mpak-scanner 0.2.2__tar.gz → 0.2.4__tar.gz

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/.gitignore

@@ -51,6 +51,9 @@ dmypy.json
 *.mcpb
 /tmp/
 
+# Downloaded test bundles (e2e tests)
+/tests/data/
+
 # Environment
 .env
 .env.*

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/CLAUDE.md

@@ -62,7 +62,9 @@ src/mpak_scanner/
     └── capability_declaration/  # CD-01, CD-02, CD-03
 
 tests/
-├── test_scanner.py       # All tests
+├── test_scanner.py       # Unit + fixture-based integration tests
+├── test_e2e_bundles.py   # E2E tests against real registry bundles
+├── data/                 # Downloaded bundles for e2e tests (gitignored)
 └── fixtures/             # Test bundles (see fixtures/README.md)
     ├── clean-l1-bundle/      # Passes Level 1
     ├── has-secrets-bundle/   # Fails CQ-01
@@ -128,35 +130,58 @@ Located in `tests/fixtures/`. Each fixture tests specific controls:
 - `node-server-bundle/` - Clean Node.js bundle, passes CQ-05
 - `unsafe-node-bundle/` - Contains unsafe patterns (CQ-05 should fail)
 
+## E2E Tests
+
+End-to-end tests scan real bundles pulled from the mpak registry. They catch false positives and regressions that synthetic fixtures miss.
+
+### Setup (one-time)
+
+```bash
+mpak bundle pull @nimblebraininc/finnhub -o tests/data/finnhub.mcpb
+mpak bundle pull @nimblebraininc/folk -o tests/data/folk.mcpb
+mpak bundle pull @nimblebraininc/nationalparks -o tests/data/nationalparks.mcpb
+```
+
+Bundles are stored in `tests/data/` (gitignored). Tests skip gracefully if bundles are missing.
+
+### Running
+
+```bash
+uv run pytest -m e2e -v              # e2e tests only
+uv run pytest tests/test_scanner.py  # unit tests only (fast)
+uv run pytest                        # all tests (unit + e2e)
+```
+
+### Adding new e2e bundles
+
+1. `mpak bundle pull @scope/name -o tests/data/name.mcpb`
+2. Add a `pytest.param()` entry to the appropriate list in `test_e2e_bundles.py`
+
 ## Releasing a New Version
 
 The scanner is distributed via PyPI. The Docker image installs from PyPI, not local source.
 
 ### Steps
 
-1. **Bump version** in three files (must match):
+1. **Bump version** in four files (must all match):
    - `pyproject.toml` (`version = "X.Y.Z"`)
    - `src/mpak_scanner/__init__.py` (`__version__ = "X.Y.Z"`)
    - `src/mpak_scanner/scanner.py` (`SCANNER_VERSION = "X.Y.Z"`)
+   - `Dockerfile` (`mpak-scanner[job]==X.Y.Z`)
 
-2. **Update Dockerfile** version pin:
-   ```dockerfile
-   RUN pip install --no-cache-dir mpak-scanner==X.Y.Z
-   ```
-
-3. **Run verification**:
+2. **Run verification**:
    ```bash
    uv run ruff check src/ tests/ && uv run ruff format --check src/ tests/ && uv run ty check src/ && uv run pytest
    ```
 
-4. **Commit and push** in `apps/mpak`
+3. **Commit and push** in `apps/mpak`
 
-5. **Publish to PyPI**:
+4. **Publish to PyPI** (from `apps/mpak/apps/scanner/`):
    ```bash
    uv build && uv publish
    ```
 
-6. **Deploy Docker image** (from `hq/deployments/mpak/`):
+5. **Build + push Docker image** (from `hq/deployments/mpak/`):
    ```bash
    make deploy-scanner ENV=production
    make apply-scanner-infra ENV=production  # only if RBAC/secrets changed

mpak_scanner-0.2.4/Dockerfile

@@ -0,0 +1,26 @@
+FROM python:3.13-slim
+
+# System deps for external security tools
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl \
+    ca-certificates \
+    git \
+    nodejs \
+    npm \
+    && rm -rf /var/lib/apt/lists/*
+
+# Anchore tools: syft (SBOM), grype (CVE scanning)
+RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin && \
+    curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
+
+# TruffleHog (secret detection)
+RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
+
+# ESLint with security plugin (JS/TS static analysis)
+RUN npm install -g eslint eslint-plugin-security --no-fund --no-audit
+
+# mpak-scanner + Python security tools (bandit, guarddog)
+RUN pip install --no-cache-dir "mpak-scanner[job]==0.2.4" bandit guarddog
+
+ENTRYPOINT ["mpak-scanner"]
+CMD ["job"]

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mpak-scanner
-Version: 0.2.2
+Version: 0.2.4
 Summary: Security scanner for MCP bundles. Powers mpak Certified verification.
 Project-URL: Homepage, https://mpak.dev
 Project-URL: Documentation, https://mpak.dev/certified

mpak_scanner-0.2.4/SCANNER_BUG_REPORT_NODE_AI05.md

@@ -0,0 +1,157 @@
+# mpak-scanner: AI-05 false positives on Node.js bundles
+
+## Summary
+
+AI-05 (Bundle Completeness) produces false-positive HIGH findings on every compiled JavaScript file in a Node.js bundle's output directory (`build/`, `dist/`). The control has Python-specific module resolution but no equivalent for Node.js, causing all non-entry-point `.js` files to be flagged as "unexpected executables." This blocks Node.js bundles from reaching L2 compliance.
+
+**Scanner version**: 0.2.3
+**Bundle tested**: `@nimblebraininc/nationalparks@0.2.0` (Node.js, TypeScript)
+
+## Reproduction
+
+```bash
+# Build a Node.js MCPB bundle (any multi-file TypeScript server)
+cd mcp-servers/nationalparks
+npm ci && npm run build && npm prune --omit=dev
+mcpb pack . test.mcpb
+
+# Scan it
+uvx mpak-scanner scan test.mcpb --json
+```
+
+**Result**: AI-05 FAIL with 11 HIGH findings. Every `.js` file in `build/` except the entry point is flagged:
+
+```
+[HIGH] Unexpected executable: build/constants.js
+[HIGH] Unexpected executable: build/formatters.js
+[HIGH] Unexpected executable: build/config.js
+[HIGH] Unexpected executable: build/schemas.js
+[HIGH] Unexpected executable: build/utils/npsApiClient.js
+[HIGH] Unexpected executable: build/handlers/getAlerts.js
+[HIGH] Unexpected executable: build/handlers/getParkDetails.js
+[HIGH] Unexpected executable: build/handlers/getEvents.js
+[HIGH] Unexpected executable: build/handlers/findParks.js
+[HIGH] Unexpected executable: build/handlers/getCampgrounds.js
+[HIGH] Unexpected executable: build/handlers/getVisitorCenters.js
+```
+
+**Expected**: AI-05 PASS. These files are standard Node.js modules imported by the entry point (`build/index.js`).
+
+## Root cause
+
+`ai05_bundle_completeness.py` builds a "referenced files" set from the manifest, then flags any executable-extension file not in that set.
+
+For **Python**, `_add_python_module_files()` (line 235) resolves `python -m mcp_echo.server` into the entire `mcp_echo/` package directory tree, adding all files as referenced. This correctly covers Python's module import pattern.
+
+For **Node.js**, there is no equivalent. The referenced set only contains:
+- `server.entry_point` (e.g., `build/index.js`) -- added at line 198
+- `mcp_config.args` file-like values (e.g., `${__dirname}/build/index.js` cleaned to `build/index.js`) -- added at line 227
+
+But `build/index.js` imports sibling modules (`./config.js`, `./schemas.js`, `./handlers/findParks.js`, etc.) via standard ES module `import` statements. These are never added to the referenced set.
+
+### Code path
+
+```
+_build_referenced_files()
+  ├── server.entry_point → "build/index.js"           ✓ added
+  ├── mcp_config.args → "${__dirname}/build/index.js"  ✓ added (duplicate)
+  ├── Python -m detection → _add_python_module_files() ✓ adds whole package
+  └── Node.js entry_point → (nothing)                  ✗ missing
+```
+
+### Why node_modules isn't affected
+
+`node_modules/` is correctly allowed via `DEP_DIRS` on line 42 / `_is_in_dep_dir()` on line 296. The problem is limited to the server's own compiled output directory.
+
+## Proposed fix
+
+Add `_add_node_entry_point_files()` analogous to `_add_python_module_files()`:
+
+```python
+def _add_node_entry_point_files(
+    self, entry_point: str, bundle_dir: Path, referenced: set[str]
+) -> None:
+    """Resolve a Node.js entry point to its sibling modules.
+
+    TypeScript compiles to a directory (build/, dist/) where the entry
+    point imports other .js files. Add all files in the entry point's
+    directory tree as referenced.
+    """
+    entry_path = bundle_dir / entry_point
+    if not entry_path.exists():
+        return
+
+    # Add all files in the entry point's parent directory tree
+    entry_dir = entry_path.parent
+    if entry_dir == bundle_dir:
+        # Entry point is at root; don't add everything
+        return
+
+    for f in entry_dir.rglob("*"):
+        if f.is_file():
+            referenced.add(str(f.relative_to(bundle_dir)).replace("\\", "/"))
+```
+
+Then call it from `_build_referenced_files()` when `server.type == "node"`:
+
+```python
+# After the entry_point handling (around line 198):
+server_type = server.get("type", "")
+if server_type == "node" and entry_point and bundle_dir:
+    self._add_node_entry_point_files(entry_point, bundle_dir, referenced)
+```
+
+### Why directory-tree resolution is correct
+
+This mirrors the Python approach:
+- **Python**: `-m mcp_echo.server` resolves to the `mcp_echo/` package, and all files in that package are added (line 251: `package_dir.rglob("*")`)
+- **Node.js**: `build/index.js` resolves to the `build/` directory, and all files in that directory are added
+
+Both languages compile/organize source into a directory where the entry point's siblings are expected runtime dependencies.
+
+### Edge case: root-level entry point
+
+If `entry_point` is `index.js` (at bundle root), we should NOT add every file in the bundle. The proposed code handles this with the `entry_dir == bundle_dir` guard.
+
+## Test fixture gap
+
+The existing `node-server-bundle` fixture only has a single file (`src/server.js`):
+
+```
+node-server-bundle/
+├── manifest.json
+└── src/server.js
+```
+
+This doesn't represent real Node.js bundles which have multi-file compiled output. A realistic fixture would look like:
+
+```
+node-server-bundle/
+├── manifest.json
+├── package.json
+├── build/
+│   ├── index.js          # entry_point
+│   ├── config.js          # imported by index.js
+│   └── handlers/
+│       └── handler.js     # imported by index.js
+└── node_modules/
+    └── some-dep/
+        ├── package.json
+        └── index.js
+```
+
+### Suggested test cases
+
+1. **Multi-file Node.js build** (should PASS): Entry point at `build/index.js` with sibling modules in `build/`
+2. **Node.js with stray script** (should FAIL): Entry point in `build/` plus an unrelated `scripts/deploy.sh` at root
+3. **Root-level entry point** (should PASS): Entry point at `index.js` with no extra files outside node_modules
+
+## Impact
+
+- Blocks all multi-file Node.js servers from L2 compliance
+- `@nimblebraininc/nationalparks` is the first Node.js server going through MCPB migration
+- All 15 other L2 controls pass; AI-05 is the sole blocker
+
+## Related: mcpb CLI excludes lockfiles
+
+Separate issue, but noted here for context: `mcpb pack` v2.1.2 hardcodes `package-lock.json` in its `EXCLUDE_PATTERNS` (`dist/node/files.js`). This prevents lockfiles from appearing in Node.js bundles, which causes SC-03/SC-04 INFO findings about missing lockfiles. SC-03 and SC-04 still PASS (SC-03 falls back to package.json parsing; SC-04 is client-enforced), but the lockfile should ideally be includable. This is an `mcpb` CLI issue, not a scanner issue.

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mpak-scanner"
-version = "0.2.2"
+version = "0.2.4"
 description = "Security scanner for MCP bundles. Powers mpak Certified verification."
 readme = "README.md"
 license = "Apache-2.0"
@@ -92,6 +92,9 @@ python-version = "3.13"
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
+markers = [
+    "e2e: end-to-end tests against real bundles from the registry (requires tests/data/)",
+]
 
 [dependency-groups]
 dev = [

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/src/mpak_scanner/__init__.py

@@ -3,5 +3,5 @@
 from mpak_scanner.models import ComplianceLevel, ControlResult, SecurityReport
 from mpak_scanner.scanner import scan_bundle
 
-__version__ = "0.2.2"
+__version__ = "0.2.4"
 __all__ = ["scan_bundle", "SecurityReport", "ControlResult", "ComplianceLevel"]

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/src/mpak_scanner/controls/artifact_integrity/ai01_manifest.py

@@ -118,7 +118,7 @@ class AI01ValidManifest(Control):
         else:
             # Validate MTF extension structure
             mtf_schema = get_mtf_schema()
-            mtf_errors = self._validate_schema({"_meta": manifest.get("_meta", {})}, mtf_schema, "MTF")
+            mtf_errors = self._validate_schema(mtf_namespace, mtf_schema, "MTF")
             for error in mtf_errors:
                 findings.append(
                     Finding(

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/src/mpak_scanner/controls/artifact_integrity/ai05_bundle_completeness.py

@@ -227,8 +227,10 @@ class AI05BundleCompleteness(Control):
                     cleaned = arg.replace("${__dirname}/", "")
                     referenced.add(cleaned)
 
-        # _meta.org.mpaktrust metadata (non-executable, always allowed)
-        # These don't need to be in the referenced set since they're not executable
+        # Node.js entry point directory resolution
+        server_type = server.get("type", "") if isinstance(server, dict) else ""
+        if server_type == "node" and entry_point and bundle_dir:
+            self._add_node_entry_point_files(entry_point, bundle_dir, referenced)
 
         return referenced
 
@@ -252,6 +254,27 @@ class AI05BundleCompleteness(Control):
                     if f.is_file():
                         referenced.add(str(f.relative_to(bundle_dir)).replace("\\", "/"))
 
+    def _add_node_entry_point_files(self, entry_point: str, bundle_dir: Path, referenced: set[str]) -> None:
+        """Resolve a Node.js entry point to its sibling modules.
+
+        TypeScript compiles to a directory (build/, dist/) where the entry
+        point imports other .js files. Add all files in the entry point's
+        directory tree as referenced.
+        """
+        entry_path = bundle_dir / entry_point
+        if not entry_path.exists():
+            return
+
+        # Add all files in the entry point's parent directory tree
+        entry_dir = entry_path.parent
+        if entry_dir == bundle_dir:
+            # Entry point is at root; don't add everything
+            return
+
+        for f in entry_dir.rglob("*"):
+            if f.is_file():
+                referenced.add(str(f.relative_to(bundle_dir)).replace("\\", "/"))
+
     def _looks_like_file(self, arg: str) -> bool:
         """Check if an argument looks like a file path."""
         # Skip flags

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/src/mpak_scanner/controls/supply_chain/sc02_vuln_scan.py

@@ -12,6 +12,7 @@ Blocking logic per MTF spec:
 """
 
 import json
+import logging
 import subprocess
 import time
 import urllib.request
@@ -21,6 +22,8 @@ from typing import Any
 from mpak_scanner.controls.base import Control, ControlRegistry
 from mpak_scanner.models import ControlResult, ControlStatus, Finding, Severity
 
+logger = logging.getLogger(__name__)
+
 # EPSS API endpoint (FIRST.org)
 EPSS_API_URL = "https://api.first.org/data/v1/epss"
 
@@ -150,6 +153,8 @@ class SC02VulnerabilityScan(Control):
             return self.error("Vulnerability scan timed out")
 
         # Grype exits non-zero if it finds vulnerabilities, but also for errors
+        stderr_preview = result.stderr[:200] if result.stderr else ""
+        logger.info("grype exit=%d stdout=%d bytes stderr=%s", result.returncode, len(result.stdout), stderr_preview)
         if result.returncode != 0 and "no packages discovered" not in result.stderr.lower():
             if not result.stdout.strip():
                 return ControlResult(

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/src/mpak_scanner/models.py

@@ -324,6 +324,7 @@ class SecurityReport:
                                 }
                                 for f in ctrl.findings
                             ],
+                            **({"error": ctrl.error} if ctrl.error else {}),
                         }
                         for ctrl_id, ctrl in domain.controls.items()
                     }

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/src/mpak_scanner/scanner.py

@@ -70,7 +70,7 @@ __all__ = ["scan_bundle", "extract_bundle"]
 logger = logging.getLogger(__name__)
 
 # Version of the scanner
-SCANNER_VERSION = "0.2.2"
+SCANNER_VERSION = "0.2.4"
 
 # Domain groupings for controls (matches MTF v0.1 spec)
 DOMAINS = {

mpak_scanner-0.2.4/tests/test_e2e_bundles.py

@@ -0,0 +1,144 @@
+"""End-to-end tests against real bundles from the mpak registry.
+
+These tests scan real published bundles to catch false positives and
+regressions that synthetic fixtures miss.
+
+Setup:
+    mpak bundle pull @nimblebraininc/finnhub -o tests/data/finnhub.mcpb
+    mpak bundle pull @nimblebraininc/folk -o tests/data/folk.mcpb
+    mpak bundle pull @nimblebraininc/nationalparks -o tests/data/nationalparks.mcpb
+
+Run:
+    uv run pytest tests/test_e2e_bundles.py -v
+    uv run pytest -m e2e -v
+"""
+
+from pathlib import Path
+
+import pytest
+
+from mpak_scanner import scan_bundle
+from mpak_scanner.models import ControlStatus, Severity
+
+DATA_DIR = Path(__file__).parent / "data"
+
+# Bundle paths
+FINNHUB = DATA_DIR / "finnhub.mcpb"
+FOLK = DATA_DIR / "folk.mcpb"
+NATIONALPARKS = DATA_DIR / "nationalparks.mcpb"
+
+ALL_BUNDLES = [
+    pytest.param(FINNHUB, id="finnhub"),
+    pytest.param(FOLK, id="folk"),
+    pytest.param(NATIONALPARKS, id="nationalparks"),
+]
+
+PYTHON_BUNDLES = [
+    pytest.param(FINNHUB, id="finnhub"),
+    pytest.param(FOLK, id="folk"),
+]
+
+NODE_BUNDLES = [
+    pytest.param(NATIONALPARKS, id="nationalparks"),
+]
+
+
+def skip_if_missing(bundle_path: Path) -> None:
+    if not bundle_path.exists():
+        pytest.skip(f"Bundle not found: {bundle_path.name} (run: mpak bundle pull ... -o {bundle_path})")
+
+
+@pytest.mark.e2e
+class TestBundleCompleteness:
+    """AI-05: Real bundles should not have false-positive unexpected executables."""
+
+    @pytest.mark.parametrize("bundle", ALL_BUNDLES)
+    def test_ai05_passes(self, bundle: Path) -> None:
+        """AI-05 should PASS on all published bundles (no false positives)."""
+        skip_if_missing(bundle)
+        report = scan_bundle(bundle)
+
+        ai05 = report.all_controls.get("AI-05")
+        assert ai05 is not None
+        assert ai05.status == ControlStatus.PASS, f"AI-05 false positives on {bundle.name}: " + ", ".join(
+            f.title for f in ai05.findings if f.severity in {Severity.HIGH, Severity.CRITICAL}
+        )
+
+    @pytest.mark.parametrize("bundle", ALL_BUNDLES)
+    def test_no_high_or_critical_in_ai05(self, bundle: Path) -> None:
+        """AI-05 should have zero HIGH/CRITICAL findings on published bundles."""
+        skip_if_missing(bundle)
+        report = scan_bundle(bundle)
+
+        ai05 = report.all_controls.get("AI-05")
+        assert ai05 is not None
+        blocking = [f for f in ai05.findings if f.severity in {Severity.HIGH, Severity.CRITICAL}]
+        assert blocking == [], f"Blocking findings on {bundle.name}: {[f.title for f in blocking]}"
+
+
+@pytest.mark.e2e
+class TestManifestValidation:
+    """AI-01: Real bundles should have valid manifests."""
+
+    @pytest.mark.parametrize("bundle", ALL_BUNDLES)
+    def test_ai01_passes(self, bundle: Path) -> None:
+        skip_if_missing(bundle)
+        report = scan_bundle(bundle)
+
+        ai01 = report.all_controls.get("AI-01")
+        assert ai01 is not None
+        assert ai01.status == ControlStatus.PASS, f"AI-01 failed on {bundle.name}: {ai01.findings}"
+
+
+@pytest.mark.e2e
+class TestSafeExecution:
+    """CQ-05: Real bundles should pass safe execution checks."""
+
+    @pytest.mark.parametrize("bundle", ALL_BUNDLES)
+    def test_cq05_passes(self, bundle: Path) -> None:
+        skip_if_missing(bundle)
+        report = scan_bundle(bundle)
+
+        cq05 = report.all_controls.get("CQ-05")
+        assert cq05 is not None
+        assert cq05.status == ControlStatus.PASS, f"CQ-05 failed on {bundle.name}: {cq05.findings}"
+
+
+@pytest.mark.e2e
+class TestFullScan:
+    """Full scan results for each bundle."""
+
+    @pytest.mark.parametrize("bundle", PYTHON_BUNDLES)
+    def test_python_bundles_no_critical_findings(self, bundle: Path) -> None:
+        """Python bundles should have no CRITICAL findings across all controls."""
+        skip_if_missing(bundle)
+        report = scan_bundle(bundle)
+
+        critical = []
+        for control_id, result in report.all_controls.items():
+            for f in result.findings:
+                if f.severity == Severity.CRITICAL:
+                    critical.append(f"{control_id}: {f.title}")
+        assert critical == [], f"Critical findings on {bundle.name}: {critical}"
+
+    @pytest.mark.parametrize("bundle", NODE_BUNDLES)
+    def test_node_bundles_no_critical_findings(self, bundle: Path) -> None:
+        """Node.js bundles should have no CRITICAL findings across all controls."""
+        skip_if_missing(bundle)
+        report = scan_bundle(bundle)
+
+        critical = []
+        for control_id, result in report.all_controls.items():
+            for f in result.findings:
+                if f.severity == Severity.CRITICAL:
+                    critical.append(f"{control_id}: {f.title}")
+        assert critical == [], f"Critical findings on {bundle.name}: {critical}"
+
+    @pytest.mark.parametrize("bundle", ALL_BUNDLES)
+    def test_scan_completes_without_errors(self, bundle: Path) -> None:
+        """Scanner should not produce ERROR status on any control."""
+        skip_if_missing(bundle)
+        report = scan_bundle(bundle)
+
+        errors = [f"{cid}: {r.findings}" for cid, r in report.all_controls.items() if r.status == ControlStatus.ERROR]
+        assert errors == [], f"Controls errored on {bundle.name}: {errors}"

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/tests/test_scanner.py

@@ -862,6 +862,93 @@ class TestAI05BundleCompleteness:
         assert result.status == ControlStatus.FAIL
         assert any("backdoor.py" in f.file for f in result.findings if f.file)
 
+    def test_node_multi_file_build_passes(self, bundle_dir: Path) -> None:
+        """Node.js entry point in build/ should treat sibling modules as referenced."""
+        manifest = {
+            "name": "@test/node-multi",
+            "version": "1.0.0",
+            "server": {
+                "type": "node",
+                "entry_point": "build/index.js",
+                "mcp_config": {
+                    "command": "node",
+                    "args": ["${__dirname}/build/index.js", "--stdio"],
+                },
+            },
+        }
+        (bundle_dir / "manifest.json").write_text(json.dumps(manifest))
+        (bundle_dir / "package.json").write_text('{"name": "test"}')
+        build = bundle_dir / "build"
+        build.mkdir()
+        (build / "index.js").write_text("import './config.js';")
+        (build / "config.js").write_text("export const cfg = {};")
+        (build / "schemas.js").write_text("export const schemas = {};")
+        handlers = build / "handlers"
+        handlers.mkdir()
+        (handlers / "findParks.js").write_text("export function findParks() {}")
+        (handlers / "getAlerts.js").write_text("export function getAlerts() {}")
+
+        from mpak_scanner.controls.artifact_integrity import AI05BundleCompleteness
+
+        control = AI05BundleCompleteness()
+        result = control.run(bundle_dir, manifest)
+        assert result.status == ControlStatus.PASS
+
+    def test_node_build_with_stray_script_fails(self, bundle_dir: Path) -> None:
+        """Node.js build/ files are allowed but stray scripts at root should fail."""
+        manifest = {
+            "name": "@test/node-stray",
+            "version": "1.0.0",
+            "server": {
+                "type": "node",
+                "entry_point": "build/index.js",
+                "mcp_config": {
+                    "command": "node",
+                    "args": ["${__dirname}/build/index.js"],
+                },
+            },
+        }
+        (bundle_dir / "manifest.json").write_text(json.dumps(manifest))
+        build = bundle_dir / "build"
+        build.mkdir()
+        (build / "index.js").write_text("console.log('ok')")
+        # Stray script outside build/
+        (bundle_dir / "deploy.sh").write_text("#!/bin/bash\nrm -rf /")
+
+        from mpak_scanner.controls.artifact_integrity import AI05BundleCompleteness
+
+        control = AI05BundleCompleteness()
+        result = control.run(bundle_dir, manifest)
+        assert result.status == ControlStatus.FAIL
+        assert any("deploy.sh" in f.file for f in result.findings if f.file)
+        # build/index.js should NOT be flagged
+        assert not any("build/index.js" in f.file for f in result.findings if f.file)
+
+    def test_node_root_entry_point_no_over_allow(self, bundle_dir: Path) -> None:
+        """Node.js entry point at root should not whitelist all files."""
+        manifest = {
+            "name": "@test/node-root",
+            "version": "1.0.0",
+            "server": {
+                "type": "node",
+                "entry_point": "index.js",
+                "mcp_config": {
+                    "command": "node",
+                    "args": ["${__dirname}/index.js"],
+                },
+            },
+        }
+        (bundle_dir / "manifest.json").write_text(json.dumps(manifest))
+        (bundle_dir / "index.js").write_text("console.log('ok')")
+        (bundle_dir / "backdoor.js").write_text("require('child_process').exec('evil')")
+
+        from mpak_scanner.controls.artifact_integrity import AI05BundleCompleteness
+
+        control = AI05BundleCompleteness()
+        result = control.run(bundle_dir, manifest)
+        assert result.status == ControlStatus.FAIL
+        assert any("backdoor.js" in f.file for f in result.findings if f.file)
+
 
 # =============================================================================
 # Fixture-based Integration Tests

{mpak_scanner-0.2.2 → mpak_scanner-0.2.4}/uv.lock

@@ -464,7 +464,7 @@ wheels = [
 
 [[package]]
 name = "mpak-scanner"
-version = "0.2.2"
+version = "0.2.4"
 source = { editable = "." }
 dependencies = [
     { name = "click" },

mpak_scanner-0.2.2/Dockerfile

@@ -1,4 +0,0 @@
-FROM python:3.13-slim
-RUN pip install --no-cache-dir "mpak-scanner[job]==0.2.2"
-ENTRYPOINT ["mpak-scanner"]
-CMD ["job"]