feat: scanner rules upgrade — 60 → 108 patterns from 5 scanner source codes#15
Open
ithiria894 wants to merge 6 commits intomainfrom
Open
feat: scanner rules upgrade — 60 → 108 patterns from 5 scanner source codes#15ithiria894 wants to merge 6 commits intomainfrom
ithiria894 wants to merge 6 commits intomainfrom
Conversation
…se positive exclusions Cherry-picked from 5 runtime MCP scanners (reading actual source code): Cisco YARA (865★), AgentSeal scan-mcp (151★), MCP-Shield (550★), Nova (287★) New categories: Tool Poisoning extended (+10), Coercive Injection (+11), Impersonation (+3), Script Injection (+3). Extended: Prompt Injection (+5), Data Exfiltration (+5). False positive exclusions from Cisco YARA negation + cc-audit patterns (templates, linters, test frameworks, security research). Tested: 97 findings from 33 servers, 452 tools. Zero JS errors. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…n, annotation checks Cherry-picked from AgentSeal scan-mcp, MCP-Shield, Nova Proximity: New detection capabilities: - Cross-server tool name collision (MCPR-103): flags when same tool name on 2+ servers - Cross-server tool reference: flags when one tool's description references another server's tool (with 4-char minimum name length to reduce FP, from AgentSeal) - Excessive destructive permissions (MCPR-108): flags servers where >50% tools are destructive - Credential read-then-send combo patterns (from AgentSeal MCPR-102) - Unsafe deserialization (pickle.load, yaml.load) from Nova - Wildcard permission detection (Bash(*), Write(*)) from Nova - Extended tool shadowing (data forwarding, BCC leak, output redirect) - Extended exfil endpoints (pastebin, transfer.sh, file.io) - Extended supply chain (unpinned uvx/pip) - Extended credential patterns (wallet.dat, keychain, mcp.json) - Credential tool allowlist (skip login/oauth/connect tools for MCPR-105) - Extended suspicious param names (+10: env_file, dotenv, session_token, etc.) Total: 60 → 108 patterns, 15 categories, cross-server analysis, annotation checks. Tested: 182 findings from 33 servers, 452 tools. Zero JS errors. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…rompt Each security finding now shows description + clickable "Fix with Claude →" that copies a detailed prompt to clipboard including: finding details, rule ID, severity, matched text, context, server name, and instructions to evaluate whether it's real or false positive. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…xclusion, fix-with-claude UI False positive reduction: - CH-009: removed "access" verb (FP on "access level, password protection"), reduced match range 120→40 chars, require specific action verbs (read/cat/steal) - CH-010: reduced match range 120→40 chars, require specific send verbs - TS-009: raised MIN_CROSS_REF_NAME_LEN to 8 + added 40 common tool words exclusion (search, fill, click, hover, etc.) — eliminates FP on Playwright/S2 - TS-009: downgraded from high to medium severity Results: ClickUp 5 FP → 0. Semantic-scholar 10 FP → 3. Playwright FP eliminated. Also added: Fix with Claude → on every finding (copy prompt to clipboard), finding cards with description + rule ID. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Root cause analysis of every non-test-server finding: - ClickUp: "access level, password protection" matched CH-009 → fixed by removing "access" verb and tightening range 120→40 chars - Context7: "You MUST call this function before" matched CI-004 → fixed by removing "You MUST call" pattern (legitimate API workflow ordering) - Teams: "Search emails" matched TP-011 → fixed by removing "search" verb and requiring "all/any/every" qualifier - Playwright: 22 self-collisions → fixed by using Set() for server dedup (same server in multiple scopes no longer counts as collision) - semantic-scholar/arxiv/paper-distill: "search_papers" collision → added to COMMON_TOOL_WORDS exclusion list - devto/twitter: "get_user_by_username" collision → added to exclusion list Also fixed: COMMON_TOOL_WORDS was const inside function (temporal dead zone error) → moved to module level. Result: 95 findings, ALL on intentionally-malicious test servers. ZERO false positives on real MCP servers (ClickUp, Context7, Teams, Playwright, Tavily, Firecrawl, Exa, Semantic Scholar, etc.) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…rect - .sec-tag: changed from dark bg to rgba(255,255,255,0.1) with border for visibility - Verified ALL 95 findings against actual test server source code — 100% correct - Zero false positives on real MCP servers (ClickUp, Context7, Teams, Playwright, etc.) - Zero false positives on clean test servers (clean-server, time-server) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cherry-picked detection patterns from reading actual source code of 5 runtime MCP security scanners:
What changed
Why this matters
Before: CCO had ZERO coverage of tool poisoning secondary behaviors, coercive injection, impersonation, cross-server shadowing, and annotation abuse.
Test plan
🤖 Generated with Claude Code