feat(security): add sensitive data detection for tool calls (Spec 026) #289
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Deploying mcpproxy-docs with
|
| Latest commit: |
ab96555
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://b57cdbac.mcpproxy-docs.pages.dev |
| Branch Preview URL: | https://026-pii-detection.mcpproxy-docs.pages.dev |
Dumbris
force-pushed
the
026-pii-detection
branch
from
b163c79 to
c87b97d
Compare
Implement automatic scanning of tool call arguments and responses for secrets, credentials, and sensitive data patterns including: - Cloud credentials (AWS, GCP, Azure) - Private keys (RSA, EC, DSA, OpenSSH, PGP) - API tokens (GitHub, GitLab, Stripe, Slack, OpenAI) - Database connection strings (MySQL, PostgreSQL, MongoDB) - Credit card numbers (with Luhn validation) - Sensitive file paths (.ssh/, .aws/, .env files) - High-entropy strings (potential secrets) Key features: - Async detection integrated with ActivityService - REST API filtering (sensitive_data, detection_type, severity params) - CLI flags: --sensitive-data, --detection-type, --severity - Web UI: detection badges, severity indicators, detail drawer - Configurable categories and custom patterns support - Event bus integration for real-time notifications Also fixes CLI socket path detection bug where os.Stat was called with unix:// prefix, causing fallback to HTTP with wrong port. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Dumbris
force-pushed
the
026-pii-detection
branch
from
c87b97d to
13c5122
Compare
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 21560952747 --repo smart-mcp-proxy/mcpproxy-go
|
- Add sensitive data detection status to `mcpproxy doctor` output - Include SensitiveDataDetection in DefaultConfig() for new installs - Add detection patterns for 14 LLM/AI providers: - Google AI/Gemini (AIzaSy prefix) - xAI/Grok (xai- prefix) - Groq (gsk_ prefix) - Hugging Face (hf_, api_org_ prefixes) - Replicate (r8_ prefix) - Perplexity (pplx- prefix) - Fireworks AI (fw_ prefix) - Anyscale (esecret_ prefix) - Mistral AI (keyword context) - Cohere (keyword context) - DeepSeek (sk- with keyword) - Together AI (keyword context) - Improve OpenAI pattern (sk-proj-, sk-svcacct-, sk-admin-) - Improve Anthropic pattern (sk-ant-api03-, sk-ant-admin01-) - Add comprehensive tests with dynamic key construction - Update documentation with new provider patterns Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add extensive test coverage for all 15 LLM provider API key patterns: - TestLLMKeysInJSONContext: Keys in JSON configuration files - TestLLMKeysInYAMLContext: Keys in YAML configuration files - TestLLMKeysInCodeSnippets: Keys in Python/JS/Shell code examples - TestLLMKeysFalsePositivePrevention: Ensures patterns don't over-match - TestLLMKeysWithMixedAlphanumeric: Realistic mixed-case key patterns - TestLLMKeysInLogOutput: Keys exposed in error messages and logs - TestOpenAIAnthropicImprovedPatterns: All OpenAI/Anthropic variants - TestAllLLMPatternsExist: Validates all expected patterns are registered Tests cover: - OpenAI (sk-, sk-proj-, sk-svcacct-, sk-admin-) - Anthropic (sk-ant-api03-, sk-ant-admin01-) - Google AI/Gemini (AIzaSy) - xAI/Grok (xai-) - Groq (gsk_) - HuggingFace (hf_, api_org_) - Replicate (r8_) - Perplexity (pplx-) - Fireworks AI (fw_) - Anyscale (esecret_) - Mistral, Cohere, DeepSeek, Together AI (keyword context) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add deduplication to AddDetection() to prevent duplicate type+location - AWS secret key pattern now requires keyword context (aws_secret_access_key=, AWS_SECRET_KEY:, secretAccessKey:) to avoid matching random base64 in RSA keys - Azure client secret pattern now requires keyword context (AZURE_CLIENT_SECRET=, client_secret:, clientSecret:) to avoid false positives - Update tests to reflect context-required behavior - Add TestResult_AddDetection_Deduplication test Before: id_rsa showed 9 detections (including aws_secret_key false positives) After: id_rsa shows 3 detections (rsa_private_key, private_key, high_entropy) Before: .env showed 29 detections (many duplicates) After: .env shows 9 unique detections Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add sensitive data detection section to activity-log.md - Document detection metadata structure and filtering options - Add cross-reference to sensitive-data-detection.md - Update sidebars.js with sensitive data detection page - Update intro.md and AGENTS.md references Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- spec.md: Feature specification and requirements - plan.md: Implementation plan - tasks.md: Task breakdown - data-model.md: Data model design - research.md: Research notes - quickstart.md: Quick start guide - contracts/: API contracts - checklists/: Implementation checklists - MANUAL_TESTING_PLAN.md: Manual testing guide Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
sensitive_data,detection_type, andseverityparameters--sensitive-data,--detection-type,--severityTest plan
🤖 Generated with Claude Code