palizade 0.1.1 → 0.2.0

package/dist/index.cjs

@@ -25387,6 +25387,7 @@ var capabilitySchema = external_exports.enum([
   "reads_untrusted_content",
   "reads_sensitive_data",
   "network_egress",
+  "file_write",
   "writes_local",
   "writes_remote",
   "deletes_data",
@@ -25404,9 +25405,48 @@ var serverConfigSchema = external_exports.object({
   trust: trustSchema.default("untrusted"),
   toolClasses: external_exports.record(external_exports.string(), toolClassSchema).default({}),
   toolCapabilities: external_exports.record(external_exports.string(), external_exports.array(capabilitySchema)).default({}),
+  sensitive: external_exports.boolean().default(false),
+  sensitiveTools: external_exports.record(external_exports.string(), external_exports.boolean()).default({}),
+  sensitivePathPatterns: external_exports.array(external_exports.string()).default([]),
   shell: external_exports.boolean().default(false),
   allowShell: external_exports.boolean().default(false)
 }).strict();
+var secretDetectorConfigSchema = external_exports.object({
+  enabled: external_exports.boolean().default(false),
+  aws: external_exports.boolean().default(true),
+  generic: external_exports.boolean().default(true),
+  jwt: external_exports.boolean().default(true),
+  privateKey: external_exports.boolean().default(true),
+  googleApiKey: external_exports.boolean().default(true),
+  stripe: external_exports.boolean().default(true),
+  slack: external_exports.boolean().default(true),
+  github: external_exports.boolean().default(true),
+  openai: external_exports.boolean().default(true)
+}).default({
+  enabled: false,
+  aws: true,
+  generic: true,
+  jwt: true,
+  privateKey: true,
+  googleApiKey: true,
+  stripe: true,
+  slack: true,
+  github: true,
+  openai: true
+});
+var piiDetectorConfigSchema = external_exports.object({
+  enabled: external_exports.boolean().default(false),
+  email: external_exports.boolean().default(true),
+  ssn: external_exports.boolean().default(true),
+  creditCard: external_exports.boolean().default(true),
+  phone: external_exports.boolean().default(true)
+}).default({
+  enabled: false,
+  email: true,
+  ssn: true,
+  creditCard: true,
+  phone: true
+});
 var palizadeConfigSchema = external_exports.object({
   stateDir: external_exports.string().default(".palizade"),
   policy: external_exports.string().default("policies/default.yaml"),
@@ -25429,10 +25469,22 @@ var palizadeConfigSchema = external_exports.object({
       model: external_exports.string().default("sinatras/Llama-Prompt-Guard-2-86M-ONNX"),
       cacheDir: external_exports.string().optional(),
       device: external_exports.string().default("cpu")
-    }).default({ enabled: false, model: "sinatras/Llama-Prompt-Guard-2-86M-ONNX", device: "cpu" })
+    }).default({ enabled: false, model: "sinatras/Llama-Prompt-Guard-2-86M-ONNX", device: "cpu" }),
+    secrets: secretDetectorConfigSchema,
+    pii: piiDetectorConfigSchema
   }).default({
     heuristic: true,
-    promptGuard2: { enabled: false, model: "sinatras/Llama-Prompt-Guard-2-86M-ONNX", device: "cpu" }
+    promptGuard2: { enabled: false, model: "sinatras/Llama-Prompt-Guard-2-86M-ONNX", device: "cpu" },
+    secrets: { enabled: false, aws: true, generic: true, jwt: true, privateKey: true, googleApiKey: true, stripe: true, slack: true, github: true, openai: true },
+    pii: { enabled: false, email: true, ssn: true, creditCard: true, phone: true }
+  }),
+  egress: external_exports.object({
+    allowlist: external_exports.object({
+      hosts: external_exports.array(external_exports.string()).default([]),
+      emails: external_exports.array(external_exports.string()).default([])
+    }).default({ hosts: [], emails: [] })
+  }).default({
+    allowlist: { hosts: [], emails: [] }
   }),
   transport: external_exports.object({
     maxMessageBytes: external_exports.number().int().min(1024).default(64 * 1024 * 1024),
@@ -25520,7 +25572,7 @@ var SOURCE_RE = /\b(read|get|fetch|search|browse|list|download|crawl|open|load|q
 var CAPABILITY_RULES = [
   [/\b(fetch|http|post|put|patch|request|webhook|url|browser|crawl)\b/iu, ["network_egress", "reads_untrusted_content"]],
   [/\b(email|mail|send|sms|slack|discord|message|publish)\b/iu, ["sends_message", "writes_remote", "network_egress"]],
-  [/\b(write|save|edit|create|move|append)\b/iu, ["writes_local"]],
+  [/\b(write|save|edit|create|move|append)\b/iu, ["file_write", "writes_local"]],
   [/\b(delete|remove|rm|destroy)\b/iu, ["deletes_data"]],
   [/\b(exec|shell|run|spawn|command|script|terminal)\b/iu, ["executes_code"]],
   [/\b(secret|credential|token|key|env|password)\b/iu, ["accesses_credentials", "reads_sensitive_data"]],
@@ -25534,7 +25586,7 @@ function classifyToolDetailed(toolName, server, tool) {
   for (const capability of capabilitiesFromAnnotations(tool?.annotations)) {
     capabilities.add(capability);
   }
-  const searchable = `${toolName} ${tool?.title ?? ""} ${tool?.description ?? ""}`;
+  const searchable = `${toolName} ${tool?.title ?? ""} ${tool?.description ?? ""}`.replace(/[_-]+/gu, " ");
   for (const [regex, matched] of CAPABILITY_RULES) {
     if (regex.test(searchable)) {
       matched.forEach((capability) => capabilities.add(capability));
@@ -25564,6 +25616,7 @@ function capabilitiesFromAnnotations(annotations) {
   const capabilities = /* @__PURE__ */ new Set();
   if (annotations.destructiveHint === true) {
     capabilities.add("writes_remote");
+    capabilities.add("file_write");
     capabilities.add("writes_local");
   }
   if (annotations.openWorldHint === true) {
@@ -25578,6 +25631,7 @@ function capabilitiesFromAnnotations(annotations) {
 function deriveClass(toolName, capabilities) {
   if ([...capabilities].some((capability) => [
     "network_egress",
+    "file_write",
     "writes_local",
     "writes_remote",
     "deletes_data",
@@ -26480,8 +26534,176 @@ function promptGuardMaliciousScore(rows) {
   return rows[0]?.score ?? 0;
 }
 
+// ../detectors/dist/sensitive.js
+var SECRET_RULES = [
+  { label: "secret:aws-access-key-id", family: "aws", kind: "secret", score: 0.9, regex: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gu },
+  { label: "secret:aws-secret-key", family: "aws", kind: "secret", score: 0.95, regex: /\baws[_-]?secret[_-]?access[_-]?key\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})["']?/giu },
+  { label: "secret:openai", family: "openai", kind: "secret", score: 0.9, regex: /\bsk-[A-Za-z0-9]{20,}\b/gu },
+  { label: "secret:github", family: "github", kind: "secret", score: 0.9, regex: /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/gu },
+  { label: "secret:slack", family: "slack", kind: "secret", score: 0.9, regex: /\bxox[abprs]-[A-Za-z0-9-]{20,}\b/gu },
+  { label: "secret:jwt", family: "jwt", kind: "secret", score: 0.85, regex: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/gu },
+  { label: "secret:jwt", family: "jwt", kind: "secret", score: 0.85, regex: /\bBearer\s+(eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})\b/giu },
+  { label: "secret:private-key", family: "privateKey", kind: "secret", score: 1, regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]{24,}?-----END [A-Z ]*PRIVATE KEY-----/gu },
+  { label: "secret:google-api-key", family: "googleApiKey", kind: "secret", score: 0.9, regex: /\bAIza[0-9A-Za-z_-]{35}\b/gu },
+  { label: "secret:stripe", family: "stripe", kind: "secret", score: 0.9, regex: /\b[sp]k_live_[0-9A-Za-z]{16,}\b/gu },
+  {
+    label: "secret:assignment",
+    family: "generic",
+    kind: "secret",
+    score: 0.8,
+    regex: /\b(?:password|passwd|api[_-]?key|secret|token|access[_-]?token|client[_-]?secret)\s*[:=]\s*["']?([A-Za-z0-9_./+=-]{12,})["']?/giu,
+    validate: (match) => shannonEntropy(match[1] ?? "") >= 3.2
+  }
+];
+var PII_RULES = [
+  { label: "pii:email", family: "email", kind: "pii", score: 0.55, regex: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/giu },
+  { label: "pii:ssn", family: "ssn", kind: "pii", score: 0.75, regex: /\b(?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b/gu },
+  {
+    label: "pii:credit-card",
+    family: "creditCard",
+    kind: "pii",
+    score: 0.75,
+    regex: /\b(?:\d[ -]*?){13,19}\b/gu,
+    validate: (match) => luhn(match[0].replace(/\D/gu, ""))
+  },
+  { label: "pii:phone", family: "phone", kind: "pii", score: 0.45, regex: /\b(?:\+?1[\s.-]?)?(?:\(\d{3}\)|\d{3})[\s.-]\d{3}[\s.-]\d{4}\b/gu }
+];
+var SensitiveDataDetector = class {
+  name = "sensitive";
+  options;
+  constructor(options = {}) {
+    this.options = {
+      secrets: { enabled: false, ...options.secrets },
+      pii: { enabled: false, ...options.pii }
+    };
+  }
+  detect(text, _ctx = {}) {
+    if (!text.trim()) {
+      return { score: 0, labels: [], spans: [], detector: this.name };
+    }
+    const spans = [];
+    const labels = /* @__PURE__ */ new Set();
+    let score = 0;
+    if (this.options.secrets.enabled) {
+      score = Math.max(score, this.applyRules(text, SECRET_RULES, this.options.secrets, spans, labels));
+    }
+    if (this.options.pii.enabled) {
+      score = Math.max(score, this.applyRules(text, PII_RULES, this.options.pii, spans, labels));
+    }
+    return {
+      score: clampScore(score),
+      labels: [...labels],
+      spans: mergeSensitiveSpans(spans),
+      detector: this.name
+    };
+  }
+  applyRules(text, rules, options, spans, labels) {
+    let maxScore = 0;
+    for (const rule of rules) {
+      if (options[rule.family] === false) {
+        continue;
+      }
+      for (const match of text.matchAll(rule.regex)) {
+        if (rule.validate && !rule.validate(match)) {
+          continue;
+        }
+        const start = match.index ?? 0;
+        const end = start + match[0].length;
+        labels.add(rule.label);
+        spans.push({ start, end, label: rule.label });
+        maxScore = Math.max(maxScore, rule.score);
+      }
+    }
+    return maxScore;
+  }
+};
+function isSecretLabel(label) {
+  return label.startsWith("secret:");
+}
+function isPiiLabel(label) {
+  return label.startsWith("pii:");
+}
+function hasSecretLabel(labels) {
+  return labels.some(isSecretLabel);
+}
+function hasPiiLabel(labels) {
+  return labels.some(isPiiLabel);
+}
+function maskSensitiveText(text, spans = []) {
+  if (spans.length === 0) {
+    return text;
+  }
+  let output2 = text;
+  const sorted = [...spans].sort((left, right) => right.start - left.start || right.end - left.end);
+  for (const span of sorted) {
+    output2 = `${output2.slice(0, span.start)}[REDACTED:${span.label ?? "sensitive"}]${output2.slice(span.end)}`;
+  }
+  return output2;
+}
+function maskKnownSensitiveText(text) {
+  const detector = new SensitiveDataDetector({
+    secrets: { enabled: true },
+    pii: { enabled: true }
+  });
+  const result = detector.detect(text);
+  return maskSensitiveText(text, result.spans);
+}
+function mergeSensitiveSpans(spans) {
+  const sorted = [...spans].sort((a, b) => a.start - b.start || a.end - b.end);
+  const merged = [];
+  for (const span of sorted) {
+    const last = merged[merged.length - 1];
+    if (!last || span.start > last.end) {
+      merged.push({ ...span });
+      continue;
+    }
+    last.end = Math.max(last.end, span.end);
+    if (last.label !== span.label) {
+      last.label = `${last.label ?? "sensitive"},${span.label ?? "sensitive"}`;
+    }
+  }
+  return merged;
+}
+function shannonEntropy(input2) {
+  if (!input2) {
+    return 0;
+  }
+  const counts = /* @__PURE__ */ new Map();
+  for (const char of input2) {
+    counts.set(char, (counts.get(char) ?? 0) + 1);
+  }
+  let entropy = 0;
+  for (const count of counts.values()) {
+    const p = count / input2.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+function luhn(input2) {
+  if (input2.length < 13 || input2.length > 19) {
+    return false;
+  }
+  let sum = 0;
+  let doubleDigit = false;
+  for (let index = input2.length - 1; index >= 0; index -= 1) {
+    let digit = Number(input2[index]);
+    if (!Number.isInteger(digit)) {
+      return false;
+    }
+    if (doubleDigit) {
+      digit *= 2;
+      if (digit > 9) {
+        digit -= 9;
+      }
+    }
+    sum += digit;
+    doubleDigit = !doubleDigit;
+  }
+  return sum % 10 === 0;
+}
+
 // ../policy/dist/schema.js
-var actionSchema = external_exports.enum(["allow", "block", "sanitize", "redact_spans", "require_approval", "log_only"]);
+var actionSchema = external_exports.enum(["allow", "block", "sanitize", "redact_spans", "redact_secrets", "require_approval", "log_only"]);
 var directionSchema = external_exports.enum(["request", "response"]);
 var trustSchema2 = external_exports.enum(["trusted", "semi", "untrusted"]);
 var toolClassSchema2 = external_exports.enum(["source", "sink", "pure", "unknown"]);
@@ -26490,6 +26712,7 @@ var capabilitySchema2 = external_exports.enum([
   "reads_untrusted_content",
   "reads_sensitive_data",
   "network_egress",
+  "file_write",
   "writes_local",
   "writes_remote",
   "deletes_data",
@@ -26512,7 +26735,12 @@ var policyConditionSchema = external_exports.object({
   capabilities_all: external_exports.array(capabilitySchema2).optional(),
   trust: singleOrArray(trustSchema2).optional(),
   taint: external_exports.boolean().optional(),
+  sensitive_taint: external_exports.boolean().optional(),
   temporal_taint: external_exports.boolean().optional(),
+  secret_detected: external_exports.boolean().optional(),
+  pii_detected: external_exports.boolean().optional(),
+  destination_allowed: external_exports.boolean().optional(),
+  destination_allowlist_configured: external_exports.boolean().optional(),
   detector_score_gte: external_exports.number().min(0).max(1).optional(),
   detector_score_lt: external_exports.number().min(0).max(1).optional(),
   labels_any: external_exports.array(external_exports.string()).optional(),
@@ -26602,8 +26830,18 @@ function matchesCondition(condition, ctx) {
     return false;
   if (condition.taint !== void 0 && Boolean(ctx.taint) !== condition.taint)
     return false;
+  if (condition.sensitive_taint !== void 0 && Boolean(ctx.sensitive_taint) !== condition.sensitive_taint)
+    return false;
   if (condition.temporal_taint !== void 0 && Boolean(ctx.temporal_taint) !== condition.temporal_taint)
     return false;
+  if (condition.secret_detected !== void 0 && Boolean(ctx.secret_detected) !== condition.secret_detected)
+    return false;
+  if (condition.pii_detected !== void 0 && Boolean(ctx.pii_detected) !== condition.pii_detected)
+    return false;
+  if (condition.destination_allowed !== void 0 && Boolean(ctx.destination_allowed) !== condition.destination_allowed)
+    return false;
+  if (condition.destination_allowlist_configured !== void 0 && Boolean(ctx.destination_allowlist_configured) !== condition.destination_allowlist_configured)
+    return false;
   if (condition.session_quarantined !== void 0 && Boolean(ctx.session_quarantined) !== condition.session_quarantined)
     return false;
   if (condition.detector_score_gte !== void 0 && (ctx.detector_score ?? 0) < condition.detector_score_gte)
@@ -26703,14 +26941,44 @@ var InterceptionEngine = class {
     const toolClass = classification.toolClass;
     const argumentText = flattenArguments(params.arguments);
     const argumentFields = extractArgumentFields(params.arguments);
+    const argumentBlocks = extractTextBlocks(params.arguments);
+    const argumentDetections = await Promise.all(argumentBlocks.map(async (block) => ({
+      block,
+      detection: await this.options.detector.detect(block.text, {
+        server: this.options.serverName,
+        tool,
+        trust: this.options.server.trust,
+        surface: "argument"
+      })
+    })));
+    const argumentDetection = fuseDetections(argumentDetections.map((entry) => entry.detection));
+    const argumentDetectionsByPath = new Map(argumentDetections.map((entry) => [pathKey(entry.block), entry.detection]));
     const matches = this.options.taintStore.match(this.options.sessionId, argumentText, {
       fuzzyHammingMax: this.options.config.taint.fuzzyHammingMax
     });
     const fieldMatches = argumentFields.flatMap((field) => this.options.taintStore.match(this.options.sessionId, field.text, {
       fuzzyHammingMax: this.options.config.taint.fuzzyHammingMax
     }).map((match) => ({ field, match })));
+    const sensitiveMatches = this.options.taintStore.match(this.options.sessionId, argumentText, {
+      fuzzyHammingMax: this.options.config.taint.fuzzyHammingMax,
+      classes: ["sensitive"]
+    });
+    const sensitiveFieldMatches = argumentFields.flatMap((field) => this.options.taintStore.match(this.options.sessionId, field.text, {
+      fuzzyHammingMax: this.options.config.taint.fuzzyHammingMax,
+      classes: ["sensitive"]
+    }).map((match) => ({ field, match })));
     const taintedArgumentRoles = [...new Set(fieldMatches.map(({ field }) => field.role))];
     const temporal = matches.some((match) => match.reason === "temporal") || this.options.taintStore.hasTemporal(this.options.sessionId);
+    const secretDetected = hasSecretLabel(argumentDetection.labels);
+    const piiDetected = hasPiiLabel(argumentDetection.labels);
+    const sensitiveTaint = sensitiveMatches.length > 0 || sensitiveFieldMatches.length > 0;
+    const destination = summarizeDestinations(argumentFields, this.options.config.egress.allowlist);
+    const allTaintMatches = [
+      ...matches,
+      ...fieldMatches.map(({ match }) => match),
+      ...sensitiveMatches,
+      ...sensitiveFieldMatches.map(({ match }) => match)
+    ];
     const decision = evaluatePolicy(this.options.policy, {
       direction: "request",
       method: message.method,
@@ -26720,7 +26988,14 @@ var InterceptionEngine = class {
       capabilities: classification.capabilities,
       trust: this.options.server.trust,
       taint: matches.length > 0 || fieldMatches.length > 0,
+      sensitive_taint: sensitiveTaint,
       temporal_taint: temporal,
+      secret_detected: secretDetected,
+      pii_detected: piiDetected,
+      destination_allowed: destination.allowed,
+      destination_allowlist_configured: destination.allowlistConfigured,
+      detector_score: argumentDetection.score,
+      labels: argumentDetection.labels,
       argument_text: argumentText,
       argument_roles: argumentRolesSummary(argumentFields),
       tainted_argument_roles: taintedArgumentRoles
@@ -26730,29 +27005,49 @@ var InterceptionEngine = class {
       tool,
       toolClass,
       classification,
-      taintMatches: [...matches, ...fieldMatches.map(({ match }) => match)],
+      taintMatches: allTaintMatches,
       summary: `${tool} (${toolClass}; ${classification.capabilities.join(",") || "no capabilities"}) wants to run with ${matches.length + fieldMatches.length} taint match(es).`
     });
     await this.auditDecision(message, "request", approval.decision, startedAt, {
       tool,
       toolClass,
       classification,
-      taintMatches: [...matches, ...fieldMatches.map(({ match }) => match)],
-      approved: approval.approved
+      detector: argumentDetection,
+      taintMatches: allTaintMatches,
+      approved: approval.approved,
+      argumentRoles: argumentRolesSummary(argumentFields),
+      taintedArgumentRoles,
+      destination,
+      sensitiveTaint,
+      secretDetected,
+      piiDetected,
+      taintClasses: classesFromMatches(allTaintMatches),
+      redacted: decision.action === "redact_secrets"
     });
     this.options.taintStore.consumeTurn(this.options.sessionId);
     if (!approval.approved || decision.action === "block") {
+      const taintMatchCount = matches.length + fieldMatches.length;
       return {
         toClient: message.id === void 0 ? [] : [
-          makeErrorResponse(message.id, -32020, "Palizade blocked MCP tool call", {
-            decision,
-            taint: matches,
-            taintedArgumentRoles
-          })
+          makeErrorResponse(message.id, -32020, formatBlockedToolCallMessage(decision), makeBlockedToolCallData(decision, taintedArgumentRoles, taintMatchCount))
         ],
         toServer: []
       };
     }
+    if (decision.action === "redact_secrets") {
+      const redactedArguments = applyTextTransforms(params.arguments, (text, block) => maskSensitiveText(text, argumentDetectionsByPath.get(pathKey(block))?.spans));
+      this.recordPending(message, tool);
+      return {
+        toClient: [],
+        toServer: [{
+          ...message,
+          params: {
+            ...params,
+            arguments: redactedArguments
+          }
+        }]
+      };
+    }
     this.recordPending(message, tool);
     return { toClient: [], toServer: [message] };
   }
@@ -26855,6 +27150,9 @@ var InterceptionEngine = class {
       capabilities: classification.capabilities,
       trust: this.options.server.trust,
       taint: taintRecords.length > 0,
+      sensitive_taint: recordsHaveClass(taintRecords, "sensitive"),
+      secret_detected: hasSecretLabel(fused.labels),
+      pii_detected: hasPiiLabel(fused.labels),
       detector_score: fused.score,
       labels: fused.labels
     });
@@ -26873,6 +27171,10 @@ var InterceptionEngine = class {
       classification,
       detector: fused,
       taintIds: taintRecords.map((record2) => record2.id),
+      taintClasses: classesFromRecords(taintRecords),
+      sensitiveTaint: recordsHaveClass(taintRecords, "sensitive"),
+      secretDetected: hasSecretLabel(fused.labels),
+      piiDetected: hasPiiLabel(fused.labels),
       approved: approval.approved,
       payload: result
     });
@@ -26901,7 +27203,7 @@ var InterceptionEngine = class {
         toServer: []
       };
     }
-    if (decision.action === "redact_spans") {
+    if (decision.action === "redact_spans" || decision.action === "redact_secrets") {
       return {
         toClient: [{
           ...message,
@@ -26978,8 +27280,10 @@ var InterceptionEngine = class {
     return { toClient: [message], toServer: [] };
   }
   registerTaint(tool, toolClass, blocks, detection) {
-    const shouldTaint = this.options.server.trust !== "trusted" || toolClass === "source" || detection.score >= this.options.config.taint.suspiciousScore;
-    if (!shouldTaint) {
+    const untrusted = this.options.server.trust !== "trusted" || toolClass === "source" || detection.score >= this.options.config.taint.suspiciousScore;
+    const sensitive = this.isSensitiveOrigin(tool) || hasSecretLabel(detection.labels) || hasPiiLabel(detection.labels);
+    const classes = taintClasses({ untrusted, sensitive });
+    if (classes.length === 0) {
       return [];
     }
     return blocks.filter((block) => block.text.trim().length >= 8).map((block) => this.options.taintStore.add({
@@ -26989,24 +27293,30 @@ var InterceptionEngine = class {
       trust: this.options.server.trust,
       text: block.text,
       detectorScore: detection.score,
-      labels: detection.labels
+      labels: detection.labels,
+      classes
     }));
   }
   registerTaintFromContents(sourceName, classification, contents, detection) {
     const highRiskSource = this.options.server.trust === "untrusted" || classification.toolClass === "source" || classification.capabilities.includes("reads_untrusted_content");
-    const shouldTaint = highRiskSource || detection.score >= this.options.config.taint.suspiciousScore;
-    if (!shouldTaint) {
-      return [];
-    }
-    return contents.filter((content) => content.text && content.text.trim().length >= 8 && content.kind !== "binary").map((content) => this.options.taintStore.add({
-      sessionId: this.options.sessionId,
-      sourceServer: this.options.serverName,
-      sourceTool: content.sourceToolOrResource ?? sourceName,
-      trust: this.options.server.trust,
-      text: content.text ?? "",
-      detectorScore: detection.score,
-      labels: detection.labels
-    }));
+    return contents.filter((content) => content.text && content.text.trim().length >= 8 && content.kind !== "binary").flatMap((content) => {
+      const untrusted = highRiskSource || detection.score >= this.options.config.taint.suspiciousScore;
+      const sensitive = this.isSensitiveOrigin(sourceName, content) || hasSecretLabel(detection.labels) || hasPiiLabel(detection.labels);
+      const classes = taintClasses({ untrusted, sensitive });
+      if (classes.length === 0) {
+        return [];
+      }
+      return [this.options.taintStore.add({
+        sessionId: this.options.sessionId,
+        sourceServer: this.options.serverName,
+        sourceTool: content.sourceToolOrResource ?? sourceName,
+        trust: this.options.server.trust,
+        text: content.text ?? "",
+        detectorScore: detection.score,
+        labels: detection.labels,
+        classes
+      })];
+    });
   }
   async handleDescriptorListResponse(message, bucket, origin, resultKey, nameOf) {
     const startedAt = Date.now();
@@ -27077,6 +27387,9 @@ var InterceptionEngine = class {
       capabilities: classification.capabilities,
       trust: this.options.server.trust,
       taint: taintRecords.length > 0,
+      sensitive_taint: recordsHaveClass(taintRecords, "sensitive"),
+      secret_detected: hasSecretLabel(fused.labels),
+      pii_detected: hasPiiLabel(fused.labels),
       detector_score: fused.score,
       labels: fused.labels
     });
@@ -27093,6 +27406,10 @@ var InterceptionEngine = class {
       classification,
       detector: fused,
       taintIds: taintRecords.map((record2) => record2.id),
+      taintClasses: classesFromRecords(taintRecords),
+      sensitiveTaint: recordsHaveClass(taintRecords, "sensitive"),
+      secretDetected: hasSecretLabel(fused.labels),
+      piiDetected: hasPiiLabel(fused.labels),
       approved: approval.approved,
       payload: result
     });
@@ -27115,7 +27432,7 @@ var InterceptionEngine = class {
         toServer: []
       };
     }
-    if (decision.action === "redact_spans") {
+    if (decision.action === "redact_spans" || decision.action === "redact_secrets") {
       return {
         toClient: [{
           ...message,
@@ -27226,7 +27543,7 @@ var InterceptionEngine = class {
       tool: extra.tool,
       direction,
       method: extra.method ?? (isRequest(message) ? message.method : void 0),
-      taint_ids: extra.taintIds ?? extra.taintMatches?.map((match) => match.taintId) ?? [],
+      taint_ids: dedupePreservingOrder(extra.taintIds ?? extra.taintMatches?.map((match) => match.taintId) ?? []),
       detector: {
         score: extra.detector?.score ?? 0,
         labels: extra.detector?.labels ?? []
@@ -27238,13 +27555,46 @@ var InterceptionEngine = class {
       action: decision.action,
       reason: decision.reason,
       latency_ms: Date.now() - startedAt,
-      payload: extra.payload,
+      payload: scrubAuditPayload(extra.payload),
       metadata: {
         toolClass: extra.toolClass,
         capabilities: extra.classification?.capabilities,
         lockChecks: extra.lockChecks,
         lockStatus: extra.lockStatus,
-        approved: extra.approved
+        approved: extra.approved,
+        argumentRoles: extra.argumentRoles,
+        taintedArgumentRoles: extra.taintedArgumentRoles,
+        taintClasses: extra.taintClasses,
+        destination: extra.destination,
+        sensitiveTaint: extra.sensitiveTaint,
+        secretDetected: extra.secretDetected,
+        piiDetected: extra.piiDetected,
+        redacted: extra.redacted
+      }
+    });
+  }
+  isSensitiveOrigin(sourceName, content) {
+    if (this.options.server.sensitive) {
+      return true;
+    }
+    if (this.options.server.sensitiveTools[sourceName] === true) {
+      return true;
+    }
+    if (content?.sourceToolOrResource && this.options.server.sensitiveTools[content.sourceToolOrResource] === true) {
+      return true;
+    }
+    const searchable = [
+      sourceName,
+      content?.sourceToolOrResource,
+      content?.path,
+      typeof content?.rawValue === "string" ? content.rawValue : void 0
+    ].filter((value) => Boolean(value));
+    return this.options.server.sensitivePathPatterns.some((pattern) => {
+      try {
+        const regex = new RegExp(pattern, "iu");
+        return searchable.some((value) => regex.test(value));
+      } catch {
+        return false;
       }
     });
   }
@@ -27252,6 +27602,111 @@ var InterceptionEngine = class {
 function pathKey(block) {
   return block.path.join(".");
 }
+function taintClasses(input2) {
+  const classes = [];
+  if (input2.untrusted) {
+    classes.push("untrusted");
+  }
+  if (input2.sensitive) {
+    classes.push("sensitive");
+  }
+  return classes;
+}
+function recordsHaveClass(records, taintClass) {
+  return records.some((record2) => record2.classes.includes(taintClass));
+}
+function classesFromRecords(records) {
+  return dedupePreservingOrder(records.flatMap((record2) => record2.classes));
+}
+function classesFromMatches(matches) {
+  return dedupePreservingOrder(matches.flatMap((match) => match.classes ?? []));
+}
+function summarizeDestinations(argumentFields, allowlist) {
+  const hosts = dedupePreservingOrder(argumentFields.flatMap((field) => hostsFromField(field)));
+  const emails = dedupePreservingOrder(argumentFields.filter((field) => field.role === "email_recipient").map((field) => field.text.toLowerCase()));
+  const allowlistConfigured = allowlist.hosts.length > 0 || allowlist.emails.length > 0;
+  const hostsAllowed = hosts.every((host) => allowlist.hosts.some((entry) => matchesHost(entry, host)));
+  const emailsAllowed = emails.every((email3) => allowlist.emails.some((entry) => matchesEmail(entry, email3)));
+  const hasDestinations = hosts.length > 0 || emails.length > 0;
+  return {
+    allowed: !allowlistConfigured || !hasDestinations || hostsAllowed && emailsAllowed,
+    allowlistConfigured,
+    hosts,
+    emailRecipients: emails.map(maskSensitiveValueForMetadata),
+    destinationCount: hosts.length + emails.length
+  };
+}
+function hostsFromField(field) {
+  if (field.role === "hostname") {
+    return [normalizeHost(field.text)].filter(Boolean);
+  }
+  if (field.role !== "url") {
+    return [];
+  }
+  try {
+    return [normalizeHost(new URL(field.text).hostname)].filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function matchesHost(pattern, host) {
+  const normalizedPattern = normalizeHost(pattern);
+  const normalizedHost = normalizeHost(host);
+  if (!normalizedPattern || !normalizedHost) {
+    return false;
+  }
+  if (normalizedPattern === "*") {
+    return true;
+  }
+  if (normalizedPattern.startsWith("*.")) {
+    const suffix = normalizedPattern.slice(1);
+    return normalizedHost.endsWith(suffix);
+  }
+  return normalizedPattern === normalizedHost;
+}
+function matchesEmail(pattern, email3) {
+  const normalizedPattern = pattern.trim().toLowerCase();
+  const normalizedEmail = email3.trim().toLowerCase();
+  if (!normalizedPattern || !normalizedEmail) {
+    return false;
+  }
+  if (normalizedPattern === "*") {
+    return true;
+  }
+  if (normalizedPattern.startsWith("*@")) {
+    return normalizedEmail.endsWith(normalizedPattern.slice(1));
+  }
+  if (normalizedPattern.startsWith("@")) {
+    return normalizedEmail.endsWith(normalizedPattern);
+  }
+  return normalizedPattern === normalizedEmail;
+}
+function normalizeHost(value) {
+  return value.trim().toLowerCase().replace(/\.$/u, "");
+}
+function maskSensitiveValueForMetadata(value) {
+  const [local, domain2] = value.split("@");
+  if (!local || !domain2) {
+    return "[REDACTED:destination]";
+  }
+  return `${local.slice(0, 1) || "*"}***@${domain2}`;
+}
+function scrubAuditPayload(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value === "string") {
+    return maskKnownSensitiveText(value);
+  }
+  if (value === null || typeof value !== "object") {
+    return value;
+  }
+  try {
+    return applyTextTransforms(value, (text) => maskKnownSensitiveText(text));
+  } catch {
+    return "[payload omitted: audit masking failed]";
+  }
+}
 function worstLockStatus(checks) {
   if (checks.length === 0)
     return "unknown";
@@ -27274,6 +27729,29 @@ function descriptorName(item, fallback) {
   }
   return `${fallback}:${JSON.stringify(item).slice(0, 80)}`;
 }
+function formatBlockedToolCallMessage(decision) {
+  const reason = trimTrailingPeriod(decision.reason);
+  const rule = decision.matchedRuleId ? ` (rule: ${decision.matchedRuleId})` : "";
+  return `Palizade blocked this call: ${reason}${rule}.`;
+}
+function makeBlockedToolCallData(decision, taintedArgumentRoles, taintMatchCount) {
+  return {
+    action: decision.action,
+    rule: {
+      id: decision.matchedRuleId,
+      name: decision.matchedRuleName
+    },
+    reason: decision.reason,
+    taintedArgumentRoles,
+    taintMatchCount
+  };
+}
+function trimTrailingPeriod(text) {
+  return text.endsWith(".") ? text.slice(0, -1) : text;
+}
+function dedupePreservingOrder(values) {
+  return [...new Set(values)];
+}
 function auditScopeId(scope, profileId, runId, sessionId) {
   if (scope === "process") {
     return `process:${sessionId}`;
@@ -27923,6 +28401,7 @@ var SqliteTaintStore = class {
         payload_hash text not null,
         detector_score real not null,
         labels_json text not null,
+        classes_json text,
         fingerprint_json text not null
       );
       create index if not exists idx_taint_session on taint_records(session_id);
@@ -27938,6 +28417,7 @@ var SqliteTaintStore = class {
     this.ensureColumn("taint_records", "scope_id", "text");
     this.ensureColumn("taint_records", "run_id", "text");
     this.ensureColumn("taint_records", "expires_at", "text");
+    this.ensureColumn("taint_records", "classes_json", "text");
     this.db.exec(`
       create index if not exists idx_taint_scope on taint_records(scope_id);
       create index if not exists idx_taint_expires on taint_records(expires_at);
@@ -27962,11 +28442,12 @@ var SqliteTaintStore = class {
       payloadHash: sha2563(input2.text),
       detectorScore: input2.detectorScore,
       labels: [...input2.labels],
+      classes: normalizeClasses(input2.classes),
       fingerprint: makeProtectedFingerprint(input2.text, this.hmacKey)
     };
     this.db.prepare(`insert into taint_records
-       (id, profile_id, scope_id, run_id, session_id, source_server, source_tool, trust, created_at, expires_at, payload_hash, detector_score, labels_json, fingerprint_json)
-       values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(record2.id, record2.profileId, record2.scopeId, record2.runId ?? null, record2.sessionId, record2.sourceServer, record2.sourceTool, record2.trust, record2.createdAt, record2.expiresAt, record2.payloadHash, record2.detectorScore, JSON.stringify(record2.labels), JSON.stringify(record2.fingerprint));
+       (id, profile_id, scope_id, run_id, session_id, source_server, source_tool, trust, created_at, expires_at, payload_hash, detector_score, labels_json, classes_json, fingerprint_json)
+       values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(record2.id, record2.profileId, record2.scopeId, record2.runId ?? null, record2.sessionId, record2.sourceServer, record2.sourceTool, record2.trust, record2.createdAt, record2.expiresAt, record2.payloadHash, record2.detectorScore, JSON.stringify(record2.labels), JSON.stringify(record2.classes), JSON.stringify(record2.fingerprint));
     return record2;
   }
   get(id) {
@@ -27984,27 +28465,34 @@ var SqliteTaintStore = class {
     const records = this.recordsForScope(sessionId);
     const matches = [];
     for (const record2 of records) {
+      if (!matchesClassFilter(record2.classes, options.classes)) {
+        continue;
+      }
       const incomingFragments = new Set(incoming.substrings);
       const substring = record2.fingerprint.substrings.find((candidate) => candidate.length >= minNormalizedLength && incomingFragments.has(candidate));
       if (substring) {
-        matches.push({ taintId: record2.id, reason: "substring", token: substring });
+        matches.push({ taintId: record2.id, reason: "substring", token: substring, classes: record2.classes });
         continue;
       }
       const token = record2.fingerprint.tokens.find((candidate) => candidate.length >= 8 && incoming.tokens.includes(candidate));
       if (token) {
-        matches.push({ taintId: record2.id, reason: "token", token });
+        matches.push({ taintId: record2.id, reason: "token", token, classes: record2.classes });
         continue;
       }
       if (record2.fingerprint.normalized.length >= 32 && incoming.normalized.length >= 32) {
         const distance = hammingDistanceHex(record2.fingerprint.simhash, incoming.simhash);
         if (distance <= fuzzyHammingMax) {
-          matches.push({ taintId: record2.id, reason: "fuzzy", score: 1 - distance / 64 });
+          matches.push({ taintId: record2.id, reason: "fuzzy", classes: record2.classes, score: 1 - distance / 64 });
         }
       }
     }
     for (const temporal of this.activeTemporalRows(sessionId)) {
       for (const taintId of JSON.parse(temporal.source_taint_ids_json)) {
-        matches.push({ taintId, reason: "temporal" });
+        const record2 = this.get(taintId);
+        const classes = record2?.classes ?? ["untrusted"];
+        if (matchesClassFilter(classes, options.classes)) {
+          matches.push({ taintId, reason: "temporal", classes });
+        }
       }
     }
     return dedupeMatches(matches);
@@ -28101,9 +28589,17 @@ function rowToRecord(row) {
     payloadHash: row.payload_hash,
     detectorScore: row.detector_score,
     labels: JSON.parse(row.labels_json),
+    classes: row.classes_json ? JSON.parse(row.classes_json) : ["untrusted"],
     fingerprint: JSON.parse(row.fingerprint_json)
   };
 }
+function normalizeClasses(classes) {
+  const normalized = classes && classes.length > 0 ? classes : ["untrusted"];
+  return [...new Set(normalized)];
+}
+function matchesClassFilter(classes, filter) {
+  return !filter || filter.some((taintClass) => classes.includes(taintClass));
+}
 function makeProtectedFingerprint(input2, key) {
   const normalized = normalizeText(input2);
   const fragments = makeSubstrings(normalized).map((fragment) => hmacSha256Hex(key, fragment));
@@ -28194,6 +28690,12 @@ function createDetector(config2) {
   if (config2.detectors.heuristic) {
     detectors2.push(new HeuristicDetector());
   }
+  if (config2.detectors.secrets.enabled || config2.detectors.pii.enabled) {
+    detectors2.push(new SensitiveDataDetector({
+      secrets: config2.detectors.secrets,
+      pii: config2.detectors.pii
+    }));
+  }
   if (config2.detectors.onnxModelPath) {
     detectors2.push(new OptionalOnnxDetector({ modelPath: config2.detectors.onnxModelPath }));
   }
@@ -28401,6 +28903,15 @@ detectors:
     model: sinatras/Llama-Prompt-Guard-2-86M-ONNX
     cacheDir: .palizade/models
     device: cpu
+  secrets:
+    enabled: false
+  pii:
+    enabled: false
+
+egress:
+  allowlist:
+    hosts: []
+    emails: []
 
 transport:
   maxMessageBytes: 67108864
@@ -28432,6 +28943,9 @@ servers:
       read_web: source
       send_email: sink
       echo: pure
+    sensitive: false
+    sensitiveTools: {}
+    sensitivePathPatterns: []
   filesystem:
     command: node
     args:
@@ -28453,6 +28967,9 @@ servers:
       edit_file: sink
       create_directory: sink
       move_file: sink
+    sensitive: false
+    sensitiveTools: {}
+    sensitivePathPatterns: []
 `;
 var DEFAULT_POLICY = `version: 1
 defaults:
@@ -28524,7 +29041,6 @@ rules:
     when:
       direction: response
       method: tools/call
-      trust: untrusted
       detector_score_gte: 0.35
     action: sanitize
     reason: Untrusted tool output contains injection-like signals.
@@ -28540,6 +29056,15 @@ rules:
     action: sanitize
     reason: Resource or prompt content contains injection-like signals.
 
+  - id: sanitize-strong-injection-any-trust
+    name: Spotlight strong injection signals regardless of trust
+    when:
+      direction: response
+      method: tools/call
+      detector_score_gte: 0.75
+    action: sanitize
+    reason: Strong injection signal in tool output.
+
   - id: block-tainted-sink
     name: Block tainted content entering sinks
     when:

package/dist/templates.d.ts

@@ -1,3 +1,3 @@
-export declare const DEFAULT_CONFIG = "stateDir: .palizade\npolicy: policies/default.yaml\nlockfile: palizade.lock\n\naudit:\n  jsonl: .palizade/audit.jsonl\n  sqlite: .palizade/audit.sqlite\n  captureRawPayloads: false\n\napprovals:\n  mode: localhost\n  timeoutMs: 30000\n  default: deny\n\ndetectors:\n  heuristic: true\n  promptGuard2:\n    enabled: false\n    model: sinatras/Llama-Prompt-Guard-2-86M-ONNX\n    cacheDir: .palizade/models\n    device: cpu\n\ntransport:\n  maxMessageBytes: 67108864\n  maxBufferedBytes: 67108864\n  allowBatches: false\n  allowContentLength: false\n\ntaint:\n  sqlite: .palizade/taint.sqlite\n  keyPath: .palizade/taint.key\n  scope: profile\n  profileId: default\n  ttlMs: 86400000\n  suspiciousScore: 0.35\n  fuzzyHammingMax: 7\n  temporal:\n    enabled: true\n    turns: 3\n    ttlMs: 300000\n    detectorScoreGte: 0.55\n\nservers:\n  toy:\n    command: node\n    args:\n      - examples/toy-mcp-server/server.mjs\n    trust: untrusted\n    toolClasses:\n      read_web: source\n      send_email: sink\n      echo: pure\n  filesystem:\n    command: node\n    args:\n      - node_modules/@modelcontextprotocol/server-filesystem/dist/index.js\n      - .\n    trust: semi\n    toolClasses:\n      read_file: source\n      read_text_file: source\n      read_media_file: source\n      read_multiple_files: source\n      list_directory: source\n      list_directory_with_sizes: source\n      directory_tree: source\n      search_files: source\n      get_file_info: source\n      list_allowed_directories: source\n      write_file: sink\n      edit_file: sink\n      create_directory: sink\n      move_file: sink\n";
-export declare const DEFAULT_POLICY = "version: 1\ndefaults:\n  action: allow\n  on_error: block\n\nrules:\n  - id: deny-server-sampling\n    name: Deny server-initiated model access\n    when:\n      direction: request\n      method: sampling/createMessage\n    action: block\n    reason: MCP server attempted to access the model through sampling.\n\n  - id: block-poisoned-tool-metadata\n    name: Block poisoned tool metadata\n    when:\n      direction: response\n      method: tools/list\n      detector_score_gte: 0.75\n    action: block\n    reason: Tool metadata looks like prompt injection or tool poisoning.\n\n  - id: block-untrusted-unknown-tool\n    name: Block unknown tools on untrusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: untrusted\n      tool_class: unknown\n    action: block\n    reason: Unknown tools on untrusted servers must be classified explicitly.\n\n  - id: approve-semi-unknown-tool\n    name: Require approval for unknown tools on semi-trusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: semi\n      tool_class: unknown\n    action: require_approval\n    reason: Unknown tools on semi-trusted servers require approval.\n\n  - id: log-trusted-unknown-tool\n    name: Audit unknown tools on trusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: trusted\n      tool_class: unknown\n    action: log_only\n    reason: Unknown tool on trusted server allowed with audit logging.\n\n  - id: log-unapproved-tool-metadata\n    name: Surface tool lock drift\n    when:\n      direction: response\n      method: tools/list\n      lock_status:\n        - missing\n        - new\n        - changed\n    action: log_only\n    reason: Tool metadata is not approved in palizade.lock.\n\n  - id: sanitize-suspicious-untrusted-output\n    name: Spotlight suspicious untrusted output\n    when:\n      direction: response\n      method: tools/call\n      trust: untrusted\n      detector_score_gte: 0.35\n    action: sanitize\n    reason: Untrusted tool output contains injection-like signals.\n\n  - id: sanitize-suspicious-resource-content\n    name: Spotlight suspicious resource content\n    when:\n      direction: response\n      method:\n        - resources/read\n        - prompts/get\n      detector_score_gte: 0.35\n    action: sanitize\n    reason: Resource or prompt content contains injection-like signals.\n\n  - id: block-tainted-sink\n    name: Block tainted content entering sinks\n    when:\n      direction: request\n      method: tools/call\n      tool_class: sink\n      taint: true\n    action: block\n    reason: Tainted content is flowing into a sink tool.\n\n  - id: block-tainted-egress-destination\n    name: Block tainted outbound destinations\n    when:\n      direction: request\n      method: tools/call\n      capabilities_any:\n        - network_egress\n        - sends_message\n      tainted_argument_role_any:\n        - url\n        - hostname\n        - email_recipient\n        - http_query\n    action: block\n    reason: Tainted content is being used as an outbound destination or query parameter.\n\n  - id: require-approval-temporal-taint-sink\n    name: Require approval during temporal taint\n    when:\n      direction: request\n      method: tools/call\n      tool_class: sink\n      temporal_taint: true\n    action: require_approval\n    reason: Recent suspicious untrusted content makes sink calls risky.\n";
+export declare const DEFAULT_CONFIG = "stateDir: .palizade\npolicy: policies/default.yaml\nlockfile: palizade.lock\n\naudit:\n  jsonl: .palizade/audit.jsonl\n  sqlite: .palizade/audit.sqlite\n  captureRawPayloads: false\n\napprovals:\n  mode: localhost\n  timeoutMs: 30000\n  default: deny\n\ndetectors:\n  heuristic: true\n  promptGuard2:\n    enabled: false\n    model: sinatras/Llama-Prompt-Guard-2-86M-ONNX\n    cacheDir: .palizade/models\n    device: cpu\n  secrets:\n    enabled: false\n  pii:\n    enabled: false\n\negress:\n  allowlist:\n    hosts: []\n    emails: []\n\ntransport:\n  maxMessageBytes: 67108864\n  maxBufferedBytes: 67108864\n  allowBatches: false\n  allowContentLength: false\n\ntaint:\n  sqlite: .palizade/taint.sqlite\n  keyPath: .palizade/taint.key\n  scope: profile\n  profileId: default\n  ttlMs: 86400000\n  suspiciousScore: 0.35\n  fuzzyHammingMax: 7\n  temporal:\n    enabled: true\n    turns: 3\n    ttlMs: 300000\n    detectorScoreGte: 0.55\n\nservers:\n  toy:\n    command: node\n    args:\n      - examples/toy-mcp-server/server.mjs\n    trust: untrusted\n    toolClasses:\n      read_web: source\n      send_email: sink\n      echo: pure\n    sensitive: false\n    sensitiveTools: {}\n    sensitivePathPatterns: []\n  filesystem:\n    command: node\n    args:\n      - node_modules/@modelcontextprotocol/server-filesystem/dist/index.js\n      - .\n    trust: semi\n    toolClasses:\n      read_file: source\n      read_text_file: source\n      read_media_file: source\n      read_multiple_files: source\n      list_directory: source\n      list_directory_with_sizes: source\n      directory_tree: source\n      search_files: source\n      get_file_info: source\n      list_allowed_directories: source\n      write_file: sink\n      edit_file: sink\n      create_directory: sink\n      move_file: sink\n    sensitive: false\n    sensitiveTools: {}\n    sensitivePathPatterns: []\n";
+export declare const DEFAULT_POLICY = "version: 1\ndefaults:\n  action: allow\n  on_error: block\n\nrules:\n  - id: deny-server-sampling\n    name: Deny server-initiated model access\n    when:\n      direction: request\n      method: sampling/createMessage\n    action: block\n    reason: MCP server attempted to access the model through sampling.\n\n  - id: block-poisoned-tool-metadata\n    name: Block poisoned tool metadata\n    when:\n      direction: response\n      method: tools/list\n      detector_score_gte: 0.75\n    action: block\n    reason: Tool metadata looks like prompt injection or tool poisoning.\n\n  - id: block-untrusted-unknown-tool\n    name: Block unknown tools on untrusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: untrusted\n      tool_class: unknown\n    action: block\n    reason: Unknown tools on untrusted servers must be classified explicitly.\n\n  - id: approve-semi-unknown-tool\n    name: Require approval for unknown tools on semi-trusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: semi\n      tool_class: unknown\n    action: require_approval\n    reason: Unknown tools on semi-trusted servers require approval.\n\n  - id: log-trusted-unknown-tool\n    name: Audit unknown tools on trusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: trusted\n      tool_class: unknown\n    action: log_only\n    reason: Unknown tool on trusted server allowed with audit logging.\n\n  - id: log-unapproved-tool-metadata\n    name: Surface tool lock drift\n    when:\n      direction: response\n      method: tools/list\n      lock_status:\n        - missing\n        - new\n        - changed\n    action: log_only\n    reason: Tool metadata is not approved in palizade.lock.\n\n  - id: sanitize-suspicious-untrusted-output\n    name: Spotlight suspicious untrusted output\n    when:\n      direction: response\n      method: tools/call\n      detector_score_gte: 0.35\n    action: sanitize\n    reason: Untrusted tool output contains injection-like signals.\n\n  - id: sanitize-suspicious-resource-content\n    name: Spotlight suspicious resource content\n    when:\n      direction: response\n      method:\n        - resources/read\n        - prompts/get\n      detector_score_gte: 0.35\n    action: sanitize\n    reason: Resource or prompt content contains injection-like signals.\n\n  - id: sanitize-strong-injection-any-trust\n    name: Spotlight strong injection signals regardless of trust\n    when:\n      direction: response\n      method: tools/call\n      detector_score_gte: 0.75\n    action: sanitize\n    reason: Strong injection signal in tool output.\n\n  - id: block-tainted-sink\n    name: Block tainted content entering sinks\n    when:\n      direction: request\n      method: tools/call\n      tool_class: sink\n      taint: true\n    action: block\n    reason: Tainted content is flowing into a sink tool.\n\n  - id: block-tainted-egress-destination\n    name: Block tainted outbound destinations\n    when:\n      direction: request\n      method: tools/call\n      capabilities_any:\n        - network_egress\n        - sends_message\n      tainted_argument_role_any:\n        - url\n        - hostname\n        - email_recipient\n        - http_query\n    action: block\n    reason: Tainted content is being used as an outbound destination or query parameter.\n\n  - id: require-approval-temporal-taint-sink\n    name: Require approval during temporal taint\n    when:\n      direction: request\n      method: tools/call\n      tool_class: sink\n      temporal_taint: true\n    action: require_approval\n    reason: Recent suspicious untrusted content makes sink calls risky.\n";
 //# sourceMappingURL=templates.d.ts.map

package/dist/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,6kDAyE1B,CAAC;AAEF,eAAO,MAAM,cAAc,k4GAyH1B,CAAC"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,21DAwF1B,CAAC;AAEF,eAAO,MAAM,cAAc,soHAiI1B,CAAC"}

package/dist/templates.js

@@ -19,6 +19,15 @@ detectors:
     model: sinatras/Llama-Prompt-Guard-2-86M-ONNX
     cacheDir: .palizade/models
     device: cpu
+  secrets:
+    enabled: false
+  pii:
+    enabled: false
+
+egress:
+  allowlist:
+    hosts: []
+    emails: []
 
 transport:
   maxMessageBytes: 67108864
@@ -50,6 +59,9 @@ servers:
       read_web: source
       send_email: sink
       echo: pure
+    sensitive: false
+    sensitiveTools: {}
+    sensitivePathPatterns: []
   filesystem:
     command: node
     args:
@@ -71,6 +83,9 @@ servers:
       edit_file: sink
       create_directory: sink
       move_file: sink
+    sensitive: false
+    sensitiveTools: {}
+    sensitivePathPatterns: []
 `;
 export const DEFAULT_POLICY = `version: 1
 defaults:
@@ -142,7 +157,6 @@ rules:
     when:
       direction: response
       method: tools/call
-      trust: untrusted
       detector_score_gte: 0.35
     action: sanitize
     reason: Untrusted tool output contains injection-like signals.
@@ -158,6 +172,15 @@ rules:
     action: sanitize
     reason: Resource or prompt content contains injection-like signals.
 
+  - id: sanitize-strong-injection-any-trust
+    name: Spotlight strong injection signals regardless of trust
+    when:
+      direction: response
+      method: tools/call
+      detector_score_gte: 0.75
+    action: sanitize
+    reason: Strong injection signal in tool output.
+
   - id: block-tainted-sink
     name: Block tainted content entering sinks
     when:

package/dist/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyE7B,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyH7B,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwF7B,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiI7B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "palizade",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "MCP-native prompt-injection firewall and security proxy.",
   "license": "Apache-2.0",
   "type": "module",