Skip to content

Latest commit

 

History

History
84 lines (63 loc) · 4.54 KB

File metadata and controls

84 lines (63 loc) · 4.54 KB

Detection coverage

MSCC runs four engines. This page catalogs what each detects. Rule counts change between releases; the categories and mappings below are stable.

Categories and framework mappings

Category OWASP MCP Other Example detections
Prompt injection MCP-03 LLM01 ignore-instructions, system markers, jailbreak, role manipulation, hidden Unicode, delimiter injection
Tool poisoning MCP-02 hidden HTML-comment instructions, encoded-content runs, XSS in descriptions
Excessive permissions MCP-01 shell execution, unrestricted filesystem/network, debug mode, unsafe/raw pointers, FFI
Command injection MCP-04 CWE-78/89/94/502/611/917 shell exec, eval/exec, SQLi, deserialization, XXE, JNDI, reflection, LDAP
Secret exposure MCP-01 CWE-798/321 API keys, passwords, tokens, private keys, AWS/GitHub/OpenAI keys, DB connection strings
OAuth misconfiguration CWE-295/319/598 implicit flow, TLS verification disabled, plain-HTTP MCP server
Data exfiltration outbound data transmission
Insufficient logging MCP-06 logging disabled
Memory poisoning OWASP ASI06 planted instructions, external refs in memory
Skill poisoning OWASP ASI01 instruction-shaped skill text
Toxic flow read-secret + egress in one artifact

1. Static pattern engine (scanner/static.py)

60+ compiled regex rules. Language-specific rules carry a file_types scope so they only run on the relevant extension.

Language coverage — Python, JavaScript/TypeScript (.js .jsx .ts .tsx .mjs .cjs), Go, Rust, Java, C#. Representative rules per language:

Language Rules include
Python subprocess/os.system/eval/exec, insecure deserialization (pickle, unsafe yaml.load)
JS/TS eval & Function, child_process, innerHTML/XSS, prototype pollution, dynamic RegExp, fs write/delete
Go exec.Command, unsafe pointer, SQLi via concatenation/Sprintf, InsecureSkipVerify, path traversal
Rust unsafe blocks, Command::new, raw pointers, FFI, transmute, format! SQLi, path traversal
Java Runtime.exec/ProcessBuilder, deserialization, SQLi, XXE, JNDI, reflection, LDAP, path traversal, hardcoded crypto keys
C# Process.Start, BinaryFormatter/unsafe JSON, SQLi, XXE, path traversal, reflection, LDAP, dynamic Regex, hardcoded connection strings

Cross-language / config / prose rules — secrets (generic, AWS, GitHub, OpenAI-format, DB connection strings, private keys), prompt-injection and tool-poisoning text patterns, excessive-permission and debug-mode config, OAuth implicit flow.

Many capability-detection rules carry a confidence below 1.0 so they contribute proportionally less to the risk score than a confirmed secret.

2. Context engine (scanner/context.py)

Skill and memory analysis — see agent-context.md for the full rule list. Rules: context-toxic-flow, context-secret-access-instruction, context-instruction-override, context-embedded-secret, context-external-reference.

3. MCP client-config analysis (scanner/static.py)

Applied to mcpServers blocks in client configs (recursively, for nested layouts):

Rule Severity Flags
mcp-client-unpinned-package medium npx/uvx/bunx server launched without a pinned version (supply-chain risk)
mcp-client-plaintext-secret high Inline credential in a server's env block
mcp-client-plain-http high Remote server configured over http://

Server-side tool manifests (tools[] with capability declarations) add config-shell-exec, config-fs-unrestricted, and config-net-unrestricted.

4. YARA engine (src/mscc/rules/)

Packaged rule packs, extensible with your own .yar files:

Pack Rules
core/owasp-mcp/mcp-01-excessive-agency.yar shell execution, unrestricted filesystem/network, debug mode
core/owasp-mcp/mcp-02-tool-poisoning.yar hidden HTML instructions, encoded-content runs, XSS, base64 payloads
core/owasp-mcp/mcp-03-prompt-injection.yar ignore-instructions, system markers, role manipulation, jailbreak, hidden Unicode, delimiter injection
core/secrets/api-keys.yar generic/AWS/GitHub/Slack keys, private keys, DB strings, JWT secrets, OpenAI/Anthropic keys

See writing-rules.md to add your own.

Suppression

Any finding on a line containing mscc:ignore is suppressed; scope it to one rule with mscc:ignore[rule-id] (comma-separate multiple rule ids).