mcpvetter 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MCPVetter
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,79 @@
-# Temporary Holding Version
+# mcpvetter
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Audit the MCP servers your AI assistant uses: leaked secrets, unpinned or look-alike packages, risky launch commands, unencrypted remote servers, over-broad file access, poisoned tool descriptions, hidden Unicode, tool shadowing, and silent tool changes.
+
+```bash
+npx mcpvetter scan          # discover + static scan, offline
+npx mcpvetter scan --live   # also read each server's tool descriptions (asks first)
+```
+
+Local, no account, no telemetry. A static scan reads your MCP config files and nothing else. It never changes a config file.
+
+## What a finding looks like
+
+```
+■ github
+[HIGH] Plain-text secret in MCP config  MCP-SECRET-001 · confidence high · static
+    server: github  file: .mcp.json
+    Evidence: env GITHUB_PERSONAL_ACCESS_TOKEN=ghp_…[redacted 40 chars] (GitHub token)
+    Why it matters: Anything that can read this file, including other tools, backups, sync
+    folders, and anyone the file is shared or committed with, gets a working credential.
+    Fix: Rotate the credential first (removing it does not un-leak it), then reference it
+    from the environment or a secret store instead of the literal value. Claude Code and
+    Claude Desktop expand "${VAR}" in .mcp.json, Cursor expands "${env:VAR}", and VS Code
+    supports "${input:...}" prompts or an "envFile".
+```
+
+Every finding has a stable ID, separate severity and confidence, redacted evidence, a plain-English reason, and a concrete fix. What each rule checks, and how, is published at [mcpvetter.com/rules](https://mcpvetter.com/rules) and in [src/scanner/rules](./src/scanner/rules).
+
+## Clients discovered
+
+Claude Code (`~/.claude.json`, `.mcp.json`), Claude Desktop, Cursor (`~/.cursor/mcp.json`, `.cursor/mcp.json`), VS Code (`mcp.json`, `settings.json`, `.vscode/mcp.json`), Windsurf, Gemini CLI. Or pass `--config <file>`.
+
+## Commands
+
+```
+mcpvetter scan [--live] [--yes] [--config <file>]... [--json [file]] [--summary] [--fail-on <severity>]
+mcpvetter list                               inventory only
+mcpvetter explain MCP-POISON-001             explain a finding
+mcpvetter rules                              every rule and what it checks
+mcpvetter suppress <ID> --server <name> --reason "<why>"
+mcpvetter accept <server> --reason "<why>"   accept a server's new tool fingerprint
+mcpvetter serve                              run as a local MCP server (stdio)
+```
+
+Exit codes: `0` no findings at or above `--fail-on` (default `high`), `1` findings at or above it, `2` scan could not complete. Use it in CI as-is.
+
+Suppressions are always listed in the report, so a shared report cannot hide them.
+
+## About `--live`
+
+To read tool descriptions, MCPVetter has to start each stdio server, exactly as your AI client does every time it launches. It asks before each one, runs it with a minimal environment plus the env your config declares, and only calls `initialize`, `tools/list`, `prompts/list`, and `resources/list`. It never calls a tool. The first approved probe records a fingerprint of each server's tools in `~/.mcpvetter/fingerprints.json`; later probes report any change (a "rug pull") with a before/after diff.
+
+## Inside your AI assistant
+
+Claude Code:
+
+```bash
+claude mcp add mcpvetter -- npx -y mcpvetter@0.1.0 serve
+```
+
+Cursor / VS Code / Claude Desktop (`mcpServers` or `servers`):
+
+```json
+{ "mcpServers": { "mcpvetter": { "command": "npx", "args": ["-y", "mcpvetter@0.1.0", "serve"] } } }
+```
+
+Then ask: "audit my MCP setup".
+
+Free without an account: `check_mcp_setup`, `explain_finding`. With an API key (`MCPVETTER_API_KEY`, free tier available at [mcpvetter.com/account](https://mcpvetter.com/account)): `review_code`, `secure_pattern`, `start_lab`, `check_lab`, `team_posture`. Code review runs on your machine; only rule IDs and counts are sent for your history. Plans: [mcpvetter.com/pricing](https://mcpvetter.com/pricing).
+
+## Privacy
+
+- Static analysis runs on your machine. Without an API key, MCPVetter makes no network requests.
+- With an API key, only rule IDs, severities, and counts are sent. Never code, evidence, file paths, or server names.
+- Reports redact secret values by default.
+
+## License
+
+MIT

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,236 @@
+#!/usr/bin/env node
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { parseArgs } from "node:util";
+import { reviewCode } from "./code/review.js";
+import { getRuleMeta, allRuleMetas } from "./engine/registry.js";
+import { atOrAbove, SEVERITY_ORDER } from "./engine/types.js";
+import { LocalBackend, apiConfig } from "./mcp/local-backend.js";
+import { fingerprint, loadBaseline, saveBaseline, stateDir } from "./scanner/fingerprint.js";
+import { addSuppression, loadFiles, redactArg, redactUrl, scan } from "./scanner/index.js";
+import { probeServer } from "./scanner/probe.js";
+import { formatFinding, formatReport, shareableSummary } from "./scanner/report.js";
+import { VERSION } from "./version.js";
+const HELP = `mcpvetter ${VERSION}: audit your MCP servers and AI-generated code
+
+Usage:
+  mcpvetter scan [--live] [--yes] [--config <file>]... [--json [file]] [--summary] [--fail-on <severity>]
+  mcpvetter list [--config <file>]...          Inventory only, no findings
+  mcpvetter explain <ID>                       Explain a finding ID (e.g. MCP-POISON-001)
+  mcpvetter rules                              List every rule and what it checks
+  mcpvetter suppress <ID> --server <name> --reason "<why>"
+  mcpvetter accept <server> --reason "<why>"   Accept a server's new tool fingerprint after drift
+  mcpvetter review <file>... [--json] [--fail-on <severity>]   Review code (needs an API key)
+  mcpvetter auth <api-key>                     Save your API key to ~/.mcpvetter/config.json
+  mcpvetter serve                              Run as a local MCP server over stdio
+
+Exit codes: 0 = no findings at or above --fail-on (default high), 1 = findings at or above it, 2 = could not complete.
+Static scans are local and offline. Nothing is sent anywhere unless you configure an API key.
+--live starts each configured server (exactly as your AI client would) to read its tool list. It asks first.`;
+function severityArg(v) {
+    const s = String(v ?? "high").toLowerCase();
+    if (!SEVERITY_ORDER.includes(s))
+        throw new Error(`--fail-on must be one of ${SEVERITY_ORDER.join(", ")}`);
+    return s;
+}
+async function ask(q) {
+    if (!process.stdin.isTTY)
+        return false;
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    const a = (await rl.question(q)).trim().toLowerCase();
+    rl.close();
+    return a === "y" || a === "yes";
+}
+async function main(argv) {
+    const [cmd, ...rest] = argv;
+    const { values, positionals } = parseArgs({
+        args: rest,
+        allowPositionals: true,
+        options: {
+            live: { type: "boolean" },
+            yes: { type: "boolean", short: "y" },
+            config: { type: "string", multiple: true },
+            json: { type: "boolean" },
+            out: { type: "string", short: "o" },
+            summary: { type: "boolean" },
+            "fail-on": { type: "string" },
+            server: { type: "string" },
+            reason: { type: "string" },
+            language: { type: "string" },
+        },
+    });
+    // `--json out.json` form: treat a following .json positional as the output file.
+    let jsonOut = values.out;
+    if (values.json && !jsonOut && positionals[0]?.endsWith(".json") && cmd === "scan")
+        jsonOut = positionals.shift();
+    const origin = apiConfig().origin;
+    switch (cmd) {
+        case "scan": {
+            const failOn = severityArg(values["fail-on"]);
+            const r = await scan({
+                paths: values.config,
+                live: values.live,
+                confirm: values.live
+                    ? async (s) => {
+                        if (values.yes)
+                            return true;
+                        const what = s.command ? `run "${[s.command, ...s.args.map(redactArg)].join(" ").slice(0, 100)}"` : `connect to ${redactUrl(s.url)}`;
+                        return ask(`Probe "${s.name}"? This will ${what} and list its tools (no tool is called). [y/N] `);
+                    }
+                    : undefined,
+                onProgress: (m) => process.stderr.write(`${m}\n`),
+            });
+            if (values.json) {
+                const body = JSON.stringify(r, null, 2);
+                if (jsonOut)
+                    writeFileSync(jsonOut, body);
+                else
+                    process.stdout.write(body + "\n");
+            }
+            if (!values.json || jsonOut)
+                console.log(values.summary ? shareableSummary(r) : formatReport(r, origin));
+            if (r.files.length && r.files.every((f) => f.error))
+                return 2;
+            return r.findings.some((f) => atOrAbove(f.severity, failOn)) ? 1 : 0;
+        }
+        case "list": {
+            const { files } = loadFiles({ paths: values.config });
+            if (!files.length)
+                console.log("No MCP configuration found. Pass --config <file>.");
+            for (const f of files) {
+                console.log(`${f.client} · ${f.path}${f.error ? `  (error: ${f.error})` : ""}`);
+                for (const s of f.servers) {
+                    const launch = redactUrl(s.url) ?? [s.command, ...s.args.map(redactArg)].join(" ");
+                    console.log(`  - ${s.name} [${s.transport}${s.disabled ? ", disabled" : ""}] ${launch.slice(0, 100)}${Object.keys(s.env).length ? `  env: ${Object.keys(s.env).join(", ")}` : ""}`);
+                }
+            }
+            return 0;
+        }
+        case "explain": {
+            const id = positionals[0]?.toUpperCase();
+            const m = id ? getRuleMeta(id) : undefined;
+            if (!m) {
+                console.error(`Unknown ID "${positionals[0] ?? ""}". Run "mcpvetter rules" for the list.`);
+                return 2;
+            }
+            console.log(`${m.id}: ${m.title}\nDefault severity: ${m.severity} · confidence ${m.confidence} · ${m.evidenceKind}\n\nWhy it matters: ${m.why}\n\nFix: ${m.fix}\n\nWhat this rule checks: ${m.method}${m.lab ? `\n\nLab: ${origin}/labs/${m.lab}` : ""}`);
+            return 0;
+        }
+        case "rules": {
+            for (const m of allRuleMetas())
+                console.log(`${m.id.padEnd(18)} ${m.severity.padEnd(9)} ${m.title}`);
+            console.log(`\nFull methods: ${origin}/rules`);
+            return 0;
+        }
+        case "suppress": {
+            const id = positionals[0]?.toUpperCase();
+            if (!id || !getRuleMeta(id) || !values.server || !values.reason) {
+                console.error('Usage: mcpvetter suppress <ID> --server <name|*> --reason "<why>"');
+                return 2;
+            }
+            addSuppression({ id, server: values.server, reason: values.reason });
+            console.log(`Suppressed ${id} on ${values.server}. It will still be listed under "Suppressed" in every report.`);
+            return 0;
+        }
+        case "accept": {
+            const name = positionals[0];
+            if (!name || !values.reason) {
+                console.error('Usage: mcpvetter accept <server> --reason "<why>"');
+                return 2;
+            }
+            const s = loadFiles({ paths: values.config }).files.flatMap((f) => f.servers).find((x) => x.name === name);
+            if (!s) {
+                console.error(`No configured server named "${name}".`);
+                return 2;
+            }
+            const p = await probeServer(s);
+            if (!p.ok) {
+                console.error(`Could not probe ${name}: ${p.error}`);
+                return 2;
+            }
+            const b = loadBaseline();
+            b[p.identity] = { ...fingerprint(p), acceptedReason: values.reason };
+            saveBaseline(b);
+            mkdirSync(stateDir(), { recursive: true });
+            writeFileSync(join(stateDir(), "accept.log"), `${new Date().toISOString()}\t${name}\t${values.reason.replace(/\s+/g, " ")}\n`, { flag: "a" });
+            console.log(`Accepted new fingerprint for ${name} (${p.tools.length} tools). Reason logged to ~/.mcpvetter/accept.log.`);
+            return 0;
+        }
+        case "review": {
+            if (!positionals.length) {
+                console.error("Usage: mcpvetter review <file>...");
+                return 2;
+            }
+            const failOn = severityArg(values["fail-on"]);
+            const backend = new LocalBackend();
+            const a = await backend.authorize("review_code");
+            if (!a.allowed) {
+                console.error(a.message);
+                return 2;
+            }
+            let worst = false;
+            const all = [];
+            for (const file of positionals) {
+                const findings = reviewCode(readFileSync(file, "utf8"), { filename: file, language: values.language }).map((f) => ({ ...f, location: { ...f.location, file } }));
+                all.push(...findings);
+                if (findings.some((f) => atOrAbove(f.severity, failOn)))
+                    worst = true;
+                if (!values.json) {
+                    console.log(`■ ${file}: ${findings.length ? `${findings.length} finding(s)` : "no findings"}`);
+                    for (const f of findings)
+                        console.log(formatFinding(f, origin) + "\n");
+                }
+            }
+            await backend.recordHistory("review_code", all.map((f) => ({ id: f.id, severity: f.severity })));
+            if (values.json)
+                console.log(JSON.stringify({ version: VERSION, findings: all }, null, 2));
+            return worst ? 1 : 0;
+        }
+        case "auth": {
+            const key = positionals[0];
+            if (!key || !/^mcpv_(?:live|test)_[A-Za-z0-9]{16,}$/.test(key)) {
+                console.error(`Usage: mcpvetter auth <api-key>  (get one at ${origin}/account)`);
+                return 2;
+            }
+            mkdirSync(stateDir(), { recursive: true });
+            const p = join(stateDir(), "config.json");
+            let cfg = {};
+            try {
+                cfg = JSON.parse(readFileSync(p, "utf8"));
+            }
+            catch {
+                /* new file */
+            }
+            writeFileSync(p, JSON.stringify({ ...cfg, apiKey: key }, null, 2), { mode: 0o600 });
+            console.log("Saved. The local MCP server and `mcpvetter review` will use this key.");
+            return 0;
+        }
+        case "serve": {
+            const { serveStdio } = await import("./mcp/stdio.js");
+            await serveStdio();
+            return -1; // keep running
+        }
+        case "--version":
+        case "-v":
+        case "version":
+            console.log(VERSION);
+            return 0;
+        case undefined:
+        case "help":
+        case "--help":
+        case "-h":
+            console.log(HELP);
+            return 0;
+        default:
+            console.error(`Unknown command "${cmd}".\n\n${HELP}`);
+            return 2;
+    }
+}
+main(process.argv.slice(2)).then((code) => {
+    if (code >= 0)
+        process.exitCode = code;
+}, (e) => {
+    console.error(`mcpvetter: ${e.message}`);
+    process.exitCode = 2;
+});

package/dist/code/labs.d.ts

@@ -0,0 +1,12 @@
+import type { Finding } from "../engine/types.js";
+import type { LabCheck } from "../mcp/backend.js";
+export interface LabResult {
+    passed: boolean;
+    failures: string[];
+    findings: Finding[];
+}
+/**
+ * Verify a lab submission: none of the lab's rules may still fire, every required secure
+ * pattern must be present, and no forbidden pattern may remain.
+ */
+export declare function checkLab(check: LabCheck, code: string, language?: string): LabResult;

package/dist/code/labs.js

@@ -0,0 +1,25 @@
+import { reviewCode } from "./review.js";
+/**
+ * Verify a lab submission: none of the lab's rules may still fire, every required secure
+ * pattern must be present, and no forbidden pattern may remain.
+ */
+export function checkLab(check, code, language) {
+    const findings = reviewCode(code, { language });
+    const failures = [];
+    if (!code.trim())
+        failures.push("The submission is empty. Paste your fixed version of the lab code.");
+    for (const id of check.mustNotTrigger) {
+        for (const f of findings.filter((x) => x.id === id)) {
+            failures.push(`${f.id} still triggers${f.location?.line ? ` on line ${f.location.line}` : ""}: ${f.title}. ${f.evidence}`);
+        }
+    }
+    for (const m of check.mustMatch) {
+        if (!new RegExp(m.re, m.flags ?? "").test(code))
+            failures.push(m.hint);
+    }
+    for (const m of check.mustNotMatch ?? []) {
+        if (new RegExp(m.re, m.flags ?? "").test(code))
+            failures.push(m.hint);
+    }
+    return { passed: failures.length === 0, failures, findings };
+}

package/dist/code/review.d.ts

@@ -0,0 +1,8 @@
+import { type CodeContext, type Finding, type Rule } from "../engine/types.js";
+export declare const CODE_RULES: Rule<CodeContext>[];
+export declare function detectLanguage(code: string, hint?: string, filename?: string): string;
+/** Run every code rule on a snippet. Findings are deduped per rule + line and sorted worst-first. */
+export declare function reviewCode(code: string, opts?: {
+    language?: string;
+    filename?: string;
+}): Finding[];

package/dist/code/review.js

@@ -0,0 +1,90 @@
+import { sortFindings, toFinding } from "../engine/types.js";
+import { codeAuth } from "./rules/auth.js";
+import { codeIdor } from "./rules/idor.js";
+import { codeLlmOutput } from "./rules/llmout.js";
+import { codeMcpConfig } from "./rules/mcpcfg.js";
+import { codePromptInjection } from "./rules/prompt.js";
+import { codeSecret } from "./rules/secret.js";
+import { codeSqli } from "./rules/sqli.js";
+import { codeSsrf } from "./rules/ssrf.js";
+import { codeUpload } from "./rules/upload.js";
+import { codeXss } from "./rules/xss.js";
+export const CODE_RULES = [
+    codeSecret,
+    codeSqli,
+    codePromptInjection,
+    codeLlmOutput,
+    codeAuth,
+    codeIdor,
+    codeXss,
+    codeSsrf,
+    codeUpload,
+    codeMcpConfig,
+];
+const EXT = {
+    js: "javascript", mjs: "javascript", cjs: "javascript", jsx: "javascript",
+    ts: "typescript", tsx: "typescript", mts: "typescript", cts: "typescript",
+    py: "python", json: "json", jsonc: "json", html: "html", vue: "javascript",
+    svelte: "javascript", ejs: "html", hbs: "html", jinja: "html", j2: "html",
+};
+const ALIASES = {
+    js: "javascript", node: "javascript", nodejs: "javascript", javascript: "javascript", jsx: "javascript",
+    ts: "typescript", typescript: "typescript", tsx: "typescript",
+    py: "python", python: "python", python3: "python",
+    json: "json", jsonc: "json", html: "html", jinja: "html", jinja2: "html",
+};
+export function detectLanguage(code, hint, filename) {
+    if (hint) {
+        const h = ALIASES[hint.toLowerCase().trim()];
+        if (h)
+            return h;
+    }
+    const ext = filename?.split(".").pop()?.toLowerCase();
+    if (ext && EXT[ext])
+        return EXT[ext];
+    const t = code.trim();
+    if (/^[{[]/.test(t)) {
+        try {
+            JSON.parse(t);
+            return "json";
+        }
+        catch {
+            if (/"mcpServers"|"servers"\s*:/.test(t) && !/\b(?:const|function|def|import)\b/.test(t))
+                return "json";
+        }
+    }
+    if (/^\s*(?:def |class \w+.*:\s*$|import \w+\s*$|from [\w.]+ import |@app\.|if __name__ ==)/m.test(code))
+        return "python";
+    if (/^\s*<(?:!doctype|html|div|template|body)/i.test(t))
+        return "html";
+    if (/:\s*(?:string|number|boolean)\b|\binterface \w+|\bimport type\b|<\w+>\(/.test(code))
+        return "typescript";
+    return "javascript";
+}
+/** Run every code rule on a snippet. Findings are deduped per rule + line and sorted worst-first. */
+export function reviewCode(code, opts = {}) {
+    const language = detectLanguage(code, opts.language, opts.filename);
+    const ctx = { code, language, filename: opts.filename, lines: code.split(/\r?\n/) };
+    const seen = new Set();
+    const findings = [];
+    for (const rule of CODE_RULES) {
+        let hits;
+        try {
+            hits = rule.check(ctx);
+        }
+        catch {
+            continue; // a rule bug must never break the whole review
+        }
+        for (const hit of hits) {
+            const key = `${rule.id}:${hit.location?.line ?? 0}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            const f = toFinding(rule, hit);
+            if (opts.filename)
+                f.location = { ...f.location, file: opts.filename };
+            findings.push(f);
+        }
+    }
+    return sortFindings(findings);
+}

package/dist/code/rules/auth.d.ts

@@ -0,0 +1,2 @@
+import type { CodeContext, Rule } from "../../engine/types.js";
+export declare const codeAuth: Rule<CodeContext>;

package/dist/code/rules/auth.js

@@ -0,0 +1,94 @@
+import { evidence } from "../../engine/redact.js";
+import { isCommentLine, windowText } from "../taint.js";
+const isPy = (ctx) => ctx.language === "python";
+const CHECKS = [
+    {
+        re: /\bjwt\.decode\s*\(/,
+        lang: "js",
+        detail: "jwt.decode() only parses the token; it does not check the signature. Use jwt.verify(token, secret, { algorithms: [\"HS256\"] }).",
+        confidence: "high",
+        unless: (ctx) => /\bjwt\.verify\s*\(|jwtVerify\s*\(/.test(ctx.code),
+    },
+    {
+        re: /verify_signature["']?\s*:\s*False|\bverify\s*=\s*False|options\s*=\s*\{[^}]*["']verify_signature["']\s*:\s*False/,
+        lang: "python",
+        detail: "Signature verification is disabled. Remove the option and pass algorithms=[\"HS256\"] (or your algorithm) to jwt.decode().",
+        confidence: "high",
+    },
+    {
+        re: /algorithms?\s*[:=]\s*\[?\s*["']none["']/i,
+        detail: "The \"none\" algorithm accepts unsigned tokens. Allow only the algorithm you sign with.",
+        confidence: "high",
+        severity: "critical",
+    },
+    {
+        re: /\bjwt\.sign\s*\(/,
+        detail: "Token is signed without an expiry. Add { expiresIn: \"15m\" } (or a short lifetime that fits) and refresh tokens server-side.",
+        confidence: "medium",
+        severity: "medium",
+        unless: (ctx, i) => /expiresIn|\bexp\s*:/.test(windowText(ctx.lines, i, 6, 4)),
+    },
+    {
+        re: /\bjwt\.encode\s*\(/,
+        lang: "python",
+        detail: "Token is created without an \"exp\" claim. Include \"exp\": datetime.now(timezone.utc) + timedelta(minutes=15).",
+        confidence: "medium",
+        severity: "medium",
+        unless: (ctx, i) => /["']exp["']|\bexp\s*=/.test(windowText(ctx.lines, i, 8, 3)),
+    },
+    {
+        re: /\b\w*pass(?:word|wd)\w*["']?\]?(?:\.\w+|\[["']\w+["']\])*\s*(?:===?|!==?)\s*[\w.[\]"']*pass(?:word|wd)/i,
+        detail: "Passwords are compared as plain text, which means they are stored unhashed. Store a bcrypt/argon2 hash and compare with bcrypt.compare() / argon2.verify() / check_password_hash().",
+        confidence: "high",
+        unless: (ctx, i) => /hash|bcrypt|argon|scrypt|compare|confirm|repeat|again|new_?password\s*[!=]==?\s*confirm/i.test(ctx.lines[i]),
+    },
+    {
+        re: /(?:createHash\s*\(\s*["'](?:md5|sha1|sha256)["']|hashlib\.(?:md5|sha1|sha256)\s*\(|\bmd5\s*\(|\bsha1\s*\()/i,
+        detail: "Fast hashes (MD5, SHA-1, SHA-256) are not password hashes; leaked hashes can be cracked quickly. Use bcrypt, scrypt or argon2 with a per-user salt.",
+        confidence: "high",
+        unless: (ctx, i) => !/pass(?:word|wd)|pwd/i.test(windowText(ctx.lines, i, 1, 1)),
+    },
+    {
+        re: /localStorage\.getItem\s*\(\s*["'](?:isLoggedIn|loggedIn|isAdmin|is_admin|role|isAuthenticated|authenticated|admin)["']\s*\)/,
+        detail: "Access is decided by a value in localStorage that the user can edit. Enforce authorization on the server for every request.",
+        confidence: "high",
+    },
+    {
+        re: /\b(?:httpOnly|httponly)\s*:\s*false|\bsecure\s*:\s*false|SESSION_COOKIE_(?:SECURE|HTTPONLY)\s*=\s*False|httponly\s*=\s*False/,
+        detail: "Session cookie is missing HttpOnly or Secure. Set httpOnly: true, secure: true and sameSite: \"lax\" (or stricter).",
+        confidence: "medium",
+        severity: "medium",
+    },
+];
+export const codeAuth = {
+    id: "CODE-AUTH-001",
+    title: "Weak authentication or session handling",
+    severity: "high",
+    confidence: "medium",
+    evidenceKind: "static",
+    lab: "lab-05-auth",
+    pattern: "auth-sessions",
+    why: "Login and session code that looks finished can still let anyone in: tokens that are never verified or never expire, passwords stored in plain text or with fast hashes, and access decisions made in the browser. These flaws turn one leaked token or database dump into full account takeover.",
+    fix: "Verify every token's signature with a fixed algorithm, give tokens a short expiry, hash passwords with bcrypt or argon2, set session cookies HttpOnly and Secure, and make every authorization decision on the server.",
+    method: "Flags: jwt.decode() in JavaScript when the snippet never calls jwt.verify(); PyJWT decode with verify_signature False; the \"none\" algorithm; jwt.sign() / jwt.encode() without an expiry nearby; equality comparison between two password values (no hash or compare call on the line); MD5/SHA-1/SHA-256 next to the word password; authorization flags read from localStorage; session cookies with httpOnly or secure set to false.",
+    check(ctx) {
+        const hits = [];
+        ctx.lines.forEach((line, i) => {
+            if (isCommentLine(line))
+                return;
+            for (const c of CHECKS) {
+                if (c.lang === "js" && isPy(ctx))
+                    continue;
+                if (c.lang === "python" && !isPy(ctx))
+                    continue;
+                if (!c.re.test(line))
+                    continue;
+                if (c.unless?.(ctx, i))
+                    continue;
+                hits.push({ evidence: evidence(line), location: { line: i + 1 }, confidence: c.confidence, severity: c.severity, fixDetail: c.detail });
+                break;
+            }
+        });
+        return hits;
+    },
+};

package/dist/code/rules/idor.d.ts

@@ -0,0 +1,2 @@
+import type { CodeContext, Rule } from "../../engine/types.js";
+export declare const codeIdor: Rule<CodeContext>;

package/dist/code/rules/idor.js

@@ -0,0 +1,53 @@
+import { evidence } from "../../engine/redact.js";
+import { computeTaint, isCommentLine, isTestFile, REQUEST_SOURCE_RE, windowText } from "../taint.js";
+const LOOKUP_RE = /\b(?:findById|findByPk|findOne|findUnique|findUniqueOrThrow|findFirst|findOneBy|get_object_or_404|get_or_404|getById|query\.get|objects\.get|session\.get|db\.get)\s*\(|\.filter_by\s*\(|\.filter\s*\(\s*\w+\.id\s*==|WHERE\s+(?:\w+\.)?id\s*=\s*(?:\$\d|\?|%s|:\w+|\$\{)/i;
+/** Signals that the handler scopes the record to the caller. */
+const OWNERSHIP_RE = /\b(?:require_\w+|ensure_\w+|check_\w*(?:access|member|permission|owner)\w*|membership|is_member|Depends\(\s*\w*(?:user|auth|member|org|owner)\w*|req\.user|request\.user|current_user|currentUser|session\.user(?:Id)?|ctx\.state\.user|req\.auth|auth\.uid|getServerSession|auth\(\)|authorize|can\s*\(|permission|policy|has_?access|ensureOwner|assertOwner|forbidden|Forbidden|403)\b/;
+/** Scoping column names; count as ownership only when the value is not itself request input. */
+const SCOPE_NAME_RE = /\b(owner_?[iI]d|user_?[iI]d|account_?[iI]d|tenant_?[iI]d|org_?[iI]d|organizationId|created_?[bB]y)\b/g;
+function scoped(ctx, text, requestVars) {
+    if (OWNERSHIP_RE.test(text))
+        return true;
+    for (const m of text.matchAll(SCOPE_NAME_RE)) {
+        if (!requestVars.has(m[1]))
+            return true;
+    }
+    return false;
+}
+/** IDOR is a web-request flaw: only analyse snippets that look like request handlers. */
+const WEB_HANDLER_RE = /@\w+(?:\.\w+)*\.(?:route|get|post|put|patch|delete|api_route)\s*\(|\b(?:app|router|server)\.(?:get|post|put|patch|delete|all|route)\s*\(|\breq\.(?:params|query|body)|\brequest\.(?:args|form|json|view_args|match_info|path_params)|export\s+(?:async\s+)?function\s+(?:GET|POST|PUT|PATCH|DELETE)\b/;
+const ID_NAME_RE = /^(?:id|pk|\w*[iI]d|\w*_id|uuid|slug)$/;
+export const codeIdor = {
+    id: "CODE-IDOR-001",
+    title: "Record fetched by request ID with no ownership check (IDOR)",
+    severity: "high",
+    confidence: "medium",
+    evidenceKind: "static",
+    lab: "lab-06-idor",
+    pattern: "auth-sessions",
+    why: "The endpoint loads a record using an ID taken straight from the request and returns or changes it without checking that it belongs to the caller. Any signed-in user can change the ID in the URL or body and read or modify someone else's data.",
+    fix: "Scope the lookup to the authenticated user, for example findFirst({ where: { id, userId: req.user.id } }) or Order.query.filter_by(id=order_id, user_id=current_user.id).first_or_404(), and return 404 when nothing matches. For shared resources, check an explicit permission before returning the record.",
+    method: "Flags a record lookup (findById, findUnique, findFirst, findOne, get_object_or_404, query.get, filter_by, or SQL WHERE id = ?) whose ID argument comes from request input or a route parameter, when no ownership or authorization signal (req.user, current_user, request.user, userId, ownerId, tenantId, an authorize/permission call, or a 403) appears within the surrounding handler (8 lines before, 12 after). Only snippets that look like web request handlers are analysed, and test files are skipped. Confidence is medium because ownership can be enforced elsewhere, such as in middleware or row-level security.",
+    check(ctx) {
+        if (isTestFile(ctx.filename) || !WEB_HANDLER_RE.test(ctx.code))
+            return [];
+        const hits = [];
+        const taint = computeTaint(ctx);
+        ctx.lines.forEach((line, i) => {
+            if (isCommentLine(line) || !LOOKUP_RE.test(line))
+                return;
+            const args = line.slice(line.search(LOOKUP_RE));
+            const fromRequest = REQUEST_SOURCE_RE.test(args) ||
+                (args.match(/[A-Za-z_$][\w$]*/g) ?? []).some((id) => taint.request.has(id) && ID_NAME_RE.test(id));
+            // the lookup may also reference an id variable on a nearby SQL params line
+            const nearbyParams = !fromRequest && /WHERE/i.test(args) && windowText(ctx.lines, i, 0, 2).match(/\[\s*([A-Za-z_$][\w$.]*)\s*\]|\(\s*([A-Za-z_]\w*)\s*,\s*\)/);
+            const viaParams = nearbyParams && [nearbyParams[1], nearbyParams[2]].some((v) => v && (REQUEST_SOURCE_RE.test(v) || taint.request.has(v)));
+            if (!fromRequest && !viaParams)
+                return;
+            if (scoped(ctx, windowText(ctx.lines, i, 8, 12), taint.request))
+                return;
+            hits.push({ evidence: evidence(line), location: { line: i + 1 } });
+        });
+        return hits;
+    },
+};

package/dist/code/rules/llmout.d.ts

@@ -0,0 +1,2 @@
+import type { CodeContext, Rule } from "../../engine/types.js";
+export declare const codeLlmOutput: Rule<CodeContext>;