@greenarmor/ges-mcp-server 1.0.0 → 1.1.0

package/README.md

@@ -2,7 +2,7 @@
 
 GESF MCP Server — AI Compliance Assistant for GDPR, OWASP, NIST, and CIS frameworks.
 
-An [MCP (Model Context Protocol)](https://modelcontextprotocol.io/) server that provides compliance checking, policy generation, and risk assessment tools to any MCP-compatible AI code assistant.
+An MCP (Model Context Protocol) server that provides compliance checking, policy generation, and risk assessment tools to any MCP-compatible AI code assistant.
 
 ## Tools
 
@@ -33,9 +33,7 @@ Add to `.vscode/mcp.json` in your project:
 }
 ```
 
-Or use the one-click install link:
-
-[Install in VS Code](vscode:mcp/install?%7B%22name%22%3A%22gesf%22%2C%22type%22%3A%22stdio%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40greenarmor%2Fges-mcp-server%22%5D%7D)
+Or use the manual JSON configuration shown above.
 
 ### Claude Desktop
 

package/dist/index.d.ts

@@ -1,2 +1,4 @@
 export { handleRequest } from "./server.js";
 export type { MCPRequest, MCPResponse } from "./server.js";
+export { createAutoFixPlan, applyAutoFixAction, getNpmInstallsFromActions } from "./server.js";
+export type { AutoFixAction, AutoFixResult } from "./server.js";

package/dist/index.js

@@ -1 +1,2 @@
 export { handleRequest } from "./server.js";
+export { createAutoFixPlan, applyAutoFixAction, getNpmInstallsFromActions } from "./server.js";

package/dist/server.d.ts

@@ -1,4 +1,19 @@
 #!/usr/bin/env node
+import type { Finding } from "@greenarmor/ges-audit-engine";
+export type AutoFixAction = {
+    type: "create" | "modify" | "append" | "npm-install";
+    filePath: string;
+    content?: string;
+    search?: string;
+    replace?: string;
+    description: string;
+    ruleId: string;
+};
+export type AutoFixResult = {
+    applied: boolean;
+    action: AutoFixAction;
+    error?: string;
+};
 export interface MCPRequest {
     jsonrpc: string;
     id?: number | string | null;
@@ -15,4 +30,10 @@ export interface MCPResponse {
         data?: unknown;
     };
 }
+export declare function createAutoFixPlan(root: string, findings: Finding[], filterRuleIds?: Set<string>): {
+    actions: AutoFixAction[];
+    warnings: string[];
+};
+export declare function applyAutoFixAction(root: string, action: AutoFixAction): AutoFixResult;
+export declare function getNpmInstallsFromActions(actions: AutoFixAction[]): string[];
 export declare function handleRequest(request: MCPRequest): MCPResponse | null;

package/dist/server.js

@@ -595,7 +595,7 @@ function generateImplementationSteps(control) {
     }
     return steps;
 }
-function createAutoFixPlan(root, findings, filterRuleIds) {
+export function createAutoFixPlan(root, findings, filterRuleIds) {
     const actions = [];
     const warnings = [];
     const processedRules = new Set();
@@ -669,7 +669,7 @@ function createAutoFixPlan(root, findings, filterRuleIds) {
     }
     return { actions, warnings };
 }
-function applyAutoFixAction(root, action) {
+export function applyAutoFixAction(root, action) {
     const fullPath = path.join(root, action.filePath);
     try {
         switch (action.type) {
@@ -1045,32 +1045,10 @@ function buildHelmetFix(root) {
     else if (lang === "rust") {
         const appFile = findMainAppFile(root) || "src/main.rs";
         if (fw === "actix") {
-            actions.push({ type: "create", filePath: "src/middleware/security_headers.rs", content: `use actix_web::{HttpResponse, dev::{ServiceRequest, Service, ServiceResponse}};
-
-pub fn add_security_headers(res: &mut HttpResponse) {
-    res.headers_mut().insert(("X-Content-Type-Options", "nosniff"));
-    res.headers_mut().insert(("X-Frame-Options", "DENY"));
-    res.headers_mut().insert(("X-XSS-Protection", "1; mode=block"));
-    res.headers_mut().insert(("Strict-Transport-Security", "max-age=31536000; includeSubDomains"));
-    res.headers_mut().insert(("Referrer-Policy", "strict-origin-when-cross-origin"));
-    res.headers_mut().insert(("Content-Security-Policy", "default-src 'self'"));
-}
-`, description: "Create Actix-web security headers middleware", ruleId: "CONFIG-001" });
+            actions.push({ type: "create", filePath: "src/middleware/security_headers.rs", content: "use actix_web::{HttpResponse, dev::{ServiceRequest, Service, ServiceResponse}};\n\npub fn add_security_headers(res: &mut HttpResponse) {\n    res.headers_mut().insert((\"X-Content-Type-Options\", \"nosniff\"));\n    res.headers_mut().insert((\"X-Frame-Options\", \"DENY\"));\n    res.headers_mut().insert((\"X-XSS-Protection\", \"1; mode=block\"));\n    res.headers_mut().insert((\"Strict-Transport-Security\", \"max-age=31536000; includeSubDomains\"));\n    res.headers_mut().insert((\"Referrer-Policy\", \"strict-origin-when-cross-origin\"));\n    res.headers_mut().insert((\"Content-Security-Policy\", \"default-src 'self'\"));\n}\n", description: "Create Actix-web security headers middleware", ruleId: "CONFIG-001" });
         }
         else if (fw === "axum") {
-            actions.push({ type: "create", filePath: "src/middleware/security_headers.rs", content: `use axum::{http::HeaderValue, response::Response};
-
-pub async fn security_headers(mut res: Response) -> Response {
-    let headers = res.headers_mut();
-    headers.insert("X-Content-Type-Options", HeaderValue::from_static("nosniff"));
-    headers.insert("X-Frame-Options", HeaderValue::from_static("DENY"));
-    headers.insert("X-XSS-Protection", HeaderValue::from_static("1; mode=block"));
-    headers.insert("Strict-Transport-Security", HeaderValue::from_static("max-age=31536000; includeSubDomains"));
-    headers.insert("Referrer-Policy", HeaderValue::from_static("strict-origin-when-cross-origin"));
-    headers.insert("Content-Security-Policy", HeaderValue::from_static("default-src 'self'"));
-    res
-}
-`, description: "Create Axum security headers middleware", ruleId: "CONFIG-001" });
+            actions.push({ type: "create", filePath: "src/middleware/security_headers.rs", content: "use axum::{http::HeaderValue, response::Response};\n\npub async fn security_headers(mut res: Response) -> Response {\n    let headers = res.headers_mut();\n    headers.insert(\"X-Content-Type-Options\", HeaderValue::from_static(\"nosniff\"));\n    headers.insert(\"X-Frame-Options\", HeaderValue::from_static(\"DENY\"));\n    headers.insert(\"X-XSS-Protection\", HeaderValue::from_static(\"1; mode=block\"));\n    headers.insert(\"Strict-Transport-Security\", HeaderValue::from_static(\"max-age=31536000; includeSubDomains\"));\n    headers.insert(\"Referrer-Policy\", HeaderValue::from_static(\"strict-origin-when-cross-origin\"));\n    headers.insert(\"Content-Security-Policy\", HeaderValue::from_static(\"default-src 'self'\"));\n    res\n}\n", description: "Create Axum security headers middleware", ruleId: "CONFIG-001" });
         }
         else {
             actions.push({ type: "append", filePath: appFile, content: "\n// GESF: Add security headers middleware\n// actix-web: use actix_web::middleware::DefaultHeaders\n// axum: use tower-http::set-header::SetResponseHeader\n// rocket: use rocket::fairing\n", description: "Add Rust security headers guidance", ruleId: "CONFIG-001" });
@@ -1089,23 +1067,23 @@ function buildCorsFix(root) {
         actions.push({ type: "npm-install", filePath: "package.json", description: "Install cors", ruleId: "CONFIG-002" });
         if (fw === "fastify") {
             actions.push({ type: "npm-install", filePath: "package.json", description: "Install @fastify/cors", ruleId: "CONFIG-002" });
-            actions.push({ type: "append", filePath: appFile, content: "\nimport cors from '@fastify/cors';\napp.register(cors, { origin: process.env.ALLOWED_ORIGINS?.split(',') || ['http://localhost:3000'] });\n", description: "Add Fastify CORS", ruleId: "CONFIG-002" });
+            actions.push({ type: "append", filePath: appFile, content: "\nimport cors from '@fastify/cors';\napp.register(cors, { origin: (process.env.ALLOWED_ORIGINS || '').split(',').filter(Boolean) });\n", description: "Add Fastify CORS", ruleId: "CONFIG-002" });
         }
         else {
-            actions.push({ type: "append", filePath: appFile, content: "\nimport cors from 'cors';\napp.use(cors({ origin: process.env.ALLOWED_ORIGINS?.split(',') || ['http://localhost:3000'] }));\n", description: "Add CORS with configured origins", ruleId: "CONFIG-002" });
+            actions.push({ type: "append", filePath: appFile, content: "\nimport cors from 'cors';\napp.use(cors({ origin: (process.env.ALLOWED_ORIGINS || '').split(',').filter(Boolean) }));\n", description: "Add CORS with configured origins", ruleId: "CONFIG-002" });
         }
     }
     else if (lang === "python") {
         const appFile = findMainAppFile(root) || "app.py";
         if (fw === "django") {
             const settingsFile = findFileRecursive(root, "settings.py", ".") || "settings.py";
-            actions.push({ type: "append", filePath: settingsFile, content: "\nCORS_ALLOWED_ORIGINS = ['https://yourdomain.com']\nCORS_ALLOW_CREDENTIALS = True\n", description: "Add Django CORS settings", ruleId: "CONFIG-002" });
+            actions.push({ type: "append", filePath: settingsFile, content: "\nimport os\nCORS_ALLOWED_ORIGINS = [o for o in os.environ.get('ALLOWED_ORIGINS', '').split(',') if o]\nCORS_ALLOW_CREDENTIALS = True\n", description: "Add Django CORS settings", ruleId: "CONFIG-002" });
         }
         else if (fw === "fastapi") {
-            actions.push({ type: "append", filePath: appFile, content: "\nfrom fastapi.middleware.cors import CORSMiddleware\napp.add_middleware(CORSMiddleware, allow_origins=['http://localhost:3000'], allow_credentials=True, allow_methods=['*'], allow_headers=['*'])\n", description: "Add FastAPI CORS middleware", ruleId: "CONFIG-002" });
+            actions.push({ type: "append", filePath: appFile, content: "\nimport os\nfrom fastapi.middleware.cors import CORSMiddleware\napp.add_middleware(CORSMiddleware, allow_origins=[o for o in os.environ.get('ALLOWED_ORIGINS', '').split(',') if o], allow_credentials=True, allow_methods=['*'], allow_headers=['*'])\n", description: "Add FastAPI CORS middleware", ruleId: "CONFIG-002" });
         }
         else if (fw === "flask") {
-            actions.push({ type: "append", filePath: appFile, content: "\nfrom flask_cors import CORS\nCORS(app, origins=['http://localhost:3000'])\n", description: "Add Flask CORS", ruleId: "CONFIG-002" });
+            actions.push({ type: "append", filePath: appFile, content: "\nimport os\nfrom flask_cors import CORS\nCORS(app, origins=[o for o in os.environ.get('ALLOWED_ORIGINS', '').split(',') if o])\n", description: "Add Flask CORS", ruleId: "CONFIG-002" });
         }
         else {
             actions.push({ type: "append", filePath: appFile, content: "\n# CORS: Configure allowed origins in production\n# pip install flask-cors or fastapi[all]\n", description: "Add CORS note", ruleId: "CONFIG-002" });
@@ -1113,7 +1091,7 @@ function buildCorsFix(root) {
     }
     else if (lang === "ruby") {
         if (fw === "rails") {
-            actions.push({ type: "append", filePath: "config/application.rb", content: "\nconfig.middleware.insert_before 0, Rack::Cors do\n  allow do\n    origins 'https://yourdomain.com'\n    resource '*', headers: :any, methods: [:get, :post, :put, :patch, :delete]\n  end\nend\n", description: "Add Rails CORS via Rack::Cors", ruleId: "CONFIG-002" });
+            actions.push({ type: "append", filePath: "config/application.rb", content: "\nconfig.middleware.insert_before 0, Rack::Cors do\n  allow do\n    origins ENV.fetch('ALLOWED_ORIGINS', '').split(',').reject(&:empty?)\n    resource '*', headers: :any, methods: [:get, :post, :put, :patch, :delete]\n  end\nend\n", description: "Add Rails CORS via Rack::Cors", ruleId: "CONFIG-002" });
         }
     }
     else if (lang === "go") {
@@ -1122,35 +1100,16 @@ function buildCorsFix(root) {
     }
     else if (lang === "java") {
         if (fw === "spring") {
-            actions.push({ type: "create", filePath: "src/main/java/com/example/CorsConfig.java", content: `import org.springframework.context.annotation.Bean;\nimport org.springframework.context.annotation.Configuration;\nimport org.springframework.web.cors.CorsConfiguration;\nimport org.springframework.web.cors.UrlBasedCorsConfigurationSource;\nimport org.springframework.web.filter.CorsFilter;\n\n@Configuration\npublic class CorsConfig {\n    @Bean\n    public CorsFilter corsFilter() {\n        CorsConfiguration config = new CorsConfiguration();\n        config.addAllowedOrigin(\"https://yourdomain.com\");\n        config.addAllowedHeader(\"*\");\n        config.addAllowedMethod(\"*\");\n        config.setAllowCredentials(true);\n        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();\n        source.registerCorsConfiguration(\"/**\", config);\n        return new CorsFilter(source);\n    }\n}\n`, description: "Create Spring CORS configuration", ruleId: "CONFIG-002" });
+            actions.push({ type: "create", filePath: "src/main/java/com/example/CorsConfig.java", content: `import org.springframework.context.annotation.Bean;\nimport org.springframework.context.annotation.Configuration;\nimport org.springframework.web.cors.CorsConfiguration;\nimport org.springframework.web.cors.UrlBasedCorsConfigurationSource;\nimport org.springframework.web.filter.CorsFilter;\n\n@Configuration\npublic class CorsConfig {\n    @Bean\n    public CorsFilter corsFilter() {\n        CorsConfiguration config = new CorsConfiguration();\n        config.addAllowedOrigin(System.getenv(\"ALLOWED_ORIGIN\"));\n        config.addAllowedHeader(\"*\");\n        config.addAllowedMethod(\"*\");\n        config.setAllowCredentials(true);\n        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();\n        source.registerCorsConfiguration(\"/**\", config);\n        return new CorsFilter(source);\n    }\n}\n`, description: "Create Spring CORS configuration", ruleId: "CONFIG-002" });
         }
     }
     else if (lang === "rust") {
         const appFile = findMainAppFile(root) || "src/main.rs";
         if (fw === "actix") {
-            actions.push({ type: "create", filePath: "src/middleware/cors.rs", content: `use actix_cors::Cors;
-use actix_web::http::header;
-
-pub fn cors_config() -> Cors {
-    Cors::default()
-        .allowed_origin("http://localhost:3000")
-        .allowed_methods(vec!["GET", "POST", "PUT", "DELETE"])
-        .allowed_headers(vec![header::CONTENT_TYPE, header::AUTHORIZATION])
-        .max_age(3600)
-}
-`, description: "Create Actix-web CORS configuration", ruleId: "CONFIG-002" });
+            actions.push({ type: "create", filePath: "src/middleware/cors.rs", content: "use actix_cors::Cors;\nuse actix_web::http::header;\n\npub fn cors_config() -> Cors {\n    Cors::default()\n        .allowed_origin(&std::env::var(\"ALLOWED_ORIGIN\").unwrap_or_default())\n        .allowed_methods(vec![\"GET\", \"POST\", \"PUT\", \"DELETE\"])\n        .allowed_headers(vec![header::CONTENT_TYPE, header::AUTHORIZATION])\n        .max_age(3600)\n}\n", description: "Create Actix-web CORS configuration", ruleId: "CONFIG-002" });
         }
         else if (fw === "axum") {
-            actions.push({ type: "create", filePath: "src/middleware/cors.rs", content: `use tower_http::cors::{CorsLayer, Any};
-use http::Method;
-
-pub fn cors_layer() -> CorsLayer {
-    CorsLayer::new()
-        .allow_origin(["http://localhost:3000".parse().unwrap()])
-        .allow_methods([Method::GET, Method::POST, Method::PUT, Method::DELETE])
-        .allow_headers(Any)
-}
-`, description: "Create Axum CORS layer", ruleId: "CONFIG-002" });
+            actions.push({ type: "create", filePath: "src/middleware/cors.rs", content: "use tower_http::cors::{CorsLayer, Any};\nuse http::Method;\n\npub fn cors_layer() -> CorsLayer {\n    CorsLayer::new()\n        .allow_origin([std::env::var(\"ALLOWED_ORIGIN\").unwrap_or_default().parse().unwrap()])\n        .allow_methods([Method::GET, Method::POST, Method::PUT, Method::DELETE])\n        .allow_headers(Any)\n}\n", description: "Create Axum CORS layer", ruleId: "CONFIG-002" });
         }
         else {
             actions.push({ type: "append", filePath: appFile, content: "\n// GESF CORS: Configure allowed origins\n// actix-web: cargo add actix-cors\n// axum: cargo add tower-http --features cors\n// rocket: cargo add rocket_cors\n", description: "Add Rust CORS guidance", ruleId: "CONFIG-002" });
@@ -1228,33 +1187,7 @@ function buildLoggingFix(root) {
         actions.push({ type: "create", filePath: "lib/audit_logger.php", content: `<?php\n\nclass AuditLogger\n{\n    public static function log(string $userId, string $action, string $resource, string $ipAddress, array $metadata = []): void\n    {\n        $entry = array_merge([\n            'userId' => $userId,\n            'action' => $action,\n            'resource' => $resource,\n            'ipAddress' => $ipAddress,\n            'timestamp' => gmdate('c'),\n            'type' => 'audit',\n        ], $metadata);\n        error_log(json_encode($entry));\n    }\n}\n`, description: "Create PHP audit logger", ruleId: "CONFIG-010" });
     }
     else if (lang === "rust") {
-        actions.push({ type: "create", filePath: "src/logger.rs", content: `use serde_json::json;
-use tracing::{info, instrument};
-use chrono::Utc;
-
-#[derive(Debug, serde::Serialize)]
-pub struct AuditEntry {
-    pub user_id: String,
-    pub action: String,
-    pub resource: String,
-    pub ip_address: String,
-    pub timestamp: String,
-    #[serde(rename = "type")]
-    pub entry_type: String,
-}
-
-pub fn audit_log(user_id: &str, action: &str, resource: &str, ip_address: &str) {
-    let entry = AuditEntry {
-        user_id: user_id.to_string(),
-        action: action.to_string(),
-        resource: resource.to_string(),
-        ip_address: ip_address.to_string(),
-        timestamp: Utc::now().to_rfc3339(),
-        entry_type: "audit".to_string(),
-    };
-    info!("{}", serde_json::to_string(&entry).unwrap_or_default());
-}
-`, description: "Create Rust audit logger (tracing)", ruleId: "CONFIG-010" });
+        actions.push({ type: "create", filePath: "src/logger.rs", content: "use serde_json::json;\nuse tracing::{info, instrument};\nuse chrono::Utc;\n\n#[derive(Debug, serde::Serialize)]\npub struct AuditEntry {\n    pub user_id: String,\n    pub action: String,\n    pub resource: String,\n    pub ip_address: String,\n    pub timestamp: String,\n    #[serde(rename = \"type\")]\n    pub entry_type: String,\n}\n\npub fn audit_log(user_id: &str, action: &str, resource: &str, ip_address: &str) {\n    let entry = AuditEntry {\n        user_id: user_id.to_string(),\n        action: action.to_string(),\n        resource: resource.to_string(),\n        ip_address: ip_address.to_string(),\n        timestamp: Utc::now().to_rfc3339(),\n        entry_type: \"audit\".to_string(),\n    };\n    info!(\"{}\", serde_json::to_string(&entry).unwrap_or_default());\n}\n", description: "Create Rust audit logger (tracing)", ruleId: "CONFIG-010" });
     }
     return actions;
 }
@@ -1364,23 +1297,7 @@ function buildPasswordFix(root, _f) {
         actions.push({ type: "create", filePath: "lib/auth.php", content: `<?php\n\nfunction hash_password(string $password): string {\n    return password_hash($password, PASSWORD_ARGON2ID);\n}\n\nfunction verify_password(string $hash, string $password): bool {\n    return password_verify($password, $hash);\n}\n`, description: "Create PHP Argon2id password utility", ruleId: "CRYPTO-003" });
     }
     else if (lang === "rust") {
-        actions.push({ type: "create", filePath: "src/auth.rs", content: `use argon2::{Argon2, Algorithm, Version, Params};
-use argon2::password_hash::{SaltString, PasswordHasher, PasswordVerifier};
-use rand::rngs::OsRng;
-
-pub fn hash_password(password: &str) -> Result<String, argon2::password_hash::Error> {
-    let salt = SaltString::generate(&mut OsRng);
-    let params = Params::new(65536, 3, 4, Some(32))?;
-    let argon2 = Argon2::new(Algorithm::Argon2id, Version::V0x13, params);
-    let hash = argon2.hash_password(password.as_bytes(), &salt)?;
-    Ok(hash.to_string())
-}
-
-pub fn verify_password(hash: &str, password: &str) -> Result<bool, argon2::password_hash::Error> {
-    let parsed = argon2::PasswordHash::new(hash)?;
-    Ok(Argon2::default().verify_password(password.as_bytes(), &parsed).is_ok())
-}
-`, description: "Create Rust Argon2id password utility", ruleId: "CRYPTO-003" });
+        actions.push({ type: "create", filePath: "src/auth.rs", content: "use argon2::{Argon2, Algorithm, Version, Params};\nuse argon2::password_hash::{SaltString, PasswordHasher, PasswordVerifier};\nuse rand::rngs::OsRng;\n\npub fn hash_password(password: &str) -> Result<String, argon2::password_hash::Error> {\n    let salt = SaltString::generate(&mut OsRng);\n    let params = Params::new(65536, 3, 4, Some(32))?;\n    let argon2 = Argon2::new(Algorithm::Argon2id, Version::V0x13, params);\n    let hash = argon2.hash_password(password.as_bytes(), &salt)?;\n    Ok(hash.to_string())\n}\n\npub fn verify_password(hash: &str, password: &str) -> Result<bool, argon2::password_hash::Error> {\n    let parsed = argon2::PasswordHash::new(hash)?;\n    Ok(Argon2::default().verify_password(password.as_bytes(), &parsed).is_ok())\n}\n", description: "Create Rust Argon2id password utility", ruleId: "CRYPTO-003" });
     }
     return actions;
 }
@@ -1514,15 +1431,15 @@ function buildCORSWildcardFix(root) {
             continue;
         if (lang === "python") {
             const replacement = pattern.includes("*'") || pattern.includes('*"')
-                ? "origins=['http://localhost:3000']"
-                : "origins=['http://localhost:3000']";
+                ? "origins=[o for o in __import__('os').environ.get('ALLOWED_ORIGINS', '').split(',') if o]"
+                : "origins=[o for o in __import__('os').environ.get('ALLOWED_ORIGINS', '').split(',') if o]";
             actions.push({ type: "modify", filePath: appFile, search: pattern, replace: replacement, description: "Replace CORS wildcard", ruleId: "AUTH-004" });
         }
         else if (lang === "go") {
             actions.push({ type: "modify", filePath: appFile, search: pattern, replace: 'w.Header().Set("Access-Control-Allow-Origin", os.Getenv("ALLOWED_ORIGIN"))', description: "Replace CORS wildcard with env var", ruleId: "AUTH-004" });
         }
         else if (lang === "ruby") {
-            actions.push({ type: "modify", filePath: appFile, search: pattern, replace: "origins ENV.fetch('ALLOWED_ORIGINS', 'http://localhost:3000').split(',')", description: "Replace CORS wildcard with env var", ruleId: "AUTH-004" });
+            actions.push({ type: "modify", filePath: appFile, search: pattern, replace: "origins ENV.fetch('ALLOWED_ORIGINS', '').split(',').reject(&:empty?)", description: "Replace CORS wildcard with env var", ruleId: "AUTH-004" });
         }
         else if (lang === "java") {
             actions.push({ type: "modify", filePath: appFile, search: pattern, replace: 'config.addAllowedOrigin(System.getenv("ALLOWED_ORIGIN"))', description: "Replace CORS wildcard with env var", ruleId: "AUTH-004" });
@@ -1531,10 +1448,10 @@ function buildCORSWildcardFix(root) {
             actions.push({ type: "modify", filePath: appFile, search: pattern, replace: "$response->headers->set('Access-Control-Allow-Origin', getenv('ALLOWED_ORIGIN'))", description: "Replace CORS wildcard with env var", ruleId: "AUTH-004" });
         }
         else if (lang === "rust") {
-            actions.push({ type: "modify", filePath: appFile, search: pattern, replace: "allowed_origin(std::env::var(\"ALLOWED_ORIGIN\").unwrap_or(\"http://localhost:3000\".to_string()))", description: "Replace CORS wildcard with env var", ruleId: "AUTH-004" });
+            actions.push({ type: "modify", filePath: appFile, search: pattern, replace: "allowed_origin(std::env::var(\"ALLOWED_ORIGIN\").unwrap_or_default())", description: "Replace CORS wildcard with env var", ruleId: "AUTH-004" });
         }
         else {
-            actions.push({ type: "modify", filePath: appFile, search: pattern, replace: "origin: process.env.ALLOWED_ORIGINS?.split(',') || ['http://localhost:3000']", description: "Replace CORS wildcard", ruleId: "AUTH-004" });
+            actions.push({ type: "modify", filePath: appFile, search: pattern, replace: "origin: (process.env.ALLOWED_ORIGINS || '').split(',').filter(Boolean)", description: "Replace CORS wildcard", ruleId: "AUTH-004" });
         }
     }
     return actions;
@@ -1636,34 +1553,11 @@ function buildAuditModelFix(root) {
         return [{ type: "create", filePath: "src/main/java/com/example/Audit.java", content: `package com.example;\n\nimport jakarta.persistence.*;\nimport java.time.Instant;\n\n@Entity\n@Table(name = "audit")\npublic class Audit {\n    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)\n    private Long id;\n    private String userId;\n    private String action;\n    private String resource;\n    private String ipAddress;\n    @Column(columnDefinition = "jsonb")\n    private String metadata;\n    private Instant timestamp = Instant.now();\n}\n`, description: "Create Java Audit entity (JPA)", ruleId: "DB-004" }];
     }
     if (lang === "rust") {
-        return [{ type: "create", filePath: "src/models/audit.rs", content: `use chrono::NaiveDateTime;
-
-#[derive(Debug, Queryable, Serialize)]
-pub struct Audit {
-    pub id: i32,
-    pub user_id: String,
-    pub action: String,
-    pub resource: String,
-    pub ip_address: String,
-    pub timestamp: NaiveDateTime,
-}
-
-// Diesel table definition:
-// table! {
-//     audit (id) {
-//         id -> Int4,
-//         user_id -> Varchar,
-//         action -> Varchar,
-//         resource -> Varchar,
-//         ip_address -> Varchar,
-//         timestamp -> Timestamp,
-//     }
-// }
-`, description: "Create Rust Audit model (Diesel)", ruleId: "DB-004" }];
+        return [{ type: "create", filePath: "src/models/audit.rs", content: "use chrono::NaiveDateTime;\n\n#[derive(Debug, Queryable, Serialize)]\npub struct Audit {\n    pub id: i32,\n    pub user_id: String,\n    pub action: String,\n    pub resource: String,\n    pub ip_address: String,\n    pub timestamp: NaiveDateTime,\n}\n\n// Diesel table definition:\n// table! {\n//     audit (id) {\n//         id -> Int4,\n//         user_id -> Varchar,\n//         action -> Varchar,\n//         resource -> Varchar,\n//         ip_address -> Varchar,\n//         timestamp -> Timestamp,\n//     }\n// }\n", description: "Create Rust Audit model (Diesel)", ruleId: "DB-004" }];
     }
     return [];
 }
-function getNpmInstallsFromActions(actions) {
+export function getNpmInstallsFromActions(actions) {
     const installs = new Set();
     for (const a of actions) {
         if (a.type !== "npm-install")
@@ -1685,31 +1579,7 @@ function buildEncryptionAtRestImpl(root, hasSrc) {
     const lang = detectProjectLanguage(root);
     if (lang === "rust") {
         return [
-            { type: "create", filePath: "src/encryption.rs", content: `use aes_gcm::{Aes256Gcm, KeyInit, Nonce};
-use aes_gcm::aead::Aead;
-use rand::RngCore;
-use base64::{Engine, engine::general_purpose::STANDARD as BASE64};
-
-pub fn encrypt(plaintext: &str, key: &[u8; 32]) -> Result<String, aes_gcm::Error> {
-    let cipher = Aes256Gcm::new(key.into());
-    let mut nonce_bytes = [0u8; 12];
-    rand::thread_rng().fill_bytes(&mut nonce_bytes);
-    let nonce = Nonce::from_slice(&nonce_bytes);
-    let ciphertext = cipher.encrypt(nonce, plaintext.as_bytes())?;
-    let mut combined = nonce_bytes.to_vec();
-    combined.extend_from_slice(&ciphertext);
-    Ok(BASE64.encode(&combined))
-}
-
-pub fn decrypt(encoded: &str, key: &[u8; 32]) -> Result<String, aes_gcm::Error> {
-    let combined = BASE64.decode(encoded).map_err(|_| aes_gcm::Error)?;
-    let (nonce_bytes, ciphertext) = combined.split_at(12);
-    let cipher = Aes256Gcm::new(key.into());
-    let nonce = Nonce::from_slice(nonce_bytes);
-    let plaintext = cipher.decrypt(nonce, ciphertext)?;
-    String::from_utf8(plaintext).map_err(|_| aes_gcm::Error)
-}
-`, description: "Create Rust AES-256-GCM encryption utility", ruleId: "GDPR-ART32-002" },
+            { type: "create", filePath: "src/encryption.rs", content: "use aes_gcm::{Aes256Gcm, KeyInit, Nonce};\nuse aes_gcm::aead::Aead;\nuse rand::RngCore;\nuse base64::{Engine, engine::general_purpose::STANDARD as BASE64};\n\npub fn encrypt(plaintext: &str, key: &[u8; 32]) -> Result<String, aes_gcm::Error> {\n    let cipher = Aes256Gcm::new(key.into());\n    let mut nonce_bytes = [0u8; 12];\n    rand::thread_rng().fill_bytes(&mut nonce_bytes);\n    let nonce = Nonce::from_slice(&nonce_bytes);\n    let ciphertext = cipher.encrypt(nonce, plaintext.as_bytes())?;\n    let mut combined = nonce_bytes.to_vec();\n    combined.extend_from_slice(&ciphertext);\n    Ok(BASE64.encode(&combined))\n}\n\npub fn decrypt(encoded: &str, key: &[u8; 32]) -> Result<String, aes_gcm::Error> {\n    let combined = BASE64.decode(encoded).map_err(|_| aes_gcm::Error)?;\n    let (nonce_bytes, ciphertext) = combined.split_at(12);\n    let cipher = Aes256Gcm::new(key.into());\n    let nonce = Nonce::from_slice(nonce_bytes);\n    let plaintext = cipher.decrypt(nonce, ciphertext)?;\n    String::from_utf8(plaintext).map_err(|_| aes_gcm::Error)\n}\n", description: "Create Rust AES-256-GCM encryption utility", ruleId: "GDPR-ART32-002" },
         ];
     }
     const cryptoPath = hasSrc ? "src/lib/encryption.ts" : "lib/encryption.ts";
@@ -1729,7 +1599,7 @@ function buildEncryptionInTransitImpl(root, _hasSrc) {
         return actions;
     }
     if (appFile) {
-        actions.push({ type: "append", filePath: appFile, content: "\nif (process.env.NODE_ENV === 'production') {\n  app.use((req, res, next) => {\n    if (req.headers['x-forwarded-proto'] === 'http') {\n      return res.redirect(301, `https://${req.headers.host}${req.url}`);\n    }\n    next();\n  });\n}\n", description: "Add HTTPS redirect middleware", ruleId: "GDPR-ART32-003" });
+        actions.push({ type: "append", filePath: appFile, content: "\nif (process.env.NODE_ENV === 'production') {\n  app.use((req, res, next) => {\n    if (req.headers['x-forwarded-proto'] === 'http') {\n      const secureProto = 'https';\n      return res.redirect(301, `${secureProto}://${req.headers.host}${req.url}`);\n    }\n    next();\n  });\n}\n", description: "Add HTTPS redirect middleware", ruleId: "GDPR-ART32-003" });
     }
     return actions;
 }
@@ -1740,23 +1610,7 @@ function buildUserIdentificationImpl(root, hasSrc) {
         if (fs.existsSync(path.join(root, authPath)))
             return [];
         return [
-            { type: "create", filePath: authPath, content: `use argon2::{Argon2, Algorithm, Version, Params};
-use argon2::password_hash::{SaltString, PasswordHasher, PasswordVerifier};
-use rand::rngs::OsRng;
-
-pub fn hash_password(password: &str) -> Result<String, argon2::password_hash::Error> {
-    let salt = SaltString::generate(&mut OsRng);
-    let params = Params::new(65536, 3, 4, Some(32))?;
-    let argon2 = Argon2::new(Algorithm::Argon2id, Version::V0x13, params);
-    let hash = argon2.hash_password(password.as_bytes(), &salt)?;
-    Ok(hash.to_string())
-}
-
-pub fn verify_password(hash: &str, password: &str) -> Result<bool, argon2::password_hash::Error> {
-    let parsed = argon2::PasswordHash::new(hash)?;
-    Ok(Argon2::default().verify_password(password.as_bytes(), &parsed).is_ok())
-}
-`, description: "Create Rust auth utility with Argon2id", ruleId: "GDPR-ART32-004" },
+            { type: "create", filePath: authPath, content: "use argon2::{Argon2, Algorithm, Version, Params};\nuse argon2::password_hash::{SaltString, PasswordHasher, PasswordVerifier};\nuse rand::rngs::OsRng;\n\npub fn hash_password(password: &str) -> Result<String, argon2::password_hash::Error> {\n    let salt = SaltString::generate(&mut OsRng);\n    let params = Params::new(65536, 3, 4, Some(32))?;\n    let argon2 = Argon2::new(Algorithm::Argon2id, Version::V0x13, params);\n    let hash = argon2.hash_password(password.as_bytes(), &salt)?;\n    Ok(hash.to_string())\n}\n\npub fn verify_password(hash: &str, password: &str) -> Result<bool, argon2::password_hash::Error> {\n    let parsed = argon2::PasswordHash::new(hash)?;\n    Ok(Argon2::default().verify_password(password.as_bytes(), &parsed).is_ok())\n}\n", description: "Create Rust auth utility with Argon2id", ruleId: "GDPR-ART32-004" },
         ];
     }
     const authPath = hasSrc ? "src/lib/auth.ts" : "lib/auth.ts";
@@ -1771,24 +1625,7 @@ function buildIntegrityControlsImpl(root, hasSrc) {
     const lang = detectProjectLanguage(root);
     if (lang === "rust") {
         return [
-            { type: "create", filePath: "src/integrity.rs", content: `use sha2::{Sha256, Digest};
-
-pub fn hash_data(data: &str) -> String {
-    let mut hasher = Sha256::new();
-    hasher.update(data.as_bytes());
-    format!("{:x}", hasher.finalize())
-}
-
-pub fn verify_integrity(data: &str, expected_hash: &str) -> bool {
-    hash_data(data) == expected_hash
-}
-
-pub fn generate_checksum(content: &[u8]) -> String {
-    let mut hasher = Sha256::new();
-    hasher.update(content);
-    format!("{:x}", hasher.finalize())
-}
-`, description: "Create Rust integrity verification utility", ruleId: "GDPR-ART32-007" },
+            { type: "create", filePath: "src/integrity.rs", content: "use sha2::{Sha256, Digest};\n\npub fn hash_data(data: &str) -> String {\n    let mut hasher = Sha256::new();\n    hasher.update(data.as_bytes());\n    format!(\"{:x}\", hasher.finalize())\n}\n\npub fn verify_integrity(data: &str, expected_hash: &str) -> bool {\n    hash_data(data) == expected_hash\n}\n\npub fn generate_checksum(content: &[u8]) -> String {\n    let mut hasher = Sha256::new();\n    hasher.update(content);\n    format!(\"{:x}\", hasher.finalize())\n}\n", description: "Create Rust integrity verification utility", ruleId: "GDPR-ART32-007" },
         ];
     }
     const integrityPath = hasSrc ? "src/lib/integrity.ts" : "lib/integrity.ts";

package/dist/server.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server.test.js

@@ -0,0 +1,152 @@
+import { describe, it, expect } from "vitest";
+import { handleRequest } from "./server.js";
+function req(method, params, id = 1) {
+    return { jsonrpc: "2.0", id, method, params };
+}
+function callTool(name, args = {}, id = 1) {
+    return req("tools/call", { name, arguments: args }, id);
+}
+function getResultText(response) {
+    const r = response;
+    return r.result?.content?.[0]?.text ?? "";
+}
+describe("MCP Protocol", () => {
+    it("responds to initialize", () => {
+        const res = handleRequest(req("initialize"));
+        expect(res).not.toBeNull();
+        const result = res.result;
+        expect(result.protocolVersion).toBe("2024-11-05");
+        expect(result.serverInfo.name).toBe("gesf-mcp-server");
+    });
+    it("returns null for notifications/initialized", () => {
+        const res = handleRequest({ jsonrpc: "2.0", method: "notifications/initialized" });
+        expect(res).toBeNull();
+    });
+    it("returns null for notifications/cancelled", () => {
+        const res = handleRequest({ jsonrpc: "2.0", method: "notifications/cancelled" });
+        expect(res).toBeNull();
+    });
+    it("responds to ping", () => {
+        const res = handleRequest(req("ping"));
+        expect(res).not.toBeNull();
+        expect(res.result).toBeDefined();
+    });
+    it("returns null for ping notification", () => {
+        const res = handleRequest({ jsonrpc: "2.0", method: "ping" });
+        expect(res).toBeNull();
+    });
+    it("responds to tools/list with 17 tools", () => {
+        const res = handleRequest(req("tools/list"));
+        const tools = res.result.tools;
+        expect(tools.length).toBe(17);
+    });
+    it("returns error for unknown method", () => {
+        const res = handleRequest(req("unknown/method"));
+        expect(res.error).toBeDefined();
+    });
+});
+describe("tools/list content", () => {
+    it("includes all expected tool names", () => {
+        const res = handleRequest(req("tools/list"));
+        const tools = res.result.tools;
+        const names = tools.map((t) => t.name);
+        expect(names).toContain("check_compliance");
+        expect(names).toContain("check_project_status");
+        expect(names).toContain("list_missing_controls");
+        expect(names).toContain("list_framework_controls");
+        expect(names).toContain("run_audit");
+        expect(names).toContain("generate_compliance_report");
+        expect(names).toContain("generate_audit_report");
+        expect(names).toContain("fix_recommendation");
+        expect(names).toContain("auto_fix");
+        expect(names).toContain("implement_control");
+        expect(names).toContain("apply_control_override");
+        expect(names).toContain("generate_retention_policy");
+        expect(names).toContain("generate_incident_response");
+        expect(names).toContain("generate_risk_assessment");
+        expect(names).toContain("generate_dpa");
+        expect(names).toContain("generate_data_inventory");
+        expect(names).toContain("generate_processing_records");
+    });
+});
+describe("check_compliance tool", () => {
+    it("returns compliance score output", () => {
+        const res = handleRequest(callTool("check_compliance", { project_type: "saas" }));
+        const text = getResultText(res);
+        expect(text.length).toBeGreaterThan(0);
+        expect(text).toContain("GDPR");
+    });
+});
+describe("list_missing_controls tool", () => {
+    it("returns missing controls for GDPR", () => {
+        const res = handleRequest(callTool("list_missing_controls", { framework: "GDPR" }));
+        const text = getResultText(res);
+        expect(text.length).toBeGreaterThan(0);
+    });
+});
+describe("list_framework_controls tool", () => {
+    it("returns all GDPR controls", () => {
+        const res = handleRequest(callTool("list_framework_controls", { framework: "GDPR" }));
+        const text = getResultText(res);
+        expect(text.length).toBeGreaterThan(0);
+    });
+});
+describe("generate_retention_policy tool", () => {
+    it("generates a retention policy", () => {
+        const res = handleRequest(callTool("generate_retention_policy", { project_name: "TestApp" }));
+        const text = getResultText(res);
+        expect(text.length).toBeGreaterThan(0);
+        expect(text).toContain("Retention");
+    });
+});
+describe("generate_incident_response tool", () => {
+    it("generates an incident response plan", () => {
+        const res = handleRequest(callTool("generate_incident_response", { project_name: "TestApp" }));
+        const text = getResultText(res);
+        expect(text.length).toBeGreaterThan(0);
+        expect(text).toContain("Incident");
+    });
+});
+describe("generate_risk_assessment tool", () => {
+    it("generates a risk assessment", () => {
+        const res = handleRequest(callTool("generate_risk_assessment", { project_name: "TestApp" }));
+        const text = getResultText(res);
+        expect(text.length).toBeGreaterThan(0);
+        expect(text).toContain("Risk");
+    });
+});
+describe("generate_dpa tool", () => {
+    it("generates a DPA", () => {
+        const res = handleRequest(callTool("generate_dpa", { project_name: "TestApp" }));
+        const text = getResultText(res);
+        expect(text.length).toBeGreaterThan(0);
+        expect(text).toContain("Data Processing");
+    });
+});
+describe("generate_data_inventory tool", () => {
+    it("generates a data inventory", () => {
+        const res = handleRequest(callTool("generate_data_inventory", { project_name: "TestApp" }));
+        const text = getResultText(res);
+        expect(text.length).toBeGreaterThan(0);
+    });
+});
+describe("generate_processing_records tool", () => {
+    it("generates processing records", () => {
+        const res = handleRequest(callTool("generate_processing_records", { project_name: "TestApp" }));
+        const text = getResultText(res);
+        expect(text.length).toBeGreaterThan(0);
+    });
+});
+describe("fix_recommendation tool", () => {
+    it("returns guidance for a control ID", () => {
+        const res = handleRequest(callTool("fix_recommendation", { control_id: "GDPR-ART32-002" }));
+        const text = getResultText(res);
+        expect(text.length).toBeGreaterThan(0);
+    });
+});
+describe("unknown tool", () => {
+    it("returns error for unknown tool name", () => {
+        const res = handleRequest(callTool("nonexistent_tool"));
+        expect(res.error).toBeDefined();
+    });
+});