mergen-server 1.4.0

package/dist/commands/scan.js

@@ -0,0 +1,243 @@
+import { log, error } from "./shared.js";
+const DESCRIPTION_INJECTION_PATTERNS = [
+  /ignore\s+(all\s+)?previous\s+instructions/i,
+  /you\s+are\s+now\s+in\s+\w+\s+mode/i,
+  /system\s*:\s*override/i,
+  /\[SYSTEM\]/i,
+  /\{\{.*?\}\}/,
+  // template literals in descriptions
+  /<\s*script[\s>]/i,
+  /\bdo\s+not\s+(tell|mention|disclose)/i,
+  /\bsecretly\b|\bsilently\b/i,
+  /\balways\s+(respond|reply|output)/i,
+  /\bnever\s+(say|tell|refuse)/i
+];
+const DANGEROUS_NAME_TOKENS = [
+  "exec",
+  "execute",
+  "run",
+  "shell",
+  "cmd",
+  "command",
+  "eval",
+  "spawn",
+  "process",
+  "subprocess",
+  "delete",
+  "remove",
+  "drop",
+  "truncate",
+  "wipe",
+  "destroy",
+  "nuke",
+  "upload",
+  "exfil",
+  "send",
+  "transmit",
+  "post",
+  "write",
+  "overwrite",
+  "inject",
+  "sudo",
+  "root",
+  "admin",
+  "privilege"
+];
+const SENSITIVE_DESCRIPTION_NOUNS = [
+  /\b(file|path|directory|folder)\b/i,
+  /\b(database|db|sql|query|table)\b/i,
+  /\b(secret|password|token|credential|key|auth)\b/i,
+  /\b(network|http|curl|wget|url|endpoint)\b/i,
+  /\b(email|message|send|webhook)\b/i,
+  /\b(shell|bash|terminal|command)\b/i
+];
+function analyzeToolDescription(description) {
+  const signals = [];
+  for (const pattern of DESCRIPTION_INJECTION_PATTERNS) {
+    if (pattern.test(description)) {
+      signals.push(`description contains injection pattern: ${pattern.source.slice(0, 40)}`);
+    }
+  }
+  return signals;
+}
+function analyzeInputSchema(schema) {
+  const signals = [];
+  let hasUnconstrainedString = false;
+  if (!schema || typeof schema !== "object") return { signals, hasUnconstrainedString };
+  const s = schema;
+  const props = s["properties"] ?? {};
+  for (const [paramName, paramSchema] of Object.entries(props)) {
+    const pschema = paramSchema;
+    const ptype = pschema["type"];
+    const lname = paramName.toLowerCase();
+    for (const token of DANGEROUS_NAME_TOKENS) {
+      if (lname.includes(token)) {
+        signals.push(`parameter "${paramName}" has dangerous name token: "${token}"`);
+        break;
+      }
+    }
+    if (ptype === "string") {
+      const hasConstraint = pschema["enum"] || pschema["pattern"] || pschema["maxLength"];
+      if (!hasConstraint) {
+        hasUnconstrainedString = true;
+        signals.push(`parameter "${paramName}" is an unconstrained string (no enum/pattern/maxLength)`);
+      }
+    }
+  }
+  if (!s["properties"]) {
+    signals.push("tool has no input schema (accepts arbitrary input)");
+    hasUnconstrainedString = true;
+  }
+  return { signals, hasUnconstrainedString };
+}
+function scoreTool(toolName, description, inputSchema) {
+  const allSignals = [];
+  const descSignals = analyzeToolDescription(description ?? "");
+  allSignals.push(...descSignals);
+  const lname = toolName.toLowerCase();
+  for (const token of DANGEROUS_NAME_TOKENS) {
+    if (lname.includes(token)) {
+      allSignals.push(`tool name contains dangerous token: "${token}"`);
+      break;
+    }
+  }
+  const { signals: schemaSignals, hasUnconstrainedString } = analyzeInputSchema(inputSchema);
+  allSignals.push(...schemaSignals);
+  if (hasUnconstrainedString) {
+    const desc = (description ?? "").toLowerCase();
+    for (const noun of SENSITIVE_DESCRIPTION_NOUNS) {
+      if (noun.test(desc)) {
+        allSignals.push(`unconstrained string param + sensitive noun in description: ${noun.source}`);
+        break;
+      }
+    }
+  }
+  const hasCritical = descSignals.length > 0;
+  const hasHighRisk = allSignals.some((s) => s.includes("dangerous name token") || s.includes("dangerous token"));
+  const hasMedium = hasUnconstrainedString && allSignals.some((s) => s.includes("sensitive noun"));
+  let level = "LOW";
+  let score = 0;
+  if (hasCritical) {
+    level = "CRITICAL";
+    score = 90 + Math.min(descSignals.length * 2, 10);
+  } else if (hasHighRisk && hasUnconstrainedString) {
+    level = "HIGH";
+    score = 65 + Math.min(allSignals.length * 3, 25);
+  } else if (hasMedium || hasHighRisk) {
+    level = "MEDIUM";
+    score = 35 + Math.min(allSignals.length * 5, 30);
+  } else if (allSignals.length > 0) {
+    level = "LOW";
+    score = Math.min(allSignals.length * 5, 25);
+  }
+  return { toolName, level, score: Math.min(score, 100), signals: allSignals };
+}
+async function fetchMcpToolList(baseUrl) {
+  const url = `${baseUrl.replace(/\/$/, "")}/tools/list`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} }),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!res.ok) throw new Error(`MCP server responded with HTTP ${res.status} at ${url}`);
+  const body = await res.json();
+  const tools = body?.result?.tools ?? body.tools;
+  if (!Array.isArray(tools)) throw new Error(`Unexpected response format \u2014 no "tools" array in response`);
+  return tools;
+}
+const LEVEL_COLOR = {
+  CRITICAL: "\x1B[91m",
+  // bright red
+  HIGH: "\x1B[33m",
+  // yellow
+  MEDIUM: "\x1B[36m",
+  // cyan
+  LOW: "\x1B[32m"
+  // green
+};
+const RESET = "\x1B[0m";
+function printResults(url, results, jsonMode) {
+  if (jsonMode) {
+    const summary = {
+      url,
+      scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      totalTools: results.length,
+      criticalCount: results.filter((r) => r.level === "CRITICAL").length,
+      highCount: results.filter((r) => r.level === "HIGH").length,
+      mediumCount: results.filter((r) => r.level === "MEDIUM").length,
+      lowCount: results.filter((r) => r.level === "LOW").length,
+      tools: results
+    };
+    console.log(JSON.stringify(summary, null, 2));
+    return;
+  }
+  const critical = results.filter((r) => r.level === "CRITICAL");
+  const high = results.filter((r) => r.level === "HIGH");
+  const medium = results.filter((r) => r.level === "MEDIUM");
+  console.log(`
+\u{1F50D} Mergen MCP Server Risk Scanner`);
+  console.log(`   Target: ${url}`);
+  console.log(`   Tools scanned: ${results.length}`);
+  console.log(`   Scanned at: ${(/* @__PURE__ */ new Date()).toLocaleString()}
+`);
+  if (critical.length === 0 && high.length === 0 && medium.length === 0) {
+    console.log(`${LEVEL_COLOR.LOW}\u2713 No high-risk signals found${RESET}
+`);
+  }
+  for (const r of results) {
+    if (r.level === "LOW" && r.signals.length === 0) continue;
+    const col = LEVEL_COLOR[r.level];
+    console.log(`${col}[${r.level}]${RESET} ${r.toolName} (score: ${r.score}/100)`);
+    for (const s of r.signals) {
+      console.log(`    \u2022 ${s}`);
+    }
+    console.log("");
+  }
+  console.log("\u2500".repeat(60));
+  const totals = [
+    critical.length ? `${LEVEL_COLOR.CRITICAL}${critical.length} CRITICAL${RESET}` : null,
+    high.length ? `${LEVEL_COLOR.HIGH}${high.length} HIGH${RESET}` : null,
+    medium.length ? `${LEVEL_COLOR.MEDIUM}${medium.length} MEDIUM${RESET}` : null
+  ].filter(Boolean);
+  if (totals.length > 0) {
+    console.log(`Summary: ${totals.join("  ")}  ${results.length - critical.length - high.length - medium.length} LOW`);
+  } else {
+    console.log(`Summary: ${LEVEL_COLOR.LOW}${results.length} LOW \u2014 server looks clean${RESET}`);
+  }
+  if (critical.length > 0) {
+    console.log(`
+\u26A0\uFE0F  CRITICAL tools detected \u2014 consider blocking this MCP server entirely`);
+    console.log(`   Add to Mergen policy: mergen-server policy-push and add a block rule for these tool names`);
+  } else if (high.length > 0) {
+    console.log(`
+\u26A0\uFE0F  HIGH risk tools detected \u2014 review parameter schemas and restrict with Mergen hold rules`);
+  }
+  console.log("");
+}
+async function scanCommand(args) {
+  const url = args.find((a) => !a.startsWith("-"));
+  const jsonMode = args.includes("--json");
+  if (!url) {
+    error("Usage: mergen-server scan <mcp-server-url> [--json]");
+    error("Example: mergen-server scan http://localhost:3001");
+    process.exit(1);
+  }
+  if (!jsonMode) log(`Scanning MCP server: ${url}`);
+  let tools;
+  try {
+    tools = await fetchMcpToolList(url);
+  } catch (err) {
+    error(`Failed to fetch tool manifest: ${err.message}`);
+    error(`Make sure the MCP server is running and accessible at ${url}`);
+    process.exit(1);
+  }
+  if (!jsonMode) log(`Found ${tools.length} tool(s) \u2014 analyzing risk signals...`);
+  const results = tools.map((t) => scoreTool(t.name, t.description ?? "", t.inputSchema));
+  results.sort((a, b) => b.score - a.score);
+  printResults(url, results, jsonMode);
+  if (results.some((r) => r.level === "CRITICAL")) process.exit(1);
+}
+export {
+  scanCommand
+};