ghostrules 0.1.0__py3-none-any.whl

ghostrules/reporters/sarif.py

@@ -0,0 +1,137 @@
+"""SARIF 2.1.0 report (GitHub code scanning)."""
+
+from __future__ import annotations
+
+import json
+import re
+from typing import Any
+from urllib.parse import quote
+
+from ghostrules import PROJECT_URL, __version__
+from ghostrules.models import Finding, ScanResult, Severity
+from ghostrules.reporters.common import safe
+from ghostrules.rules.registry import Rule, all_rules
+
+SCHEMA_URL = "https://json.schemastore.org/sarif-2.1.0.json"
+_LEVEL = {
+    Severity.CRITICAL: "error",
+    Severity.HIGH: "error",
+    Severity.MEDIUM: "warning",
+    Severity.LOW: "note",
+    Severity.INFO: "note",
+}
+_SECURITY_SEVERITY = {
+    Severity.CRITICAL: "9.5",
+    Severity.HIGH: "8.0",
+    Severity.MEDIUM: "5.5",
+    Severity.LOW: "3.0",
+    Severity.INFO: "1.0",
+}
+_NOT_REPO_RELATIVE = re.compile(r"^(?:~|/|[A-Za-z]:[\\/])")
+
+
+def is_repo_relative(path: str) -> bool:
+    """False for user-level files (``~/...``) and absolute paths, which SARIF cannot place."""
+    return _NOT_REPO_RELATIVE.match(path) is None
+
+
+def _rule_entry(rule: Rule) -> dict[str, Any]:
+    return {
+        "id": rule.id,
+        "name": rule.title,
+        "shortDescription": {"text": rule.title},
+        "fullDescription": {"text": rule.description},
+        "helpUri": f"{PROJECT_URL}#{rule.id.lower()}",
+        "defaultConfiguration": {"level": _LEVEL[rule.severity]},
+        "properties": {
+            "security-severity": _SECURITY_SEVERITY[rule.severity],
+            "tags": ["security", "ai-agents"],
+        },
+    }
+
+
+def _result(finding: Finding, rule_index: dict[str, int]) -> dict[str, Any]:
+    region: dict[str, Any] = {
+        "startLine": finding.line,
+        "startColumn": finding.column,
+        "endLine": finding.line,
+        "endColumn": max(finding.end_column, finding.column),
+        "snippet": {"text": safe(finding.snippet)},
+    }
+    properties: dict[str, Any] = {"security-severity": _SECURITY_SEVERITY[finding.severity]}
+    if finding.decoded:
+        properties["decodedHiddenText"] = safe(finding.decoded)
+    if finding.fix_hint:
+        properties["fixHint"] = safe(finding.fix_hint)
+    result: dict[str, Any] = {
+        "ruleId": finding.rule_id,
+        "level": _LEVEL[finding.severity],
+        "message": {"text": safe(f"{finding.title}: {finding.message}")},
+        "locations": [
+            {
+                "physicalLocation": {
+                    "artifactLocation": {
+                        "uri": quote(safe(finding.path), safe="/"),
+                        "uriBaseId": "%SRCROOT%",
+                    },
+                    "region": region,
+                }
+            }
+        ],
+        "properties": properties,
+    }
+    if finding.rule_id in rule_index:
+        result["ruleIndex"] = rule_index[finding.rule_id]
+    return result
+
+
+def to_dict(result: ScanResult) -> dict[str, Any]:
+    """The SARIF log as plain data. Findings in user-level files are left out (and counted)."""
+    rules = all_rules()
+    rule_index = {r.id: i for i, r in enumerate(rules)}
+    reportable = [f for f in result.findings if is_repo_relative(f.path)]
+    skipped = len(result.findings) - len(reportable)
+    notifications = [
+        {"level": "warning", "message": {"text": safe(w)}} for w in result.warnings
+    ] + [{"level": "error", "message": {"text": safe(e)}} for e in result.errors]
+    if skipped:
+        notifications.append(
+            {
+                "level": "note",
+                "message": {
+                    "text": f"{skipped} finding(s) in files outside the repository (--home) "
+                    "are not included in SARIF."
+                },
+            }
+        )
+    return {
+        "$schema": SCHEMA_URL,
+        "version": "2.1.0",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "ghostrules",
+                        "version": __version__,
+                        "semanticVersion": __version__,
+                        "informationUri": PROJECT_URL,
+                        "rules": [_rule_entry(r) for r in rules],
+                    }
+                },
+                "columnKind": "unicodeCodePoints",
+                "originalUriBaseIds": {"%SRCROOT%": {"uri": "file:///"}},
+                "results": [_result(f, rule_index) for f in reportable],
+                "invocations": [
+                    {
+                        "executionSuccessful": not result.errors,
+                        "toolExecutionNotifications": notifications,
+                    }
+                ],
+            }
+        ],
+    }
+
+
+def render(result: ScanResult, **_options: Any) -> str:
+    """Render the SARIF 2.1.0 log."""
+    return json.dumps(to_dict(result), indent=2, ensure_ascii=False) + "\n"

ghostrules/reporters/table.py

@@ -0,0 +1,235 @@
+"""Rich terminal report: findings grouped by file, with the hidden text front and centre."""
+
+from __future__ import annotations
+
+import io
+import re
+from typing import IO
+
+from rich import box
+from rich.console import Console, ConsoleOptions, Group, RenderableType, RenderResult
+from rich.padding import Padding
+from rich.panel import Panel
+from rich.rule import Rule
+from rich.table import Table
+from rich.text import Text
+
+from ghostrules import __version__
+from ghostrules.models import Finding, ScanResult, Severity
+from ghostrules.reporters.common import (
+    SEVERITY_ORDER,
+    FileGroup,
+    config_notes,
+    group_by_file,
+    safe,
+    severity_counts,
+)
+from ghostrules.rules.patterns import COLLECTOR_PATTERNS, EXFIL_PATTERNS, INJECTION_PATTERNS
+
+BADGE_STYLE = {
+    Severity.CRITICAL: "bold white on red3",
+    Severity.HIGH: "bold black on dark_orange",
+    Severity.MEDIUM: "bold black on yellow",
+    Severity.LOW: "bold white on dodger_blue2",
+    Severity.INFO: "bold white on grey42",
+}
+TEXT_STYLE = {
+    Severity.CRITICAL: "bold red",
+    Severity.HIGH: "bold dark_orange",
+    Severity.MEDIUM: "bold yellow",
+    Severity.LOW: "bold dodger_blue1",
+    Severity.INFO: "bold grey62",
+}
+_TOKEN_RE = re.compile(r"⟦[^⟧]*⟧")
+_URL_RE = re.compile(r"https?://[^\s)\]>\"']+")
+_TOKEN_STYLE = "bold bright_red"
+_DECODED_STYLE = "bold bright_yellow"
+_MATCH_STYLE = "bold white on red3"
+_MAX_WIDTH = 120
+
+
+def styled_snippet(snippet: str) -> Text:
+    """The snippet with every ``⟦U+XXXX⟧`` token highlighted, so invisible characters stand out."""
+    text = Text(safe(snippet), no_wrap=False)
+    for match in _TOKEN_RE.finditer(text.plain):
+        text.stylize(_TOKEN_STYLE, match.start(), match.end())
+    return text
+
+
+def styled_decoded(decoded: str) -> Text:
+    """Hidden text with the phrases that look malicious (and URLs) highlighted."""
+    text = Text(safe(decoded), style=_DECODED_STYLE)
+    plain = text.plain
+    patterns = [p for group in INJECTION_PATTERNS.values() for p in group]
+    for pattern in (*patterns, *EXFIL_PATTERNS, *COLLECTOR_PATTERNS):
+        for match in pattern.finditer(plain):
+            text.stylize(_MATCH_STYLE, match.start(), match.end())
+    for match in _URL_RE.finditer(plain):
+        text.stylize("underline", match.start(), match.end())
+    return text
+
+
+def _badge(severity: Severity) -> Text:
+    return Text(f" {severity.label.upper():^8} ", style=BADGE_STYLE[severity])
+
+
+class _Head:
+    """The first line of a finding: badge, rule id, title and ``path:line:col``.
+
+    On one row when it fits. On narrow terminals or with long paths the location moves to a
+    second line instead of squeezing the title into a few characters.
+    """
+
+    def __init__(self, finding: Finding) -> None:
+        self.badge = _badge(finding.severity)
+        self.rule_id = Text(finding.rule_id, style="bold")
+        self.title = Text(safe(finding.title), style="bold")
+        self.location = Text(
+            safe(f"{finding.path}:{finding.line}:{finding.column}"), style="dim", no_wrap=True
+        )
+
+    def __rich_console__(self, console: Console, options: ConsoleOptions) -> RenderResult:
+        needed = (
+            self.badge.cell_len
+            + self.rule_id.cell_len
+            + self.title.cell_len
+            + self.location.cell_len
+            + 4
+        )
+        grid = Table.grid(expand=True, padding=(0, 1))
+        grid.add_column(no_wrap=True)
+        grid.add_column(no_wrap=True)
+        grid.add_column(ratio=1)
+        if needed <= options.max_width:
+            grid.add_column(no_wrap=True, justify="right")
+            grid.add_row(self.badge, self.rule_id, self.title, self.location)
+            yield grid
+            return
+        grid.add_row(self.badge, self.rule_id, self.title)
+        yield grid
+        indent = self.badge.cell_len + 1
+        yield Padding(Text.assemble(("at ", "dim"), self.location), (0, 0, 0, indent))
+
+
+def _finding_block(finding: Finding, repeated_hidden_text: bool) -> RenderableType:
+    """One finding. When it was found inside hidden text already shown above, stay compact."""
+    parts: list[RenderableType] = [_Head(finding)]
+    body: list[RenderableType] = []
+    if repeated_hidden_text:
+        body.append(Text.assemble(("↳ ", "dim"), safe(finding.message)))
+    else:
+        gutter = Text(f"{finding.line:>4} │ ", style="dim")
+        body.append(
+            Text.assemble(
+                gutter, styled_snippet(finding.snippet), no_wrap=True, overflow="ellipsis"
+            )
+        )
+        if finding.decoded:
+            body.append(
+                Panel(
+                    styled_decoded(finding.decoded),
+                    title="Decoded hidden text",
+                    title_align="left",
+                    border_style="red",
+                    box=box.ROUNDED,
+                    padding=(0, 1),
+                )
+            )
+        body.append(Text(safe(finding.message)))
+    if finding.fix_hint:
+        body.append(Text.assemble(("fix  ", "green"), (safe(finding.fix_hint), "dim")))
+    parts.append(Padding(Group(*body), (0, 0, 0, 2)))
+    parts.append(Text(""))
+    return Group(*parts)
+
+
+def _file_block(group: FileGroup) -> RenderableType:
+    count = len(group.findings)
+    title = Text.assemble(
+        (safe(group.path), "bold cyan"),
+        (f"  {count} finding{'s' if count != 1 else ''}", "dim"),
+    )
+    shown_hidden: set[tuple[int, int, str]] = set()
+    blocks: list[RenderableType] = [Rule(title, align="left", style="grey37", characters="─")]
+    for finding in group.findings:
+        key = (finding.line, finding.column, finding.decoded or "")
+        repeated = bool(finding.decoded) and key in shown_hidden
+        if finding.decoded:
+            shown_hidden.add(key)
+        blocks.append(_finding_block(finding, repeated))
+    return Group(*blocks)
+
+
+def _summary(result: ScanResult) -> RenderableType:
+    if not result.findings and result.errors:
+        return Text.assemble(
+            ("✖ Scan incomplete", "bold red"), (f"  (scanned {result.scanned_files} files)", "dim")
+        )
+    if not result.findings:
+        return Text.assemble(
+            ("✔ No findings", "bold green"), (f"  (scanned {result.scanned_files} files)", "dim")
+        )
+    counts = severity_counts(result.findings)
+    line = Text()
+    for i, severity in enumerate(s for s in SEVERITY_ORDER if s.label in counts):
+        if i:
+            line.append(" · ", style="dim")
+        line.append(f"{counts[severity.label]} {severity.label}", style=TEXT_STYLE[severity])
+    files = len({f.path for f in result.findings})
+    line.append(
+        f" in {files} file{'s' if files != 1 else ''} (scanned {result.scanned_files})", style="dim"
+    )
+    return line
+
+
+def build(result: ScanResult, *, target: str | None = None) -> RenderableType:
+    """Assemble the whole report as a rich renderable."""
+    header = Text.assemble(("◆ ghostrules", "bold"), (f" v{__version__}", "dim"))
+    if target:
+        header.append(f"  scanning {target}", style="dim")
+    parts: list[RenderableType] = [header, Text("")]
+    parts.extend(_file_block(group) for group in group_by_file(result.findings))
+    parts.append(Rule(style="grey37", characters="─"))
+    parts.append(_summary(result))
+    for note in config_notes(result):
+        parts.append(Text.assemble(("note: ", "bold yellow"), (note, "yellow")))
+    for warning in result.warnings:
+        parts.append(Text.assemble(("warning: ", "bold yellow"), safe(warning)))
+    for error in result.errors:
+        parts.append(Text.assemble(("error: ", "bold red"), safe(error)))
+    return Group(*parts)
+
+
+def make_console(
+    *, color: bool | None = None, width: int | None = None, file: IO[str] | None = None
+) -> Console:
+    """Console used for reports: no emoji/markup surprises, bounded width.
+
+    ``color=None`` follows the terminal (and ``NO_COLOR``), ``False`` never emits escape codes,
+    ``True`` always does (used when rendering to a string).
+    """
+    options: dict[str, object] = {
+        "file": file,
+        "width": width,
+        "highlight": False,
+        "emoji": False,
+        "legacy_windows": False,
+    }
+    if color is False:
+        options["color_system"] = None
+    elif color is True:
+        options.update(color_system="truecolor", force_terminal=True)
+    console = Console(**options)  # type: ignore[arg-type]
+    if width is None and console.width > _MAX_WIDTH:
+        console.width = _MAX_WIDTH
+    return console
+
+
+def render(
+    result: ScanResult, *, color: bool = False, width: int = 100, target: str | None = None
+) -> str:
+    """Render the table report to a string (plain text unless ``color``)."""
+    buffer = io.StringIO()
+    console = make_console(color=color, width=width, file=buffer)
+    console.print(build(result, target=target))
+    return buffer.getvalue()

ghostrules/reveal.py

@@ -0,0 +1,90 @@
+"""``ghostrules reveal``: show a file with its invisible characters made visible."""
+
+from __future__ import annotations
+
+import re
+
+from rich.console import Group, RenderableType
+from rich.padding import Padding
+from rich.text import Text
+
+from ghostrules.reporters.common import safe
+from ghostrules.reporters.table import styled_decoded
+from ghostrules.secrets import mask_secrets
+from ghostrules.unicode_utils import (
+    TAG,
+    VARIATION_SELECTOR,
+    classify,
+    decode_tags,
+    decode_variation_selectors,
+    find_runs,
+    render_char,
+)
+
+_COMMENT_RE = re.compile(r"<!--.*?(?:-->|\Z)", re.DOTALL)
+_TOKEN_STYLE = "bold white on red3"
+_COMMENT_STYLE = "black on yellow"
+_VS_MIN_RUN = 3
+
+
+def _is_invisible(ch: str) -> bool:
+    return classify(ch) is not None or ch == "\u00ad"
+
+
+def _comment_offsets(text: str) -> set[int]:
+    inside: set[int] = set()
+    for match in _COMMENT_RE.finditer(text):
+        inside.update(range(match.start(), match.end()))
+    return inside
+
+
+def _line_text(line: str, base: int, comments: set[int]) -> Text:
+    out = Text()
+    for i, ch in enumerate(line):
+        if _is_invisible(ch):
+            # Tag characters and variation selectors come in long runs: names would drown them.
+            named = classify(ch) not in (TAG, VARIATION_SELECTOR)
+            out.append(render_char(ch, with_name=named), style=_TOKEN_STYLE)
+        else:
+            out.append(ch, style=_COMMENT_STYLE if base + i in comments else "")
+    return out
+
+
+def _hidden_lines(line: str) -> list[RenderableType]:
+    """Decoded ASCII for tag characters, and bytes hidden in variation selectors."""
+    found: list[RenderableType] = []
+    for run in find_runs(line, TAG):
+        decoded = decode_tags(line[run.start : run.end])
+        if decoded:
+            found.append(_decoded_row("tag characters", mask_secrets(decoded)))
+    for run in find_runs(line, VARIATION_SELECTOR):
+        if run.end - run.start >= _VS_MIN_RUN:
+            decoded_vs = decode_variation_selectors(line[run.start : run.end])
+            if decoded_vs:
+                found.append(_decoded_row("variation selectors", mask_secrets(decoded_vs)))
+    return found
+
+
+def _decoded_row(source: str, decoded: str) -> RenderableType:
+    label = Text.assemble(("     ↳ Decoded hidden text", "bold red"), (f" ({source}): ", "dim"))
+    return Text.assemble(label, styled_decoded(decoded))
+
+
+def build(text: str) -> RenderableType:
+    """Numbered listing of ``text``; secrets are masked like everywhere else."""
+    text = safe(mask_secrets(text))
+    comments = _comment_offsets(text)
+    rows: list[RenderableType] = []
+    offset = 0
+    for number, raw in enumerate(text.split("\n"), start=1):
+        line = raw.removesuffix("\r")
+        row = Text.assemble((f"{number:>4} │ ", "dim"), _line_text(line, offset, comments))
+        rows.append(row)
+        rows.extend(Padding(extra, (0, 0, 0, 0)) for extra in _hidden_lines(line))
+        offset += len(raw) + 1
+    return Group(*rows)
+
+
+def has_hidden_content(text: str) -> bool:
+    """Whether the text contains invisible characters or HTML comments."""
+    return any(_is_invisible(ch) for ch in text) or _COMMENT_RE.search(text) is not None

ghostrules/rules/__init__.py

@@ -0,0 +1,16 @@
+"""Rule registry and built-in rule modules."""
+
+from ghostrules.rules import agent_settings, injection, mcp, unicode
+from ghostrules.rules.registry import Rule, all_rules, get_rule, register, rule
+
+__all__ = [
+    "Rule",
+    "agent_settings",
+    "all_rules",
+    "get_rule",
+    "injection",
+    "mcp",
+    "register",
+    "rule",
+    "unicode",
+]

ghostrules/rules/agent_settings.py

@@ -0,0 +1,159 @@
+"""Agent settings rules GR107-GR108 (``.claude/settings*.json``, Gemini settings, MCP trust)."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Iterator
+
+from ghostrules.jsonloc import JNode, parse_located
+from ghostrules.mcp_config import Span, is_settings_file
+from ghostrules.models import Finding, Kind, ScanTarget, Severity
+from ghostrules.rules.helpers import build_finding
+from ghostrules.rules.patterns import COLLECTOR_PATTERNS, EXFIL_PATTERNS, INJECTION_PATTERNS
+from ghostrules.rules.registry import rule
+
+CONFIG: tuple[Kind, ...] = ("config",)
+
+_SENSITIVE_PATH = (
+    r"(?:(?<!\w)\.env\b(?!\.(?:example|sample|template|dist)\b)|~/\.ssh|id_rsa|id_ed25519"
+    r"|\.aws/credentials|\.npmrc|\.netrc|\.pypirc|/etc/shadow)"
+)
+_SENDER = r"(?:curl|wget|nc|ncat|netcat)"
+_HOOK_EXFIL_PATTERNS = tuple(
+    re.compile(p, re.IGNORECASE)
+    for p in (
+        rf"\b{_SENDER}\b[^\n|;&]{{0,200}}{_SENSITIVE_PATH}",
+        rf"{_SENSITIVE_PATH}[^\n]{{0,200}}\|\s*{_SENDER}\b",
+        rf"\b(?:env|printenv)\b[^\n]{{0,60}}\|\s*{_SENDER}\b",
+    )
+)
+_BROAD_ALLOW = re.compile(
+    r"Bash(?:\(\s*\*{0,2}\s*\))?"
+    r"|Bash\(\s*(?:curl|sudo|rm)\s*:\s*\*\s*\)"
+    r"|WebFetch(?:\(\s*\*?\s*\))?",
+    re.IGNORECASE,
+)
+
+
+def _finding(
+    target: ScanTarget,
+    rule_id: str,
+    severity: Severity,
+    title: str,
+    message: str,
+    span: Span,
+    fix_hint: str,
+) -> Finding:
+    return build_finding(
+        target=target,
+        rule_id=rule_id,
+        severity=severity,
+        title=title,
+        message=message,
+        start=span[0],
+        end=max(span[1], span[0]),
+        fix_hint=fix_hint,
+        limit=80,
+    )
+
+
+def _hook_commands(node: JNode | None) -> Iterator[JNode]:
+    """Every string ``command`` value nested anywhere under ``hooks``."""
+    if node is None:
+        return
+    if node.members is not None:
+        for key, (_start, child) in node.members.items():
+            if key == "command" and isinstance(child.value, str):
+                yield child
+            else:
+                yield from _hook_commands(child)
+    elif node.elements is not None:
+        for element in node.elements:
+            yield from _hook_commands(element)
+
+
+def _hook_problem(command: str) -> str | None:
+    if any(p.search(command) for p in INJECTION_PATTERNS["GR012"]):
+        return "downloads and executes remote code"
+    if any(
+        p.search(command) for p in (*EXFIL_PATTERNS, *_HOOK_EXFIL_PATTERNS, *COLLECTOR_PATTERNS)
+    ):
+        return "sends sensitive data to a remote host"
+    return None
+
+
+@rule(
+    "GR107",
+    Severity.HIGH,
+    "Over-permissive agent settings",
+    "Agent settings that skip permission prompts, allow unrestricted tools, or run risky hooks.",
+    CONFIG,
+)
+def gr107_permissive_settings(target: ScanTarget) -> Iterator[Finding]:
+    """``bypassPermissions``, blanket ``Bash``/``WebFetch``/``curl``/``sudo``/``rm`` allows, Gemini
+    ``yolo``; hooks that fetch-and-run code or send secrets are critical."""
+    if not is_settings_file(target.path):
+        return
+    root = parse_located(target.text)
+    if root is None:
+        return
+    permissions = root.get("permissions")
+    mode = permissions.get("defaultMode") if permissions else None
+    if mode is not None and mode.value == "bypassPermissions":
+        yield _finding(
+            target, "GR107", Severity.HIGH, "Over-permissive agent settings",
+            "defaultMode is bypassPermissions: the agent runs every tool without asking.",
+            mode.string_span(), "Remove defaultMode or use a mode that asks for permission.",
+        )  # fmt: skip
+    allow = permissions.get("allow") if permissions else None
+    for item in (allow.elements or []) if allow else []:
+        if isinstance(item.value, str) and _BROAD_ALLOW.fullmatch(item.value.strip()):
+            yield _finding(
+                target, "GR107", Severity.HIGH, "Over-permissive agent settings",
+                f"Permission rule '{item.value}' allows unrestricted use of a powerful tool.",
+                item.string_span(),
+                "Allow only specific commands or domains, for example Bash(npm run test:*).",
+            )  # fmt: skip
+    yolo = root.get("yolo")
+    if yolo is not None and yolo.value is True and ".gemini/" in target.path.replace("\\", "/"):
+        yield _finding(
+            target, "GR107", Severity.HIGH, "Over-permissive agent settings",
+            "yolo is enabled: Gemini CLI runs every tool call without confirmation.",
+            (yolo.start, yolo.end), "Remove \"yolo\" so tool calls need confirmation.",
+        )  # fmt: skip
+    for command in _hook_commands(root.get("hooks")):
+        problem = _hook_problem(command.value)
+        if problem:
+            yield _finding(
+                target, "GR107", Severity.CRITICAL, "Over-permissive agent settings",
+                f"A hook {problem}: {command.value[:100]}",
+                command.string_span(), "Remove the hook; hooks run with your full privileges.",
+            )  # fmt: skip
+
+
+@rule(
+    "GR108",
+    Severity.MEDIUM,
+    "Auto-enabled project MCP servers",
+    "Settings that start MCP servers from a cloned repository without review.",
+    CONFIG,
+)
+def gr108_auto_trust(target: ScanTarget) -> Iterator[Finding]:
+    """``enableAllProjectMcpServers: true`` and servers marked ``trust: true`` (Gemini)."""
+    if is_settings_file(target.path):
+        root = parse_located(target.text)
+        flag = root.get("enableAllProjectMcpServers") if root else None
+        if flag is not None and flag.value is True:
+            yield _finding(
+                target, "GR108", Severity.MEDIUM, "Auto-enabled project MCP servers",
+                "enableAllProjectMcpServers is true: any cloned repo's .mcp.json starts its "
+                "servers without review.",
+                (flag.start, flag.end), "Remove it and approve project servers one by one.",
+            )  # fmt: skip
+    for server in target.servers:
+        if server.trust:
+            yield _finding(
+                target, "GR108", Severity.MEDIUM, "Auto-trusted MCP server",
+                f"Server '{server.name}' is marked trust: its tool calls skip confirmation.",
+                server.span("trust"), "Remove \"trust\" so tool calls need confirmation.",
+            )  # fmt: skip