Skip to content

MCP Trustcard v0.4.0

Marketplace
Marketplace

Choose a tag to compare

View all tags
@davidnichols-ops davidnichols-ops released this 17 Jul 21:55
· 58 commits to master since this release
v0.4.0
a11a1c1

MCP Trustcard v0.4.0

Six production security fixes over v0.3.0.

What's new

1. Fixed false positives in destructive verb matching
Word-boundary regex instead of substring includes(). browser_navigate no longer matches "remove", duckduckgo_web_search no longer matches "search". Eliminates ~15 false positives from the v0.2.0 leaderboard.

2. Added 14 new destructive verbs
checkout, push, merge, fork, revert, rollback, format, reboot, shutdown, eject, detach, evict, clear, clean, flush, abort. Catches git_checkout, push_files, merge_pull_request, fork_repository which were all false negatives.

3. Parameter-based danger analysis
Parses inputSchema.properties for dangerous parameter names (path, command, sql, url, webhook) and dangerous description patterns. Unconstrained string params (no enum/pattern/maxLength) are upgraded to high risk. Detects that read_file with a path param is dangerous even though "read" is a safe verb.

4. HTTP transport proxy (mcp-http-proxy)
New binary for HTTP/SSE MCP servers (Notion, Linear, Atlassian, Figma, Roboflow, DeepWiki). Intercepts tools/list and tools/call over HTTP. Handles both JSON and SSE streaming. Supports --strict and --auto-update modes. Health check endpoint at GET /health.

5. Config file secret scanning (scan-config)
New subcommand: mcp-trustcard scan-config . Scans MCP config files for exposed secrets — GitHub tokens, OpenAI keys, Slack tokens, AWS keys, Google keys, Bearer tokens, JWTs, and generic key-value patterns. Redacts secrets in output. Found 2 real secrets in the production config during testing.

6. Secret redaction in both proxies
All stderr logs in both mcp-proxy and mcp-http-proxy are redacted via lib/redact.js. Server stderr passthrough is redacted. Prevents secret leakage in debug output, crash logs, or piped telemetry. Covers GitHub, OpenAI, Slack, AWS, Google, Bearer, JWT, and generic key-value patterns.

GitHub Action

New scan-config input for the GitHub Action:

- uses: davidnichols-ops/trustcard@v0.4.0
  with:
    scan-config: .devin/config.json  # scan for exposed secrets

Or server scan mode (unchanged):

- uses: davidnichols-ops/trustcard@v0.4.0
  with:
    server: @modelcontextprotocol/server-github
    min-score: 50
    save-manifest: manifest.json

Stats

  • 49 tests, all passing (19 new tests for checks, 10 new for HTTP proxy, 20 existing)
  • 14 files in npm package, 31.3 kB packed
  • Zero dependencies — pure Node stdlib
  • node >= 18 required
Assets 2
Loading