@defai.digital/ax-cli 3.5.2 → 3.6.0

package/dist/mcp/ssrf-protection.d.ts

@@ -0,0 +1,86 @@
+/**
+ * SSRF Protection for HTTP/SSE Transports (REQ-SEC-011)
+ *
+ * Prevents Server-Side Request Forgery attacks by validating URLs
+ * Blocks:
+ * - Private IP addresses (RFC 1918, loopback, link-local)
+ * - DNS rebinding attacks
+ * - Cloud metadata endpoints
+ * - Dangerous protocols
+ *
+ * Security: CVSS 8.6 (High Priority)
+ */
+/**
+ * URL validation result
+ */
+export interface SSRFValidationResult {
+    valid: boolean;
+    error?: string;
+    category?: SSRFThreatCategory;
+    resolvedIp?: string;
+}
+/**
+ * SSRF threat categories
+ */
+export declare enum SSRFThreatCategory {
+    PRIVATE_IP = "PRIVATE_IP",
+    BLOCKED_HOSTNAME = "BLOCKED_HOSTNAME",
+    INVALID_PROTOCOL = "INVALID_PROTOCOL",
+    INVALID_URL = "INVALID_URL",
+    DNS_REBINDING = "DNS_REBINDING"
+}
+/**
+ * Validate URL against SSRF threats
+ *
+ * @param urlString - URL to validate
+ * @returns Validation result
+ *
+ * @example
+ * ```typescript
+ * const result = validateURL('https://api.example.com');
+ * if (!result.valid) {
+ *   console.error(`SSRF threat detected: ${result.error}`);
+ * }
+ * ```
+ */
+export declare function validateURL(urlString: string): SSRFValidationResult;
+/**
+ * Validate MCP HTTP/SSE transport URL
+ *
+ * @param url - Transport URL
+ * @param transportType - Transport type ('http' or 'sse')
+ * @returns Validation result
+ */
+export declare function validateTransportURL(url: string, transportType: 'http' | 'sse'): SSRFValidationResult;
+/**
+ * Safe URL wrapper for HTTP requests
+ *
+ * @param url - URL to validate and wrap
+ * @returns Validated URL or throws error
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   const safeUrl = safeURL('https://api.example.com');
+ *   await fetch(safeUrl);
+ * } catch (error) {
+ *   console.error('SSRF protection blocked request:', error);
+ * }
+ * ```
+ */
+export declare function safeURL(url: string): string;
+/**
+ * Batch validate multiple URLs
+ *
+ * @param urls - Array of URLs to validate
+ * @returns Array of validation results
+ */
+export declare function validateURLs(urls: string[]): SSRFValidationResult[];
+/**
+ * Get SSRF protection statistics
+ */
+export declare function getSSRFStats(): {
+    blockedHostnames: number;
+    privateIPRanges: number;
+    allowedProtocols: number;
+};

package/dist/mcp/ssrf-protection.js

@@ -0,0 +1,313 @@
+/**
+ * SSRF Protection for HTTP/SSE Transports (REQ-SEC-011)
+ *
+ * Prevents Server-Side Request Forgery attacks by validating URLs
+ * Blocks:
+ * - Private IP addresses (RFC 1918, loopback, link-local)
+ * - DNS rebinding attacks
+ * - Cloud metadata endpoints
+ * - Dangerous protocols
+ *
+ * Security: CVSS 8.6 (High Priority)
+ */
+import { getAuditLogger, AuditCategory } from '../utils/audit-logger.js';
+/**
+ * Private IP ranges (RFC 1918 and special-use addresses)
+ */
+const PRIVATE_IP_RANGES = [
+    // IPv4 Private Ranges
+    { start: '10.0.0.0', end: '10.255.255.255', name: 'RFC1918 Class A' },
+    { start: '172.16.0.0', end: '172.31.255.255', name: 'RFC1918 Class B' },
+    { start: '192.168.0.0', end: '192.168.255.255', name: 'RFC1918 Class C' },
+    // Loopback
+    { start: '127.0.0.0', end: '127.255.255.255', name: 'Loopback' },
+    // Link-local
+    { start: '169.254.0.0', end: '169.254.255.255', name: 'Link-local' },
+    // Multicast
+    { start: '224.0.0.0', end: '239.255.255.255', name: 'Multicast' },
+    // Reserved
+    { start: '240.0.0.0', end: '255.255.255.255', name: 'Reserved' },
+    // Broadcast
+    { start: '255.255.255.255', end: '255.255.255.255', name: 'Broadcast' },
+];
+/**
+ * Blocked hostnames (cloud metadata endpoints, etc.)
+ */
+const BLOCKED_HOSTNAMES = [
+    // AWS metadata
+    '169.254.169.254',
+    'metadata.google.internal',
+    // GCP metadata
+    'metadata.goog',
+    // Azure metadata
+    '169.254.169.254',
+    // Kubernetes metadata
+    'kubernetes.default.svc',
+    // Special addresses
+    'localhost',
+    'localhost.localdomain',
+    '0.0.0.0',
+    '::1',
+    '::',
+    // DNS rebinding targets
+    '0x7f000001', // 127.0.0.1 in hex
+    '2130706433', // 127.0.0.1 in decimal
+];
+/**
+ * Allowed protocols
+ */
+const ALLOWED_PROTOCOLS = ['http:', 'https:'];
+/**
+ * SSRF threat categories
+ */
+export var SSRFThreatCategory;
+(function (SSRFThreatCategory) {
+    SSRFThreatCategory["PRIVATE_IP"] = "PRIVATE_IP";
+    SSRFThreatCategory["BLOCKED_HOSTNAME"] = "BLOCKED_HOSTNAME";
+    SSRFThreatCategory["INVALID_PROTOCOL"] = "INVALID_PROTOCOL";
+    SSRFThreatCategory["INVALID_URL"] = "INVALID_URL";
+    SSRFThreatCategory["DNS_REBINDING"] = "DNS_REBINDING";
+})(SSRFThreatCategory || (SSRFThreatCategory = {}));
+/**
+ * Convert IP address string to number (unsigned 32-bit)
+ */
+function ipToNumber(ip) {
+    const parts = ip.split('.').map(p => parseInt(p, 10));
+    if (parts.length !== 4 || parts.some(p => isNaN(p) || p < 0 || p > 255)) {
+        return -1;
+    }
+    // Use unsigned 32-bit arithmetic (>>> 0 converts to unsigned)
+    return ((parts[0] << 24) + (parts[1] << 16) + (parts[2] << 8) + parts[3]) >>> 0;
+}
+/**
+ * Check if IP is in private range
+ */
+function isPrivateIP(ip) {
+    const ipNum = ipToNumber(ip);
+    if (ipNum === -1) {
+        return { isPrivate: false };
+    }
+    for (const range of PRIVATE_IP_RANGES) {
+        const startNum = ipToNumber(range.start);
+        const endNum = ipToNumber(range.end);
+        if (ipNum >= startNum && ipNum <= endNum) {
+            return { isPrivate: true, range: range.name };
+        }
+    }
+    return { isPrivate: false };
+}
+/**
+ * Check if hostname is blocked
+ */
+function isBlockedHostname(hostname) {
+    const normalized = hostname.toLowerCase().trim();
+    // Check exact matches
+    if (BLOCKED_HOSTNAMES.includes(normalized)) {
+        return true;
+    }
+    // Check for localhost variations
+    if (normalized.startsWith('localhost') ||
+        normalized.endsWith('.localhost') ||
+        normalized === '0.0.0.0' ||
+        normalized === '::1') {
+        return true;
+    }
+    return false;
+}
+/**
+ * Validate URL against SSRF threats
+ *
+ * @param urlString - URL to validate
+ * @returns Validation result
+ *
+ * @example
+ * ```typescript
+ * const result = validateURL('https://api.example.com');
+ * if (!result.valid) {
+ *   console.error(`SSRF threat detected: ${result.error}`);
+ * }
+ * ```
+ */
+export function validateURL(urlString) {
+    const auditLogger = getAuditLogger();
+    // Parse URL
+    let url;
+    try {
+        url = new URL(urlString);
+    }
+    catch (error) {
+        const result = {
+            valid: false,
+            error: 'Invalid URL format',
+            category: SSRFThreatCategory.INVALID_URL,
+        };
+        auditLogger.logWarning({
+            category: AuditCategory.INPUT_VALIDATION,
+            action: 'ssrf_validation_failed',
+            resource: urlString,
+            outcome: 'failure',
+            error: result.error,
+            details: { category: result.category },
+        });
+        return result;
+    }
+    // Validate protocol
+    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
+        const result = {
+            valid: false,
+            error: `Protocol not allowed: ${url.protocol}. Only HTTP(S) allowed.`,
+            category: SSRFThreatCategory.INVALID_PROTOCOL,
+        };
+        auditLogger.logCritical({
+            category: AuditCategory.INPUT_VALIDATION,
+            action: 'ssrf_invalid_protocol',
+            resource: urlString,
+            outcome: 'failure',
+            error: result.error,
+            details: { protocol: url.protocol, category: result.category },
+        });
+        return result;
+    }
+    // Validate hostname
+    const hostname = url.hostname.toLowerCase();
+    // Check for IPv6 addresses (they include brackets in hostname)
+    if (hostname.startsWith('[') && hostname.endsWith(']')) {
+        const result = {
+            valid: false,
+            error: `IPv6 addresses are not allowed: ${hostname}`,
+            category: SSRFThreatCategory.BLOCKED_HOSTNAME,
+        };
+        auditLogger.logCritical({
+            category: AuditCategory.INPUT_VALIDATION,
+            action: 'ssrf_ipv6_blocked',
+            resource: urlString,
+            outcome: 'failure',
+            error: result.error,
+            details: { hostname, category: result.category },
+        });
+        return result;
+    }
+    // Check if hostname is an IPv4 address (to get proper category)
+    const ipMatch = hostname.match(/^(\d{1,3}\.){3}\d{1,3}$/);
+    if (ipMatch) {
+        const privateCheck = isPrivateIP(hostname);
+        if (privateCheck.isPrivate) {
+            const result = {
+                valid: false,
+                error: `Private IP address not allowed: ${hostname} (${privateCheck.range})`,
+                category: SSRFThreatCategory.PRIVATE_IP,
+                resolvedIp: hostname,
+            };
+            auditLogger.logCritical({
+                category: AuditCategory.INPUT_VALIDATION,
+                action: 'ssrf_private_ip',
+                resource: urlString,
+                outcome: 'failure',
+                error: result.error,
+                details: {
+                    ip: hostname,
+                    range: privateCheck.range,
+                    category: result.category,
+                },
+            });
+            return result;
+        }
+    }
+    // Check blocked hostnames (non-IP addresses)
+    if (isBlockedHostname(hostname)) {
+        const result = {
+            valid: false,
+            error: `Blocked hostname: ${hostname}`,
+            category: SSRFThreatCategory.BLOCKED_HOSTNAME,
+        };
+        auditLogger.logCritical({
+            category: AuditCategory.INPUT_VALIDATION,
+            action: 'ssrf_blocked_hostname',
+            resource: urlString,
+            outcome: 'failure',
+            error: result.error,
+            details: { hostname, category: result.category },
+        });
+        return result;
+    }
+    // URL is valid
+    auditLogger.logInfo({
+        category: AuditCategory.INPUT_VALIDATION,
+        action: 'ssrf_validation_passed',
+        resource: urlString,
+        outcome: 'success',
+        details: {
+            hostname,
+            protocol: url.protocol,
+        },
+    });
+    return { valid: true };
+}
+/**
+ * Validate MCP HTTP/SSE transport URL
+ *
+ * @param url - Transport URL
+ * @param transportType - Transport type ('http' or 'sse')
+ * @returns Validation result
+ */
+export function validateTransportURL(url, transportType) {
+    const auditLogger = getAuditLogger();
+    const result = validateURL(url);
+    if (!result.valid) {
+        auditLogger.logCritical({
+            category: AuditCategory.MCP_OPERATION,
+            action: 'mcp_transport_ssrf_blocked',
+            resource: url,
+            outcome: 'failure',
+            error: result.error,
+            details: {
+                transportType,
+                category: result.category,
+            },
+        });
+    }
+    return result;
+}
+/**
+ * Safe URL wrapper for HTTP requests
+ *
+ * @param url - URL to validate and wrap
+ * @returns Validated URL or throws error
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   const safeUrl = safeURL('https://api.example.com');
+ *   await fetch(safeUrl);
+ * } catch (error) {
+ *   console.error('SSRF protection blocked request:', error);
+ * }
+ * ```
+ */
+export function safeURL(url) {
+    const result = validateURL(url);
+    if (!result.valid) {
+        throw new Error(`SSRF protection: ${result.error}`);
+    }
+    return url;
+}
+/**
+ * Batch validate multiple URLs
+ *
+ * @param urls - Array of URLs to validate
+ * @returns Array of validation results
+ */
+export function validateURLs(urls) {
+    return urls.map(url => validateURL(url));
+}
+/**
+ * Get SSRF protection statistics
+ */
+export function getSSRFStats() {
+    return {
+        blockedHostnames: BLOCKED_HOSTNAMES.length,
+        privateIPRanges: PRIVATE_IP_RANGES.length,
+        allowedProtocols: ALLOWED_PROTOCOLS.length,
+    };
+}
+//# sourceMappingURL=ssrf-protection.js.map

package/dist/mcp/ssrf-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-protection.js","sourceRoot":"","sources":["../../src/mcp/ssrf-protection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzE;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACxB,sBAAsB;IACtB,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACrE,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACvE,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAEzE,WAAW;IACX,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE;IAEhE,aAAa;IACb,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE;IAEpE,YAAY;IACZ,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;IAEjE,WAAW;IACX,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE;IAEhE,YAAY;IACZ,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;CAC/D,CAAC;AAEX;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACxB,eAAe;IACf,iBAAiB;IACjB,0BAA0B;IAE1B,eAAe;IACf,eAAe;IAEf,iBAAiB;IACjB,iBAAiB;IAEjB,sBAAsB;IACtB,wBAAwB;IAExB,oBAAoB;IACpB,WAAW;IACX,uBAAuB;IACvB,SAAS;IACT,KAAK;IACL,IAAI;IAEJ,wBAAwB;IACxB,YAAY,EAAE,mBAAmB;IACjC,YAAY,EAAE,uBAAuB;CAC7B,CAAC;AAEX;;GAEG;AACH,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAU,CAAC;AAYvD;;GAEG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,2DAAqC,CAAA;IACrC,2DAAqC,CAAA;IACrC,iDAA2B,CAAA;IAC3B,qDAA+B,CAAA;AACjC,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,EAAU;IAC5B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,8DAA8D;IAC9D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACzC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEjD,sBAAsB;IACtB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,UAAiB,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iCAAiC;IACjC,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC;QAClC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,KAAK,SAAS;QACxB,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IAErC,YAAY;IACZ,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAyB;YACnC,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,oBAAoB;YAC3B,QAAQ,EAAE,kBAAkB,CAAC,WAAW;SACzC,CAAC;QAEF,WAAW,CAAC,UAAU,CAAC;YACrB,QAAQ,EAAE,aAAa,CAAC,gBAAgB;YACxC,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;SACvC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAe,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAyB;YACnC,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,yBAAyB,GAAG,CAAC,QAAQ,yBAAyB;YACrE,QAAQ,EAAE,kBAAkB,CAAC,gBAAgB;SAC9C,CAAC;QAEF,WAAW,CAAC,WAAW,CAAC;YACtB,QAAQ,EAAE,aAAa,CAAC,gBAAgB;YACxC,MAAM,EAAE,uBAAuB;YAC/B,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;SAC/D,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE5C,+DAA+D;IAC/D,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAyB;YACnC,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,mCAAmC,QAAQ,EAAE;YACpD,QAAQ,EAAE,kBAAkB,CAAC,gBAAgB;SAC9C,CAAC;QAEF,WAAW,CAAC,WAAW,CAAC;YACtB,QAAQ,EAAE,aAAa,CAAC,gBAAgB;YACxC,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;SACjD,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gEAAgE;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC1D,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAyB;gBACnC,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,mCAAmC,QAAQ,KAAK,YAAY,CAAC,KAAK,GAAG;gBAC5E,QAAQ,EAAE,kBAAkB,CAAC,UAAU;gBACvC,UAAU,EAAE,QAAQ;aACrB,CAAC;YAEF,WAAW,CAAC,WAAW,CAAC;gBACtB,QAAQ,EAAE,aAAa,CAAC,gBAAgB;gBACxC,MAAM,EAAE,iBAAiB;gBACzB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,SAAS;gBAClB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE;oBACP,EAAE,EAAE,QAAQ;oBACZ,KAAK,EAAE,YAAY,CAAC,KAAK;oBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B;aACF,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAyB;YACnC,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,qBAAqB,QAAQ,EAAE;YACtC,QAAQ,EAAE,kBAAkB,CAAC,gBAAgB;SAC9C,CAAC;QAEF,WAAW,CAAC,WAAW,CAAC;YACtB,QAAQ,EAAE,aAAa,CAAC,gBAAgB;YACxC,MAAM,EAAE,uBAAuB;YAC/B,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;SACjD,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,eAAe;IACf,WAAW,CAAC,OAAO,CAAC;QAClB,QAAQ,EAAE,aAAa,CAAC,gBAAgB;QACxC,MAAM,EAAE,wBAAwB;QAChC,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE;YACP,QAAQ;YACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,aAA6B;IAE7B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IAErC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,WAAW,CAAC,WAAW,CAAC;YACtB,QAAQ,EAAE,aAAa,CAAC,aAAa;YACrC,MAAM,EAAE,4BAA4B;YACpC,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE;gBACP,aAAa;gBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAK1B,OAAO;QACL,gBAAgB,EAAE,iBAAiB,CAAC,MAAM;QAC1C,eAAe,EAAE,iBAAiB,CAAC,MAAM;QACzC,gBAAgB,EAAE,iBAAiB,CAAC,MAAM;KAC3C,CAAC;AACJ,CAAC"}

package/dist/mcp/validation.d.ts

@@ -23,3 +23,7 @@ export declare function validateServerConfig(config: MCPServerConfig): Promise<V
  * Format validation result for display
  */
 export declare function formatValidationResult(result: ValidationResult): string;
+/**
+ * Get the list of safe MCP commands (for documentation/testing)
+ */
+export declare function getSafeMCPCommands(): readonly string[];

package/dist/mcp/validation.js

@@ -4,10 +4,38 @@
  * Provides pre-flight checks to validate MCP server configurations
  * before attempting connection, improving error messages and UX.
  */
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { getTemplate } from './templates.js';
-const execAsync = promisify(exec);
+import { getAuditLogger, AuditCategory } from '../utils/audit-logger.js';
+const execFileAsync = promisify(execFile);
+/**
+ * Safe commands whitelist for MCP stdio transport
+ * Only these commands are allowed to prevent command injection
+ */
+const SAFE_MCP_COMMANDS = [
+    // Node.js package managers
+    'node',
+    'npm',
+    'npx',
+    'bun',
+    'deno',
+    'pnpm',
+    'yarn',
+    // Python
+    'python',
+    'python3',
+    'pip',
+    'pip3',
+    'uvx',
+    // Docker
+    'docker',
+    // Common shell commands (for legitimate MCP servers)
+    'bash',
+    'sh',
+    'zsh',
+    // Full paths allowed (validated separately)
+];
 /**
  * Validate an MCP server configuration with pre-flight checks
  */
@@ -47,6 +75,59 @@ export async function validateServerConfig(config) {
         errors
     };
 }
+/**
+ * Validate command against whitelist
+ * Prevents command injection by only allowing safe commands
+ */
+function validateCommandWhitelist(command) {
+    // Allow full paths (they will be validated separately)
+    if (command.includes('/') || command.includes('\\')) {
+        // Validate path doesn't contain shell metacharacters
+        const dangerousChars = /[;&|`$()<>]/;
+        if (dangerousChars.test(command)) {
+            return {
+                valid: false,
+                error: `Command path contains dangerous characters: ${command}`
+            };
+        }
+        return { valid: true };
+    }
+    // Check against whitelist
+    const baseCommand = command.split(/\s+/)[0]; // Get command name without args
+    if (!SAFE_MCP_COMMANDS.includes(baseCommand)) {
+        return {
+            valid: false,
+            error: `Command "${baseCommand}" is not in the safe commands whitelist. ` +
+                `Allowed: ${SAFE_MCP_COMMANDS.join(', ')}. ` +
+                `Use full path for custom commands.`
+        };
+    }
+    return { valid: true };
+}
+/**
+ * Validate command arguments for injection attempts
+ */
+function validateCommandArgs(args) {
+    const dangerousPatterns = /[;&|`$()<>]/;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        // Check for shell metacharacters
+        if (dangerousPatterns.test(arg)) {
+            return {
+                valid: false,
+                error: `Argument ${i} contains dangerous shell metacharacters: "${arg}"`
+            };
+        }
+        // Check for null bytes
+        if (arg.includes('\0')) {
+            return {
+                valid: false,
+                error: `Argument ${i} contains null byte`
+            };
+        }
+    }
+    return { valid: true };
+}
 /**
  * Validate stdio transport configuration
  */
@@ -59,14 +140,39 @@ async function validateStdioTransport(config, errors, warnings) {
         errors.push('Command is required for stdio transport');
         return;
     }
-    // Check if command is executable
-    const commandExists = await checkCommandExists(command);
-    if (!commandExists) {
-        errors.push(`Command "${command}" not found in PATH. Please install it or provide full path.`);
+    // SECURITY: Validate command against whitelist (REQ-SEC-004)
+    const whitelistResult = validateCommandWhitelist(command);
+    if (!whitelistResult.valid) {
+        // REQ-SEC-008: Audit log command injection attempt
+        const auditLogger = getAuditLogger();
+        auditLogger.logCritical({
+            category: AuditCategory.COMMAND_EXECUTION,
+            action: 'mcp_command_injection_attempt',
+            resource: config.name,
+            outcome: 'failure',
+            error: whitelistResult.error,
+            details: { command, configName: config.name },
+        });
+        errors.push(whitelistResult.error);
+        return; // Don't continue if command is not allowed
     }
     // Validate args
     if (args && !Array.isArray(args)) {
         errors.push('Arguments must be an array');
+        return;
+    }
+    // SECURITY: Validate arguments for injection attempts (REQ-SEC-004)
+    if (args && args.length > 0) {
+        const argsResult = validateCommandArgs(args);
+        if (!argsResult.valid) {
+            errors.push(argsResult.error);
+            return;
+        }
+    }
+    // Check if command is executable (after whitelist check)
+    const commandExists = await checkCommandExists(command);
+    if (!commandExists) {
+        warnings.push(`Command "${command}" not found in PATH. Please install it or provide full path.`);
     }
     // Check for common npm package patterns
     if (command === 'npx' && args && args.length > 0) {
@@ -147,6 +253,7 @@ function validateRequiredEnvVars(config, errors, _warnings) {
 }
 /**
  * Check if a command exists in PATH
+ * Uses execFile to prevent command injection vulnerabilities
  */
 async function checkCommandExists(command) {
     try {
@@ -154,11 +261,9 @@ async function checkCommandExists(command) {
         if (command.includes('/') || command.includes('\\')) {
             return true; // Assume full paths are valid
         }
-        // Check if command exists in PATH
-        const checkCommand = process.platform === 'win32'
-            ? `where ${command}`
-            : `which ${command}`;
-        await execAsync(checkCommand);
+        // Check if command exists in PATH using execFile (prevents command injection)
+        const checkCommand = process.platform === 'win32' ? 'where' : 'which';
+        await execFileAsync(checkCommand, [command]);
         return true;
     }
     catch {
@@ -212,4 +317,10 @@ export function formatValidationResult(result) {
     }
     return lines.join('\n');
 }
+/**
+ * Get the list of safe MCP commands (for documentation/testing)
+ */
+export function getSafeMCPCommands() {
+    return SAFE_MCP_COMMANDS;
+}
 //# sourceMappingURL=validation.js.map

package/dist/mcp/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/mcp/validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAclC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAuB;IAChE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,6CAA6C;IAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,mCAAmC;IACnC,QAAQ,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC9B,KAAK,OAAO;YACV,MAAM,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK;YACR,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtD,MAAM;QACR,KAAK,iBAAiB;YACpB,MAAM,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChE,MAAM;IACV,CAAC;IAED,2DAA2D;IAC3D,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAElD,0BAA0B;IAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,IAAI,qFAAqF,CAAC,CAAC;IAClI,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAuB,EACvB,MAAgB,EAChB,QAAkB;IAElB,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO;IAEnE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAE3C,0BAA0B;IAC1B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,YAAY,OAAO,8DAA8D,CAAC,CAAC;IACjG,CAAC;IAED,gBAAgB;IAChB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IAED,wCAAwC;IACxC,IAAI,OAAO,KAAK,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,WAAW,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACrD,iDAAiD;YACjD,QAAQ,CAAC,IAAI,CAAC,WAAW,WAAW,kCAAkC,WAAW,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAClC,MAAuB,EACvB,MAAgB,EAChB,QAAkB;IAElB,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO;IAEvG,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAEjC,sBAAsB;IACtB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,sBAAsB;IACtB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/B,iBAAiB;QACjB,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,qBAAqB,SAAS,CAAC,QAAQ,6BAA6B,CAAC,CAAC;QACpF,CAAC;QAED,8BAA8B;QAC9B,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7H,QAAQ,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;QAC7G,CAAC;QAED,4CAA4C;QAC5C,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,oBAAoB,GAAG,uDAAuD,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,+BAA+B,CAC5C,MAAuB,EACvB,MAAgB,EAChB,SAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO;IAE7E,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAEjC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAC9B,MAAuB,EACvB,MAAgB,EAChB,SAAmB;IAEnB,sCAAsC;IACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW;QAAE,OAAO;IAE/C,2CAA2C;IAC3C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;QACjF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;QAEhD,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,oBAAoB;QACpB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,CAAC,8BAA8B;QAC7C,CAAC;QAED,kCAAkC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC/C,CAAC,CAAC,SAAS,OAAO,EAAE;YACpB,CAAC,CAAC,SAAS,OAAO,EAAE,CAAC;QAEvB,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,gCAAgC;QAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,mBAAmB;QAE/E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,iCAAiC;QAClF,CAAC;gBAAS,CAAC;YACT,oEAAoE;YACpE,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC7E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAChC,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/mcp/validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAc1C;;;GAGG;AACH,MAAM,iBAAiB,GAAG;IACxB,2BAA2B;IAC3B,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,SAAS;IACT,KAAK;IACL,MAAM;IACN,KAAK;IACL,SAAS;IACT,QAAQ;IACR,qDAAqD;IACrD,MAAM;IACN,IAAI;IACJ,KAAK;IACL,4CAA4C;CACpC,CAAC;AAIX;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAuB;IAChE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,6CAA6C;IAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,mCAAmC;IACnC,QAAQ,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC9B,KAAK,OAAO;YACV,MAAM,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK;YACR,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtD,MAAM;QACR,KAAK,iBAAiB;YACpB,MAAM,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChE,MAAM;IACV,CAAC;IAED,2DAA2D;IAC3D,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAElD,0BAA0B;IAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,IAAI,qFAAqF,CAAC,CAAC;IAClI,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,uDAAuD;IACvD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,qDAAqD;QACrD,MAAM,cAAc,GAAG,aAAa,CAAC;QACrC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,+CAA+C,OAAO,EAAE;aAChE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gCAAgC;IAC7E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAA6B,CAAC,EAAE,CAAC;QAC/D,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,YAAY,WAAW,2CAA2C;gBAClE,YAAY,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC5C,oCAAoC;SAC5C,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAAc;IACzC,MAAM,iBAAiB,GAAG,aAAa,CAAC;IAExC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEpB,iCAAiC;QACjC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,YAAY,CAAC,8CAA8C,GAAG,GAAG;aACzE,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,YAAY,CAAC,qBAAqB;aAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAuB,EACvB,MAAgB,EAChB,QAAkB;IAElB,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO;IAEnE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAE3C,0BAA0B;IAC1B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,6DAA6D;IAC7D,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC3B,mDAAmD;QACnD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,WAAW,CAAC,WAAW,CAAC;YACtB,QAAQ,EAAE,aAAa,CAAC,iBAAiB;YACzC,MAAM,EAAE,+BAA+B;YACvC,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,eAAe,CAAC,KAAK;YAC5B,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE;SAC9C,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAM,CAAC,CAAC;QACpC,OAAO,CAAC,2CAA2C;IACrD,CAAC;IAED,gBAAgB;IAChB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IAED,oEAAoE;IACpE,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAM,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,YAAY,OAAO,8DAA8D,CAAC,CAAC;IACnG,CAAC;IAED,wCAAwC;IACxC,IAAI,OAAO,KAAK,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,WAAW,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACrD,iDAAiD;YACjD,QAAQ,CAAC,IAAI,CAAC,WAAW,WAAW,kCAAkC,WAAW,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAClC,MAAuB,EACvB,MAAgB,EAChB,QAAkB;IAElB,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO;IAEvG,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAEjC,sBAAsB;IACtB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,sBAAsB;IACtB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/B,iBAAiB;QACjB,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,qBAAqB,SAAS,CAAC,QAAQ,6BAA6B,CAAC,CAAC;QACpF,CAAC;QAED,8BAA8B;QAC9B,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7H,QAAQ,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;QAC7G,CAAC;QAED,4CAA4C;QAC5C,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,oBAAoB,GAAG,uDAAuD,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,+BAA+B,CAC5C,MAAuB,EACvB,MAAgB,EAChB,SAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO;IAE7E,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAEjC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAC9B,MAAuB,EACvB,MAAgB,EAChB,SAAmB;IAEnB,sCAAsC;IACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW;QAAE,OAAO;IAE/C,2CAA2C;IAC3C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;QACjF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;QAEhD,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,oBAAoB;QACpB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,CAAC,8BAA8B;QAC7C,CAAC;QAED,8EAA8E;QAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAEtE,MAAM,aAAa,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,gCAAgC;QAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,mBAAmB;QAE/E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,iCAAiC;QAClF,CAAC;gBAAS,CAAC;YACT,oEAAoE;YACpE,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC7E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAChC,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,iBAAiB,CAAC;AAC3B,CAAC"}