io.github.KamaruSama/mcp-google-forms

Name Normalisation

Damerau Levenshtein Similarity

Exact Match Blocklist

Case Insensitive Match

Separator Normalised Match

Prefix Collision Warning

Destructive Tool Severity Bump

Common Tool Vocabulary Crossref

Exec Call Identifier Set

New Expression Identifier Set

Import Keyword Ast

String Marker Substring

Inline Event Handler Scan

Sanitizer Scope Check

Response Receiver Method Pair

Structural Test File Detection

External Source Vocabulary

Taint Tracked Sanitizer Check

Handler Parameter Taint

Descendant Expression Walk

Structural Test File Detection

Destructive Parameter Vocabulary

Description Destructive Verb Scan

Schema Inference Cross Check

Self Contradicting Annotations

Confidence Floor On Weak Signal

Companion Stub Returns Empty

Parent Rule Is Sole Producer

No Duplicate Annotation Traversal

Ast Visits Live Nodes Only

Legitimate Idiom In Enclosing Scope

Pipe To Shell Detection

Dual Signal Required

Template Part Concatenation

Tool Count Delta Threshold

Dangerous New Tool Classifier

Fingerprint Hash Diff

Annotation Flip Detection

Baseline Absence Skip

Multi Signal Capability Classification

Cross Tool Graph Reachability

Schema Structural Inference

Confidence Min Across Legs

Score Cap Preservation

Companion Stub Returns Empty

Parent Rule Is Sole Producer

Credential Classification Delegated To F1

Capability Graph Classification

Min Total Tools Threshold

Require Both Benign And Dangerous

Bounded Ratio Confidence

Honest Refusal Small Servers

Renderable Scheme Detection

Script Capable Mime Vocabulary

Render Intent Linguistics

Documentation Vs App Separation

Read Only Claim Catalogue

Write Verb Parameter Catalogue

Network Verb Parameter Catalogue

Default Value Destructive Check

Destructive Bool Defaults

Root Path Defaults

Wildcard Defaults

Companion Stub Returns Empty

Parent Rule Is Sole Producer

No Duplicate Graph Traversal

Enterprise Vs Untrusted Classification

Scoped Registry Exception Handling

Protocol Https Enforcement

Goproxy Comma List Split

Runtime Env Var Injection

Structured Author Object

Whole Word Vendor Match

Per Field Finding

Scoped Package Whitelist

Author Field Only

Sendlogmessage User Input Scan

Logger Info User Input Scan

Logger Middleware Body Attach Scan

Notifications Message Level From User Scan

Authority Phrase Tokenization

Certification Claim Match

False Positive Fence Lookup

Noisy Or Aggregation

Initialize Field Scan

Length Outlier Zscore

Padding Repetition Signature

Tail Imperative Density

Description Parameter Ratio

Position Weighted Phrase Presence

Prior Approval Reference Match

Permission Inheritance Claim

Session State Reference

Assumed Consent By Absence

Severity From Aggregate Confidence

Init Field Tokenization

Special Token Substring

Unicode Control Detection

Base64 Hidden Payload

Version Shape Check

Silent Skip When No Metadata

Tokenised Phrase Matching

Llm Special Token Substring

Noisy Or Aggregation

Tail Window Scanning

Severity From Aggregate Confidence

Character Count Threshold

Scaling Confidence Factor

Structural Alphabet Scanner

Shannon Entropy Threshold

Post Decode Keyword Match

Mixed Encoding Layering Detection

Non Latin Context Downgrade

Walk Top Level Property Descriptions

Reuse A1 Phrase Catalogue

Llm Special Token Substring

Schema Stringify Scan

Injection Phrase Token Match

Noisy Or Aggregate

Fence Aware Demotion

Cross Reference B5 B7

Phrase Catalogue Match

Token Sequence Scan

Fence Aware Demotion

Tool Scope Per Finding

Cross Reference B5

Script Mixing policy: only emit findings when an identifier contains BOTH Basic/Extended Latin codepoints AND codepoints from a lookalike script (Cyrillic, Greek, Armenian, Georgian, Cherokee, Fullwidth Latin, Mathematical Alphanumeric). This prevents false positives on single Script identifiers.

Description density threshold: tool descriptions must contain ≥3 confusable hits before the description Level finding fires. Below that threshold we assume legitimate cross Script prose.

Evidence integrity: every `HomoglyphHit` carries the original codepoint, its position (zero Based character index), the Latin letter it impersonates, and its script block. The verification step instructs the auditor to hex Dump the raw value and confirm the codepoint — the observation is reproducible without running our detector.

Codepoint catalogue is declared once in data/invisible Codepoints.ts as a Record keyed by arbitrary stable ids (e.g. "zwsp", "bom", "bidi Embedding"). The detection logic iterates `Object.keys` on this Record — no regex, no long string Array literals.

Emoji ZWJ/VS suppression: gather.ts checks the previous and next codepoints when a ZWJ or variation Selector candidate is observed. The check uses the shared EMOJI RANGES table and is applied ONLY to descriptions (identifiers are never granted the exception).

Tag Character decoding: if a description contains three or more tag codepoints in the U+E0020–U+E007E subrange, the decoded ASCII string is surfaced in the finding as `hidden Tag Message`. The verification step shows the reviewer how to reproduce the decoding independently.

Bidi gets its own dedicated finding (critical severity) separate from the aggregated description finding, because bidi is uniquely dangerous: it produces a divergence between rendered and logical text that ordinary stripping / hex Dumping does not surface. The finding cites CVE 2021 42574 directly.

Chatml Role Delimiter Structural Scan

Llama Inst Block Structural Scan

Conversation Role Marker Scan

Parameter Description Token Scan

Response Token Pair Match

Error Message Catalogue

No Regex Literal

Token Line Scan

Charter Confidence Cap

Subscription Update Handler No Integrity Scan

Resource Update Hash Absent Scan

Coalescing Update Unchecked Scan

Cross Server Relay Pass Through Scan

Companion Stub Returns Empty

Parent Rule Is Sole Producer

Dfs Cycle Detection Delegated To F1

Write Plus Read On Same Store Is Required

Capability Graph Ingestion Classification

Cross Tool Sink Reachability

Resource Ingestion Surface

Sanitizer Mitigation Checkpoint

User Input To Error Message Scan

Stack Trace In Error Data Scan

Error Constructor User Input Scan

Full Request Stringify Scan

Protocol Mimic Token Match

Jsonrpc Shape In Description

Mcp Method Reference Match

Noisy Or Aggregation

False Positive Fence Lookup

Injection Phrase Tokenisation

Delimiter Token Match

Multi Field Concatenation

Encoded Payload Flag

Lower Scrutiny Surface Emphasis

Phrase Match Description

Phrase Match Argument Descriptions

Delimiter Token Match

Template Marker Cross Check

Multi Field Aggregation

Capability Declared Check

Ingestion Capability Graph

Pair Finding Emission

Amplification Factor Cited

Claim Vocabulary Lookup

Scope Noun Co Occurrence

Constraint Contradiction Softener

AST taint analysis · interprocedural

Sanitiser verification · by name

Template Literal Taint

Shell True Argument Taint

Binding Alias Resolution

Regex Fallback Degradation

Try Catch Does Not Mitigate Eval

Function Constructor Reflection Out Of Scope

SetTimeout String Argument Taint

Vm RunInNewContext Is A Sink

Python Importlib Via Lightweight

AST taint analysis · interprocedural

Lightweight Taint Fallback

Ast Fs Call With Root Path

Ast Chdir Root

Ast Allowed Paths Root

Python Walk Root

Homedir With User Input

Git C Override Is Critical

Allowlist Bypass Via Alias Is Medium

Argv Array With Tainted Flag Is Critical

Ssh Dot Git Write Paths Are Critical

Library Usage Is Informational

AST taint analysis · interprocedural

Lightweight Taint Fallback

Lodash Merge With Tainted Input

Object Assign With Tainted Arg

Dynamic Property Write Tainted Key

Json Parse Reviver Pollution

Object Fromentries User Map

Hasownproperty Guard Present

Sanitiser verification · by name

Dynamic Identifier Interpolation

Tagged Template Parameterisation

Second Order Sql Injection

AST taint analysis · interprocedural

Lightweight Taint Fallback

Yaml Loader Keyword Preservation

Try Except Does Not Neutralise

Json Reviver Class Instantiation

Multi Hop Deserialisation Chain

Custom Unserialize Wrapper Resolved

AST taint analysis · interprocedural

Lightweight Taint Fallback

Compile Time Vs Runtime Data

Concat Partial Literal Still Tainted

Autoescape Does Not Mitigate Source

File Path Render Is Different Risk

Jinja From String Flagged

AST taint analysis · interprocedural

Lightweight Taint Fallback

AST taint analysis · file sink

Lightweight Path Access Fallback

Resolve Without Clamp

Literal Traversal Substring

AST taint analysis · ssrf sink

Lightweight Url Request Fallback

Charter Audited Allowlister

Dns Rebinding Aware

Scheme Catalogue Match

Traversal Marker Match

Root Containment Warning

Render Surface Exploit Path

Dynamic Uri Construction Flag

Verify Without Options

Algorithms Contains None

Algorithms Reference Not Literal

Wrapper Verify Override

Conditional Unsafe Branch

Decode Used As Verify

Pyjwt Verify False

Ignore Expiration True

Ast Strict Equality On Secret

Ast Startswith On Secret

Python Equality On Secret

Timing Safe Import Suppression

Test File Suppression

Structural Test File Nature

Placeholder Marker Detection

Prefix Literal Recognition

Entropy Minimum Threshold

Entropy Bonus High

Comment Line Skip

Exact Name Semver Gated

Modern Fork Explicit Allowlist

C14 Overlap Acknowledged

Spec Field Token Catalogue

Interpolation Token Scan

Template Literal Detector

Concat Detector

Cve Precedent Reference

Lifecycle Order Detection

Build Tool Camouflage

Ci Workflow Tamper Scan

Artifact Fetch Modify

Full Command Observation

Package Json Install Hook Scan

Build Config Ast Walk

Dangerous Hook Api Detection

Dynamic Plugin Load Detection

Url Plugin Import Detection

Ast Regexp Literal Pattern

Ast New Regexp Non Literal

Structural Pattern Analyser

Bounded Input Suppression

Test File Suppression

Ast Error To Response Sink

Ast Stack Property Access

Python Traceback Call

Spread Or Stringify Of Error

Test File Suppression

Ast Cors Call Options

Ast Bare Cors Call

Ast Set Header Wildcard

Ast Reflected Origin

Python Flask Cors

Ast Listen Call

Ast Host Resolution

Ast Auth Middleware Check

Ast Per Route Auth

Python Uvicorn Host

Null Connection Skip

Localhost Does Not Count

Proxy Layer Reviewer Note

Surface Enumeration Vocabulary

Exfil Sink Cross Reference

Telemetry Endpoint Or Tracking Pixel

Consent Check Demotion

Honest Refusal No Network Egress

Ast Bulk Read Shape Match

Shared Env Var Vocabulary

Spread Destructure Detection

Test File Structural Skip

Ast Error Response Construction

Fingerprint Surface Catalogue

Shared Exfil Sink Anchor

Sanitizer Adjacency Check

Auth Branch Divergence Detection

Ast Timing Primitive Catalogue

Data Dependent Delay Expression

Retry After Header Modulation

Progress Notification Timing Cross Ref

Honest Refusal No Timing Primitive

Ambient Path Token Match

Homedir Expansion Detection

Env Var Indirection Detection

Test File Structural Skip

Agent Input Description Classifier

Agent Input Parameter Name Classifier

Shared Memory Writer Classifier

Dual Role Amplifier

Sanitization Suppression

Merge Toolset Cross Server

Per Server Contribution Mapping

Honest Refusal Single Server

Literal Rule Id For Scorer Cap

Base32 Chunked Subdomain

Doh Fetch Cofire

Recursive Dns Amplification

Record Type Agnostic

Wrapper By Name Heuristic

Entropy As Confidence Factor

AST taint analysis · from secret source

Url Parsing

Host Registry Lookup

Suspicious Tld Lookup

High Entropy Subdomain Scan

Redirect Action Target Pair

Auth Pretext Detection

Tool Description Scan

False Positive Fence Demotion

Dynamic Url Flag

Leading Action Target Pair

Action Token Catalogue

Target Token Catalogue

Tool Description Scan

False Positive Fence Demotion

Sensitivity Token Set

Single Function Taint Walk

Redactor Same Argument

Param Name Sensitivity Downweight

Structural Test File Detection

Graph Reachability Through Transforms

Encoder Node Classification

Capability Tag By Signal Not By Name

Deep Schema Walker

Centrality At Endpoints Only

Header Credential Forward Detection

Shared Store Write Detection

Credential In Tool Response

Oauth Proxy Confused Deputy

Exec With Credential Argument

Ast Test Nature Detection

Expanded Sensitive Identifier List

Additive Jitter Recognition

Adjacency Based Mitigation

Comments Skipped Structurally

Shared State Vocabulary

Paired Write Read On Same Server

Attestation Detection

Write Only Read Only Filter

Linguistic Downweight

Vendor Token Catalogue

Serverinfo Name Match

Description Vendor Claim Match

Multi Agent Context Gate

Encoder Passthrough Taint

Alias Binding Resolution

Cross Function Helper Walk

Placeholder Literal Suppression

Http Transport Gate

Statelessness Source Signal

Auth Construct Suppression

Metadata And Source Fusion

Redirect Uri From Request

Implicit Flow Literal

Ropc Grant Literal

Localstorage Token Write

State Validation Absence

Scope From Request

Ambiguous Name With Context Confirmation

Whitespace And Array Tokenisation

Colon Dot Suffix Classification

Generic Receiver Chain Marker Required

Template Span User Input Detection

Structural Test File Detection

Library Receiver Plus Method

Options Object Expiry Evaluation

Duration Unit Parsing

Disable Literal Detection

Refresh Context Classification

Bare Token Creation Call Set

Structural Test File Detection

Credential Name Vocabulary

Normalized Name Matching

Description Corroboration

Non Auth Token Exclusion

Nested Schema Walk

Local Verify Suppression

Exact Transport Match

Null Connection Skip

Explicit Insecure Set

Anti Pattern Catalogue

Token Trigram Scan

Cookie Flag Scan

Source Line Citation

Cwe Mapped Factor

Explicit Pinning Bypass Scan

First Connect Accept Any Scan

Mutable Fingerprint Store Scan

Writeable Pin File Scan

Structured Yaml Walk

Expression Interpolation Detection

Nested Reusable Workflow Scan

Sha Pin Verification

Run Step Pipe To Shell

Cred File Substring Match

AST taint analysis · file read to network sink

Dockerfile Copy Cred File Scan

Cred Read Without Fd Scoping

Lightweight File Read Fallback

Encoded Exfil Follow

Artifact Dump Via File Write

Indirect Log Exposure

Bulk Env Dump

Secret Name Allowlist

AST taint analysis · interprocedural

Lightweight Taint Fallback

Symlink Resolution Warning

Cross Platform Path Normalisation

Append Mode Escalation

Dynamic Path Upgrade Factor

Charter Sanitiser Allowlist

Yaml Merge Spread Warning

Explicit Override In Scope

Path Override Flag All

Library Hijack Any Path

Case Insensitive Key Match

Shared Bridge Sinks Vocabulary

Npx Uvx Shell Scan

Child Process Arg Scan

Manifest Range Loose Match

Workspace Committed Aware

Case Variant Match

Auto Approve Key Separate Finding

Any Write Regardless Of Propagation

Silent Mutation Covered By Any Write

Dev Env Gate Does Not Mitigate

File Write Only Is Medium Severity

Project Local Helper Script Is High

Setup Py Cmdclass Subprocess Is Critical

Pyproject Local Backend Is High

Pipe To Shell Pattern Is Critical

Base64 Decode In Hook Is Critical

Import Keyword Ast

Ancestor Scope Integrity Walk

Subprocess Fetch Exec Chain

Integrity Filename Literal

Structural Test File Detection

Empty Cve Array Skip

Version Null Silent Skip

Single Finding Per Dep

Cve Id Manifest Passthrough

Null Last Updated Silent Skip

Age Graduated Factor

Single Finding Per Dep

Count Exact Passthrough

Tiered Factor Weight

Monorepo Reviewer Note

Legitimate Fork Allowlist

Visual Confusable Replay

Scope Squat Detection

Numeric Version Suffix Strip

Algorithm Agreement Gate

Exact Match Lookup

Unicode Normalise Before Lookup

Explicit Variant Enumeration

Advisory Driven Maintenance

Scoped Package Only

Major Version Tiered Threshold

Silent Skip Non Semver

Companion Stub Emission

Non Overlap With Parent

Future Migration Coordination

Structural Command Array Inspection

Env Block Api Redirect

Sensitive Env In Args

Npx Separator Remote Fetch

Content Write Regardless Of Target

Prepublish Manifest Mutation

Bin Field System Command Shadow

Bin Field Hidden Target

Exports Conditional Divergence

Exports Package Json Block

Ast Dual Sdk Import

Alias Binding Resolution

Transport Class Equivalence

Credential Forwarding Taint

Structural Test File Exclusion

Proxy Framework Substring

Multi Stage Per Stage Check

Arg Reference Flag

Scratch Exact Match

Mutable Tag Suffix Tokenisation

Flag Stripping Before Image Extraction

Symlink Creation Sensitive Target

Path Resolve Without Realpath

Lstat Followed By Read Race

No Nofollow Flag On Open

Symlink Lookup In Config Dir

Structural Json Walk

Install Command Token Walker

Semver Lexical Compare

Mcp Critical Prefix Escalation

Arg Default Value Detection

Copy Credential File Detection

Multi Stage Isolation Conservative

Buildkit Secret Mount Exemption

Run Inline Assignment Detection

Env Var Approval Gate

Cli Flag Auto Approve

Conditional Branch Skip

Framework Non Interactive Mode

Neutered Confirmation Stub

Morpheme Tokenisation

Required Param Check

Annotation Partial Mitigation

Structural Test File Detection

Ancestor Guard Walk

Preceding Sibling Confirmation

Receiver Method Guard

Capability Declared Check

Handler Vocabulary Match

Mcp Capability Catalogue

Per Capability Finding

Reader Plus Persistent Store Structural Scan

Unbounded Accumulation No Truncation Scan

Llm Output Feedback Loop Scan

Vector Store Raw Ingest Scan

Pagination Mitigation Multiplicative

No Pagination Is Aggravation

Description Length As Signal

Schema Field Inspection

Multi Signal Threshold

A2a Protocol Surface Catalogue

A2a To Mcp Flow Detection

Agent Card Skill Ingestion

Part Based Content Policy Bypass

Honest Refusal No A2a Surface

Threshold 10s Passthrough

Network Latency Reviewer Note

Silent Skip No Connection

Handler Scope Taint

Alias Binding Resolution

Audit Erasure

Test Nature Structural

Indirect Logger Detection

Spread Assignment Opacity

Child Bindings Field Resolution

Mixin Format Presence

Indirect Structured Wrapper

Template Literal No Structure

Symlink Unlink Still Fires

Rename Then Unlink Without Archive

Logging Disable Structural

Truncate Any Size Fires

Config Field Name Allowed

Silent Assignment

Python Os Remove Audit Path

Ast Read Filter Write Roundtrip

Shell Sed In Place

Rw Mode Open On Audit Path

Timestamp Forgery Detection

Redaction Context Exclusion

Mitigation Token Detection

Weight Assignment By Signal Class

Multi Signal Required

System Context Write Escalation

Language Acknowledge Gap

Empty Name Structural Check

Missing Description Check

Missing Inputschema Check

Protocol Version Validation

Semver Shape Check