mcp-capdiff 0.1.1__py3-none-any.whl

mcp_capdiff-0.1.1.dist-info/METADATA

@@ -0,0 +1,173 @@
+Metadata-Version: 2.4
+Name: mcp-capdiff
+Version: 0.1.1
+Summary: Security regression scanner for Model Context Protocol servers.
+Author: MCP Audit contributors
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/robbyfa/MCP-Audit
+Project-URL: Repository, https://github.com/robbyfa/MCP-Audit
+Project-URL: Issues, https://github.com/robbyfa/MCP-Audit/issues
+Keywords: mcp,security,static-analysis,sarif,ci
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: PyYAML<7,>=6.0
+Dynamic: license-file
+
+# MCP Audit
+
+MCP Audit is an open-source security regression scanner for Model Context Protocol servers. It extracts tool capabilities and permissions, detects risky cross-tool data flows, compares security posture across Git revisions, and emits CI-friendly evidence.
+
+The first version focuses on Python/FastMCP projects and the core product thesis from the spec: show what an MCP server can do, what changed, and whether the change creates a dangerous capability path.
+
+MCP005 is the capability-graph rule: it identifies when one tool returns classified data and another tool in the same MCP registration context can send it to an external destination. Findings include the source, data classification, sink, destination, path, source evidence, impact, and remediation.
+
+## Install locally
+
+```bash
+uv sync
+```
+
+Run project commands through `uv run`, or activate the virtual environment with
+`source .venv/bin/activate` before using bare commands.
+
+The package also supports isolated CLI installation directly from a checkout:
+
+```bash
+pipx install .
+mcp-audit --version
+mcp-audit scan .
+```
+
+The product and CLI are named MCP Audit, while the PyPI distribution is named `mcp-capdiff`:
+
+```bash
+pipx install mcp-capdiff
+mcp-audit --version
+```
+
+## Scan a server
+
+```bash
+uv run mcp-audit scan .
+```
+
+Scans fail closed when source cannot be read or when no MCP tools are discovered. Use `--allow-empty` only when an empty result is intentional.
+
+Useful output formats:
+
+```bash
+uv run mcp-audit scan . --format json
+uv run mcp-audit scan . --format sarif --output mcp-audit.sarif
+```
+
+## Generate a capability manifest
+
+```bash
+uv run mcp-audit manifest .
+```
+
+## Compare against a Git baseline
+
+```bash
+uv run mcp-audit diff --base origin/main
+```
+
+The diff report focuses on security changes: before/after risk, added and changed tools, expanded capabilities, new findings, resolved findings, and approval removal.
+
+## Run tests
+
+```bash
+uv run pytest
+```
+
+The corpus contains positive, negative, and edge cases under `fixtures/`, including host allowlisting, path-root validation, approval gating, and cross-tool sensitive-data paths.
+
+## GitHub Action
+
+The repository includes a composite action that runs the security diff, uploads SARIF to GitHub Code Scanning, and fails the check when policy thresholds are crossed:
+
+```yaml
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+steps:
+  - uses: actions/checkout@v4
+    with:
+      fetch-depth: 0
+  - uses: actions/setup-python@v5
+    with:
+      python-version: "3.12"
+  - uses: your-org/mcp-audit@v0.1
+    with:
+      target: .
+      base: origin/main
+      policy: mcp-audit.yaml
+```
+
+JSON reports and manifests use the versioned schema documented in `docs/report-schema.md`.
+
+The copyable [vulnerable FastMCP demo](examples/vulnerable-fastmcp/) includes four before/after pull-request scenarios and its own Action workflow.
+
+## V0.1 rules
+
+- `MCP001` arbitrary shell execution.
+- `MCP002` unrestricted filesystem access.
+- `MCP003` arbitrary URL or SSRF surface.
+- `MCP004` high-impact side effect without approval.
+- `MCP005` sensitive read to external write path.
+- `MCP007` unbounded security-sensitive input.
+- `MCP010` destructive tool exposed.
+- `MCP016` capability escalation in a diff.
+- `MCP017` approval removed in a diff.
+
+Each rule's detection behavior, examples, remediation, and limitations are documented in [docs/rules](docs/rules/README.md).
+
+## Demo fixtures
+
+```bash
+uv run mcp-audit scan fixtures/safe_server
+uv run mcp-audit scan fixtures/vulnerable_server
+```
+
+The vulnerable fixture includes a sensitive file read tool, an unrestricted URL fetcher, shell execution, and a destructive operation. MCP Audit should flag the individual findings and the cross-tool path:
+
+```text
+read_customer_file -> agent_context -> fetch_url
+```
+
+## Policy
+
+The default policy fails on high and critical findings. A minimal policy file can set a risk threshold and suppress reviewed findings:
+
+```yaml
+policy:
+  ci:
+    fail_on:
+      - critical
+      - high
+    max_risk_score: 60
+
+suppress:
+  - rule: MCP003
+    tool: internal_fetch
+    reason: "Network egress is enforced by service mesh"
+    expires: 2027-01-31
+```
+
+Suppression reasons are required. Expired suppressions no longer hide findings, and `mcp-audit policy check` reports them. See [policy documentation](docs/policy.md).
+
+## Version contracts
+
+CLI, ruleset, report schema, and manifest schema versions evolve independently. See [versioning](docs/versioning.md) and [report schema](docs/report-schema.md).
+
+Passing MCP Audit is technical security evidence, not a legal compliance determination.

mcp_capdiff-0.1.1.dist-info/RECORD

@@ -0,0 +1,30 @@
+mcp_audit/__init__.py,sha256=0yAP6G5TzdAmauO3FvPb3fgJsdpH4ahMc3oqY7Rmg0g,186
+mcp_audit/__main__.py,sha256=K_GoXoMc21FRRl6J8xKtGp_pmsDIeqGUd5ogv9u4MIU,97
+mcp_audit/analysis/__init__.py,sha256=axuNr8OZZZrzaqJ9O8xJp8fXrEq9ROZfhpfUtb8vWqo,29
+mcp_audit/analysis/diff.py,sha256=Bu2OswJskTZrLb-lAIAHbPi_8GwpnEfAhamBUFRPSAw,9308
+mcp_audit/analysis/scan.py,sha256=TJVzLB3YA4JBX0gUAF4ExE6H3c-g5tQaw7iqLrB154I,870
+mcp_audit/cli/__init__.py,sha256=C63yWifzpA0IV7YWDatpAdrhoV8zjqxAKv0xMf09VdM,19
+mcp_audit/cli/main.py,sha256=94zGGOyPkdOm6bo1f0xK1TM8OFwxcrLMXOHXbTAJ_5A,4490
+mcp_audit/models/__init__.py,sha256=fOgXYCfXZYGU_FmdogMm4FIyyQrARQWpr3S6N-3UNu0,279
+mcp_audit/models/capability.py,sha256=12Pcre2QkEGEXYyFR7LStKTpTptD-0yR0HHXn50Uey4,2219
+mcp_audit/models/finding.py,sha256=1_uoFi_GvMyXkeaH1CtyPAylAcDG7KRC2ixPNMLj_8o,2521
+mcp_audit/models/report.py,sha256=mEmgVWGEFbxZjxQeaB87b17i0DpGCkqkWxiDmWv22bc,4270
+mcp_audit/policy/__init__.py,sha256=yyOeCqhHPWymlKhRlwCSQlRCrAS8R9_SZx62dLJOKGc,37
+mcp_audit/policy/evaluator.py,sha256=u9mPFNGAhEWyoZ4Hdg-VUH5sdKrKbjx9Z4DD5gPDznI,993
+mcp_audit/policy/loader.py,sha256=adrb6YqRFCBoiX9xvBYbETbIXvauntjOkDGxNZP8sBw,4941
+mcp_audit/reporters/__init__.py,sha256=bmQ3dGBiHqSPwumamEebbTyZSdWgUDms_jPjo1MBB0Y,24
+mcp_audit/reporters/json.py,sha256=86ki9DG4NYPk6TNKXNP3itu_tFqneEOCNSw1Nky-iXY,237
+mcp_audit/reporters/manifest.py,sha256=D7t4Pl7pMk6daLHBe3ahTOb1lO5Pxmo1ly6hdiEnbVA,1132
+mcp_audit/reporters/sarif.py,sha256=OpB8B-FpamZzoCd6LTVz4yuaUn4R9to5lveHePpZtvk,3167
+mcp_audit/reporters/terminal.py,sha256=fxDN7PmRAcebVXrTlAd4nbfv462FkGwGuTOfpGGjUJY,3216
+mcp_audit/rules/__init__.py,sha256=D0zBK-ojsCfJhqDtPV5yASxq9tnZh-ewz6pXqpGWvVg,22
+mcp_audit/rules/engine.py,sha256=C4fPdDITOZlTCXcklz9_ytJdBXEoCRMt5Xq1MBlQdsg,8877
+mcp_audit/scanners/__init__.py,sha256=MMjF2VtHU7IulhbzPMcQGN3442bQx_SQlFPgXXbZ8LI,35
+mcp_audit/scanners/source/__init__.py,sha256=JIg80amN3QYYuuHF9aUvaR8APE8Vm-_jM5yc0H6RZow,23
+mcp_audit/scanners/source/python.py,sha256=7JKOM-TukLM5ej1eFKjBj3MR36mZSXCt17xpNBdjVp4,19588
+mcp_capdiff-0.1.1.dist-info/licenses/LICENSE,sha256=Q4GJ9OGrYcDpGmXPusuLT49p33NbsP4KYGiN9qqreeY,1079
+mcp_capdiff-0.1.1.dist-info/METADATA,sha256=EOX6Fp-O1YeeiDpq-iVLzR-r0nG-sONdQzdRK2MTklM,5520
+mcp_capdiff-0.1.1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mcp_capdiff-0.1.1.dist-info/entry_points.txt,sha256=rfG7Q7QC08t3hxDUU-EQUidHJW_x1URDZKG8uSBJYoQ,54
+mcp_capdiff-0.1.1.dist-info/top_level.txt,sha256=YZ4Gy-ehEA074nfIt4cMSAS6gAJDYcWfX0gu468CZVE,10
+mcp_capdiff-0.1.1.dist-info/RECORD,,

mcp_capdiff-0.1.1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

mcp_capdiff-0.1.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+mcp-audit = mcp_audit.cli.main:main

mcp_capdiff-0.1.1.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MCP Audit contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mcp_capdiff-0.1.1.dist-info/top_level.txt

@@ -0,0 +1 @@
+mcp_audit