Ecosystem audit of public MCP servers (upstash/context7, cloudflare/mcp-server-cloudflare, stripe/agent-toolkit, awslabs/mcp) turns up and fixes five precision bugs, adds a new detection rule (MCP011: untrusted tool source), and ships a pre-commit hook plus a VS Code extension scaffold for distribution.
Fixed
- AI002 flagged secrets outside any LLM context — fired on a bcrypt hash in a demo app and a non-secret constant merely named with "KEY".
- isTestFilePath now recognizes
eval(s)as a non-production path segment, so LLM-as-judge eval harnesses aren't scanned as real request handlers. - MCP001 required a real identifier reference instead of a plain substring match, fixing a
proven/critical false positive on prose that merely used the word "tools". - MCP009/SKL003 cross-tool-reference detection resolved all 7 residual false positives by requiring the referenced tool to sit between the trigger word and the verb (a redirect), not just appear anywhere in the sentence.
Added
- MCP011: untrusted tool source — flags an MCP tool handler that fetches from an external/unauthenticated source and returns the response with no sanitization (the Sentry-MCP-DSN attack shape).
- Pre-commit hook (
.pre-commit-hooks.yaml). - VS Code extension scaffold (
vscode-extension/) — local-build install, not yet on the Marketplace. - Example compliance artifact + terminal-recording demo.
npm test: 151/151 passing.
What's Changed
- chore(deps): bump github/codeql-action from 4.37.3 to 4.37.7 by @dependabot[bot] in #21
- Ecosystem audit, distribution surfaces, and 5 precision fixes by @akanthed in #22
- feat(rules): add MCP011 rule for untrusted tool source and implement … by @akanthed in #23
- Fix readme file by @akanthed in #24
Full Changelog: v0.10.0...v0.11.0
Contributors
dependabot and akanthed