@blacksandscyber/mcp-server-bursar 0.5.0

package/build/shield/discovery/dataStoreDetector.js

@@ -0,0 +1,125 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectDataStores = detectDataStores;
+/** Detect database and data store connections. */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const DB_PACKAGES = {
+    pg: { type: "postgresql", defaultPort: 5432 },
+    mysql2: { type: "mysql", defaultPort: 3306 },
+    mongoose: { type: "mongodb", defaultPort: 27017 },
+    mongodb: { type: "mongodb", defaultPort: 27017 },
+    sequelize: { type: "sql_orm", defaultPort: null },
+    prisma: { type: "sql_orm", defaultPort: null },
+    "@prisma/client": { type: "sql_orm", defaultPort: null },
+    typeorm: { type: "sql_orm", defaultPort: null },
+    knex: { type: "sql_orm", defaultPort: null },
+    redis: { type: "redis", defaultPort: 6379 },
+    ioredis: { type: "redis", defaultPort: 6379 },
+    psycopg2: { type: "postgresql", defaultPort: 5432 },
+    asyncpg: { type: "postgresql", defaultPort: 5432 },
+    sqlalchemy: { type: "sql_orm", defaultPort: null },
+    pymongo: { type: "mongodb", defaultPort: 27017 },
+};
+const ENV_PATTERNS = [
+    { pattern: /DATABASE_URL/i, type: "sql" },
+    { pattern: /POSTGRES_(?:HOST|URL|URI)/i, type: "postgresql" },
+    { pattern: /MYSQL_(?:HOST|URL|URI)/i, type: "mysql" },
+    { pattern: /MONGO(?:DB)?_(?:HOST|URL|URI)/i, type: "mongodb" },
+    { pattern: /REDIS_(?:HOST|URL|URI)/i, type: "redis" },
+];
+async function detectDataStores(projectPath) {
+    const stores = [];
+    const seen = new Set();
+    // package.json
+    const pkgPath = path.join(projectPath, "package.json");
+    if (fs.existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+            const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+            for (const [dep, meta] of Object.entries(DB_PACKAGES)) {
+                if (allDeps[dep] && !seen.has(meta.type)) {
+                    seen.add(meta.type);
+                    stores.push({ type: meta.type, host: "detected", port: meta.defaultPort, encrypted: null, contains_pii: null, detectedFrom: "package.json" });
+                }
+            }
+        }
+        catch { /* ignore */ }
+    }
+    // requirements.txt
+    const reqPath = path.join(projectPath, "requirements.txt");
+    if (fs.existsSync(reqPath)) {
+        const content = fs.readFileSync(reqPath, "utf8").toLowerCase();
+        for (const [dep, meta] of Object.entries(DB_PACKAGES)) {
+            if (content.includes(dep.toLowerCase()) && !seen.has(meta.type)) {
+                seen.add(meta.type);
+                stores.push({ type: meta.type, host: "detected", port: meta.defaultPort, encrypted: null, contains_pii: null, detectedFrom: "requirements.txt" });
+            }
+        }
+    }
+    // .env files
+    for (const envFile of [".env", ".env.local", ".env.example"]) {
+        const envPath = path.join(projectPath, envFile);
+        if (fs.existsSync(envPath)) {
+            const content = fs.readFileSync(envPath, "utf8");
+            for (const { pattern, type } of ENV_PATTERNS) {
+                if (pattern.test(content) && !seen.has(type)) {
+                    seen.add(type);
+                    stores.push({ type, host: "from_env", port: null, encrypted: null, contains_pii: null, detectedFrom: envFile });
+                }
+            }
+        }
+    }
+    // docker-compose
+    for (const composeFile of ["docker-compose.yml", "docker-compose.yaml", "compose.yml"]) {
+        const composePath = path.join(projectPath, composeFile);
+        if (fs.existsSync(composePath)) {
+            const content = fs.readFileSync(composePath, "utf8");
+            const check = (re, type, port, pii) => {
+                if (re.test(content) && !seen.has(type)) {
+                    seen.add(type);
+                    stores.push({ type, host: "docker", port, encrypted: false, contains_pii: pii ? null : false, detectedFrom: composeFile });
+                }
+            };
+            check(/postgres/i, "postgresql", 5432, true);
+            check(/mysql|mariadb/i, "mysql", 3306, true);
+            check(/mongo/i, "mongodb", 27017, true);
+            check(/redis/i, "redis", 6379, false);
+        }
+    }
+    return stores;
+}
+//# sourceMappingURL=dataStoreDetector.js.map

package/build/shield/discovery/dockerScanner.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Docker environment scanner — Phase 2, READ-ONLY Docker daemon inspection.
+ *
+ * Maps a local Docker environment into the SAME normalized {@link RawEnvironment}
+ * shape the macOS scanner produces, so {@link topologyNormalizer.buildInfraPlane}
+ * folds it into the frozen topology envelope through the identical code path.
+ * Docker supplies the INFRA plane only; the ZT plane is still built solely from
+ * the Shield Broker.
+ *
+ * SECURITY MODEL (hard requirements — mirrors environmentScanner.ts):
+ *   - Only the `docker` binary is ever executed, and only with READ-ONLY
+ *     subcommands (version/info/ps/inspect/network ls|inspect/volume ls|inspect/
+ *     stats). No run/stop/rm/exec/build — enforced at type + runtime.
+ *   - Every spawn uses execFile with an ARGUMENT ARRAY — never a shell string,
+ *     never string-interpolation. Container/network/volume ids come from CLI
+ *     output; any id beginning with "-" is rejected and option parsing is
+ *     terminated with `--` so an id can never be read as a flag.
+ *   - Every spawn has a timeout + maxBuffer. A missing binary, a failed
+ *     `docker info` (daemon down), malformed output, or a timeout DEGRADES
+ *     GRACEFULLY: we return whatever we have plus a human-readable note. The
+ *     scan must never throw.
+ */
+import type { RawEnvironment } from "./environmentScanner";
+/**
+ * Inspect the local Docker environment READ-ONLY and return the raw environment
+ * in the SAME shape as {@link scanMacEnvironment}. Never throws: any failure is
+ * captured in `notes` and the corresponding section is returned empty/partial.
+ *
+ * `listeningPorts` is left empty for the Docker provider — published container
+ * ports are already surfaced per-container; host-level TCP LISTEN inspection is
+ * the macOS scanner's concern.
+ */
+export declare function scanDockerEnvironment(): Promise<RawEnvironment>;
+//# sourceMappingURL=dockerScanner.d.ts.map