NQjbdZddlmZddlZddlZddlZddlmZehdZ ej dej Z ej dej Z ej dej Zd ZddZddZddZddZddZdS)ulSecurity checks for user-configured MCP server entries. MCP stdio transports intentionally support arbitrary local commands so users can run custom servers. This module does not try to sandbox that capability. It blocks two high-signal abuse shapes seen in the wild: 1. The exfiltration shape from #45620: a shell interpreter whose inline script invokes network egress tooling. 2. The persistence shape from the June 2026 ``hermes-0day`` campaign: a shell interpreter whose inline script writes to OS persistence surfaces (``~/.ssh/authorized_keys``, ``/etc/ssh``, ``/etc/pam.d``, ``sudoers``, crontab, shell rc files). The campaign planted ``command: bash`` MCP entries whose payload appended an attacker SSH key to ``authorized_keys``; Hermes re-executed them on every cron tick / startup, re-installing the backdoor. 3. A hardcoded indicator-of-compromise (IOC) blocklist for that campaign — the attacker's ``hermes-0day`` SSH public key and source IPs. Any entry whose command/args/env carry an IOC is refused outright, regardless of shape, so a pre-planted ``config.yaml`` cannot spawn it. These checks run BOTH at save time (``_save_mcp_server`` — dashboard API + CLI) and at spawn time (``tools.mcp_tool._filter_suspicious_mcp_servers`` — discovery / cron / startup), so a hand-edited or pre-planted entry is also caught before it can execute. ) annotationsN)Any> cmd.exepwsh.exepowershell.exeshcmdzshbashdashfishpwsh powershellz(?z!_inline_script..ks(33dD 333333) isinstancelisttuplejoinr)r&s r$_inline_scriptr4gsO |r$u &&4xx33d333333 t99r/entrydict[str, Any]ct|dpdg}|t|d|d}t |t r1|d|Dd|S)zEFlatten command + args + env values into one string for IOC scanning.rrr&envc34K|]}t|VdSr*r+)r,vs r$r.z_entry_text..us(22SVV222222r/r() rgetappendr4r0dictextendvaluesr3)r5r"r8s r$ _entry_textr@osEIIi006B778E LL & 1 122333 ))E  C#t3 22SZZ\\222222 88E??r/r list[str]cvt|tsgSg}t|}tD]&}||vr |d|d|d|cS'|d}t |}|tvr|St|d}|s|St |r=d|d|d}t |r|dz }||t |r|d|d|d |S) a?Return security warnings for an MCP server entry. Empty return means the entry is not suspicious. This is intentionally not a whitelist: legitimate local MCPs can still use custom commands, Python scripts, npx, uvx, etc. We block three narrow shapes only: * a known hermes-0day IOC anywhere in command/args/env (hardcoded blocklist); * a shell interpreter whose inline script invokes network egress (#45620); * a shell interpreter whose inline script writes to an OS persistence surface (June 2026 hermes-0day SSH/PAM/sudoers/cron shape). z MCP server 'z9' contains a known hermes-0day indicator-of-compromise ('z')rr&z' uses shell interpreter 'z' with network egress in argsz" and exfiltration-shaped argumentsu' to write to an OS persistence surface (SSH keys / PAM / sudoers / cron / shell rc) — this is the hermes-0day backdoor shape, not a real MCP server) r0r=r@_IOC_SUBSTRINGSr<r;r%_SHELL_INTERPRETERSr4_EGRESS_PATTERNsearch_EXFIL_HINT_PATTERN_PERSISTENCE_PATTERN) rr5issuesflatiocrrscriptissues r$validate_mcp_server_entryrNys eT " " F u  D $;; MM5t55-0555    MMM ii ""G ))H*** EIIf-- . .F  f%% &4 & &7 & & &   % %f - - : 9 9E e""6**   4  7       Mr/boolc<tt||Sr*)rOrN)rr5s r$is_mcp_server_entry_suspiciousrQs )$66 7 77r/)rrrr)r&rrr)r5r6rr)rrr5r6rrA)rrr5r6rrO)__doc__ __future__rrrertypingr frozensetrDcompile IGNORECASErErGrHrCr%r4r@rNrQr/r$rZsH2#""""" i ! ! !  "*# M !bjIM"rz:M    + + + +8888v888888r/