residoo 0.22.0 → 0.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/cve.js

@@ -0,0 +1,278 @@
+"use strict";
+
+/**
+ * A small, hand-curated, dated table of published CVEs affecting the
+ * MCP/AI-agent ecosystem, plus a minimal version-range matcher -- the
+ * shared infrastructure behind `residoo scan`'s MCP-config CVE check
+ * (integrity.js's "MCP server configuration risks" section) and a future
+ * `--project` dependency-manifest check.
+ *
+ * SOURCE, stated precisely because it matters: every entry below was
+ * fetched directly from GitHub's own Security Advisory REST API
+ * (api.github.com/advisories?ecosystem=<npm|pip>&affects=<package>) on
+ * 2026-09-05 -- a primary, authoritative source (GHSA-reviewed, each
+ * entry carrying its own CVE id, GHSA id, and vulnerable/patched version
+ * range), not a secondary aggregator's summary. An earlier draft of this
+ * table was built from a dedicated MCP-CVE tracking site
+ * (vulnerablemcp.info) and cross-checked against this API before
+ * shipping; every version range below is the API's own
+ * `vulnerable_version_range` field, not a re-derived or estimated one.
+ * Package NAMES were independently confirmed to exist on the real npm/
+ * PyPI registries (`npm view <pkg>`, PyPI's own JSON API) before being
+ * added here -- a wrong package name would silently never match anything,
+ * the same "never a false all-clear" concern CONTRIBUTING.md states for
+ * source paths, applied to this table instead.
+ *
+ * DELIBERATELY SMALL, on purpose: this is ~24 entries across 10 packages,
+ * not a claim of exhaustive coverage the way Medusa's own "~200 CVEs" is.
+ * Every single entry here is individually traceable to a specific GHSA/
+ * CVE id and a real advisory -- the same "84 high-confidence rules beat a
+ * competitor's higher rule count" trade-off already proven on this
+ * project's own benchmark (see bench/RESULTS.md), applied to CVE data
+ * instead of secret patterns. A welcome follow-up PR is adding more
+ * packages through the same API query, cited the same way -- never by
+ * guessing a plausible-sounding range.
+ *
+ * VERSION COMPARISON: a minimal, hand-written major.minor.patch numeric
+ * comparator -- NOT a full semver-range grammar (no ^, ~, prerelease
+ * tags, build metadata, x-ranges). Sufficient for every range in this
+ * table, including the date-based versioning scheme
+ * `@modelcontextprotocol/server-filesystem` switched to mid-2025
+ * (`2025.1.14`, `2025.7.1`) -- verified directly that comparing
+ * `[2025,1,20]` against `[2025,7,1]` component-by-component gives the
+ * correct ordering, the same way it would for an ordinary semver triple.
+ * A version string this comparator can't parse (a prerelease suffix, a
+ * git-hash pseudo-version, anything non-numeric) is reported as
+ * "cannot determine" by the caller, never silently treated as either safe
+ * or vulnerable -- CONTRIBUTING.md's rule 5 applied to a version string
+ * instead of a file.
+ */
+
+const CVE_DATABASE = [
+  // ---- npm ----
+  {
+    id: "CVE-2025-6514", ecosystem: "npm", package: "mcp-remote", severity: "critical",
+    ranges: [{ min: "0.0.5", maxExclusive: "0.1.16" }],
+    summary: "OS command injection via a crafted authorization_endpoint response URL when connecting to an untrusted MCP server.",
+    source: "GHSA-6xpm-ggf7-wc3p",
+  },
+  {
+    id: "CVE-2025-58444", ecosystem: "npm", package: "@modelcontextprotocol/inspector", severity: "high",
+    ranges: [{ maxExclusive: "0.16.6" }],
+    summary: "Potential command execution via XSS when Inspector connects to an untrusted MCP server.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-49596", ecosystem: "npm", package: "@modelcontextprotocol/inspector", severity: "critical",
+    ranges: [{ maxExclusive: "0.14.1" }],
+    summary: "The Inspector proxy server lacks authentication between the Inspector client and the proxy, enabling RCE.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-23744", ecosystem: "npm", package: "@mcpjam/inspector", severity: "critical",
+    ranges: [{ maxInclusive: "1.4.2" }],
+    summary: "Remote code execution via an exposed, unauthenticated HTTP endpoint.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-65513", ecosystem: "npm", package: "mcp-fetch-server", severity: "medium",
+    ranges: [{ maxInclusive: "1.0.2" }],
+    summary: "Server-Side Request Forgery (SSRF) vulnerability.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53372", ecosystem: "npm", package: "node-code-sandbox-mcp", severity: "high",
+    ranges: [{ maxInclusive: "1.2.0" }],
+    summary: "Sandbox escape via command injection.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-47250", ecosystem: "npm", package: "mcp-server-kubernetes", severity: "medium",
+    ranges: [{ maxInclusive: "3.6.2" }],
+    summary: "kubectl-generic flag injection enables Kubernetes bearer-token exfiltration.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-46519", ecosystem: "npm", package: "mcp-server-kubernetes", severity: "high",
+    ranges: [{ maxExclusive: "3.6.0" }],
+    summary: "Tool access control bypass via presentation-layer filtering with no execution-layer enforcement.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-39884", ecosystem: "npm", package: "mcp-server-kubernetes", severity: "high",
+    ranges: [{ maxInclusive: "3.4.0" }],
+    summary: "Argument injection in the port_forward tool via space-splitting.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-66404", ecosystem: "npm", package: "mcp-server-kubernetes", severity: "medium",
+    ranges: [{ maxInclusive: "2.9.7" }],
+    summary: "Security issue in the exec_in_pod tool.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53355", ecosystem: "npm", package: "mcp-server-kubernetes", severity: "high",
+    ranges: [{ maxExclusive: "2.5.0" }],
+    summary: "Command injection in several tools.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-25536", ecosystem: "npm", package: "@modelcontextprotocol/sdk", severity: "high",
+    ranges: [{ min: "1.10.0", maxInclusive: "1.25.3" }],
+    summary: "Cross-client data leak via shared server/transport instance reuse.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-0621", ecosystem: "npm", package: "@modelcontextprotocol/sdk", severity: "high",
+    ranges: [{ min: "1.3.0", maxExclusive: "1.25.2" }],
+    summary: "ReDoS (regular expression denial of service) vulnerability.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-66414", ecosystem: "npm", package: "@modelcontextprotocol/sdk", severity: "high",
+    ranges: [{ maxExclusive: "1.24.0" }],
+    summary: "DNS rebinding protection not enabled by default on localhost-bound SSE/StreamableHTTP servers.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53110", ecosystem: "npm", package: "@modelcontextprotocol/server-filesystem", severity: "high",
+    ranges: [{ maxInclusive: "0.6.2" }, { min: "2025.1.14", maxExclusive: "2025.7.1" }],
+    summary: "Path validation bypass via a colliding path prefix.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53109", ecosystem: "npm", package: "@modelcontextprotocol/server-filesystem", severity: "high",
+    ranges: [{ maxInclusive: "0.6.2" }, { min: "2025.1.14", maxExclusive: "2025.7.1" }],
+    summary: "Path validation bypass via prefix matching and symlink handling.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+
+  // ---- pip ----
+  {
+    id: "CVE-2026-59950", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ maxExclusive: "1.28.1" }],
+    summary: "MCP Python SDK: WebSocket server transport does not support Host/Origin validation.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-52869", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ maxInclusive: "1.27.1" }],
+    summary: "MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-52870", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ min: "1.23.0", maxInclusive: "1.27.1" }],
+    summary: "Experimental task handlers allow any client to access and cancel other clients' tasks.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-66416", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ maxExclusive: "1.23.0" }],
+    summary: "DNS rebinding protection not enabled by default on localhost-bound SSE/StreamableHTTP servers.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53366", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ maxExclusive: "1.9.4" }],
+    summary: "FastMCP Server validation error leading to denial of service.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53365", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ maxExclusive: "1.10.0" }],
+    summary: "Unhandled exception in the Streamable HTTP transport, leading to denial of service.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-27735", ecosystem: "pip", package: "mcp-server-git", severity: "medium",
+    ranges: [{ maxExclusive: "2026.1.14" }],
+    summary: "Path traversal in git_add allows staging files outside the repository boundary.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-68145", ecosystem: "pip", package: "mcp-server-git", severity: "medium",
+    ranges: [{ maxExclusive: "2025.12.18" }],
+    summary: "Missing path validation when using the --repository flag.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-68144", ecosystem: "pip", package: "mcp-server-git", severity: "medium",
+    ranges: [{ maxExclusive: "2025.12.18" }],
+    summary: "Argument injection in git_diff and git_checkout allows overwriting local files.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-68143", ecosystem: "pip", package: "mcp-server-git", severity: "medium",
+    ranges: [{ maxExclusive: "2025.9.25" }],
+    summary: "Unrestricted git_init tool allows repository creation at arbitrary filesystem locations.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+];
+
+/**
+ * Parse a version string's leading major.minor.patch numeric triple.
+ * Returns null for anything this simple comparator can't handle (a
+ * prerelease/build-metadata suffix, a git-hash pseudo-version, a bare "1"
+ * or "1.2" with no patch component) -- the caller must treat null as
+ * "cannot determine," never as a match or a clean bill of health.
+ */
+function parseVersion(v) {
+  // `String(v)` itself can throw -- an object whose own `toString` property
+  // is present but not a function (e.g. `{ toString: "" }`, a real shape
+  // fast-check's property fuzzing found, not a hypothetical) fails the
+  // ToPrimitive coercion with "Cannot convert object to primitive value"
+  // before the regex ever runs. `v` here can be anything an attacker-
+  // controlled MCP config's `args` array contains, so this must degrade to
+  // "unparseable" the same as any other malformed input, never throw.
+  let s;
+  try { s = String(v).trim(); } catch { return null; }
+  const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(s);
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+
+/** -1 / 0 / 1, comparing two parseVersion() triples component-by-component. */
+function compareVersions(a, b) {
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] - b[i];
+  }
+  return 0;
+}
+
+function inOneRange(parsed, range) {
+  if (range.min) {
+    const min = parseVersion(range.min);
+    if (min && compareVersions(parsed, min) < 0) return false;
+  }
+  if (range.maxInclusive) {
+    const max = parseVersion(range.maxInclusive);
+    if (max && compareVersions(parsed, max) > 0) return false;
+  }
+  if (range.maxExclusive) {
+    const max = parseVersion(range.maxExclusive);
+    if (max && compareVersions(parsed, max) >= 0) return false;
+  }
+  return true;
+}
+
+/**
+ * Check one resolved `packageName`@`version` pair (ecosystem "npm" or
+ * "pip") against CVE_DATABASE. Returns `{ checkable, matches }` --
+ * `checkable: false` means the version string couldn't be parsed at all
+ * (report "cannot determine," never silently clean); `matches` is every
+ * CVE_DATABASE entry whose package matches and whose vulnerable range
+ * (any one of its, possibly several, disjoint ranges) contains this
+ * version.
+ */
+function checkVersion(ecosystem, packageName, version) {
+  const parsed = parseVersion(version);
+  if (!parsed) return { checkable: false, matches: [] };
+  const matches = CVE_DATABASE.filter((entry) =>
+    entry.ecosystem === ecosystem &&
+    entry.package === packageName &&
+    entry.ranges.some((r) => inOneRange(parsed, r)));
+  return { checkable: true, matches };
+}
+
+module.exports = { CVE_DATABASE, parseVersion, compareVersions, checkVersion };

package/src/integrity.js

@@ -10,6 +10,7 @@ const os = require("os");
 // reference at import time and never see a later patch.
 const cp = require("child_process");
 const { PATTERNS, redact } = require("./patterns");
+const { checkVersion } = require("./cve");
 
 /**
  * Integrity checks for agent config directories.
@@ -386,6 +387,100 @@ function extractHooks(parsed) {
   return { hooks, unrecognized, hadHooksKey: true, truncated, sawLeaf };
 }
 
+// ── MCP server configuration risk checks ────────────────────────────────
+//
+// Distinct from agent-configs.js (which scans these same files' raw TEXT
+// for leaked secrets) and from injection.js (which scans transcript
+// CONTENT for injection payloads): this parses the STRUCTURED
+// `mcpServers` object every MCP client config converges on
+// (`{"mcpServers": {"<name>": {"command", "args", "env", "url"}}}` --
+// Claude Code, Claude Desktop, Cursor, and Visual Studio's own docs all
+// document this identical shape, already cited in agent-configs.js's own
+// header) and checks it for two named, real risk classes:
+//
+//   1. A known-vulnerable version of a specific MCP-ecosystem package
+//      pinned in the server's launch command (see cve.js).
+//   2. A remote (non-loopback) server configured over plain HTTP instead
+//      of HTTPS -- MCP protocol traffic, including tool definitions,
+//      crossing a real network in cleartext.
+//
+// NOT checked, disclosed rather than silently gapped (see injection.js's
+// own header for the fuller version of this point): a malicious server
+// changing a TOOL'S OWN DESCRIPTION after approval ("tool poisoning") --
+// a tool's description is protocol data returned by a live server at
+// request time, never present in a static config file, so there is
+// nothing here for a file-scanner to check it against.
+
+/**
+ * Extract the `mcpServers` object from a parsed config file. Every real
+ * MCP client this project has verified (Claude Code, Claude Desktop,
+ * Cursor, Visual Studio) uses this identical top-level shape. Anything
+ * else (the key absent, present but not an object) yields an empty
+ * object -- a config with no MCP servers configured is not an error.
+ */
+function extractMcpServers(parsed) {
+  if (!parsed || typeof parsed !== "object") return {};
+  const servers = parsed.mcpServers;
+  if (!servers || typeof servers !== "object" || Array.isArray(servers)) return {};
+  return servers;
+}
+
+// npm: optional @scope/, then a name, a literal @, then a version
+// starting with a digit. pip: a name, a literal ==, then a version
+// starting with a digit. Both anchored full-string (^...$) -- matched
+// against ONE argv element at a time, never a substring of a longer
+// string that happens to contain a coincidental match.
+const NPM_PKG_VERSION_RE = /^(@[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+|[a-zA-Z0-9._-]+)@(\d[\w.-]*)$/;
+const PIP_PKG_VERSION_RE = /^([a-zA-Z0-9._-]+)==(\d[\w.-]*)$/;
+
+/**
+ * Scan one MCP server's `args` array for a `package@version` (npm) or
+ * `package==version` (pip) argv element -- the documented invocation
+ * shape for `npx <pkg>@<version>` / `uvx <pkg>==<version>` / `pip install
+ * <pkg>==<version>`. An unpinned invocation (`npx mcp-remote` with no
+ * `@version`) yields nothing here on purpose: there's no version to
+ * check, and this deliberately does NOT treat "unpinned" itself as a
+ * finding -- that's a real, genuinely debatable trade-off (always
+ * getting the latest PATCHED release vs. exposure to a compromised
+ * "latest" publish), not a clear vulnerability the way a specific
+ * known-bad pinned version is.
+ */
+function extractPackageVersions(args) {
+  if (!Array.isArray(args)) return [];
+  const found = [];
+  for (const a of args) {
+    if (typeof a !== "string") continue;
+    const npm = NPM_PKG_VERSION_RE.exec(a);
+    if (npm) { found.push({ ecosystem: "npm", package: npm[1], version: npm[2] }); continue; }
+    const pip = PIP_PKG_VERSION_RE.exec(a);
+    if (pip) found.push({ ecosystem: "pip", package: pip[1], version: pip[2] });
+  }
+  return found;
+}
+
+// A well-known, widely-flagged supply-chain red flag: an installer script
+// fetched and piped directly into a shell, never saved or reviewed first.
+// Checked against the whole command+args joined, not `command` alone,
+// since the realistic shape is `command: "sh", args: ["-c", "curl ... |
+// bash"]` -- the risky text lives in `args`, not `command`.
+const CURL_PIPE_SHELL_RE = /\b(?:curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh)\b/i;
+
+/**
+ * True for a URL-transport MCP server (`url` field present) using plain
+ * HTTP to a non-loopback host. A loopback URL (localhost/127.0.0.1/::1)
+ * is excluded -- an ordinary local-dev MCP server, not the actual risk
+ * this names: MCP protocol traffic, including tool definitions, crossing
+ * a real network where it can be observed or altered in transit.
+ */
+function isInsecureRemoteUrl(url) {
+  if (typeof url !== "string") return false;
+  let parsed;
+  try { parsed = new URL(url); } catch { return false; }
+  if (parsed.protocol !== "http:") return false;
+  const host = parsed.hostname;
+  return host !== "localhost" && host !== "127.0.0.1" && host !== "::1" && host !== "[::1]";
+}
+
 // ── the checker ───────────────────────────────────────────────────────────
 
 /**
@@ -827,6 +922,66 @@ function checkIntegrity({ home = os.homedir(), cwd = process.cwd(), projectMode
     }
   }
 
+  // ---- 6. MCP server configuration risks ---------------------------------
+  // Home/machine-level configs (none of these are ever project-scoped by
+  // any vendor's own design, the same reasoning section 5 states) plus
+  // the two genuinely project-scoped MCP config locations, which use `cwd`
+  // unconditionally -- `cwd` already equals the project root in project
+  // mode (see this function's own docstring), so no separate branch is
+  // needed for them.
+  const mcpConfigFiles = [];
+  if (!projectMode) {
+    mcpConfigFiles.push(path.join(home, ".claude.json"));
+    const desktopConfig =
+      process.platform === "darwin" ? path.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") :
+      process.platform === "win32" ? path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json") :
+      null; // Linux: no official build, unofficial ports disagree -- see agent-configs.js's own header
+    if (desktopConfig) mcpConfigFiles.push(desktopConfig);
+    mcpConfigFiles.push(path.join(home, ".cursor", "mcp.json"));
+    mcpConfigFiles.push(path.join(home, ".kiro", "settings", "mcp.json"));
+    mcpConfigFiles.push(path.join(home, ".mcp.json"));
+  }
+  mcpConfigFiles.push(path.join(cwd, ".mcp.json"));
+  mcpConfigFiles.push(path.join(cwd, ".vs", "mcp.json"));
+
+  for (const file of mcpConfigFiles) {
+    const text = readOrReport(file);
+    if (text === null) continue;
+
+    let parsed;
+    try { parsed = JSON.parse(text); } catch {
+      add("warn", "unparseable-config", file, "exists in a known MCP config location but is not valid JSON; the client's own loader would also choke on it, so corruption or tampering is worth a look");
+      continue;
+    }
+
+    const servers = extractMcpServers(parsed);
+    for (const [name, def] of Object.entries(servers)) {
+      if (!def || typeof def !== "object") continue;
+      const label = safePreview(name, 60);
+
+      for (const { ecosystem, package: pkg, version } of extractPackageVersions(def.args)) {
+        const { checkable, matches } = checkVersion(ecosystem, pkg, version);
+        if (!checkable) continue; // a version string this comparator can't parse: unverified, not silently clean, but nothing more to say than that
+        for (const m of matches) {
+          add("warn", "mcp-known-cve", file,
+            `MCP server "${label}" pins ${pkg}@${version}, matching ${m.id} (${m.severity}): ${m.summary} Upgrade past the vulnerable range.`);
+        }
+      }
+
+      if (isInsecureRemoteUrl(def.url)) {
+        add("warn", "mcp-insecure-transport", file,
+          `MCP server "${label}" connects to ${safePreview(def.url, 80)} over plain HTTP -- protocol traffic, including tool definitions, can be observed or altered in transit. Use an HTTPS URL if the server supports one.`);
+      }
+
+      const commandLine = [def.command, ...(Array.isArray(def.args) ? def.args : [])]
+        .filter((x) => typeof x === "string").join(" ");
+      if (commandLine && CURL_PIPE_SHELL_RE.test(commandLine)) {
+        add("warn", "mcp-curl-pipe-shell", file,
+          `MCP server "${label}" launch command fetches a script and pipes it directly into a shell: "${safePreview(commandLine)}". Review and pin to a specific, reviewed version instead of trusting whatever the URL currently serves.`);
+      }
+    }
+  }
+
   return {
     findings,
     filesChecked,