ramparts 0.8.2

Security scanner for Model Context Protocol (MCP) servers and AI agent skills (Claude Code commands, agentskills.io bundles, Cursor / Codex / Windsurf / Gemini equivalents).
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217

#[cfg(test)]
mod tests {
    use crate::core::{MCPScannerCore, RegisterServerRequest};
    use std::collections::HashMap;

    #[tokio::test]
    async fn test_server_registration_and_listing() {
        let _ = tracing_subscriber::fmt::try_init();

        let core = MCPScannerCore::new().expect("Failed to create core");

        // Test server registration
        let request = RegisterServerRequest {
            url: "https://api.example.com/mcp/".to_string(),
            auth_headers: Some({
                let mut headers = HashMap::new();
                headers.insert("Authorization".to_string(), "Bearer test-token".to_string());
                headers
            }),
            timeout: Some(30),
        };

        let response = core.register_server(request).await;
        assert!(
            !response.success,
            "Server registration should be deprecated"
        );
        assert!(response.message.contains("deprecated"));

        // Test listing registered servers (should also be deprecated)
        let list_response = core.list_registered_servers().await;
        assert!(
            !list_response.success,
            "Listing servers should be deprecated"
        );
        assert_eq!(list_response.count, 0, "Should have 0 registered servers");

        // Test unregistering server (should also be deprecated)
        let unregister_response = core.unregister_server("https://api.example.com/mcp/").await;
        assert!(
            !unregister_response.success,
            "Server unregistration should be deprecated"
        );
    }

    #[tokio::test]
    async fn test_refresh_tools_handles_server_failure() {
        let _ = tracing_subscriber::fmt::try_init();

        let core = MCPScannerCore::new().expect("Failed to create core");

        // Test with non-existent server
        let request = crate::core::RefreshToolsRequest {
            urls: vec!["http://localhost:99999".to_string()],
            auth_headers: None,
            timeout: Some(1),
        };

        let response = core.refresh_tools(request).await;

        // Verify deprecation behavior
        assert!(!response.success, "Should be deprecated");
        assert_eq!(response.total, 0);
        assert_eq!(response.successful, 0);
        assert_eq!(response.failed, 0);
        assert_eq!(response.results.len(), 0);
    }

    #[tokio::test]
    async fn test_config_persistence() {
        let _ = tracing_subscriber::fmt::try_init();

        let core = MCPScannerCore::new().expect("Failed to create core");

        // Test that registration is deprecated
        let request = RegisterServerRequest {
            url: "https://api.github.com/mcp/".to_string(),
            auth_headers: None,
            timeout: Some(30),
        };

        let response = core.register_server(request).await;
        assert!(!response.success, "Registration should be deprecated");
        assert!(response.message.contains("deprecated"));

        // Test that listing is deprecated
        let list_response = core.list_registered_servers().await;
        assert!(!list_response.success, "Listing should be deprecated");
        assert_eq!(list_response.count, 0, "Should have 0 servers");

        // Test that unregistration is deprecated
        let unregister_response = core.unregister_server("https://api.github.com/mcp/").await;
        assert!(
            !unregister_response.success,
            "Unregistration should be deprecated"
        );
    }

    #[tokio::test]
    async fn test_environment_variable_mapping() {
        let _ = tracing_subscriber::fmt::try_init();

        // Set environment variable
        std::env::set_var("LLM_API_KEY", "test-llm-key");

        let core = MCPScannerCore::new().expect("Failed to create core");

        // Register server without explicit auth headers
        let request = RegisterServerRequest {
            url: "https://api.example.com/mcp/".to_string(),
            auth_headers: None, // No explicit auth headers
            timeout: Some(30),
        };

        let response = core.register_server(request).await;
        assert!(
            !response.success,
            "Server registration should be deprecated"
        );
        assert!(response.message.contains("deprecated"));

        // Clean up environment variable
        std::env::remove_var("LLM_API_KEY");
    }

    #[tokio::test]
    async fn test_env_mapping_function() {
        // Clean up any existing env vars first
        std::env::remove_var("LLM_API_KEY");
        std::env::remove_var("X_API_KEY");
        std::env::remove_var("API_KEY");

        // Test the apply_env_mappings function directly
        std::env::set_var("LLM_API_KEY", "test-key-123");
        std::env::set_var("X_API_KEY", "x-api-key-456");

        let mut headers = HashMap::new();
        headers.insert("Custom-Header".to_string(), "custom-value".to_string());

        let result = crate::config::apply_env_mappings(headers);

        // Should have original header plus environment mappings
        assert_eq!(
            result.get("Custom-Header"),
            Some(&"custom-value".to_string())
        );
        assert_eq!(
            result.get("Authorization"),
            Some(&"Bearer test-key-123".to_string())
        );
        assert_eq!(result.get("X-API-Key"), Some(&"x-api-key-456".to_string()));

        // Clean up
        std::env::remove_var("LLM_API_KEY");
        std::env::remove_var("X_API_KEY");
    }

    #[tokio::test]
    async fn test_env_mapping_respects_existing_headers() {
        // Clean up any existing env vars first
        std::env::remove_var("LLM_API_KEY");
        std::env::remove_var("X_API_KEY");
        std::env::remove_var("API_KEY");

        // Test that existing headers are not overridden
        std::env::set_var("LLM_API_KEY", "env-key");

        let mut headers = HashMap::new();
        headers.insert(
            "Authorization".to_string(),
            "Bearer existing-key".to_string(),
        );

        let result = crate::config::apply_env_mappings(headers);

        // Should keep existing Authorization header, not override with env var
        assert_eq!(
            result.get("Authorization"),
            Some(&"Bearer existing-key".to_string())
        );

        // Clean up
        std::env::remove_var("LLM_API_KEY");
    }

    #[tokio::test]
    async fn test_enhanced_scan_api_with_change_detection() {
        let _ = tracing_subscriber::fmt::try_init();

        let core = MCPScannerCore::new().expect("Failed to create core");

        // Test enhanced scan API with change detection
        let request = crate::core::ScanRequest {
            url: "https://api.example.com/mcp/".to_string(),
            timeout: Some(30),
            http_timeout: Some(30),
            detailed: Some(false),
            format: Some("json".to_string()),
            auth_headers: None,
            return_prompts: Some(true), // Return prompts to avoid LLM calls
            reference_url: Some("https://api.example.com/mcp/".to_string()),
        };

        let response = core.scan(request).await;

        // Verify response structure includes change detection fields
        // These fields should exist regardless of their values
        let _ = response.success; // Field exists
        let _ = response.refresh_happened; // Field exists
        let _ = response.changes_detected; // Field exists
        let _ = response.scan_skipped; // Field exists
        let _ = response.cache_hit; // Field exists

        // Change summary might be None if no changes or if servers are unreachable
        // This is expected behavior
    }
}