aidp 0.41.0 → 0.43.0

data/lib/aidp/security/mcp_risk_profile.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require "yaml"
+require "time"
+require_relative "../config_paths"
+
+module Aidp
+  module Security
+    # Deterministic MCP tool risk profile generated once during configuration.
+    class McpRiskProfile
+      VERSION = 1
+      VALID_FLAGS = %w[untrusted_input private_data egress].freeze
+      VALID_RISK_LEVELS = %w[low medium high].freeze
+
+      attr_reader :generated_at, :generator_model, :version, :tools
+
+      def self.load(project_dir = Dir.pwd)
+        path = Aidp::ConfigPaths.mcp_risk_profile_file(project_dir)
+        return new(tools: {}) unless File.exist?(path)
+
+        data = YAML.safe_load_file(path, permitted_classes: [Symbol], symbolize_names: true) || {}
+        new(
+          generated_at: data[:generated_at],
+          generator_model: data[:generator_model],
+          version: data[:version] || VERSION,
+          tools: data[:tools] || {}
+        )
+      rescue Psych::Exception => e
+        Aidp.log_error("security.mcp_risk_profile", "load_failed", path: path, error: e.message)
+        new(tools: {})
+      end
+
+      def initialize(generated_at: nil, generator_model: nil, version: VERSION, tools: {})
+        @generated_at = generated_at
+        @generator_model = generator_model
+        @version = version
+        @tools = normalize_tools(tools)
+      end
+
+      def save!(project_dir = Dir.pwd)
+        Aidp::ConfigPaths.ensure_security_dir(project_dir)
+        File.write(Aidp::ConfigPaths.mcp_risk_profile_file(project_dir), YAML.dump(to_h))
+      end
+
+      def tool(tool_name)
+        tools[tool_name.to_s]
+      end
+
+      def flags_for(tool_name)
+        tool(tool_name)&.fetch(:flags, []) || []
+      end
+
+      def risk_level_for(tool_name)
+        tool(tool_name)&.fetch(:risk_level, nil)
+      end
+
+      def empty?
+        tools.empty?
+      end
+
+      def to_h
+        {
+          "generated_at" => generated_at,
+          "generator_model" => generator_model,
+          "version" => version,
+          "tools" => tools.transform_values do |tool_data|
+            {
+              "flags" => tool_data[:flags],
+              "risk_level" => tool_data[:risk_level],
+              "rationale" => tool_data[:rationale]
+            }
+          end
+        }
+      end
+
+      private
+
+      def normalize_tools(raw_tools)
+        raw_tools.each_with_object({}) do |(name, tool_data), normalized|
+          data = symbolize(tool_data || {})
+          normalized[name.to_s] = {
+            flags: normalize_flags(data[:flags]),
+            risk_level: normalize_risk_level(data[:risk_level]),
+            rationale: data[:rationale].to_s
+          }
+        end
+      end
+
+      def normalize_flags(flags)
+        Array(flags).map(&:to_s).select { |flag| VALID_FLAGS.include?(flag) }.uniq.sort
+      end
+
+      def normalize_risk_level(level)
+        risk_level = level.to_s
+        VALID_RISK_LEVELS.include?(risk_level) ? risk_level : "low"
+      end
+
+      def symbolize(value)
+        case value
+        when Hash
+          value.each_with_object({}) { |(key, inner), hash| hash[key.to_sym] = symbolize(inner) }
+        when Array
+          value.map { |item| symbolize(item) }
+        else
+          value
+        end
+      end
+    end
+  end
+end

data/lib/aidp/security/mcp_tool_risk_classifier.rb

@@ -0,0 +1,233 @@
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require_relative "../harness/provider_factory"
+require_relative "../harness/provider_info"
+require_relative "../harness/thinking_depth_manager"
+require_relative "mcp_risk_profile"
+
+module Aidp
+  module Security
+    # Generates an MCP tool risk profile using an AI call at configuration time.
+    class McpToolRiskClassifier
+      RISK_FLAGS = %w[untrusted_input private_data egress].freeze
+      RISK_LEVELS = %w[low medium high].freeze
+
+      GENERATION_PROMPT = <<~PROMPT
+        You are classifying MCP tools for Rule-of-Two security enforcement.
+
+        For each MCP tool, determine which risk flags should be enabled when that
+        tool is available to an agent:
+        - untrusted_input: processes or imports untrusted external/user-controlled content
+        - private_data: can access secrets, credentials, local files, repos, databases, or other sensitive data
+        - egress: can communicate externally, push data, call remote services, or send messages off-machine
+
+        Also assign a risk_level of low, medium, or high based on the combined impact.
+
+        Tools to classify:
+        {{tools_json}}
+
+        Respond with ONLY valid JSON in this format:
+        {
+          "tools": [
+            {
+              "name": "filesystem",
+              "flags": ["private_data"],
+              "risk_level": "medium",
+              "rationale": "Can read and write local files that may contain secrets."
+            }
+          ]
+        }
+      PROMPT
+
+      attr_reader :config, :project_dir, :provider_factory
+
+      def initialize(config, project_dir:, provider_factory: nil, provider_info_class: nil, time_source: Time)
+        @config = config
+        @project_dir = project_dir
+        @provider_factory = provider_factory || Aidp::Harness::ProviderFactory.new(config)
+        @provider_info_class = provider_info_class || Aidp::Harness::ProviderInfo
+        @time_source = time_source
+      end
+
+      def generate!(providers: nil, tier: "mini", force_refresh: false, force_refresh_providers: nil)
+        tools = collect_tools(
+          providers: providers,
+          force_refresh: force_refresh,
+          force_refresh_providers: force_refresh_providers
+        )
+        return write_empty_profile if tools.empty?
+
+        provider_name, model_name = select_model(tier)
+        response = call_ai(provider_name, model_name, build_prompt(tools))
+        profile = build_profile(response, model_name, expected_tools: tools)
+        profile.save!(project_dir)
+        profile
+      rescue => e
+        Aidp.log_error("security.mcp_classifier", "generation_failed",
+          error: e.message,
+          error_class: e.class.name)
+        raise
+      end
+
+      def collect_tools(providers: nil, force_refresh: false, force_refresh_providers: nil)
+        provider_names = Array(providers || config.configured_providers).map(&:to_s)
+        force_refresh_provider_names = Array(force_refresh_providers).map(&:to_s)
+
+        provider_names.each_with_object({}) do |provider_name, tools|
+          refresh_provider = refresh_provider?(provider_name, force_refresh, force_refresh_provider_names)
+          provider_info = @provider_info_class.new(provider_name, project_dir)
+          info = provider_info.info(force_refresh: refresh_provider)
+          validate_refreshed_provider_info!(provider_name, info, refresh_provider)
+          next unless info&.dig(:mcp_support)
+
+          enabled_mcp_servers(info).each do |server|
+            next if server_name(server).empty?
+
+            entry = (tools[server_name(server)] ||= {
+              name: server_name(server),
+              descriptions: [],
+              providers: []
+            })
+            description = server[:description].to_s.strip
+            entry[:descriptions] << description unless description.empty?
+            entry[:providers] << provider_name
+          end
+        end.values.map do |tool|
+          tool[:descriptions].uniq!
+          tool[:providers].uniq!
+          tool
+        end.sort_by { |tool| tool[:name] }
+      end
+
+      private
+
+      def write_empty_profile
+        profile = McpRiskProfile.new(
+          generated_at: @time_source.now.utc.iso8601,
+          generator_model: "none",
+          tools: {}
+        )
+        profile.save!(project_dir)
+        profile
+      end
+
+      def select_model(tier)
+        thinking_manager = Aidp::Harness::ThinkingDepthManager.new(config)
+        provider_name, model_name, = thinking_manager.select_model_for_tier(
+          tier,
+          provider: config.respond_to?(:default_provider) ? config.default_provider : nil
+        )
+        [provider_name, model_name]
+      end
+
+      def build_prompt(tools)
+        prompt = GENERATION_PROMPT.dup
+        prompt.gsub!("{{tools_json}}", JSON.pretty_generate(tools))
+        prompt
+      end
+
+      def call_ai(provider_name, model_name, prompt)
+        provider = provider_factory.create_provider(provider_name, model: model_name, output: nil, prompt: nil)
+        provider.send_message(prompt: prompt, session: nil)
+      end
+
+      def build_profile(response, model_name, expected_tools:)
+        parsed = parse_response(response)
+        classified_tools = index_classified_tools(parsed)
+        expected_names = expected_tools.map { |tool| tool[:name] }
+
+        log_unexpected_tools(classified_tools.keys - expected_names)
+
+        tools_hash = expected_names.each_with_object({}) do |tool_name, hash|
+          tool_profile = classified_tools[tool_name]
+          hash[tool_name] = tool_profile || conservative_tool_profile(tool_name)
+        end
+
+        McpRiskProfile.new(
+          generated_at: @time_source.now.utc.iso8601,
+          generator_model: model_name,
+          tools: tools_hash
+        )
+      end
+
+      def parse_response(response)
+        text = response.is_a?(String) ? response : response.to_s
+        json_match = text.match(/\{.*\}/m)
+        raise "No JSON found in AI response" unless json_match
+
+        JSON.parse(json_match[0], symbolize_names: true)
+      rescue JSON::ParserError => e
+        raise "Invalid JSON in AI response: #{e.message}"
+      end
+
+      def index_classified_tools(parsed)
+        Array(parsed[:tools]).each_with_object({}) do |tool, hash|
+          name = tool[:name].to_s.strip
+          next if name.empty?
+
+          normalized = normalize_tool_profile(tool)
+          hash[name] = normalized if normalized
+        end
+      end
+
+      def normalize_tool_profile(tool)
+        flags = tool[:flags]
+        return unless flags.is_a?(Array) && RISK_LEVELS.include?(tool[:risk_level].to_s)
+
+        normalized_flags = flags.map(&:to_s).select { |flag| RISK_FLAGS.include?(flag) }.uniq
+        return if flags.any? && normalized_flags.empty?
+
+        {
+          flags: normalized_flags,
+          risk_level: tool[:risk_level].to_s,
+          rationale: tool[:rationale].to_s.strip
+        }
+      end
+
+      def conservative_tool_profile(tool_name)
+        Aidp.log_warn("security.mcp_classifier", "missing_tool_classification",
+          tool_name: tool_name)
+
+        {
+          flags: RISK_FLAGS,
+          risk_level: "high",
+          rationale: "Conservative fallback: model response omitted or malformed classification for #{tool_name}."
+        }
+      end
+
+      def log_unexpected_tools(tool_names)
+        return if tool_names.empty?
+
+        Aidp.log_warn("security.mcp_classifier", "unexpected_tool_classifications",
+          tool_names: tool_names)
+      end
+
+      def enabled_mcp_servers(info)
+        Array(info[:mcp_servers]).select { |server| server_enabled?(server) }
+      end
+
+      def refresh_provider?(provider_name, force_refresh, force_refresh_provider_names)
+        force_refresh || force_refresh_provider_names.include?(provider_name)
+      end
+
+      def validate_refreshed_provider_info!(provider_name, info, refresh_provider)
+        return unless refresh_provider
+        raise "Provider metadata unavailable for #{provider_name}" unless info
+        return unless info[:mcp_support]
+        return if info.key?(:mcp_servers)
+
+        raise "MCP server metadata unavailable for #{provider_name}"
+      end
+
+      def server_enabled?(server)
+        server[:enabled] != false
+      end
+
+      def server_name(server)
+        server[:name].to_s.strip
+      end
+    end
+  end
+end

data/lib/aidp/security/work_loop_adapter.rb

@@ -17,7 +17,8 @@ module Aidp
     #   adapter.check_agent_call_allowed!(operation: :git_push)
     #   adapter.end_work_unit
     class WorkLoopAdapter
-      attr_reader :project_dir, :config, :current_work_unit_id, :current_state
+      attr_reader :project_dir, :config, :current_work_unit_id, :current_state, :mcp_risk_profile
+      MCP_CONSERVATIVE_FLAGS = %i[untrusted_input private_data egress].freeze
 
       # Sources of untrusted input that trigger the untrusted_input flag
       UNTRUSTED_SOURCES = %w[
@@ -42,11 +43,13 @@ module Aidp
         issue_comment
       ].freeze
 
-      def initialize(project_dir:, config: nil, enforcer: nil, secrets_proxy: nil)
+      def initialize(project_dir:, config: nil, enforcer: nil, secrets_proxy: nil, provider_info_class: nil)
         @project_dir = project_dir
         @config = config || load_security_config
         @enforcer = enforcer || Aidp::Security.enforcer
         @secrets_proxy = secrets_proxy || Aidp::Security.secrets_proxy
+        @provider_info_class = provider_info_class || Aidp::Harness::ProviderInfo
+        @mcp_risk_profile = load_mcp_risk_profile
         @current_work_unit_id = nil
         @current_state = nil
       end
@@ -131,6 +134,40 @@ module Aidp
         @current_state
       end
 
+      # Apply deterministic MCP tool risk flags generated during configuration.
+      # This uses the stored profile and does not perform any AI calls at runtime.
+      def apply_mcp_tool_risk!(tool_name)
+        return @current_state unless enabled? && @current_state
+
+        tool_profile = @mcp_risk_profile.tool(tool_name)
+        return apply_unclassified_mcp_tool_risk!(tool_name) unless tool_profile
+
+        enable_mcp_tool_flags(tool_name, tool_profile[:flags])
+      end
+
+      # Apply deterministic MCP tool risk flags for all MCP servers configured on
+      # the selected provider. This reads only persisted provider metadata so the
+      # work loop never re-introspects provider CLIs at runtime.
+      def apply_provider_mcp_tool_risk!(provider_name, force_refresh: false)
+        return @current_state unless enabled? && @current_state
+
+        if force_refresh
+          Aidp.log_debug("security.adapter", "ignored_provider_mcp_refresh_request",
+            provider: provider_name)
+        end
+
+        provider_mcp_server_names(provider_name).each do |tool_name|
+          apply_mcp_tool_risk!(tool_name)
+        end
+
+        @current_state
+      rescue => e
+        Aidp.log_warn("security.adapter", "mcp_provider_lookup_failed",
+          provider: provider_name,
+          error: e.message)
+        apply_unknown_mcp_risk!(provider_name)
+      end
+
       # Request credentials through the secrets proxy
       # This enables the private_data flag and returns a short-lived token
       # @param secret_name [String] The registered secret name
@@ -219,6 +256,60 @@ module Aidp
         {} # Fallback to empty config
       end
 
+      def load_mcp_risk_profile
+        Aidp::Security::McpRiskProfile.load(@project_dir)
+      rescue
+        Aidp::Security::McpRiskProfile.new(tools: {})
+      end
+
+      def provider_mcp_server_names(provider_name)
+        provider_info = @provider_info_class.new(provider_name, project_dir)
+        info = provider_info.load_info
+        raise "Provider metadata unavailable for #{provider_name}" unless info
+
+        return [] unless info&.dig(:mcp_support)
+        raise "MCP server metadata unavailable for #{provider_name}" unless info.key?(:mcp_servers)
+
+        enabled_mcp_servers(info).filter_map do |server|
+          name = server_name(server)
+          name unless name.empty?
+        end.uniq
+      end
+
+      def enabled_mcp_servers(info)
+        Array(info[:mcp_servers]).select { |server| server_enabled?(server) }
+      end
+
+      def server_enabled?(server)
+        server[:enabled] != false
+      end
+
+      def server_name(server)
+        server[:name].to_s.strip
+      end
+
+      def apply_unknown_mcp_risk!(provider_name)
+        MCP_CONSERVATIVE_FLAGS.each do |flag|
+          @current_state.enable(flag, source: "mcp_provider:#{provider_name}:unknown_tools")
+        end
+
+        @current_state
+      end
+
+      def apply_unclassified_mcp_tool_risk!(tool_name)
+        Aidp.log_warn("security.adapter", "mcp_tool_unclassified",
+          tool_name: tool_name)
+        enable_mcp_tool_flags(tool_name, MCP_CONSERVATIVE_FLAGS, source_suffix: ":unclassified")
+      end
+
+      def enable_mcp_tool_flags(tool_name, flags, source_suffix: "")
+        Array(flags).each do |flag|
+          @current_state.enable(flag.to_sym, source: "mcp_tool:#{tool_name}#{source_suffix}")
+        end
+
+        @current_state
+      end
+
       # Detect untrusted input sources in the context
       def detect_and_enable_untrusted_input(context)
         sources = []

data/lib/aidp/security.rb

@@ -16,6 +16,8 @@ require_relative "security/trifecta_state"
 require_relative "security/rule_of_two_enforcer"
 require_relative "security/secrets_registry"
 require_relative "security/secrets_proxy"
+require_relative "security/mcp_risk_profile"
+require_relative "security/mcp_tool_risk_classifier"
 require_relative "security/work_loop_adapter"
 require_relative "security/watch_mode_handler"
 

data/lib/aidp/setup/wizard.rb

@@ -9,6 +9,7 @@ require "json"
 require "ostruct"
 require_relative "in_memory_config_adapter"
 require_relative "in_memory_config_manager"
+require_relative "../security"
 
 module Aidp
   module Setup
@@ -1993,11 +1994,23 @@ module Aidp
       def save_config(yaml_content)
         Aidp::ConfigPaths.ensure_config_dir(project_dir)
         File.write(config_path, yaml_content)
+        generate_mcp_risk_profile
 
         # Generate devcontainer if managed
         generate_devcontainer_file
       end
 
+      def generate_mcp_risk_profile
+        classifier = Aidp::Security::McpToolRiskClassifier.new(
+          build_in_memory_config_adapter,
+          project_dir: project_dir
+        )
+        classifier.generate!
+      rescue => e
+        @warnings << "Failed to generate MCP risk profile: #{e.message}"
+        Aidp.log_warn("setup_wizard", "mcp_risk_profile_generation_failed", error: e.message)
+      end
+
       def display_warnings
         return if @warnings.empty?
 

data/lib/aidp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Aidp
-  VERSION = "0.41.0"
+  VERSION = "0.43.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aidp
 version: !ruby/object:Gem::Version
-  version: 0.41.0
+  version: 0.43.0
 platform: ruby
 authors:
 - Bart Agapinan
@@ -407,6 +407,7 @@ files:
 - lib/aidp/execute/interactive_repl.rb
 - lib/aidp/execute/persistent_tasklist.rb
 - lib/aidp/execute/progress.rb
+- lib/aidp/execute/project_knowledge_manager.rb
 - lib/aidp/execute/prompt_evaluator.rb
 - lib/aidp/execute/prompt_manager.rb
 - lib/aidp/execute/repl_macros.rb
@@ -526,6 +527,7 @@ files:
 - lib/aidp/pr_worktree_manager.rb
 - lib/aidp/prompt_optimization/context_composer.rb
 - lib/aidp/prompt_optimization/optimizer.rb
+- lib/aidp/prompt_optimization/project_knowledge_indexer.rb
 - lib/aidp/prompt_optimization/prompt_builder.rb
 - lib/aidp/prompt_optimization/relevance_scorer.rb
 - lib/aidp/prompt_optimization/source_code_fragmenter.rb
@@ -539,6 +541,8 @@ files:
 - lib/aidp/rescue_logging.rb
 - lib/aidp/safe_directory.rb
 - lib/aidp/security.rb
+- lib/aidp/security/mcp_risk_profile.rb
+- lib/aidp/security/mcp_tool_risk_classifier.rb
 - lib/aidp/security/rule_of_two_enforcer.rb
 - lib/aidp/security/secrets_proxy.rb
 - lib/aidp/security/secrets_registry.rb