terminal-mcp 0.1.6

Model Context Protocol (MCP) server for long-lived shell execution.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

// src/security/detect/bash/rules/reverse_shell.rs

use crate::sec_bash_detector_rule_impl_base;
use crate::security::detect::{EvaluateResult, Severity};

sec_bash_detector_rule_impl_base!(
    RuleBashTcpUdpReverseShell1,
    name: "bash_tcp_udp_reverse_shell_1",
    desc: "Detects reverse shell attempts using /dev/tcp or /dev/udp redirections",
    default_severity: Severity::Critical,
    query: "(file_redirect destination: (word) @dest (#match? @dest \"^/dev/(tcp|udp)/(.*)\"))",
    capture: |node, source| {
        let evidence = node.utf8_text(source)?;
        Ok(EvaluateResult::hit(format!("Matched redirection: {}", evidence)))
    }
);