mcpprobe-scanner 0.1.0__tar.gz → 0.2.0__tar.gz

mcpprobe_scanner-0.2.0/CHANGELOG.md

@@ -0,0 +1,129 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.2.0]
+
+Accuracy release, driven by an independent review of a 0.1.0 scan of the project's own
+deliberately weak demo server. 0.1.0 missed the demo's textbook tool poisoning,
+reported four checks as passed that had tested nothing, and rated an unauthenticated
+remote shell low. All of that is fixed and pinned by fixtures in CI.
+
+- Licence changes from MIT to Apache-2.0 for future releases. Version 0.1.0 remains available under MIT.
+
+### Fixed
+
+- **META-01 missed obvious poisoning.** It now detects instructions aimed at the model
+  ("always call this first", "call this tool before any other", "you must", "do not
+  tell the user", "ignore previous instructions"), requests to send the model's context
+  out (conversation, chat history, system prompt, previous messages), requests to
+  harvest the user's secrets, and HTML comments, in tool, argument, prompt and resource
+  descriptions. A directive combined with a context-exfiltration request is high. The
+  demo's `run_command` description is now reported high. Several 0.1 patterns that
+  fired on benign text ("Read the file at the given path", "Forward an email",
+  "Silently ignores unknown fields", "Operating system: Linux", "rather than the user's
+  timezone") were tightened; a corpus of 33 benign real-world descriptions must stay
+  below medium in the test-suite.
+- **Checks no longer report "passed" for things they did not test.** New check status
+  `not_applicable` (with a one-sentence reason and an optional `related_to`), raised
+  through `NotApplicable`. Every early exit was audited: AUTH-03/AUTH-04 are not
+  applicable when the server needs no authentication (related to AUTH-01), TRANS-03
+  when no `Mcp-Session-Id` is issued, META-* when no tool metadata could be read,
+  ERR-01/DOS-01 when every probe was stopped at authentication, META-02 without a
+  previous baseline, TRANS-01/TRANS-02 when a 401/429 hides the behaviour. Transport
+  failures are now `error`, not a pass. Reporters count only `ran` with no findings
+  as passed; SARIF lists not-applicable checks as notifications, never as passes.
+- **AUTH-02 passed when the metadata was missing.** Missing RFC 9728 metadata is now a
+  finding on unauthenticated servers too (medium on public hosts, low on loopback).
+- **AUTH-01 misreported servers scanned with credentials.** When `--header` supplies
+  credentials, one extra request is sent with them removed; a 401/403 marks the server
+  protected. AUTH-04's query-string probe no longer carries the operator's own token.
+- **Not an MCP server.** A target that answers but does not speak MCP (for example an
+  ordinary web site) no longer aborts with a generic error or produces results: the
+  report has `target_kind: "not_mcp"`, every check is not applicable with the
+  observation ("Not an MCP server: initialize -> HTTP 200 text/html"), and the CLI
+  exits with the new code 3. Unreachable targets get `target_kind: "unreachable"`
+  (exit 2, as before).
+
+### Changed
+
+- **META-03 rates by capability.** Tools that advertise arbitrary command execution or
+  arbitrary file read/write (a shell or file capability selected by a free-form string
+  argument) are high on their own and critical on an unauthenticated public endpoint.
+  The fix text says to remove or sandbox the tool with an allow-list; annotations come
+  after. The description states that a passive scan sees the advertised capability, not
+  whether the implementation really executes. Annotation contradictions are one finding
+  listing every affected tool. Check title updated accordingly.
+- **One finding per check per root cause.** META-04 emits one finding listing every
+  affected tool, with each tool's complete `inputSchema` and its specific problems
+  (including arguments missing from `required` and `additionalProperties` not false).
+- **Evidence and proof.** Every finding has `proof` (the complete object judged, built
+  from parsed data), `verify` (one runnable line, a `curl` against the real target for
+  HTTP), `affected`, `evidence_ids`, and `confidence_reason` whenever confidence is not
+  high (enforced). Evidence keeps every request and response header, with credential
+  headers redacted, and bodies up to 64 KiB (was 4 KiB).
+- **Environment-aware fix text.** The edge is detected from response headers
+  (`apigw-requestid`/`x-amz-apigw-id` -> AWS API Gateway, CloudFront, Cloudflare
+  `cf-ray`, Vercel `x-vercel-id`) and public vs local hosts are told apart. TRANS-05 and
+  DOS-01 say where to configure TLS, headers and throttling; AUTH-01 and TRANS-01 drop
+  "bind to 127.0.0.1" on public hosts. AUTH-01 shows the exact `WWW-Authenticate` header
+  with the target's metadata URL and notes that authentication does not make a shell
+  tool safe. TRANS-01 also probes and advises on `Origin: null` and allows requests with
+  no Origin. TRANS-02 mentions version negotiation on `initialize`.
+- **Attack chains.** New top-level `chains`: CHAIN-01 (unauthenticated + arbitrary
+  capability, + poisoned description when META-01 fired on that tool, critical) and
+  CHAIN-02 (the same on a local server that accepts foreign Origins). A chain is only
+  emitted when every constituent finding is present.
+- Report schema 0.2 (`schema_version`, `target_kind`, `environment`, `chains`, the new
+  finding fields, `checks[].related_to`, `summary.checks_passed` /
+  `checks_not_applicable`), documented in `docs/report-schema.md`.
+
+### Tests
+
+- Fixtures pinned in CI: an exact replica of the public demo server (`--preset demo`),
+  the observable passive behaviour of a hardened reference server (`--preset
+  hardened`), and an ordinary HTML site (`--preset html`). The exact outcome of every
+  check against each is asserted; any change fails the suite.
+
+## [0.1.0]
+
+- Published on PyPI as `mcpprobe-scanner` (PyPI blocks `mcpprobe` and `mcpprobe-cli` as too similar to existing projects). The command and the Python package are both `mcpprobe`.
+ - 2026-10-27
+
+First public release of the open-source scanner core.
+
+### Added
+
+- MCP client for Streamable HTTP (JSON-RPC over POST, JSON or SSE responses)
+  and stdio, written to send deliberately non-conformant requests.
+- Protocol fingerprinting: `server/discover` (2026-07-28) first, then
+  `initialize` with 2025-11-25 and 2025-06-18, then the deprecated
+  2024-11-05 HTTP+SSE transport.
+- Evidence log: every request/response with timestamp, method, status, a
+  header subset, bodies truncated to 4 KB, `Authorization` values and known
+  secret patterns redacted.
+- Passive checks: AUTH-01..04, TRANS-01..05, META-01..05, ERR-01, DOS-01.
+- Active checks INJ-01..05, SUPPLY-01/02 and SANDBOX-01 registered as gated
+  stubs (report `not_implemented`; no payloads are sent).
+- Governance items GOV-01..05 listed as attestation-only in every report.
+- Authorisation gate for active mode: `--authorised-by`, `--scope` and
+  ownership verification (`--verify dns-txt` via `_mcpprobe.<host>` TXT, or
+  `--verify local` for stdio); an authorisation record JSON is written next to
+  the report.
+- Opt-out: DNS TXT `mcpprobe-opt-out=all` at `_mcpprobe.<host>` and
+  `/.well-known/mcpprobe-opt-out`, both checked before any MCP request.
+- Rate limiting: 5 requests/second by default, hard ceiling 10.
+- Reports: JSON (with evidence), SARIF 2.1.0 (validated against the official
+  schema in tests) and a rich terminal summary. Exit codes 0 / 1 / 2.
+- META-02 baselines: canonical SHA-256 of tools, prompts, resources and
+  instructions with diffing against a stored baseline (rug-pull detection).
+- Optional LLM-judge hook for META-01 (`ScanOptions.judge`); mcpprobe makes no
+  LLM or third-party network calls itself.
+- Docker container GitHub Action, CI (ruff, strict mypy, pytest on Python
+  3.11 to 3.13) and PyPI Trusted Publishing release workflow.
+
+[0.1.0]: https://github.com/mcpprobe-dev/mcpprobe/releases/tag/v0.1.0

{mcpprobe_scanner-0.1.0 → mcpprobe_scanner-0.2.0}/CHECKS.md

@@ -1,6 +1,6 @@
 # mcpprobe checks catalogue
 
-Generated from the check metadata of mcpprobe 0.1.0 (`mcpprobe checks --format markdown`). Do not edit by hand.
+Generated from the check metadata of mcpprobe 0.2.0 (`mcpprobe checks --format markdown`). Do not edit by hand.
 
 Standards: OWASP MCP Top 10 (IDs `MCP0x:2025`, still a beta list, so shown with `(beta)`), OWASP Top 10 for Agentic Applications (`ASI0x`), OWASP Top 10 for LLM Applications 2026 (`LLM0x:2026`, primary) and 2025 (`LLM0x:2025`, kept for one release cycle). Severities are defaults; a check can raise or lower the severity of an individual finding (for example loopback-only servers are reported one level lower), and heuristic checks never rate a finding Critical on their own.
 
@@ -21,7 +21,7 @@ Passive checks send only what a normal MCP client would send plus a few benign m
 | [TRANS-05](#trans-05---plain-http-weak-tls-or-missing-security-headers) | passive | high | Plain HTTP, weak TLS or missing security headers | MCP01:2025 (beta) |
 | [META-01](#meta-01---possible-tool-description-poisoning) | passive | high | Possible tool-description poisoning | MCP03:2025 (beta), ASI01, ASI04, LLM01:2026, LLM01:2025 |
 | [META-02](#meta-02---tool-surface-changed-since-the-stored-baseline-rug-pull-indicator) | passive | medium | Tool surface changed since the stored baseline (rug-pull indicator) | MCP03:2025 (beta), ASI04 |
-| [META-03](#meta-03---tool-annotations-contradict-the-tools-apparent-capability) | passive | medium | Tool annotations contradict the tool's apparent capability | MCP02:2025 (beta), MCP05:2025 (beta), ASI02, ASI05, LLM03:2026, LLM06:2025 |
+| [META-03](#meta-03---dangerous-tool-capability-exposed-or-annotations-contradict-it) | passive | high | Dangerous tool capability exposed or annotations contradict it | MCP02:2025 (beta), MCP05:2025 (beta), ASI02, ASI05, LLM03:2026, LLM06:2025 |
 | [META-04](#meta-04---tool-schema-hygiene-problems) | passive | low | Tool schema hygiene problems | MCP05:2025 (beta) |
 | [META-05](#meta-05---secret-material-in-server-metadata-or-configuration) | passive | high | Secret material in server metadata or configuration | MCP01:2025 (beta), LLM02:2026, LLM02:2025 |
 | [ERR-01](#err-01---verbose-error-responses-leak-stack-traces-paths-or-versions) | passive | medium | Verbose error responses leak stack traces, paths or versions | MCP08:2025 (beta), LLM02:2026, LLM02:2025 |
@@ -50,13 +50,13 @@ Passive checks send only what a normal MCP client would send plus a few benign m
 | Default severity | high |
 | Transports | http |
 | Standards | MCP07:2025 (beta), ASI03, LLM04:2026, LLM03:2026, LLM03:2025, LLM06:2025 |
-| Evidence | The unauthenticated tools/list request and the 200 response. |
+| Evidence | The unauthenticated request (Authorization shown as not sent) and the response. |
 
-POSTs initialize (or server/discover) and tools/list with no Authorization header. If the server answers with a tool list, anyone who can reach the endpoint can drive its tools. Missing authentication was the single most common issue in public MCP server studies.
+POSTs initialize (or server/discover) and tools/list with no Authorization header. If the server answers with a tool list, anyone who can reach the endpoint can drive its tools. When the operator supplies credentials with --header, one extra request is sent with those credentials removed, so a protected server is not misreported. Passes only when the endpoint answers 401/403 without credentials.
 
 **False positives.** Servers protected by a network boundary (VPN, mTLS at a proxy, IP allow-list) will still be flagged because the scanner only sees what the endpoint returns. Local development servers bound to loopback are reported at reduced severity but are still exposed to DNS-rebinding and browser-based attacks (see CVE-2025-49596 class).
 
-**Fix.** Put the endpoint behind OAuth 2.1 as described in the MCP authorization spec: return 401 with WWW-Authenticate pointing at RFC 9728 protected-resource metadata, validate token audience, and reject requests without a valid bearer token. For local servers, bind to 127.0.0.1 and still require a token.
+**Fix.** Put the endpoint behind OAuth 2.1 as described in the MCP authorization spec: return 401 with WWW-Authenticate: Bearer resource_metadata="<RFC 9728 metadata URL>", validate each token's signature, issuer, expiry and audience, and reject requests without a valid bearer token. Authentication does not make a dangerous tool safe.
 
 ### AUTH-02 - Protected resource metadata (RFC 9728) missing or invalid
 
@@ -66,11 +66,11 @@ POSTs initialize (or server/discover) and tools/list with no Authorization heade
 | Default severity | high |
 | Transports | http |
 | Standards | MCP07:2025 (beta) |
-| Evidence | The 401 response headers and each metadata GET with its status/body. |
+| Evidence | The 401 response headers and each metadata GET with its status. |
 
-On a 401 the scanner parses WWW-Authenticate for resource_metadata, then tries /.well-known/oauth-protected-resource[/path] and the host root. The document must be JSON with a non-empty authorization_servers list. Without it, conformant clients cannot start the OAuth flow and users are pushed toward pasting long-lived static tokens.
+Parses WWW-Authenticate for resource_metadata (when the server answers 401), then tries /.well-known/oauth-protected-resource[/path] and the host root. The document must be JSON with a non-empty authorization_servers list. Without it, conformant clients cannot start the OAuth flow and users are pushed toward pasting long-lived static tokens. A server that requires no authentication and serves no metadata is reported too (medium, the discovery half of AUTH-01).
 
-**False positives.** Servers that use a non-OAuth scheme (API keys at a gateway) will be flagged; the MCP spec still expects RFC 9728 metadata for HTTP transports.
+**False positives.** Servers that use a non-OAuth scheme (API keys at a gateway) will be flagged; the MCP spec still expects RFC 9728 metadata for HTTP transports. A deliberately public, read-only server with no authentication will also be flagged; AUTH-01 is the root cause.
 
 **Fix.** Serve /.well-known/oauth-protected-resource (path-aware variant preferred) with 'resource' and 'authorization_servers', and include WWW-Authenticate: Bearer resource_metadata="<url>" on every 401.
 
@@ -114,13 +114,13 @@ Mints two syntactically valid JWTs the server cannot have issued (HS256 with a r
 | Default severity | medium |
 | Transports | http |
 | Standards | MCP07:2025 (beta) |
-| Evidence | The POST with the foreign Origin header and the non-403 response. |
+| Evidence | Each POST with a foreign Origin header and the non-403 response. |
 
-Sends a normal negotiation request with 'Origin: https://evil.example'. The transport spec says servers MUST validate Origin and return 403 on an invalid one; otherwise a web page can drive a locally running MCP server through the victim's browser (DNS rebinding).
+Sends a normal negotiation request with 'Origin: https://evil.example' and one with 'Origin: null'. The transport spec says servers MUST validate Origin and return 403 on an invalid one; otherwise a web page can drive the server through the victim's browser (DNS rebinding). Requests without an Origin header are not tested: non-browser clients do not send one.
 
-**False positives.** If the server answers 401 before looking at Origin the check is indeterminate and no finding is raised (see scan notes). Reverse proxies that strip Origin will cause a finding against the proxied endpoint even if the application validates it.
+**False positives.** If the server answers 401 (or 429) before looking at Origin the check is not applicable and says so. Reverse proxies that strip Origin will cause a finding against the proxied endpoint even if the application validates it.
 
-**Fix.** Reject requests whose Origin is not on an allow-list with HTTP 403 before processing the body. For local servers also bind to 127.0.0.1 rather than 0.0.0.0.
+**Fix.** Reject any request whose Origin header is present and not on an allow-list with HTTP 403, before processing the body, including 'Origin: null'. Allow requests with no Origin header.
 
 ### TRANS-02 - Unsupported MCP-Protocol-Version header not rejected
 
@@ -134,9 +134,9 @@ Sends a normal negotiation request with 'Origin: https://evil.example'. The tran
 
 Sends a request with 'MCP-Protocol-Version: 1999-01-01'. The spec requires HTTP 400 (or, on 2026-07-28, an UnsupportedProtocolVersionError). Accepting any version string suggests the server ignores version negotiation entirely.
 
-**False positives.** Pre-2025-06-18 servers never defined the header, so an older server that ignores it is noted at low severity only.
+**False positives.** Pre-2025-06-18 servers never defined the header, so an older server that ignores it is noted at low severity only. A 401/429 before the header is read makes the check not applicable.
 
-**Fix.** Validate MCP-Protocol-Version against the supported list and reply 400 when it is unknown.
+**Fix.** Validate the MCP-Protocol-Version header against the versions you support and reply 400 when it is unknown. Separately, when initialize asks for a protocolVersion you do not support, answer with the latest version you do support and let the client decide; never echo back whatever the client asked for.
 
 ### TRANS-03 - Weak, predictable or unvalidated Mcp-Session-Id
 
@@ -184,7 +184,7 @@ Flags non-loopback endpoints served over plain HTTP (bearer tokens in clear), TL
 
 **False positives.** Loopback plain-HTTP is reported as informational. Header checks look at the MCP endpoint only; a CDN may add headers on other paths.
 
-**Fix.** Serve the endpoint over HTTPS with TLS 1.2+ only, add Strict-Transport-Security and X-Content-Type-Options: nosniff.
+**Fix.** Serve the endpoint over HTTPS with TLS 1.2+ only, add Strict-Transport-Security and X-Content-Type-Options: nosniff. Where an edge (API Gateway, CloudFront, Cloudflare, Vercel) is detected the fix text says where to configure it.
 
 ### META-01 - Possible tool-description poisoning
 
@@ -196,11 +196,11 @@ Flags non-loopback endpoints served over plain HTTP (bearer tokens in clear), TL
 | Standards | MCP03:2025 (beta), ASI01, ASI04, LLM01:2026, LLM01:2025 |
 | Evidence | The tools/list (or prompts/resources/initialize) response and the matched excerpts. |
 
-Scans every tool, prompt and resource description, every inputSchema parameter description and the server 'instructions' for: prompt-style markup (<IMPORTANT>, <system>), instructions aimed at the model (conceal from user, override instructions, read-and-forward, prerequisite coercion, redirect/replace), credential file paths, references to other tools with behaviour-modifying language (shadowing), URLs and e-mail addresses with send/BCC wording, base64 blobs, zero-width/bidi/tag Unicode, mixed-script homoglyphs and excessive length. Findings carry tiered confidence and are never rated Critical on heuristics alone.
+Scans every tool, prompt and resource description, every inputSchema parameter description and the server 'instructions' for: prompt-style markup (<IMPORTANT>, <system>, HTML comments), instructions aimed at the model (call this first / before any other tool, you must, conceal from the user, ignore previous instructions, redirect/replace), requests to send the model's context out (conversation, chat history, system prompt, previous messages), requests to harvest secrets (the user's API key, token, password, credentials, .env), credential file paths, references to other tools with behaviour-modifying language (shadowing), URLs and e-mail addresses with send/BCC wording, base64 blobs, zero-width/bidi/tag Unicode, mixed-script homoglyphs and excessive length. Findings carry tiered confidence and are never rated Critical on heuristics alone. A model directive combined with a request to send context out is rated high. Precision is guarded by a corpus of benign real-world descriptions in the test-suite that must stay below medium.
 
 **False positives.** Legitimate guidance such as 'IMPORTANT: call authenticate before this tool' matches the markup and prerequisite heuristics at medium confidence. URLs to documentation and mentions of sibling tools without behaviour-modifying words are reported at low severity. Review the matched excerpts; a second-opinion judge can be plugged in through the Python API (ScanOptions.judge); mcpprobe itself makes no LLM calls.
 
-**Fix.** Remove any text addressed to the model rather than describing the tool. Keep descriptions short and factual, strip invisible Unicode, and never reference other servers' tools. Pin and hash approved descriptions in clients (see META-02).
+**Fix.** Rewrite the description so it only says what the tool does. Remove every instruction addressed to the model (when to call it, what to call first, what to hide from the user) and every request to pass along conversation, prompts, files or credentials. Strip invisible Unicode and HTML comments, and never reference other servers' tools. Pin and hash approved descriptions in clients (see META-02).
 
 ### META-02 - Tool surface changed since the stored baseline (rug-pull indicator)
 
@@ -218,21 +218,21 @@ Computes SHA-256 over the canonical JSON of each tool, prompt and resource defin
 
 **Fix.** Treat tool definitions as code: version them, review changes, and have clients pin and re-approve definitions when the hash changes.
 
-### META-03 - Tool annotations contradict the tool's apparent capability
+### META-03 - Dangerous tool capability exposed or annotations contradict it
 
 | | |
 |---|---|
 | Mode | passive (implemented) |
-| Default severity | medium |
+| Default severity | high |
 | Transports | http, stdio |
 | Standards | MCP02:2025 (beta), MCP05:2025 (beta), ASI02, ASI05, LLM03:2026, LLM06:2025 |
-| Evidence | The tools/list response; matched terms per tool are listed in details. |
+| Evidence | The tools/list response; each affected tool's complete definition is shown as proof. |
 
-Classifies each tool by name, description and parameter names into capability classes (exec, file_write, file_read, database_*, network, email, credentials, payments, delete, search) and cross-checks the declared annotations: a tool that looks like it runs commands or sends e-mail but is marked readOnlyHint:true, or an exec/delete tool marked destructiveHint:false, is reported. A summary of the dangerous surface is reported at low severity. Annotations are treated as untrusted hints, as the spec requires of clients.
+Classifies each tool by name, description and parameter names into capability classes. Tools that advertise arbitrary command execution, arbitrary file read or arbitrary file write (a shell/file capability selected by a free-form string argument with no enum, const or pattern) are rated high on their own and critical when the remote endpoint needs no authentication. Declared annotations are cross-checked (a command tool marked readOnlyHint:true is reported), and the remaining high-impact surface (network, e-mail, credentials, payments) is summarised at low severity. Passive scanning sees the advertised capability, not whether the implementation really executes: the rating is based on the name, description and schema, and no tool is called.
 
-**False positives.** Classification is keyword-based: a tool named 'delete_draft' that only removes the user's own draft will be classed 'delete'. Confidence is medium for contradictions and the dangerous-surface summary is informational.
+**False positives.** Classification is keyword-based: a tool named 'delete_draft' that only removes the user's own draft will be classed 'delete'. A tool that advertises a shell but whose implementation is a stub is still reported, because clients and models act on the advertised capability.
 
-**Fix.** Make annotations truthful (readOnlyHint only for tools with no side effects, destructiveHint:true for anything that deletes or executes), and consider splitting broad tools into narrower ones so clients can gate approval.
+**Fix.** For arbitrary command execution or file access: remove the tool, or sandbox it and replace the free-form argument with an allow-list (enum) of commands or files. Annotations come after that. Make annotations truthful (destructiveHint:true for anything that executes or deletes); they help a careful client warn the user but do nothing about the risk.
 
 ### META-04 - Tool schema hygiene problems
 
@@ -242,13 +242,13 @@ Classifies each tool by name, description and parameter names into capability cl
 | Default severity | low |
 | Transports | http, stdio |
 | Standards | MCP05:2025 (beta) |
-| Evidence | The tools/list response. |
+| Evidence | The tools/list response; each affected tool's complete inputSchema is shown as proof. |
 
-Checks tool names against [A-Za-z0-9_.-]{1,128} and for duplicates; checks that inputSchema is a JSON Schema object of type 'object'; flags free-form string arguments whose names suggest paths, commands, URLs or queries and that carry no enum, pattern, format or maxLength constraint. Missing outputSchema cannot be judged without calling the tool and is not reported.
+Checks tool names against [A-Za-z0-9_.-]{1,128} and for duplicates; checks that inputSchema is a JSON Schema object of type 'object'; flags free-form string arguments whose names suggest paths, commands, URLs or queries and that carry no enum, pattern, format or maxLength constraint. One finding lists every affected tool, with each tool's complete inputSchema and its specific problems (including arguments missing from 'required' and additionalProperties not set to false). Missing outputSchema cannot be judged without calling the tool and is not reported.
 
 **False positives.** An unconstrained 'query' string is often unavoidable (search tools); the finding is Low severity and meant as a review prompt, not a defect.
 
-**Fix.** Use valid names, give every tool an object inputSchema, and constrain risky string arguments with enum/pattern/format/maxLength so clients and servers can validate.
+**Fix.** Constrain every risky string argument (enum for a fixed set, pattern for a format, maxLength to bound size), list required arguments in 'required', set additionalProperties: false, and validate arguments on the server against the same schema instead of trusting the client to have done it.
 
 ### META-05 - Secret material in server metadata or configuration
 

mcpprobe_scanner-0.2.0/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

mcpprobe_scanner-0.2.0/NOTICE

@@ -0,0 +1,8 @@
+mcpprobe
+Copyright 2026 mcpprobe contributors
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).
+Releases up to and including 0.1.0 were published under the MIT License and remain available under it.
+
+"mcpprobe" and the mcpprobe logo are trademarks of the project. The Apache License does not grant
+permission to use them (Section 6), except to describe the origin of the work.

{mcpprobe_scanner-0.1.0 → mcpprobe_scanner-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpprobe-scanner
-Version: 0.1.0
+Version: 0.2.0
 Summary: Security scanner for Model Context Protocol (MCP) servers: auth, transport, tool-metadata and poisoning checks with JSON and SARIF output.
 Project-URL: Homepage, https://mcpprobe.tech
 Project-URL: Scanning policy, https://mcpprobe.tech/scanning-policy
@@ -8,8 +8,9 @@ Project-URL: Source, https://github.com/mcpprobe-dev/mcpprobe
 Project-URL: Issues, https://github.com/mcpprobe-dev/mcpprobe/issues
 Author-email: mcpprobe contributors <hello@mcpprobe.tech>
 Maintainer-email: mcpprobe contributors <hello@mcpprobe.tech>
-License-Expression: MIT
+License-Expression: Apache-2.0
 License-File: LICENSE
+License-File: NOTICE
 Keywords: mcp,model-context-protocol,owasp,sarif,scanner,security
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Console
@@ -85,7 +86,7 @@ which checks ran, which were skipped and why. `mcpprobe checks` lists every chec
 |---|---|---|
 | Authentication | AUTH-01..04 | endpoint answers without credentials; missing RFC 9728 protected-resource metadata; no PKCE S256; accepts a self-minted JWT with the wrong audience; token accepted in the query string |
 | Transport | TRANS-01..05 | `Origin` not validated (DNS rebinding); bogus `MCP-Protocol-Version` accepted; weak or forgeable `Mcp-Session-Id`; deprecated HTTP+SSE; plain HTTP, weak TLS, missing headers |
-| Tool metadata | META-01..05 | hidden instructions, cross-tool shadowing, credential paths, URLs, base64, zero-width/bidi/homoglyph Unicode; rug-pull diff against a stored SHA-256 baseline; annotations that contradict capability; schema hygiene; secrets in descriptions or stdio env |
+| Tool metadata | META-01..05 | instructions aimed at the model ("always call this first", "do not tell the user"), requests to send conversation, system prompt or secrets out, cross-tool shadowing, credential paths, URLs, base64, HTML comments, zero-width/bidi/homoglyph Unicode; rug-pull diff against a stored SHA-256 baseline; advertised arbitrary command execution or file access (high, critical when unauthenticated) and annotations that contradict capability; schema hygiene; secrets in descriptions or stdio env |
 | Robustness | ERR-01, DOS-01 | stack traces and versions in errors; one oversized argument, one 64-deep nesting probe and 20 paced `tools/list` calls, never more |
 | Active (gated stubs) | INJ-01..05, SUPPLY-01/02, SANDBOX-01 | registered and reported as `not_implemented` in this release |
 | Governance | GOV-01..05 | listed as attestation-only: not assessable by a scan, never marked passed |
@@ -147,7 +148,8 @@ opt-outs (below), but those are courtesy mechanisms, not permission.
 |---|---|
 | `0` | No finding at or above `--fail-on` (default `high`) |
 | `1` | At least one finding at or above `--fail-on` |
-| `2` | Error: target unreachable or not MCP, bad arguments, ownership verification failed, authorisation refused, or the target opted out |
+| `2` | Error: target unreachable, bad arguments, ownership verification failed, authorisation refused, or the target opted out |
+| `3` | The target answered but is not an MCP server (for example an ordinary web site); every check is reported not applicable and nothing passes |
 
 ## SARIF and GitHub code scanning
 
@@ -202,8 +204,12 @@ description after approval is the classic rug pull) and update the file; use
 ## Reports and evidence
 
 - `--json FILE`: the full report, including every request/response pair (timestamp,
-  method, status, a header subset, bodies truncated to 4 KB). `Authorization` values
-  and recognised secret patterns are redacted.
+  method, status, every header, bodies up to 64 KiB). Credential headers and
+  recognised secret patterns are redacted. Each finding carries a `proof` excerpt
+  built from parsed data, a runnable `verify` line and, when confidence is not high,
+  a `confidence_reason`. Checks whose preconditions are absent are reported
+  `not_applicable` with a reason and never count as passed. The schema is documented
+  in [docs/report-schema.md](docs/report-schema.md).
 - `--sarif FILE`: SARIF 2.1.0.
 - `-v`: descriptions and scan notes in the terminal; `-q`: no terminal output.
 
@@ -237,4 +243,4 @@ $ python -m tests.fake_server --preset vulnerable --port 8765   # deliberately v
 $ mcpprobe http://127.0.0.1:8765/mcp
 ```
 
-Security issues: see [SECURITY.md](SECURITY.md). Licence: [MIT](LICENSE).
+Security issues: see [SECURITY.md](SECURITY.md). Licence: [Apache-2.0](LICENSE) from 0.2.0 (see [NOTICE](NOTICE)); 0.1.0 was released under MIT.

{mcpprobe_scanner-0.1.0 → mcpprobe_scanner-0.2.0}/README.md

@@ -47,7 +47,7 @@ which checks ran, which were skipped and why. `mcpprobe checks` lists every chec
 |---|---|---|
 | Authentication | AUTH-01..04 | endpoint answers without credentials; missing RFC 9728 protected-resource metadata; no PKCE S256; accepts a self-minted JWT with the wrong audience; token accepted in the query string |
 | Transport | TRANS-01..05 | `Origin` not validated (DNS rebinding); bogus `MCP-Protocol-Version` accepted; weak or forgeable `Mcp-Session-Id`; deprecated HTTP+SSE; plain HTTP, weak TLS, missing headers |
-| Tool metadata | META-01..05 | hidden instructions, cross-tool shadowing, credential paths, URLs, base64, zero-width/bidi/homoglyph Unicode; rug-pull diff against a stored SHA-256 baseline; annotations that contradict capability; schema hygiene; secrets in descriptions or stdio env |
+| Tool metadata | META-01..05 | instructions aimed at the model ("always call this first", "do not tell the user"), requests to send conversation, system prompt or secrets out, cross-tool shadowing, credential paths, URLs, base64, HTML comments, zero-width/bidi/homoglyph Unicode; rug-pull diff against a stored SHA-256 baseline; advertised arbitrary command execution or file access (high, critical when unauthenticated) and annotations that contradict capability; schema hygiene; secrets in descriptions or stdio env |
 | Robustness | ERR-01, DOS-01 | stack traces and versions in errors; one oversized argument, one 64-deep nesting probe and 20 paced `tools/list` calls, never more |
 | Active (gated stubs) | INJ-01..05, SUPPLY-01/02, SANDBOX-01 | registered and reported as `not_implemented` in this release |
 | Governance | GOV-01..05 | listed as attestation-only: not assessable by a scan, never marked passed |
@@ -109,7 +109,8 @@ opt-outs (below), but those are courtesy mechanisms, not permission.
 |---|---|
 | `0` | No finding at or above `--fail-on` (default `high`) |
 | `1` | At least one finding at or above `--fail-on` |
-| `2` | Error: target unreachable or not MCP, bad arguments, ownership verification failed, authorisation refused, or the target opted out |
+| `2` | Error: target unreachable, bad arguments, ownership verification failed, authorisation refused, or the target opted out |
+| `3` | The target answered but is not an MCP server (for example an ordinary web site); every check is reported not applicable and nothing passes |
 
 ## SARIF and GitHub code scanning
 
@@ -164,8 +165,12 @@ description after approval is the classic rug pull) and update the file; use
 ## Reports and evidence
 
 - `--json FILE`: the full report, including every request/response pair (timestamp,
-  method, status, a header subset, bodies truncated to 4 KB). `Authorization` values
-  and recognised secret patterns are redacted.
+  method, status, every header, bodies up to 64 KiB). Credential headers and
+  recognised secret patterns are redacted. Each finding carries a `proof` excerpt
+  built from parsed data, a runnable `verify` line and, when confidence is not high,
+  a `confidence_reason`. Checks whose preconditions are absent are reported
+  `not_applicable` with a reason and never count as passed. The schema is documented
+  in [docs/report-schema.md](docs/report-schema.md).
 - `--sarif FILE`: SARIF 2.1.0.
 - `-v`: descriptions and scan notes in the terminal; `-q`: no terminal output.
 
@@ -199,4 +204,4 @@ $ python -m tests.fake_server --preset vulnerable --port 8765   # deliberately v
 $ mcpprobe http://127.0.0.1:8765/mcp
 ```
 
-Security issues: see [SECURITY.md](SECURITY.md). Licence: [MIT](LICENSE).
+Security issues: see [SECURITY.md](SECURITY.md). Licence: [Apache-2.0](LICENSE) from 0.2.0 (see [NOTICE](NOTICE)); 0.1.0 was released under MIT.

{mcpprobe_scanner-0.1.0 → mcpprobe_scanner-0.2.0}/mcpprobe/__init__.py

@@ -13,7 +13,7 @@ The package is organised as follows:
 
 from __future__ import annotations
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 
 POLICY_URL = "https://mcpprobe.tech/scanning-policy"
 USER_AGENT = f"mcpprobe/{__version__} (+{POLICY_URL})"