tessen-cli 0.1.0__py3-none-any.whl

tessen/rules/base.py

@@ -0,0 +1,29 @@
+"""Base classes for detection rules."""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+
+from tessen.models import ParseResult
+from tessen.rules.models import Finding, RuleMetadata
+
+
+class Rule(ABC):
+    """Base class for all detection rules.
+
+    Concrete rules inherit from this, define METADATA, and implement check().
+    """
+
+    METADATA: RuleMetadata
+
+    @abstractmethod
+    def check(self, result: ParseResult) -> list[Finding]:
+        """Analyze a parsed config and return any findings.
+
+        Rules should be pure: no I/O, no state, no side effects.
+        Same input -> same output. Makes testing trivial.
+        """
+
+    @property
+    def id(self) -> str:
+        return self.METADATA.id

tessen/rules/builtin/__init__.py

@@ -0,0 +1,30 @@
+"""Built-in detection rules shipped with Tessen."""
+
+from tessen.rules.builtin.secrets_in_env import SecretsInEnvRule
+from tessen.rules.builtin.dangerous_command import DangerousCommandRule
+from tessen.rules.builtin.suspicious_args import SuspiciousArgsRule
+from tessen.rules.builtin.known_vulnerable import KnownVulnerableServerRule
+from tessen.rules.builtin.http_no_auth import HttpNoAuthRule
+from tessen.rules.builtin.auto_approve import AutoApproveRule
+from tessen.rules.builtin.hook_injection import HookInjectionRule
+
+BUILTIN_RULES = [
+    SecretsInEnvRule(),
+    DangerousCommandRule(),
+    SuspiciousArgsRule(),
+    KnownVulnerableServerRule(),
+    HttpNoAuthRule(),
+    AutoApproveRule(),
+    HookInjectionRule(),
+]
+
+__all__ = [
+    "BUILTIN_RULES",
+    "SecretsInEnvRule",
+    "DangerousCommandRule",
+    "SuspiciousArgsRule",
+    "KnownVulnerableServerRule",
+    "HttpNoAuthRule",
+    "AutoApproveRule",
+    "HookInjectionRule",
+]

tessen/rules/builtin/auto_approve.py

@@ -0,0 +1,98 @@
+"""Detect dangerous auto-approve and trust-all configurations."""
+
+from __future__ import annotations
+
+from tessen.models import ParseResult
+from tessen.rules.base import Rule
+from tessen.rules.models import Finding, RuleMetadata, Severity
+
+# Fields (in server extra data) that indicate blanket auto-approval.
+AUTO_APPROVE_FIELDS = {
+    "autoApprove",
+    "auto_approve",
+    "autoApproveAll",
+    "auto_approve_all",
+    "trustAll",
+    "trust_all",
+    "skipConfirmation",
+    "skip_confirmation",
+    "alwaysAllow",
+    "always_allow",
+}
+
+
+class AutoApproveRule(Rule):
+    METADATA = RuleMetadata(
+        id="tessen-auto-approve",
+        name="Dangerous auto-approve configuration",
+        description=(
+            "An MCP server is configured to auto-approve all tool calls, "
+            "bypassing the human-in-the-loop consent mechanism. This means "
+            "any prompt injection reaching this server can execute tools "
+            "without user confirmation."
+        ),
+        severity=Severity.HIGH,
+    )
+
+    def check(self, result: ParseResult) -> list[Finding]:
+        findings: list[Finding] = []
+
+        for server_name, server in result.config.mcpServers.items():
+            extra = server.model_extra or {}
+
+            for field_name, value in extra.items():
+                if field_name not in AUTO_APPROVE_FIELDS:
+                    continue
+
+                is_dangerous = self._is_dangerous_value(value)
+                if not is_dangerous:
+                    continue
+
+                findings.append(
+                    Finding(
+                        rule_id=self.METADATA.id,
+                        severity=self.METADATA.severity,
+                        title=f"Auto-approve enabled on server '{server_name}'",
+                        message=(
+                            f"Server '{server_name}' has '{field_name}' set to "
+                            f"{self._format_value(value)}. This bypasses the consent "
+                            f"mechanism that normally requires user approval before "
+                            f"tool execution. Any prompt injection reaching this "
+                            f"server will execute without a confirmation step."
+                        ),
+                        location=f"mcpServers.{server_name}.{field_name}",
+                        remediation=(
+                            "Remove the auto-approve flag or scope it to specific "
+                            "low-risk tools instead of granting blanket approval. "
+                            "Use an allowlist of specific tool names rather than "
+                            "wildcards or boolean true."
+                        ),
+                        references=self.METADATA.references,
+                    )
+                )
+
+        return findings
+
+    @staticmethod
+    def _is_dangerous_value(value) -> bool:
+        """Check if the value represents blanket approval."""
+        if isinstance(value, bool):
+            return value is True
+
+        if isinstance(value, str):
+            return value.lower() in ("true", "yes", "1", "*", "all")
+
+        if isinstance(value, list):
+            # ["*"] or ["all"] = blanket approval
+            if any(str(v).strip() in ("*", "all") for v in value):
+                return True
+            # A list with 10+ tools is suspicious but not auto-flagged.
+            # That's a judgment call for the user.
+
+        return False
+
+    @staticmethod
+    def _format_value(value) -> str:
+        if isinstance(value, list):
+            return str(value)
+        return repr(value)

tessen/rules/builtin/dangerous_command.py

@@ -0,0 +1,89 @@
+"""Detect commands known to be dangerous or a common attack vector."""
+
+from __future__ import annotations
+
+from tessen.models import ParseResult
+from tessen.rules.base import Rule
+from tessen.rules.models import Finding, RuleMetadata, Severity
+
+
+# Commands that indicate direct shell access — an MCP server should almost
+# never need this.
+SHELL_COMMANDS = {"sh", "bash", "zsh", "fish", "cmd", "cmd.exe", "powershell", "pwsh"}
+
+# Commands that pull remote code without pinning or verification.
+UNVERIFIED_REMOTE_EXEC = {
+    ("curl", "|", "sh"),
+    ("curl", "|", "bash"),
+    ("wget", "|", "sh"),
+    ("wget", "|", "bash"),
+}
+
+
+class DangerousCommandRule(Rule):
+    METADATA = RuleMetadata(
+        id="tessen-dangerous-command",
+        name="MCP server invoked via dangerous command",
+        description=(
+            "The MCP server is invoked using a shell interpreter or a curl-pipe-shell "
+            "pattern. Either grants the server arbitrary code execution and blocks "
+            "any pretense of sandboxing."
+        ),
+        severity=Severity.HIGH,
+    )
+
+    def check(self, result: ParseResult) -> list[Finding]:
+        findings: list[Finding] = []
+
+        for server_name, server in result.config.mcpServers.items():
+            cmd = server.command.strip()
+            cmd_base = cmd.rsplit("/", 1)[-1]  # e.g. /bin/bash -> bash
+
+            if cmd_base in SHELL_COMMANDS:
+                findings.append(
+                    Finding(
+                        rule_id=self.METADATA.id,
+                        severity=self.METADATA.severity,
+                        title="Shell interpreter used as MCP server command",
+                        message=(
+                            f"Server '{server_name}' is launched with '{cmd}', a shell "
+                            f"interpreter. The MCP client will execute whatever this "
+                            f"shell decides to run. Any prompt injection reaching this "
+                            f"server can achieve arbitrary command execution on the host."
+                        ),
+                        location=f"mcpServers.{server_name}.command",
+                        remediation=(
+                            "Invoke the MCP server binary directly (e.g. via npx, uvx, "
+                            "or the absolute path to the installed binary) instead of "
+                            "wrapping it in a shell."
+                        ),
+                        references=self.METADATA.references,
+                    )
+                )
+
+            # Check for curl-pipe-shell in args
+            full_command = " ".join([cmd] + server.args).lower()
+            for pattern in UNVERIFIED_REMOTE_EXEC:
+                if all(p in full_command for p in pattern):
+                    findings.append(
+                        Finding(
+                            rule_id=self.METADATA.id,
+                            severity=Severity.CRITICAL,
+                            title="curl-pipe-shell pattern in server command",
+                            message=(
+                                f"Server '{server_name}' fetches and executes remote code "
+                                f"without verification. This is a supply-chain attack "
+                                f"waiting to happen — anyone controlling the remote URL "
+                                f"can push arbitrary code to your machine at any time."
+                            ),
+                            location=f"mcpServers.{server_name}",
+                            remediation=(
+                                "Pin the server to a specific verified version and install "
+                                "it via a package manager with signature verification."
+                            ),
+                            references=self.METADATA.references,
+                        )
+                    )
+                    break
+
+        return findings

tessen/rules/builtin/hook_injection.py

@@ -0,0 +1,153 @@
+"""Detect hook injection and post-install script patterns.
+
+Covers the attack class disclosed by Check Point in Feb 2026:
+malicious .claude/settings.json hooks that execute arbitrary code
+on operations like git clone, file open, or project init.
+
+Also detects suspicious patterns in MCP server args that suggest
+the server is being used as a hook delivery mechanism.
+"""
+
+from __future__ import annotations
+
+import re
+
+from tessen.models import ParseResult
+from tessen.rules.base import Rule
+from tessen.rules.models import Finding, RuleMetadata, Severity
+
+# Commands that suggest remote code fetch + execution in hook context.
+REMOTE_EXEC_PATTERNS = [
+    re.compile(r"curl\s+.+\|\s*(sh|bash|zsh|python)", re.IGNORECASE),
+    re.compile(r"wget\s+.+\|\s*(sh|bash|zsh|python)", re.IGNORECASE),
+    re.compile(r"curl\s+.+-o\s+\S+\s*&&\s*(sh|bash|chmod)", re.IGNORECASE),
+    re.compile(r"eval\s*\$\(curl", re.IGNORECASE),
+    re.compile(r"eval\s*\$\(wget", re.IGNORECASE),
+    re.compile(r"python\s+-c\s+.*import\s+(urllib|requests|http)", re.IGNORECASE),
+]
+
+# Field names in extra config that look like hooks.
+HOOK_FIELD_NAMES = re.compile(
+    r"(?i)(hook|on[_-]?(start|stop|init|install|open|clone|attach|connect|load)"
+    r"|pre[_-]?(start|init|install)|post[_-]?(start|init|install)"
+    r"|setup[_-]?command|init[_-]?command|startup[_-]?command)"
+)
+
+# Common benign hook values (npm lifecycle scripts, etc.)
+BENIGN_HOOKS = {
+    "npm install",
+    "npm ci",
+    "npm run build",
+    "pip install -r requirements.txt",
+    "uv sync",
+    "yarn install",
+    "pnpm install",
+}
+
+
+class HookInjectionRule(Rule):
+    METADATA = RuleMetadata(
+        id="tessen-hook-injection",
+        name="Suspicious hook or startup script pattern",
+        description=(
+            "An MCP server configuration contains hook fields or startup "
+            "commands that could execute arbitrary code. This matches the "
+            "attack class disclosed by Check Point (Feb 2026) where malicious "
+            ".claude/settings.json hooks achieved RCE on git clone."
+        ),
+        severity=Severity.CRITICAL,
+        references=[
+            "https://blog.checkpoint.com/research/the-stealthy-satisfyer-exposing-claude-codes-hidden-risks/",
+        ],
+    )
+
+    def check(self, result: ParseResult) -> list[Finding]:
+        findings: list[Finding] = []
+
+        for server_name, server in result.config.mcpServers.items():
+            extra = server.model_extra or {}
+
+            # Check extra fields for hook-like field names
+            for field_name, value in extra.items():
+                if not HOOK_FIELD_NAMES.search(field_name):
+                    continue
+
+                str_value = self._to_string(value)
+                if not str_value:
+                    continue
+
+                if str_value.strip().lower() in BENIGN_HOOKS:
+                    continue
+
+                severity = Severity.CRITICAL
+                message_extra = ""
+
+                if self._has_remote_exec(str_value):
+                    message_extra = (
+                        " The hook fetches and executes remote code, which means "
+                        "anyone controlling the remote URL can push arbitrary "
+                        "code to your machine."
+                    )
+                else:
+                    severity = Severity.HIGH
+                    message_extra = (
+                        " While the hook doesn't fetch remote code, it still "
+                        "executes on a lifecycle event without explicit user "
+                        "consent."
+                    )
+
+                findings.append(
+                    Finding(
+                        rule_id=self.METADATA.id,
+                        severity=severity,
+                        title=f"Hook script in server '{server_name}'",
+                        message=(
+                            f"Server '{server_name}' has a hook field "
+                            f"'{field_name}' set to: {str_value!r}.{message_extra}"
+                        ),
+                        location=f"mcpServers.{server_name}.{field_name}",
+                        remediation=(
+                            "Remove the hook field or replace it with a known-safe "
+                            "command. If a startup script is necessary, audit it "
+                            "manually and pin it to a local path under version control."
+                        ),
+                        references=self.METADATA.references,
+                    )
+                )
+
+            # Also check args for remote-exec patterns
+            for i, arg in enumerate(server.args):
+                if self._has_remote_exec(arg):
+                    findings.append(
+                        Finding(
+                            rule_id=self.METADATA.id,
+                            severity=Severity.CRITICAL,
+                            title="Remote code execution in server args",
+                            message=(
+                                f"Argument {i} of server '{server_name}' contains "
+                                f"a pattern that fetches and executes remote code: "
+                                f"{arg!r}. This is a supply-chain attack vector."
+                            ),
+                            location=f"mcpServers.{server_name}.args[{i}]",
+                            remediation=(
+                                "Install the server via a package manager with "
+                                "version pinning. Do not fetch and execute scripts "
+                                "from URLs at runtime."
+                            ),
+                            references=self.METADATA.references,
+                        )
+                    )
+
+        return findings
+
+    @staticmethod
+    def _has_remote_exec(value: str) -> bool:
+        return any(p.search(value) for p in REMOTE_EXEC_PATTERNS)
+
+    @staticmethod
+    def _to_string(value) -> str | None:
+        if isinstance(value, str):
+            return value
+        if isinstance(value, list):
+            return " && ".join(str(v) for v in value)
+        return None

tessen/rules/builtin/http_no_auth.py

@@ -0,0 +1,99 @@
+"""Detect MCP servers using HTTP/SSE transport without authentication."""
+
+from __future__ import annotations
+
+from tessen.models import ParseResult
+from tessen.rules.base import Rule
+from tessen.rules.models import Finding, RuleMetadata, Severity
+
+# Fields that suggest auth is configured — checked in the server's extra fields
+# and env vars.
+AUTH_SIGNALS = {
+    "authorization",
+    "auth",
+    "token",
+    "api_key",
+    "apikey",
+    "api-key",
+    "bearer",
+    "secret",
+    "password",
+    "credentials",
+}
+
+
+class HttpNoAuthRule(Rule):
+    METADATA = RuleMetadata(
+        id="tessen-http-no-auth",
+        name="HTTP/SSE transport without authentication",
+        description=(
+            "An MCP server is configured with HTTP or SSE transport but no "
+            "authentication mechanism is apparent. Anyone who can reach the "
+            "server's URL can invoke its tools."
+        ),
+        severity=Severity.HIGH,
+        references=[
+            "https://spec.modelcontextprotocol.io/specification/2024-11-05/basic/transports/",
+        ],
+    )
+
+    def check(self, result: ParseResult) -> list[Finding]:
+        findings: list[Finding] = []
+
+        for server_name, server in result.config.mcpServers.items():
+            # Only applies to HTTP/SSE transports
+            transport = getattr(server, "transport", None)
+            url = getattr(server, "url", None)
+
+            # Also check extra fields (Pydantic extra="allow") for transport/url
+            extra = server.model_extra or {}
+            if transport is None:
+                transport = extra.get("transport")
+            if url is None:
+                url = extra.get("url")
+
+            if transport not in ("http", "sse") and url is None:
+                continue
+
+            # Check if there's any auth signal in env vars or extra fields
+            has_auth = self._has_auth_signal(server.env, extra)
+
+            if not has_auth:
+                display_url = url or "(no URL specified)"
+                findings.append(
+                    Finding(
+                        rule_id=self.METADATA.id,
+                        severity=self.METADATA.severity,
+                        title=f"Unauthenticated {transport or 'HTTP'} transport",
+                        message=(
+                            f"Server '{server_name}' uses {transport or 'HTTP'} transport "
+                            f"at {display_url} with no visible authentication. "
+                            f"Any network-adjacent attacker can invoke this server's tools, "
+                            f"read its resources, and potentially pivot to the host."
+                        ),
+                        location=f"mcpServers.{server_name}",
+                        remediation=(
+                            "Add authentication to the transport layer. Use an API key "
+                            "in an Authorization header (via env var reference), or "
+                            "restrict the server to localhost with a firewall rule."
+                        ),
+                        references=self.METADATA.references,
+                    )
+                )
+
+        return findings
+
+    @staticmethod
+    def _has_auth_signal(env: dict[str, str], extra: dict) -> bool:
+        """Check if any field name suggests auth is configured."""
+        # Check env var names
+        for name in env:
+            if any(signal in name.lower() for signal in AUTH_SIGNALS):
+                return True
+
+        # Check extra config fields
+        for key in extra:
+            if any(signal in key.lower() for signal in AUTH_SIGNALS):
+                return True
+
+        return False

tessen/rules/builtin/known_vulnerable.py

@@ -0,0 +1,159 @@
+"""Detect MCP servers with known vulnerabilities (CVE feed)."""
+
+from __future__ import annotations
+
+import re
+
+from tessen.models import ParseResult
+from tessen.rules.base import Rule
+from tessen.rules.models import Finding, RuleMetadata, Severity
+
+
+# The vulnerability database. Each entry matches against the npm package name
+# that appears in the `args` of an `npx -y <package>` invocation.
+#
+# This is the seed of the Tessen CVE feed. In v0.2 this moves to a
+# separately-versioned JSON file that can be updated independently of the CLI.
+
+VULNERABLE_SERVERS: list[dict] = [
+    {
+        "package": "@anthropic/mcp-inspector",
+        "cve": "CVE-2025-49596",
+        "title": "Command injection in MCP Inspector",
+        "severity": Severity.CRITICAL,
+        "description": (
+            "MCP Inspector versions before the patched release are vulnerable to "
+            "command injection via crafted server names. An attacker who controls "
+            "the server name can execute arbitrary commands on the host."
+        ),
+        "references": ["https://nvd.nist.gov/vuln/detail/CVE-2025-49596"],
+    },
+    {
+        "package": "librechat-mcp",
+        "cve": "CVE-2026-22252",
+        "title": "Injection vulnerability in LibreChat MCP integration",
+        "severity": Severity.HIGH,
+        "description": (
+            "LibreChat's MCP integration is vulnerable to injection attacks "
+            "through crafted tool descriptions, allowing prompt injection "
+            "that can exfiltrate conversation data."
+        ),
+        "references": ["https://nvd.nist.gov/vuln/detail/CVE-2026-22252"],
+    },
+    {
+        "package": "weknora-mcp",
+        "cve": "CVE-2026-22688",
+        "title": "Remote code execution in WeKnora MCP server",
+        "severity": Severity.CRITICAL,
+        "description": (
+            "WeKnora MCP server allows remote code execution through "
+            "unsanitized input in tool call parameters."
+        ),
+        "references": ["https://nvd.nist.gov/vuln/detail/CVE-2026-22688"],
+    },
+    {
+        "package": "@anthropic/claude-code",
+        "cve": "CVE-2026-21852",
+        "title": "API key theft via Claude Code MCP consent bypass",
+        "severity": Severity.CRITICAL,
+        "description": (
+            "Claude Code versions before the patched release allow a malicious "
+            "MCP server to exfiltrate API keys by bypassing the tool consent "
+            "mechanism."
+        ),
+        "references": ["https://nvd.nist.gov/vuln/detail/CVE-2026-21852"],
+    },
+    {
+        "package": "windsurf-mcp",
+        "cve": "CVE-2026-30615",
+        "title": "Prompt injection leading to RCE in Windsurf",
+        "severity": Severity.CRITICAL,
+        "description": (
+            "Windsurf's MCP integration is vulnerable to prompt injection "
+            "that escalates to remote code execution on the developer's machine."
+        ),
+        "references": ["https://nvd.nist.gov/vuln/detail/CVE-2026-30615"],
+    },
+]
+
+# Pattern to extract npm package name from npx args.
+# Matches: npx -y @scope/package, npx -y package, npx -y package@version
+NPX_PACKAGE_PATTERN = re.compile(
+    r"^(?:-[a-zA-Z]+\s+)*"  # optional flags like -y
+    r"((?:@[\w-]+/)?[\w.-]+)"  # package name (with optional scope)
+)
+
+
+class KnownVulnerableServerRule(Rule):
+    METADATA = RuleMetadata(
+        id="tessen-known-vulnerable-server",
+        name="MCP server with known CVE",
+        description=(
+            "The configured MCP server matches a package with a known "
+            "vulnerability in the Tessen CVE database."
+        ),
+        severity=Severity.CRITICAL,
+        references=[
+            "https://github.com/SlimBenTanfous1/tessen-cli",
+        ],
+    )
+
+    def check(self, result: ParseResult) -> list[Finding]:
+        findings: list[Finding] = []
+
+        for server_name, server in result.config.mcpServers.items():
+            package = self._extract_package(server.command, server.args)
+            if package is None:
+                continue
+
+            for vuln in VULNERABLE_SERVERS:
+                if self._matches(package, vuln["package"]):
+                    findings.append(
+                        Finding(
+                            rule_id=self.METADATA.id,
+                            severity=vuln["severity"],
+                            title=f"{vuln['cve']}: {vuln['title']}",
+                            message=(
+                                f"Server '{server_name}' uses package '{package}' "
+                                f"which has a known vulnerability ({vuln['cve']}). "
+                                f"{vuln['description']}"
+                            ),
+                            location=f"mcpServers.{server_name}",
+                            remediation=(
+                                "Update to the latest patched version, or remove "
+                                "the server if it's not essential. Check the CVE "
+                                "for specific remediation guidance."
+                            ),
+                            references=vuln["references"],
+                        )
+                    )
+
+        return findings
+
+    @staticmethod
+    def _extract_package(command: str, args: list[str]) -> str | None:
+        """Extract the npm package name from an npx/uvx invocation."""
+        cmd_base = command.rsplit("/", 1)[-1]
+
+        if cmd_base in ("npx", "npx.cmd"):
+            # Join args and extract the package name after flags
+            args_str = " ".join(args)
+            match = NPX_PACKAGE_PATTERN.search(args_str)
+            if match:
+                # Strip version suffix if present (@1.2.3)
+                pkg = match.group(1)
+                pkg = re.sub(r"@[\d.].*$", "", pkg)
+                return pkg
+
+        if cmd_base in ("uvx", "pipx"):
+            # Python tools: first non-flag arg is the package
+            for arg in args:
+                if not arg.startswith("-"):
+                    return arg.split("==")[0].split(">=")[0]
+
+        return None
+
+    @staticmethod
+    def _matches(installed: str, vulnerable: str) -> bool:
+        """Check if installed package matches a known-vulnerable package."""
+        return installed.lower() == vulnerable.lower()