feat: Tier-2 detection — API key patterns, multilingual injection, SSRF/ReDoS, tool pinning - #90
Merged
Merged
Conversation
…ts/resources, SARIF tags, escape stub #71 — Wire HTTP transport: replace the bail!() stub in main.rs with a real HttpTransport::connect(url) call. The HTTP transport, CLI --url flag, and all test infrastructure were already complete; this is the missing CLI hookup. Also removes the file-level #![allow(dead_code)] from mcp.rs and session.rs that were placeholders for this wire-up. #75 — Annotation deception scanning (FUZZD-028): adds annotations: Option<Value> to ToolDefinition per the MCP 2025-11-05 spec. New scan_annotations() pass fires AnnotationDeception when readOnlyHint/destructiveHint/openWorldHint contradict the tool's actual description — the exact attack documented in arXiv:2603.22489 where false hints suppress client confirmation dialogs for destructive operations. 7 new tests; 0 new false positives on clean_tools.json. #76 — Prompts/resources scanning (full pipeline): adds PromptDefinition, ResourceDefinition, ListPromptsResult, ListResourcesResult to mcp.rs; adds list_prompts()/list_resources() to Session; adds enumerate_prompts/resources() to Harness; adds PROMPTS_LIST/RESOURCES_LIST method constants. New scan_surface() on DescriptionScanner runs the four injection-detection passes on (name, description) pairs. Wired into the ToolPoisoning audit path — gracefully skips if the server returns method-not-found for unsupported endpoints. #77 — OWASP/NSA SARIF compliance tags: adds tags() method to Signal returning OWASP MCP Top-10, OWASP Agentic Top-10 (ASI series), and CWE identifiers. sarif_rules() now emits properties.tags for every rule, enabling SARIF consumers (GitHub Code Scanning, SonarQube) to cross-reference fuzzd findings against industry frameworks without a separate mapping step. #78 — Escape module stub: implements the no-op fuzz_escape() function in a new src/fuzzer/escape.rs and wires it into the dispatch so Escape no longer emits "not yet implemented" warnings in default scans. https://claude.ai/code/session_014T1x8ZiDbJcVvkZBfP91nk
…ick wins - bench/README: 27→28 signals, add annotation_deception row, update pass count to 5, note prompts/resources and annotations as scanned surfaces - README roadmap: add HTTP transport, annotation scanning, prompts/resources, SARIF compliance tags as shipped; update signal count 23→28 - CHANGELOG: [Unreleased] entry for #71/#75/#76/#77/#78 with full detail https://claude.ai/code/session_014T1x8ZiDbJcVvkZBfP91nk
…RF/ReDoS payloads, tool pinning #80 — API key and token patterns (CredentialReference): 13 new high-confidence AC needles targeting cloud platform key prefixes and auth headers — AWS AKIA, GitHub gh{p,u,s}_, Slack xox{b,p}-, Anthropic sk-ant-, Google AIzaSy, Stripe sk_{live,test}_, Kubernetes ~/.kube/config, Docker config, Bearer token. All needles lowercase to work with the ascii_case_insensitive automaton. #82 — Multilingual injection patterns (14 new needles): Chinese (必须, 您必须, 立即执行, 不得告知, 系统规则), Japanese/Traditional Chinese (必須, 絶対に), Korean (반드시, 알리지 마), Russian (должны, обязательно, не сообщайте), Arabic (يجب, إلزامي). Covers the non-English imperative and stealth-language patterns used to evade English-only scanners, documented in Perez & Ribeiro (2022) and observed in Wang et al. (2025) MCPTox samples. 0 new false positives. #81 — SSRF and ReDoS payloads in argument fuzzer: adds two new PayloadCategory statics to payloads.rs included in ALL_CATEGORIES — SSRF (14 payloads: AWS/GCP/DO metadata endpoints, localhost variants, file://, gopher://, dict://) and REDOS (4 catastrophic-backtracking strings). Also removes stale #![allow(dead_code)] from payloads.rs. Basis: PortSwigger SSRF cheatsheet; OWASP ReDoS; Davis et al. #79 — Tool pinning and rug-pull detection: Harness now records a u64 content hash (name + description + inputSchema + annotations via DefaultHasher) for each tool on first enumerate_tools() call. New recheck_tool_integrity() method re-fetches tools/list and returns the names of any tools whose definition changed. Wired into the ToolPoisoning audit path in main.rs — changed tools emit ConditionalActivation (FUZZD-011) findings at Critical severity. 3 new tests cover the detect-change, no-change, and before-enumerate cases. https://claude.ai/code/session_014T1x8ZiDbJcVvkZBfP91nk
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Four Tier-2 roadmap items. 283 tests pass, 0 new false positives on
clean_tools.json.#80 — API key and token patterns
13 new
CredentialReferenceAC needles targeting cloud platform key prefixes and auth headers:akia(IAM access key prefix)ghp_,ghu_,ghs_(PAT / user / server tokens)xoxb-,xoxp-(bot / user tokens)sk-ant-(Claude API key)aizasy(AIzaSy… Cloud/Firebase key prefix)sk_live_,sk_test_~/.kube/config,~/.docker/config.json,bearer#82 — Multilingual injection patterns (14 new needles)
Covers non-English imperative/stealth patterns used to evade English-only scanners (Perez & Ribeiro 2022; Wang et al. 2025 MCPTox samples):
#81 — SSRF and ReDoS payloads
New
SSRF(14 payloads) andREDOS(4 payloads)PayloadCategorystatics added topayloads.rsand included inALL_CATEGORIES— active in the argument fuzzer on all string fields. SSRF covers AWS/GCP/DO metadata endpoints, localhost variants, file://, gopher://, dict://. ReDoS covers catastrophic-backtracking strings. Also removes stale#[allow(dead_code)].#79 — Tool pinning and rug-pull detection
Harnessnow records a content hash (name + description + inputSchema + annotations viaDefaultHasher) for each tool on firstenumerate_tools(). Newrecheck_tool_integrity()re-fetchestools/listand returns names of changed tools. Wired intoToolPoisoninginmain.rs— changed tools emitConditionalActivation(FUZZD-011) at Critical. 3 new unit tests.Test plan
cargo test— 283 tests passcargo clippy -- -D warnings— cleancargo fmt --check— cleanfuzzd scan --schema bench/clean_tools.json— 0 findings (no new FP)each_pattern_needle_detectable_by_scannerinvariant test)recheck_detects_changed_descriptiontest passeshttps://claude.ai/code/session_014T1x8ZiDbJcVvkZBfP91nk
Generated by Claude Code