mcptrustchecker 1.0.0

package/dist/detectors/capability.js

@@ -0,0 +1,281 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Stage 3 — Capability findings. The capability *tags* are computed by the
+ * engine and shared via context; here we turn them into findings:
+ *  - dangerous capabilities (command/code execution, filesystem mutation);
+ *  - annotation-vs-behavior mismatch, open-world + sensitive read, and missing
+ *    destructiveHint (the annotation-truthfulness story);
+ *  - schema-level injection preconditions (unconstrained command / URL / path
+ *    parameters — the advertised half of command-injection / SSRF / traversal);
+ *  - declared server capabilities that are high-signal on their own (sampling,
+ *    elicitation) — static proxies for classes rivals only catch at runtime.
+ */
+import { CAPABILITY_SIGNALS, COMMAND_PARAM_NAMES, PARAM_NAME_SIGNALS, PATH_PARAM_NAMES, SECRET_FIELD_NAMES, SSRF_PARAM_NAMES, } from '../data/capabilityLexicon.js';
+import { normalizeForMatch } from '../util/text.js';
+function capFor(caps, tool) {
+    return caps.find((c) => c.tool === tool);
+}
+const MUTATION_TAGS = new Set(['code-exec', 'file-write']);
+/**
+ * Is a tool's state-mutating capability (code-exec / file-write) evidenced
+ * *operatively* — by its NAME or a PARAMETER — rather than only by a keyword
+ * that happens to appear in its prose description? A read-only getter like
+ * `get_config` whose description merely lists "defaultShell" / "blockedCommands"
+ * picks up a `code-exec` tag from the word "shell", but it does not execute
+ * anything. Only name/param evidence is strong enough to call an annotation a
+ * lie (MTC-CAP-003), so a description-only mention must not trip that rule.
+ */
+function mutationOperativelyEvidenced(tool) {
+    const nameNorm = normalizeForMatch(typeof tool.name === 'string' ? tool.name : '');
+    const nameTokens = new Set(nameNorm.split(' ').filter(Boolean));
+    for (const sig of CAPABILITY_SIGNALS) {
+        if (!MUTATION_TAGS.has(sig.tag))
+            continue;
+        for (const kw of sig.keywords) {
+            const k = normalizeForMatch(kw);
+            if (k.includes(' ') ? nameNorm.includes(k) : nameTokens.has(k))
+                return true;
+        }
+    }
+    const pTokens = new Set(Object.keys(tool.inputSchema?.properties ?? {}).flatMap((n) => n.toLowerCase().split(/[^a-z0-9]+/i).filter(Boolean)));
+    for (const sig of PARAM_NAME_SIGNALS) {
+        if (!MUTATION_TAGS.has(sig.tag))
+            continue;
+        for (const pn of sig.names)
+            if (pTokens.has(pn))
+                return true;
+    }
+    return false;
+}
+/** True if a string-typed property has no enum/pattern constraint. */
+function isUnconstrainedString(prop) {
+    if (!prop || typeof prop !== 'object')
+        return true;
+    const t = prop.type;
+    const stringy = t === undefined || t === 'string' || (Array.isArray(t) && t.includes('string'));
+    if (!stringy)
+        return false;
+    return !prop.enum && !prop.pattern;
+}
+function nameMatches(paramName, list) {
+    const tokens = paramName.toLowerCase().split(/[^a-z0-9]+/i).filter(Boolean);
+    return list.some((n) => tokens.includes(n));
+}
+export const capabilityDetector = {
+    id: 'capability',
+    stage: 3,
+    title: 'Capability & annotation analysis',
+    run(ctx) {
+        const findings = [];
+        for (const tool of ctx.surface.tools) {
+            if (!tool || typeof tool !== 'object' || typeof tool.name !== 'string')
+                continue;
+            const cap = capFor(ctx.capabilities, tool.name);
+            if (!cap)
+                continue;
+            const tags = cap.tags;
+            const reasons = cap.reasons;
+            const has = (t) => tags.includes(t);
+            if (has('code-exec')) {
+                findings.push({
+                    ruleId: 'MTC-CAP-001',
+                    title: `Tool "${tool.name}" exposes command/code execution`,
+                    category: 'permissions',
+                    severity: 'high',
+                    confidence: 'strong',
+                    description: `Tool "${tool.name}" appears to run shell commands or evaluate code ` +
+                        `(${(reasons['code-exec'] ?? []).join(', ')}). Arbitrary execution driven by model input is one of ` +
+                        `the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.`,
+                    remediation: 'Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.',
+                    location: { kind: 'tool', name: tool.name },
+                    owasp: 'LLM05:2025 Improper Output Handling',
+                    data: { tags },
+                });
+            }
+            if (has('file-write')) {
+                findings.push({
+                    ruleId: 'MTC-CAP-002',
+                    title: `Tool "${tool.name}" can modify the filesystem`,
+                    category: 'permissions',
+                    severity: 'medium',
+                    confidence: 'strong',
+                    description: `Tool "${tool.name}" can write, overwrite or delete files ` +
+                        `(${(reasons['file-write'] ?? []).join(', ')}). Verify it is scoped to a safe directory.`,
+                    remediation: 'Constrain file operations to an explicit, non-sensitive root; reject path traversal.',
+                    location: { kind: 'tool', name: tool.name },
+                    data: { tags },
+                });
+            }
+            // Annotation-vs-behavior mismatch. Only a tool that genuinely MODIFIES
+            // state (file-write / code-exec) contradicts readOnly/non-destructive — a
+            // tool that merely makes an outbound request (e.g. fetch/scrape) can be
+            // legitimately read-only, so external-sink alone is NOT a contradiction.
+            const claimsReadOnly = tool.annotations?.readOnlyHint === true;
+            const claimsNonDestructive = tool.annotations?.destructiveHint === false;
+            // Require OPERATIVE evidence (name/param), not a description-only keyword,
+            // before calling the annotation a lie — else a read-only getter that merely
+            // describes shell/exec config (get_config, get_prompts) is a false positive.
+            const actuallyMutates = (has('file-write') || has('code-exec')) && mutationOperativelyEvidenced(tool);
+            if ((claimsReadOnly || claimsNonDestructive) && actuallyMutates) {
+                findings.push({
+                    ruleId: 'MTC-CAP-003',
+                    title: `Annotation contradicts behavior on "${tool.name}"`,
+                    category: 'permissions',
+                    severity: 'medium',
+                    confidence: 'strong',
+                    description: `Tool "${tool.name}" advertises ${claimsReadOnly ? 'readOnlyHint=true' : 'destructiveHint=false'} but its ` +
+                        `derived capabilities include state-modifying actions (${tags.join(', ')}). Tool annotations are ` +
+                        `attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server ` +
+                        `hides a destructive tool.`,
+                    remediation: 'Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.',
+                    location: { kind: 'tool', name: tool.name },
+                    owasp: 'LLM06:2025 Excessive Agency',
+                    data: { tags, annotations: tool.annotations },
+                });
+            }
+            // open-world hint + sensitive read = a lethal-trifecta signal from annotations.
+            if (tool.annotations?.openWorldHint === true && has('sensitive-source')) {
+                findings.push({
+                    ruleId: 'MTC-CAP-004',
+                    title: `Open-world tool "${tool.name}" also reads sensitive data`,
+                    category: 'exfiltration',
+                    severity: 'medium',
+                    confidence: 'heuristic',
+                    description: `Tool "${tool.name}" declares openWorldHint=true — it interacts with entities outside the trust boundary — ` +
+                        `while also reading sensitive data. That combination is a canonical lethal-trifecta indicator.`,
+                    remediation: 'Separate outward-facing tools from sensitive-data reads; require confirmation between them.',
+                    location: { kind: 'tool', name: tool.name },
+                    owasp: 'LLM02:2025 Sensitive Information Disclosure',
+                    data: { tags },
+                });
+            }
+            // Missing destructiveHint on a genuinely destructive tool (write/exec only,
+            // to avoid flagging the very common annotation-less "send" tool).
+            const noDestructiveHint = !tool.annotations || tool.annotations.destructiveHint === undefined;
+            const genuinelyDestructive = has('file-write') || has('code-exec');
+            if (genuinelyDestructive && noDestructiveHint) {
+                findings.push({
+                    ruleId: 'MTC-CAP-005',
+                    title: `Mutating tool "${tool.name}" declares no destructiveHint`,
+                    category: 'hygiene',
+                    severity: 'low',
+                    confidence: 'heuristic',
+                    description: `Tool "${tool.name}" can mutate/egress but declares no destructiveHint. Clients that don't default to ` +
+                        `spec-safe behavior may not prompt before running it.`,
+                    remediation: 'Declare accurate annotations, and gate destructive tools on user confirmation regardless.',
+                    location: { kind: 'tool', name: tool.name },
+                    data: { tags },
+                });
+            }
+            // Schema-level injection preconditions (only on the relevant capability).
+            const props = tool.inputSchema?.properties ?? {};
+            for (const [pname, pschema] of Object.entries(props)) {
+                if (!isUnconstrainedString(pschema))
+                    continue;
+                const field = `inputSchema.properties.${pname}`;
+                if (has('code-exec') && nameMatches(pname, COMMAND_PARAM_NAMES)) {
+                    findings.push({
+                        ruleId: 'MTC-CAP-006',
+                        title: `Unconstrained command parameter "${pname}" on "${tool.name}"`,
+                        category: 'permissions',
+                        severity: 'medium',
+                        confidence: 'heuristic',
+                        description: `Tool "${tool.name}" takes a command-shaped parameter "${pname}" with no enum/pattern constraint. ` +
+                            `Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.`,
+                        remediation: 'Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.',
+                        location: { kind: 'tool', name: tool.name, field },
+                        owasp: 'LLM05:2025 Improper Output Handling',
+                        data: { param: pname },
+                    });
+                }
+                else if ((has('external-sink') || has('untrusted-input')) && nameMatches(pname, SSRF_PARAM_NAMES)) {
+                    findings.push({
+                        ruleId: 'MTC-CAP-007',
+                        title: `Unconstrained URL/host parameter "${pname}" on "${tool.name}"`,
+                        category: 'network',
+                        severity: 'medium',
+                        confidence: 'heuristic',
+                        description: `Tool "${tool.name}" takes a URL/host parameter "${pname}" with no allowlist/pattern. An outbound-request ` +
+                            `tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).`,
+                        remediation: 'Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.',
+                        location: { kind: 'tool', name: tool.name, field },
+                        owasp: 'LLM06:2025 Excessive Agency',
+                        data: { param: pname },
+                    });
+                }
+                else if ((has('file-write') || has('sensitive-source')) && nameMatches(pname, PATH_PARAM_NAMES)) {
+                    findings.push({
+                        ruleId: 'MTC-CAP-008',
+                        title: `Unconstrained path parameter "${pname}" on "${tool.name}"`,
+                        category: 'permissions',
+                        severity: 'low',
+                        confidence: 'heuristic',
+                        description: `Tool "${tool.name}" takes a path parameter "${pname}" with no constraint. Without a canonicalize-and-` +
+                            `contain check (not visible statically), this permits ../ traversal outside the intended root.`,
+                        remediation: 'Resolve and verify the path stays within an allowed root; reject traversal sequences.',
+                        location: { kind: 'tool', name: tool.name, field },
+                        data: { param: pname },
+                    });
+                }
+            }
+        }
+        // --- Server-capability pass (declared capabilities are facts, not guesses) ---
+        const rawCaps = ctx.surface.server.capabilities;
+        const caps = rawCaps && typeof rawCaps === 'object' ? rawCaps : {};
+        if ('sampling' in caps) {
+            findings.push({
+                ruleId: 'MTC-CAP-009',
+                title: 'Server declares the sampling capability',
+                category: 'permissions',
+                severity: 'medium',
+                confidence: 'strong',
+                description: 'This server declares the MCP `sampling` capability, letting it drive the client\'s own LLM with ' +
+                    'server-authored prompts. That reverse-trust channel enables token/resource drain, conversation hijack, ' +
+                    'and covert tool invocation. Most benign servers do not need sampling.',
+                remediation: 'Only grant sampling to servers you fully trust; review what the server does with completions.',
+                location: { kind: 'server', field: 'capabilities.sampling' },
+                owasp: 'LLM06:2025 Excessive Agency',
+            });
+        }
+        if ('elicitation' in caps) {
+            // Plain declared elicitation is a CAPABILITY (MTC-CAP-010, not scored). Only
+            // when it also solicits a secret is it a trust THREAT (MTC-CAP-011, scored).
+            const secretField = findSecretSeekingField(ctx);
+            findings.push({
+                ruleId: secretField ? 'MTC-CAP-011' : 'MTC-CAP-010',
+                title: 'Server declares the elicitation capability' + (secretField ? ' and solicits secrets' : ''),
+                category: secretField ? 'exfiltration' : 'permissions',
+                severity: secretField ? 'high' : 'medium',
+                confidence: 'strong',
+                description: 'This server declares the MCP `elicitation` capability (it can pop mid-session input requests). This ' +
+                    'enables consent-fatigue conditioning and phishing.' +
+                    (secretField
+                        ? ` It also exposes a secret-seeking field ("${secretField}") — the spec forbids collecting secrets via elicitation.`
+                        : ''),
+                remediation: 'Treat elicitation prompts as untrusted UI; never enter credentials into an elicitation request.',
+                location: { kind: 'server', field: 'capabilities.elicitation' },
+                owasp: 'LLM02:2025 Sensitive Information Disclosure',
+                ...(secretField ? { evidence: secretField } : {}),
+            });
+        }
+        return findings;
+    },
+};
+/** Find the first param/prompt-arg name that solicits a secret, if any. */
+function findSecretSeekingField(ctx) {
+    const check = (name) => name.toLowerCase().split(/[^a-z0-9]+/i).some((tok) => SECRET_FIELD_NAMES.includes(tok));
+    for (const tool of ctx.surface.tools) {
+        if (!tool || typeof tool !== 'object')
+            continue;
+        for (const p of Object.keys(tool.inputSchema?.properties ?? {}))
+            if (check(p))
+                return p;
+    }
+    for (const prompt of ctx.surface.prompts) {
+        const args = Array.isArray(prompt?.arguments) ? prompt.arguments : [];
+        for (const a of args)
+            if (a && typeof a === 'object' && typeof a.name === 'string' && check(a.name))
+                return a.name;
+    }
+    return undefined;
+}

package/dist/detectors/collision.d.ts

@@ -0,0 +1,11 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Cross-server tool-name collision / shadowing. When a scan covers several
+ * servers (e.g. a whole client config), a malicious server can register a tool
+ * whose name collides with — or is a homoglyph/near-miss of — a trusted
+ * server's tool, hijacking selection by connection order or embedding rank
+ * (SAFE-T1004 / T1008). This complements description-level shadowing
+ * (MTC-INJ-SHADOW-1) with name-level collision across the server set.
+ */
+import type { Detector } from '../types.js';
+export declare const collisionDetector: Detector;

package/dist/detectors/collision.js

@@ -0,0 +1,63 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Cross-server tool-name collision / shadowing. When a scan covers several
+ * servers (e.g. a whole client config), a malicious server can register a tool
+ * whose name collides with — or is a homoglyph/near-miss of — a trusted
+ * server's tool, hijacking selection by connection order or embedding rank
+ * (SAFE-T1004 / T1008). This complements description-level shadowing
+ * (MTC-INJ-SHADOW-1) with name-level collision across the server set.
+ */
+import { skeleton } from '../data/confusables.js';
+import { damerauLevenshtein } from '../util/distance.js';
+export const collisionDetector = {
+    id: 'collision',
+    stage: 4,
+    title: 'Cross-server tool-name collision',
+    run(ctx) {
+        const siblings = ctx.siblingTools ?? [];
+        if (siblings.length === 0)
+            return [];
+        const findings = [];
+        const seen = new Set();
+        for (const tool of ctx.surface.tools) {
+            if (!tool || typeof tool !== 'object' || typeof tool.name !== 'string')
+                continue;
+            const nameLower = tool.name.toLowerCase();
+            const skel = skeleton(tool.name);
+            for (const sib of siblings) {
+                const sibLower = sib.name.toLowerCase();
+                const key = [tool.name, sib.server, sib.name].join('|');
+                if (seen.has(key))
+                    continue;
+                let hit = null;
+                if (nameLower === sibLower) {
+                    hit = { severity: 'high', confidence: 'strong', why: 'an identical name' };
+                }
+                else if (skel === skeleton(sib.name)) {
+                    hit = { severity: 'high', confidence: 'strong', why: 'a homoglyph/confusable name' };
+                }
+                else if (tool.name.length >= 4 && damerauLevenshtein(nameLower, sibLower) <= 1) {
+                    hit = { severity: 'medium', confidence: 'heuristic', why: 'a near-identical name (edit distance 1)' };
+                }
+                if (!hit)
+                    continue;
+                seen.add(key);
+                findings.push({
+                    ruleId: 'MTC-INJ-SHADOW-2',
+                    title: `Tool "${tool.name}" collides with a tool on server "${sib.server}"`,
+                    category: 'injection',
+                    severity: hit.severity,
+                    confidence: hit.confidence,
+                    description: `This server's tool "${tool.name}" shares ${hit.why} with "${sib.name}" on server "${sib.server}". ` +
+                        `Colliding tool names let a server hijack tool selection (by connection order or embedding rank) and ` +
+                        `shadow a trusted tool.`,
+                    remediation: 'Namespace tools per server and require the user to confirm which server a tool belongs to; distrust duplicate names.',
+                    location: { kind: 'tool', name: tool.name },
+                    owasp: 'LLM01:2025 Prompt Injection',
+                    data: { collidesWith: sib },
+                });
+            }
+        }
+        return findings;
+    },
+};

package/dist/detectors/flowGraph.d.ts

@@ -0,0 +1,43 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Dataflow graph for the toxic-flow analysis.
+ *
+ * MCP tools are not statically wired to each other — the *agent* orchestrates
+ * them. So the conservative model is: any tool's output can reach any other
+ * tool's input via the model ("agent-mediated" edge). On top of that we detect
+ * the higher-plausibility case where a consumer exposes an unconstrained
+ * free-text / URL parameter that a producer's output can be dropped straight
+ * into ("schema-wired" edge).
+ *
+ * From that graph we recover a concrete UNTRUSTED → SENSITIVE → SINK **path**
+ * (the actual attack chain, e.g. `fetch_url → read_file → http_request`) and
+ * grade confidence by how directly the legs are wired — turning a co-presence
+ * heuristic into an explainable, path-level result.
+ */
+import type { ToolCapability, ToolDef } from '../types.js';
+export type FlowEdgeKind = 'schema-wired' | 'agent-mediated';
+export interface FlowEdge {
+    from: string;
+    to: string;
+    kind: FlowEdgeKind;
+}
+export interface FlowPath {
+    /** Ordered tools forming the attack chain (2 or 3 hops). */
+    path: string[];
+    edges: FlowEdge[];
+    /** True when at least one leg is a direct schema wire (higher plausibility). */
+    wired: boolean;
+}
+/** Does this tool expose an unconstrained string param a producer can feed? */
+export declare function consumesFreeText(tool: ToolDef | undefined): boolean;
+/**
+ * Recover a representative untrusted → sensitive → sink attack path. Legs are
+ * chosen deterministically (lexicographic) and preferentially across *distinct*
+ * tools so the chain reads as a real composition. Returns null if the trifecta
+ * is not completable.
+ */
+export declare function representativeTrifectaPath(caps: ToolCapability[], tools: ToolDef[]): FlowPath | null;
+/** A representative sensitive-source → external-sink path (no untrusted leg). */
+export declare function representativeExfilPath(caps: ToolCapability[], tools: ToolDef[]): FlowPath | null;
+/** Render a path as an arrow chain for a human-readable finding. */
+export declare function renderPath(p: FlowPath): string;

package/dist/detectors/flowGraph.js

@@ -0,0 +1,100 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Dataflow graph for the toxic-flow analysis.
+ *
+ * MCP tools are not statically wired to each other — the *agent* orchestrates
+ * them. So the conservative model is: any tool's output can reach any other
+ * tool's input via the model ("agent-mediated" edge). On top of that we detect
+ * the higher-plausibility case where a consumer exposes an unconstrained
+ * free-text / URL parameter that a producer's output can be dropped straight
+ * into ("schema-wired" edge).
+ *
+ * From that graph we recover a concrete UNTRUSTED → SENSITIVE → SINK **path**
+ * (the actual attack chain, e.g. `fetch_url → read_file → http_request`) and
+ * grade confidence by how directly the legs are wired — turning a co-presence
+ * heuristic into an explainable, path-level result.
+ */
+/** Parameter names that accept free-form content a producer's output slots into. */
+const FREE_TEXT_PARAMS = new Set([
+    'content', 'body', 'text', 'data', 'input', 'message', 'prompt', 'query', 'q',
+    'url', 'uri', 'html', 'markdown', 'payload', 'value', 'string', 'document',
+]);
+/** Does this tool expose an unconstrained string param a producer can feed? */
+export function consumesFreeText(tool) {
+    const props = tool?.inputSchema?.properties;
+    if (!props || typeof props !== 'object')
+        return false;
+    for (const [name, schema] of Object.entries(props)) {
+        if (!FREE_TEXT_PARAMS.has(name.toLowerCase()))
+            continue;
+        const t = schema?.type;
+        const stringy = t === undefined || t === 'string' || (Array.isArray(t) && t.includes('string'));
+        const constrained = Boolean(schema?.enum) ||
+            Boolean(schema?.pattern);
+        if (stringy && !constrained)
+            return true;
+    }
+    return false;
+}
+function edge(from, to, toolByName) {
+    // A leg is a "schema wire" when the consumer takes free text (the producer's
+    // output can be dropped straight in); otherwise the agent has to mediate it.
+    const kind = consumesFreeText(toolByName.get(to)) ? 'schema-wired' : 'agent-mediated';
+    return { from, to, kind };
+}
+const has = (c, tag) => c.tags.includes(tag);
+const isSink = (c) => has(c, 'external-sink') || has(c, 'code-exec');
+/**
+ * Recover a representative untrusted → sensitive → sink attack path. Legs are
+ * chosen deterministically (lexicographic) and preferentially across *distinct*
+ * tools so the chain reads as a real composition. Returns null if the trifecta
+ * is not completable.
+ */
+export function representativeTrifectaPath(caps, tools) {
+    const toolByName = new Map(tools.filter((t) => t && typeof t.name === 'string').map((t) => [t.name, t]));
+    const sorted = [...caps].sort((a, b) => (a.tool < b.tool ? -1 : a.tool > b.tool ? 1 : 0));
+    const untrusted = sorted.filter((c) => has(c, 'untrusted-input')).map((c) => c.tool);
+    const sources = sorted.filter((c) => has(c, 'sensitive-source')).map((c) => c.tool);
+    const sinks = sorted.filter(isSink).map((c) => c.tool);
+    if (!untrusted.length || !sources.length || !sinks.length)
+        return null;
+    // Prefer legs on distinct tools; fall back to reuse when the surface is small.
+    const pick = (pool, avoid) => pool.find((t) => !avoid.has(t)) ?? pool[0];
+    const used = new Set();
+    const u = pick(untrusted, used);
+    used.add(u);
+    const s = pick(sources, used);
+    used.add(s);
+    const k = pick(sinks, used);
+    // Collapse consecutive duplicates (a tool holding two roles) into one node.
+    const nodes = [];
+    for (const n of [u, s, k])
+        if (nodes[nodes.length - 1] !== n)
+            nodes.push(n);
+    const edges = [];
+    for (let i = 0; i < nodes.length - 1; i++)
+        edges.push(edge(nodes[i], nodes[i + 1], toolByName));
+    return { path: nodes, edges, wired: edges.some((e) => e.kind === 'schema-wired') };
+}
+/** A representative sensitive-source → external-sink path (no untrusted leg). */
+export function representativeExfilPath(caps, tools) {
+    const toolByName = new Map(tools.filter((t) => t && typeof t.name === 'string').map((t) => [t.name, t]));
+    const sorted = [...caps].sort((a, b) => (a.tool < b.tool ? -1 : a.tool > b.tool ? 1 : 0));
+    const sources = sorted.filter((c) => has(c, 'sensitive-source')).map((c) => c.tool);
+    const sinks = sorted.filter(isSink).map((c) => c.tool);
+    const s = sources[0];
+    const k = sinks.find((x) => x !== s) ?? sinks[0];
+    if (!s || !k)
+        return null;
+    const nodes = s === k ? [s] : [s, k];
+    const edges = nodes.length === 2 ? [edge(nodes[0], nodes[1], toolByName)] : [];
+    return { path: nodes, edges, wired: edges.some((e) => e.kind === 'schema-wired') };
+}
+/** Render a path as an arrow chain for a human-readable finding. */
+export function renderPath(p) {
+    if (p.path.length === 1)
+        return p.path[0];
+    return p.path
+        .map((n, i) => (i === 0 ? n : `${p.edges[i - 1].kind === 'schema-wired' ? '⇒' : '→'} ${n}`))
+        .join(' ');
+}

package/dist/detectors/index.d.ts

@@ -0,0 +1,18 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Detector registry. The engine runs every registered detector, then runs the
+ * toxic-flow analysis and integrity check (which need cross-cutting state and
+ * are wired directly in the engine).
+ */
+import type { Detector } from '../types.js';
+import { metaDetector } from './meta.js';
+import { unicodeDetector } from './unicode.js';
+import { injectionDetector } from './injection.js';
+import { capabilityDetector } from './capability.js';
+import { collisionDetector } from './collision.js';
+import { supplyChainDetector } from './supplyChain.js';
+import { postureDetector } from './posture.js';
+import { sourceDetector } from './source.js';
+export declare const DETECTORS: Detector[];
+export { metaDetector, unicodeDetector, injectionDetector, capabilityDetector, collisionDetector, supplyChainDetector, postureDetector, sourceDetector, };
+export { analyzeToxicFlows } from './toxicFlow.js';

package/dist/detectors/index.js

@@ -0,0 +1,26 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Detector registry. The engine runs every registered detector, then runs the
+ * toxic-flow analysis and integrity check (which need cross-cutting state and
+ * are wired directly in the engine).
+ */
+import { metaDetector } from './meta.js';
+import { unicodeDetector } from './unicode.js';
+import { injectionDetector } from './injection.js';
+import { capabilityDetector } from './capability.js';
+import { collisionDetector } from './collision.js';
+import { supplyChainDetector } from './supplyChain.js';
+import { postureDetector } from './posture.js';
+import { sourceDetector } from './source.js';
+export const DETECTORS = [
+    metaDetector,
+    unicodeDetector,
+    injectionDetector,
+    capabilityDetector,
+    collisionDetector,
+    supplyChainDetector,
+    postureDetector,
+    sourceDetector,
+];
+export { metaDetector, unicodeDetector, injectionDetector, capabilityDetector, collisionDetector, supplyChainDetector, postureDetector, sourceDetector, };
+export { analyzeToxicFlows } from './toxicFlow.js';

package/dist/detectors/injection.d.ts

@@ -0,0 +1,9 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Stage 2 — Content injection heuristics (tool poisoning / line jumping /
+ * shadowing). Runs the pattern lexicon across four channels, then escalates
+ * when multiple poisoning signals co-occur in one field — the shape of a real
+ * tool-poisoning attack rather than an incidental keyword.
+ */
+import type { Detector } from '../types.js';
+export declare const injectionDetector: Detector;