Privatae
1733 lines
54 KiB
Go
1733 lines
54 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"io"
|
|
"net"
|
|
"net/url"
|
|
"os"
|
|
"path/filepath"
|
|
"regexp"
|
|
"runtime"
|
|
"sort"
|
|
"strconv"
|
|
"strings"
|
|
)
|
|
|
|
// THE TOOL SERVERS THIS MACHINE'S AGENT CLIENTS ARE SET UP TO START.
|
|
//
|
|
// Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Codex and Zed each
|
|
// keep a file that lists the tool servers (Model Context Protocol servers) the
|
|
// client may start or connect to. An assessment needs that list: which servers
|
|
// a person's agents can reach, how each is launched, whether a secret sits in
|
|
// the file in plain text, and whether the server the file names is actually
|
|
// running — or a server is running that no file names.
|
|
//
|
|
// THIS FILE ONLY READS FILES. It opens no socket, starts no process and never
|
|
// talks to a server; the bastion does not speak that protocol, and
|
|
// TestNoRouteOpOrDependencySpeaksMCP (claims_static_test.go) holds it to that
|
|
// by walking the call graph out of every function declared here. The process
|
|
// list it correlates against is handed IN by agents.go, which reads it with
|
|
// the platform's own enumerator (scanMCPProcesses, agents_<goos>.go).
|
|
//
|
|
// WHAT LEAVES THE MACHINE, AND WHAT NEVER DOES. Per declared server: the
|
|
// client, the config scope, the file path, the server's name, transport,
|
|
// whether it is a local process or a URL (and the URL's host), the launch
|
|
// command truncated the way agent command lines are, the package and whether
|
|
// it is pinned, the NAMES of the environment variables it is given, whether a
|
|
// value matched a secret's shape, whether a remote server has authentication
|
|
// configured, and whether it is running. NEVER a value of an environment
|
|
// variable or a header: a value is looked at once, for its shape, and dropped
|
|
// in the same function. A command-line argument that looks like a secret is
|
|
// replaced by a marker before the command is kept at all. Paths and names
|
|
// travel only inside the heartbeat's `observing` gate, beside the agent list.
|
|
//
|
|
// WHERE EACH CLIENT KEEPS ITS FILE is mcpConfigSources below, with the page
|
|
// each path was checked against on 2026-10-20. Paths a page did not state are
|
|
// marked there as not confirmed; they are still read, because reading a file
|
|
// that is not there costs a stat and finds nothing.
|
|
|
|
// mcpServerObs is one declared (or running, undeclared) tool server.
|
|
type mcpServerObs struct {
|
|
Client string `json:"client,omitempty"` // claude-desktop, claude-code, cursor, vscode, windsurf, codex, zed
|
|
Scope string `json:"scope,omitempty"` // user, project, system
|
|
Path string `json:"path,omitempty"`
|
|
Name string `json:"name,omitempty"`
|
|
// Transport: stdio, http, sse, websocket, unknown.
|
|
Transport string `json:"transport"`
|
|
// Locality: local_process (the client starts it here), loopback, lan,
|
|
// remote (a URL host off this network), unknown.
|
|
Locality string `json:"locality"`
|
|
URLHost string `json:"url_host,omitempty"`
|
|
// Command is the launch command and its arguments, joined and truncated
|
|
// to 200 characters like an agent's cmdline, with any argument that
|
|
// looked like a secret replaced by mcpRedacted first.
|
|
Command string `json:"command,omitempty"`
|
|
// PackageSource: npx, uvx, pip, docker, binary, unknown.
|
|
PackageSource string `json:"package_source,omitempty"`
|
|
PackageName string `json:"package_name,omitempty"`
|
|
// PackagePinned: yes (an exact version or an image digest), no (a
|
|
// range, a tag, or nothing), unknown (a path or binary).
|
|
PackagePinned string `json:"package_pinned,omitempty"`
|
|
EnvNames []string `json:"env_names,omitempty"`
|
|
// SecretInPlaintext: a value in this entry (an env value, a header, an
|
|
// argument, the URL) matched a secret's shape. The value is not kept.
|
|
SecretInPlaintext bool `json:"secret_in_plaintext"`
|
|
// AuthConfigured: yes when the file gives a remote server a credential
|
|
// (a header, a bearer-token variable, credentials in the URL);
|
|
// not_applicable for a local process; unknown otherwise, because a client
|
|
// may negotiate OAuth when it connects and that leaves nothing in a file.
|
|
AuthConfigured string `json:"auth_configured"`
|
|
// BindClass: what the server listens on. not_applicable for stdio;
|
|
// unknown for a URL, which says where the client connects, not what the
|
|
// server binds.
|
|
BindClass string `json:"bind_class"`
|
|
Disabled bool `json:"disabled,omitempty"`
|
|
// RunningState: declared_running, declared_not_running,
|
|
// running_not_declared; not_local for a URL off this machine; unknown
|
|
// when the process list could not be read or a loopback URL cannot be
|
|
// matched to a process from a file.
|
|
RunningState string `json:"running_state"`
|
|
PIDs []int `json:"pids,omitempty"`
|
|
|
|
// The correlation key, never sent: a package name or a script path to
|
|
// find in a command line, or a program's basename to find as argv[0].
|
|
matchSub string
|
|
matchBase string
|
|
}
|
|
|
|
// mcpConfigScan says how much was looked at, so "no servers" from a box that
|
|
// read nothing is visibly different from one that read forty files.
|
|
type mcpConfigScan struct {
|
|
Supported bool `json:"supported"`
|
|
Accounts int `json:"accounts"`
|
|
Projects int `json:"projects"`
|
|
FilesRead int `json:"files_read"`
|
|
Unreadable int `json:"files_unreadable"`
|
|
Unparsed int `json:"files_unparsed"`
|
|
Truncated bool `json:"truncated,omitempty"`
|
|
// ForeignOwner: files skipped because neither the account they were
|
|
// read for nor root (SYSTEM or Administrators on Windows) owns them
|
|
// (mcpReadFileAs).
|
|
ForeignOwner int `json:"files_foreign_owner,omitempty"`
|
|
// TimedOut: the file read did not finish within mcpReadTimeout; the
|
|
// list is the last complete read, or empty when there was none.
|
|
TimedOut bool `json:"timed_out,omitempty"`
|
|
// ProcessScan: ok, failed or unsupported — whether running_state could
|
|
// be measured at all.
|
|
ProcessScan string `json:"process_scan"`
|
|
}
|
|
|
|
const (
|
|
mcpRedacted = "<redacted>"
|
|
mcpUnknown = "unknown"
|
|
mcpMaxFileBytes = 1 << 20
|
|
mcpMaxAccounts = 64
|
|
mcpMaxProjects = 200
|
|
mcpMaxServers = 500
|
|
mcpMaxPIDs = 8
|
|
mcpCommandMax = 200
|
|
mcpNameMax = 128 // a server name, an env name, a package name
|
|
mcpHostMax = 253 // a DNS name's own limit
|
|
mcpPathMax = 1024
|
|
mcpMaxEnvNames = 32
|
|
mcpMaxNesting = 64 // TOML arrays and inline tables
|
|
mcpNoOwnerCheck = "" // the owner a file is read for when no owner check applies
|
|
mcpOwnerUnknown = "?" // an owner that could not be read: matches nothing
|
|
mcpStateRunning = "declared_running"
|
|
mcpStateIdle = "declared_not_running"
|
|
mcpStateShadow = "running_not_declared"
|
|
mcpStateNotLocal = "not_local"
|
|
mcpStateUnknown = "unknown"
|
|
mcpLocalProcess = "local_process"
|
|
mcpNotApplicable = "not_applicable"
|
|
mcpFormatServers = "mcpServers" // a top-level mcpServers object
|
|
mcpFormatClaude = "claude-json" // ~/.claude.json: user and per-project servers
|
|
mcpFormatVSCode = "vscode" // a top-level servers object
|
|
mcpFormatZed = "context_servers" // Zed settings, JSON with comments
|
|
mcpFormatCodex = "codex-toml" // [mcp_servers.<name>] tables
|
|
mcpScopeUser = "user"
|
|
mcpScopeProject = "project"
|
|
mcpScopeSystem = "system"
|
|
mcpClientDesktop = "claude-desktop"
|
|
mcpClientCode = "claude-code"
|
|
mcpClientCursor = "cursor"
|
|
mcpClientVSCode = "vscode"
|
|
mcpClientWindsurf = "windsurf"
|
|
mcpClientCodex = "codex"
|
|
mcpClientZed = "zed"
|
|
)
|
|
|
|
// mcpHome is one account's home directory and the per-user application
|
|
// configuration directory under it (XDG on Linux, Application Support on
|
|
// macOS, AppData\Roaming on Windows).
|
|
type mcpHome struct {
|
|
Dir string
|
|
ConfigDir string
|
|
}
|
|
|
|
// mcpSource is one file to read.
|
|
type mcpSource struct {
|
|
Client, Scope, Path, Format string
|
|
}
|
|
|
|
// mcpConfigSources is every file the seven clients keep for one account, for
|
|
// the platform goos. Checked against each vendor's page on 2026-10-20:
|
|
//
|
|
// claude-desktop https://modelcontextprotocol.io/docs/develop/connect-local-servers
|
|
// macOS and Windows stated; the Linux path is NOT CONFIRMED
|
|
// (the page says Linux is supported and gives no path).
|
|
// claude-code https://code.claude.com/docs/en/mcp — user and local scope in
|
|
// ~/.claude.json (local nested under projects.<path>), project
|
|
// scope in .mcp.json; https://code.claude.com/docs/en/managed-mcp
|
|
// for the system file on each platform.
|
|
// cursor https://cursor.com/docs/context/mcp — ~/.cursor/mcp.json and
|
|
// .cursor/mcp.json; given only in the ~ form, so the Windows
|
|
// location (the user profile) is NOT CONFIRMED.
|
|
// vscode https://code.visualstudio.com/docs/copilot/reference/mcp-configuration
|
|
// — .vscode/mcp.json, and an mcp.json "in your user profile";
|
|
// the profile folder is from
|
|
// https://code.visualstudio.com/docs/configure/profiles. The
|
|
// exact user-file path is NOT CONFIRMED on any platform.
|
|
// windsurf https://docs.devin.ai/windsurf/plugins/cascade/mcp — the
|
|
// config-directory file (devin/mcp_config.json) and the
|
|
// editor's own ~/.codeium/windsurf[-next]/mcp_config.json; the
|
|
// Windows form of the second is NOT CONFIRMED.
|
|
// codex https://learn.chatgpt.com/docs/config-file/config-basic and
|
|
// https://learn.chatgpt.com/docs/extend/mcp — ~/.codex/config.toml,
|
|
// /etc/codex/config.toml, and .codex/config.toml in a trusted
|
|
// project; the Windows path is NOT CONFIRMED.
|
|
// zed https://zed.dev/docs/configuring-zed — ~/.config/zed/settings.json
|
|
// (macOS and Linux), %APPDATA%\Zed\settings.json, and
|
|
// .zed/settings.json in a project; "JSON with support for //
|
|
// comments".
|
|
func mcpConfigSources(goos string, h mcpHome) []mcpSource {
|
|
j := filepath.Join
|
|
out := []mcpSource{
|
|
{mcpClientDesktop, mcpScopeUser, j(h.ConfigDir, "Claude", "claude_desktop_config.json"), mcpFormatServers},
|
|
{mcpClientCode, mcpScopeUser, j(h.Dir, ".claude.json"), mcpFormatClaude},
|
|
{mcpClientCursor, mcpScopeUser, j(h.Dir, ".cursor", "mcp.json"), mcpFormatServers},
|
|
{mcpClientVSCode, mcpScopeUser, j(h.ConfigDir, "Code", "User", "mcp.json"), mcpFormatVSCode},
|
|
{mcpClientWindsurf, mcpScopeUser, j(h.ConfigDir, "devin", "mcp_config.json"), mcpFormatServers},
|
|
{mcpClientWindsurf, mcpScopeUser, j(h.Dir, ".codeium", "windsurf", "mcp_config.json"), mcpFormatServers},
|
|
{mcpClientWindsurf, mcpScopeUser, j(h.Dir, ".codeium", "windsurf-next", "mcp_config.json"), mcpFormatServers},
|
|
{mcpClientCodex, mcpScopeUser, j(h.Dir, ".codex", "config.toml"), mcpFormatCodex},
|
|
}
|
|
if goos == "windows" {
|
|
out = append(out, mcpSource{mcpClientZed, mcpScopeUser, j(h.ConfigDir, "Zed", "settings.json"), mcpFormatZed})
|
|
} else {
|
|
// macOS and Linux both: Zed keeps ~/.config/zed on macOS too, not
|
|
// Application Support.
|
|
out = append(out, mcpSource{mcpClientZed, mcpScopeUser, j(h.Dir, ".config", "zed", "settings.json"), mcpFormatZed})
|
|
}
|
|
return out
|
|
}
|
|
|
|
// mcpSystemSources is the machine-wide files: Claude Code's managed file and
|
|
// Codex's system config. programFiles is %ProgramFiles% on Windows.
|
|
func mcpSystemSources(goos, programFiles string) []mcpSource {
|
|
switch goos {
|
|
case "darwin":
|
|
return []mcpSource{
|
|
{mcpClientCode, mcpScopeSystem, filepath.Join("/Library", "Application Support", "ClaudeCode", "managed-mcp.json"), mcpFormatServers},
|
|
{mcpClientCodex, mcpScopeSystem, filepath.Join("/etc", "codex", "config.toml"), mcpFormatCodex},
|
|
}
|
|
case "windows":
|
|
if programFiles == "" {
|
|
return nil
|
|
}
|
|
return []mcpSource{
|
|
{mcpClientCode, mcpScopeSystem, filepath.Join(programFiles, "ClaudeCode", "managed-mcp.json"), mcpFormatServers},
|
|
}
|
|
default:
|
|
return []mcpSource{
|
|
{mcpClientCode, mcpScopeSystem, filepath.Join("/etc", "claude-code", "managed-mcp.json"), mcpFormatServers},
|
|
{mcpClientCodex, mcpScopeSystem, filepath.Join("/etc", "codex", "config.toml"), mcpFormatCodex},
|
|
}
|
|
}
|
|
}
|
|
|
|
// mcpProjectSources is the per-project files under one project directory.
|
|
// Project directories come from Claude Code's own list of projects in
|
|
// ~/.claude.json; the disk is never walked looking for projects, so a
|
|
// project only another client has opened is not seen. That is a stated
|
|
// limit, not a finding of "none".
|
|
func mcpProjectSources(dir string) []mcpSource {
|
|
j := filepath.Join
|
|
return []mcpSource{
|
|
{mcpClientCode, mcpScopeProject, j(dir, ".mcp.json"), mcpFormatServers},
|
|
{mcpClientCursor, mcpScopeProject, j(dir, ".cursor", "mcp.json"), mcpFormatServers},
|
|
{mcpClientVSCode, mcpScopeProject, j(dir, ".vscode", "mcp.json"), mcpFormatVSCode},
|
|
{mcpClientZed, mcpScopeProject, j(dir, ".zed", "settings.json"), mcpFormatZed},
|
|
{mcpClientCodex, mcpScopeProject, j(dir, ".codex", "config.toml"), mcpFormatCodex},
|
|
}
|
|
}
|
|
|
|
// mcpGOOS is the platform whose paths are read; a test reads another's.
|
|
var mcpGOOS = runtime.GOOS
|
|
|
|
// mcpHomesFn and mcpSystemFn are the platform's account list and system files
|
|
// (mcpconfig_<goos>.go); a test points them at a fixture.
|
|
var (
|
|
mcpHomesFn = mcpHomes
|
|
mcpSystemFn = mcpSystemFiles
|
|
)
|
|
|
|
// readMCPConfigs reads every source for every account and returns the
|
|
// declared servers (running state not yet known) and what was looked at.
|
|
func readMCPConfigs() ([]mcpServerObs, mcpConfigScan) {
|
|
homes, supported := mcpHomesFn()
|
|
scan := mcpConfigScan{Supported: supported}
|
|
if !supported {
|
|
return nil, scan
|
|
}
|
|
if len(homes) > mcpMaxAccounts {
|
|
homes, scan.Truncated = homes[:mcpMaxAccounts], true
|
|
}
|
|
scan.Accounts = len(homes)
|
|
var out []mcpServerObs
|
|
// A project is read for the account whose list named it, and its files
|
|
// are held to that account's ownership: one account naming another's
|
|
// directory as a project reads nothing of the other's.
|
|
type project struct {
|
|
dir string
|
|
owner string
|
|
}
|
|
seenProject := map[project]bool{}
|
|
var projects []project
|
|
read := func(src mcpSource, owner string) {
|
|
raw, ok := mcpReadFileAs(src.Path, owner, &scan)
|
|
if !ok {
|
|
return
|
|
}
|
|
entries, projs, err := mcpParse(src.Format, raw)
|
|
if err != nil {
|
|
scan.Unparsed++
|
|
return
|
|
}
|
|
for _, d := range projs {
|
|
p := project{d, owner}
|
|
if !seenProject[p] {
|
|
seenProject[p] = true
|
|
projects = append(projects, p)
|
|
}
|
|
}
|
|
for _, e := range entries {
|
|
o := mcpAnalyze(e)
|
|
o.Client, o.Path = src.Client, truncate(src.Path, mcpPathMax)
|
|
o.Scope = src.Scope
|
|
if e.projectScoped {
|
|
o.Scope = mcpScopeProject
|
|
}
|
|
out = append(out, o)
|
|
}
|
|
}
|
|
// The system files sit where only an administrator can write.
|
|
for _, src := range mcpSystemFn() {
|
|
read(src, mcpNoOwnerCheck)
|
|
}
|
|
for _, h := range homes {
|
|
owner := mcpPathOwner(h.Dir)
|
|
for _, src := range mcpConfigSources(mcpGOOS, h) {
|
|
read(src, owner)
|
|
}
|
|
}
|
|
sort.Slice(projects, func(i, j int) bool {
|
|
if projects[i].dir != projects[j].dir {
|
|
return projects[i].dir < projects[j].dir
|
|
}
|
|
return projects[i].owner < projects[j].owner
|
|
})
|
|
if len(projects) > mcpMaxProjects {
|
|
projects, scan.Truncated = projects[:mcpMaxProjects], true
|
|
}
|
|
scan.Projects = len(projects)
|
|
for _, p := range projects {
|
|
for _, src := range mcpProjectSources(p.dir) {
|
|
read(src, p.owner)
|
|
}
|
|
}
|
|
if len(out) > mcpMaxServers {
|
|
out, scan.Truncated = out[:mcpMaxServers], true
|
|
}
|
|
return out, scan
|
|
}
|
|
|
|
// mcpReadFile reads one config file, bounded. A file that is not there is
|
|
// not counted; one that is there and cannot be read is, so a bastion without
|
|
// the right to look says so instead of reporting "no servers".
|
|
//
|
|
// On linux and darwin a symlink is followed, as the client itself would, but
|
|
// what it points at is OPENED only once it is known to be a regular file
|
|
// (mcpOpenRegular, mcpconfig_open_<goos>.go). On Windows a link at the path
|
|
// itself is refused (mcpconfig_winopen.go). These paths sit in other people's home directories
|
|
// and this service reads them with every right it has: opening a FIFO would
|
|
// hold the heartbeat, and opening a device runs its driver (a watchdog arms,
|
|
// a serial line toggles), so a crafted link must never get that far.
|
|
func mcpReadFile(path string, scan *mcpConfigScan) ([]byte, bool) {
|
|
return mcpReadFileAs(path, mcpNoOwnerCheck, scan)
|
|
}
|
|
|
|
// mcpReadFileAs is mcpReadFile for one account: the file is read only when
|
|
// that account or an administrative owner owns it (root; on Windows SYSTEM
|
|
// or the Administrators group), so an account cannot point its own config
|
|
// path at another's file and have this service read it for it. owner is a
|
|
// uid on unix and a SID on Windows; mcpNoOwnerCheck reads whatever is there
|
|
// (the system files; a platform with no owner model).
|
|
func mcpReadFileAs(path string, owner string, scan *mcpConfigScan) ([]byte, bool) {
|
|
f, fileOwner, err := mcpOpenRegularFn(path)
|
|
if err != nil {
|
|
if !errors.Is(err, os.ErrNotExist) {
|
|
scan.Unreadable++
|
|
}
|
|
return nil, false
|
|
}
|
|
defer f.Close()
|
|
if !mcpOwnerAllowed(fileOwner, owner, mcpAdminOwners) {
|
|
scan.ForeignOwner++
|
|
return nil, false
|
|
}
|
|
b, err := io.ReadAll(io.LimitReader(f, mcpMaxFileBytes+1))
|
|
if err != nil {
|
|
scan.Unreadable++
|
|
return nil, false
|
|
}
|
|
if len(b) > mcpMaxFileBytes {
|
|
scan.Unparsed++
|
|
return nil, false
|
|
}
|
|
scan.FilesRead++
|
|
return b, true
|
|
}
|
|
|
|
// errMCPNotRegular: the path names something other than a regular file.
|
|
var errMCPNotRegular = errors.New("not a regular file")
|
|
|
|
// mcpOpenRegularFn is the seam a test uses to stand a platform's open in;
|
|
// production never reassigns it.
|
|
var mcpOpenRegularFn = mcpOpenRegular
|
|
|
|
// mcpOwnerAllowed: a file owned by file may be read for want. An owner that
|
|
// could not be read is never allowed where a check applies.
|
|
func mcpOwnerAllowed(file, want string, admins map[string]bool) bool {
|
|
if want == mcpNoOwnerCheck {
|
|
return true
|
|
}
|
|
if file == "" || file == mcpOwnerUnknown {
|
|
return false
|
|
}
|
|
return file == want || admins[file]
|
|
}
|
|
|
|
// mcpEntry is one server as a file declares it, before analysis. Values live
|
|
// here only between parsing and mcpAnalyze.
|
|
type mcpEntry struct {
|
|
name string
|
|
typ string
|
|
command string
|
|
args []string
|
|
env map[string]string
|
|
envNames []string // names passed through without a value (Codex env_vars)
|
|
url string
|
|
headers map[string]string
|
|
authHint bool // a credential configured by reference: bearer_token_env_var, env_http_headers, a headers helper
|
|
disabled bool
|
|
projectScoped bool
|
|
}
|
|
|
|
// mcpParse turns one file into entries, plus any project directories the
|
|
// file lists (Claude Code's ~/.claude.json).
|
|
func mcpParse(format string, raw []byte) ([]mcpEntry, []string, error) {
|
|
if format == mcpFormatCodex {
|
|
t, err := parseTOMLSubset(string(raw))
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
return mcpCodexEntries(t), nil, nil
|
|
}
|
|
var doc map[string]any
|
|
if err := json.Unmarshal(stripJSONC(raw), &doc); err != nil {
|
|
return nil, nil, err
|
|
}
|
|
switch format {
|
|
case mcpFormatVSCode:
|
|
return mcpJSONEntries(doc["servers"], false), nil, nil
|
|
case mcpFormatZed:
|
|
return mcpJSONEntries(doc["context_servers"], false), nil, nil
|
|
case mcpFormatClaude:
|
|
out := mcpJSONEntries(doc["mcpServers"], false)
|
|
var projects []string
|
|
if ps, ok := doc["projects"].(map[string]any); ok {
|
|
for dir, v := range ps {
|
|
projects = append(projects, filepath.FromSlash(dir))
|
|
if p, ok := v.(map[string]any); ok {
|
|
out = append(out, mcpJSONEntries(p["mcpServers"], true)...)
|
|
}
|
|
}
|
|
}
|
|
sort.Strings(projects)
|
|
return out, projects, nil
|
|
default:
|
|
return mcpJSONEntries(doc["mcpServers"], false), nil, nil
|
|
}
|
|
}
|
|
|
|
// mcpJSONEntries reads one servers object. The clients agree on command,
|
|
// args, env, url and headers; type is spelled `type` (and `transport` by some
|
|
// older files); Windsurf also spells the URL serverUrl; Zed's older form nests
|
|
// the command as {path, args, env}.
|
|
func mcpJSONEntries(v any, projectScoped bool) []mcpEntry {
|
|
m, ok := v.(map[string]any)
|
|
if !ok {
|
|
return nil
|
|
}
|
|
names := make([]string, 0, len(m))
|
|
for k := range m {
|
|
names = append(names, k)
|
|
}
|
|
sort.Strings(names)
|
|
var out []mcpEntry
|
|
for _, name := range names {
|
|
s, ok := m[name].(map[string]any)
|
|
if !ok {
|
|
continue
|
|
}
|
|
e := mcpEntry{name: name, projectScoped: projectScoped,
|
|
typ: jsonStr(s["type"]), url: jsonStr(s["url"])}
|
|
if e.typ == "" {
|
|
e.typ = jsonStr(s["transport"])
|
|
}
|
|
if e.url == "" {
|
|
e.url = jsonStr(s["serverUrl"])
|
|
}
|
|
e.args = jsonStrList(s["args"])
|
|
e.env = jsonStrMap(s["env"])
|
|
switch c := s["command"].(type) {
|
|
case string:
|
|
e.command = c
|
|
case map[string]any:
|
|
e.command = jsonStr(c["path"])
|
|
e.args = append(e.args, jsonStrList(c["args"])...)
|
|
for k, v := range jsonStrMap(c["env"]) {
|
|
if e.env == nil {
|
|
e.env = map[string]string{}
|
|
}
|
|
e.env[k] = v
|
|
}
|
|
}
|
|
e.headers = jsonStrMap(s["headers"])
|
|
if s["headersHelper"] != nil || s["oauth"] != nil {
|
|
e.authHint = true
|
|
}
|
|
if d, ok := s["disabled"].(bool); ok && d {
|
|
e.disabled = true
|
|
}
|
|
if en, ok := s["enabled"].(bool); ok && !en {
|
|
e.disabled = true
|
|
}
|
|
out = append(out, e)
|
|
}
|
|
return out
|
|
}
|
|
|
|
func jsonStr(v any) string {
|
|
s, _ := v.(string)
|
|
return s
|
|
}
|
|
|
|
func jsonStrList(v any) []string {
|
|
l, ok := v.([]any)
|
|
if !ok {
|
|
return nil
|
|
}
|
|
out := make([]string, 0, len(l))
|
|
for _, x := range l {
|
|
if s, ok := x.(string); ok {
|
|
out = append(out, s)
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
// jsonStrMap keeps string values; any other value is kept as "" so its NAME
|
|
// still counts (a number in env is still a variable passed to the server).
|
|
func jsonStrMap(v any) map[string]string {
|
|
m, ok := v.(map[string]any)
|
|
if !ok {
|
|
return nil
|
|
}
|
|
out := make(map[string]string, len(m))
|
|
for k, x := range m {
|
|
s, _ := x.(string)
|
|
out[k] = s
|
|
}
|
|
return out
|
|
}
|
|
|
|
// mcpCodexEntries reads [mcp_servers.<name>] tables (Codex config.toml):
|
|
// command, args, env, env_vars, url, bearer_token_env_var, http_headers,
|
|
// env_http_headers, enabled.
|
|
func mcpCodexEntries(t map[string]any) []mcpEntry {
|
|
servers, ok := t["mcp_servers"].(map[string]any)
|
|
if !ok {
|
|
return nil
|
|
}
|
|
names := make([]string, 0, len(servers))
|
|
for k := range servers {
|
|
names = append(names, k)
|
|
}
|
|
sort.Strings(names)
|
|
var out []mcpEntry
|
|
for _, name := range names {
|
|
s, ok := servers[name].(map[string]any)
|
|
if !ok {
|
|
continue
|
|
}
|
|
e := mcpEntry{name: name, command: jsonStr(s["command"]), url: jsonStr(s["url"]),
|
|
args: jsonStrList(s["args"]), env: jsonStrMap(s["env"]), headers: jsonStrMap(s["http_headers"])}
|
|
if l, ok := s["env_vars"].([]any); ok {
|
|
for _, x := range l {
|
|
switch v := x.(type) {
|
|
case string:
|
|
e.envNames = append(e.envNames, v)
|
|
case map[string]any:
|
|
if n := jsonStr(v["name"]); n != "" {
|
|
e.envNames = append(e.envNames, n)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
if n := jsonStr(s["bearer_token_env_var"]); n != "" {
|
|
e.authHint = true
|
|
e.envNames = append(e.envNames, n)
|
|
}
|
|
if h, ok := s["env_http_headers"].(map[string]any); ok && len(h) > 0 {
|
|
e.authHint = true
|
|
}
|
|
if en, ok := s["enabled"].(bool); ok && !en {
|
|
e.disabled = true
|
|
}
|
|
out = append(out, e)
|
|
}
|
|
return out
|
|
}
|
|
|
|
// mcpAnalyze turns an entry into the record that leaves the machine. Every
|
|
// value it looks at is used for a shape check and then goes out of scope with
|
|
// the entry; nothing but names and classes is copied into the result.
|
|
func mcpAnalyze(e mcpEntry) mcpServerObs {
|
|
o := mcpServerObs{Name: truncate(e.name, mcpNameMax), Disabled: e.disabled}
|
|
o.Transport = mcpTransport(e)
|
|
for k := range e.env {
|
|
o.EnvNames = append(o.EnvNames, k)
|
|
}
|
|
o.EnvNames = append(o.EnvNames, e.envNames...)
|
|
o.EnvNames = dedupeStrings(o.EnvNames)
|
|
sort.Strings(o.EnvNames)
|
|
if len(o.EnvNames) > mcpMaxEnvNames {
|
|
o.EnvNames = o.EnvNames[:mcpMaxEnvNames]
|
|
}
|
|
for i, n := range o.EnvNames {
|
|
o.EnvNames[i] = truncate(n, mcpNameMax)
|
|
}
|
|
for k, v := range e.env {
|
|
if secretShaped(k, v) {
|
|
o.SecretInPlaintext = true
|
|
}
|
|
}
|
|
headerAuth := false
|
|
for k, v := range e.headers {
|
|
if secretShaped(k, v) {
|
|
o.SecretInPlaintext = true
|
|
}
|
|
if mcpAuthHeader(k) {
|
|
headerAuth = true
|
|
}
|
|
}
|
|
args, argSecret := redactSecretArgs(e.args)
|
|
if argSecret {
|
|
o.SecretInPlaintext = true
|
|
}
|
|
if e.command != "" {
|
|
// A file may put the whole command line in command; it is redacted
|
|
// word by word like the arguments.
|
|
cmd, cmdSecret := redactSecretArgs(strings.Fields(e.command))
|
|
if cmdSecret {
|
|
o.SecretInPlaintext = true
|
|
}
|
|
o.Command = truncate(strings.Join(append(cmd, args...), " "), mcpCommandMax)
|
|
o.PackageSource, o.PackageName, o.PackagePinned = mcpPackage(e.command, e.args)
|
|
o.matchSub, o.matchBase = mcpMatchKey(e.command, e.args, o.PackageName)
|
|
o.PackageName = truncate(o.PackageName, mcpNameMax)
|
|
}
|
|
if o.Transport == "stdio" {
|
|
o.Locality, o.AuthConfigured, o.BindClass = mcpLocalProcess, mcpNotApplicable, mcpNotApplicable
|
|
return o
|
|
}
|
|
o.BindClass = mcpUnknown
|
|
o.AuthConfigured = mcpUnknown
|
|
o.Locality = mcpUnknown
|
|
if e.url != "" {
|
|
host, urlSecret, urlAuth := mcpURLFacts(e.url)
|
|
o.URLHost = truncate(host, mcpHostMax)
|
|
o.Locality = hostLocality(host)
|
|
if urlSecret {
|
|
o.SecretInPlaintext = true
|
|
}
|
|
if urlAuth {
|
|
headerAuth = true
|
|
}
|
|
}
|
|
if headerAuth || e.authHint {
|
|
o.AuthConfigured = ownerYes
|
|
}
|
|
return o
|
|
}
|
|
|
|
// mcpTransport is the declared type, or what the entry's shape implies.
|
|
func mcpTransport(e mcpEntry) string {
|
|
switch strings.ToLower(strings.TrimSpace(e.typ)) {
|
|
case "stdio":
|
|
return "stdio"
|
|
case "http", "streamable-http", "streamablehttp", "streamable_http":
|
|
return "http"
|
|
case "sse":
|
|
return "sse"
|
|
case "ws", "websocket":
|
|
return "websocket"
|
|
case "":
|
|
default:
|
|
return mcpUnknown
|
|
}
|
|
switch {
|
|
case e.command != "":
|
|
return "stdio"
|
|
case e.url == "":
|
|
return mcpUnknown
|
|
}
|
|
u, err := url.Parse(e.url)
|
|
if err != nil {
|
|
return mcpUnknown
|
|
}
|
|
switch strings.ToLower(u.Scheme) {
|
|
case "ws", "wss":
|
|
return "websocket"
|
|
}
|
|
if strings.HasSuffix(strings.TrimRight(u.Path, "/"), "/sse") {
|
|
return "sse"
|
|
}
|
|
return "http"
|
|
}
|
|
|
|
// mcpURLFacts: the URL's host, whether credentials sit in it (a password in
|
|
// the userinfo, or a secret-named query parameter with a value), and whether
|
|
// that amounts to authentication being configured. The URL itself is not
|
|
// kept: its path and query can carry a token.
|
|
func mcpURLFacts(raw string) (host string, secret bool, auth bool) {
|
|
u, err := url.Parse(raw)
|
|
if err != nil {
|
|
return "", false, false
|
|
}
|
|
host = strings.ToLower(u.Hostname())
|
|
if u.User != nil {
|
|
if _, has := u.User.Password(); has {
|
|
secret, auth = true, true
|
|
}
|
|
}
|
|
for k, vs := range u.Query() {
|
|
for _, v := range vs {
|
|
if secretName(k) && v != "" && !isReference(v) {
|
|
secret, auth = true, true
|
|
}
|
|
}
|
|
}
|
|
return host, secret, auth
|
|
}
|
|
|
|
// hostLocality classes a URL host without resolving it. Resolving a name is
|
|
// a network request, which this file does not make, so a name is classed
|
|
// by its form: loopback names and addresses, private and link-local
|
|
// addresses, and names no public resolver answers (one label, .local,
|
|
// .internal, .lan, .home.arpa) are local; anything else is remote.
|
|
func hostLocality(host string) string {
|
|
h := strings.TrimSuffix(strings.ToLower(host), ".")
|
|
switch {
|
|
case h == "":
|
|
return mcpUnknown
|
|
case h == "localhost" || strings.HasSuffix(h, ".localhost"):
|
|
return "loopback"
|
|
}
|
|
if ip := net.ParseIP(h); ip != nil {
|
|
switch {
|
|
case ip.IsLoopback():
|
|
return "loopback"
|
|
case ip.IsPrivate() || ip.IsLinkLocalUnicast():
|
|
return "lan"
|
|
case ip.IsUnspecified():
|
|
return "loopback"
|
|
}
|
|
return "remote"
|
|
}
|
|
if !strings.Contains(h, ".") {
|
|
return "lan"
|
|
}
|
|
for _, suffix := range []string{".local", ".internal", ".lan", ".home.arpa"} {
|
|
if strings.HasSuffix(h, suffix) {
|
|
return "lan"
|
|
}
|
|
}
|
|
return "remote"
|
|
}
|
|
|
|
// mcpAuthHeader: a header whose name carries a credential.
|
|
func mcpAuthHeader(name string) bool {
|
|
n := strings.ToLower(name)
|
|
return n == "authorization" || n == "cookie" || n == "proxy-authorization" || secretName(n)
|
|
}
|
|
|
|
// ── secrets: the shape, never the value ─────────────────────────────────────
|
|
|
|
// secretPrefixes are the shapes of credentials whose issuers publish a fixed
|
|
// prefix: Anthropic and OpenAI keys, GitHub tokens, Slack tokens, AWS access
|
|
// key ids, Google API keys, GitLab tokens, Hugging Face and npm tokens, JWTs,
|
|
// and PEM private keys.
|
|
var secretPrefixes = regexp.MustCompile(`(?:^|[^A-Za-z0-9])(?:` +
|
|
`sk-ant-[A-Za-z0-9_-]{16,}|sk-(?:proj-)?[A-Za-z0-9_-]{20,}|` +
|
|
`gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{30,}|` +
|
|
`xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|` +
|
|
`glpat-[A-Za-z0-9_-]{20,}|hf_[A-Za-z0-9]{30,}|npm_[A-Za-z0-9]{36}|` +
|
|
`eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.|-----BEGIN [A-Z ]*PRIVATE KEY-----)`)
|
|
|
|
// secretNameRe: a variable, header or flag whose name says it holds a secret.
|
|
var secretNameRe = regexp.MustCompile(`(?i)(key|token|secret|passw|pwd|credential|auth|bearer|cookie|session)`)
|
|
|
|
func secretName(name string) bool { return secretNameRe.MatchString(name) }
|
|
|
|
// isReference: the value names where the secret comes from (${env:X},
|
|
// ${input:x}, $X, %X%) rather than holding it.
|
|
func isReference(v string) bool {
|
|
v = strings.TrimSpace(v)
|
|
return strings.Contains(v, "${") || strings.HasPrefix(v, "$") ||
|
|
(len(v) > 2 && strings.HasPrefix(v, "%") && strings.HasSuffix(v, "%"))
|
|
}
|
|
|
|
// secretShaped answers whether one name/value pair holds a secret in plain
|
|
// text: the value has a known credential's shape, or the name says secret and
|
|
// the value is a literal long enough to be one. The value is not returned or
|
|
// kept; the caller gets a bool.
|
|
func secretShaped(name, value string) bool {
|
|
v := strings.TrimSpace(value)
|
|
if v == "" || isReference(v) {
|
|
return false
|
|
}
|
|
if secretPrefixes.MatchString(v) {
|
|
return true
|
|
}
|
|
if strings.HasPrefix(strings.ToLower(v), "bearer ") || strings.HasPrefix(strings.ToLower(v), "basic ") {
|
|
rest := strings.TrimSpace(v[strings.IndexByte(v, ' ')+1:])
|
|
return len(rest) >= 8 && !isReference(rest)
|
|
}
|
|
if !secretName(name) || len(v) < 8 {
|
|
return false
|
|
}
|
|
// A path or a plain URL under a secret-sounding name (a key FILE, an
|
|
// auth SERVER) is where a secret lives, not the secret.
|
|
if filepath.IsAbs(v) || strings.HasPrefix(v, "~") || strings.HasPrefix(v, "./") {
|
|
return false
|
|
}
|
|
if u, err := url.Parse(v); err == nil && u.Scheme != "" && u.Host != "" {
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
// isPureReference: the whole value is one ${...} reference (${VAR},
|
|
// ${env:VAR}, ${input:id}), which the client expands and which names where
|
|
// the secret comes from. Only that form is kept on a redacted command line:
|
|
// a bare $NAME is passed through literally by clients that start a server
|
|
// without a shell, so it may well be the secret itself.
|
|
func isPureReference(v string) bool {
|
|
v = strings.TrimSpace(v)
|
|
return strings.HasPrefix(v, "${") && strings.HasSuffix(v, "}") && strings.Count(v, "${") == 1 &&
|
|
strings.IndexByte(v, '}') == len(v)-1
|
|
}
|
|
|
|
// redactSecretArgs replaces every argument that holds a secret with
|
|
// mcpRedacted: one with a credential's shape, the value after or inside a
|
|
// flag whose name says secret, a NAME=value whose name does, a header
|
|
// argument (Authorization: ..., X-Api-Key: ...), and the userinfo, path and
|
|
// query of a URL. found reports whether a value matched a secret's shape;
|
|
// redaction itself is wider than that, because a value that does not look
|
|
// like a secret can still be one.
|
|
func redactSecretArgs(args []string) (out []string, found bool) {
|
|
out = make([]string, len(args))
|
|
for i := 0; i < len(args); i++ {
|
|
a := args[i]
|
|
if strings.HasPrefix(a, "-") {
|
|
flag, val, hasVal := strings.Cut(strings.TrimLeft(a, "-"), "=")
|
|
if hasVal {
|
|
v, f := redactValue(flag, val)
|
|
out[i], found = a[:len(a)-len(val)]+v, found || f
|
|
continue
|
|
}
|
|
out[i] = a
|
|
if secretName(flag) && i+1 < len(args) && !strings.HasPrefix(args[i+1], "-") {
|
|
v, f := redactValue(flag, args[i+1])
|
|
out[i+1], found = v, found || f
|
|
i++
|
|
}
|
|
continue
|
|
}
|
|
v, f := redactValue("", a)
|
|
out[i], found = v, found || f
|
|
}
|
|
return out, found
|
|
}
|
|
|
|
// redactValue is one value with whatever secret it carries replaced. name is
|
|
// the flag or variable it was given under, "" for a positional argument.
|
|
func redactValue(name, v string) (string, bool) {
|
|
if v == "" || isPureReference(v) {
|
|
return v, false
|
|
}
|
|
if secretPrefixes.MatchString(v) {
|
|
return mcpRedacted, true
|
|
}
|
|
if secretName(name) {
|
|
return mcpRedacted, secretShaped(name, v)
|
|
}
|
|
if low := strings.ToLower(v); strings.HasPrefix(low, "bearer ") || strings.HasPrefix(low, "basic ") {
|
|
return mcpRedacted, secretShaped(name, v)
|
|
}
|
|
if i := strings.Index(v, "://"); i > 0 && !strings.ContainsAny(v[:i], " =:") {
|
|
return redactURL(v)
|
|
}
|
|
if k, val, ok := strings.Cut(v, "="); ok && k != "" && !strings.ContainsAny(k, " /\\:") {
|
|
r, f := redactValue(k, val)
|
|
return k + "=" + r, f
|
|
}
|
|
if k, val, ok := strings.Cut(v, ":"); ok && k != "" && !strings.ContainsAny(k, " /\\") && mcpAuthHeader(k) {
|
|
val = strings.TrimSpace(val)
|
|
rest := val
|
|
if low := strings.ToLower(rest); strings.HasPrefix(low, "bearer ") || strings.HasPrefix(low, "basic ") {
|
|
rest = strings.TrimSpace(rest[strings.IndexByte(rest, ' ')+1:])
|
|
}
|
|
if rest == "" || isPureReference(rest) {
|
|
return v, false
|
|
}
|
|
return k + ": " + mcpRedacted, secretShaped(k, val)
|
|
}
|
|
return v, false
|
|
}
|
|
|
|
// redactURL keeps a URL's scheme and host and replaces the rest: userinfo
|
|
// carries credentials, and a path or query can carry a token as easily as a
|
|
// named parameter does. found: a password, a secret-shaped user, or a
|
|
// secret-named query parameter with a value.
|
|
func redactURL(raw string) (string, bool) {
|
|
u, err := url.Parse(raw)
|
|
if err != nil || u.Host == "" {
|
|
return mcpRedacted, secretPrefixes.MatchString(raw)
|
|
}
|
|
_, found, _ := mcpURLFacts(raw)
|
|
out := u.Scheme + "://"
|
|
if u.User != nil {
|
|
out += mcpRedacted + "@"
|
|
if secretPrefixes.MatchString(u.User.Username()) {
|
|
found = true
|
|
}
|
|
}
|
|
out += truncate(u.Host, mcpHostMax)
|
|
if strings.Trim(u.EscapedPath(), "/") != "" || u.RawQuery != "" || u.Fragment != "" || u.Opaque != "" {
|
|
out += "/" + mcpRedacted
|
|
}
|
|
return out, found
|
|
}
|
|
|
|
// ── packages: where the server's code comes from, and whether it is pinned ──
|
|
|
|
var (
|
|
exactSemver = regexp.MustCompile(`^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$`)
|
|
exactPEP440 = regexp.MustCompile(`^\d+(?:\.\d+)*(?:(?:a|b|rc)\d+)?(?:\.post\d+)?(?:\.dev\d+)?$`)
|
|
)
|
|
|
|
// npm flags that take a value, so the value is not mistaken for the package.
|
|
var npxValueFlags = map[string]bool{"-p": true, "--package": true, "--registry": true,
|
|
"--cache": true, "--prefix": true, "-c": true, "--call": true, "--userconfig": true}
|
|
|
|
// uvx flags that take a value; --from names the package itself.
|
|
var uvxValueFlags = map[string]bool{"--from": true, "--with": true, "-w": true, "--python": true,
|
|
"-p": true, "--index": true, "--index-url": true, "--extra-index-url": true,
|
|
"--with-requirements": true, "--constraint": true, "-c": true}
|
|
|
|
// docker run flags that take a value (the common ones a server entry uses).
|
|
var dockerValueFlags = map[string]bool{"-e": true, "--env": true, "--env-file": true, "-v": true,
|
|
"--volume": true, "--mount": true, "--name": true, "--network": true, "--net": true,
|
|
"-p": true, "--publish": true, "-w": true, "--workdir": true, "-u": true, "--user": true,
|
|
"--entrypoint": true, "-l": true, "--label": true, "--platform": true, "--pull": true,
|
|
"--memory": true, "-m": true, "--cpus": true, "--add-host": true, "--cap-add": true,
|
|
"--cap-drop": true, "--security-opt": true, "--hostname": true, "-h": true, "--init-path": true}
|
|
|
|
// mcpPackage names where a stdio server's code comes from.
|
|
func mcpPackage(command string, args []string) (source, name, pinned string) {
|
|
base := runnerBase(command)
|
|
switch {
|
|
case base == "npx" || base == "bunx" || base == "pnpx" ||
|
|
((base == "pnpm" || base == "yarn") && len(args) > 0 && args[0] == "dlx") ||
|
|
(base == "npm" && len(args) > 0 && args[0] == "exec"):
|
|
if base == "pnpm" || base == "yarn" || base == "npm" {
|
|
args = args[1:]
|
|
}
|
|
spec := firstPositional(args, npxValueFlags, map[string]bool{"-p": true, "--package": true})
|
|
n, ver := splitNPMSpec(spec)
|
|
return "npx", n, pinnedWord(ver, exactSemver, spec)
|
|
case base == "uvx" || (base == "uv" && len(args) > 1 && args[0] == "tool" && args[1] == "run"):
|
|
if base == "uv" {
|
|
args = args[2:]
|
|
}
|
|
spec := firstPositional(args, uvxValueFlags, map[string]bool{"--from": true})
|
|
n, ver := splitPySpec(spec)
|
|
return "uvx", n, pinnedWord(ver, exactPEP440, spec)
|
|
case base == "pipx" && len(args) > 0 && args[0] == "run":
|
|
spec := firstPositional(args[1:], map[string]bool{"--spec": true, "--python": true}, map[string]bool{"--spec": true})
|
|
n, ver := splitPySpec(spec)
|
|
return "pip", n, pinnedWord(ver, exactPEP440, spec)
|
|
case base == "docker" || base == "podman":
|
|
i := 0
|
|
for i < len(args) && args[i] != "run" {
|
|
i++
|
|
}
|
|
if i == len(args) {
|
|
return "docker", "", mcpUnknown
|
|
}
|
|
image := firstPositional(args[i+1:], dockerValueFlags, nil)
|
|
n, digest := splitImage(image)
|
|
if image == "" {
|
|
return "docker", "", mcpUnknown
|
|
}
|
|
return "docker", n, yesNo(digest)
|
|
case interpreters[base]:
|
|
// node server.js, python -m pkg: the code is a script or module on
|
|
// disk, not a package the command line names.
|
|
return mcpUnknown, "", mcpUnknown
|
|
}
|
|
return "binary", "", mcpUnknown
|
|
}
|
|
|
|
// runnerBase is binBase with the Windows script suffixes dropped too: npm
|
|
// installs npx as npx.cmd there, and a config names it either way.
|
|
func runnerBase(s string) string {
|
|
b := binBase(s)
|
|
for _, suf := range []string{".cmd", ".bat", ".ps1"} {
|
|
b = strings.TrimSuffix(b, suf)
|
|
}
|
|
return b
|
|
}
|
|
|
|
// firstPositional is the first argument that is not a flag or a flag's value.
|
|
// A flag in pick names the package itself, and its value is returned.
|
|
func firstPositional(args []string, valueFlags, pick map[string]bool) string {
|
|
for i := 0; i < len(args); i++ {
|
|
a := args[i]
|
|
if f, v, ok := strings.Cut(a, "="); ok && strings.HasPrefix(a, "-") {
|
|
if pick[f] {
|
|
return v
|
|
}
|
|
continue
|
|
}
|
|
if pick[a] && i+1 < len(args) {
|
|
return args[i+1]
|
|
}
|
|
if valueFlags[a] {
|
|
i++
|
|
continue
|
|
}
|
|
if strings.HasPrefix(a, "-") {
|
|
continue
|
|
}
|
|
return a
|
|
}
|
|
return ""
|
|
}
|
|
|
|
// splitNPMSpec splits "@scope/name@1.2.3" or "name@^1" into name and version.
|
|
func splitNPMSpec(spec string) (name, version string) {
|
|
if spec == "" {
|
|
return "", ""
|
|
}
|
|
if strings.Contains(spec, "://") {
|
|
// git+https://user:token@host/..., a tarball URL: not a registry
|
|
// name, and its userinfo can carry a credential.
|
|
n, _ := redactURL(spec)
|
|
return n, ""
|
|
}
|
|
at := strings.LastIndexByte(spec, '@')
|
|
if at <= 0 {
|
|
return spec, ""
|
|
}
|
|
return spec[:at], spec[at+1:]
|
|
}
|
|
|
|
// splitPySpec splits "name==1.2", "name@1.2" or "name>=1" into name and the
|
|
// exact version when the spec pins one ("" otherwise, with a range kept as a
|
|
// non-matching version so it reads as not pinned).
|
|
func splitPySpec(spec string) (name, version string) {
|
|
if strings.Contains(spec, "://") {
|
|
n, _ := redactURL(spec)
|
|
return n, ""
|
|
}
|
|
if i := strings.Index(spec, "=="); i > 0 {
|
|
return spec[:i], spec[i+2:]
|
|
}
|
|
if i := strings.IndexByte(spec, '@'); i > 0 {
|
|
return spec[:i], spec[i+1:]
|
|
}
|
|
if i := strings.IndexAny(spec, "<>~!="); i > 0 {
|
|
return spec[:i], spec[i:]
|
|
}
|
|
return spec, ""
|
|
}
|
|
|
|
// splitImage splits an image reference into its name and whether it is
|
|
// pinned by digest. A tag can be moved to other content; only a digest
|
|
// cannot, so only a digest counts as pinned.
|
|
func splitImage(ref string) (name string, digest bool) {
|
|
if i := strings.Index(ref, "@sha256:"); i > 0 {
|
|
return ref[:i], true
|
|
}
|
|
slash := strings.LastIndexByte(ref, '/')
|
|
if c := strings.LastIndexByte(ref, ':'); c > slash {
|
|
return ref[:c], false
|
|
}
|
|
return ref, false
|
|
}
|
|
|
|
// pinnedWord: yes for an exact version, no for a range, a tag or none, and
|
|
// unknown when the spec is a path, a URL or a git reference.
|
|
func pinnedWord(version string, exact *regexp.Regexp, spec string) string {
|
|
if spec == "" || strings.ContainsAny(spec, `/\`) && !strings.HasPrefix(spec, "@") ||
|
|
strings.Contains(spec, ":") {
|
|
return mcpUnknown
|
|
}
|
|
return yesNo(exact.MatchString(version))
|
|
}
|
|
|
|
// mcpMatchKey is what finds this server in a process list: the package name
|
|
// for a packaged server, the script for an interpreter, the program's
|
|
// basename otherwise.
|
|
func mcpMatchKey(command string, args []string, pkg string) (sub, base string) {
|
|
if pkg != "" {
|
|
return strings.ToLower(pkg), ""
|
|
}
|
|
b := runnerBase(command)
|
|
if interpreters[b] {
|
|
for _, a := range args {
|
|
if !strings.HasPrefix(a, "-") {
|
|
return strings.ToLower(a), ""
|
|
}
|
|
}
|
|
return "", ""
|
|
}
|
|
return "", b
|
|
}
|
|
|
|
// ── correlation with the process list ───────────────────────────────────────
|
|
|
|
// mcpProc is one process as the platform enumerator saw it. Argv is empty
|
|
// when the platform did not read this process's command line (Windows reads
|
|
// it only for candidates); such a process still carries its parent link.
|
|
type mcpProc struct {
|
|
PID int
|
|
PPID int
|
|
Argv []string
|
|
}
|
|
|
|
// mcpWantedBases is the program basenames whose command lines the Windows
|
|
// enumerator must read: every interpreter and package runner, plus every
|
|
// program a declared server names.
|
|
func mcpWantedBases(declared []mcpServerObs) map[string]bool {
|
|
want := map[string]bool{"docker": true, "podman": true, "pipx": true, "pnpm": true, "yarn": true,
|
|
"npm": true, "bunx": true, "pnpx": true}
|
|
for b := range interpreters {
|
|
want[b] = true
|
|
}
|
|
for _, d := range declared {
|
|
if d.matchBase != "" {
|
|
want[d.matchBase] = true
|
|
}
|
|
}
|
|
return want
|
|
}
|
|
|
|
// correlateMCP sets running_state on every declared server and adds the
|
|
// servers that are running with no declaration. procsOK false means the
|
|
// process list could not be read, and then nothing is guessed: every local
|
|
// server reads unknown and no undeclared server is reported.
|
|
func correlateMCP(declared []mcpServerObs, procs []mcpProc, procsOK bool) []mcpServerObs {
|
|
byPID := map[int]mcpProc{}
|
|
for _, p := range procs {
|
|
byPID[p.PID] = p
|
|
}
|
|
// Direct matches: a process whose command line names a declared server.
|
|
owner := map[int][]int{} // pid -> indexes into declared
|
|
for pid, p := range byPID {
|
|
if len(p.Argv) == 0 {
|
|
continue
|
|
}
|
|
low := strings.ToLower(strings.Join(p.Argv, " "))
|
|
for i, d := range declared {
|
|
if d.Transport != "stdio" {
|
|
continue
|
|
}
|
|
if (d.matchSub != "" && strings.Contains(low, d.matchSub)) ||
|
|
(d.matchBase != "" && binBase(p.Argv[0]) == d.matchBase) {
|
|
owner[pid] = append(owner[pid], i)
|
|
}
|
|
}
|
|
}
|
|
// A package runner starts the server as a child (npx -> node .../bin/x),
|
|
// and the child is the same server: it inherits its parent's match.
|
|
inherit := func(pid int) []int {
|
|
seen := map[int]bool{}
|
|
for hop := 0; hop < maxHelperHops; hop++ {
|
|
p, ok := byPID[pid]
|
|
if !ok || seen[pid] {
|
|
return nil
|
|
}
|
|
seen[pid] = true
|
|
if m := owner[p.PPID]; len(m) > 0 {
|
|
return m
|
|
}
|
|
pid = p.PPID
|
|
}
|
|
return nil
|
|
}
|
|
matched := map[int][]int{}
|
|
for pid := range byPID {
|
|
if m := owner[pid]; len(m) > 0 {
|
|
matched[pid] = m
|
|
} else if m := inherit(pid); len(m) > 0 {
|
|
matched[pid] = m
|
|
}
|
|
}
|
|
pids := make([][]int, len(declared))
|
|
for pid, idx := range matched {
|
|
for _, i := range idx {
|
|
pids[i] = append(pids[i], pid)
|
|
}
|
|
}
|
|
out := make([]mcpServerObs, 0, len(declared))
|
|
for i, d := range declared {
|
|
switch {
|
|
case d.Transport != "stdio" && (d.Locality == "remote" || d.Locality == "lan"):
|
|
d.RunningState = mcpStateNotLocal
|
|
case d.Transport != "stdio" || !procsOK:
|
|
d.RunningState = mcpStateUnknown
|
|
case len(pids[i]) > 0:
|
|
d.RunningState = mcpStateRunning
|
|
sort.Ints(pids[i])
|
|
if len(pids[i]) > mcpMaxPIDs {
|
|
pids[i] = pids[i][:mcpMaxPIDs]
|
|
}
|
|
d.PIDs = pids[i]
|
|
default:
|
|
d.RunningState = mcpStateIdle
|
|
}
|
|
out = append(out, d)
|
|
}
|
|
if !procsOK {
|
|
return out
|
|
}
|
|
// Undeclared: a process that looks like a tool server, matched by no
|
|
// declaration, and not itself the child of one already reported.
|
|
shadow := map[int]bool{}
|
|
for pid, p := range byPID {
|
|
if len(matched[pid]) == 0 && looksLikeMCPServer(p.Argv) {
|
|
shadow[pid] = true
|
|
}
|
|
}
|
|
var shadowPIDs []int
|
|
for pid := range shadow {
|
|
if !shadowAncestor(byPID, shadow, pid) {
|
|
shadowPIDs = append(shadowPIDs, pid)
|
|
}
|
|
}
|
|
sort.Ints(shadowPIDs)
|
|
for _, pid := range shadowPIDs {
|
|
if len(out) >= mcpMaxServers {
|
|
break
|
|
}
|
|
p := byPID[pid]
|
|
args, secret := redactSecretArgs(p.Argv[1:])
|
|
src, name, pinned := mcpPackage(p.Argv[0], p.Argv[1:])
|
|
name = truncate(name, mcpNameMax)
|
|
out = append(out, mcpServerObs{Name: name, Transport: mcpUnknown, Locality: mcpLocalProcess,
|
|
Command: truncate(strings.Join(append([]string{p.Argv[0]}, args...), " "), mcpCommandMax),
|
|
PackageSource: src, PackageName: name, PackagePinned: pinned, SecretInPlaintext: secret,
|
|
AuthConfigured: mcpNotApplicable, BindClass: mcpUnknown,
|
|
RunningState: mcpStateShadow, PIDs: []int{pid}})
|
|
}
|
|
return out
|
|
}
|
|
|
|
func shadowAncestor(byPID map[int]mcpProc, shadow map[int]bool, pid int) bool {
|
|
seen := map[int]bool{pid: true}
|
|
for hop := 0; hop < maxHelperHops; hop++ {
|
|
p, ok := byPID[pid]
|
|
if !ok {
|
|
return false
|
|
}
|
|
if shadow[p.PPID] {
|
|
return true
|
|
}
|
|
if seen[p.PPID] {
|
|
return false
|
|
}
|
|
seen[p.PPID] = true
|
|
pid = p.PPID
|
|
}
|
|
return false
|
|
}
|
|
|
|
// mcpNPMScope is the npm scope the protocol's reference servers are published
|
|
// under; a command line naming it is running one of them.
|
|
const mcpNPMScope = "@modelcontextprotocol/"
|
|
|
|
// looksLikeMCPServer: a process whose command line names a tool server — a
|
|
// program or package whose name carries "mcp" as a word (github-mcp-server,
|
|
// mcp-server-git, fastmcp, mcp-remote) or the reference servers' npm scope.
|
|
// Only for a program that runs servers (an interpreter or package runner) or
|
|
// one whose own name carries the word: an agent started with --mcp-config is
|
|
// a client, and flags are never read. Soft, like every process signal here.
|
|
func looksLikeMCPServer(argv []string) bool {
|
|
if len(argv) == 0 {
|
|
return false
|
|
}
|
|
if _, isAgent := matchAgentSignature(argv); isAgent {
|
|
return false
|
|
}
|
|
base := runnerBase(argv[0])
|
|
if mcpWord(base) {
|
|
return true
|
|
}
|
|
if !interpreters[base] && base != "docker" && base != "podman" && base != "npm" && base != "pipx" {
|
|
return false
|
|
}
|
|
for _, a := range argv[1:] {
|
|
if strings.HasPrefix(a, "-") {
|
|
continue
|
|
}
|
|
low := strings.ToLower(a)
|
|
if strings.Contains(low, mcpNPMScope) {
|
|
return true
|
|
}
|
|
for _, part := range strings.FieldsFunc(low, func(r rune) bool {
|
|
return r == '/' || r == '\\' || r == '@' || r == ':' || r == '='
|
|
}) {
|
|
if mcpWord(part) {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// mcpWord: "mcp" as a whole word inside one name, split on - _ and .
|
|
func mcpWord(s string) bool {
|
|
for _, w := range strings.FieldsFunc(s, func(r rune) bool { return r == '-' || r == '_' || r == '.' }) {
|
|
if w == "mcp" || w == "fastmcp" {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// ── JSON with comments, and the subset of TOML Codex writes ─────────────────
|
|
|
|
// stripJSONC removes // and /* */ comments and trailing commas outside
|
|
// strings, so Zed's and VS Code's files parse as JSON. Plain JSON passes
|
|
// through unchanged.
|
|
func stripJSONC(b []byte) []byte {
|
|
out := make([]byte, 0, len(b))
|
|
inStr, esc := false, false
|
|
for i := 0; i < len(b); i++ {
|
|
c := b[i]
|
|
if inStr {
|
|
out = append(out, c)
|
|
switch {
|
|
case esc:
|
|
esc = false
|
|
case c == '\\':
|
|
esc = true
|
|
case c == '"':
|
|
inStr = false
|
|
}
|
|
continue
|
|
}
|
|
switch {
|
|
case c == '"':
|
|
inStr = true
|
|
out = append(out, c)
|
|
case c == '/' && i+1 < len(b) && b[i+1] == '/':
|
|
for i < len(b) && b[i] != '\n' {
|
|
i++
|
|
}
|
|
if i < len(b) {
|
|
out = append(out, '\n')
|
|
}
|
|
case c == '/' && i+1 < len(b) && b[i+1] == '*':
|
|
i += 2
|
|
for i+1 < len(b) && !(b[i] == '*' && b[i+1] == '/') {
|
|
i++
|
|
}
|
|
i++
|
|
case c == '}' || c == ']':
|
|
// Drop a comma that only whitespace separates from this close.
|
|
j := len(out) - 1
|
|
for j >= 0 && (out[j] == ' ' || out[j] == '\t' || out[j] == '\n' || out[j] == '\r') {
|
|
j--
|
|
}
|
|
if j >= 0 && out[j] == ',' {
|
|
out = append(out[:j], out[j+1:]...)
|
|
}
|
|
out = append(out, c)
|
|
default:
|
|
out = append(out, c)
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
// parseTOMLSubset reads the part of TOML a Codex config uses: [table] and
|
|
// [a."b c"] headers, key = value with dotted and quoted keys, basic and
|
|
// literal strings (and their multi-line forms), arrays (across lines),
|
|
// inline tables, and bare scalars kept as their text (true/false become
|
|
// booleans). [[array of tables]] sections are skipped: Codex keeps no
|
|
// server there. A line it cannot read is an error for the whole file, which
|
|
// counts as unparsed rather than silently half-read.
|
|
func parseTOMLSubset(src string) (map[string]any, error) {
|
|
root := map[string]any{}
|
|
cur := root
|
|
skipping := false
|
|
p := &tomlParser{s: src}
|
|
for {
|
|
p.skipSpaceAndComments(true)
|
|
if p.eof() {
|
|
return root, nil
|
|
}
|
|
if p.peek() == '[' {
|
|
if strings.HasPrefix(p.s[p.i:], "[[") {
|
|
skipping = true
|
|
p.skipLine()
|
|
continue
|
|
}
|
|
p.i++
|
|
keys, err := p.keyPath(']')
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
p.i++ // ]
|
|
skipping = false
|
|
cur = root
|
|
for _, k := range keys {
|
|
next, ok := cur[k].(map[string]any)
|
|
if !ok {
|
|
next = map[string]any{}
|
|
cur[k] = next
|
|
}
|
|
cur = next
|
|
}
|
|
p.skipLine()
|
|
continue
|
|
}
|
|
keys, err := p.keyPath('=')
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
p.i++ // =
|
|
v, err := p.value()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if !skipping {
|
|
setDotted(cur, keys, v)
|
|
}
|
|
p.skipLine()
|
|
}
|
|
}
|
|
|
|
func setDotted(m map[string]any, keys []string, v any) {
|
|
for _, k := range keys[:len(keys)-1] {
|
|
next, ok := m[k].(map[string]any)
|
|
if !ok {
|
|
next = map[string]any{}
|
|
m[k] = next
|
|
}
|
|
m = next
|
|
}
|
|
m[keys[len(keys)-1]] = v
|
|
}
|
|
|
|
type tomlParser struct {
|
|
s string
|
|
i int
|
|
depth int // arrays and inline tables open around the current value
|
|
}
|
|
|
|
var errTOML = errors.New("toml: cannot read this line")
|
|
|
|
func (p *tomlParser) eof() bool { return p.i >= len(p.s) }
|
|
func (p *tomlParser) peek() byte { return p.s[p.i] }
|
|
|
|
func (p *tomlParser) skipSpaceAndComments(newlines bool) {
|
|
for !p.eof() {
|
|
c := p.peek()
|
|
switch {
|
|
case c == ' ' || c == '\t' || c == '\r' || (newlines && c == '\n'):
|
|
p.i++
|
|
case c == '#':
|
|
for !p.eof() && p.peek() != '\n' {
|
|
p.i++
|
|
}
|
|
default:
|
|
return
|
|
}
|
|
}
|
|
}
|
|
|
|
// skipLine moves past the rest of the line (trailing space and a comment).
|
|
func (p *tomlParser) skipLine() {
|
|
for !p.eof() && p.peek() != '\n' {
|
|
p.i++
|
|
}
|
|
}
|
|
|
|
// keyPath reads a dotted key up to (not past) the stop byte.
|
|
func (p *tomlParser) keyPath(stop byte) ([]string, error) {
|
|
var keys []string
|
|
for {
|
|
p.skipSpaceAndComments(false)
|
|
if p.eof() {
|
|
return nil, errTOML
|
|
}
|
|
var k string
|
|
switch p.peek() {
|
|
case '"', '\'':
|
|
s, err := p.str()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
k = s
|
|
default:
|
|
st := p.i
|
|
for !p.eof() && (isBareKeyByte(p.peek())) {
|
|
p.i++
|
|
}
|
|
if p.i == st {
|
|
return nil, errTOML
|
|
}
|
|
k = p.s[st:p.i]
|
|
}
|
|
keys = append(keys, k)
|
|
p.skipSpaceAndComments(false)
|
|
if p.eof() {
|
|
return nil, errTOML
|
|
}
|
|
switch p.peek() {
|
|
case '.':
|
|
p.i++
|
|
case stop:
|
|
return keys, nil
|
|
default:
|
|
return nil, errTOML
|
|
}
|
|
}
|
|
}
|
|
|
|
func isBareKeyByte(c byte) bool {
|
|
return c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' || c == '_' || c == '-'
|
|
}
|
|
|
|
func (p *tomlParser) value() (any, error) {
|
|
p.skipSpaceAndComments(false)
|
|
if p.eof() {
|
|
return nil, errTOML
|
|
}
|
|
switch p.peek() {
|
|
case '"', '\'':
|
|
return p.str()
|
|
case '[', '{':
|
|
// Each level is a stack frame; a crafted file a million deep must
|
|
// not walk the stack that far.
|
|
if p.depth >= mcpMaxNesting {
|
|
return nil, errTOML
|
|
}
|
|
p.depth++
|
|
defer func() { p.depth-- }()
|
|
}
|
|
switch p.peek() {
|
|
case '[':
|
|
p.i++
|
|
var out []any
|
|
for {
|
|
p.skipSpaceAndComments(true)
|
|
if p.eof() {
|
|
return nil, errTOML
|
|
}
|
|
if p.peek() == ']' {
|
|
p.i++
|
|
return out, nil
|
|
}
|
|
v, err := p.value()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, v)
|
|
p.skipSpaceAndComments(true)
|
|
if !p.eof() && p.peek() == ',' {
|
|
p.i++
|
|
}
|
|
}
|
|
case '{':
|
|
p.i++
|
|
out := map[string]any{}
|
|
for {
|
|
p.skipSpaceAndComments(false)
|
|
if p.eof() {
|
|
return nil, errTOML
|
|
}
|
|
if p.peek() == '}' {
|
|
p.i++
|
|
return out, nil
|
|
}
|
|
keys, err := p.keyPath('=')
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
p.i++
|
|
v, err := p.value()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
setDotted(out, keys, v)
|
|
p.skipSpaceAndComments(false)
|
|
if !p.eof() && p.peek() == ',' {
|
|
p.i++
|
|
}
|
|
}
|
|
}
|
|
st := p.i
|
|
for !p.eof() && !strings.ContainsRune(",]}\n#", rune(p.peek())) {
|
|
p.i++
|
|
}
|
|
raw := strings.TrimSpace(p.s[st:p.i])
|
|
switch raw {
|
|
case "":
|
|
return nil, errTOML
|
|
case "true":
|
|
return true, nil
|
|
case "false":
|
|
return false, nil
|
|
}
|
|
return raw, nil
|
|
}
|
|
|
|
// str reads a basic ("...", with escapes) or literal ('...') string, either
|
|
// in its one-line or its triple-quoted multi-line form.
|
|
func (p *tomlParser) str() (string, error) {
|
|
q := p.peek()
|
|
triple := strings.Repeat(string(q), 3)
|
|
if strings.HasPrefix(p.s[p.i:], triple) {
|
|
p.i += 3
|
|
if strings.HasPrefix(p.s[p.i:], "\n") {
|
|
p.i++
|
|
} else if strings.HasPrefix(p.s[p.i:], "\r\n") {
|
|
p.i += 2
|
|
}
|
|
end := strings.Index(p.s[p.i:], triple)
|
|
if end < 0 {
|
|
return "", errTOML
|
|
}
|
|
body := p.s[p.i : p.i+end]
|
|
p.i += end + 3
|
|
if q == '"' {
|
|
return tomlUnescape(body), nil
|
|
}
|
|
return body, nil
|
|
}
|
|
p.i++
|
|
var b strings.Builder
|
|
for !p.eof() {
|
|
c := p.peek()
|
|
switch {
|
|
case c == '\n':
|
|
return "", errTOML
|
|
case c == q:
|
|
p.i++
|
|
if q == '"' {
|
|
return tomlUnescape(b.String()), nil
|
|
}
|
|
return b.String(), nil
|
|
case c == '\\' && q == '"' && p.i+1 < len(p.s):
|
|
b.WriteByte(c)
|
|
b.WriteByte(p.s[p.i+1])
|
|
p.i += 2
|
|
default:
|
|
b.WriteByte(c)
|
|
p.i++
|
|
}
|
|
}
|
|
return "", errTOML
|
|
}
|
|
|
|
// tomlUnescape decodes the escapes of a TOML basic string: \\ \" \b \t
|
|
// \n \f \r and \uXXXX / \UXXXXXXXX. An escape it does not know is kept
|
|
// as written.
|
|
func tomlUnescape(s string) string {
|
|
if !strings.Contains(s, `\`) {
|
|
return s
|
|
}
|
|
var b strings.Builder
|
|
for i := 0; i < len(s); i++ {
|
|
c := s[i]
|
|
if c != '\\' || i+1 >= len(s) {
|
|
b.WriteByte(c)
|
|
continue
|
|
}
|
|
i++
|
|
switch s[i] {
|
|
case '\\', '"':
|
|
b.WriteByte(s[i])
|
|
case 'b':
|
|
b.WriteByte('\b')
|
|
case 't':
|
|
b.WriteByte('\t')
|
|
case 'n':
|
|
b.WriteByte('\n')
|
|
case 'f':
|
|
b.WriteByte('\f')
|
|
case 'r':
|
|
b.WriteByte('\r')
|
|
case 'u', 'U':
|
|
n := 4
|
|
if s[i] == 'U' {
|
|
n = 8
|
|
}
|
|
if i+n < len(s) {
|
|
if r, err := strconv.ParseUint(s[i+1:i+1+n], 16, 32); err == nil {
|
|
b.WriteRune(rune(r))
|
|
i += n
|
|
continue
|
|
}
|
|
}
|
|
b.WriteByte('\\')
|
|
b.WriteByte(s[i])
|
|
default:
|
|
b.WriteByte('\\')
|
|
b.WriteByte(s[i])
|
|
}
|
|
}
|
|
return b.String()
|
|
}
|