feat(CREDENTIALS_IN_URL): flag credentials embedded in the transport URL

[dmchaledev]

Summary

A transport/serverUrl of the form scheme://user:password@host embeds long‑lived credentials directly in the connection string. Today the scanner has no rule for this, so such a config scans completely clean:

$ node dist/cli.js creds-url.json --format=table   # transport.url: https://admin:SuperSecret123@mcp.example.com
Found 0 finding(s): 0 critical, 0 high, 0 medium, 0 low
PASSED

That's a false negative on a real, well‑known credential‑exposure vector (CWE‑522 / CWE‑598): credentials in a URL leak through access/proxy logs, browser history, and Referer headers. TLS does not protect them — the exposure happens at the endpoints, not on the wire — so MISSING_TLS/INSECURE_TRANSPORT don't cover it, and the secret‑scanning patterns (sk-…, ghp_…, AKIA…, password=…) don't match a URL userinfo component either.

This gap is independent of the current backlog — no open/closed issue or PR references URL userinfo / embedded credentials. (The EXPOSED_SECRETS PRs all target API‑key/token/password patterns in string values.)

Change

Add a HIGH‑severity CREDENTIALS_IN_URL rule that parses the transport URL with the WHATWG URL API and fires on any non‑empty username (with or without a password).

$ node dist/cli.js creds-url.json --format=table
HIGH | CREDENTIALS_IN_URL | Credentials Embedded in Transport URL

• Password is redacted in the evidence (transport.url: https://admin:***@mcp.example.com/mcp) — the scanner never echoes the secret it flags.
• URL‑evaluable: embedded credentials are visible in the URL string itself, so the rule is added to URL_EVALUABLE_RULES and runs in URL mode too — giving that mode its first genuine (non‑transport‑scheme) security finding.
• The new RuleId is auto‑included in --rule validation and --help (both derive from the enum), so no CLI wiring changes were needed.
• Unparseable URLs are ignored (no throw, no finding).

Tests

• Rule‑level: user:password@, bare user@, wss://, serverUrl fallback, evidence redaction, and the clean/absent/unparseable negatives.
• Integration: URL‑mode scan flags the finding, a clean endpoint does not, and the serialized report contains no plaintext secret.

Full suite: 128 passed. typecheck, lint (--max-warnings 0), and build all clean.

Docs

README "What It Checks" now mentions credentials embedded in the connection URL.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XgH2BbU7WoCekW6n8QxcNE

---

Generated by Claude Code