@greenarmor/ges-mcp-server 0.1.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +147 -0
- package/bundle/server.js +1361 -0
- package/dist/server.js +1 -1
- package/package.json +54 -16
- package/LICENSE +0 -21
- package/src/index.ts +0 -2
- package/src/server.ts +0 -257
- package/tsconfig.json +0 -12
- package/tsconfig.tsbuildinfo +0 -1
package/bundle/server.js
ADDED
|
@@ -0,0 +1,1361 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
|
|
3
|
+
// src/server.ts
|
|
4
|
+
import * as readline from "node:readline";
|
|
5
|
+
|
|
6
|
+
// ../compliance-engine/dist/article-5.js
|
|
7
|
+
function createArticle5Controls() {
|
|
8
|
+
return [
|
|
9
|
+
{
|
|
10
|
+
id: "GDPR-ART5-001",
|
|
11
|
+
name: "Lawfulness, Fairness, and Transparency",
|
|
12
|
+
description: "Personal data must be processed lawfully, fairly, and in a transparent manner.",
|
|
13
|
+
category: "data-processing",
|
|
14
|
+
framework: "GDPR",
|
|
15
|
+
article: "Article 5(1)(a)",
|
|
16
|
+
status: "not-implemented",
|
|
17
|
+
severity: "critical",
|
|
18
|
+
implementation_guidance: "Implement a consent management system. Maintain a record of legal bases for each processing activity. Provide clear privacy notices.",
|
|
19
|
+
checks: [
|
|
20
|
+
{ id: "GDPR-ART5-001-C1", description: "Legal basis documented for each processing activity", status: "not-implemented" },
|
|
21
|
+
{ id: "GDPR-ART5-001-C2", description: "Privacy notice is clear and accessible", status: "not-implemented" },
|
|
22
|
+
{ id: "GDPR-ART5-001-C3", description: "Consent mechanism implemented where required", status: "not-implemented" }
|
|
23
|
+
]
|
|
24
|
+
},
|
|
25
|
+
{
|
|
26
|
+
id: "GDPR-ART5-002",
|
|
27
|
+
name: "Purpose Limitation",
|
|
28
|
+
description: "Personal data must be collected for specified, explicit, and legitimate purposes.",
|
|
29
|
+
category: "data-processing",
|
|
30
|
+
framework: "GDPR",
|
|
31
|
+
article: "Article 5(1)(b)",
|
|
32
|
+
status: "not-implemented",
|
|
33
|
+
severity: "critical",
|
|
34
|
+
implementation_guidance: "Document all purposes of data processing. Implement controls to prevent processing beyond declared purposes.",
|
|
35
|
+
checks: [
|
|
36
|
+
{ id: "GDPR-ART5-002-C1", description: "Purpose of each data collection documented", status: "not-implemented" },
|
|
37
|
+
{ id: "GDPR-ART5-002-C2", description: "Technical controls prevent unauthorized purpose deviation", status: "not-implemented" }
|
|
38
|
+
]
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
id: "GDPR-ART5-003",
|
|
42
|
+
name: "Data Minimisation",
|
|
43
|
+
description: "Personal data must be adequate, relevant, and limited to what is necessary.",
|
|
44
|
+
category: "data-processing",
|
|
45
|
+
framework: "GDPR",
|
|
46
|
+
article: "Article 5(1)(c)",
|
|
47
|
+
status: "not-implemented",
|
|
48
|
+
severity: "high",
|
|
49
|
+
implementation_guidance: "Review data collection forms and APIs to ensure only necessary data is collected. Remove unused data fields.",
|
|
50
|
+
checks: [
|
|
51
|
+
{ id: "GDPR-ART5-003-C1", description: "Data collection reviewed for minimisation", status: "not-implemented" },
|
|
52
|
+
{ id: "GDPR-ART5-003-C2", description: "No unnecessary data fields in forms and APIs", status: "not-implemented" }
|
|
53
|
+
]
|
|
54
|
+
},
|
|
55
|
+
{
|
|
56
|
+
id: "GDPR-ART5-004",
|
|
57
|
+
name: "Accuracy",
|
|
58
|
+
description: "Personal data must be accurate and, where necessary, kept up to date.",
|
|
59
|
+
category: "data-quality",
|
|
60
|
+
framework: "GDPR",
|
|
61
|
+
article: "Article 5(1)(d)",
|
|
62
|
+
status: "not-implemented",
|
|
63
|
+
severity: "high",
|
|
64
|
+
implementation_guidance: "Implement data validation on input. Provide user self-service for data updates. Schedule periodic data accuracy reviews.",
|
|
65
|
+
checks: [
|
|
66
|
+
{ id: "GDPR-ART5-004-C1", description: "Input validation implemented for personal data", status: "not-implemented" },
|
|
67
|
+
{ id: "GDPR-ART5-004-C2", description: "Users can update their own data", status: "not-implemented" }
|
|
68
|
+
]
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
id: "GDPR-ART5-005",
|
|
72
|
+
name: "Storage Limitation",
|
|
73
|
+
description: "Personal data must be kept in identifiable form no longer than necessary.",
|
|
74
|
+
category: "data-retention",
|
|
75
|
+
framework: "GDPR",
|
|
76
|
+
article: "Article 5(1)(e)",
|
|
77
|
+
status: "not-implemented",
|
|
78
|
+
severity: "critical",
|
|
79
|
+
implementation_guidance: "Define retention periods per data category. Implement automated deletion or anonymisation. Document retention policies.",
|
|
80
|
+
checks: [
|
|
81
|
+
{ id: "GDPR-ART5-005-C1", description: "Retention periods defined per data category", status: "not-implemented" },
|
|
82
|
+
{ id: "GDPR-ART5-005-C2", description: "Automated deletion or anonymisation implemented", status: "not-implemented" },
|
|
83
|
+
{ id: "GDPR-ART5-005-C3", description: "Retention policy documented", status: "not-implemented" }
|
|
84
|
+
]
|
|
85
|
+
},
|
|
86
|
+
{
|
|
87
|
+
id: "GDPR-ART5-006",
|
|
88
|
+
name: "Integrity and Confidentiality",
|
|
89
|
+
description: "Personal data must be processed with appropriate security measures.",
|
|
90
|
+
category: "security",
|
|
91
|
+
framework: "GDPR",
|
|
92
|
+
article: "Article 5(1)(f)",
|
|
93
|
+
status: "not-implemented",
|
|
94
|
+
severity: "critical",
|
|
95
|
+
implementation_guidance: "Implement encryption at rest and in transit. Use access controls. Ensure data integrity checks.",
|
|
96
|
+
checks: [
|
|
97
|
+
{ id: "GDPR-ART5-006-C1", description: "Encryption at rest configured", status: "not-implemented" },
|
|
98
|
+
{ id: "GDPR-ART5-006-C2", description: "Encryption in transit enforced (TLS 1.2+)", status: "not-implemented" },
|
|
99
|
+
{ id: "GDPR-ART5-006-C3", description: "Access controls implemented", status: "not-implemented" }
|
|
100
|
+
]
|
|
101
|
+
}
|
|
102
|
+
];
|
|
103
|
+
}
|
|
104
|
+
|
|
105
|
+
// ../compliance-engine/dist/article-25.js
|
|
106
|
+
function createArticle25Controls() {
|
|
107
|
+
return [
|
|
108
|
+
{
|
|
109
|
+
id: "GDPR-ART25-001",
|
|
110
|
+
name: "Data Protection by Design",
|
|
111
|
+
description: "Implement appropriate technical and organisational measures to integrate data protection principles into processing.",
|
|
112
|
+
category: "privacy-by-design",
|
|
113
|
+
framework: "GDPR",
|
|
114
|
+
article: "Article 25(1)",
|
|
115
|
+
status: "not-implemented",
|
|
116
|
+
severity: "critical",
|
|
117
|
+
implementation_guidance: "Conduct privacy impact assessments during design phase. Implement pseudonymisation by default. Minimise data processing in all components.",
|
|
118
|
+
checks: [
|
|
119
|
+
{ id: "GDPR-ART25-001-C1", description: "Privacy impact assessment conducted", status: "not-implemented" },
|
|
120
|
+
{ id: "GDPR-ART25-001-C2", description: "Pseudonymisation implemented where applicable", status: "not-implemented" },
|
|
121
|
+
{ id: "GDPR-ART25-001-C3", description: "Data protection integrated into development lifecycle", status: "not-implemented" }
|
|
122
|
+
]
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
id: "GDPR-ART25-002",
|
|
126
|
+
name: "Data Protection by Default",
|
|
127
|
+
description: "Only personal data necessary for each specific purpose is processed by default.",
|
|
128
|
+
category: "privacy-by-design",
|
|
129
|
+
framework: "GDPR",
|
|
130
|
+
article: "Article 25(2)",
|
|
131
|
+
status: "not-implemented",
|
|
132
|
+
severity: "critical",
|
|
133
|
+
implementation_guidance: "Configure default settings to process minimal data. Require explicit opt-in for additional data processing. Implement granular consent controls.",
|
|
134
|
+
checks: [
|
|
135
|
+
{ id: "GDPR-ART25-002-C1", description: "Default settings minimise data processing", status: "not-implemented" },
|
|
136
|
+
{ id: "GDPR-ART25-002-C2", description: "Explicit opt-in required for additional processing", status: "not-implemented" }
|
|
137
|
+
]
|
|
138
|
+
}
|
|
139
|
+
];
|
|
140
|
+
}
|
|
141
|
+
|
|
142
|
+
// ../compliance-engine/dist/article-30.js
|
|
143
|
+
function createArticle30Controls() {
|
|
144
|
+
return [
|
|
145
|
+
{
|
|
146
|
+
id: "GDPR-ART30-001",
|
|
147
|
+
name: "Record of Processing Activities",
|
|
148
|
+
description: "Maintain a record of processing activities under the controller's responsibility.",
|
|
149
|
+
category: "documentation",
|
|
150
|
+
framework: "GDPR",
|
|
151
|
+
article: "Article 30(1)",
|
|
152
|
+
status: "not-implemented",
|
|
153
|
+
severity: "high",
|
|
154
|
+
implementation_guidance: "Create and maintain a processing activities register. Include: purposes, data categories, recipients, retention periods, and security measures.",
|
|
155
|
+
checks: [
|
|
156
|
+
{ id: "GDPR-ART30-001-C1", description: "Processing activities register created", status: "not-implemented" },
|
|
157
|
+
{ id: "GDPR-ART30-001-C2", description: "All required fields documented per Article 30", status: "not-implemented" },
|
|
158
|
+
{ id: "GDPR-ART30-001-C3", description: "Register kept up to date", status: "not-implemented" }
|
|
159
|
+
]
|
|
160
|
+
},
|
|
161
|
+
{
|
|
162
|
+
id: "GDPR-ART30-002",
|
|
163
|
+
name: "Processor Records",
|
|
164
|
+
description: "Processors must maintain records of all categories of processing carried out on behalf of controllers.",
|
|
165
|
+
category: "documentation",
|
|
166
|
+
framework: "GDPR",
|
|
167
|
+
article: "Article 30(2)",
|
|
168
|
+
status: "not-implemented",
|
|
169
|
+
severity: "high",
|
|
170
|
+
implementation_guidance: "If acting as a processor, maintain records of all processing categories. Include controller details, processing purposes, and data transfers.",
|
|
171
|
+
checks: [
|
|
172
|
+
{ id: "GDPR-ART30-002-C1", description: "Processor processing records maintained", status: "not-implemented" },
|
|
173
|
+
{ id: "GDPR-ART30-002-C2", description: "Data transfer documentation complete", status: "not-implemented" }
|
|
174
|
+
]
|
|
175
|
+
}
|
|
176
|
+
];
|
|
177
|
+
}
|
|
178
|
+
|
|
179
|
+
// ../compliance-engine/dist/article-32.js
|
|
180
|
+
function createArticle32Controls() {
|
|
181
|
+
return [
|
|
182
|
+
{
|
|
183
|
+
id: "GDPR-ART32-001",
|
|
184
|
+
name: "Pseudonymisation",
|
|
185
|
+
description: "Implement pseudonymisation as a technical measure to protect personal data.",
|
|
186
|
+
category: "data-protection",
|
|
187
|
+
framework: "GDPR",
|
|
188
|
+
article: "Article 32(1)(a)",
|
|
189
|
+
status: "not-implemented",
|
|
190
|
+
severity: "critical",
|
|
191
|
+
implementation_guidance: "Replace identifying fields with pseudonymous identifiers. Maintain a separate, secured mapping table. Use tokenisation where applicable.",
|
|
192
|
+
checks: [
|
|
193
|
+
{ id: "GDPR-ART32-001-C1", description: "Pseudonymisation strategy defined", status: "not-implemented" },
|
|
194
|
+
{ id: "GDPR-ART32-001-C2", description: "Technical implementation of pseudonymisation in place", status: "not-implemented" },
|
|
195
|
+
{ id: "GDPR-ART32-001-C3", description: "Mapping table secured with access controls", status: "not-implemented" }
|
|
196
|
+
]
|
|
197
|
+
},
|
|
198
|
+
{
|
|
199
|
+
id: "GDPR-ART32-002",
|
|
200
|
+
name: "Encryption at Rest",
|
|
201
|
+
description: "Implement encryption of personal data at rest using approved algorithms.",
|
|
202
|
+
category: "encryption",
|
|
203
|
+
framework: "GDPR",
|
|
204
|
+
article: "Article 32(1)(a)",
|
|
205
|
+
status: "not-implemented",
|
|
206
|
+
severity: "critical",
|
|
207
|
+
implementation_guidance: "Use AES-256-GCM or ChaCha20-Poly1305 for data at rest. Encrypt databases, file storage, and backups. Manage keys via vault or KMS.",
|
|
208
|
+
checks: [
|
|
209
|
+
{ id: "GDPR-ART32-002-C1", description: "Database encryption enabled", status: "not-implemented" },
|
|
210
|
+
{ id: "GDPR-ART32-002-C2", description: "File storage encryption enabled", status: "not-implemented" },
|
|
211
|
+
{ id: "GDPR-ART32-002-C3", description: "Backup encryption enabled", status: "not-implemented" },
|
|
212
|
+
{ id: "GDPR-ART32-002-C4", description: "Key management via approved system (Vault/KMS)", status: "not-implemented" }
|
|
213
|
+
]
|
|
214
|
+
},
|
|
215
|
+
{
|
|
216
|
+
id: "GDPR-ART32-003",
|
|
217
|
+
name: "Encryption in Transit",
|
|
218
|
+
description: "Ensure all personal data transmitted is encrypted using TLS 1.2 minimum.",
|
|
219
|
+
category: "encryption",
|
|
220
|
+
framework: "GDPR",
|
|
221
|
+
article: "Article 32(1)(a)",
|
|
222
|
+
status: "not-implemented",
|
|
223
|
+
severity: "critical",
|
|
224
|
+
implementation_guidance: "Enforce TLS 1.2 minimum, prefer TLS 1.3. Configure HSTS. Disable older protocols. Use strong cipher suites.",
|
|
225
|
+
checks: [
|
|
226
|
+
{ id: "GDPR-ART32-003-C1", description: "TLS 1.2 minimum enforced on all endpoints", status: "not-implemented" },
|
|
227
|
+
{ id: "GDPR-ART32-003-C2", description: "HSTS headers configured", status: "not-implemented" },
|
|
228
|
+
{ id: "GDPR-ART32-003-C3", description: "Strong cipher suites only", status: "not-implemented" }
|
|
229
|
+
]
|
|
230
|
+
},
|
|
231
|
+
{
|
|
232
|
+
id: "GDPR-ART32-004",
|
|
233
|
+
name: "Unique User Identification",
|
|
234
|
+
description: "Ensure unique identification of each user through secure authentication.",
|
|
235
|
+
category: "authentication",
|
|
236
|
+
framework: "GDPR",
|
|
237
|
+
article: "Article 32(1)(b)",
|
|
238
|
+
status: "not-implemented",
|
|
239
|
+
severity: "critical",
|
|
240
|
+
implementation_guidance: "Implement unique user IDs. Use Argon2id for password hashing. Support MFA and passkeys.",
|
|
241
|
+
checks: [
|
|
242
|
+
{ id: "GDPR-ART32-004-C1", description: "Unique user identification implemented", status: "not-implemented" },
|
|
243
|
+
{ id: "GDPR-ART32-004-C2", description: "Secure password hashing (Argon2id)", status: "not-implemented" },
|
|
244
|
+
{ id: "GDPR-ART32-004-C3", description: "MFA support implemented", status: "not-implemented" }
|
|
245
|
+
]
|
|
246
|
+
},
|
|
247
|
+
{
|
|
248
|
+
id: "GDPR-ART32-005",
|
|
249
|
+
name: "Automatic Session Timeout",
|
|
250
|
+
description: "Implement automatic session expiration after period of inactivity.",
|
|
251
|
+
category: "authentication",
|
|
252
|
+
framework: "GDPR",
|
|
253
|
+
article: "Article 32(1)(b)",
|
|
254
|
+
status: "not-implemented",
|
|
255
|
+
severity: "high",
|
|
256
|
+
implementation_guidance: "Set maximum session duration. Implement idle timeout (15-30 minutes). Require re-authentication for sensitive operations.",
|
|
257
|
+
checks: [
|
|
258
|
+
{ id: "GDPR-ART32-005-C1", description: "Session timeout configured", status: "not-implemented" },
|
|
259
|
+
{ id: "GDPR-ART32-005-C2", description: "Idle timeout implemented", status: "not-implemented" },
|
|
260
|
+
{ id: "GDPR-ART32-005-C3", description: "Re-authentication for sensitive operations", status: "not-implemented" }
|
|
261
|
+
]
|
|
262
|
+
},
|
|
263
|
+
{
|
|
264
|
+
id: "GDPR-ART32-006",
|
|
265
|
+
name: "Audit Logging",
|
|
266
|
+
description: "Maintain comprehensive audit logs of all access and processing activities.",
|
|
267
|
+
category: "audit",
|
|
268
|
+
framework: "GDPR",
|
|
269
|
+
article: "Article 32(1)(b)",
|
|
270
|
+
status: "not-implemented",
|
|
271
|
+
severity: "critical",
|
|
272
|
+
implementation_guidance: "Log all authentication, authorization, data access, exports, and admin actions. Never log passwords, tokens, or sensitive data. Ensure logs are immutable.",
|
|
273
|
+
checks: [
|
|
274
|
+
{ id: "GDPR-ART32-006-C1", description: "Audit logging system implemented", status: "not-implemented" },
|
|
275
|
+
{ id: "GDPR-ART32-006-C2", description: "Logs include required fields (userId, action, resource, timestamp, IP)", status: "not-implemented" },
|
|
276
|
+
{ id: "GDPR-ART32-006-C3", description: "Logs are immutable (append-only)", status: "not-implemented" },
|
|
277
|
+
{ id: "GDPR-ART32-006-C4", description: "Sensitive data is not logged", status: "not-implemented" }
|
|
278
|
+
]
|
|
279
|
+
},
|
|
280
|
+
{
|
|
281
|
+
id: "GDPR-ART32-007",
|
|
282
|
+
name: "Integrity Controls",
|
|
283
|
+
description: "Implement measures to ensure ongoing integrity of personal data.",
|
|
284
|
+
category: "data-integrity",
|
|
285
|
+
framework: "GDPR",
|
|
286
|
+
article: "Article 32(1)(b)",
|
|
287
|
+
status: "not-implemented",
|
|
288
|
+
severity: "high",
|
|
289
|
+
implementation_guidance: "Use checksums or hashes for data integrity verification. Implement input validation. Use database constraints.",
|
|
290
|
+
checks: [
|
|
291
|
+
{ id: "GDPR-ART32-007-C1", description: "Data integrity verification implemented", status: "not-implemented" },
|
|
292
|
+
{ id: "GDPR-ART32-007-C2", description: "Input validation on all data entry points", status: "not-implemented" },
|
|
293
|
+
{ id: "GDPR-ART32-007-C3", description: "Database constraints enforced", status: "not-implemented" }
|
|
294
|
+
]
|
|
295
|
+
},
|
|
296
|
+
{
|
|
297
|
+
id: "GDPR-ART32-008",
|
|
298
|
+
name: "Backup and Recovery",
|
|
299
|
+
description: "Implement regular backup and recovery procedures for personal data.",
|
|
300
|
+
category: "backup",
|
|
301
|
+
framework: "GDPR",
|
|
302
|
+
article: "Article 32(1)(b)",
|
|
303
|
+
status: "not-implemented",
|
|
304
|
+
severity: "critical",
|
|
305
|
+
implementation_guidance: "Perform daily encrypted backups. Test restores weekly. Conduct monthly recovery tests. Document backup procedures.",
|
|
306
|
+
checks: [
|
|
307
|
+
{ id: "GDPR-ART32-008-C1", description: "Daily backup schedule configured", status: "not-implemented" },
|
|
308
|
+
{ id: "GDPR-ART32-008-C2", description: "Backups are encrypted", status: "not-implemented" },
|
|
309
|
+
{ id: "GDPR-ART32-008-C3", description: "Weekly restore tests performed", status: "not-implemented" },
|
|
310
|
+
{ id: "GDPR-ART32-008-C4", description: "Monthly recovery tests documented", status: "not-implemented" }
|
|
311
|
+
]
|
|
312
|
+
},
|
|
313
|
+
{
|
|
314
|
+
id: "GDPR-ART32-009",
|
|
315
|
+
name: "Regular Security Testing",
|
|
316
|
+
description: "Conduct regular testing, assessment, and evaluation of security measures.",
|
|
317
|
+
category: "security-testing",
|
|
318
|
+
framework: "GDPR",
|
|
319
|
+
article: "Article 32(1)(d)",
|
|
320
|
+
status: "not-implemented",
|
|
321
|
+
severity: "critical",
|
|
322
|
+
implementation_guidance: "Run dependency scans (Trivy, Dependabot). Perform secret scanning (Gitleaks). Use SAST (Semgrep). Schedule penetration tests.",
|
|
323
|
+
checks: [
|
|
324
|
+
{ id: "GDPR-ART32-009-C1", description: "Dependency scanning in CI/CD", status: "not-implemented" },
|
|
325
|
+
{ id: "GDPR-ART32-009-C2", description: "Secret scanning in CI/CD", status: "not-implemented" },
|
|
326
|
+
{ id: "GDPR-ART32-009-C3", description: "SAST analysis integrated", status: "not-implemented" },
|
|
327
|
+
{ id: "GDPR-ART32-009-C4", description: "Penetration test schedule defined", status: "not-implemented" }
|
|
328
|
+
]
|
|
329
|
+
}
|
|
330
|
+
];
|
|
331
|
+
}
|
|
332
|
+
|
|
333
|
+
// ../compliance-engine/dist/article-33.js
|
|
334
|
+
function createArticle33Controls() {
|
|
335
|
+
return [
|
|
336
|
+
{
|
|
337
|
+
id: "GDPR-ART33-001",
|
|
338
|
+
name: "Data Breach Notification to Authority",
|
|
339
|
+
description: "Notify the supervisory authority of a personal data breach within 72 hours.",
|
|
340
|
+
category: "incident-response",
|
|
341
|
+
framework: "GDPR",
|
|
342
|
+
article: "Article 33(1)",
|
|
343
|
+
status: "not-implemented",
|
|
344
|
+
severity: "critical",
|
|
345
|
+
implementation_guidance: "Create a breach notification procedure. Define escalation paths. Prepare notification templates. Maintain contact details for supervisory authorities.",
|
|
346
|
+
checks: [
|
|
347
|
+
{ id: "GDPR-ART33-001-C1", description: "Breach notification procedure documented", status: "not-implemented" },
|
|
348
|
+
{ id: "GDPR-ART33-001-C2", description: "72-hour notification timeline achievable", status: "not-implemented" },
|
|
349
|
+
{ id: "GDPR-ART33-001-C3", description: "Supervisory authority contacts maintained", status: "not-implemented" }
|
|
350
|
+
]
|
|
351
|
+
},
|
|
352
|
+
{
|
|
353
|
+
id: "GDPR-ART33-002",
|
|
354
|
+
name: "Breach Documentation",
|
|
355
|
+
description: "Document all data breaches including facts, effects, and remedial actions.",
|
|
356
|
+
category: "incident-response",
|
|
357
|
+
framework: "GDPR",
|
|
358
|
+
article: "Article 33(4)",
|
|
359
|
+
status: "not-implemented",
|
|
360
|
+
severity: "high",
|
|
361
|
+
implementation_guidance: "Maintain a breach register. Record: nature of breach, categories and number of data subjects, likely consequences, and measures taken.",
|
|
362
|
+
checks: [
|
|
363
|
+
{ id: "GDPR-ART33-002-C1", description: "Breach register maintained", status: "not-implemented" },
|
|
364
|
+
{ id: "GDPR-ART33-002-C2", description: "All required breach details documented", status: "not-implemented" }
|
|
365
|
+
]
|
|
366
|
+
}
|
|
367
|
+
];
|
|
368
|
+
}
|
|
369
|
+
|
|
370
|
+
// ../compliance-engine/dist/article-34.js
|
|
371
|
+
function createArticle34Controls() {
|
|
372
|
+
return [
|
|
373
|
+
{
|
|
374
|
+
id: "GDPR-ART34-001",
|
|
375
|
+
name: "Data Breach Communication to Data Subjects",
|
|
376
|
+
description: "Communicate personal data breaches to affected data subjects when likely to result in high risk.",
|
|
377
|
+
category: "incident-response",
|
|
378
|
+
framework: "GDPR",
|
|
379
|
+
article: "Article 34(1)",
|
|
380
|
+
status: "not-implemented",
|
|
381
|
+
severity: "critical",
|
|
382
|
+
implementation_guidance: "Prepare data subject notification templates. Define criteria for high-risk breaches. Establish communication channels.",
|
|
383
|
+
checks: [
|
|
384
|
+
{ id: "GDPR-ART34-001-C1", description: "Data subject notification templates prepared", status: "not-implemented" },
|
|
385
|
+
{ id: "GDPR-ART34-001-C2", description: "High-risk criteria defined", status: "not-implemented" },
|
|
386
|
+
{ id: "GDPR-ART34-001-C3", description: "Communication channels established", status: "not-implemented" }
|
|
387
|
+
]
|
|
388
|
+
}
|
|
389
|
+
];
|
|
390
|
+
}
|
|
391
|
+
|
|
392
|
+
// ../compliance-engine/dist/index.js
|
|
393
|
+
function createGDPRControls() {
|
|
394
|
+
return [
|
|
395
|
+
...createArticle5Controls(),
|
|
396
|
+
...createArticle25Controls(),
|
|
397
|
+
...createArticle30Controls(),
|
|
398
|
+
...createArticle32Controls(),
|
|
399
|
+
...createArticle33Controls(),
|
|
400
|
+
...createArticle34Controls()
|
|
401
|
+
];
|
|
402
|
+
}
|
|
403
|
+
|
|
404
|
+
// ../policy-engine/dist/packs/gdpr.js
|
|
405
|
+
function createGDPRPolicyPack() {
|
|
406
|
+
return {
|
|
407
|
+
id: "gdpr",
|
|
408
|
+
name: "GDPR Compliance Pack",
|
|
409
|
+
description: "General Data Protection Regulation controls covering Articles 5, 25, 30, 32, 33, and 34.",
|
|
410
|
+
version: "1.0.0",
|
|
411
|
+
project_types: [
|
|
412
|
+
"saas",
|
|
413
|
+
"ai-application",
|
|
414
|
+
"mcp-server",
|
|
415
|
+
"blockchain",
|
|
416
|
+
"wallet",
|
|
417
|
+
"government-system",
|
|
418
|
+
"healthcare-system",
|
|
419
|
+
"event-platform",
|
|
420
|
+
"photo-storage-platform",
|
|
421
|
+
"vulnerability-scanner",
|
|
422
|
+
"generic-web-application",
|
|
423
|
+
"api-backend",
|
|
424
|
+
"mobile-application"
|
|
425
|
+
],
|
|
426
|
+
controls: createGDPRControls(),
|
|
427
|
+
frameworks: ["GDPR"]
|
|
428
|
+
};
|
|
429
|
+
}
|
|
430
|
+
|
|
431
|
+
// ../policy-engine/dist/packs/owasp.js
|
|
432
|
+
function createOWASPPolicyPack() {
|
|
433
|
+
const controls = [
|
|
434
|
+
{
|
|
435
|
+
id: "OWASP-ASVS-001",
|
|
436
|
+
name: "Input Validation",
|
|
437
|
+
description: "Verify that all input data is validated, filtered, or sanitized.",
|
|
438
|
+
category: "validation",
|
|
439
|
+
framework: "OWASP",
|
|
440
|
+
status: "not-implemented",
|
|
441
|
+
severity: "critical",
|
|
442
|
+
implementation_guidance: "Validate all inputs on the server side. Use allowlists over denylists. Implement schema validation (Zod, Joi).",
|
|
443
|
+
checks: [
|
|
444
|
+
{ id: "OWASP-ASVS-001-C1", description: "Server-side input validation implemented", status: "not-implemented" },
|
|
445
|
+
{ id: "OWASP-ASVS-001-C2", description: "Schema validation library in use", status: "not-implemented" }
|
|
446
|
+
]
|
|
447
|
+
},
|
|
448
|
+
{
|
|
449
|
+
id: "OWASP-ASVS-002",
|
|
450
|
+
name: "Output Encoding",
|
|
451
|
+
description: "Verify that output encoding prevents XSS and injection attacks.",
|
|
452
|
+
category: "validation",
|
|
453
|
+
framework: "OWASP",
|
|
454
|
+
status: "not-implemented",
|
|
455
|
+
severity: "critical",
|
|
456
|
+
implementation_guidance: "Encode output appropriate to context (HTML, JavaScript, URL, CSS). Use framework-provided escaping.",
|
|
457
|
+
checks: [
|
|
458
|
+
{ id: "OWASP-ASVS-002-C1", description: "Output encoding implemented", status: "not-implemented" },
|
|
459
|
+
{ id: "OWASP-ASVS-002-C2", description: "Content-Security-Policy headers configured", status: "not-implemented" }
|
|
460
|
+
]
|
|
461
|
+
},
|
|
462
|
+
{
|
|
463
|
+
id: "OWASP-ASVS-003",
|
|
464
|
+
name: "Authentication Security",
|
|
465
|
+
description: "Verify that authentication uses strong mechanisms.",
|
|
466
|
+
category: "authentication",
|
|
467
|
+
framework: "OWASP",
|
|
468
|
+
status: "not-implemented",
|
|
469
|
+
severity: "critical",
|
|
470
|
+
implementation_guidance: "Implement MFA. Use Argon2id for hashing. Implement account lockout. Use rate limiting.",
|
|
471
|
+
checks: [
|
|
472
|
+
{ id: "OWASP-ASVS-003-C1", description: "MFA implemented", status: "not-implemented" },
|
|
473
|
+
{ id: "OWASP-ASVS-003-C2", description: "Secure password hashing (Argon2id)", status: "not-implemented" },
|
|
474
|
+
{ id: "OWASP-ASVS-003-C3", description: "Account lockout implemented", status: "not-implemented" },
|
|
475
|
+
{ id: "OWASP-ASVS-003-C4", description: "Rate limiting on authentication endpoints", status: "not-implemented" }
|
|
476
|
+
]
|
|
477
|
+
},
|
|
478
|
+
{
|
|
479
|
+
id: "OWASP-ASVS-004",
|
|
480
|
+
name: "Access Control",
|
|
481
|
+
description: "Verify that access controls enforce least privilege and deny by default.",
|
|
482
|
+
category: "authorization",
|
|
483
|
+
framework: "OWASP",
|
|
484
|
+
status: "not-implemented",
|
|
485
|
+
severity: "critical",
|
|
486
|
+
implementation_guidance: "Implement RBAC. Enforce deny-by-default. Validate authorization on every request.",
|
|
487
|
+
checks: [
|
|
488
|
+
{ id: "OWASP-ASVS-004-C1", description: "RBAC implemented", status: "not-implemented" },
|
|
489
|
+
{ id: "OWASP-ASVS-004-C2", description: "Deny-by-default enforced", status: "not-implemented" },
|
|
490
|
+
{ id: "OWASP-ASVS-004-C3", description: "Authorization checked on every request", status: "not-implemented" }
|
|
491
|
+
]
|
|
492
|
+
},
|
|
493
|
+
{
|
|
494
|
+
id: "OWASP-ASVS-005",
|
|
495
|
+
name: "Secrets Management",
|
|
496
|
+
description: "Verify that secrets are properly managed and never stored in source code.",
|
|
497
|
+
category: "secrets",
|
|
498
|
+
framework: "OWASP",
|
|
499
|
+
status: "not-implemented",
|
|
500
|
+
severity: "critical",
|
|
501
|
+
implementation_guidance: "Use vault or secret management. Never commit secrets. Use environment variables. Rotate secrets regularly.",
|
|
502
|
+
checks: [
|
|
503
|
+
{ id: "OWASP-ASVS-005-C1", description: "No secrets in source code", status: "not-implemented" },
|
|
504
|
+
{ id: "OWASP-ASVS-005-C2", description: "Secret management solution in use", status: "not-implemented" },
|
|
505
|
+
{ id: "OWASP-ASVS-005-C3", description: "Secret rotation policy defined", status: "not-implemented" }
|
|
506
|
+
]
|
|
507
|
+
},
|
|
508
|
+
{
|
|
509
|
+
id: "OWASP-ASVS-006",
|
|
510
|
+
name: "Secure Communications",
|
|
511
|
+
description: "Verify that all communications use TLS 1.2+.",
|
|
512
|
+
category: "encryption",
|
|
513
|
+
framework: "OWASP",
|
|
514
|
+
status: "not-implemented",
|
|
515
|
+
severity: "critical",
|
|
516
|
+
implementation_guidance: "Enforce TLS 1.2 minimum. Configure HSTS. Disable insecure protocols.",
|
|
517
|
+
checks: [
|
|
518
|
+
{ id: "OWASP-ASVS-006-C1", description: "TLS 1.2+ enforced", status: "not-implemented" },
|
|
519
|
+
{ id: "OWASP-ASVS-006-C2", description: "HSTS configured", status: "not-implemented" }
|
|
520
|
+
]
|
|
521
|
+
}
|
|
522
|
+
];
|
|
523
|
+
return {
|
|
524
|
+
id: "owasp",
|
|
525
|
+
name: "OWASP ASVS Policy Pack",
|
|
526
|
+
description: "OWASP Application Security Verification Standard controls.",
|
|
527
|
+
version: "1.0.0",
|
|
528
|
+
project_types: [
|
|
529
|
+
"saas",
|
|
530
|
+
"ai-application",
|
|
531
|
+
"healthcare-system",
|
|
532
|
+
"event-platform",
|
|
533
|
+
"photo-storage-platform",
|
|
534
|
+
"vulnerability-scanner",
|
|
535
|
+
"generic-web-application",
|
|
536
|
+
"api-backend",
|
|
537
|
+
"mobile-application"
|
|
538
|
+
],
|
|
539
|
+
controls,
|
|
540
|
+
frameworks: ["OWASP"]
|
|
541
|
+
};
|
|
542
|
+
}
|
|
543
|
+
|
|
544
|
+
// ../policy-engine/dist/packs/ai.js
|
|
545
|
+
function createAIPolicyPack() {
|
|
546
|
+
const controls = [
|
|
547
|
+
{
|
|
548
|
+
id: "AI-001",
|
|
549
|
+
name: "Prompt Logging",
|
|
550
|
+
description: "Log all AI prompts and interactions for audit purposes.",
|
|
551
|
+
category: "ai-governance",
|
|
552
|
+
framework: "GDPR",
|
|
553
|
+
status: "not-implemented",
|
|
554
|
+
severity: "critical",
|
|
555
|
+
implementation_guidance: "Implement logging of all prompts sent to AI models. Store prompts securely with access controls. Define retention periods.",
|
|
556
|
+
checks: [
|
|
557
|
+
{ id: "AI-001-C1", description: "Prompt logging system implemented", status: "not-implemented" },
|
|
558
|
+
{ id: "AI-001-C2", description: "Logs stored securely", status: "not-implemented" },
|
|
559
|
+
{ id: "AI-001-C3", description: "Retention period defined", status: "not-implemented" }
|
|
560
|
+
]
|
|
561
|
+
},
|
|
562
|
+
{
|
|
563
|
+
id: "AI-002",
|
|
564
|
+
name: "Output Validation",
|
|
565
|
+
description: "Validate AI outputs before presenting to users or taking actions.",
|
|
566
|
+
category: "ai-governance",
|
|
567
|
+
framework: "GDPR",
|
|
568
|
+
status: "not-implemented",
|
|
569
|
+
severity: "critical",
|
|
570
|
+
implementation_guidance: "Implement output filtering and validation. Check for PII leakage. Validate against safety guidelines.",
|
|
571
|
+
checks: [
|
|
572
|
+
{ id: "AI-002-C1", description: "Output validation pipeline implemented", status: "not-implemented" },
|
|
573
|
+
{ id: "AI-002-C2", description: "PII detection on outputs", status: "not-implemented" }
|
|
574
|
+
]
|
|
575
|
+
},
|
|
576
|
+
{
|
|
577
|
+
id: "AI-003",
|
|
578
|
+
name: "PII Detection",
|
|
579
|
+
description: "Detect and protect personal data in AI inputs and outputs.",
|
|
580
|
+
category: "ai-governance",
|
|
581
|
+
framework: "GDPR",
|
|
582
|
+
status: "not-implemented",
|
|
583
|
+
severity: "critical",
|
|
584
|
+
implementation_guidance: "Implement PII detection before sending to external AI providers. Redact or pseudonymise detected PII.",
|
|
585
|
+
checks: [
|
|
586
|
+
{ id: "AI-003-C1", description: "PII detection on inputs", status: "not-implemented" },
|
|
587
|
+
{ id: "AI-003-C2", description: "PII redaction/pseudonymisation implemented", status: "not-implemented" }
|
|
588
|
+
]
|
|
589
|
+
},
|
|
590
|
+
{
|
|
591
|
+
id: "AI-004",
|
|
592
|
+
name: "AI Rate Limiting",
|
|
593
|
+
description: "Implement rate limiting on AI endpoints.",
|
|
594
|
+
category: "ai-governance",
|
|
595
|
+
framework: "GDPR",
|
|
596
|
+
status: "not-implemented",
|
|
597
|
+
severity: "high",
|
|
598
|
+
implementation_guidance: "Implement per-user and per-IP rate limiting on AI endpoints. Define usage quotas.",
|
|
599
|
+
checks: [
|
|
600
|
+
{ id: "AI-004-C1", description: "Rate limiting on AI endpoints", status: "not-implemented" },
|
|
601
|
+
{ id: "AI-004-C2", description: "Usage quotas defined", status: "not-implemented" }
|
|
602
|
+
]
|
|
603
|
+
},
|
|
604
|
+
{
|
|
605
|
+
id: "AI-005",
|
|
606
|
+
name: "Data Classification for AI",
|
|
607
|
+
description: "Classify data before processing through AI systems.",
|
|
608
|
+
category: "ai-governance",
|
|
609
|
+
framework: "GDPR",
|
|
610
|
+
status: "not-implemented",
|
|
611
|
+
severity: "critical",
|
|
612
|
+
implementation_guidance: "Implement data classification checks before AI processing. Restrict restricted/confidential data from external AI providers.",
|
|
613
|
+
checks: [
|
|
614
|
+
{ id: "AI-005-C1", description: "Data classification before AI processing", status: "not-implemented" },
|
|
615
|
+
{ id: "AI-005-C2", description: "Restricted data blocked from external AI", status: "not-implemented" }
|
|
616
|
+
]
|
|
617
|
+
},
|
|
618
|
+
{
|
|
619
|
+
id: "AI-006",
|
|
620
|
+
name: "Prevent Unauthorized Data Transfer to External AI",
|
|
621
|
+
description: "Prevent unauthorized transfer of personal data to external AI providers.",
|
|
622
|
+
category: "ai-governance",
|
|
623
|
+
framework: "GDPR",
|
|
624
|
+
status: "not-implemented",
|
|
625
|
+
severity: "critical",
|
|
626
|
+
implementation_guidance: "Implement data loss prevention for AI API calls. Review and approve AI providers. Document data processing agreements.",
|
|
627
|
+
checks: [
|
|
628
|
+
{ id: "AI-006-C1", description: "DLP controls for AI API calls", status: "not-implemented" },
|
|
629
|
+
{ id: "AI-006-C2", description: "AI providers reviewed and approved", status: "not-implemented" },
|
|
630
|
+
{ id: "AI-006-C3", description: "DPAs with AI providers signed", status: "not-implemented" }
|
|
631
|
+
]
|
|
632
|
+
}
|
|
633
|
+
];
|
|
634
|
+
return {
|
|
635
|
+
id: "ai",
|
|
636
|
+
name: "AI System Policy Pack",
|
|
637
|
+
description: "Controls for LLMs, Agents, MCP, and RAG systems.",
|
|
638
|
+
version: "1.0.0",
|
|
639
|
+
project_types: ["ai-application", "mcp-server"],
|
|
640
|
+
controls,
|
|
641
|
+
frameworks: ["GDPR"]
|
|
642
|
+
};
|
|
643
|
+
}
|
|
644
|
+
|
|
645
|
+
// ../policy-engine/dist/packs/blockchain.js
|
|
646
|
+
function createBlockchainPolicyPack() {
|
|
647
|
+
const controls = [
|
|
648
|
+
{
|
|
649
|
+
id: "BC-001",
|
|
650
|
+
name: "Cryptographic Signatures",
|
|
651
|
+
description: "All on-chain operations must use cryptographic signatures.",
|
|
652
|
+
category: "blockchain",
|
|
653
|
+
framework: "GDPR",
|
|
654
|
+
status: "not-implemented",
|
|
655
|
+
severity: "critical",
|
|
656
|
+
implementation_guidance: "Implement wallet-based transaction signing. Verify signatures before on-chain operations.",
|
|
657
|
+
checks: [
|
|
658
|
+
{ id: "BC-001-C1", description: "Cryptographic signing implemented", status: "not-implemented" },
|
|
659
|
+
{ id: "BC-001-C2", description: "Signature verification on all operations", status: "not-implemented" }
|
|
660
|
+
]
|
|
661
|
+
},
|
|
662
|
+
{
|
|
663
|
+
id: "BC-002",
|
|
664
|
+
name: "Validator Identity Verification",
|
|
665
|
+
description: "Validators must be identity-verified.",
|
|
666
|
+
category: "blockchain",
|
|
667
|
+
framework: "GDPR",
|
|
668
|
+
status: "not-implemented",
|
|
669
|
+
severity: "high",
|
|
670
|
+
implementation_guidance: "Implement KYC for validators. Maintain identity verification records.",
|
|
671
|
+
checks: [
|
|
672
|
+
{ id: "BC-002-C1", description: "Validator identity verification process", status: "not-implemented" }
|
|
673
|
+
]
|
|
674
|
+
},
|
|
675
|
+
{
|
|
676
|
+
id: "BC-003",
|
|
677
|
+
name: "Key Rotation",
|
|
678
|
+
description: "Implement regular key rotation for blockchain operations.",
|
|
679
|
+
category: "blockchain",
|
|
680
|
+
framework: "GDPR",
|
|
681
|
+
status: "not-implemented",
|
|
682
|
+
severity: "critical",
|
|
683
|
+
implementation_guidance: "Define key rotation schedule. Automate rotation where possible. Maintain key history.",
|
|
684
|
+
checks: [
|
|
685
|
+
{ id: "BC-003-C1", description: "Key rotation schedule defined", status: "not-implemented" },
|
|
686
|
+
{ id: "BC-003-C2", description: "Rotation automation implemented", status: "not-implemented" }
|
|
687
|
+
]
|
|
688
|
+
},
|
|
689
|
+
{
|
|
690
|
+
id: "BC-004",
|
|
691
|
+
name: "Encrypted Payload Support",
|
|
692
|
+
description: "Support encrypted payloads for sensitive on-chain data.",
|
|
693
|
+
category: "blockchain",
|
|
694
|
+
framework: "GDPR",
|
|
695
|
+
status: "not-implemented",
|
|
696
|
+
severity: "critical",
|
|
697
|
+
implementation_guidance: "Encrypt sensitive data before storing on-chain. Use hybrid encryption schemes.",
|
|
698
|
+
checks: [
|
|
699
|
+
{ id: "BC-004-C1", description: "Encrypted payload support implemented", status: "not-implemented" },
|
|
700
|
+
{ id: "BC-004-C2", description: "No plaintext personal data on-chain", status: "not-implemented" }
|
|
701
|
+
]
|
|
702
|
+
},
|
|
703
|
+
{
|
|
704
|
+
id: "BC-005",
|
|
705
|
+
name: "Immutable Audit Trails",
|
|
706
|
+
description: "Maintain immutable audit trails for all blockchain operations.",
|
|
707
|
+
category: "blockchain",
|
|
708
|
+
framework: "GDPR",
|
|
709
|
+
status: "not-implemented",
|
|
710
|
+
severity: "critical",
|
|
711
|
+
implementation_guidance: "Use blockchain immutability for audit logs. Store hashes and CIDs. Keep references off-chain.",
|
|
712
|
+
checks: [
|
|
713
|
+
{ id: "BC-005-C1", description: "Audit trail mechanism implemented", status: "not-implemented" },
|
|
714
|
+
{ id: "BC-005-C2", description: "Hashes stored on-chain, data off-chain", status: "not-implemented" }
|
|
715
|
+
]
|
|
716
|
+
},
|
|
717
|
+
{
|
|
718
|
+
id: "BC-006",
|
|
719
|
+
name: "No Plaintext Personal Data On-Chain",
|
|
720
|
+
description: "Never store plaintext personal data on-chain. Store only hashes, CIDs, references, and encrypted metadata.",
|
|
721
|
+
category: "blockchain",
|
|
722
|
+
framework: "GDPR",
|
|
723
|
+
status: "not-implemented",
|
|
724
|
+
severity: "critical",
|
|
725
|
+
implementation_guidance: "Store only hashes (SHA-256+), CIDs, references, or encrypted metadata on-chain. Keep actual data in encrypted off-chain storage.",
|
|
726
|
+
checks: [
|
|
727
|
+
{ id: "BC-006-C1", description: "Only hashes/CIDs/references on-chain", status: "not-implemented" },
|
|
728
|
+
{ id: "BC-006-C2", description: "Encrypted metadata for on-chain records", status: "not-implemented" }
|
|
729
|
+
]
|
|
730
|
+
}
|
|
731
|
+
];
|
|
732
|
+
return {
|
|
733
|
+
id: "blockchain",
|
|
734
|
+
name: "Blockchain Policy Pack",
|
|
735
|
+
description: "Controls for blockchain, wallets, and government ledgers.",
|
|
736
|
+
version: "1.0.0",
|
|
737
|
+
project_types: ["blockchain", "wallet"],
|
|
738
|
+
controls,
|
|
739
|
+
frameworks: ["GDPR"]
|
|
740
|
+
};
|
|
741
|
+
}
|
|
742
|
+
|
|
743
|
+
// ../policy-engine/dist/packs/government.js
|
|
744
|
+
function createGovernmentPolicyPack() {
|
|
745
|
+
const controls = [
|
|
746
|
+
{
|
|
747
|
+
id: "GOV-001",
|
|
748
|
+
name: "Data Sovereignty",
|
|
749
|
+
description: "Ensure all data processing occurs within designated jurisdictions.",
|
|
750
|
+
category: "government",
|
|
751
|
+
framework: "GDPR",
|
|
752
|
+
status: "not-implemented",
|
|
753
|
+
severity: "critical",
|
|
754
|
+
implementation_guidance: "Deploy infrastructure in required jurisdictions. Implement geo-fencing for data storage. Verify cloud provider compliance.",
|
|
755
|
+
checks: [
|
|
756
|
+
{ id: "GOV-001-C1", description: "Infrastructure in required jurisdictions", status: "not-implemented" },
|
|
757
|
+
{ id: "GOV-001-C2", description: "Geo-fencing implemented", status: "not-implemented" },
|
|
758
|
+
{ id: "GOV-001-C3", description: "Cloud provider compliance verified", status: "not-implemented" }
|
|
759
|
+
]
|
|
760
|
+
},
|
|
761
|
+
{
|
|
762
|
+
id: "GOV-002",
|
|
763
|
+
name: "Chain of Custody",
|
|
764
|
+
description: "Maintain complete chain of custody for all data processing.",
|
|
765
|
+
category: "government",
|
|
766
|
+
framework: "GDPR",
|
|
767
|
+
status: "not-implemented",
|
|
768
|
+
severity: "critical",
|
|
769
|
+
implementation_guidance: "Log all data access and transfers. Maintain custody records. Implement digital signatures on records.",
|
|
770
|
+
checks: [
|
|
771
|
+
{ id: "GOV-002-C1", description: "Chain of custody logging implemented", status: "not-implemented" },
|
|
772
|
+
{ id: "GOV-002-C2", description: "Digital signatures on custody records", status: "not-implemented" }
|
|
773
|
+
]
|
|
774
|
+
},
|
|
775
|
+
{
|
|
776
|
+
id: "GOV-003",
|
|
777
|
+
name: "Tamper Evidence",
|
|
778
|
+
description: "Implement tamper detection for all records and data.",
|
|
779
|
+
category: "government",
|
|
780
|
+
framework: "GDPR",
|
|
781
|
+
status: "not-implemented",
|
|
782
|
+
severity: "critical",
|
|
783
|
+
implementation_guidance: "Use cryptographic hashing for integrity verification. Implement merkle trees for batch verification. Use write-once storage.",
|
|
784
|
+
checks: [
|
|
785
|
+
{ id: "GOV-003-C1", description: "Tamper detection implemented", status: "not-implemented" },
|
|
786
|
+
{ id: "GOV-003-C2", description: "Integrity verification on read", status: "not-implemented" }
|
|
787
|
+
]
|
|
788
|
+
},
|
|
789
|
+
{
|
|
790
|
+
id: "GOV-004",
|
|
791
|
+
name: "Record Integrity Verification",
|
|
792
|
+
description: "Enable verification of record integrity at any point.",
|
|
793
|
+
category: "government",
|
|
794
|
+
framework: "GDPR",
|
|
795
|
+
status: "not-implemented",
|
|
796
|
+
severity: "critical",
|
|
797
|
+
implementation_guidance: "Store integrity hashes with records. Provide verification APIs. Schedule regular integrity checks.",
|
|
798
|
+
checks: [
|
|
799
|
+
{ id: "GOV-004-C1", description: "Integrity hashes stored with records", status: "not-implemented" },
|
|
800
|
+
{ id: "GOV-004-C2", description: "Verification API available", status: "not-implemented" },
|
|
801
|
+
{ id: "GOV-004-C3", description: "Regular integrity checks scheduled", status: "not-implemented" }
|
|
802
|
+
]
|
|
803
|
+
},
|
|
804
|
+
{
|
|
805
|
+
id: "GOV-005",
|
|
806
|
+
name: "Auditability",
|
|
807
|
+
description: "Ensure all actions are fully auditable.",
|
|
808
|
+
category: "government",
|
|
809
|
+
framework: "GDPR",
|
|
810
|
+
status: "not-implemented",
|
|
811
|
+
severity: "critical",
|
|
812
|
+
implementation_guidance: "Implement comprehensive audit logging. Ensure logs are immutable. Provide audit trail export capabilities.",
|
|
813
|
+
checks: [
|
|
814
|
+
{ id: "GOV-005-C1", description: "Comprehensive audit logging", status: "not-implemented" },
|
|
815
|
+
{ id: "GOV-005-C2", description: "Immutable log storage", status: "not-implemented" },
|
|
816
|
+
{ id: "GOV-005-C3", description: "Audit trail export capability", status: "not-implemented" }
|
|
817
|
+
]
|
|
818
|
+
}
|
|
819
|
+
];
|
|
820
|
+
return {
|
|
821
|
+
id: "government",
|
|
822
|
+
name: "Government Policy Pack",
|
|
823
|
+
description: "Additional controls for government systems including data sovereignty and chain of custody.",
|
|
824
|
+
version: "1.0.0",
|
|
825
|
+
project_types: ["government-system"],
|
|
826
|
+
controls,
|
|
827
|
+
frameworks: ["GDPR"]
|
|
828
|
+
};
|
|
829
|
+
}
|
|
830
|
+
|
|
831
|
+
// ../policy-engine/dist/packs/cis.js
|
|
832
|
+
function createCISPolicyPack() {
|
|
833
|
+
const controls = [
|
|
834
|
+
{
|
|
835
|
+
id: "CIS-001",
|
|
836
|
+
name: "Inventory of Authorized and Unauthorized Devices",
|
|
837
|
+
description: "Maintain an inventory of all devices authorized to access organizational data.",
|
|
838
|
+
category: "asset-management",
|
|
839
|
+
framework: "CIS",
|
|
840
|
+
status: "not-implemented",
|
|
841
|
+
severity: "high",
|
|
842
|
+
implementation_guidance: "Maintain device inventory. Implement MDM. Monitor for unauthorized devices.",
|
|
843
|
+
checks: [
|
|
844
|
+
{ id: "CIS-001-C1", description: "Device inventory maintained", status: "not-implemented" },
|
|
845
|
+
{ id: "CIS-001-C2", description: "Unauthorized device detection", status: "not-implemented" }
|
|
846
|
+
]
|
|
847
|
+
},
|
|
848
|
+
{
|
|
849
|
+
id: "CIS-002",
|
|
850
|
+
name: "Inventory of Authorized and Unauthorized Software",
|
|
851
|
+
description: "Maintain a software inventory.",
|
|
852
|
+
category: "asset-management",
|
|
853
|
+
framework: "CIS",
|
|
854
|
+
status: "not-implemented",
|
|
855
|
+
severity: "high",
|
|
856
|
+
implementation_guidance: "Use package managers and lock files. Scan for unauthorized software. Maintain SBOM.",
|
|
857
|
+
checks: [
|
|
858
|
+
{ id: "CIS-002-C1", description: "Software inventory (SBOM) maintained", status: "not-implemented" },
|
|
859
|
+
{ id: "CIS-002-C2", description: "Dependency scanning implemented", status: "not-implemented" }
|
|
860
|
+
]
|
|
861
|
+
},
|
|
862
|
+
{
|
|
863
|
+
id: "CIS-003",
|
|
864
|
+
name: "Secure Configuration",
|
|
865
|
+
description: "Establish and maintain secure configuration for all hardware and software.",
|
|
866
|
+
category: "configuration",
|
|
867
|
+
framework: "CIS",
|
|
868
|
+
status: "not-implemented",
|
|
869
|
+
severity: "critical",
|
|
870
|
+
implementation_guidance: "Use infrastructure-as-code. Implement configuration management. Regular configuration audits.",
|
|
871
|
+
checks: [
|
|
872
|
+
{ id: "CIS-003-C1", description: "Secure baseline configurations defined", status: "not-implemented" },
|
|
873
|
+
{ id: "CIS-003-C2", description: "Configuration drift detection", status: "not-implemented" }
|
|
874
|
+
]
|
|
875
|
+
},
|
|
876
|
+
{
|
|
877
|
+
id: "CIS-004",
|
|
878
|
+
name: "Continuous Vulnerability Management",
|
|
879
|
+
description: "Continuously assess and remediate vulnerabilities.",
|
|
880
|
+
category: "vulnerability-management",
|
|
881
|
+
framework: "CIS",
|
|
882
|
+
status: "not-implemented",
|
|
883
|
+
severity: "critical",
|
|
884
|
+
implementation_guidance: "Automated vulnerability scanning in CI/CD. Regular penetration testing. Remediation SLAs defined.",
|
|
885
|
+
checks: [
|
|
886
|
+
{ id: "CIS-004-C1", description: "Automated vulnerability scanning", status: "not-implemented" },
|
|
887
|
+
{ id: "CIS-004-C2", description: "Remediation SLAs defined", status: "not-implemented" }
|
|
888
|
+
]
|
|
889
|
+
},
|
|
890
|
+
{
|
|
891
|
+
id: "CIS-005",
|
|
892
|
+
name: "Controlled Use of Administrative Privileges",
|
|
893
|
+
description: "Control and monitor access to administrative privileges.",
|
|
894
|
+
category: "access-control",
|
|
895
|
+
framework: "CIS",
|
|
896
|
+
status: "not-implemented",
|
|
897
|
+
severity: "critical",
|
|
898
|
+
implementation_guidance: "Implement RBAC. Use least privilege. Audit all admin actions. Require MFA for admin access.",
|
|
899
|
+
checks: [
|
|
900
|
+
{ id: "CIS-005-C1", description: "RBAC implemented", status: "not-implemented" },
|
|
901
|
+
{ id: "CIS-005-C2", description: "MFA required for admin access", status: "not-implemented" },
|
|
902
|
+
{ id: "CIS-005-C3", description: "Admin action audit logging", status: "not-implemented" }
|
|
903
|
+
]
|
|
904
|
+
}
|
|
905
|
+
];
|
|
906
|
+
return {
|
|
907
|
+
id: "cis",
|
|
908
|
+
name: "CIS Controls Policy Pack",
|
|
909
|
+
description: "Center for Internet Security Controls.",
|
|
910
|
+
version: "1.0.0",
|
|
911
|
+
project_types: [
|
|
912
|
+
"saas",
|
|
913
|
+
"healthcare-system",
|
|
914
|
+
"generic-web-application",
|
|
915
|
+
"government-system"
|
|
916
|
+
],
|
|
917
|
+
controls,
|
|
918
|
+
frameworks: ["CIS"]
|
|
919
|
+
};
|
|
920
|
+
}
|
|
921
|
+
|
|
922
|
+
// ../policy-engine/dist/packs/nist.js
|
|
923
|
+
function createNISTPolicyPack() {
|
|
924
|
+
const controls = [
|
|
925
|
+
{
|
|
926
|
+
id: "NIST-ID-001",
|
|
927
|
+
name: "Identity Management",
|
|
928
|
+
description: "Manage identities and access to organizational resources.",
|
|
929
|
+
category: "identify",
|
|
930
|
+
framework: "NIST",
|
|
931
|
+
status: "not-implemented",
|
|
932
|
+
severity: "critical",
|
|
933
|
+
implementation_guidance: "Implement centralized identity management. Use SSO. Automate user provisioning and deprovisioning.",
|
|
934
|
+
checks: [
|
|
935
|
+
{ id: "NIST-ID-001-C1", description: "Centralized identity management", status: "not-implemented" },
|
|
936
|
+
{ id: "NIST-ID-001-C2", description: "SSO implemented", status: "not-implemented" }
|
|
937
|
+
]
|
|
938
|
+
},
|
|
939
|
+
{
|
|
940
|
+
id: "NIST-PR-001",
|
|
941
|
+
name: "Access Control",
|
|
942
|
+
description: "Implement access control policies and mechanisms.",
|
|
943
|
+
category: "protect",
|
|
944
|
+
framework: "NIST",
|
|
945
|
+
status: "not-implemented",
|
|
946
|
+
severity: "critical",
|
|
947
|
+
implementation_guidance: "Implement RBAC or ABAC. Enforce least privilege. Regular access reviews.",
|
|
948
|
+
checks: [
|
|
949
|
+
{ id: "NIST-PR-001-C1", description: "Access control model implemented", status: "not-implemented" },
|
|
950
|
+
{ id: "NIST-PR-001-C2", description: "Regular access reviews scheduled", status: "not-implemented" }
|
|
951
|
+
]
|
|
952
|
+
},
|
|
953
|
+
{
|
|
954
|
+
id: "NIST-PR-002",
|
|
955
|
+
name: "Data Security",
|
|
956
|
+
description: "Protect data at rest and in transit.",
|
|
957
|
+
category: "protect",
|
|
958
|
+
framework: "NIST",
|
|
959
|
+
status: "not-implemented",
|
|
960
|
+
severity: "critical",
|
|
961
|
+
implementation_guidance: "Encrypt data at rest (AES-256). Encrypt data in transit (TLS 1.2+). Classify data.",
|
|
962
|
+
checks: [
|
|
963
|
+
{ id: "NIST-PR-002-C1", description: "Data encryption at rest", status: "not-implemented" },
|
|
964
|
+
{ id: "NIST-PR-002-C2", description: "Data encryption in transit", status: "not-implemented" },
|
|
965
|
+
{ id: "NIST-PR-002-C3", description: "Data classification implemented", status: "not-implemented" }
|
|
966
|
+
]
|
|
967
|
+
},
|
|
968
|
+
{
|
|
969
|
+
id: "NIST-DE-001",
|
|
970
|
+
name: "Security Monitoring",
|
|
971
|
+
description: "Monitor for security events and anomalies.",
|
|
972
|
+
category: "detect",
|
|
973
|
+
framework: "NIST",
|
|
974
|
+
status: "not-implemented",
|
|
975
|
+
severity: "critical",
|
|
976
|
+
implementation_guidance: "Implement centralized logging. Use SIEM or similar. Define alert thresholds.",
|
|
977
|
+
checks: [
|
|
978
|
+
{ id: "NIST-DE-001-C1", description: "Centralized logging implemented", status: "not-implemented" },
|
|
979
|
+
{ id: "NIST-DE-001-C2", description: "Security alerting configured", status: "not-implemented" }
|
|
980
|
+
]
|
|
981
|
+
},
|
|
982
|
+
{
|
|
983
|
+
id: "NIST-RS-001",
|
|
984
|
+
name: "Incident Response",
|
|
985
|
+
description: "Establish and maintain incident response capabilities.",
|
|
986
|
+
category: "respond",
|
|
987
|
+
framework: "NIST",
|
|
988
|
+
status: "not-implemented",
|
|
989
|
+
severity: "critical",
|
|
990
|
+
implementation_guidance: "Create incident response plan. Define roles and responsibilities. Conduct regular drills.",
|
|
991
|
+
checks: [
|
|
992
|
+
{ id: "NIST-RS-001-C1", description: "Incident response plan documented", status: "not-implemented" },
|
|
993
|
+
{ id: "NIST-RS-001-C2", description: "Roles and responsibilities defined", status: "not-implemented" },
|
|
994
|
+
{ id: "NIST-RS-001-C3", description: "Regular drills conducted", status: "not-implemented" }
|
|
995
|
+
]
|
|
996
|
+
},
|
|
997
|
+
{
|
|
998
|
+
id: "NIST-RC-001",
|
|
999
|
+
name: "Recovery Planning",
|
|
1000
|
+
description: "Establish and maintain recovery plans.",
|
|
1001
|
+
category: "recover",
|
|
1002
|
+
framework: "NIST",
|
|
1003
|
+
status: "not-implemented",
|
|
1004
|
+
severity: "critical",
|
|
1005
|
+
implementation_guidance: "Create disaster recovery plan. Define RTO and RPO. Test recovery procedures regularly.",
|
|
1006
|
+
checks: [
|
|
1007
|
+
{ id: "NIST-RC-001-C1", description: "Disaster recovery plan documented", status: "not-implemented" },
|
|
1008
|
+
{ id: "NIST-RC-001-C2", description: "RTO and RPO defined", status: "not-implemented" },
|
|
1009
|
+
{ id: "NIST-RC-001-C3", description: "Regular recovery tests", status: "not-implemented" }
|
|
1010
|
+
]
|
|
1011
|
+
}
|
|
1012
|
+
];
|
|
1013
|
+
return {
|
|
1014
|
+
id: "nist",
|
|
1015
|
+
name: "NIST Cybersecurity Framework Policy Pack",
|
|
1016
|
+
description: "NIST CSF controls across Identify, Protect, Detect, Respond, and Recover.",
|
|
1017
|
+
version: "1.0.0",
|
|
1018
|
+
project_types: [
|
|
1019
|
+
"saas",
|
|
1020
|
+
"healthcare-system",
|
|
1021
|
+
"generic-web-application",
|
|
1022
|
+
"government-system"
|
|
1023
|
+
],
|
|
1024
|
+
controls,
|
|
1025
|
+
frameworks: ["NIST"]
|
|
1026
|
+
};
|
|
1027
|
+
}
|
|
1028
|
+
|
|
1029
|
+
// ../policy-engine/dist/index.js
|
|
1030
|
+
var ALL_PACKS = [
|
|
1031
|
+
createGDPRPolicyPack,
|
|
1032
|
+
createOWASPPolicyPack,
|
|
1033
|
+
createAIPolicyPack,
|
|
1034
|
+
createBlockchainPolicyPack,
|
|
1035
|
+
createGovernmentPolicyPack,
|
|
1036
|
+
createCISPolicyPack,
|
|
1037
|
+
createNISTPolicyPack
|
|
1038
|
+
];
|
|
1039
|
+
function getAllPacks() {
|
|
1040
|
+
return ALL_PACKS.map((fn) => fn());
|
|
1041
|
+
}
|
|
1042
|
+
function getPacksForProjectType(projectType) {
|
|
1043
|
+
return getAllPacks().filter((pack) => pack.project_types.includes(projectType));
|
|
1044
|
+
}
|
|
1045
|
+
|
|
1046
|
+
// ../scoring-engine/dist/index.js
|
|
1047
|
+
function scoreByFramework(controls, frameworks) {
|
|
1048
|
+
const result = {};
|
|
1049
|
+
for (const fw of frameworks) {
|
|
1050
|
+
const fwControls = controls.filter((c) => c.framework === fw);
|
|
1051
|
+
const total = fwControls.length;
|
|
1052
|
+
const passed = fwControls.filter((c) => c.status === "pass").length;
|
|
1053
|
+
const failed = fwControls.filter((c) => c.status === "fail").length;
|
|
1054
|
+
const warning = fwControls.filter((c) => c.status === "warning").length;
|
|
1055
|
+
const notApplicable = fwControls.filter((c) => c.status === "not-applicable").length;
|
|
1056
|
+
const score = total > 0 ? Math.round((passed + notApplicable) / total * 100) : 0;
|
|
1057
|
+
result[fw] = {
|
|
1058
|
+
framework: fw,
|
|
1059
|
+
score,
|
|
1060
|
+
total_controls: total,
|
|
1061
|
+
passed_controls: passed,
|
|
1062
|
+
failed_controls: failed,
|
|
1063
|
+
warning_controls: warning,
|
|
1064
|
+
not_applicable: notApplicable,
|
|
1065
|
+
evaluated_at: (/* @__PURE__ */ new Date()).toISOString()
|
|
1066
|
+
};
|
|
1067
|
+
}
|
|
1068
|
+
return result;
|
|
1069
|
+
}
|
|
1070
|
+
function computeOverallScore(frameworkScores) {
|
|
1071
|
+
const scores = Object.values(frameworkScores);
|
|
1072
|
+
if (scores.length === 0)
|
|
1073
|
+
return 0;
|
|
1074
|
+
const total = scores.reduce((sum, s) => sum + s.score, 0);
|
|
1075
|
+
return Math.round(total / scores.length);
|
|
1076
|
+
}
|
|
1077
|
+
function generateScoreFile(controls, frameworks) {
|
|
1078
|
+
const frameworkScores = scoreByFramework(controls, frameworks);
|
|
1079
|
+
const overall = computeOverallScore(frameworkScores);
|
|
1080
|
+
return {
|
|
1081
|
+
overall,
|
|
1082
|
+
frameworks: frameworkScores,
|
|
1083
|
+
evaluated_at: (/* @__PURE__ */ new Date()).toISOString()
|
|
1084
|
+
};
|
|
1085
|
+
}
|
|
1086
|
+
function formatScoreOutput(score) {
|
|
1087
|
+
const lines = [];
|
|
1088
|
+
lines.push("");
|
|
1089
|
+
for (const [fw, data] of Object.entries(score.frameworks)) {
|
|
1090
|
+
const padding = Math.max(1, 20 - fw.length);
|
|
1091
|
+
const dots = ".".repeat(padding);
|
|
1092
|
+
lines.push(` ${fw} ${dots} ${data.score}%`);
|
|
1093
|
+
}
|
|
1094
|
+
const overallPadding = Math.max(1, 20 - "Overall".length);
|
|
1095
|
+
const overallDots = ".".repeat(overallPadding);
|
|
1096
|
+
lines.push(` Overall ${overallDots} ${score.overall}%`);
|
|
1097
|
+
lines.push("");
|
|
1098
|
+
return lines.join("\n");
|
|
1099
|
+
}
|
|
1100
|
+
|
|
1101
|
+
// src/server.ts
|
|
1102
|
+
var TOOLS = [
|
|
1103
|
+
{
|
|
1104
|
+
name: "check_compliance",
|
|
1105
|
+
description: "Check GDPR compliance status for a project",
|
|
1106
|
+
inputSchema: {
|
|
1107
|
+
type: "object",
|
|
1108
|
+
properties: {
|
|
1109
|
+
project_type: { type: "string", description: "Project type" }
|
|
1110
|
+
}
|
|
1111
|
+
}
|
|
1112
|
+
},
|
|
1113
|
+
{
|
|
1114
|
+
name: "list_missing_controls",
|
|
1115
|
+
description: "Show missing compliance controls",
|
|
1116
|
+
inputSchema: {
|
|
1117
|
+
type: "object",
|
|
1118
|
+
properties: {
|
|
1119
|
+
project_type: {
|
|
1120
|
+
type: "string",
|
|
1121
|
+
description: "Project type"
|
|
1122
|
+
},
|
|
1123
|
+
framework: {
|
|
1124
|
+
type: "string",
|
|
1125
|
+
description: "Framework name (GDPR, OWASP, etc.)"
|
|
1126
|
+
}
|
|
1127
|
+
}
|
|
1128
|
+
}
|
|
1129
|
+
},
|
|
1130
|
+
{
|
|
1131
|
+
name: "generate_retention_policy",
|
|
1132
|
+
description: "Generate a data retention policy template",
|
|
1133
|
+
inputSchema: {
|
|
1134
|
+
type: "object",
|
|
1135
|
+
properties: {
|
|
1136
|
+
project_name: { type: "string", description: "Project name" }
|
|
1137
|
+
}
|
|
1138
|
+
}
|
|
1139
|
+
},
|
|
1140
|
+
{
|
|
1141
|
+
name: "generate_incident_response",
|
|
1142
|
+
description: "Generate an incident response plan template",
|
|
1143
|
+
inputSchema: {
|
|
1144
|
+
type: "object",
|
|
1145
|
+
properties: {
|
|
1146
|
+
project_name: { type: "string", description: "Project name" }
|
|
1147
|
+
}
|
|
1148
|
+
}
|
|
1149
|
+
},
|
|
1150
|
+
{
|
|
1151
|
+
name: "generate_risk_assessment",
|
|
1152
|
+
description: "Generate a risk assessment template",
|
|
1153
|
+
inputSchema: {
|
|
1154
|
+
type: "object",
|
|
1155
|
+
properties: {
|
|
1156
|
+
project_name: { type: "string", description: "Project name" }
|
|
1157
|
+
}
|
|
1158
|
+
}
|
|
1159
|
+
},
|
|
1160
|
+
{
|
|
1161
|
+
name: "generate_dpa",
|
|
1162
|
+
description: "Generate a Data Processing Agreement template",
|
|
1163
|
+
inputSchema: {
|
|
1164
|
+
type: "object",
|
|
1165
|
+
properties: {
|
|
1166
|
+
project_name: { type: "string", description: "Project name" }
|
|
1167
|
+
}
|
|
1168
|
+
}
|
|
1169
|
+
}
|
|
1170
|
+
];
|
|
1171
|
+
function send(message) {
|
|
1172
|
+
process.stdout.write(JSON.stringify(message) + "\n");
|
|
1173
|
+
}
|
|
1174
|
+
function handleRequest(request) {
|
|
1175
|
+
const isNotification = request.id === void 0 || request.id === null;
|
|
1176
|
+
if (request.method === "initialize") {
|
|
1177
|
+
return {
|
|
1178
|
+
jsonrpc: "2.0",
|
|
1179
|
+
id: request.id,
|
|
1180
|
+
result: {
|
|
1181
|
+
protocolVersion: "2024-11-05",
|
|
1182
|
+
capabilities: { tools: {} },
|
|
1183
|
+
serverInfo: {
|
|
1184
|
+
name: "gesf-mcp-server",
|
|
1185
|
+
version: "0.2.0"
|
|
1186
|
+
}
|
|
1187
|
+
}
|
|
1188
|
+
};
|
|
1189
|
+
}
|
|
1190
|
+
if (request.method === "notifications/initialized") {
|
|
1191
|
+
return null;
|
|
1192
|
+
}
|
|
1193
|
+
if (request.method === "notifications/cancelled") {
|
|
1194
|
+
return null;
|
|
1195
|
+
}
|
|
1196
|
+
if (request.method === "ping") {
|
|
1197
|
+
if (isNotification) return null;
|
|
1198
|
+
return {
|
|
1199
|
+
jsonrpc: "2.0",
|
|
1200
|
+
id: request.id,
|
|
1201
|
+
result: {}
|
|
1202
|
+
};
|
|
1203
|
+
}
|
|
1204
|
+
if (request.method === "tools/list") {
|
|
1205
|
+
return {
|
|
1206
|
+
jsonrpc: "2.0",
|
|
1207
|
+
id: request.id,
|
|
1208
|
+
result: { tools: TOOLS }
|
|
1209
|
+
};
|
|
1210
|
+
}
|
|
1211
|
+
if (request.method === "tools/call") {
|
|
1212
|
+
const toolName = request.params?.name || "";
|
|
1213
|
+
const args = request.params?.arguments || {};
|
|
1214
|
+
let resultText;
|
|
1215
|
+
switch (toolName) {
|
|
1216
|
+
case "check_compliance": {
|
|
1217
|
+
const projectType = args.project_type || "saas";
|
|
1218
|
+
const packs = getPacksForProjectType(projectType);
|
|
1219
|
+
const controls = packs.flatMap((p) => p.controls);
|
|
1220
|
+
const score = generateScoreFile(controls, ["GDPR", "OWASP"]);
|
|
1221
|
+
resultText = formatScoreOutput(score);
|
|
1222
|
+
break;
|
|
1223
|
+
}
|
|
1224
|
+
case "list_missing_controls": {
|
|
1225
|
+
const framework = args.framework || "GDPR";
|
|
1226
|
+
const allControls = getAllPacks().flatMap((p) => p.controls);
|
|
1227
|
+
const missing = allControls.filter(
|
|
1228
|
+
(c) => c.framework === framework && c.status !== "pass"
|
|
1229
|
+
);
|
|
1230
|
+
resultText = missing.length > 0 ? missing.map(
|
|
1231
|
+
(c) => `- [${c.severity.toUpperCase()}] ${c.id}: ${c.name}`
|
|
1232
|
+
).join("\n") : "All controls are passing.";
|
|
1233
|
+
break;
|
|
1234
|
+
}
|
|
1235
|
+
case "generate_retention_policy": {
|
|
1236
|
+
const name = args.project_name || "Project";
|
|
1237
|
+
resultText = `# Data Retention Policy - ${name}
|
|
1238
|
+
|
|
1239
|
+
## Retention Periods
|
|
1240
|
+
|
|
1241
|
+
| Category | Period | Justification |
|
|
1242
|
+
|----------|--------|---------------|
|
|
1243
|
+
| User data | Account + 30 days | Contract |
|
|
1244
|
+
| Audit logs | 1 year | Legal obligation |
|
|
1245
|
+
| Session data | Session duration | Operational |
|
|
1246
|
+
|
|
1247
|
+
Review quarterly and update as needed.`;
|
|
1248
|
+
break;
|
|
1249
|
+
}
|
|
1250
|
+
case "generate_incident_response": {
|
|
1251
|
+
const name = args.project_name || "Project";
|
|
1252
|
+
resultText = `# Incident Response Plan - ${name}
|
|
1253
|
+
|
|
1254
|
+
## Severity Levels
|
|
1255
|
+
- P1 (Critical): 15 min response
|
|
1256
|
+
- P2 (High): 1 hour response
|
|
1257
|
+
- P3 (Medium): 4 hour response
|
|
1258
|
+
|
|
1259
|
+
## Process
|
|
1260
|
+
1. Detection \u2192 2. Assessment \u2192 3. Containment \u2192 4. Eradication \u2192 5. Recovery \u2192 6. Post-Incident
|
|
1261
|
+
|
|
1262
|
+
## GDPR: Notify supervisory authority within 72 hours.`;
|
|
1263
|
+
break;
|
|
1264
|
+
}
|
|
1265
|
+
case "generate_risk_assessment": {
|
|
1266
|
+
const name = args.project_name || "Project";
|
|
1267
|
+
resultText = `# Risk Assessment - ${name}
|
|
1268
|
+
|
|
1269
|
+
| Risk | Likelihood | Impact | Mitigation |
|
|
1270
|
+
|------|-----------|--------|------------|
|
|
1271
|
+
| Data breach | Medium | Critical | Encryption, MFA, access controls |
|
|
1272
|
+
| Insider threat | Low | High | RBAC, audit logging |
|
|
1273
|
+
| Data loss | Low | Critical | Backups, DR plan |
|
|
1274
|
+
| Non-compliance | Medium | High | Regular audits |`;
|
|
1275
|
+
break;
|
|
1276
|
+
}
|
|
1277
|
+
case "generate_dpa": {
|
|
1278
|
+
const name = args.project_name || "Project";
|
|
1279
|
+
resultText = `# Data Processing Agreement - ${name}
|
|
1280
|
+
|
|
1281
|
+
## Parties
|
|
1282
|
+
- Controller: [Company Name]
|
|
1283
|
+
- Processor: [Service Provider]
|
|
1284
|
+
|
|
1285
|
+
## Subject Matter
|
|
1286
|
+
Processing of personal data as described in the attached schedule.
|
|
1287
|
+
|
|
1288
|
+
## Duration
|
|
1289
|
+
Effective until termination of services.
|
|
1290
|
+
|
|
1291
|
+
## Obligations
|
|
1292
|
+
- Process data only on documented instructions
|
|
1293
|
+
- Ensure confidentiality
|
|
1294
|
+
- Implement appropriate security (Article 32)
|
|
1295
|
+
- Assist with data subject rights
|
|
1296
|
+
- Assist with breach notification
|
|
1297
|
+
- Delete/return data on termination`;
|
|
1298
|
+
break;
|
|
1299
|
+
}
|
|
1300
|
+
default:
|
|
1301
|
+
return {
|
|
1302
|
+
jsonrpc: "2.0",
|
|
1303
|
+
id: request.id,
|
|
1304
|
+
error: { code: -32601, message: `Unknown tool: ${toolName}` }
|
|
1305
|
+
};
|
|
1306
|
+
}
|
|
1307
|
+
return {
|
|
1308
|
+
jsonrpc: "2.0",
|
|
1309
|
+
id: request.id,
|
|
1310
|
+
result: {
|
|
1311
|
+
content: [{ type: "text", text: resultText }]
|
|
1312
|
+
}
|
|
1313
|
+
};
|
|
1314
|
+
}
|
|
1315
|
+
if (isNotification) {
|
|
1316
|
+
return null;
|
|
1317
|
+
}
|
|
1318
|
+
return {
|
|
1319
|
+
jsonrpc: "2.0",
|
|
1320
|
+
id: request.id,
|
|
1321
|
+
error: { code: -32601, message: `Unknown method: ${request.method}` }
|
|
1322
|
+
};
|
|
1323
|
+
}
|
|
1324
|
+
var rl = readline.createInterface({ input: process.stdin });
|
|
1325
|
+
rl.on("line", (line) => {
|
|
1326
|
+
const trimmed = line.trim();
|
|
1327
|
+
if (!trimmed) return;
|
|
1328
|
+
let parsed;
|
|
1329
|
+
try {
|
|
1330
|
+
parsed = JSON.parse(trimmed);
|
|
1331
|
+
} catch {
|
|
1332
|
+
send({
|
|
1333
|
+
jsonrpc: "2.0",
|
|
1334
|
+
id: null,
|
|
1335
|
+
error: { code: -32700, message: "Parse error" }
|
|
1336
|
+
});
|
|
1337
|
+
return;
|
|
1338
|
+
}
|
|
1339
|
+
try {
|
|
1340
|
+
const response = handleRequest(parsed);
|
|
1341
|
+
if (response !== null) {
|
|
1342
|
+
send(response);
|
|
1343
|
+
}
|
|
1344
|
+
} catch (err) {
|
|
1345
|
+
send({
|
|
1346
|
+
jsonrpc: "2.0",
|
|
1347
|
+
id: parsed.id ?? null,
|
|
1348
|
+
error: {
|
|
1349
|
+
code: -32603,
|
|
1350
|
+
message: "Internal error",
|
|
1351
|
+
data: err instanceof Error ? err.message : String(err)
|
|
1352
|
+
}
|
|
1353
|
+
});
|
|
1354
|
+
}
|
|
1355
|
+
});
|
|
1356
|
+
rl.on("close", () => {
|
|
1357
|
+
process.exit(0);
|
|
1358
|
+
});
|
|
1359
|
+
export {
|
|
1360
|
+
handleRequest
|
|
1361
|
+
};
|