feat: Tier-1 quick wins — HTTP transport, annotation scanning, prompts/resources, SARIF tags - #89
Merged
Merged
Conversation
…ts/resources, SARIF tags, escape stub #71 — Wire HTTP transport: replace the bail!() stub in main.rs with a real HttpTransport::connect(url) call. The HTTP transport, CLI --url flag, and all test infrastructure were already complete; this is the missing CLI hookup. Also removes the file-level #![allow(dead_code)] from mcp.rs and session.rs that were placeholders for this wire-up. #75 — Annotation deception scanning (FUZZD-028): adds annotations: Option<Value> to ToolDefinition per the MCP 2025-11-05 spec. New scan_annotations() pass fires AnnotationDeception when readOnlyHint/destructiveHint/openWorldHint contradict the tool's actual description — the exact attack documented in arXiv:2603.22489 where false hints suppress client confirmation dialogs for destructive operations. 7 new tests; 0 new false positives on clean_tools.json. #76 — Prompts/resources scanning (full pipeline): adds PromptDefinition, ResourceDefinition, ListPromptsResult, ListResourcesResult to mcp.rs; adds list_prompts()/list_resources() to Session; adds enumerate_prompts/resources() to Harness; adds PROMPTS_LIST/RESOURCES_LIST method constants. New scan_surface() on DescriptionScanner runs the four injection-detection passes on (name, description) pairs. Wired into the ToolPoisoning audit path — gracefully skips if the server returns method-not-found for unsupported endpoints. #77 — OWASP/NSA SARIF compliance tags: adds tags() method to Signal returning OWASP MCP Top-10, OWASP Agentic Top-10 (ASI series), and CWE identifiers. sarif_rules() now emits properties.tags for every rule, enabling SARIF consumers (GitHub Code Scanning, SonarQube) to cross-reference fuzzd findings against industry frameworks without a separate mapping step. #78 — Escape module stub: implements the no-op fuzz_escape() function in a new src/fuzzer/escape.rs and wires it into the dispatch so Escape no longer emits "not yet implemented" warnings in default scans. https://claude.ai/code/session_014T1x8ZiDbJcVvkZBfP91nk
…ick wins - bench/README: 27→28 signals, add annotation_deception row, update pass count to 5, note prompts/resources and annotations as scanned surfaces - README roadmap: add HTTP transport, annotation scanning, prompts/resources, SARIF compliance tags as shipped; update signal count 23→28 - CHANGELOG: [Unreleased] entry for #71/#75/#76/#77/#78 with full detail https://claude.ai/code/session_014T1x8ZiDbJcVvkZBfP91nk
This was referenced Jun 13, 2026
Merged
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Five Tier-1 roadmap items delivered in one pass. All 276 tests pass, 0 new false positives on
clean_tools.json.#71 — HTTP transport wired
Replaces the
bail!()stub inmain.rswithHttpTransport::connect(url). The transport, CLI--urlflag, and test infrastructure were already complete — this is the missing CLI hookup. Also removes the file-level#[allow(dead_code)]frommcp.rsandsession.rsthat were placeholders for this wire-up.#75 — Annotation deception scanning (FUZZD-028)
Adds
annotations: Option<Value>toToolDefinitionper MCP spec 2025-11-05. Newscan_annotations()pass firesAnnotationDeceptionwhenreadOnlyHint/destructiveHint/openWorldHintcontradict the tool's actual description. Attack basis: arXiv:2603.22489 — false hints suppress client confirmation dialogs for destructive operations. 7 new tests.#76 — Prompts/resources scanning (full pipeline)
PromptDefinition,ResourceDefinition,ListPromptsResult,ListResourcesResult,PROMPTS_LIST/RESOURCES_LISTmethod constantslist_prompts(),list_resources()with caching fieldsenumerate_prompts(),enumerate_resources()with lazy-cache patternDescriptionScanner::scan_surface()runs all four injection-detection passes on(name, description)pairsToolPoisoningaudit path; gracefully skips if the server returns method-not-found#77 — OWASP/NSA SARIF compliance tags
Adds
tags()method toSignalreturningOWASP:MCP-NN,OWASP:ASINN, andCWE-NNNidentifiers for all 28 signals.sarif_rules()now emitsproperties.tagson every rule — enables GitHub Code Scanning, SonarQube, and other SARIF consumers to cross-reference findings against OWASP MCP Top 10, OWASP Agentic Top 10, and CWE without a separate mapping.#78 — Escape module stub
Implements the no-op
fuzz_escape()insrc/fuzzer/escape.rsand wires it into dispatch. Default scans no longer emit "warning: attack module 'escape' not yet implemented".Test plan
cargo test— 276 tests pass, no failurescargo clippy -- -D warnings— cleanfuzzd scan --schema bench/clean_tools.json— no findings (0 FP from annotation scanner)fuzzd scan --schema demo/servers/poisoned.json --output sarif— SARIF output includesproperties.tagson each rulefuzzd audit --transport http --url http://localhost:3000— no longer errors with "not yet implemented"https://claude.ai/code/session_014T1x8ZiDbJcVvkZBfP91nk
Generated by Claude Code