Fix MCP payloads: structured tool calls and DVAA response pattern matching#57
Conversation
…atterns Supply-chain and tool-shadow payloads were sending natural language via MCP which fell back to calling a non-existent "execute" tool, causing 20/20 inconclusive results. Fixed by: - Converting payloads to JSON format with _mcpTool/_mcpMethod fields that the scanner's buildMcpRequestBody() parses into proper JSON-RPC - Mapping supply-chain payloads to PluginBot tools (register_tool, store_secret, fetch_data) and tool-shadow payloads to ProxyBot tools (secure_query, sign_document, transfer_funds) - Updating successIndicators to match DVAA response patterns (VULNERABLE:, path traversal, SQL injection, tlsVerified, etc.) - Adding DVAA-specific heuristics to scanner (VULNERABLE: marker, secure mode defensive pattern) Integration test results: supply-chain 10/10, tool-shadow 9/10.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
Security Review: PR #57 - MCP Payloads and Response Pattern Matching
VERDICT: APPROVE
SUMMARY
This PR refactors attack payloads from natural language to structured JSON-RPC MCP tool calls and adds DVAA-specific response patterns to the heuristic analyzer. The changes are configuration-driven updates to test payloads and pattern matching logic. No security vulnerabilities were introduced. The code correctly handles JSON parsing with try/catch blocks, uses structured data formats that prevent injection attacks, and maintains proper separation between payload definitions and execution logic.
VERIFICATION NOTES
All potential findings were verified against the full source code:
- JSON Parsing (scanner.ts:300-312): Protected by try/catch block with safe fallback behavior
- Regex Patterns: All new patterns (lines 457-471) use linear-time matching without nested quantifiers - no ReDoS risk
- URL Handling: URLs in payloads are data (not executed), and the scanner already uses
fetch()with controlled request construction (lines 157-165, 267-275) - Object Property Deletion (scanner.ts:327-328): Safe cleanup of internal fields from parsed objects before sending to API
- HTTP Request Construction: Uses
JSON.stringify()on controlled objects (lines 163, 273) - no injection vectors - Pattern Matching Order: Correctly prioritizes
blockedIndicatorsbeforesuccessIndicators(lines 408-416, 420-429)
No command execution, file system operations, or dynamic code evaluation occurs in the changed code. All modifications are to static payload definitions and pattern-matching logic.
Reviewed 3 files changed (28148 bytes)
1 participant
Summary
Integration test results
Test plan