aidp 0.42.0 → 0.43.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f44b47ad0d31015794ec7b2286dc659e85061eb3e6dad8c89ae018976e0d9b1d
-  data.tar.gz: 6d8b28a431c3d55e037e32d0e54e583313af4d495982578b72ab3374155323c5
+  metadata.gz: 013dc044889cc320404776d0691d2091f3cddda0d9ba854dc0afb92312396336
+  data.tar.gz: bb1c57bf8e7d87dfa7d7b169d69646ac76c0cb14fe2f72c70ef02b8543b43494
 SHA512:
-  metadata.gz: d2f838a10c7789f69a253858d0d71aee754a24020722a845eba38cd29eb764be247fee615427afe67f13618cec384565c04cf0f25a25ddd2493962df0df3e0af
-  data.tar.gz: 616bf1a6910461b907c5ab99bccb8dddc3312ee7816550d22d31c395b9faecb90e97bd4e5a032ba594a5d78538d9199a0ffbee203a8fe5c08ae8f784ae47b84e
+  metadata.gz: c7ea760cd1d62424ada60f64acc356cdf4a82db6e2166c203d9d41c489fed936a704afaee17e9a20d588fbf0ead8ebd816a991a3fa01d87644939c872b104b12
+  data.tar.gz: 9c3b34d7474a2f9e899bf50d9b61d1edcb67a1b4a7b41d78abf810517db8cb2082fe889ec7b1fda5266276b6f1406e577644f2ddca16142bcf66e66e79b1e338

data/lib/aidp/cli/providers_command.rb

@@ -6,6 +6,7 @@ require "tty-spinner"
 require_relative "../harness/provider_info"
 require_relative "../harness/capability_registry"
 require_relative "../harness/config_manager"
+require_relative "../security"
 
 module Aidp
   class CLI
@@ -21,12 +22,13 @@ module Aidp
     class ProvidersCommand
       include Aidp::MessageDisplay
 
-      def initialize(prompt: TTY::Prompt.new, provider_info_class: nil, capability_registry_class: nil, config_manager_class: nil, project_dir: nil)
+      def initialize(prompt: TTY::Prompt.new, provider_info_class: nil, capability_registry_class: nil, config_manager_class: nil, project_dir: nil, mcp_tool_risk_classifier_class: nil)
         @prompt = prompt
         @provider_info_class = provider_info_class || Aidp::Harness::ProviderInfo
         @capability_registry_class = capability_registry_class || Aidp::Harness::CapabilityRegistry
         @config_manager_class = config_manager_class || Aidp::Harness::ConfigManager
         @project_dir = project_dir || Dir.pwd
+        @mcp_tool_risk_classifier_class = mcp_tool_risk_classifier_class || Aidp::Security::McpToolRiskClassifier
       end
 
       # Main entry point for providers info/refresh subcommands
@@ -198,10 +200,23 @@ module Aidp
           end
         end
 
+        refresh_mcp_risk_profile(config_manager, providers_to_refresh)
+
         display_message("\n" + "=" * 60, type: :muted)
         display_message("Refresh complete", type: :highlight)
       end
 
+      def refresh_mcp_risk_profile(config_manager, providers_to_refresh)
+        classifier = @mcp_tool_risk_classifier_class.new(config_manager, project_dir: @project_dir)
+        classifier.generate!(
+          providers: config_manager.provider_names,
+          force_refresh_providers: providers_to_refresh
+        )
+        display_message("✓ MCP risk profile refreshed", type: :success)
+      rescue => e
+        display_message("⚠ MCP risk profile refresh failed: #{e.message}", type: :warning)
+      end
+
       def display_help
         display_message("\nUsage: aidp providers <subcommand> [options]", type: :info)
         display_message("\nSubcommands:", type: :info)

data/lib/aidp/config_paths.rb

@@ -32,6 +32,7 @@ module Aidp
     # Security module paths
     def self.security_dir(project_dir = Dir.pwd) = File.join(aidp_dir(project_dir), "security")
     def self.secrets_registry_file(project_dir = Dir.pwd) = File.join(security_dir(project_dir), "secrets_registry.json")
+    def self.mcp_risk_profile_file(project_dir = Dir.pwd) = File.join(security_dir(project_dir), "mcp_risk_profile.yml")
 
     # Database path
     def self.database_file(project_dir = Dir.pwd) = File.join(aidp_dir(project_dir), "aidp.db")

data/lib/aidp/execute/work_loop_runner.rb

@@ -1094,6 +1094,7 @@ module Aidp
           # Execute with sanitized environment (secrets stripped) when security is enabled
           # This ensures agent processes cannot access registered secrets directly
           execute_block = lambda do
+            @security_adapter.apply_provider_mcp_tool_risk!(provider_name)
             @provider_manager.execute_with_provider(
               provider_name,
               full_prompt,

data/lib/aidp/security/mcp_risk_profile.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require "yaml"
+require "time"
+require_relative "../config_paths"
+
+module Aidp
+  module Security
+    # Deterministic MCP tool risk profile generated once during configuration.
+    class McpRiskProfile
+      VERSION = 1
+      VALID_FLAGS = %w[untrusted_input private_data egress].freeze
+      VALID_RISK_LEVELS = %w[low medium high].freeze
+
+      attr_reader :generated_at, :generator_model, :version, :tools
+
+      def self.load(project_dir = Dir.pwd)
+        path = Aidp::ConfigPaths.mcp_risk_profile_file(project_dir)
+        return new(tools: {}) unless File.exist?(path)
+
+        data = YAML.safe_load_file(path, permitted_classes: [Symbol], symbolize_names: true) || {}
+        new(
+          generated_at: data[:generated_at],
+          generator_model: data[:generator_model],
+          version: data[:version] || VERSION,
+          tools: data[:tools] || {}
+        )
+      rescue Psych::Exception => e
+        Aidp.log_error("security.mcp_risk_profile", "load_failed", path: path, error: e.message)
+        new(tools: {})
+      end
+
+      def initialize(generated_at: nil, generator_model: nil, version: VERSION, tools: {})
+        @generated_at = generated_at
+        @generator_model = generator_model
+        @version = version
+        @tools = normalize_tools(tools)
+      end
+
+      def save!(project_dir = Dir.pwd)
+        Aidp::ConfigPaths.ensure_security_dir(project_dir)
+        File.write(Aidp::ConfigPaths.mcp_risk_profile_file(project_dir), YAML.dump(to_h))
+      end
+
+      def tool(tool_name)
+        tools[tool_name.to_s]
+      end
+
+      def flags_for(tool_name)
+        tool(tool_name)&.fetch(:flags, []) || []
+      end
+
+      def risk_level_for(tool_name)
+        tool(tool_name)&.fetch(:risk_level, nil)
+      end
+
+      def empty?
+        tools.empty?
+      end
+
+      def to_h
+        {
+          "generated_at" => generated_at,
+          "generator_model" => generator_model,
+          "version" => version,
+          "tools" => tools.transform_values do |tool_data|
+            {
+              "flags" => tool_data[:flags],
+              "risk_level" => tool_data[:risk_level],
+              "rationale" => tool_data[:rationale]
+            }
+          end
+        }
+      end
+
+      private
+
+      def normalize_tools(raw_tools)
+        raw_tools.each_with_object({}) do |(name, tool_data), normalized|
+          data = symbolize(tool_data || {})
+          normalized[name.to_s] = {
+            flags: normalize_flags(data[:flags]),
+            risk_level: normalize_risk_level(data[:risk_level]),
+            rationale: data[:rationale].to_s
+          }
+        end
+      end
+
+      def normalize_flags(flags)
+        Array(flags).map(&:to_s).select { |flag| VALID_FLAGS.include?(flag) }.uniq.sort
+      end
+
+      def normalize_risk_level(level)
+        risk_level = level.to_s
+        VALID_RISK_LEVELS.include?(risk_level) ? risk_level : "low"
+      end
+
+      def symbolize(value)
+        case value
+        when Hash
+          value.each_with_object({}) { |(key, inner), hash| hash[key.to_sym] = symbolize(inner) }
+        when Array
+          value.map { |item| symbolize(item) }
+        else
+          value
+        end
+      end
+    end
+  end
+end

data/lib/aidp/security/mcp_tool_risk_classifier.rb

@@ -0,0 +1,233 @@
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require_relative "../harness/provider_factory"
+require_relative "../harness/provider_info"
+require_relative "../harness/thinking_depth_manager"
+require_relative "mcp_risk_profile"
+
+module Aidp
+  module Security
+    # Generates an MCP tool risk profile using an AI call at configuration time.
+    class McpToolRiskClassifier
+      RISK_FLAGS = %w[untrusted_input private_data egress].freeze
+      RISK_LEVELS = %w[low medium high].freeze
+
+      GENERATION_PROMPT = <<~PROMPT
+        You are classifying MCP tools for Rule-of-Two security enforcement.
+
+        For each MCP tool, determine which risk flags should be enabled when that
+        tool is available to an agent:
+        - untrusted_input: processes or imports untrusted external/user-controlled content
+        - private_data: can access secrets, credentials, local files, repos, databases, or other sensitive data
+        - egress: can communicate externally, push data, call remote services, or send messages off-machine
+
+        Also assign a risk_level of low, medium, or high based on the combined impact.
+
+        Tools to classify:
+        {{tools_json}}
+
+        Respond with ONLY valid JSON in this format:
+        {
+          "tools": [
+            {
+              "name": "filesystem",
+              "flags": ["private_data"],
+              "risk_level": "medium",
+              "rationale": "Can read and write local files that may contain secrets."
+            }
+          ]
+        }
+      PROMPT
+
+      attr_reader :config, :project_dir, :provider_factory
+
+      def initialize(config, project_dir:, provider_factory: nil, provider_info_class: nil, time_source: Time)
+        @config = config
+        @project_dir = project_dir
+        @provider_factory = provider_factory || Aidp::Harness::ProviderFactory.new(config)
+        @provider_info_class = provider_info_class || Aidp::Harness::ProviderInfo
+        @time_source = time_source
+      end
+
+      def generate!(providers: nil, tier: "mini", force_refresh: false, force_refresh_providers: nil)
+        tools = collect_tools(
+          providers: providers,
+          force_refresh: force_refresh,
+          force_refresh_providers: force_refresh_providers
+        )
+        return write_empty_profile if tools.empty?
+
+        provider_name, model_name = select_model(tier)
+        response = call_ai(provider_name, model_name, build_prompt(tools))
+        profile = build_profile(response, model_name, expected_tools: tools)
+        profile.save!(project_dir)
+        profile
+      rescue => e
+        Aidp.log_error("security.mcp_classifier", "generation_failed",
+          error: e.message,
+          error_class: e.class.name)
+        raise
+      end
+
+      def collect_tools(providers: nil, force_refresh: false, force_refresh_providers: nil)
+        provider_names = Array(providers || config.configured_providers).map(&:to_s)
+        force_refresh_provider_names = Array(force_refresh_providers).map(&:to_s)
+
+        provider_names.each_with_object({}) do |provider_name, tools|
+          refresh_provider = refresh_provider?(provider_name, force_refresh, force_refresh_provider_names)
+          provider_info = @provider_info_class.new(provider_name, project_dir)
+          info = provider_info.info(force_refresh: refresh_provider)
+          validate_refreshed_provider_info!(provider_name, info, refresh_provider)
+          next unless info&.dig(:mcp_support)
+
+          enabled_mcp_servers(info).each do |server|
+            next if server_name(server).empty?
+
+            entry = (tools[server_name(server)] ||= {
+              name: server_name(server),
+              descriptions: [],
+              providers: []
+            })
+            description = server[:description].to_s.strip
+            entry[:descriptions] << description unless description.empty?
+            entry[:providers] << provider_name
+          end
+        end.values.map do |tool|
+          tool[:descriptions].uniq!
+          tool[:providers].uniq!
+          tool
+        end.sort_by { |tool| tool[:name] }
+      end
+
+      private
+
+      def write_empty_profile
+        profile = McpRiskProfile.new(
+          generated_at: @time_source.now.utc.iso8601,
+          generator_model: "none",
+          tools: {}
+        )
+        profile.save!(project_dir)
+        profile
+      end
+
+      def select_model(tier)
+        thinking_manager = Aidp::Harness::ThinkingDepthManager.new(config)
+        provider_name, model_name, = thinking_manager.select_model_for_tier(
+          tier,
+          provider: config.respond_to?(:default_provider) ? config.default_provider : nil
+        )
+        [provider_name, model_name]
+      end
+
+      def build_prompt(tools)
+        prompt = GENERATION_PROMPT.dup
+        prompt.gsub!("{{tools_json}}", JSON.pretty_generate(tools))
+        prompt
+      end
+
+      def call_ai(provider_name, model_name, prompt)
+        provider = provider_factory.create_provider(provider_name, model: model_name, output: nil, prompt: nil)
+        provider.send_message(prompt: prompt, session: nil)
+      end
+
+      def build_profile(response, model_name, expected_tools:)
+        parsed = parse_response(response)
+        classified_tools = index_classified_tools(parsed)
+        expected_names = expected_tools.map { |tool| tool[:name] }
+
+        log_unexpected_tools(classified_tools.keys - expected_names)
+
+        tools_hash = expected_names.each_with_object({}) do |tool_name, hash|
+          tool_profile = classified_tools[tool_name]
+          hash[tool_name] = tool_profile || conservative_tool_profile(tool_name)
+        end
+
+        McpRiskProfile.new(
+          generated_at: @time_source.now.utc.iso8601,
+          generator_model: model_name,
+          tools: tools_hash
+        )
+      end
+
+      def parse_response(response)
+        text = response.is_a?(String) ? response : response.to_s
+        json_match = text.match(/\{.*\}/m)
+        raise "No JSON found in AI response" unless json_match
+
+        JSON.parse(json_match[0], symbolize_names: true)
+      rescue JSON::ParserError => e
+        raise "Invalid JSON in AI response: #{e.message}"
+      end
+
+      def index_classified_tools(parsed)
+        Array(parsed[:tools]).each_with_object({}) do |tool, hash|
+          name = tool[:name].to_s.strip
+          next if name.empty?
+
+          normalized = normalize_tool_profile(tool)
+          hash[name] = normalized if normalized
+        end
+      end
+
+      def normalize_tool_profile(tool)
+        flags = tool[:flags]
+        return unless flags.is_a?(Array) && RISK_LEVELS.include?(tool[:risk_level].to_s)
+
+        normalized_flags = flags.map(&:to_s).select { |flag| RISK_FLAGS.include?(flag) }.uniq
+        return if flags.any? && normalized_flags.empty?
+
+        {
+          flags: normalized_flags,
+          risk_level: tool[:risk_level].to_s,
+          rationale: tool[:rationale].to_s.strip
+        }
+      end
+
+      def conservative_tool_profile(tool_name)
+        Aidp.log_warn("security.mcp_classifier", "missing_tool_classification",
+          tool_name: tool_name)
+
+        {
+          flags: RISK_FLAGS,
+          risk_level: "high",
+          rationale: "Conservative fallback: model response omitted or malformed classification for #{tool_name}."
+        }
+      end
+
+      def log_unexpected_tools(tool_names)
+        return if tool_names.empty?
+
+        Aidp.log_warn("security.mcp_classifier", "unexpected_tool_classifications",
+          tool_names: tool_names)
+      end
+
+      def enabled_mcp_servers(info)
+        Array(info[:mcp_servers]).select { |server| server_enabled?(server) }
+      end
+
+      def refresh_provider?(provider_name, force_refresh, force_refresh_provider_names)
+        force_refresh || force_refresh_provider_names.include?(provider_name)
+      end
+
+      def validate_refreshed_provider_info!(provider_name, info, refresh_provider)
+        return unless refresh_provider
+        raise "Provider metadata unavailable for #{provider_name}" unless info
+        return unless info[:mcp_support]
+        return if info.key?(:mcp_servers)
+
+        raise "MCP server metadata unavailable for #{provider_name}"
+      end
+
+      def server_enabled?(server)
+        server[:enabled] != false
+      end
+
+      def server_name(server)
+        server[:name].to_s.strip
+      end
+    end
+  end
+end

data/lib/aidp/security/work_loop_adapter.rb

@@ -17,7 +17,8 @@ module Aidp
     #   adapter.check_agent_call_allowed!(operation: :git_push)
     #   adapter.end_work_unit
     class WorkLoopAdapter
-      attr_reader :project_dir, :config, :current_work_unit_id, :current_state
+      attr_reader :project_dir, :config, :current_work_unit_id, :current_state, :mcp_risk_profile
+      MCP_CONSERVATIVE_FLAGS = %i[untrusted_input private_data egress].freeze
 
       # Sources of untrusted input that trigger the untrusted_input flag
       UNTRUSTED_SOURCES = %w[
@@ -42,11 +43,13 @@ module Aidp
         issue_comment
       ].freeze
 
-      def initialize(project_dir:, config: nil, enforcer: nil, secrets_proxy: nil)
+      def initialize(project_dir:, config: nil, enforcer: nil, secrets_proxy: nil, provider_info_class: nil)
         @project_dir = project_dir
         @config = config || load_security_config
         @enforcer = enforcer || Aidp::Security.enforcer
         @secrets_proxy = secrets_proxy || Aidp::Security.secrets_proxy
+        @provider_info_class = provider_info_class || Aidp::Harness::ProviderInfo
+        @mcp_risk_profile = load_mcp_risk_profile
         @current_work_unit_id = nil
         @current_state = nil
       end
@@ -131,6 +134,40 @@ module Aidp
         @current_state
       end
 
+      # Apply deterministic MCP tool risk flags generated during configuration.
+      # This uses the stored profile and does not perform any AI calls at runtime.
+      def apply_mcp_tool_risk!(tool_name)
+        return @current_state unless enabled? && @current_state
+
+        tool_profile = @mcp_risk_profile.tool(tool_name)
+        return apply_unclassified_mcp_tool_risk!(tool_name) unless tool_profile
+
+        enable_mcp_tool_flags(tool_name, tool_profile[:flags])
+      end
+
+      # Apply deterministic MCP tool risk flags for all MCP servers configured on
+      # the selected provider. This reads only persisted provider metadata so the
+      # work loop never re-introspects provider CLIs at runtime.
+      def apply_provider_mcp_tool_risk!(provider_name, force_refresh: false)
+        return @current_state unless enabled? && @current_state
+
+        if force_refresh
+          Aidp.log_debug("security.adapter", "ignored_provider_mcp_refresh_request",
+            provider: provider_name)
+        end
+
+        provider_mcp_server_names(provider_name).each do |tool_name|
+          apply_mcp_tool_risk!(tool_name)
+        end
+
+        @current_state
+      rescue => e
+        Aidp.log_warn("security.adapter", "mcp_provider_lookup_failed",
+          provider: provider_name,
+          error: e.message)
+        apply_unknown_mcp_risk!(provider_name)
+      end
+
       # Request credentials through the secrets proxy
       # This enables the private_data flag and returns a short-lived token
       # @param secret_name [String] The registered secret name
@@ -219,6 +256,60 @@ module Aidp
         {} # Fallback to empty config
       end
 
+      def load_mcp_risk_profile
+        Aidp::Security::McpRiskProfile.load(@project_dir)
+      rescue
+        Aidp::Security::McpRiskProfile.new(tools: {})
+      end
+
+      def provider_mcp_server_names(provider_name)
+        provider_info = @provider_info_class.new(provider_name, project_dir)
+        info = provider_info.load_info
+        raise "Provider metadata unavailable for #{provider_name}" unless info
+
+        return [] unless info&.dig(:mcp_support)
+        raise "MCP server metadata unavailable for #{provider_name}" unless info.key?(:mcp_servers)
+
+        enabled_mcp_servers(info).filter_map do |server|
+          name = server_name(server)
+          name unless name.empty?
+        end.uniq
+      end
+
+      def enabled_mcp_servers(info)
+        Array(info[:mcp_servers]).select { |server| server_enabled?(server) }
+      end
+
+      def server_enabled?(server)
+        server[:enabled] != false
+      end
+
+      def server_name(server)
+        server[:name].to_s.strip
+      end
+
+      def apply_unknown_mcp_risk!(provider_name)
+        MCP_CONSERVATIVE_FLAGS.each do |flag|
+          @current_state.enable(flag, source: "mcp_provider:#{provider_name}:unknown_tools")
+        end
+
+        @current_state
+      end
+
+      def apply_unclassified_mcp_tool_risk!(tool_name)
+        Aidp.log_warn("security.adapter", "mcp_tool_unclassified",
+          tool_name: tool_name)
+        enable_mcp_tool_flags(tool_name, MCP_CONSERVATIVE_FLAGS, source_suffix: ":unclassified")
+      end
+
+      def enable_mcp_tool_flags(tool_name, flags, source_suffix: "")
+        Array(flags).each do |flag|
+          @current_state.enable(flag.to_sym, source: "mcp_tool:#{tool_name}#{source_suffix}")
+        end
+
+        @current_state
+      end
+
       # Detect untrusted input sources in the context
       def detect_and_enable_untrusted_input(context)
         sources = []

data/lib/aidp/security.rb

@@ -16,6 +16,8 @@ require_relative "security/trifecta_state"
 require_relative "security/rule_of_two_enforcer"
 require_relative "security/secrets_registry"
 require_relative "security/secrets_proxy"
+require_relative "security/mcp_risk_profile"
+require_relative "security/mcp_tool_risk_classifier"
 require_relative "security/work_loop_adapter"
 require_relative "security/watch_mode_handler"
 

data/lib/aidp/setup/wizard.rb

@@ -9,6 +9,7 @@ require "json"
 require "ostruct"
 require_relative "in_memory_config_adapter"
 require_relative "in_memory_config_manager"
+require_relative "../security"
 
 module Aidp
   module Setup
@@ -1993,11 +1994,23 @@ module Aidp
       def save_config(yaml_content)
         Aidp::ConfigPaths.ensure_config_dir(project_dir)
         File.write(config_path, yaml_content)
+        generate_mcp_risk_profile
 
         # Generate devcontainer if managed
         generate_devcontainer_file
       end
 
+      def generate_mcp_risk_profile
+        classifier = Aidp::Security::McpToolRiskClassifier.new(
+          build_in_memory_config_adapter,
+          project_dir: project_dir
+        )
+        classifier.generate!
+      rescue => e
+        @warnings << "Failed to generate MCP risk profile: #{e.message}"
+        Aidp.log_warn("setup_wizard", "mcp_risk_profile_generation_failed", error: e.message)
+      end
+
       def display_warnings
         return if @warnings.empty?
 

data/lib/aidp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Aidp
-  VERSION = "0.42.0"
+  VERSION = "0.43.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aidp
 version: !ruby/object:Gem::Version
-  version: 0.42.0
+  version: 0.43.0
 platform: ruby
 authors:
 - Bart Agapinan
@@ -541,6 +541,8 @@ files:
 - lib/aidp/rescue_logging.rb
 - lib/aidp/safe_directory.rb
 - lib/aidp/security.rb
+- lib/aidp/security/mcp_risk_profile.rb
+- lib/aidp/security/mcp_tool_risk_classifier.rb
 - lib/aidp/security/rule_of_two_enforcer.rb
 - lib/aidp/security/secrets_proxy.rb
 - lib/aidp/security/secrets_registry.rb