mcptrustchecker 1.0.0

package/dist/data/protectedPackages.js

@@ -0,0 +1,89 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * The curated "protected" MCP package list. Typosquatting is checked only
+ * against this anchor set (never all-pairs), which is both fast and precise.
+ * Weekly-download figures feed the download-anomaly gate: a near-miss on a
+ * high-traffic name with near-zero downloads of its own is malicious, not a
+ * coincidence.
+ */
+export const PROTECTED_PACKAGES = [
+    // --- Official @modelcontextprotocol npm scope ---
+    { name: '@modelcontextprotocol/sdk', registry: 'npm', weeklyDownloads: 42_800_000, official: true },
+    { name: '@modelcontextprotocol/inspector', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/create-server', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-filesystem', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-memory', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-sequential-thinking', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-everything', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-github', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-gitlab', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-slack', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-postgres', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-puppeteer', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-brave-search', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-google-maps', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-google-drive', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-redis', registry: 'npm', official: true },
+    { name: '@modelcontextprotocol/server-sentry', registry: 'npm', official: true },
+    { name: 'mcp-remote', registry: 'npm', official: true },
+    // --- Official PyPI ---
+    { name: 'mcp', registry: 'pypi', official: true },
+    { name: 'mcp-server-git', registry: 'pypi', official: true },
+    { name: 'mcp-server-fetch', registry: 'pypi', official: true },
+    { name: 'mcp-server-time', registry: 'pypi', official: true },
+    { name: 'mcp-server-sqlite', registry: 'pypi', official: true },
+    // --- Popular community / vendor (npm) with download weights ---
+    { name: '@playwright/mcp', registry: 'npm', weeklyDownloads: 5_990_000 },
+    { name: '@upstash/context7-mcp', registry: 'npm', weeklyDownloads: 524_000 },
+    { name: '@notionhq/notion-mcp-server', registry: 'npm', weeklyDownloads: 126_000 },
+    { name: 'firecrawl-mcp', registry: 'npm', weeklyDownloads: 93_000 },
+    { name: '@sentry/mcp-server', registry: 'npm', weeklyDownloads: 85_000 },
+    { name: 'figma-developer-mcp', registry: 'npm', weeklyDownloads: 76_000 },
+    { name: '@supabase/mcp-server-supabase', registry: 'npm', weeklyDownloads: 65_000 },
+    { name: '@wonderwhy-er/desktop-commander', registry: 'npm', weeklyDownloads: 43_000 },
+    { name: 'tavily-mcp', registry: 'npm', weeklyDownloads: 28_000 },
+    { name: 'exa-mcp-server', registry: 'npm', weeklyDownloads: 18_000 },
+    { name: '@executeautomation/playwright-mcp-server', registry: 'npm', weeklyDownloads: 17_000 },
+    { name: '@brave/brave-search-mcp-server', registry: 'npm', weeklyDownloads: 15_000 },
+    { name: '@21st-dev/magic', registry: 'npm', weeklyDownloads: 13_000 },
+    { name: '@stripe/mcp', registry: 'npm', weeklyDownloads: 11_000 },
+    { name: '@browsermcp/mcp', registry: 'npm', weeklyDownloads: 9_000 },
+    { name: '@heroku/mcp-server', registry: 'npm', weeklyDownloads: 6_000 },
+    { name: '@cloudflare/mcp-server-cloudflare', registry: 'npm', weeklyDownloads: 2_000 },
+];
+/**
+ * Fake official-scope / homoglyph scope patterns. Any package whose scope
+ * matches one of these is impersonating the official namespace.
+ */
+export const FAKE_SCOPE_PATTERNS = [
+    /^@modlecontextprotocol\//i,
+    /^@model-context-protocol\//i,
+    /^@modelcontextprotocal\//i,
+    /^@modelcontext-protocol\//i,
+    /^@modelcontextprotocol-/i, // unscoped hyphen shadow of the scope
+];
+/** Bare (unscoped) names that shadow official *scoped* packages. */
+export const UNSCOPED_SHADOWS = new Set([
+    'server-filesystem',
+    'server-github',
+    'server-memory',
+    'server-slack',
+    'server-postgres',
+    'modelcontextprotocol-sdk',
+]);
+/**
+ * Pre-computed known squats mapping a malicious/confusable name to the real
+ * package it imitates (collapses several matchers to an instant hit).
+ */
+export const KNOWN_SQUATS = {
+    'playwright-mcp': '@playwright/mcp',
+    'playwright-mcp-server': '@playwright/mcp',
+    'mcp-playwright': '@playwright/mcp',
+    '@playwright/mcp-server': '@playwright/mcp',
+    '@playwrite/mcp': '@playwright/mcp',
+    'context7-mcp': '@upstash/context7-mcp',
+    'notion-mcp-server': '@notionhq/notion-mcp-server',
+    'firecrawl-mcp-server': 'firecrawl-mcp',
+};
+/** Combosquat suffixes stripped before comparison (e.g. `foo-js` ≈ `foo`). */
+export const COMBOSQUAT_SUFFIXES = ['-js', '-py', '-core', '-utils', '-mcp', '-server', '-official', '-cli'];

package/dist/data/ruleCatalog.d.ts

@@ -0,0 +1,16 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Human-readable catalogue of every rule MCP Trust Checker can emit. Powers
+ * `mcptrustchecker rules` / `mcptrustchecker explain <id>` and docs/rules.md. Keep in sync
+ * with the detectors (tested by rules.test.ts).
+ */
+import type { Category, Severity } from '../types.js';
+export interface RuleDoc {
+    id: string;
+    title: string;
+    category: Category;
+    severity: Severity;
+    summary: string;
+}
+export declare const RULE_CATALOG: RuleDoc[];
+export declare function findRule(id: string): RuleDoc | undefined;

package/dist/data/ruleCatalog.js

@@ -0,0 +1,94 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Human-readable catalogue of every rule MCP Trust Checker can emit. Powers
+ * `mcptrustchecker rules` / `mcptrustchecker explain <id>` and docs/rules.md. Keep in sync
+ * with the detectors (tested by rules.test.ts).
+ */
+export const RULE_CATALOG = [
+    // Stage 1 — Unicode
+    { id: 'MTC-UNI-001', title: 'Tags-block smuggling channel', category: 'injection', severity: 'critical', summary: 'Invisible U+E0000 Tags characters decode to hidden ASCII instructions read by the model.' },
+    { id: 'MTC-UNI-002', title: 'Variation-selector byte channel', category: 'injection', severity: 'high', summary: 'Variation selectors used as a 256-value side channel to smuggle a payload.' },
+    { id: 'MTC-UNI-003', title: 'Bidirectional override', category: 'injection', severity: 'high', summary: 'BiDi override characters can reorder how text is displayed vs. how it is read.' },
+    { id: 'MTC-UNI-004', title: 'Bidirectional isolate/mark', category: 'injection', severity: 'medium', summary: 'BiDi isolates/marks in metadata; can be used to hide or reorder content.' },
+    { id: 'MTC-UNI-005', title: 'Zero-width / invisible-math run', category: 'injection', severity: 'medium', summary: 'Zero-width or invisible-math characters, above threshold, indicate an encoded payload.' },
+    { id: 'MTC-UNI-006', title: 'Default-ignorable characters', category: 'injection', severity: 'medium', summary: 'Default-ignorable characters (soft hyphen, interlinear annotation, etc.) in metadata.' },
+    { id: 'MTC-UNI-007', title: 'Unusual whitespace', category: 'injection', severity: 'low', summary: 'Non-breaking / ideographic / thin spaces used in place of normal spaces.' },
+    { id: 'MTC-UNI-008', title: 'Control characters', category: 'injection', severity: 'high', summary: 'C0/C1 control characters (excluding tab/newline/CR) are abnormal in metadata.' },
+    { id: 'MTC-UNI-009', title: 'Mixed-script / homoglyph text', category: 'injection', severity: 'high', summary: 'A single token mixes scripts (e.g. Latin + Cyrillic) — a homoglyph impersonation signal.' },
+    { id: 'MTC-UNI-010', title: 'ANSI terminal escape sequence', category: 'injection', severity: 'high', summary: 'ANSI/CSI/OSC escapes in metadata can hide or rewrite what a terminal user sees (consent phishing).' },
+    // Stage 2 — Injection
+    { id: 'MTC-INJ-AUTH-1', title: 'Authority framing', category: 'injection', severity: 'low', summary: '"IMPORTANT"/"ATTENTION"-style authority framing in tool metadata (weak signal on its own).' },
+    { id: 'MTC-INJ-AUTH-2', title: 'Instruction-override directive', category: 'injection', severity: 'high', summary: '"ignore previous instructions"-style override aimed at the model.' },
+    { id: 'MTC-INJ-SECRECY-1', title: 'Secrecy directive', category: 'injection', severity: 'high', summary: 'Metadata instructs the model to conceal an action from the user.' },
+    { id: 'MTC-INJ-SECRECY-2', title: 'Fabricated policy framing', category: 'injection', severity: 'medium', summary: 'Fake "compliance"/"policy" justification for an instruction.' },
+    { id: 'MTC-INJ-SEQ-1', title: 'Forced-sequencing (line jumping)', category: 'injection', severity: 'medium', summary: '"before using any tool"/"always call this first" — line-jumping directive.' },
+    { id: 'MTC-INJ-SEQ-2', title: 'Conditional behavior directive', category: 'injection', severity: 'low', summary: 'Conditional "when you…"/"every time…" behavior instruction.' },
+    { id: 'MTC-INJ-TARGET-1', title: 'Sensitive file/credential reference', category: 'injection', severity: 'high', summary: 'Metadata references ~/.ssh, .env, credentials, API keys, etc.' },
+    { id: 'MTC-INJ-TARGET-2', title: 'Context/history solicitation', category: 'injection', severity: 'high', summary: 'Metadata asks for system prompt, chat history, or environment details.' },
+    { id: 'MTC-INJ-EXFIL-1', title: 'Exfil-shaped parameter description', category: 'injection', severity: 'high', summary: 'A parameter description tells the model to include/append context or file contents.' },
+    { id: 'MTC-INJ-SHADOW-1', title: 'Cross-tool redirection of a recipient/credential', category: 'injection', severity: 'high', summary: 'Description reroutes an email/message/credential/token to another destination (exfiltration/hijack).' },
+    { id: 'MTC-INJ-ENC-1', title: 'Encoded-payload decode/execute', category: 'injection', severity: 'high', summary: 'Instruction to decode base64/hex and execute the result.' },
+    { id: 'MTC-INJ-ENC-2', title: 'Encoded blob + decode instruction', category: 'injection', severity: 'high', summary: 'A long base64 blob paired with a decode/execute instruction.' },
+    { id: 'MTC-INJ-CMD-1', title: 'Shell command in metadata', category: 'injection', severity: 'high', summary: 'A shell command (rm -rf, curl|sh, etc.) embedded in tool metadata.' },
+    { id: 'MTC-INJ-CAPS', title: 'Excessive ALL-CAPS', category: 'injection', severity: 'low', summary: 'A run of shouted words used to give injected instructions false authority.' },
+    { id: 'MTC-INJ-PARAM', title: 'Suspicious hidden-channel parameter', category: 'injection', severity: 'medium', summary: 'A parameter named like a known exfil channel (side_note, context, feedback…).' },
+    { id: 'MTC-INJ-POISON', title: 'Compound tool-poisoning pattern', category: 'injection', severity: 'critical', summary: 'Multiple poisoning signals co-occur in one field — the canonical poisoning shape.' },
+    { id: 'MTC-INJ-SHADOW-2', title: 'Cross-server tool-name collision', category: 'injection', severity: 'high', summary: 'A tool name collides with (or is a homoglyph/near-miss of) a tool on another scanned server.' },
+    { id: 'MTC-INJ-SHADOW-3', title: 'Tool-selection hijack (suppress other tools)', category: 'injection', severity: 'high', summary: '"Do not use / ignore the other tools"-style text that suppresses all sibling tools in model selection.' },
+    { id: 'MTC-INJ-SHADOW-4', title: 'Assertive tool self-preference', category: 'injection', severity: 'low', summary: 'Comparative self-promotion ("only correct tool", "use this instead of the X tool") — common in legit docs; a confidence-axis nudge that escalates only with secrecy/override.' },
+    { id: 'MTC-INJ-SECRET-1', title: 'Embedded credential value', category: 'exfiltration', severity: 'high', summary: 'A live-looking secret (AWS/GitHub/Slack/JWT/PEM…) is hardcoded in server metadata.' },
+    { id: 'MTC-INJ-URL-1', title: 'Suspicious external URL in tool metadata', category: 'exfiltration', severity: 'medium', summary: 'A hardcoded webhook/paste/exfil endpoint or raw IP in a tool description — a data-exfiltration channel.' },
+    // Stage 3 — Capability
+    { id: 'MTC-CAP-001', title: 'Command/code execution capability', category: 'permissions', severity: 'high', summary: 'Tool runs shell commands or evaluates code.' },
+    { id: 'MTC-CAP-002', title: 'Filesystem mutation capability', category: 'permissions', severity: 'medium', summary: 'Tool can write, overwrite, or delete files.' },
+    { id: 'MTC-CAP-003', title: 'Annotation-vs-behavior mismatch', category: 'permissions', severity: 'medium', summary: 'Tool claims read-only/non-destructive but its behavior mutates/egresses.' },
+    { id: 'MTC-CAP-004', title: 'Open-world tool reads sensitive data', category: 'exfiltration', severity: 'medium', summary: 'openWorldHint=true plus a sensitive-data read is a lethal-trifecta indicator.' },
+    { id: 'MTC-CAP-005', title: 'Mutating tool without destructiveHint', category: 'hygiene', severity: 'low', summary: 'A tool that mutates/egresses declares no destructiveHint, so some clients may not prompt.' },
+    { id: 'MTC-CAP-006', title: 'Unconstrained command parameter', category: 'permissions', severity: 'medium', summary: 'A command-shaped param with no enum/pattern — the command-injection precondition.' },
+    { id: 'MTC-CAP-007', title: 'Unconstrained URL/host parameter', category: 'network', severity: 'medium', summary: 'An outbound tool takes an unbounded URL/host — the SSRF / cloud-metadata precondition.' },
+    { id: 'MTC-CAP-008', title: 'Unconstrained path parameter', category: 'permissions', severity: 'low', summary: 'A file tool takes an unconstrained path — the path-traversal precondition.' },
+    { id: 'MTC-CAP-009', title: 'Declared sampling capability', category: 'permissions', severity: 'medium', summary: 'Server can drive the client LLM with its own prompts (reverse-trust / resource drain).' },
+    { id: 'MTC-CAP-010', title: 'Declared elicitation capability', category: 'permissions', severity: 'medium', summary: 'Server can pop mid-session input requests (capability; blast-radius only).' },
+    { id: 'MTC-CAP-011', title: 'Elicitation solicits secrets', category: 'exfiltration', severity: 'high', summary: 'Declared elicitation + a secret-seeking field — a consent-phishing threat.' },
+    // Stage 4 — Toxic flow
+    { id: 'MTC-FLOW-001', title: 'Self-contained exfiltration primitive', category: 'exfiltration', severity: 'critical', summary: 'One tool ingests untrusted input, reads sensitive data, and can exfiltrate it.' },
+    { id: 'MTC-FLOW-002', title: 'Completed trifecta across tools', category: 'exfiltration', severity: 'critical', summary: 'Untrusted-input, sensitive-source and external-sink roles co-exist across tools.' },
+    { id: 'MTC-FLOW-003', title: 'Read-and-egress in one tool', category: 'exfiltration', severity: 'high', summary: 'A single tool both reads sensitive data and can send it out.' },
+    { id: 'MTC-FLOW-004', title: 'Source + sink co-exist', category: 'exfiltration', severity: 'high', summary: 'A sensitive-data source and an external sink are exposed together.' },
+    { id: 'MTC-FLOW-005', title: 'Untrusted input drives an action', category: 'exfiltration', severity: 'medium', summary: 'Untrusted input can reach an external-action sink (no sensitive source found).' },
+    // Stage 5 — Supply chain
+    { id: 'MTC-SUP-001', title: 'Known typosquat', category: 'supply-chain', severity: 'high', summary: 'Name matches a known impersonation of a popular package.' },
+    { id: 'MTC-SUP-002', title: 'Impersonated official scope', category: 'supply-chain', severity: 'high', summary: 'Scope crafted to look like @modelcontextprotocol.' },
+    { id: 'MTC-SUP-003', title: 'Unscoped shadow', category: 'supply-chain', severity: 'high', summary: 'Unscoped name shadowing an official scoped package.' },
+    { id: 'MTC-SUP-004', title: 'Homoglyph squat', category: 'supply-chain', severity: 'high', summary: 'Confusable skeleton identical to a protected package.' },
+    { id: 'MTC-SUP-005', title: 'Edit-distance near-miss', category: 'supply-chain', severity: 'medium', summary: 'Damerau-Levenshtein 1–2 from a protected package, download-anomaly gated.' },
+    { id: 'MTC-SUP-006', title: 'Combosquat', category: 'supply-chain', severity: 'medium', summary: 'Protected name plus a decorative suffix (-js, -server, …).' },
+    { id: 'MTC-SUP-010', title: 'Install-time scripts', category: 'supply-chain', severity: 'high', summary: 'Package runs pre/post/install scripts — the dominant malware vector.' },
+    { id: 'MTC-SUP-011', title: 'No source repository', category: 'supply-chain', severity: 'low', summary: 'Published artifact cannot be compared against reviewable source.' },
+    { id: 'MTC-SUP-012', title: 'No license', category: 'hygiene', severity: 'low', summary: 'Package declares no license.' },
+    { id: 'MTC-SUP-013', title: 'Package not version-pinned', category: 'supply-chain', severity: 'low', summary: 'Installed with @latest/floating spec — the rug-pull enabler; pinning is the recommended control.' },
+    { id: 'MTC-SUP-014', title: 'Dependency squat / advisory match', category: 'supply-chain', severity: 'medium', summary: 'A declared dependency resembles a protected package or matches a known advisory by name.' },
+    // Stage 6 — Posture / CVE
+    { id: 'MTC-NET-001', title: 'Known-vulnerable version', category: 'supply-chain', severity: 'high', summary: 'Installed version is in a known-CVE range.' },
+    { id: 'MTC-NET-002', title: 'User-controlled stdio command', category: 'network', severity: 'critical', summary: 'stdio command from untrusted config without an allowlist — stdio RCE class.' },
+    { id: 'MTC-NET-003', title: 'Plaintext HTTP transport', category: 'network', severity: 'medium', summary: 'Server reached over http:// — traffic and tokens exposed.' },
+    { id: 'MTC-NET-004', title: 'Bound to 0.0.0.0', category: 'network', severity: 'medium', summary: 'Server exposed on all interfaces; verify authentication.' },
+    { id: 'MTC-NET-005', title: 'Remote HTTP endpoint', category: 'network', severity: 'info', summary: 'Remote endpoint; server-side auth is out of scope for static analysis.' },
+    { id: 'MTC-NET-006', title: 'Local HTTP/SSE — verify Origin (DNS rebinding)', category: 'network', severity: 'low', summary: 'A browser-reachable local MCP server is exposed to DNS rebinding unless it validates Host/Origin.' },
+    // Stage 7 — Integrity
+    { id: 'MTC-TOFU-001', title: 'Surface drift since pin (rug pull)', category: 'supply-chain', severity: 'high', summary: 'Canonical fingerprint no longer matches the pinned value.' },
+    // Meta
+    { id: 'MTC-META-001', title: 'Empty surface — nothing to analyze', category: 'hygiene', severity: 'info', summary: 'No tools/prompts/resources found; an empty surface is not a clean bill of health.' },
+    // Stage 4b — Implementation-level source analysis (what the code DOES, not what the tool claims)
+    { id: 'MTC-SRC-001', title: 'Dynamic code execution in server code', category: 'permissions', severity: 'high', summary: 'eval / new Function / vm / exec(compile) — arbitrary-code-execution primitive in the implementation.' },
+    { id: 'MTC-SRC-002', title: 'Shell/command execution in server code', category: 'permissions', severity: 'high', summary: 'child_process / os.system / subprocess(shell=True) — command-execution sink; RCE with unsanitized input.' },
+    { id: 'MTC-SRC-003', title: 'Hardcoded egress to an external endpoint', category: 'exfiltration', severity: 'medium', summary: 'A fixed outbound http(s) call to a non-local host in the code — an exfiltration/telemetry channel.' },
+    { id: 'MTC-SRC-004', title: 'Obfuscated / encoded payload in server code', category: 'injection', severity: 'high', summary: 'Decode-and-execute of an encoded blob, or \\x-escaped / fromCharCode runs hiding logic from review.' },
+    { id: 'MTC-SRC-005', title: 'Dynamic module load from a non-literal', category: 'permissions', severity: 'medium', summary: 'require()/import()/__import__ from a variable — loads runtime-chosen (attacker-influenced) code.' },
+    { id: 'MTC-SRC-006', title: 'Credential-path read or environment dump in code', category: 'exfiltration', severity: 'high', summary: 'Reads ~/.ssh / .aws/credentials / .netrc, or serializes the whole environment — a sensitive-data source.' },
+    { id: 'MTC-SRC-007', title: 'Unsafe deserialization', category: 'permissions', severity: 'high', summary: 'pickle.loads / yaml.load / node-serialize / marshal.loads — a classic deserialization RCE gadget.' },
+    { id: 'MTC-SRC-008', title: 'Hardcoded credential value in server code', category: 'exfiltration', severity: 'high', summary: 'A live-looking secret (AWS/GitHub/Slack/JWT/PEM…) embedded in the source, shipped to every install.' },
+];
+export function findRule(id) {
+    return RULE_CATALOG.find((r) => r.id.toLowerCase() === id.toLowerCase());
+}

package/dist/data/sourcePatterns.d.ts

@@ -0,0 +1,25 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Implementation-level sink lexicon. Tool metadata says what a server *claims*
+ * to do; these patterns read what its code *actually does* — the dangerous
+ * sinks (arbitrary execution, egress, secret handling) that a poisoned or
+ * negligent server hides in its implementation. Deterministic, no LLM.
+ *
+ * Kept high-precision: each pattern anchors on a real dangerous API, and the
+ * detector escalates when attacker-influenced data can reach it.
+ */
+import type { Confidence, Severity } from '../types.js';
+export interface SourcePattern {
+    id: string;
+    title: string;
+    /** Language hint for the finding text. */
+    lang: 'js' | 'py' | 'any';
+    pattern: RegExp;
+    severity: Severity;
+    confidence: Confidence;
+    category: 'permissions' | 'exfiltration' | 'injection';
+    why: string;
+}
+/** File extensions we treat as scannable server source. */
+export declare const SOURCE_EXTENSIONS: Set<string>;
+export declare const SOURCE_PATTERNS: SourcePattern[];

package/dist/data/sourcePatterns.js

@@ -0,0 +1,92 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Implementation-level sink lexicon. Tool metadata says what a server *claims*
+ * to do; these patterns read what its code *actually does* — the dangerous
+ * sinks (arbitrary execution, egress, secret handling) that a poisoned or
+ * negligent server hides in its implementation. Deterministic, no LLM.
+ *
+ * Kept high-precision: each pattern anchors on a real dangerous API, and the
+ * detector escalates when attacker-influenced data can reach it.
+ */
+/** File extensions we treat as scannable server source. */
+export const SOURCE_EXTENSIONS = new Set(['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts', '.jsx', '.tsx', '.py']);
+export const SOURCE_PATTERNS = [
+    // ── Arbitrary code execution ────────────────────────────────────────────────
+    {
+        id: 'MTC-SRC-001',
+        title: 'Dynamic code execution in server code',
+        lang: 'any',
+        pattern: /\beval\s*\(|\bnew\s+Function\s*\(|\bFunction\s*\(\s*['"`]|vm\.(?:runIn\w+|compileFunction)\s*\(|\bexec\s*\(\s*compile\s*\(/,
+        severity: 'high',
+        confidence: 'strong',
+        category: 'permissions',
+        why: 'Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code.',
+    },
+    // ── Shell / command execution ───────────────────────────────────────────────
+    {
+        id: 'MTC-SRC-002',
+        title: 'Shell/command execution in server code',
+        lang: 'any',
+        pattern: /child_process|\bexecSync\s*\(|\bexec\s*\(|\bspawn(?:Sync)?\s*\(|\bos\.system\s*\(|\bos\.popen\s*\(|subprocess\.(?:run|call|Popen|check_output)\s*\(|\bshell\s*[:=]\s*True/,
+        severity: 'high',
+        confidence: 'strong',
+        category: 'permissions',
+        why: 'Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE.',
+    },
+    // ── Outbound egress to a hardcoded external host ────────────────────────────
+    {
+        id: 'MTC-SRC-003',
+        title: 'Hardcoded egress to an external endpoint',
+        lang: 'any',
+        // fetch/axios/requests/urllib to a literal http(s) URL that is NOT localhost.
+        pattern: /(?:fetch|axios(?:\.\w+)?|requests\.\w+|urllib\.request\.urlopen|https?\.request|got|node-fetch)\s*\(\s*['"`]https?:\/\/(?!localhost|127\.0\.0\.1|0\.0\.0\.0)[^'"`]+['"`]/,
+        severity: 'medium',
+        confidence: 'strong',
+        category: 'exfiltration',
+        why: 'A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data.',
+    },
+    // ── Obfuscation / hidden payloads ───────────────────────────────────────────
+    {
+        id: 'MTC-SRC-004',
+        title: 'Obfuscated / encoded payload in server code',
+        lang: 'any',
+        pattern: /(?:eval|exec|new Function|Function)\s*\(\s*(?:atob|Buffer\.from|base64\.b64decode)\b|atob\s*\([^)]*\)\s*\)?\s*(?:\)|;)?\s*.{0,20}\beval|Buffer\.from\s*\([^)]*,\s*['"`]base64['"`]\s*\)[^;]{0,40}(?:eval|Function|exec)|base64\.b64decode\s*\([^)]*\)[^;]{0,40}(?:exec|eval)|(?:\\x[0-9a-fA-F]{2}){8,}|String\.fromCharCode\s*\((?:\s*\d+\s*,){8,}/,
+        severity: 'high',
+        confidence: 'strong',
+        category: 'injection',
+        why: 'Decoding an encoded blob and executing it is how malicious logic is hidden from human review of the source.',
+    },
+    // ── Dynamic module loading ──────────────────────────────────────────────────
+    {
+        id: 'MTC-SRC-005',
+        title: 'Dynamic module load from a non-literal',
+        lang: 'any',
+        pattern: /\brequire\s*\(\s*(?!['"`])[A-Za-z_$][\w$.]*\s*\)|\bimport\s*\(\s*(?!['"`])[A-Za-z_$][\w$.]*\s*\)|__import__\s*\(\s*(?!['"`])/,
+        severity: 'medium',
+        confidence: 'heuristic',
+        category: 'permissions',
+        why: 'Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths.',
+    },
+    // ── Sensitive filesystem / environment reads ────────────────────────────────
+    {
+        id: 'MTC-SRC-006',
+        title: 'Reads a sensitive credential path or dumps the environment',
+        lang: 'any',
+        pattern: /~\/\.ssh|id_rsa\b|\.aws\/credentials|\.config\/gcloud|\.netrc\b|\.docker\/config\.json|JSON\.stringify\s*\(\s*process\.env\s*\)|\bdict\s*\(\s*os\.environ\s*\)|json\.dumps\s*\(\s*(?:dict\s*\(\s*)?os\.environ/,
+        severity: 'high',
+        confidence: 'strong',
+        category: 'exfiltration',
+        why: 'Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress.',
+    },
+    // ── Unsafe deserialization ──────────────────────────────────────────────────
+    {
+        id: 'MTC-SRC-007',
+        title: 'Unsafe deserialization',
+        lang: 'any',
+        pattern: /\bpickle\.loads?\s*\(|yaml\.load\s*\((?![^)]*Loader\s*=\s*yaml\.SafeLoader)|node-serialize|\bunserialize\s*\(|marshal\.loads?\s*\(/,
+        severity: 'high',
+        confidence: 'strong',
+        category: 'permissions',
+        why: 'Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class).',
+    },
+];

package/dist/data/unicode.d.ts

@@ -0,0 +1,34 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Unicode threat data (pinned to Unicode 17.0.0).
+ *
+ * These are the codepoint families used to *smuggle* instructions into text an
+ * LLM reads but a human reviewer does not. MCP Trust Checker's rule is to **decode, not
+ * just strip** — where a family carries a payload (Tags block, variation
+ * selectors) we recover and surface it as evidence.
+ *
+ * References:
+ *  - Unicode UAX #9 (BiDi), UTS #39 (Security Mechanisms), UAX #44 (Character DB)
+ *  - BiDi override source attacks (CVE-2021-42574)
+ *  - "Invisible prompt injection" via Tags block & variation-selector channels
+ */
+export type InvisibleFamily = 'tags' | 'variation-selector' | 'bidi-override' | 'bidi-isolate' | 'bidi-mark' | 'zero-width' | 'invisible-math' | 'default-ignorable' | 'unusual-whitespace' | 'control';
+export interface CodepointRange {
+    start: number;
+    end: number;
+    family: InvisibleFamily;
+}
+/** Ordered, non-overlapping ranges scanned by the Unicode detector. */
+export declare const INVISIBLE_RANGES: CodepointRange[];
+/** C0/C1 control ranges, excluding the benign tab/newline/CR. */
+export declare const CONTROL_RANGES: CodepointRange[];
+/** Whitespace codepoints that are legitimately ubiquitous and never flagged. */
+export declare const BENIGN_CONTROL: Set<number>;
+/** Classify a single codepoint into an invisible family, or null if ordinary. */
+export declare function classifyCodepoint(cp: number): InvisibleFamily | null;
+/** Decode a Tags-block codepoint to its mirrored ASCII char, or null. */
+export declare function decodeTagCodepoint(cp: number): string | null;
+/** Decode a variation selector to the byte value it encodes in the side channel. */
+export declare function decodeVariationSelectorByte(cp: number): number | null;
+/** Human labels for families, used in findings. */
+export declare const FAMILY_LABELS: Record<InvisibleFamily, string>;

package/dist/data/unicode.js

@@ -0,0 +1,99 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Unicode threat data (pinned to Unicode 17.0.0).
+ *
+ * These are the codepoint families used to *smuggle* instructions into text an
+ * LLM reads but a human reviewer does not. MCP Trust Checker's rule is to **decode, not
+ * just strip** — where a family carries a payload (Tags block, variation
+ * selectors) we recover and surface it as evidence.
+ *
+ * References:
+ *  - Unicode UAX #9 (BiDi), UTS #39 (Security Mechanisms), UAX #44 (Character DB)
+ *  - BiDi override source attacks (CVE-2021-42574)
+ *  - "Invisible prompt injection" via Tags block & variation-selector channels
+ */
+/** Ordered, non-overlapping ranges scanned by the Unicode detector. */
+export const INVISIBLE_RANGES = [
+    // Tags block (ASCII mirror) — the highest-signal smuggling channel.
+    { start: 0xe0000, end: 0xe007f, family: 'tags' },
+    // Variation selectors (VS1–VS16 and the supplementary VS17–VS256 side channel).
+    { start: 0xfe00, end: 0xfe0f, family: 'variation-selector' },
+    { start: 0xe0100, end: 0xe01ef, family: 'variation-selector' },
+    // BiDi overrides & embeddings.
+    { start: 0x202a, end: 0x202e, family: 'bidi-override' },
+    // BiDi isolates.
+    { start: 0x2066, end: 0x2069, family: 'bidi-isolate' },
+    // BiDi marks.
+    { start: 0x200e, end: 0x200f, family: 'bidi-mark' },
+    { start: 0x061c, end: 0x061c, family: 'bidi-mark' },
+    // Zero-width family.
+    { start: 0x200b, end: 0x200b, family: 'zero-width' }, // ZWSP
+    { start: 0x200c, end: 0x200d, family: 'zero-width' }, // ZWNJ, ZWJ
+    { start: 0xfeff, end: 0xfeff, family: 'zero-width' }, // BOM / ZWNBSP
+    // Invisible math operators (used as 0/1 bits).
+    { start: 0x2060, end: 0x2064, family: 'invisible-math' },
+    // Other default-ignorables.
+    { start: 0x00ad, end: 0x00ad, family: 'default-ignorable' }, // soft hyphen
+    { start: 0x180e, end: 0x180e, family: 'default-ignorable' }, // Mongolian vowel separator
+    { start: 0x17b4, end: 0x17b5, family: 'default-ignorable' }, // Khmer inherent vowels
+    { start: 0xfff9, end: 0xfffb, family: 'default-ignorable' }, // interlinear annotation
+    { start: 0x2028, end: 0x2029, family: 'default-ignorable' }, // line / paragraph separator
+    // Unusual whitespace.
+    { start: 0x00a0, end: 0x00a0, family: 'unusual-whitespace' }, // NBSP
+    { start: 0x1680, end: 0x1680, family: 'unusual-whitespace' }, // Ogham space
+    { start: 0x2000, end: 0x200a, family: 'unusual-whitespace' }, // en/em/thin spaces
+    { start: 0x202f, end: 0x202f, family: 'unusual-whitespace' }, // narrow NBSP
+    { start: 0x205f, end: 0x205f, family: 'unusual-whitespace' }, // medium math space
+    { start: 0x3000, end: 0x3000, family: 'unusual-whitespace' }, // ideographic space
+];
+/** C0/C1 control ranges, excluding the benign tab/newline/CR. */
+export const CONTROL_RANGES = [
+    { start: 0x0000, end: 0x0008, family: 'control' },
+    { start: 0x000b, end: 0x000c, family: 'control' },
+    { start: 0x000e, end: 0x001f, family: 'control' },
+    { start: 0x007f, end: 0x007f, family: 'control' },
+    { start: 0x0080, end: 0x009f, family: 'control' },
+];
+/** Whitespace codepoints that are legitimately ubiquitous and never flagged. */
+export const BENIGN_CONTROL = new Set([0x09, 0x0a, 0x0d]);
+const ALL_RANGES = [...INVISIBLE_RANGES, ...CONTROL_RANGES];
+/** Classify a single codepoint into an invisible family, or null if ordinary. */
+export function classifyCodepoint(cp) {
+    if (BENIGN_CONTROL.has(cp))
+        return null;
+    for (const r of ALL_RANGES) {
+        if (cp >= r.start && cp <= r.end)
+            return r.family;
+    }
+    return null;
+}
+/** Decode a Tags-block codepoint to its mirrored ASCII char, or null. */
+export function decodeTagCodepoint(cp) {
+    if (cp < 0xe0000 || cp > 0xe007f)
+        return null;
+    const ascii = cp - 0xe0000;
+    if (ascii === 0x7f)
+        return null; // CANCEL tag — a terminator, not printable
+    return String.fromCharCode(ascii);
+}
+/** Decode a variation selector to the byte value it encodes in the side channel. */
+export function decodeVariationSelectorByte(cp) {
+    if (cp >= 0xfe00 && cp <= 0xfe0f)
+        return cp - 0xfe00; // VS1–VS16 → 0–15
+    if (cp >= 0xe0100 && cp <= 0xe01ef)
+        return cp - 0xe0100 + 16; // VS17–VS256 → 16–255
+    return null;
+}
+/** Human labels for families, used in findings. */
+export const FAMILY_LABELS = {
+    tags: 'Unicode Tags block (ASCII smuggling channel)',
+    'variation-selector': 'variation-selector byte channel',
+    'bidi-override': 'bidirectional override',
+    'bidi-isolate': 'bidirectional isolate',
+    'bidi-mark': 'bidirectional mark',
+    'zero-width': 'zero-width / joiner character',
+    'invisible-math': 'invisible math operator (steganographic bit)',
+    'default-ignorable': 'default-ignorable character',
+    'unusual-whitespace': 'unusual whitespace',
+    control: 'C0/C1 control character',
+};

package/dist/detectors/capability.d.ts

@@ -0,0 +1,14 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Stage 3 — Capability findings. The capability *tags* are computed by the
+ * engine and shared via context; here we turn them into findings:
+ *  - dangerous capabilities (command/code execution, filesystem mutation);
+ *  - annotation-vs-behavior mismatch, open-world + sensitive read, and missing
+ *    destructiveHint (the annotation-truthfulness story);
+ *  - schema-level injection preconditions (unconstrained command / URL / path
+ *    parameters — the advertised half of command-injection / SSRF / traversal);
+ *  - declared server capabilities that are high-signal on their own (sampling,
+ *    elicitation) — static proxies for classes rivals only catch at runtime.
+ */
+import type { Detector } from '../types.js';
+export declare const capabilityDetector: Detector;