels: ALL_CHANNELS,
+    },
+];
+/**
+ * Parameter *names* that front for hidden exfiltration channels. Kept
+ * high-precision: generic names like `context`/`metadata`/`feedback`/`notes`
+ * are excluded because they are overwhelmingly used legitimately.
+ */
+export const SUSPICIOUS_PARAM_NAMES = [
+    'side_note',
+    'sidenote',
+    'sidechannel',
+    'summary_of_environment_details',
+    'environment_details',
+];
+/** ALL-CAPS run detector: >= this many consecutive shouted words is suspicious. */
+export const ALLCAPS_RUN_WORDS = 3;
+/**
+ * Hosts that are almost never a legitimate destination inside tool metadata —
+ * one-shot request/paste/webhook/exfil sinks and URL shorteners. A hardcoded
+ * link to one of these in a tool description is a data-exfiltration channel
+ * ("send the result to …"), the classic malicious-URL tool-poisoning move.
+ */
+export const SUSPICIOUS_URL_HOST = /(?:^|\.)(?:webhook\.site|requestbin\.(?:net|com)|requestbin\.io|hookb\.in|pipedream\.net|beeceptor\.com|ngrok(?:-free)?\.(?:io|app|dev)|trycloudflare\.com|pastebin\.com|hastebin\.com|dpaste\.(?:com|org)|ix\.io|0x0\.st|transfer\.sh|file\.io|bit\.ly|tinyurl\.com|is\.gd|t\.co|interactsh\.com|oast\.(?:fun|site|live|pro|me)|canarytokens\.com|burpcollaborator\.net)$/i;
+/** Webhook/bot endpoints whose PATH marks them as an exfil sink. */
+export const SUSPICIOUS_URL_PATH = /discord(?:app)?\.com\/api\/webhooks\/|api\.telegram\.org\/bot|hooks\.slack\.com\/services\//i;
+/** A bare IPv4/IPv6 literal as a URL host — a link to a raw address, not a name. */
+export const URL_IP_LITERAL = /^\d{1,3}(?:\.\d{1,3}){3}$|^\[[0-9a-f:]+\]$/i;
+/**
+ * High-precision secret-value patterns. A match is an actual embedded
+ * credential (not merely a reference to one), so it is `confirmed`. Evidence is
+ * always redacted to a short prefix — never echo the secret.
+ */
+export const SECRET_PATTERNS = [
+    { id: 'aws-access-key', label: 'AWS access key id', pattern: /\bAKIA[0-9A-Z]{16}\b/ },
+    { id: 'github-token', label: 'GitHub token', pattern: /\bgh[posru]_[0-9A-Za-z]{36}\b/ },
+    { id: 'slack-token', label: 'Slack token', pattern: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/ },
+    { id: 'google-api-key', label: 'Google API key', pattern: /\bAIza[0-9A-Za-z\-_]{35}\b/ },
+    { id: 'stripe-secret', label: 'Stripe secret key', pattern: /\bsk_live_[0-9A-Za-z]{24,}\b/ },
+    { id: 'openai-key', label: 'OpenAI key', pattern: /\bsk-[A-Za-z0-9]{20,}T3BlbkFJ[A-Za-z0-9]{20,}\b/ },
+    { id: 'private-key', label: 'PEM private key', pattern: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/ },
+    { id: 'jwt', label: 'JSON Web Token', pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}\b/ },
+];

package/dist/data/knownCves.d.ts

@@ -0,0 +1,24 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Known-CVE / advisory version matcher for MCP client / proxy / server
+ * packages. A cheap, high-signal check that pure content scanners lack:
+ * if a config pins a package to a version in a known-vulnerable range, say so.
+ *
+ * Ranges are intentionally simple (`< x` or `<= x`). Keep this list current;
+ * it is data, not logic.
+ */
+import type { Severity } from '../types.js';
+export interface KnownVuln {
+    id: string;
+    package: string;
+    registry: 'npm' | 'pypi';
+    /** Vulnerable when installed version < this (exclusive). */
+    ltExclusive?: string;
+    /** Vulnerable when installed version <= this (inclusive). */
+    leInclusive?: string;
+    severity: Severity;
+    cvss?: number;
+    title: string;
+    reference: string;
+}
+export declare const KNOWN_VULNS: KnownVuln[];

package/dist/data/knownCves.js

@@ -0,0 +1,49 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Known-CVE / advisory version matcher for MCP client / proxy / server
+ * packages. A cheap, high-signal check that pure content scanners lack:
+ * if a config pins a package to a version in a known-vulnerable range, say so.
+ *
+ * Ranges are intentionally simple (`< x` or `<= x`). Keep this list current;
+ * it is data, not logic.
+ */
+export const KNOWN_VULNS = [
+    {
+        id: 'CVE-2025-6514',
+        package: 'mcp-remote',
+        registry: 'npm',
+        ltExclusive: '0.1.16',
+        severity: 'critical',
+        cvss: 9.6,
+        title: 'mcp-remote OS command injection via crafted authorization endpoint',
+        reference: 'https://nvd.nist.gov/vuln/detail/CVE-2025-6514',
+    },
+    {
+        id: 'CVE-2025-49596',
+        package: '@modelcontextprotocol/inspector',
+        registry: 'npm',
+        ltExclusive: '0.14.1',
+        severity: 'critical',
+        cvss: 9.4,
+        title: 'MCP Inspector DNS-rebinding leads to RCE on the developer host',
+        reference: 'https://nvd.nist.gov/vuln/detail/CVE-2025-49596',
+    },
+    {
+        id: 'GHSA-git-mcp-cyanheads',
+        package: '@cyanheads/git-mcp-server',
+        registry: 'npm',
+        leInclusive: '2.1.4',
+        severity: 'high',
+        title: 'git-mcp-server argument injection in git commands',
+        reference: 'https://github.com/advisories',
+    },
+    {
+        id: 'GHSA-mcp-server-git',
+        package: 'mcp-server-git',
+        registry: 'pypi',
+        ltExclusive: '2025.12.18',
+        severity: 'high',
+        title: 'mcp-server-git path traversal / argument injection',
+        reference: 'https://github.com/advisories',
+    },
+];

package/dist/data/protectedPackages.d.ts

@@ -0,0 +1,30 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * The curated "protected" MCP package list. Typosquatting is checked only
+ * against this anchor set (never all-pairs), which is both fast and precise.
+ * Weekly-download figures feed the download-anomaly gate: a near-miss on a
+ * high-traffic name with near-zero downloads of its own is malicious, not a
+ * coincidence.
+ */
+export interface ProtectedPackage {
+    name: string;
+    registry: 'npm' | 'pypi';
+    /** Approximate weekly downloads (order of magnitude, for the anomaly gate). */
+    weeklyDownloads?: number;
+    official?: boolean;
+}
+export declare const PROTECTED_PACKAGES: ProtectedPackage[];
+/**
+ * Fake official-scope / homoglyph scope patterns. Any package whose scope
+ * matches one of these is impersonating the official namespace.
+ */
+export declare const FAKE_SCOPE_PATTERNS: RegExp[];
+/** Bare (unscoped) names that shadow official *scoped* packages. */
+export declare const UNSCOPED_SHADOWS: Set<string>;
+/**
+ * Pre-computed known squats mapping a malicious/confusable name to the real
+ * package it imitates (collapses several matchers to an instant hit).
+ */
+export declare const KNOWN_SQUATS: Record<string, string>;
+/** Combosquat suffixes stripped before comparison (e.g. `foo-js` ≈ `foo`). */
+export declare const COMBOSQUAT_SUFFIXES: string[];