@aaa-sentinel/mcp-server 0.6.0 → 0.8.0

package/README.md

@@ -109,9 +109,11 @@ status as plain JSON.
 | `list_cost_anomalies` | `accountId?` | `reports:read` | Business |
 | `get_security_overview` | — | `security:read` | Pro + security add-on |
 | `get_security_score` | `accountId` | `security:read` | Pro + security add-on |
-| `list_security_findings` | `accountId`, `source?` | `security:read` | Pro + security add-on |
+| `list_security_findings` | `accountId`, `source?`, `category?` | `security:read` | Pro + security add-on |
 | `get_security_critical_changes` | `accountId` | `security:read` | Pro + security add-on |
+| `list_security_vulnerabilities` | `accountId` | `security:read` | Pro + security add-on |
 | `get_security_conformance` | `accountId` or `clientId` | `security:read` | Pro + security add-on |
+| `get_security_posture_history` | `accountId` or `clientId`, `days?` | `security:read` | Pro + security add-on |
 | `get_account` | `accountId` | `accounts:read` | Pro |
 | `get_account_monthly_costs` | `accountId` | `accounts:read` | Pro |
 | `get_cost_history` | `accountId` | `reports:read` | Pro |

package/dist/cli.js

@@ -2800,6 +2800,28 @@ var $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
     return payload;
   };
 });
+var $ZodLiteral = /* @__PURE__ */ $constructor("$ZodLiteral", (inst, def) => {
+  $ZodType.init(inst, def);
+  const values = new Set(def.values);
+  inst._zod.values = values;
+  defineLazyInternal(inst, "pattern", (zod) => {
+    const vals = zod.def.values;
+    return new RegExp(vals.length ? `^(${vals.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$` : "^[^\\s\\S]$");
+  });
+  inst._zod.parse = (payload, _ctx) => {
+    const input = payload.value;
+    if (values.has(input)) {
+      return payload;
+    }
+    payload.issues.push({
+      code: "invalid_value",
+      values: def.values,
+      input,
+      inst
+    });
+    return payload;
+  };
+});
 var $ZodTransform = /* @__PURE__ */ $constructor("$ZodTransform", (inst, def) => {
   $ZodType.init(inst, def);
   inst._zod.optin = "optional";
@@ -4739,6 +4761,46 @@ var enumProcessor = (schema, _ctx, json, _params) => {
     json.type = "string";
   json.enum = values;
 };
+var literalProcessor = (schema, ctx, json, params) => {
+  const def = schema._zod.def;
+  if (def.values.length === 0) {
+    json.not = {};
+    return;
+  }
+  const vals = [];
+  for (const val of def.values) {
+    if (val === void 0) {
+      if (handleUnrepresentable(schema, ctx, json, params, "Literal `undefined` cannot be represented in JSON Schema"))
+        return;
+    } else if (typeof val === "bigint") {
+      if (handleUnrepresentable(schema, ctx, json, params, "BigInt literals cannot be represented in JSON Schema"))
+        return;
+      vals.push(Number(val));
+    } else {
+      vals.push(val);
+    }
+  }
+  if (vals.length === 0) {
+  } else if (vals.length === 1) {
+    const val = vals[0];
+    json.type = val === null ? "null" : typeof val;
+    if (ctx.target === "draft-04" || ctx.target === "openapi-3.0") {
+      json.enum = [val];
+    } else {
+      json.const = val;
+    }
+  } else {
+    if (vals.every((v) => typeof v === "number"))
+      json.type = "number";
+    if (vals.every((v) => typeof v === "string"))
+      json.type = "string";
+    if (vals.every((v) => typeof v === "boolean"))
+      json.type = "boolean";
+    if (vals.every((v) => v === null))
+      json.type = "null";
+    json.enum = vals;
+  }
+};
 var customProcessor = (schema, ctx, json, params) => {
   handleUnrepresentable(schema, ctx, json, params, "Custom types cannot be represented in JSON Schema");
 };
@@ -5668,6 +5730,27 @@ function _enum(values, params) {
     ...util_exports.normalizeParams(params)
   });
 }
+var ZodLiteral = /* @__PURE__ */ $constructor("ZodLiteral", (inst, def) => {
+  $ZodLiteral.init(inst, def);
+  ZodType.init(inst, def);
+  inst._zod.processJSONSchema = (ctx, json, params) => literalProcessor(inst, ctx, json, params);
+  inst.values = new Set(def.values);
+  Object.defineProperty(inst, "value", {
+    get() {
+      if (def.values.length > 1) {
+        throw new Error("This schema contains multiple valid literal values. Use `.values` instead.");
+      }
+      return def.values[0];
+    }
+  });
+});
+function literal(value, params) {
+  return new ZodLiteral({
+    type: "literal",
+    values: Array.isArray(value) ? value : [value],
+    ...util_exports.normalizeParams(params)
+  });
+}
 var ZodTransform = /* @__PURE__ */ $constructor("ZodTransform", (inst, def) => {
   _ensureDefaultMemoizer();
   $ZodTransform.init(inst, def);
@@ -5982,6 +6065,7 @@ function defineTool(def) {
 }
 var SAVINGS_TYPES = ["compute", "storage", "network", "database", "serverless", "governance"];
 var SECURITY_SOURCES = ["own", "corroborated", "securityhub", "guardduty", "defender", "scc"];
+var SECURITY_CATEGORIES = ["security_network", "security_exposure", "security_encryption", "security_iam", "security_logging", "security_secrets"];
 var AGENT_STATUSES = ["proposed", "pending_approval", "pending_second_approval", "approved", "executing", "completed", "failed", "cancelled", "expired"];
 var BillingPeriod = string2().regex(/^\d{4}-(0[1-9]|1[0-2])$/, "Use YYYY-MM");
 var ACCOUNT_ID = { type: "string", description: "Account identifier, as returned by list_accounts." };
@@ -6138,7 +6222,7 @@ var TOOLS = [
   }),
   defineTool({
     name: "list_security_findings",
-    description: "List the security findings of the latest security scan of one account (up to 500, most severe first), with attack chains and a diff against the previous scan. Requires the security:read scope, the Pro plan and the security add-on on that account.",
+    description: 'List the security findings of the latest security scan of one account (up to 500, most severe first), with attack chains and a diff against the previous scan. Use category "security_iam" for the permissions view: effective administrators, unused identities, keys and service accounts, granted permissions that are not used, and assignments to deleted identities. Requires the security:read scope, the Pro plan and the security add-on on that account.',
     inputSchema: {
       type: "object",
       properties: {
@@ -6147,16 +6231,25 @@ var TOOLS = [
           type: "string",
           enum: [...SECURITY_SOURCES],
           description: "Filter by origin: own rules, corroborated, or a native tool (optional)."
+        },
+        category: {
+          type: "string",
+          enum: [...SECURITY_CATEGORIES],
+          description: 'Filter by rule category (optional); "security_iam" is the permissions view.'
         }
       },
       required: ["accountId"]
     },
-    argsSchema: object({ accountId: string2().min(1), source: _enum(SECURITY_SOURCES).optional() }),
-    handler: async ({ accountId, source }, config2) => apiGet("/v1/security/findings", { accountId, source }, config2)
+    argsSchema: object({
+      accountId: string2().min(1),
+      source: _enum(SECURITY_SOURCES).optional(),
+      category: _enum(SECURITY_CATEGORIES).optional()
+    }),
+    handler: async ({ accountId, source, category }, config2) => apiGet("/v1/security/findings", { accountId, source, category }, config2)
   }),
   defineTool({
     name: "get_security_critical_changes",
-    description: "List the critical configuration changes of the last 7 days in one AWS account, read from CloudTrail (up to 100, newest first): public bucket or snapshot, remote admin open to the internet, logging turned off, root use, admin granted. Each comes with who made it and, for rule-backed changes, whether a re-check confirmed the risk. Accounts outside AWS, or without the security add-on, return supported false and an empty list. Requires the security:read scope and the Pro plan or above.",
+    description: "List the critical configuration changes of the last 7 days in one account (up to 100, newest first), read from CloudTrail in AWS, the activity log in Azure or the Admin Activity audit logs in GCP: public bucket, storage or snapshot, remote admin open to the internet, logging turned off, root use, admin granted. Each comes with who made it and, for rule-backed changes, whether a re-check confirmed the risk. Accounts without the security add-on return supported false and an empty list. Requires the security:read scope and the Pro plan or above.",
     inputSchema: {
       type: "object",
       properties: { accountId: { type: "string", description: "Account identifier, as returned by list_accounts." } },
@@ -6165,6 +6258,17 @@ var TOOLS = [
     argsSchema: object({ accountId: string2().min(1) }),
     handler: async ({ accountId }, config2) => apiGet("/v1/security/critical-changes", { accountId }, config2)
   }),
+  defineTool({
+    name: "list_security_vulnerabilities",
+    description: "List the vulnerabilities (CVEs) that the cloud native scanner already found in one account (Amazon Inspector or ECR basic scanning, Microsoft Defender for Cloud, GCP Artifact Analysis and VM Manager), up to 200, highest priority first. Each one has the cloud severity and an effective severity that rises when the resource is exposed to the internet, has a known exploit or is unused according to a cost rule (low CPU is shown as context only). AAA Sentinel does not scan on its own: tools shows whether each scanner is active, absent or could not be read, truncated whether the cloud has more than the cap, and partial why the list may be incomplete (scanner missing in some regions or resource types listed in uncovered, failed reads, time budget, unreadable entries, expired rows). Amazon Inspector only sees image use on ECS and EKS: when the account has container Lambdas, App Runner services or images not in use there, uncovered.gaps says ecr_images_outside_ecs_eks and those images come last with imageInUse false. An account without the security add-on returns access teaser and an empty list, which does not mean it has no vulnerabilities. bySeverity counts the effective severity. Requires the security:read scope and the Pro plan or above.",
+    inputSchema: {
+      type: "object",
+      properties: { accountId: { type: "string", description: "Account identifier, as returned by list_accounts." } },
+      required: ["accountId"]
+    },
+    argsSchema: object({ accountId: string2().min(1) }),
+    handler: async ({ accountId }, config2) => apiGet("/v1/security/vulnerabilities", { accountId }, config2)
+  }),
   defineTool({
     name: "get_security_conformance",
     description: "Get CIS benchmark coverage for one account, or for every account of a managed client (clientId, Business plan). Pass exactly one of accountId or clientId. Requires the security:read scope, plus reports:read when using clientId.",
@@ -6180,6 +6284,26 @@ var TOOLS = [
     }),
     handler: async ({ accountId, clientId: clientId2 }, config2) => apiGet("/v1/security/conformance", { accountId, clientId: clientId2 }, config2)
   }),
+  defineTool({
+    name: "get_security_posture_history",
+    description: "Get how the security posture changed over 30, 90 or 365 days (default 90) for one account, or for every account with the security add-on of a managed client (clientId, Business plan, up to 20 accounts; omitted counts the rest). Returns points, one per UTC day (the last scan of that day: score, scored/total rules, open findings by severity, events), and summary: from/to (Score of the first and last point), resolved (distinct findings gone in a scan that fully evaluated their rule), opened (new, from rules already fully evaluated before), surfaced (new but not comparable: rule not fully evaluated before, or an external tool), unverified (gone without confirmation), meanFixDays by severity, comparable and notComparableReasons. When comparable is false, do not describe the Score change as the account getting better or worse. Points keep the Score computed each day, without discounting risks accepted later (acceptedRisks). Pass exactly one of accountId or clientId. Requires the security:read scope, plus reports:read when using clientId.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        accountId: { type: "string", description: "Account identifier (use this or clientId)." },
+        clientId: { type: "string", description: "Managed client identifier (use this or accountId)." },
+        days: { type: "number", enum: [30, 90, 365], description: "Period in days (optional, default 90)." }
+      }
+    },
+    argsSchema: object({
+      accountId: string2().min(1).optional(),
+      clientId: string2().min(1).optional(),
+      days: union([literal(30), literal(90), literal(365)]).optional()
+    }).refine((a) => Boolean(a.accountId) !== Boolean(a.clientId), {
+      message: "Pass exactly one of accountId or clientId"
+    }),
+    handler: async ({ accountId, clientId: clientId2, days }, config2) => apiGet("/v1/security/posture-history", { accountId, clientId: clientId2, days: days === void 0 ? void 0 : String(days) }, config2)
+  }),
   // ── Cuentas y costes ───────────────────────────────────────
   defineTool({
     name: "get_account",
@@ -6516,7 +6640,7 @@ function findTool(name) {
 
 // src/protocol.ts
 var SERVER_NAME = "aaa-sentinel-mcp";
-var SERVER_VERSION = "0.6.0";
+var SERVER_VERSION = "0.8.0";
 var SUPPORTED_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
 var PARSE_ERROR = -32700;
 var INVALID_REQUEST = -32600;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aaa-sentinel/mcp-server",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Read-only MCP server for AAA Sentinel: query cloud costs, savings, security posture, AI spend, uptime monitoring, the remediation agent and managed clients from an AI assistant",
   "license": "MIT",
   "type": "module",