perimetercli 0.1.0

package/src/report.js

@@ -0,0 +1,333 @@
+import { escapeHtml } from "./util.js";
+import { money } from "./tokens.js";
+import { SEVERITY_RANK } from "./rules.js";
+
+export function severityLabel(severity) {
+  return String(severity || "info").toUpperCase();
+}
+
+export function formatText(audit) {
+  const L = [];
+  L.push("Perimeter — agent toolchain audit");
+  L.push("=".repeat(38));
+  L.push(
+    `Scanned ${audit.servers.length} server${audit.servers.length === 1 ? "" : "s"} · ${
+      audit.contextFiles.length
+    } context file${audit.contextFiles.length === 1 ? "" : "s"}`
+  );
+  L.push(`Verdict: ${sevColor(audit.effectiveVerdict)}`);
+  const c = audit.counts;
+  L.push(
+    `  ${c.critical} critical · ${c.high} high · ${c.medium} medium · ${c.low} low · ${c.info} info`
+  );
+  L.push("");
+
+  if (audit.servers.length) {
+    L.push(`── Servers (${audit.servers.length}) ──`);
+    for (const s of audit.servers) {
+      L.push(
+        `  ${s.displayName.padEnd(18)} ${sevColor(s.verdict, true).padEnd(9)} ${(
+          s.capabilities.length
+        )} caps · ${s.estimatedTokens.toLocaleString()} tok · ${s.source}`
+      );
+    }
+    L.push("");
+  }
+
+  const findings = audit.effectiveFindings.length
+    ? audit.effectiveFindings
+    : audit.findings;
+  if (findings.length) {
+    L.push(`── Findings (${findings.length}) ──`);
+    for (const f of findings) {
+      L.push(
+        `  [${sevColor(f.severity)}] ${f.id} · ${f.title}`
+      );
+      L.push(`      ${f.server}${f.packageName ? ` (${f.packageName})` : ""} — ${f.detail}`);
+      L.push(`      Fix: ${f.remediation}`);
+    }
+    L.push("");
+  } else {
+    L.push("No findings — this toolchain is clean. ✓");
+    L.push("");
+  }
+
+  const cost = audit.costs;
+  L.push(`── Cost ──`);
+  L.push(
+    `  model ${cost.model}${cost.estimated ? " (estimated)" : ""} · ~${cost.totalTokens.toLocaleString()} tokens/load · ${money(
+      cost.perLoadCost
+    )}/load`
+  );
+  if (cost.budget) {
+    L.push(
+      `  budget ${money(cost.budget)}/day → ${cost.loadsPerDayWithinBudget ?? 0} loads/day`
+    );
+    if (cost.overBudget) L.push(`  ⚠ over budget`);
+  }
+  return L.join("\n");
+}
+
+export function formatSessionText(report) {
+  const L = [];
+  L.push("Perimeter — agent runtime observability");
+  L.push("=".repeat(38));
+  L.push(
+    `${report.files} session file${report.files === 1 ? "" : "s"} · ${report.messages.toLocaleString()} messages · ${report.totalTokens.toLocaleString()} tokens${
+      report.usageExact ? " (exact)" : " (estimated)"
+    }`
+  );
+  L.push("");
+  L.push(`── Tool usage (${report.tools.length}) ──`);
+  if (report.tools.length === 0) {
+    L.push("  No tool calls recorded.");
+  } else {
+    for (const t of report.tools) {
+      L.push(
+        `  ${t.name.padEnd(18)} ${String(t.count).padStart(4)} calls  ${sevColor(t.severity, true).padEnd(9)}  ${t.capability}`
+      );
+    }
+  }
+  L.push("");
+  if (report.riskyTools.length) {
+    L.push(`── Risky tool calls (${report.riskyTools.length}) ──`);
+    for (const t of report.riskyTools) {
+      L.push(`  [${sevColor(t.severity)}] ${t.name} called ${t.count}×`);
+    }
+    L.push("");
+  }
+  const cost = report.cost;
+  L.push(`── Cost ──`);
+  L.push(
+    `  model ${cost.model}${cost.estimated ? " (estimated)" : ""} · ${money(cost.perLoad)}`
+  );
+  return L.join("\n");
+}
+
+export function formatSessionJson(report) {
+  return JSON.stringify(report, null, 2);
+}
+
+export function formatMarkdown(audit) {
+  const lines = [];
+  lines.push("# Perimeter — Agent Toolchain Audit", "");
+  lines.push(`**Verdict:** ${severityLabel(audit.effectiveVerdict)}`);
+  lines.push("");
+  lines.push(
+    `Scanned **${audit.servers.length}** servers and **${audit.contextFiles.length}** context files on ${audit.generatedAt.slice(0, 10)}.`
+  );
+  lines.push("");
+  const c = audit.counts;
+  lines.push(
+    `**Findings:** ${c.critical} critical · ${c.high} high · ${c.medium} medium · ${c.low} low · ${c.info} info`
+  );
+  lines.push("");
+
+  lines.push("## Servers", "");
+  lines.push("| Server | Transport | Capabilities | Tokens | Verdict |");
+  lines.push("| --- | --- | --- | --- | --- |");
+  for (const s of audit.servers) {
+    lines.push(
+      `| ${s.displayName} | ${s.transport} | ${s.capabilities.join(", ") || "—"} | ${s.estimatedTokens.toLocaleString()} | **${severityLabel(s.verdict)}** |`
+    );
+  }
+  lines.push("");
+
+  const findings = audit.effectiveFindings.length
+    ? audit.effectiveFindings
+    : audit.findings;
+  if (findings.length) {
+    lines.push("## Findings", "");
+    for (const f of findings) {
+      lines.push(`### [${severityLabel(f.severity)}] ${f.id} — ${f.title}`, "");
+      lines.push(`**Server:** ${f.server}${f.packageName ? ` (\`${f.packageName}\`)` : ""}`);
+      lines.push("");
+      lines.push(f.detail, "");
+      lines.push(`**Remediation:** ${f.remediation}`, "");
+      lines.push(`> OWASP Agentic: ${f.owasp}`, "");
+    }
+  } else {
+    lines.push("## Findings", "", "No findings — this toolchain is clean. ✓", "");
+  }
+
+  const cost = audit.costs;
+  lines.push("## Cost", "");
+  lines.push(
+    `- Model: \`${cost.model}\`${cost.estimated ? " (estimated pricing)" : ""}`
+  );
+  lines.push(`- ~${cost.totalTokens.toLocaleString()} tokens per load`);
+  lines.push(`- ${money(cost.perLoadCost)} per load`);
+  if (cost.budget) {
+    lines.push(`- Budget: ${money(cost.budget)}/day → ~${cost.loadsPerDayWithinBudget ?? 0} loads/day`);
+  }
+  lines.push("");
+  lines.push("---", "");
+  lines.push(`_Generated by [Perimeter](https://perimetercli.dev)._`);
+  return lines.join("\n");
+}
+
+export function formatJson(audit) {
+  return JSON.stringify(
+    {
+      generatedAt: audit.generatedAt,
+      cwd: audit.cwd,
+      verdict: audit.effectiveVerdict,
+      counts: audit.counts,
+      config: audit.config,
+      costs: audit.costs,
+      servers: audit.servers,
+      findings: audit.findings,
+      contextFiles: audit.contextFiles,
+    },
+    (key, value) => (value === undefined ? undefined : value),
+    2
+  );
+}
+
+export function formatSarif(audit) {
+  const results = audit.findings.map((f, i) => ({
+    ruleId: f.id,
+    level: sarifLevel(f.severity),
+    message: { text: `${f.title} — ${f.detail}` },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri: f.location || f.serverId || "config" },
+          region: { startLine: 1, startColumn: 1 },
+        },
+      },
+    ],
+    properties: {
+      severity: f.severity,
+      server: f.server,
+      owasp: f.owasp,
+      remediation: f.remediation,
+    },
+  }));
+  return JSON.stringify(
+    {
+      version: "2.1.0",
+      $schema:
+        "https://json.schemastore.org/sarif-2.1.0.json",
+      runs: [
+        {
+          tool: {
+            driver: {
+              name: "perimeter",
+              version: "0.1.0",
+              informationUri: "https://perimetercli.dev",
+              rules: audit.findings.map((f, i) => ({
+                id: f.id,
+                name: f.title,
+                shortDescription: { text: f.title },
+                help: { text: f.remediation },
+                properties: { severity: f.severity, owasp: f.owasp },
+              })),
+            },
+          },
+          results,
+        },
+      ],
+    },
+    null,
+    2
+  );
+}
+
+function sarifLevel(severity) {
+  if (severity === "critical" || severity === "high") return "error";
+  if (severity === "medium") return "warning";
+  if (severity === "low") return "note";
+  return "none";
+}
+
+export function formatHtml(audit) {
+  const c = audit.counts;
+  const findingsHtml = audit.findings.length
+    ? audit.findings
+        .map((f) => {
+          return `<div class="finding ${f.severity}">
+            <div class="head"><span class="sev">${severityLabel(f.severity)}</span><code>${escapeHtml(
+              f.id
+            )}</code><h3>${escapeHtml(f.title)}</h3></div>
+            <p>${escapeHtml(f.detail)}</p>
+            <div class="meta"><span>${escapeHtml(f.server)}</span>${
+              f.packageName ? `<code>${escapeHtml(f.packageName)}</code>` : ""
+            }</div>
+            <div class="fix"><strong>Fix:</strong> ${escapeHtml(f.remediation)}</div>
+            <div class="owasp">OWASP Agentic: ${escapeHtml(f.owasp)}</div>
+          </div>`;
+        })
+        .join("\n")
+    : `<p class="clean">No findings — this toolchain is clean. ✓</p>`;
+
+  const serversHtml = audit.servers
+    .map((s) => {
+      return `<tr>
+        <td>${escapeHtml(s.displayName)}</td>
+        <td>${escapeHtml(s.transport)}</td>
+        <td><code>${escapeHtml(s.capabilities.join(", ") || "—")}</code></td>
+        <td>${s.estimatedTokens.toLocaleString()}</td>
+        <td><span class="badge ${s.verdict}">${severityLabel(s.verdict)}</span></td>
+      </tr>`;
+    })
+    .join("\n");
+
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Perimeter audit — ${escapeHtml(audit.cwd)}</title>
+<style>
+:root{--bg:#0b0f17;--panel:#111827;--border:#1f2937;--text:#e5e7eb;--muted:#94a3b8;--accent:#6366f1}
+*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font-family:ui-sans-serif,system-ui,sans-serif;line-height:1.6}
+.wrap{max-width:980px;margin:0 auto;padding:32px 24px}
+h1{letter-spacing:-.02em}.muted{color:var(--muted)}
+.verdict{display:inline-block;padding:6px 14px;border-radius:999px;font-weight:700}
+.critical{background:#7f1d1d;color:#fecaca}.high{background:#7c2d12;color:#fed7aa}.medium{background:#713f12;color:#fde68a}.low{background:#1e3a8a;color:#bfdbfe}.info{background:#1f2937;color:#cbd5e1}
+.badge{padding:2px 10px;border-radius:999px;font-size:12px;font-weight:600}
+.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(120px,1fr));gap:10px;margin:18px 0}
+.card{background:var(--panel);border:1px solid var(--border);border-radius:12px;padding:14px}
+.card .n{font-size:26px;font-weight:800}.card .l{color:var(--muted);font-size:13px}
+table{border-collapse:collapse;width:100%;font-size:14px;margin:18px 0}
+th,td{padding:8px 12px;text-align:left;border-bottom:1px solid var(--border)}
+th{color:var(--muted)}code{background:#0f172a;padding:1px 6px;border-radius:5px;font-size:12.5px}
+.finding{background:var(--panel);border:1px solid var(--border);border-left:4px solid var(--accent);border-radius:12px;padding:16px;margin:12px 0}
+.finding.critical{border-left-color:#ef4444}.finding.high{border-left-color:#f97316}.finding.medium{border-left-color:#facc15}.finding.low{border-left-color:#3b82f6}
+.finding .head{display:flex;align-items:center;gap:10px}
+.finding .sev{font-size:11px;font-weight:700;color:var(--muted)}
+.finding h3{margin:0}.finding p{margin:.5rem 0;color:#cbd5e1}
+.fix{font-size:13px;margin-top:8px}.owasp{font-size:12px;color:var(--muted);margin-top:6px}
+.clean{color:var(--muted)}
+footer{margin-top:28px;color:var(--muted);font-size:13px;text-align:center}
+</style></head>
+<body><div class="wrap">
+<h1>Perimeter · Agent toolchain audit</h1>
+<p class="muted">${escapeHtml(audit.cwd)} · ${audit.generatedAt.slice(0, 19).replace("T", " ")}</p>
+<p>Verdict: <span class="verdict ${audit.effectiveVerdict}">${severityLabel(audit.effectiveVerdict)}</span></p>
+<div class="cards">
+  <div class="card"><div class="n">${audit.servers.length}</div><div class="l">Servers</div></div>
+  <div class="card"><div class="n">${audit.counts.critical}</div><div class="l">Critical</div></div>
+  <div class="card"><div class="n">${audit.counts.high}</div><div class="l">High</div></div>
+  <div class="card"><div class="n">${audit.costs.totalTokens.toLocaleString()}</div><div class="l">Tokens/load</div></div>
+  <div class="card"><div class="n">${money(audit.costs.perLoadCost)}</div><div class="l">Cost/load</div></div>
+</div>
+<h2>Servers</h2>
+<table><thead><tr><th>Server</th><th>Transport</th><th>Capabilities</th><th>Tokens</th><th>Verdict</th></tr></thead>
+<tbody>${serversHtml}</tbody></table>
+<h2>Findings</h2>
+${findingsHtml}
+<footer>Generated by <a href="https://perimetercli.dev">Perimeter</a></footer>
+</div></body></html>`;
+}
+
+function sevColor(severity, short = false) {
+  const map = {
+    critical: "\x1b[31m",
+    high: "\x1b[33m",
+    medium: "\x1b[33m",
+    low: "\x1b[36m",
+    info: "\x1b[90m",
+  };
+  const reset = "\x1b[0m";
+  const label = severityLabel(severity);
+  return `${map[severity] || ""}${label}${reset}`;
+}

package/src/rules.js

@@ -0,0 +1,357 @@
+import { looksTyposquatted } from "./catalog.js";
+import { tokensForTools } from "./tokens.js";
+
+export const SEVERITIES = ["critical", "high", "medium", "low", "info"];
+export const SEVERITY_RANK = { critical: 5, high: 4, medium: 3, low: 2, info: 1 };
+
+const INJECT_PATTERNS = [
+  /ignore\s+(?:previous|above|all|any)\s+instructions?/i,
+  /disregard\s+(?:the|previous|prior|above)/i,
+  /\bnow\s+you\s+(?:are|will be|should be)\b/i,
+  /\bdo\s+not\s+tell\s+(?:the\s+)?(?:user|anyone)\b/i,
+  /\bexfiltrat/i,
+  /\bemail\s+(?:the\s+)?(?:contents|files|data|everything)\b/i,
+  /\bsend\s+(?:everything|all|the\s+contents)\s+to\b/i,
+  /\b(?:copy|send)\s+~?\/(?:\.ssh|home|etc)|id_rsa|\.aws\/credentials\b/i,
+  /BEGIN\s+(?:SYSTEM|USER|OVERRIDE)/i,
+];
+
+const CAPABILITY_PATTERNS = {
+  shell: /(^|[^a-z])(exec|exec_js|bash|shell|terminal|run_command|run_cmd|command_line|zsh|sh\b)/i,
+  "code-exec": /(eval|evaluate_js|python|node|run_code|code_exec|interpret|js_eval|powershell)/i,
+  "filesystem-write": /(write_file|writefile|edit_file|editfile|create_file|make_directory|append_file|save_file|delete_file|rm\b)/i,
+  "filesystem-read": /(read_file|readfile|list_directory|list_dir|get_file|search_files|glob)/i,
+  "network-out": /(http_(post|put|patch)|fetch|post_message|send_message|publish|webhook|upload|send_to|curl|mailto|email_)/i,
+  "network-in": /(search_|query|web_search|http_get|fetch_url|get_page|browser_)/i,
+  payment: /(payment|checkout|purchase|transfer|withdraw|balance|charge|billing|pay_|make_payment|refund)/i,
+  credentials: /(~\/\.ssh|id_rsa|getenv|read_env|env_var|credential|secret|api[_ ]?key|access[_-]?token|password|\.aws\/credentials)/i,
+  "db-write": /(sql|execute|insert|update|delete|run_query|execute_query|sqlexecute|write_table|create_table)/i,
+  "secrets-write": /(set_secret|put_secret|store_secret|create_secret|write_(token|key)|vault_)/i,
+  "cloud-write": /(aws_|ec2|s3_|create_instance|terraform|cloudformation|gcp_|azure_|kubectl|deploy)/i,
+  browser: /(browser|puppeteer|playwright|navigate|click|screenshot)/i,
+};
+
+/**
+ * Determine the capabilities of a server from its catalog profile and from
+ * heuristics over the command, args, env keys and any tool descriptions.
+ */
+export function capabilitiesFor(server) {
+  const caps = new Set(server.catalog?.capabilities || []);
+  // A hook is arbitrary code executed by the agent at one or more lifecycle
+  // points — treat it as code execution unconditionally.
+  if (server.kind === "hook" || server.transport === "hook") caps.add("code-exec");
+  const haystack = [
+    server.command,
+    ...(server.args || []),
+    ...Object.keys(server.env || {}),
+    ...(server.tools || []).map((t) => `${t.name} ${t.description}`),
+  ]
+    .filter(Boolean)
+    .join(" ");
+  for (const [cap, re] of Object.entries(CAPABILITY_PATTERNS)) {
+    if (re.test(haystack)) caps.add(cap);
+  }
+  return caps;
+}
+
+function maxRank(items) {
+  return items.reduce((max, f) => Math.max(max, SEVERITY_RANK[f.severity]), 0);
+}
+
+/**
+ * Run the rule set against a server. `ctx` = { config, baseline, catalog, cost }.
+ */
+export function runRules(server, ctx = {}) {
+  const findings = [];
+  const caps = capabilitiesFor(server);
+  const config = ctx.config || {};
+  const baseline = ctx.baseline || null;
+  const maxTokens = config.maxTokensPerServer ?? 5000;
+  const add = (f) => findings.push({
+    server: server.displayName,
+    serverId: server.id,
+    location: server.source,
+    packageName: server.packageName || null,
+    owasp: f.owasp || "AGENT-06",
+    ...f,
+  });
+
+  const toolText = (server.tools || [])
+    .map((t) => `${t.name || ""} ${t.description || ""}`)
+    .join("\n");
+
+  // Tool poisoning / prompt injection in tool metadata.
+  if (INJECT_PATTERNS.some((re) => re.test(toolText))) {
+    add({
+      id: "INJECT-001",
+      severity: "critical",
+      title: "Tool poisoning: likely injection in tool description",
+      detail: "A tool description contains wording used by prompt-injection and tool-poisoning attacks. An agent may follow instructions hidden in tool metadata.",
+      remediation: "Remove embedded instructions from tool metadata; use a verifier or proxy that sandboxes tool output.",
+      owasp: "AGENT-01",
+    });
+  }
+
+  // Dangerous capability combinations.
+  if (caps.has("shell") || caps.has("code-exec")) {
+    add({
+      id: "RISK-SHELL",
+      severity: caps.has("network-out") ? "critical" : "high",
+      title: "Arbitrary command execution",
+      detail: "The server can execute shell/code. This is the highest-impact capability an agent can hold.",
+      remediation: "Run in a sandbox/container with no network egress; use an allowlist of permitted commands.",
+      owasp: "AGENT-05",
+    });
+  }
+  if (caps.has("payment")) {
+    add({
+      id: "RISK-PAYMENT",
+      severity: "high",
+      title: "Payment / financial capability",
+      detail: "The server can initiate transactions or alter balances. Unauthorised or prompt-injected calls can move money.",
+      remediation: "Require a human approval gate; scope keys to a read-only or sandboxed account.",
+      owasp: "AGENT-05",
+    });
+  }
+  if (caps.has("credentials")) {
+    add({
+      id: "RISK-CREDS",
+      severity: "high",
+      title: "Credential / secret access",
+      detail: "The server can read credentials (SSH keys, env vars, API tokens) or references them in its env.",
+      remediation: "Inject short-lived, scoped credentials only; never pass durable secrets in config.",
+      owasp: "AGENT-04",
+    });
+  }
+  if (
+    caps.has("network-out") &&
+    (caps.has("filesystem-read") || caps.has("filesystem-write") || caps.has("credentials"))
+  ) {
+    add({
+      id: "RISK-EXFIL",
+      severity: "critical",
+      title: "Data access plus outbound network (exfiltration risk)",
+      detail: "A server that can read/write data or secrets and reach an external endpoint is a prototypical data-exfiltration path.",
+      remediation: "Remove egress or file-write; split capabilities across least-privilege tools.",
+      owasp: "AGENT-02",
+    });
+  }
+  if (caps.has("filesystem-write")) {
+    add({
+      id: "RISK-FSWRITE",
+      severity: "medium",
+      title: "Filesystem write access",
+      detail: "The server can create or modify files. Ensure writes are confined to the project directory.",
+      remediation: "Pin the working directory; deny paths outside an allowlist.",
+      owasp: "AGENT-04",
+    });
+  }
+  if (caps.has("cloud-write")) {
+    add({
+      id: "RISK-CLOUD",
+      severity: "high",
+      title: "Cloud infrastructure write",
+      detail: "The server can mutate cloud resources. Broad cloud credentials are a high-impact risk.",
+      remediation: "Use a read-only or project-scoped role; require an approval step.",
+      owasp: "AGENT-05",
+    });
+  }
+  if (caps.has("db-write")) {
+    add({
+      id: "RISK-DBWRITE",
+      severity: "medium",
+      title: "Database write capability",
+      detail: "The server can execute writes against a database. Unsupervised writes can corrupt or exfiltrate data held in tables.",
+      remediation: "Scope to a read-only role or a dedicated schema; add an approval gate for mutations.",
+      owasp: "AGENT-05",
+    });
+  }
+
+  // Supply-chain concerns.
+  const pkg = server.packageName || "";
+  if (pkg && looksTyposquatted(pkg)) {
+    add({
+      id: "SUP-TYPOSQUAT",
+      severity: "critical",
+      title: "Possible typosquatted package name",
+      detail: `"${pkg}" is one edit away from a well-known package — a common supply-chain attack.`,
+      remediation: "Verify the publisher; pin an exact version from the canonical registry entry.",
+      owasp: "AGENT-06",
+    });
+  }
+  if (!server.catalog && server.transport !== "hook") {
+    add({
+      id: "SUP-UNVERIFIED",
+      severity: caps.size ? "medium" : "info",
+      title: "Unverified server capabilities",
+      detail: "No offline profile recognised for this package. Capabilities are inferred heuristically.",
+      remediation: "Confirm the package origin and enumerate its tools before granting it to an agent.",
+      owasp: "AGENT-06",
+    });
+  }
+  if (isUnpinnedStdio(server)) {
+    add({
+      id: "SUP-UNPINNED",
+      severity: "low",
+      title: "Unpinned package version",
+      detail: "The server is fetched at runtime (npx/uvx) without a pinned version or lockfile.",
+      remediation: "Pin an exact version or vendor the package into the lockfile.",
+      owasp: "AGENT-06",
+    });
+  }
+  const secretEnv = Object.keys(server.env || {}).filter((k) =>
+    /token|secret|key|password|credential|auth/i.test(k)
+  );
+  if (secretEnv.length) {
+    add({
+      id: "SUP-CREDS-ENV",
+      severity: "medium",
+      title: "Secrets present in server config env",
+      detail: `Credential-like env vars are configured: ${secretEnv.join(", ")}. They may be visible in version control.`,
+      remediation: "Reference secrets from the runtime secret store; never commit them.",
+      owasp: "AGENT-04",
+    });
+  }
+
+  // Context / token budget.
+  const tokens = estimateServerTokens(server);
+  server.estimatedTokens = tokens;
+  if (tokens > maxTokens) {
+    add({
+      id: "TOK-BLOAT",
+      severity: "low",
+      title: "Large context footprint",
+      detail: `Estimated ${tokens.toLocaleString()} tokens to load this server, above the ${maxTokens.toLocaleString()} threshold.`,
+      remediation: "Trim tool schemas, or lazy-load tools with a compressor such as mcp-compressor.",
+      owasp: "AGENT-03",
+    });
+  }
+
+  // Drift detection against a stored baseline.
+  if (baseline) {
+    const sig = server.signature;
+    const prior = baseline.servers && baseline.servers[server.id];
+    if (prior && prior.signature !== sig) {
+      add({
+        id: "DRIFT-CHANGED",
+        severity: "high",
+        title: "Server configuration changed since baseline",
+        detail: "A tool command, argument or description changed. This can indicate a rug-pull or silent supply-chain swap.",
+        remediation: "Review the diff and re-approve; consider pinning content hashes.",
+        owasp: "AGENT-06",
+      });
+    } else if (!prior) {
+      add({
+        id: "DRIFT-NEW",
+        severity: "medium",
+        title: "Server not in baseline",
+        detail: "A new server was added to the configuration.",
+        remediation: "Approve the new server or remove it.",
+        owasp: "AGENT-06",
+      });
+    }
+  }
+
+  findings.sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]);
+  return { capabilities: [...caps], findings, verdict: verdictOf(findings) };
+}
+
+const SECRET_PATTERNS = [
+  /\bgh[pousr]_[A-Za-z0-9]{16,}\b/,
+  /\bsk-live-[A-Za-z0-9]{16,}\b/,
+  /\bsk-[A-Za-z0-9]{16,}\b/,
+  /\bsk_live_[A-Za-z0-9]{16,}\b/,
+  /\bsk_[A-Za-z0-9]{16,}\b/,
+  /\bAKIA[0-9A-Z]{16}\b/,
+  /-----BEGIN (?:RSA|OPENSSH|EC|DSA|PGP) (?:PRIVATE )?KEY-----/,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
+  /(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*['"][^'"]{8,}['"]/i,
+];
+
+/**
+ * Analyse an agent instruction file or a skill for embedded instructions and
+ * committed secrets. These files are read by the agent every session.
+ */
+export function runContextRules(ctx) {
+  const findings = [];
+  const text = String(ctx.content || "");
+  if (INJECT_PATTERNS.some((re) => re.test(text))) {
+    findings.push({
+      id: "INJECT-002",
+      severity: "high",
+      title: "Suspicious instructions in agent context file",
+      detail: `Embedded instruction phrasing detected in ${ctx.label}. An agent reads this text every session, so it can redirect behaviour.`,
+      remediation: "Review the file and remove embedded instruction phrasing; consider pinning or signing it.",
+      server: ctx.label,
+      serverId: ctx.label,
+      location: ctx.label,
+      packageName: null,
+      owasp: "AGENT-01",
+    });
+  }
+  const secret = SECRET_PATTERNS.find((re) => re.test(text));
+  if (secret) {
+    findings.push({
+      id: "SECRET-LEAK",
+      severity: "critical",
+      title: "Possible secret in context file",
+      detail: `A credential-like value was detected in ${ctx.label}.`,
+      remediation: "Rotate the secret and remove it from version control and agent context.",
+      server: ctx.label,
+      serverId: ctx.label,
+      location: ctx.label,
+      packageName: null,
+      owasp: "AGENT-04",
+    });
+  }
+  return findings;
+}
+
+function estimateServerTokens(server) {
+  if (server.tools && server.tools.length) {
+    return tokensForTools(server.tools, 400);
+  }
+  if (server.catalog && Number.isFinite(server.catalog.tokens)) {
+    return server.catalog.tokens;
+  }
+  // Fall back to the server name/description so we at least tokenise something.
+  return tokensForTools(
+    [
+      {
+        name: server.displayName,
+        description: server.catalog?.note || server.command || "",
+      },
+    ],
+    400
+  );
+}
+
+function isUnpinnedStdio(server) {
+  const args = server.args || [];
+  if (!/npx|uvx|pipx|deno|bunx/i.test(server.command || "")) return false;
+  return !args.some((a) => /@\d+\.\d+\.\d+|=v?\d+\.\d+\.\d+/i.test(a));
+}
+
+export function verdictOf(findings) {
+  let rank = 0;
+  let verdict = "info";
+  for (const f of findings) {
+    if (SEVERITY_RANK[f.severity] > rank) {
+      rank = SEVERITY_RANK[f.severity];
+      verdict = f.severity;
+    }
+  }
+  return verdict;
+}
+
+/** Aggregate a set of server results into a single report verdict. */
+export function overallVerdict(serverResults) {
+  const all = serverResults.flatMap((r) => r.findings || []);
+  const bySeverity = {};
+  for (const s of SEVERITIES) bySeverity[s] = all.filter((f) => f.severity === s).length;
+  return {
+    verdict: verdictOf(all),
+    counts: bySeverity,
+    total: all.length,
+  };
+}