mcpnuke-checks

Check Module Conventions

Static Check Template

"""One-line description of what this check detects."""

import re
from mcpnuke.core.models import TargetResult
from mcpnuke.checks.base import time_check
from mcpnuke.patterns.rules import YOUR_PATTERNS


def check_your_check(result: TargetResult) -> None:
    with time_check("your_check", result):
        for tool in result.tools:
            name: str = tool.get("name", "")
            desc: str = tool.get("description", "")
            combined: str = f"{name} {desc} {tool.get('inputSchema', {})}"
            for pat in YOUR_PATTERNS:
                if re.search(pat, combined, re.IGNORECASE):
                    result.add("your_check", "SEVERITY", f"Title '{name}'", f"Detail: {pat}", evidence=combined[:300])
                    break

Behavioral Check Template

session is typed with MCPSessionProtocol from mcpnuke.core.transports.base. Rely only on what it declares — call, notify, close, wait_ready, protocol_mode. For anything HTTP-specific (post_raw), gate on hasattr(session, "post_raw"), because stdio has no header layer.

def check_your_check(
    session: MCPSessionProtocol,
    result: TargetResult,
    probe_opts: dict | None = None,
) -> None:
    opts: dict = probe_opts or {}
    _log = opts.get("_log", lambda msg: None)
    cache: dict = opts.get("_response_cache", {})
    with time_check("your_check", result):
        for tool in result.tools:
            name: str = tool.get("name", "")
            text: str | None = cache.get(name)
            if text is None:
                args = _build_safe_args(tool)
                resp = _call_tool(session, name, args)
                text = _response_text(resp)
            if text:
                # Analyze response
                pass

Wiring Checklist

1. Import in checks/__init__.py
2. Call in correct phase (static / behavioral / deep probe)
3. Add attack chains to core/constants.py if applicable
4. Add to README scan phases table
5. Add to CHANGELOG