slaunt 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -1
- package/dist/cli.js +14 -3
- package/dist/cli.js.map +1 -1
- package/dist/mcp/introspect.js +1 -1
- package/dist/tui/analysis-path.d.ts +14 -0
- package/dist/tui/analysis-path.d.ts.map +1 -0
- package/dist/tui/analysis-path.js +87 -0
- package/dist/tui/analysis-path.js.map +1 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -50,6 +50,9 @@ npx slaunt audit --json --no-report --no-install-slaunt --no-server-starts
|
|
|
50
50
|
|
|
51
51
|
# Deterministic product demonstration
|
|
52
52
|
npx slaunt audit --demo --no-open --no-install-slaunt
|
|
53
|
+
|
|
54
|
+
# Skip deliberate interactive pacing while keeping the full audit
|
|
55
|
+
npx slaunt audit --no-motion
|
|
53
56
|
```
|
|
54
57
|
|
|
55
58
|
Run `npx slaunt audit --help` for every option.
|
|
@@ -130,7 +133,9 @@ Database patterns are treated as bounded globs, never executable regular express
|
|
|
130
133
|
|
|
131
134
|
## Terminal experience and conversion ethics
|
|
132
135
|
|
|
133
|
-
The terminal flow uses immediate
|
|
136
|
+
The terminal flow uses immediate collection feedback followed by a short, deliberately paced analysis trail. It visibly indexes the retrieved tools, builds the client-to-capability graph, searches direct privilege paths, tests cross-server chains, ranks the resulting evidence, and only then reveals the report. Every completed line is derived from the actual audit result; the pacing never invents a server, tool, capability, or finding.
|
|
137
|
+
|
|
138
|
+
The trail runs only in an interactive terminal. JSON output, piped output, CI, `--yes`, `--no-motion`, and `SLAUNT_NO_MOTION=1` remain immediate. The experience deliberately avoids variable rewards, deceptive urgency, hidden defaults, shame, or an unsupported claim that a UI can medically “optimize dopamine.”
|
|
134
139
|
|
|
135
140
|
The design is informed by evidence that progress feedback can improve follow-through, autonomy-supportive framing is associated with more self-directed motivation, and risk messages work better when paired with an effective action. See the PubMed-indexed reviews on [progress feedback](https://pubmed.ncbi.nlm.nih.gov/33721605/), [autonomy support](https://pubmed.ncbi.nlm.nih.gov/30237648/), and [fear appeals with efficacy](https://pubmed.ncbi.nlm.nih.gov/26501228/). These findings come from other domains, so their application to developer security tooling is a product hypothesis, not a medical claim.
|
|
136
141
|
|
package/dist/cli.js
CHANGED
|
@@ -8,6 +8,7 @@ import { discoverConfigurations } from './config/discover.js';
|
|
|
8
8
|
import { installSlauntMcp } from './config/install.js';
|
|
9
9
|
import { isDynamicLauncher } from './mcp/introspect.js';
|
|
10
10
|
import { writeHtmlReport } from './report/html.js';
|
|
11
|
+
import { playAnalysisPath } from './tui/analysis-path.js';
|
|
11
12
|
import { renderAudit, renderHeader } from './tui/render.js';
|
|
12
13
|
const HELP = `Slaunt Agent Access Audit
|
|
13
14
|
|
|
@@ -24,6 +25,7 @@ Options:
|
|
|
24
25
|
--output <path> HTML report path
|
|
25
26
|
--no-report Do not write the local HTML report
|
|
26
27
|
--no-open Do not offer to open the HTML report
|
|
28
|
+
--no-motion Skip the paced interactive analysis trail
|
|
27
29
|
--timeout <ms> Per-server probe timeout (1000-60000; default 8000)
|
|
28
30
|
--json Print a machine-readable, redacted JSON result
|
|
29
31
|
--yes Accept safe interactive defaults for automation
|
|
@@ -43,7 +45,7 @@ function valueAfter(args, index, option) {
|
|
|
43
45
|
}
|
|
44
46
|
function parseArguments(args) {
|
|
45
47
|
const options = {
|
|
46
|
-
customPaths: [], demo: false, json: false, offline: false, noOpen: false, noReport: false, yes: false,
|
|
48
|
+
customPaths: [], demo: false, json: false, offline: false, noOpen: false, noMotion: false, noReport: false, yes: false,
|
|
47
49
|
};
|
|
48
50
|
for (let index = 0; index < args.length; index += 1) {
|
|
49
51
|
const argument = args[index];
|
|
@@ -57,6 +59,8 @@ function parseArguments(args) {
|
|
|
57
59
|
options.offline = true;
|
|
58
60
|
else if (argument === '--no-open')
|
|
59
61
|
options.noOpen = true;
|
|
62
|
+
else if (argument === '--no-motion')
|
|
63
|
+
options.noMotion = true;
|
|
60
64
|
else if (argument === '--no-report')
|
|
61
65
|
options.noReport = true;
|
|
62
66
|
else if (argument === '--yes' || argument === '-y')
|
|
@@ -84,7 +88,7 @@ function parseArguments(args) {
|
|
|
84
88
|
process.exit(0);
|
|
85
89
|
}
|
|
86
90
|
else if (argument === '--version' || argument === '-v') {
|
|
87
|
-
process.stdout.write('0.1.
|
|
91
|
+
process.stdout.write('0.1.1\n');
|
|
88
92
|
process.exit(0);
|
|
89
93
|
}
|
|
90
94
|
else if (argument === 'connect') {
|
|
@@ -121,6 +125,11 @@ async function main() {
|
|
|
121
125
|
}
|
|
122
126
|
const options = parseArguments(rawArgs);
|
|
123
127
|
const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY && !options.json);
|
|
128
|
+
const motionEnabled = interactive
|
|
129
|
+
&& !options.noMotion
|
|
130
|
+
&& !options.yes
|
|
131
|
+
&& !process.env.CI
|
|
132
|
+
&& process.env.SLAUNT_NO_MOTION !== '1';
|
|
124
133
|
if (!options.json)
|
|
125
134
|
process.stdout.write(`${renderHeader()}\n\n${chalk.gray('Tool and configuration data stays on this machine. No audit payload uploaded.')}\n\n`);
|
|
126
135
|
let discovery = options.demo ? undefined : await discoverConfigurations({
|
|
@@ -161,7 +170,9 @@ async function main() {
|
|
|
161
170
|
onStage: (_stage, detail) => { if (spinner)
|
|
162
171
|
spinner.text = detail; },
|
|
163
172
|
});
|
|
164
|
-
spinner?.succeed('
|
|
173
|
+
spinner?.succeed('Evidence collected');
|
|
174
|
+
if (motionEnabled)
|
|
175
|
+
await playAnalysisPath(result);
|
|
165
176
|
if (!options.noReport) {
|
|
166
177
|
const reportPath = await writeHtmlReport(result, options.output);
|
|
167
178
|
result.reportPath = reportPath;
|
package/dist/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAiB5D,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BZ,CAAC;AAEF,SAAS,UAAU,CAAC,IAAc,EAAE,KAAa,EAAE,MAAc;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,mBAAmB,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,IAAc;IACpC,MAAM,OAAO,GAAe;QAC1B,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK;KACvH,CAAC;IACF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,OAAO;YAAE,SAAS;QACnC,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;aAC1C,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;aAC/C,IAAI,QAAQ,KAAK,WAAW;YAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;aACrD,IAAI,QAAQ,KAAK,WAAW;YAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;aACpD,IAAI,QAAQ,KAAK,aAAa;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;aACxD,IAAI,QAAQ,KAAK,aAAa;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;aACxD,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;aAClE,IAAI,QAAQ,KAAK,kBAAkB;YAAE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;aAClE,IAAI,QAAQ,KAAK,qBAAqB;YAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;aACtE,IAAI,QAAQ,KAAK,uBAAuB;YAAE,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;aAC3E,IAAI,QAAQ,KAAK,oBAAoB;YAAE,OAAO,CAAC,iBAAiB,GAAG,KAAK,CAAC;aACzE,IAAI,QAAQ,KAAK,UAAU;YAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;aAC3F,IAAI,QAAQ,KAAK,UAAU;YAAE,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;aAClF,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,IAAI,KAAK,GAAG,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACpI,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;QAC5B,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAwB;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACvH,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACxI,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,KAAK,IAAI,CAAC,CAAC;QAC1F,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,KAAK,KAAK,MAAM,CAAC,OAAO,IAAI,eAAe,IAAI,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9F,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACrH,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,WAAW;WAC5B,CAAC,OAAO,CAAC,QAAQ;WACjB,CAAC,OAAO,CAAC,GAAG;WACZ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;WACf,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,GAAG,CAAC;IAE1C,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,EAAE,OAAO,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,MAAM,CAAC,CAAC;IAEnK,IAAI,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC;QACtE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAChH,MAAM,oBAAoB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC;IAC1K,IAAI,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,WAAW,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3G,aAAa,GAAG,MAAM,OAAO,CAAC;YAC5B,OAAO,EAAE,qBAAqB,oBAAoB,CAAC,MAAM,iCAAiC,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,8BAA8B;YACpK,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,IAAI,aAAa,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,oBAAkC,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAChD,SAAS,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/F,IAAI,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,IAAI,WAAW,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvG,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;QACnE,iBAAiB,GAAG,MAAM,OAAO,CAAC;YAChC,OAAO,EAAE,SAAS,YAAY,CAAC,MAAM,+BAA+B,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,gDAAgD,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,mCAAmC,CAAC,CAAC,CAAC,EAAE,EAAE;YACjO,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACpH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;QAC5B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,CAAC;QAC7C,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;KACrE,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvC,IAAI,aAAa;QAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;IAE7G,IAAI,WAAW,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC;IAC1E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
|
package/dist/mcp/introspect.js
CHANGED
|
@@ -50,7 +50,7 @@ async function listAllTools(client, server) {
|
|
|
50
50
|
return tools;
|
|
51
51
|
}
|
|
52
52
|
async function connectAndList(server, transport) {
|
|
53
|
-
const client = new Client({ name: 'slaunt-audit', version: '0.1.
|
|
53
|
+
const client = new Client({ name: 'slaunt-audit', version: '0.1.1' }, { capabilities: {} });
|
|
54
54
|
try {
|
|
55
55
|
// The SDK's transport classes declare `sessionId?: string` while its shared
|
|
56
56
|
// Transport interface is emitted without exact-optional compatibility.
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
import type { AuditResult } from '../types.js';
|
|
2
|
+
export type AnalysisBeatTone = 'success' | 'warning';
|
|
3
|
+
export interface AnalysisBeat {
|
|
4
|
+
active: string;
|
|
5
|
+
complete: string;
|
|
6
|
+
delayMs: number;
|
|
7
|
+
tone: AnalysisBeatTone;
|
|
8
|
+
}
|
|
9
|
+
export interface PlayAnalysisPathOptions {
|
|
10
|
+
sleep?: (milliseconds: number) => Promise<void>;
|
|
11
|
+
}
|
|
12
|
+
export declare function buildAnalysisPath(result: AuditResult): AnalysisBeat[];
|
|
13
|
+
export declare function playAnalysisPath(result: AuditResult, options?: PlayAnalysisPathOptions): Promise<void>;
|
|
14
|
+
//# sourceMappingURL=analysis-path.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"analysis-path.d.ts","sourceRoot":"","sources":["../../src/tui/analysis-path.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,CAAC;AAErD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAUD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,EAAE,CA8DrE;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAiBf"}
|
|
@@ -0,0 +1,87 @@
|
|
|
1
|
+
import chalk from 'chalk';
|
|
2
|
+
import ora from 'ora';
|
|
3
|
+
const wait = (milliseconds) => new Promise((resolve) => {
|
|
4
|
+
setTimeout(resolve, milliseconds);
|
|
5
|
+
});
|
|
6
|
+
function plural(value, singular, pluralForm = `${singular}s`) {
|
|
7
|
+
return value === 1 ? singular : pluralForm;
|
|
8
|
+
}
|
|
9
|
+
export function buildAnalysisPath(result) {
|
|
10
|
+
const { summary } = result;
|
|
11
|
+
const criticalPaths = result.findings.filter((finding) => finding.severity === 'critical').length;
|
|
12
|
+
const crossServerChains = result.findings.filter((finding) => (finding.serverNames.length > 1 && /chain/i.test(`${finding.title} ${finding.why}`))).length;
|
|
13
|
+
const sharedPermissionFindings = result.findings.filter((finding) => finding.clients.length > 1).length;
|
|
14
|
+
return [
|
|
15
|
+
{
|
|
16
|
+
active: `Indexing ${summary.tools} declared tools across detected clients`,
|
|
17
|
+
complete: `Indexed ${summary.tools} ${plural(summary.tools, 'tool')} from ${summary.servers} MCP ${plural(summary.servers, 'server')}`,
|
|
18
|
+
delayMs: 360,
|
|
19
|
+
tone: 'success',
|
|
20
|
+
},
|
|
21
|
+
{
|
|
22
|
+
active: 'Building the client → server → capability graph',
|
|
23
|
+
complete: `Mapped ${summary.sensitiveCapabilities} sensitive ${plural(summary.sensitiveCapabilities, 'capability', 'capabilities')} across ${summary.clientsDetected} ${plural(summary.clientsDetected, 'client')}`,
|
|
24
|
+
delayMs: 440,
|
|
25
|
+
tone: 'success',
|
|
26
|
+
},
|
|
27
|
+
{
|
|
28
|
+
active: 'Searching for direct production-changing access',
|
|
29
|
+
complete: criticalPaths > 0
|
|
30
|
+
? `${criticalPaths} critical direct-access ${plural(criticalPaths, 'path')} found`
|
|
31
|
+
: 'No critical direct-access paths found',
|
|
32
|
+
delayMs: 540,
|
|
33
|
+
tone: criticalPaths > 0 ? 'warning' : 'success',
|
|
34
|
+
},
|
|
35
|
+
{
|
|
36
|
+
active: 'Testing whether permissions can be chained across servers',
|
|
37
|
+
complete: crossServerChains > 0
|
|
38
|
+
? `${crossServerChains} cross-server capability ${plural(crossServerChains, 'chain')} found`
|
|
39
|
+
: 'No cross-server capability chains found',
|
|
40
|
+
delayMs: 620,
|
|
41
|
+
tone: crossServerChains > 0 ? 'warning' : 'success',
|
|
42
|
+
},
|
|
43
|
+
{
|
|
44
|
+
active: 'Comparing permission overlap between agent clients',
|
|
45
|
+
complete: sharedPermissionFindings > 0
|
|
46
|
+
? `Permission overlap contributes to ${sharedPermissionFindings} ${plural(sharedPermissionFindings, 'finding')}`
|
|
47
|
+
: 'No risky permission overlap found',
|
|
48
|
+
delayMs: 460,
|
|
49
|
+
tone: sharedPermissionFindings > 0 ? 'warning' : 'success',
|
|
50
|
+
},
|
|
51
|
+
{
|
|
52
|
+
active: 'Checking classification confidence and unknown tools',
|
|
53
|
+
complete: summary.unclassified > 0
|
|
54
|
+
? `${summary.unclassified} ${plural(summary.unclassified, 'tool')} need human classification`
|
|
55
|
+
: 'Every retrieved tool has a recognized classification',
|
|
56
|
+
delayMs: 400,
|
|
57
|
+
tone: summary.unclassified > 0 ? 'warning' : 'success',
|
|
58
|
+
},
|
|
59
|
+
{
|
|
60
|
+
active: 'Ranking evidence by exploitability and blast radius',
|
|
61
|
+
complete: summary.highRiskFindings > 0
|
|
62
|
+
? `${summary.highRiskFindings} high-risk ${plural(summary.highRiskFindings, 'finding')} prioritized for review`
|
|
63
|
+
: 'No high-risk findings to prioritize',
|
|
64
|
+
delayMs: 500,
|
|
65
|
+
tone: summary.highRiskFindings > 0 ? 'warning' : 'success',
|
|
66
|
+
},
|
|
67
|
+
];
|
|
68
|
+
}
|
|
69
|
+
export async function playAnalysisPath(result, options = {}) {
|
|
70
|
+
const sleep = options.sleep || wait;
|
|
71
|
+
process.stdout.write(`\n${chalk.bold('Tracing exposure paths')}\n`);
|
|
72
|
+
for (const beat of buildAnalysisPath(result)) {
|
|
73
|
+
const spinner = ora({
|
|
74
|
+
color: 'magenta',
|
|
75
|
+
spinner: 'dots12',
|
|
76
|
+
text: beat.active,
|
|
77
|
+
}).start();
|
|
78
|
+
await sleep(beat.delayMs);
|
|
79
|
+
if (beat.tone === 'warning')
|
|
80
|
+
spinner.warn(beat.complete);
|
|
81
|
+
else
|
|
82
|
+
spinner.succeed(beat.complete);
|
|
83
|
+
}
|
|
84
|
+
process.stdout.write(`${chalk.gray('Evidence graph complete. Preparing the risk map…')}\n`);
|
|
85
|
+
await sleep(220);
|
|
86
|
+
}
|
|
87
|
+
//# sourceMappingURL=analysis-path.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"analysis-path.js","sourceRoot":"","sources":["../../src/tui/analysis-path.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AAgBtB,MAAM,IAAI,GAAG,CAAC,YAAoB,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IAC5E,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,SAAS,MAAM,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAU,GAAG,GAAG,QAAQ,GAAG;IAC1E,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAClG,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAC5D,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CACnF,CAAC,CAAC,MAAM,CAAC;IACV,MAAM,wBAAwB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAExG,OAAO;QACL;YACE,MAAM,EAAE,YAAY,OAAO,CAAC,KAAK,yCAAyC;YAC1E,QAAQ,EAAE,WAAW,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,OAAO,CAAC,OAAO,QAAQ,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;YACtI,OAAO,EAAE,GAAG;YACZ,IAAI,EAAE,SAAS;SAChB;QACD;YACE,MAAM,EAAE,iDAAiD;YACzD,QAAQ,EAAE,UAAU,OAAO,CAAC,qBAAqB,cAAc,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,YAAY,EAAE,cAAc,CAAC,WAAW,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE;YACnN,OAAO,EAAE,GAAG;YACZ,IAAI,EAAE,SAAS;SAChB;QACD;YACE,MAAM,EAAE,iDAAiD;YACzD,QAAQ,EAAE,aAAa,GAAG,CAAC;gBACzB,CAAC,CAAC,GAAG,aAAa,2BAA2B,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ;gBAClF,CAAC,CAAC,uCAAuC;YAC3C,OAAO,EAAE,GAAG;YACZ,IAAI,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SAChD;QACD;YACE,MAAM,EAAE,2DAA2D;YACnE,QAAQ,EAAE,iBAAiB,GAAG,CAAC;gBAC7B,CAAC,CAAC,GAAG,iBAAiB,4BAA4B,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,QAAQ;gBAC5F,CAAC,CAAC,yCAAyC;YAC7C,OAAO,EAAE,GAAG;YACZ,IAAI,EAAE,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACpD;QACD;YACE,MAAM,EAAE,oDAAoD;YAC5D,QAAQ,EAAE,wBAAwB,GAAG,CAAC;gBACpC,CAAC,CAAC,qCAAqC,wBAAwB,IAAI,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,EAAE;gBAChH,CAAC,CAAC,mCAAmC;YACvC,OAAO,EAAE,GAAG;YACZ,IAAI,EAAE,wBAAwB,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SAC3D;QACD;YACE,MAAM,EAAE,sDAAsD;YAC9D,QAAQ,EAAE,OAAO,CAAC,YAAY,GAAG,CAAC;gBAChC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,4BAA4B;gBAC7F,CAAC,CAAC,sDAAsD;YAC1D,OAAO,EAAE,GAAG;YACZ,IAAI,EAAE,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACvD;QACD;YACE,MAAM,EAAE,qDAAqD;YAC7D,QAAQ,EAAE,OAAO,CAAC,gBAAgB,GAAG,CAAC;gBACpC,CAAC,CAAC,GAAG,OAAO,CAAC,gBAAgB,cAAc,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,SAAS,CAAC,yBAAyB;gBAC/G,CAAC,CAAC,qCAAqC;YACzC,OAAO,EAAE,GAAG;YACZ,IAAI,EAAE,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SAC3D;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAmB,EACnB,OAAO,GAA4B,EAAE;IAErC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAEpE,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,GAAG,CAAC;YAClB,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,IAAI,CAAC,MAAM;SAClB,CAAC,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;YACpD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,IAAI,CAAC,CAAC;IAC5F,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC"}
|