mcpsec 2.7.0__tar.gz → 2.7.2__tar.gz

{mcpsec-2.7.0 → mcpsec-2.7.2}/.gitignore

@@ -69,3 +69,5 @@ fix_unicode.py
 temp_*.yml
 out.txt
 mypy_output.txt
+
+verify_patterns.py

{mcpsec-2.7.0 → mcpsec-2.7.2}/CHANGELOG.md

@@ -5,6 +5,40 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.7.2] - 2026-07-12
+
+### Changed
+- **Codebase Cleanup & Deduplication**: Removed 156 duplicate regexes and consolidated 3,459 sink patterns into 9 organized files by vulnerability type.
+- **Generator Consolidation**: Merged protocol_state generators and renamed memory_exhaustion_v2 for better maintainability.
+- **Dead Code Removal**: Removed unused AI analyzer stubs (	aint_analyzer, py_analyzer) and SQL exploiter stubs.
+- **Test Organization**: Moved test server fixtures from 	ests/ to 	ests/servers/ for cleaner separation of tests and fixtures.
+
+### Fixed
+- **Silent Exception Handling**: Replaced bare except: pass blocks across 130+ files with proper logger.debug statements.
+- **Unicode Errors on Windows**: Fixed UnicodeEncodeError crashes caused by rich console emojis by forcing UTF-8 stdout encoding.
+- **Unused Imports**: Cleaned up stale imports in cli.py.
+
+
+## [2.7.1] - 2026-04-15
+
+### Improved
+- **Pattern expansion**: 3,450+ sink patterns (up from ~800), covering Python, TypeScript, Go, Rust, C/C++, Java, Ruby, PHP
+- **Sanitizer patterns**: 105 patterns to detect when dangerous sinks are properly sanitized
+- **MCP source patterns**: 45 patterns for framework-aware detection across 20+ MCP SDKs
+- **Detection accuracy**: 100% on internal test suite (13/13 vulnerabilities detected in blind_test.py)
+- **AI classification**: Improved 5-level severity system (🔴🟠🟡🔵⚪) with better server-type awareness
+
+### Fixed
+- Multi-line pattern matching (subprocess with shell=True across multiple lines now detected)
+- Variable SQL injection detection (cursor.execute(variable) where variable is f-string)
+- eval() detection with nested parentheses
+- Duplicate finding deduplication (same sink no longer reported multiple times)
+- Heuristic confidence filter (medium-confidence sinks no longer dropped)
+
+### Added
+- `--include-tests` flag to include test file findings (excluded by default)
+- Server-type detection for better by-design classification (filesystem, fetch, database servers)
+
 ## v2.7.0 (2026-03-23)
 
 ### New Features
@@ -281,4 +315,4 @@ mcpsec evolve --stdio "server" --corpus ./corpus --crashes ./crashes
 - Protocol fuzzer with 500+ test cases
 - AI-powered payload generation
 - Semgrep-based static analysis
-- Support for OpenAI, Anthropic, Google, Groq, DeepSeek, Ollama
+- Support for OpenAI, Anthropic, Google, Groq, DeepSeek, Ollama

{mcpsec-2.7.0 → mcpsec-2.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: mcpsec
-Version: 2.7.0
+Version: 2.7.2
 Summary: Security scanner for MCP (Model Context Protocol) servers - pentest your AI agent's tool connections
 Project-URL: Homepage, https://github.com/manthanghasadiya/mcpsec
 Project-URL: Documentation, https://github.com/manthanghasadiya/mcpsec#readme
@@ -53,12 +53,14 @@ Description-Content-Type: text/markdown
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![PyPI](https://img.shields.io/pypi/v/mcpsec)](https://pypi.org/project/mcpsec/)
 [![CI](https://github.com/manthanghasadiya/mcpsec/actions/workflows/ci.yml/badge.svg)](https://github.com/manthanghasadiya/mcpsec/actions/workflows/ci.yml)
-[![Bugs Fixed](https://img.shields.io/badge/bugs%20fixed-4-green)](https://github.com/manthanghasadiya/mcpsec)
-[![Bugs Reported](https://img.shields.io/badge/bugs%20reported-14+-red)](https://github.com/manthanghasadiya/mcpsec)
+[![CVEs](https://img.shields.io/badge/CVEs-6-critical)](https://github.com/manthanghasadiya/mcpsec)
+[![Bugs Fixed](https://img.shields.io/badge/bugs%20fixed-10-green)](https://github.com/manthanghasadiya/mcpsec)
+[![Bugs Reported](https://img.shields.io/badge/bugs%20reported-15+-red)](https://github.com/manthanghasadiya/mcpsec)
 [![Fuzz Cases](https://img.shields.io/badge/fuzz%20cases-800+-orange)](https://github.com/manthanghasadiya/mcpsec)
+[![Sink Patterns](https://img.shields.io/badge/sink%20patterns-3,450+-blueviolet)](https://github.com/manthanghasadiya/mcpsec)
 [![Semgrep Rules](https://img.shields.io/badge/semgrep%20rules-149-purple)](https://github.com/manthanghasadiya/mcpsec)
 
-[Installation](#installation) • [Quick Start](#quick-start) • [Scanners](#scanners) • [Fuzzing](#fuzz-generators)
+[Installation](#installation) • [Quick Start](#quick-start) • [Audit v3](#static-analysis-audit-v3) • [Scanners](#scanners) • [Fuzzing](#fuzz-generators)
 
 </div>
 
@@ -76,14 +78,18 @@ Most MCP security tools do static analysis. **mcpsec connects to live servers an
 
 ## Real Bugs Found
 
-| Target | Vulnerability | Status |
-|--------|---------------|--------|
-| **MCP Python SDK** | ClosedResourceError DoS (invalid UTF-8) | [Issue #2328](https://github.com/modelcontextprotocol/python-sdk/issues/2328) - Fix in [PR #2334](https://github.com/modelcontextprotocol/python-sdk/pull/2334) |
-| **radare2-mcp** | Multiple SIGSEGV via params type confusion | [Issue #42](https://github.com/radareorg/radare2-mcp/issues/42) |
-| MCP Python SDK | UnicodeDecodeError DoS | [Fixed - PR #2302](https://github.com/modelcontextprotocol/python-sdk/pull/2302) |
-| mcp-server-fetch | 61 crash cases, exception handling DoS | [Issue #3359](https://github.com/modelcontextprotocol/servers/issues/3359) |
-| mcp-server-git | 61 crash cases | [Issue #3359](https://github.com/modelcontextprotocol/servers/issues/3359) |
-| MCP TypeScript SDK | EPIPE crash | [Issue #1564](https://github.com/modelcontextprotocol/typescript-sdk/issues/1564) |
+| Target | Vulnerability | Severity | Status |
+|--------|---------------|----------|--------|
+| **mobile-mcp** | URL Scheme Injection (CVE-2026-35394, CVSS 8.3) - Arbitrary code execution via unsanitized tool input | High | [Fixed - PR #299](https://github.com/mobile-next/mobile-mcp/pull/299) |
+| **MCP Python SDK** | ClosedResourceError DoS (invalid UTF-8) | High | [Issue #2328](https://github.com/modelcontextprotocol/python-sdk/issues/2328) - Fix in [PR #2334](https://github.com/modelcontextprotocol/python-sdk/pull/2334) |
+| **radare2-mcp** | Arbitrary RCE via shell escape (!) in run_command/run_javascript | Critical | [Issue #45](https://github.com/radareorg/radare2-mcp/issues/45) - Fixed in [commit 482cde6](https://github.com/radareorg/radare2-mcp/commit/482cde6) |
+| **radare2-mcp** | Multiple SIGSEGV via params type confusion | High | [Issue #42](https://github.com/radareorg/radare2-mcp/issues/42) |
+| **radare2-mcp** | SIGSEGV in initialize via params type confusion | High | [Issue #52](https://github.com/radareorg/radare2-mcp/issues/52) |
+| MCP Python SDK | UnicodeDecodeError DoS | Medium | [Fixed - PR #2302](https://github.com/modelcontextprotocol/python-sdk/pull/2302) |
+| mcp-server-fetch | 61 crash cases, exception handling DoS | High | [Issue #3359](https://github.com/modelcontextprotocol/servers/issues/3359) |
+| mcp-server-git | 61 crash cases | High | [Issue #3359](https://github.com/modelcontextprotocol/servers/issues/3359) |
+| MCP TypeScript SDK | EPIPE crash | Medium | [Issue #1564](https://github.com/modelcontextprotocol/typescript-sdk/issues/1564) |
+| MCP TypeScript SDK | Integer overflow DoS (MAX_SAFE_INTEGER+1) | Medium | [Issue #1765](https://github.com/modelcontextprotocol/typescript-sdk/issues/1765) |
 
 More findings under responsible disclosure.
 
@@ -126,6 +132,21 @@ mcpsec scan --auto
 mcpsec info --stdio "python my_server.py"
 ```
 
+### Static Analysis (Audit v3)
+```bash
+# Local source - pattern-based + AI reachability
+mcpsec audit --path ./my-mcp-server
+
+# GitHub repository
+mcpsec audit --github https://github.com/user/mcp-server
+
+# With LLM-powered taint analysis
+mcpsec audit --github https://github.com/user/mcp-server --ai
+
+# Known vulnerable servers
+mcpsec audit --github https://github.com/radareorg/radare2-mcp
+```
+
 ### Protocol Fuzzing
 ```bash
 # Standard fuzzing (~200 cases)
@@ -138,18 +159,6 @@ mcpsec fuzz --stdio "python my_server.py" --intensity high
 mcpsec fuzz --stdio "python my_server.py" --ai
 ```
 
-### Static Analysis
-```bash
-# Local source
-mcpsec audit --path ./my-mcp-server
-
-# GitHub repository
-mcpsec audit --github https://github.com/user/mcp-server
-
-# With AI validation
-mcpsec audit --github https://github.com/user/mcp-server --ai
-```
-
 ### Advanced
 ```bash
 # SQL Injection scanner with DB fingerprinting
@@ -167,6 +176,55 @@ mcpsec rogue-server --port 9999 --attack all
 
 ---
 
+## Static Analysis - Audit v3
+
+> **New in v2.7.1** - Complete rewrite of the audit engine with a pattern-based architecture.
+
+### 7-Stage Analysis Pipeline
+
+```
+Source Code
+    │
+    ├─ 1. Fetch        - Clone GitHub repo or load local path
+    ├─ 2. Detect       - Identify language, MCP SDK, and framework
+    ├─ 3. Sink Scan    - 3,450+ regex patterns across 12 languages
+    ├─ 4. Semgrep      - 149 semantic rules (AST-level)
+    ├─ 5. AST          - Python/JS taint flow analysis
+    ├─ 6. Reachability - LLM taint tracing (heuristic fallback)
+    └─ 7. Deduplicate  - Merge, rank, and report findings
+```
+
+### Pattern Database - 3,450+ Sink Patterns
+
+| Vulnerability Class | Patterns | Languages |
+|--------------------|----------|-----------|
+| Command Injection   | 181      | Python, JS/TS, Go, Rust, Java, C, C#, Ruby, PHP |
+| SQL / NoSQL Injection | ~100   | All drivers + ORM-specific (Sequelize, SQLAlchemy, Drizzle, Kysely) |
+| Path Traversal      | ~60      | fs, aiofiles, Deno, Bun, tarfile, ZipSlip |
+| SSRF                | ~80      | requests, httpx, aiohttp, gRPC, OkHttp, WebSocket, got |
+| Deserialization     | ~60      | pickle, YAML, torch.load, numpy, joblib, BinaryFormatter |
+| Code Execution      | ~50      | eval, vm, exec, DOM XSS, format strings |
+| Template Injection  | ~30      | Jinja2, Pug, EJS, Handlebars, Lodash, ERB, Velocity, Thymeleaf |
+| Crypto Weaknesses   | ~40      | MD5/SHA-1, RC4, weak keys, JWT `none` alg |
+| XXE                 | ~25      | lxml, untangle, DOMDocument, SAXParser |
+| Log/Header/LDAP     | ~50      | All major frameworks |
+| Prototype Pollution | ~15      | Object.assign, deepmerge, `__proto__` |
+| Sanitizers          | 105      | Command, SQL, Path, XSS sanitizers (Python, JS, Go, Rust) |
+| MCP-Specific        | ~45      | Tool args → sinks, prompt/resource handlers (20+ SDKs) |
+
+### Framework Detection
+
+Automatically identifies:
+- **MCP SDKs**: `@modelcontextprotocol/sdk`, `mcp` (Python), `mcp-go`, `rmcp` (Rust), `mcpx` (C#)
+- **Languages**: TypeScript, JavaScript, Python, Go, Rust, Java, C#, PHP, Ruby, C/C++
+- **Frameworks**: Express, FastAPI, Django, Gin, Axum, Spring Boot, ASP.NET
+
+### Heuristic Fallback
+
+When no LLM is configured, the reachability analyzer uses **confidence scoring** to report findings without false silence - high-confidence patterns (CRITICAL/HIGH + direct taint) are always reported.
+
+---
+
 ## Scanners
 
 | Scanner | Description |
@@ -198,21 +256,9 @@ mcpsec rogue-server --port 9999 --attack all
 
 **Medium (~200 cases):** + `session_attacks`, `encoding_attacks`, `integer_boundaries`
 
-**High (~800 cases):** + `injection_payloads`, `method_mutations`, `param_mutations`, `timing_attacks`, `header_mutations`, `json_edge_cases`, `protocol_state`, `protocol_state_machine`, `id_confusion`, `concurrency_attacks`, `regex_dos`, `deserialization`
-
-**Insane (~1500+ cases):** + `resource_exhaustion`, `memory_exhaustion_v2`
-
----
-
-## Static Analysis (149 Semgrep Rules)
-
-24 rule files covering:
+**High (~800 cases):** + `injection_payloads`, `method_mutations`, `param_mutations`, `timing_attacks`, `header_mutations`, `json_edge_cases`, `protocol_state`, `id_confusion`, `concurrency_attacks`, `regex_dos`, `deserialization`
 
-- **Injection:** Command injection (JS, Go, Rust, .NET, Python, Python async), SQL injection (all drivers + ORM bypass), path traversal
-- **Network:** SSRF patterns, resource URI issues
-- **Secrets:** AWS keys, API tokens, JWT secrets, connection strings, private keys
-- **MCP-Specific:** Dangerous tool names, empty schemas, input reflection, missing auth
-- **Code Quality:** Security TODOs, empty catches, TLS disabled, CORS *, ReDoS patterns
+**Insane (~1500+ cases):** + `resource_exhaustion`, `memory_exhaustion`
 
 ---
 
@@ -225,9 +271,10 @@ mcpsec rogue-server --port 9999 --attack all
 └────┬────┘                       └────────────┘
      │
      ├── Connect & enumerate attack surface
-     ├── Run 10+ security scanners  
+     ├── Run 10+ security scanners
      ├── Generate 800+ fuzz cases
      ├── Execute AI-powered payload mutations
+     ├── Static audit: 3,450+ sink patterns + 149 Semgrep rules
      └── Report findings with PoC evidence
 ```
 
@@ -252,71 +299,7 @@ mcpsec fuzz --stdio "server" --output results.sarif
 
 ---
 
-## Changelog
-
-### v2.6.1 (2026-03-20)
-- CI/CD pipeline with GitHub Actions for automated testing and PyPI releases
-- PR and Issue templates for better community contributions
-- Nix package support via `shell.nix` for reproducible builds (@AbhiTheModder)
-- Environment variables now properly inherited in `mcp_client.py` (@AbhiTheModder)
-
-### v2.6.0 (2026-03-13)
-- **Auto-Discovery Scanner**: New `--auto` flag to automatically find and scan MCP servers from Claude, Cursor, VS Code, Windsurf, etc.
-- **Windows Unicode Fixes**: Comprehensive fix for `UnicodeEncodeError` on Windows consoles.
-- **Pydantic Compatibility**: Resolved `AttributeError` for custom metadata in scan results.
-
-### v2.5.0 (2026-03-04)
-- **New Scanners**: `code-execution`, `template-injection`, `rag-poisoning`, `idor`, `info-leak`, `deserialization`
-- **Confirmation Proofs**: Added `mcpsec_cmd_success` execution anchor for command injection
-- **SSRF Expansion**: Support for `file://` protocol and generic fetch success indicators
-- **Robust Parameter Handling**: Automatic dummy argument generation for complex tool schemas
-- **Enhanced Classification**: Massive reduction in false positives for blocked/sandboxed tools
-
-### v2.4.0 (2026-02-28)
-- **SAST Rules Expansion**: 87 new Semgrep rules → **149 total** across 24 rule files
-- Broad patterns for command injection, path traversal, SQL injection, SSRF, deserialization
-- Secrets detection: AWS keys, AI API keys, GitHub/Slack tokens, JWT secrets
-- MCP-specific rules: dangerous tool names, empty schemas, error leaks, input reflection
-- Code smells: security TODOs, empty catches, TLS disabled, CORS *, ReDoS patterns
-
-### v2.3.0 (2026-02-28)
-- **Scanner Nuclear Expansion**: Command injection (138), path traversal (104), SSRF (81) payloads
-- Encoding bypasses, protocol smuggling, shell-specific evasion
-- 5 new fuzz generators: integer boundaries, concurrency, memory exhaustion, regex DoS, deserialization
-- SDK-specific Semgrep rules for Go, Rust, Python async, .NET
-
-### v2.2.0 (2026-02-28)
-- **SARIF 2.1.0 Output** for CI/CD integration
-- CWE mapping and severity scoring
-- Audit report export with `--output` and `--format` flags
-
-### v2.1.0 (2026-02-27)
-- **AI Exploitation Assistant**: `select`, `run`, `next`, `verdict`, `auto` REPL commands
-- Expert controls: `edit`, `aggressive`, `hint` for complex bypasses
-- AI learns from manual `call` commands and response history
-
-### v2.0.3 (2026-02-26)
-- **MCP Repeater**: Interactive REPL for manual/semi-auto finding validation
-- AI payload engine with context-aware recommendations
-- Exploit playbooks for SQLi, RCE, SSRF, path traversal
-- Automated evidence capture and PoC generation
-
-<details>
-<summary>Earlier versions</summary>
-
-### v2.0.2 (2026-02-26)
-- Tool chain analysis for dangerous combinations
-- Cross-platform Windows support improvements
-
-### v2.0.1 (2026-02-25)
-- Advanced SQL scanner with modular detection
-- DB fingerprinting for MySQL, Postgres, MSSQL, SQLite
-
-### v2.0.0 (2026-02-24)
-- Fuzzing engine v2 with chained state-machine exploration
-- AI-powered validation of security findings
-
-</details>
+See [CHANGELOG.md](CHANGELOG.md) for the full release history.
 
 ---
 
@@ -324,7 +307,7 @@ mcpsec fuzz --stdio "server" --output results.sarif
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
 
-CI runs automatically on all PRs — linting with Ruff and cross-platform tests (Ubuntu, Windows, macOS).
+CI runs automatically on all PRs - linting with Ruff and cross-platform tests (Ubuntu, Windows, macOS).
 
 ---
 

{mcpsec-2.7.0 → mcpsec-2.7.2}/README.md

@@ -8,12 +8,14 @@
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![PyPI](https://img.shields.io/pypi/v/mcpsec)](https://pypi.org/project/mcpsec/)
 [![CI](https://github.com/manthanghasadiya/mcpsec/actions/workflows/ci.yml/badge.svg)](https://github.com/manthanghasadiya/mcpsec/actions/workflows/ci.yml)
-[![Bugs Fixed](https://img.shields.io/badge/bugs%20fixed-4-green)](https://github.com/manthanghasadiya/mcpsec)
-[![Bugs Reported](https://img.shields.io/badge/bugs%20reported-14+-red)](https://github.com/manthanghasadiya/mcpsec)
+[![CVEs](https://img.shields.io/badge/CVEs-6-critical)](https://github.com/manthanghasadiya/mcpsec)
+[![Bugs Fixed](https://img.shields.io/badge/bugs%20fixed-10-green)](https://github.com/manthanghasadiya/mcpsec)
+[![Bugs Reported](https://img.shields.io/badge/bugs%20reported-15+-red)](https://github.com/manthanghasadiya/mcpsec)
 [![Fuzz Cases](https://img.shields.io/badge/fuzz%20cases-800+-orange)](https://github.com/manthanghasadiya/mcpsec)
+[![Sink Patterns](https://img.shields.io/badge/sink%20patterns-3,450+-blueviolet)](https://github.com/manthanghasadiya/mcpsec)
 [![Semgrep Rules](https://img.shields.io/badge/semgrep%20rules-149-purple)](https://github.com/manthanghasadiya/mcpsec)
 
-[Installation](#installation) • [Quick Start](#quick-start) • [Scanners](#scanners) • [Fuzzing](#fuzz-generators)
+[Installation](#installation) • [Quick Start](#quick-start) • [Audit v3](#static-analysis-audit-v3) • [Scanners](#scanners) • [Fuzzing](#fuzz-generators)
 
 </div>
 
@@ -31,14 +33,18 @@ Most MCP security tools do static analysis. **mcpsec connects to live servers an
 
 ## Real Bugs Found
 
-| Target | Vulnerability | Status |
-|--------|---------------|--------|
-| **MCP Python SDK** | ClosedResourceError DoS (invalid UTF-8) | [Issue #2328](https://github.com/modelcontextprotocol/python-sdk/issues/2328) - Fix in [PR #2334](https://github.com/modelcontextprotocol/python-sdk/pull/2334) |
-| **radare2-mcp** | Multiple SIGSEGV via params type confusion | [Issue #42](https://github.com/radareorg/radare2-mcp/issues/42) |
-| MCP Python SDK | UnicodeDecodeError DoS | [Fixed - PR #2302](https://github.com/modelcontextprotocol/python-sdk/pull/2302) |
-| mcp-server-fetch | 61 crash cases, exception handling DoS | [Issue #3359](https://github.com/modelcontextprotocol/servers/issues/3359) |
-| mcp-server-git | 61 crash cases | [Issue #3359](https://github.com/modelcontextprotocol/servers/issues/3359) |
-| MCP TypeScript SDK | EPIPE crash | [Issue #1564](https://github.com/modelcontextprotocol/typescript-sdk/issues/1564) |
+| Target | Vulnerability | Severity | Status |
+|--------|---------------|----------|--------|
+| **mobile-mcp** | URL Scheme Injection (CVE-2026-35394, CVSS 8.3) - Arbitrary code execution via unsanitized tool input | High | [Fixed - PR #299](https://github.com/mobile-next/mobile-mcp/pull/299) |
+| **MCP Python SDK** | ClosedResourceError DoS (invalid UTF-8) | High | [Issue #2328](https://github.com/modelcontextprotocol/python-sdk/issues/2328) - Fix in [PR #2334](https://github.com/modelcontextprotocol/python-sdk/pull/2334) |
+| **radare2-mcp** | Arbitrary RCE via shell escape (!) in run_command/run_javascript | Critical | [Issue #45](https://github.com/radareorg/radare2-mcp/issues/45) - Fixed in [commit 482cde6](https://github.com/radareorg/radare2-mcp/commit/482cde6) |
+| **radare2-mcp** | Multiple SIGSEGV via params type confusion | High | [Issue #42](https://github.com/radareorg/radare2-mcp/issues/42) |
+| **radare2-mcp** | SIGSEGV in initialize via params type confusion | High | [Issue #52](https://github.com/radareorg/radare2-mcp/issues/52) |
+| MCP Python SDK | UnicodeDecodeError DoS | Medium | [Fixed - PR #2302](https://github.com/modelcontextprotocol/python-sdk/pull/2302) |
+| mcp-server-fetch | 61 crash cases, exception handling DoS | High | [Issue #3359](https://github.com/modelcontextprotocol/servers/issues/3359) |
+| mcp-server-git | 61 crash cases | High | [Issue #3359](https://github.com/modelcontextprotocol/servers/issues/3359) |
+| MCP TypeScript SDK | EPIPE crash | Medium | [Issue #1564](https://github.com/modelcontextprotocol/typescript-sdk/issues/1564) |
+| MCP TypeScript SDK | Integer overflow DoS (MAX_SAFE_INTEGER+1) | Medium | [Issue #1765](https://github.com/modelcontextprotocol/typescript-sdk/issues/1765) |
 
 More findings under responsible disclosure.
 
@@ -81,6 +87,21 @@ mcpsec scan --auto
 mcpsec info --stdio "python my_server.py"
 ```
 
+### Static Analysis (Audit v3)
+```bash
+# Local source - pattern-based + AI reachability
+mcpsec audit --path ./my-mcp-server
+
+# GitHub repository
+mcpsec audit --github https://github.com/user/mcp-server
+
+# With LLM-powered taint analysis
+mcpsec audit --github https://github.com/user/mcp-server --ai
+
+# Known vulnerable servers
+mcpsec audit --github https://github.com/radareorg/radare2-mcp
+```
+
 ### Protocol Fuzzing
 ```bash
 # Standard fuzzing (~200 cases)
@@ -93,18 +114,6 @@ mcpsec fuzz --stdio "python my_server.py" --intensity high
 mcpsec fuzz --stdio "python my_server.py" --ai
 ```
 
-### Static Analysis
-```bash
-# Local source
-mcpsec audit --path ./my-mcp-server
-
-# GitHub repository
-mcpsec audit --github https://github.com/user/mcp-server
-
-# With AI validation
-mcpsec audit --github https://github.com/user/mcp-server --ai
-```
-
 ### Advanced
 ```bash
 # SQL Injection scanner with DB fingerprinting
@@ -122,6 +131,55 @@ mcpsec rogue-server --port 9999 --attack all
 
 ---
 
+## Static Analysis - Audit v3
+
+> **New in v2.7.1** - Complete rewrite of the audit engine with a pattern-based architecture.
+
+### 7-Stage Analysis Pipeline
+
+```
+Source Code
+    │
+    ├─ 1. Fetch        - Clone GitHub repo or load local path
+    ├─ 2. Detect       - Identify language, MCP SDK, and framework
+    ├─ 3. Sink Scan    - 3,450+ regex patterns across 12 languages
+    ├─ 4. Semgrep      - 149 semantic rules (AST-level)
+    ├─ 5. AST          - Python/JS taint flow analysis
+    ├─ 6. Reachability - LLM taint tracing (heuristic fallback)
+    └─ 7. Deduplicate  - Merge, rank, and report findings
+```
+
+### Pattern Database - 3,450+ Sink Patterns
+
+| Vulnerability Class | Patterns | Languages |
+|--------------------|----------|-----------|
+| Command Injection   | 181      | Python, JS/TS, Go, Rust, Java, C, C#, Ruby, PHP |
+| SQL / NoSQL Injection | ~100   | All drivers + ORM-specific (Sequelize, SQLAlchemy, Drizzle, Kysely) |
+| Path Traversal      | ~60      | fs, aiofiles, Deno, Bun, tarfile, ZipSlip |
+| SSRF                | ~80      | requests, httpx, aiohttp, gRPC, OkHttp, WebSocket, got |
+| Deserialization     | ~60      | pickle, YAML, torch.load, numpy, joblib, BinaryFormatter |
+| Code Execution      | ~50      | eval, vm, exec, DOM XSS, format strings |
+| Template Injection  | ~30      | Jinja2, Pug, EJS, Handlebars, Lodash, ERB, Velocity, Thymeleaf |
+| Crypto Weaknesses   | ~40      | MD5/SHA-1, RC4, weak keys, JWT `none` alg |
+| XXE                 | ~25      | lxml, untangle, DOMDocument, SAXParser |
+| Log/Header/LDAP     | ~50      | All major frameworks |
+| Prototype Pollution | ~15      | Object.assign, deepmerge, `__proto__` |
+| Sanitizers          | 105      | Command, SQL, Path, XSS sanitizers (Python, JS, Go, Rust) |
+| MCP-Specific        | ~45      | Tool args → sinks, prompt/resource handlers (20+ SDKs) |
+
+### Framework Detection
+
+Automatically identifies:
+- **MCP SDKs**: `@modelcontextprotocol/sdk`, `mcp` (Python), `mcp-go`, `rmcp` (Rust), `mcpx` (C#)
+- **Languages**: TypeScript, JavaScript, Python, Go, Rust, Java, C#, PHP, Ruby, C/C++
+- **Frameworks**: Express, FastAPI, Django, Gin, Axum, Spring Boot, ASP.NET
+
+### Heuristic Fallback
+
+When no LLM is configured, the reachability analyzer uses **confidence scoring** to report findings without false silence - high-confidence patterns (CRITICAL/HIGH + direct taint) are always reported.
+
+---
+
 ## Scanners
 
 | Scanner | Description |
@@ -153,21 +211,9 @@ mcpsec rogue-server --port 9999 --attack all
 
 **Medium (~200 cases):** + `session_attacks`, `encoding_attacks`, `integer_boundaries`
 
-**High (~800 cases):** + `injection_payloads`, `method_mutations`, `param_mutations`, `timing_attacks`, `header_mutations`, `json_edge_cases`, `protocol_state`, `protocol_state_machine`, `id_confusion`, `concurrency_attacks`, `regex_dos`, `deserialization`
-
-**Insane (~1500+ cases):** + `resource_exhaustion`, `memory_exhaustion_v2`
-
----
-
-## Static Analysis (149 Semgrep Rules)
-
-24 rule files covering:
+**High (~800 cases):** + `injection_payloads`, `method_mutations`, `param_mutations`, `timing_attacks`, `header_mutations`, `json_edge_cases`, `protocol_state`, `id_confusion`, `concurrency_attacks`, `regex_dos`, `deserialization`
 
-- **Injection:** Command injection (JS, Go, Rust, .NET, Python, Python async), SQL injection (all drivers + ORM bypass), path traversal
-- **Network:** SSRF patterns, resource URI issues
-- **Secrets:** AWS keys, API tokens, JWT secrets, connection strings, private keys
-- **MCP-Specific:** Dangerous tool names, empty schemas, input reflection, missing auth
-- **Code Quality:** Security TODOs, empty catches, TLS disabled, CORS *, ReDoS patterns
+**Insane (~1500+ cases):** + `resource_exhaustion`, `memory_exhaustion`
 
 ---
 
@@ -180,9 +226,10 @@ mcpsec rogue-server --port 9999 --attack all
 └────┬────┘                       └────────────┘
      │
      ├── Connect & enumerate attack surface
-     ├── Run 10+ security scanners  
+     ├── Run 10+ security scanners
      ├── Generate 800+ fuzz cases
      ├── Execute AI-powered payload mutations
+     ├── Static audit: 3,450+ sink patterns + 149 Semgrep rules
      └── Report findings with PoC evidence
 ```
 
@@ -207,71 +254,7 @@ mcpsec fuzz --stdio "server" --output results.sarif
 
 ---
 
-## Changelog
-
-### v2.6.1 (2026-03-20)
-- CI/CD pipeline with GitHub Actions for automated testing and PyPI releases
-- PR and Issue templates for better community contributions
-- Nix package support via `shell.nix` for reproducible builds (@AbhiTheModder)
-- Environment variables now properly inherited in `mcp_client.py` (@AbhiTheModder)
-
-### v2.6.0 (2026-03-13)
-- **Auto-Discovery Scanner**: New `--auto` flag to automatically find and scan MCP servers from Claude, Cursor, VS Code, Windsurf, etc.
-- **Windows Unicode Fixes**: Comprehensive fix for `UnicodeEncodeError` on Windows consoles.
-- **Pydantic Compatibility**: Resolved `AttributeError` for custom metadata in scan results.
-
-### v2.5.0 (2026-03-04)
-- **New Scanners**: `code-execution`, `template-injection`, `rag-poisoning`, `idor`, `info-leak`, `deserialization`
-- **Confirmation Proofs**: Added `mcpsec_cmd_success` execution anchor for command injection
-- **SSRF Expansion**: Support for `file://` protocol and generic fetch success indicators
-- **Robust Parameter Handling**: Automatic dummy argument generation for complex tool schemas
-- **Enhanced Classification**: Massive reduction in false positives for blocked/sandboxed tools
-
-### v2.4.0 (2026-02-28)
-- **SAST Rules Expansion**: 87 new Semgrep rules → **149 total** across 24 rule files
-- Broad patterns for command injection, path traversal, SQL injection, SSRF, deserialization
-- Secrets detection: AWS keys, AI API keys, GitHub/Slack tokens, JWT secrets
-- MCP-specific rules: dangerous tool names, empty schemas, error leaks, input reflection
-- Code smells: security TODOs, empty catches, TLS disabled, CORS *, ReDoS patterns
-
-### v2.3.0 (2026-02-28)
-- **Scanner Nuclear Expansion**: Command injection (138), path traversal (104), SSRF (81) payloads
-- Encoding bypasses, protocol smuggling, shell-specific evasion
-- 5 new fuzz generators: integer boundaries, concurrency, memory exhaustion, regex DoS, deserialization
-- SDK-specific Semgrep rules for Go, Rust, Python async, .NET
-
-### v2.2.0 (2026-02-28)
-- **SARIF 2.1.0 Output** for CI/CD integration
-- CWE mapping and severity scoring
-- Audit report export with `--output` and `--format` flags
-
-### v2.1.0 (2026-02-27)
-- **AI Exploitation Assistant**: `select`, `run`, `next`, `verdict`, `auto` REPL commands
-- Expert controls: `edit`, `aggressive`, `hint` for complex bypasses
-- AI learns from manual `call` commands and response history
-
-### v2.0.3 (2026-02-26)
-- **MCP Repeater**: Interactive REPL for manual/semi-auto finding validation
-- AI payload engine with context-aware recommendations
-- Exploit playbooks for SQLi, RCE, SSRF, path traversal
-- Automated evidence capture and PoC generation
-
-<details>
-<summary>Earlier versions</summary>
-
-### v2.0.2 (2026-02-26)
-- Tool chain analysis for dangerous combinations
-- Cross-platform Windows support improvements
-
-### v2.0.1 (2026-02-25)
-- Advanced SQL scanner with modular detection
-- DB fingerprinting for MySQL, Postgres, MSSQL, SQLite
-
-### v2.0.0 (2026-02-24)
-- Fuzzing engine v2 with chained state-machine exploration
-- AI-powered validation of security findings
-
-</details>
+See [CHANGELOG.md](CHANGELOG.md) for the full release history.
 
 ---
 
@@ -279,7 +262,7 @@ mcpsec fuzz --stdio "server" --output results.sarif
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
 
-CI runs automatically on all PRs — linting with Ruff and cross-platform tests (Ubuntu, Windows, macOS).
+CI runs automatically on all PRs - linting with Ruff and cross-platform tests (Ubuntu, Windows, macOS).
 
 ---
 

mcpsec-2.7.2/mcpsec/__init__.py

@@ -0,0 +1,11 @@
+"""mcpsec — Security scanner for MCP server implementations."""
+
+__version__ = "2.7.2"
+
+
+import sys
+if hasattr(sys.stdout, 'reconfigure'):
+    try:
+        sys.stdout.reconfigure(encoding='utf-8')
+    except Exception:
+        pass

{mcpsec-2.7.0 → mcpsec-2.7.2}/mcpsec/ai/ai_payload_generator.py

@@ -1,11 +1,15 @@
 """AI payload generator — creates targeted exploits per MCP tool."""
 
+import logging
 import json
 import re
 from typing import Any, Dict, List
 
 from mcpsec.ai.llm_client import LLMClient
 
+logger = logging.getLogger(__name__)
+
+
 PAYLOAD_SYSTEM_PROMPT = """You are a penetration tester generating exploit payloads for MCP 
 (Model Context Protocol) server tools. You generate TARGETED payloads, not generic 
 fuzz strings. Every payload must have a clear hypothesis about what vulnerability 
@@ -131,9 +135,8 @@ Respond ONLY with JSON array."""
             items = json.loads(cleaned)
             if isinstance(items, list):
                 return [i for i in items if isinstance(i, dict) and "payload" in i]
-        except json.JSONDecodeError:
-            pass
-
+        except json.JSONDecodeError as e:
+            logger.debug(f"Exception caught: {e}")
         # Try to find JSON array in the response
         # Handle case where LLM wraps response in explanation text
         bracket_start = cleaned.find("[")
@@ -145,9 +148,8 @@ Respond ONLY with JSON array."""
                 items = json.loads(json_str)
                 if isinstance(items, list):
                     return [i for i in items if isinstance(i, dict) and "payload" in i]
-            except json.JSONDecodeError:
-                pass
-
+            except json.JSONDecodeError as e:
+                logger.debug(f"Exception caught: {e}")
         # Last resort: try to find individual JSON objects
         # Some LLMs return one object per line
         items = []
@@ -160,3 +162,5 @@ Respond ONLY with JSON array."""
                 continue
 
         return items
+
+