mcptrustchecker 1.0.0

package/dist/detectors/injection.js

@@ -0,0 +1,178 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Stage 2 — Content injection heuristics (tool poisoning / line jumping /
+ * shadowing). Runs the pattern lexicon across four channels, then escalates
+ * when multiple poisoning signals co-occur in one field — the shape of a real
+ * tool-poisoning attack rather than an incidental keyword.
+ */
+import { collectTextFields } from '../util/text.js';
+import { compiledInjectionPatterns, longestAllCapsRun, hasBase64Blob } from '../util/text.js';
+import { ALLCAPS_RUN_WORDS, SECRET_PATTERNS, SUSPICIOUS_PARAM_NAMES, SUSPICIOUS_URL_HOST, SUSPICIOUS_URL_PATH, URL_IP_LITERAL, } from '../data/injectionPatterns.js';
+const PATTERNS = compiledInjectionPatterns();
+function firstMatch(regex, text) {
+    const m = text.match(regex);
+    return m ? m[0] : undefined;
+}
+export const injectionDetector = {
+    id: 'injection',
+    stage: 2,
+    title: 'Prompt-injection / tool-poisoning heuristics',
+    run(ctx) {
+        const findings = [];
+        for (const field of collectTextFields(ctx.surface)) {
+            const kindsHit = new Set();
+            for (const p of PATTERNS) {
+                if (!p.meta.channels.includes(field.channel))
+                    continue;
+                const match = firstMatch(p.regex, field.text);
+                if (!match)
+                    continue;
+                kindsHit.add(p.kind);
+                findings.push({
+                    ruleId: p.id,
+                    title: p.meta.title,
+                    category: 'injection',
+                    severity: p.meta.baseSeverity,
+                    confidence: p.meta.baseConfidence,
+                    description: `${p.meta.title} detected in the ${field.location.field ?? 'text'} of ` +
+                        `${field.location.kind}${field.location.name ? ` "${field.location.name}"` : ''}. ` +
+                        `Instruction-like content in tool metadata is executed by the model, not the human, and is the ` +
+                        `primary tool-poisoning vector.`,
+                    remediation: 'Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / ' +
+                        'secrecy / sequencing language in metadata as hostile.',
+                    location: field.location,
+                    evidence: match.slice(0, 160),
+                    owasp: 'LLM01:2025 Prompt Injection',
+                    data: { kind: p.kind },
+                });
+            }
+            // Escalation to CRITICAL requires a genuinely malicious signal — secrecy
+            // (conceal from the user) or an instruction override — co-occurring with
+            // at least one other poisoning signal. A mere sensitive-target reference
+            // is NOT enough (legit tools reference credentials/context), nor is plain
+            // emphasis + sequencing ("IMPORTANT: call X first").
+            const strongSignal = kindsHit.has('secrecy') || kindsHit.has('override');
+            if (strongSignal && kindsHit.size >= 2) {
+                findings.push({
+                    ruleId: 'MTC-INJ-POISON',
+                    title: 'Compound tool-poisoning pattern',
+                    category: 'injection',
+                    severity: 'critical',
+                    confidence: 'strong',
+                    description: `Multiple tool-poisoning signals co-occur in a single field (${[...kindsHit].join(', ')}), including a ` +
+                        `concealment / override / sensitive-target directive. Together they form an instruction aimed at the ` +
+                        `model — the canonical tool-poisoning shape, not ordinary documentation.`,
+                    remediation: 'Do not install this server; the metadata is engineered to manipulate the assistant.',
+                    location: field.location,
+                    evidence: field.text.slice(0, 200),
+                    owasp: 'LLM01:2025 Prompt Injection',
+                    data: { kinds: [...kindsHit] },
+                });
+            }
+            // ALL-CAPS shouting (weak signal, contextual).
+            if ((field.channel === 'tool-description' ||
+                field.channel === 'param-description' ||
+                field.channel === 'server-instructions') &&
+                longestAllCapsRun(field.text) >= ALLCAPS_RUN_WORDS) {
+                findings.push({
+                    ruleId: 'MTC-INJ-CAPS',
+                    title: 'Excessive ALL-CAPS emphasis in metadata',
+                    category: 'injection',
+                    severity: 'low',
+                    confidence: 'heuristic',
+                    description: 'A run of shouted words is a common way to give injected instructions false authority.',
+                    location: field.location,
+                    evidence: field.text.slice(0, 120),
+                });
+            }
+            // Base64 blob in prose paired with an explicit decode/execute verb.
+            // Requires an actual DECODE verb near a blob — "execute"/"eval" describing
+            // a tool's normal function (e.g. "execute batched operations") must not match.
+            if (field.channel !== 'other' &&
+                hasBase64Blob(field.text) &&
+                /\b(decode|base64|atob|b64decode|un-?base64)\b/i.test(field.text)) {
+                findings.push({
+                    ruleId: 'MTC-INJ-ENC-2',
+                    title: 'Encoded blob paired with a decode/execute instruction',
+                    category: 'injection',
+                    severity: 'high',
+                    confidence: 'strong',
+                    description: 'A long base64-looking blob appears alongside a decode/execute instruction — a common way to hide a payload from reviewers.',
+                    location: field.location,
+                    evidence: field.text.slice(0, 160),
+                    owasp: 'LLM01:2025 Prompt Injection',
+                });
+            }
+            // Embedded secret VALUE (a real credential, not merely a reference).
+            for (const sp of SECRET_PATTERNS) {
+                const m = field.text.match(sp.pattern);
+                if (m) {
+                    findings.push({
+                        ruleId: 'MTC-INJ-SECRET-1',
+                        title: `Embedded ${sp.label} in ${field.location.field ?? 'metadata'}`,
+                        category: 'exfiltration',
+                        severity: 'high',
+                        confidence: 'confirmed',
+                        description: `A live-looking ${sp.label} is embedded in the ${field.location.field ?? 'metadata'} of ` +
+                            `${field.location.kind}${field.location.name ? ` "${field.location.name}"` : ''}. Hardcoded ` +
+                            `credentials in server metadata leak to every client that lists this server.`,
+                        remediation: 'Remove the credential and rotate it; never ship secrets in tool metadata.',
+                        location: field.location,
+                        evidence: `${sp.label}: ${m[0].slice(0, 4)}…(redacted)`,
+                        owasp: 'LLM02:2025 Sensitive Information Disclosure',
+                        data: { secretType: sp.id },
+                    });
+                }
+            }
+            // Suspicious external URL in metadata — a hardcoded webhook/paste/exfil
+            // endpoint or raw IP in a tool description is a data-exfiltration channel
+            // (the malicious-URL tool-poisoning move: "send the result to …").
+            for (const um of field.text.matchAll(/\bhttps?:\/\/([^\s/"'`)\]]+)(\/[^\s"'`)]*)?/gi)) {
+                const host = (um[1] ?? '').toLowerCase();
+                const rest = um[2] ?? '';
+                if (SUSPICIOUS_URL_HOST.test(host) || URL_IP_LITERAL.test(host) || SUSPICIOUS_URL_PATH.test(host + rest)) {
+                    findings.push({
+                        ruleId: 'MTC-INJ-URL-1',
+                        title: 'Suspicious external URL in tool metadata',
+                        category: 'exfiltration',
+                        severity: 'medium',
+                        confidence: 'strong',
+                        description: `A hardcoded link to a request/paste/webhook sink (or raw IP) appears in the ` +
+                            `${field.location.field ?? 'metadata'} of ${field.location.kind}` +
+                            `${field.location.name ? ` "${field.location.name}"` : ''}. Tool metadata pointing the model at a ` +
+                            `fixed external endpoint is a data-exfiltration channel — the classic "send the output to …" poisoning.`,
+                        remediation: 'A legitimate tool takes its destination as a validated parameter; it does not hardcode a webhook/paste sink in its description.',
+                        location: field.location,
+                        evidence: um[0].slice(0, 120),
+                        owasp: 'LLM02:2025 Sensitive Information Disclosure',
+                    });
+                    break; // one per field is enough
+                }
+            }
+        }
+        // Suspicious hidden-parameter names.
+        for (const tool of ctx.surface.tools) {
+            if (!tool || typeof tool !== 'object')
+                continue;
+            const props = tool.inputSchema?.properties ?? {};
+            for (const paramName of Object.keys(props)) {
+                if (SUSPICIOUS_PARAM_NAMES.includes(paramName.toLowerCase())) {
+                    findings.push({
+                        ruleId: 'MTC-INJ-PARAM',
+                        title: `Suspicious hidden-channel parameter "${paramName}"`,
+                        category: 'injection',
+                        severity: 'medium',
+                        confidence: 'heuristic',
+                        description: `Tool "${tool.name}" exposes a parameter named "${paramName}", a name frequently used as a ` +
+                            `hidden exfiltration channel (the model is told to stuff context/history/secrets into it).`,
+                        remediation: 'Verify what this parameter is actually used for; hidden "context"/"note" params are a red flag.',
+                        location: { kind: 'tool', name: tool.name, field: `inputSchema.properties.${paramName}` },
+                        owasp: 'LLM01:2025 Prompt Injection',
+                        data: { param: paramName },
+                    });
+                }
+            }
+        }
+        return findings;
+    },
+};

package/dist/detectors/meta.d.ts

@@ -0,0 +1,8 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Meta / hygiene checks about the scan itself — most importantly, flagging when
+ * a surface is empty so a malformed or wrong-shape manifest is never mistaken
+ * for a clean, safe server.
+ */
+import type { Detector } from '../types.js';
+export declare const metaDetector: Detector;

package/dist/detectors/meta.js

@@ -0,0 +1,33 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Meta / hygiene checks about the scan itself — most importantly, flagging when
+ * a surface is empty so a malformed or wrong-shape manifest is never mistaken
+ * for a clean, safe server.
+ */
+export const metaDetector = {
+    id: 'meta',
+    stage: 0,
+    title: 'Scan metadata',
+    run(ctx) {
+        const { surface } = ctx;
+        const empty = surface.tools.length === 0 && surface.prompts.length === 0 && surface.resources.length === 0;
+        // A package-only scan legitimately has no live surface; don't warn there.
+        if (empty && surface.source.kind !== 'package') {
+            return [
+                {
+                    ruleId: 'MTC-META-001',
+                    title: 'Empty surface — nothing to analyze',
+                    category: 'hygiene',
+                    severity: 'info',
+                    confidence: 'strong',
+                    description: 'No tools, prompts, or resources were found on this surface. This may mean the server exposes ' +
+                        'nothing, or that the input was not a recognizable MCP manifest. An empty surface is NOT a clean ' +
+                        'bill of health — there was simply nothing to score.',
+                    remediation: 'Confirm the target is the right manifest/endpoint and that the server actually advertises tools.',
+                    location: { kind: 'server' },
+                },
+            ];
+        }
+        return [];
+    },
+};

package/dist/detectors/posture.d.ts

@@ -0,0 +1,9 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Stage 6 — Transport / host posture + known-CVE version matcher.
+ * Cheap, high-value checks that content-only scanners miss.
+ */
+import type { Detector, Finding, PackageMeta } from '../types.js';
+/** Match package metadata against the known-vuln table. Exported for tests. */
+export declare function matchKnownVulns(meta: PackageMeta): Finding[];
+export declare const postureDetector: Detector;

package/dist/detectors/posture.js

@@ -0,0 +1,128 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Stage 6 — Transport / host posture + known-CVE version matcher.
+ * Cheap, high-value checks that content-only scanners miss.
+ */
+import { KNOWN_VULNS } from '../data/knownCves.js';
+import { compareVersions } from '../util/distance.js';
+/** Match package metadata against the known-vuln table. Exported for tests. */
+export function matchKnownVulns(meta) {
+    const findings = [];
+    if (typeof meta.name !== 'string' || typeof meta.version !== 'string')
+        return findings;
+    for (const v of KNOWN_VULNS) {
+        if (v.package !== meta.name)
+            continue;
+        const version = meta.version;
+        // Only compare a CONCRETE version. "latest", "*", "^1.2.0", ranges etc. would
+        // otherwise parse to [0] and be flagged as vulnerable — a false CVE.
+        if (!/^v?\d/.test(version))
+            continue;
+        const vulnerable = (v.ltExclusive !== undefined && compareVersions(version, v.ltExclusive) < 0) ||
+            (v.leInclusive !== undefined && compareVersions(version, v.leInclusive) <= 0);
+        if (!vulnerable)
+            continue;
+        findings.push({
+            ruleId: 'MTC-NET-001',
+            title: `Known-vulnerable version: ${v.package}@${version} (${v.id})`,
+            category: 'supply-chain',
+            severity: v.severity,
+            confidence: 'confirmed',
+            description: `${v.package}@${version} is in the vulnerable range for ${v.id}${v.cvss ? ` (severity ${v.cvss})` : ''}: ` +
+                `${v.title}.`,
+            remediation: `Upgrade ${v.package} to a fixed release.`,
+            location: { kind: 'package', name: v.package },
+            references: [v.reference],
+            owasp: 'LLM03:2025 Supply Chain',
+            data: { cve: v.id, version },
+        });
+    }
+    return findings;
+}
+export const postureDetector = {
+    id: 'posture',
+    stage: 6,
+    title: 'Transport & host posture',
+    run(ctx) {
+        const findings = [];
+        const t = ctx.surface.transport;
+        if (t) {
+            if (t.userControlledCommand) {
+                findings.push({
+                    ruleId: 'MTC-NET-002',
+                    title: 'stdio command is user/metadata-controlled without an allowlist',
+                    category: 'network',
+                    severity: 'critical',
+                    confidence: 'confirmed',
+                    description: 'The stdio transport spawns a command taken from untrusted configuration/metadata without an ' +
+                        'executable allowlist. This is the systemic MCP stdio-RCE class: launching the server runs arbitrary code.',
+                    remediation: 'Allowlist the executable to {npx,uvx,python,python3,node,docker,deno} and never spawn names taken verbatim from untrusted metadata.',
+                    location: { kind: 'transport' },
+                    owasp: 'LLM05:2025 Improper Output Handling',
+                });
+            }
+            if (t.kind === 'http' && typeof t.url === 'string' && t.url.startsWith('http://')) {
+                findings.push({
+                    ruleId: 'MTC-NET-003',
+                    title: 'Server reached over plaintext HTTP',
+                    category: 'network',
+                    severity: 'medium',
+                    confidence: 'confirmed',
+                    description: `The endpoint ${t.url} uses plaintext HTTP; tool traffic and any tokens are exposed on the wire.`,
+                    remediation: 'Use HTTPS for all remote MCP transports.',
+                    location: { kind: 'transport' },
+                    owasp: 'LLM03:2025 Supply Chain',
+                });
+            }
+            if (typeof t.url === 'string') {
+                try {
+                    const host = new URL(t.url).hostname;
+                    const isLocal = ['localhost', '127.0.0.1', '::1'].includes(host);
+                    if (isLocal) {
+                        findings.push({
+                            ruleId: 'MTC-NET-006',
+                            title: 'Local HTTP/SSE MCP server — verify Origin validation (DNS rebinding)',
+                            category: 'network',
+                            severity: 'low',
+                            confidence: 'heuristic',
+                            description: `A browser-reachable local MCP server (${host}) is exposed to DNS-rebinding attacks unless it ` +
+                                `validates the Host/Origin header — which static analysis cannot confirm.`,
+                            remediation: 'Ensure the server allowlists Origin/Host, or use the SDK version that adds rebinding protection.',
+                            location: { kind: 'transport' },
+                        });
+                    }
+                    if (host === '0.0.0.0') {
+                        findings.push({
+                            ruleId: 'MTC-NET-004',
+                            title: 'Server bound to 0.0.0.0',
+                            category: 'network',
+                            severity: 'medium',
+                            confidence: 'strong',
+                            description: 'Binding to 0.0.0.0 exposes the MCP server on all interfaces; ensure authentication is enforced.',
+                            remediation: 'Bind to localhost for local servers, or require auth for remote exposure.',
+                            location: { kind: 'transport' },
+                        });
+                    }
+                    else if (!isLocal) {
+                        // Remote host — worth a hygiene note about auth being out-of-scope for static analysis.
+                        findings.push({
+                            ruleId: 'MTC-NET-005',
+                            title: 'Remote HTTP MCP endpoint',
+                            category: 'network',
+                            severity: 'info',
+                            confidence: 'strong',
+                            description: `Remote endpoint ${host}. MCP Trust Checker does not test server-side authentication/authorization; verify the endpoint requires auth.`,
+                            location: { kind: 'transport' },
+                        });
+                    }
+                }
+                catch {
+                    /* not a parseable URL — ignore */
+                }
+            }
+        }
+        if (ctx.surface.packageMeta)
+            findings.push(...matchKnownVulns(ctx.surface.packageMeta));
+        return findings;
+    },
+};

package/dist/detectors/source.d.ts

@@ -0,0 +1,12 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Stage 4b — Implementation-level analysis.
+ *
+ * Metadata detectors read what a server *claims*. This one reads what its code
+ * *does*: when the server's source is available (a local package directory or an
+ * extracted tarball), it scans for dangerous sinks — arbitrary execution, shell
+ * spawning, hardcoded egress, obfuscated payloads, credential reads. Fully
+ * deterministic; no LLM, no execution of the code.
+ */
+import type { Detector } from '../types.js';
+export declare const sourceDetector: Detector;

package/dist/detectors/source.js

@@ -0,0 +1,87 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Stage 4b — Implementation-level analysis.
+ *
+ * Metadata detectors read what a server *claims*. This one reads what its code
+ * *does*: when the server's source is available (a local package directory or an
+ * extracted tarball), it scans for dangerous sinks — arbitrary execution, shell
+ * spawning, hardcoded egress, obfuscated payloads, credential reads. Fully
+ * deterministic; no LLM, no execution of the code.
+ */
+import { SOURCE_PATTERNS } from '../data/sourcePatterns.js';
+import { SECRET_PATTERNS } from '../data/injectionPatterns.js';
+const MAX_FINDINGS_PER_RULE = 10; // don't drown the report on a big codebase
+function lineOf(content, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < content.length; i++)
+        if (content[i] === '\n')
+            line += 1;
+    return line;
+}
+export const sourceDetector = {
+    id: 'source',
+    stage: 4,
+    title: 'Implementation-level source analysis',
+    run(ctx) {
+        const files = Array.isArray(ctx.surface.sourceFiles) ? ctx.surface.sourceFiles : [];
+        if (!files.length)
+            return [];
+        const findings = [];
+        const perRule = new Map();
+        for (const f of files) {
+            if (!f || typeof f.content !== 'string')
+                continue;
+            const path = typeof f.path === 'string' ? f.path : 'source';
+            for (const p of SOURCE_PATTERNS) {
+                const seen = perRule.get(p.id) ?? 0;
+                if (seen >= MAX_FINDINGS_PER_RULE)
+                    continue;
+                const m = f.content.match(p.pattern);
+                if (!m || m.index === undefined)
+                    continue;
+                perRule.set(p.id, seen + 1);
+                findings.push({
+                    ruleId: p.id,
+                    title: `${p.title} (${path})`,
+                    category: p.category,
+                    severity: p.severity,
+                    confidence: p.confidence,
+                    description: `In the server's implementation (\`${path}:${lineOf(f.content, m.index)}\`): ${p.why} ` +
+                        `This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.`,
+                    remediation: 'Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. ' +
+                        'Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.',
+                    location: { kind: 'server', name: path },
+                    evidence: m[0].slice(0, 160),
+                    owasp: p.category === 'exfiltration' ? 'LLM02:2025 Sensitive Information Disclosure' : 'LLM05:2025 Improper Output Handling',
+                    data: { rule: p.id, file: path, line: lineOf(f.content, m.index) },
+                });
+            }
+            // Embedded credential VALUE hardcoded in source (not just referenced).
+            const seenSecret = perRule.get('MTC-SRC-008') ?? 0;
+            if (seenSecret < MAX_FINDINGS_PER_RULE) {
+                for (const sp of SECRET_PATTERNS) {
+                    const m = f.content.match(sp.pattern);
+                    if (!m || m.index === undefined)
+                        continue;
+                    perRule.set('MTC-SRC-008', seenSecret + 1);
+                    findings.push({
+                        ruleId: 'MTC-SRC-008',
+                        title: `Hardcoded ${sp.label} in server code (${path})`,
+                        category: 'exfiltration',
+                        severity: 'high',
+                        confidence: 'confirmed',
+                        description: `A live-looking ${sp.label} is hardcoded in \`${path}:${lineOf(f.content, m.index)}\`. Secrets in source ` +
+                            `ship to everyone who installs the package and are a direct credential leak.`,
+                        remediation: 'Remove the secret, rotate it, and load credentials from the environment or a secret store.',
+                        location: { kind: 'server', name: path },
+                        evidence: `${sp.label}: ${m[0].slice(0, 4)}…(redacted)`,
+                        owasp: 'LLM02:2025 Sensitive Information Disclosure',
+                        data: { secretType: sp.id, file: path, line: lineOf(f.content, m.index) },
+                    });
+                    break; // one secret finding per file is enough
+                }
+            }
+        }
+        return findings;
+    },
+};

package/dist/detectors/supplyChain.d.ts

@@ -0,0 +1,17 @@
+/*! MCP Trust Checker · https://mcptrustchecker.com · support@mcptrustchecker.com · © 2026 Illia Haidar · MIT */
+/**
+ * Stage 5 — Supply-chain & typosquatting.
+ *
+ * Multi-signal, not a single edit-distance number: known-squat table, fake
+ * official scope, unscoped shadowing, confusable skeleton, Damerau-Levenshtein
+ * gated by a download anomaly, combosquat suffix stripping, plus install-script
+ * / provenance risk. Anchored to the curated protected list (never all-pairs).
+ */
+import type { Detector, Finding, PackageMeta, ResolvedConfig } from '../types.js';
+/** Pure typosquat analysis for a single package name. Exported for tests. */
+export declare function analyzeTyposquat(name: string, meta: PackageMeta | undefined, config: ResolvedConfig): Finding[];
+/** Install-script & provenance risk from package metadata. */
+export declare function analyzeProvenance(meta: PackageMeta): Finding[];
+/** Check a package's declared dependencies for squats / known-vuln names. */
+export declare function analyzeDependencies(meta: PackageMeta, config: ResolvedConfig): Finding[];
+export declare const supplyChainDetector: Detector;