@greenarmor/ges-mcp-server 1.2.4 → 1.2.6

package/dist/server.js

@@ -9,6 +9,7 @@ import { generateScoreFile, formatScoreOutput, computeGrade, generateBadgeSvg, i
 import { runAudit, deduplicateFindings } from "@greenarmor/ges-audit-engine";
 import { GESF_VERSION, GES_DIR, COMPLIANCE_DIR, SECURITY_DIR, CONTROLS_DIR, POLICIES_DIR, CHECKLISTS_DIR, DOCS_DIR, REPORTS_DIR, DEFAULT_FRAMEWORKS } from "@greenarmor/ges-core";
 import { appendFixHistory, createFixHistoryEntry } from "@greenarmor/ges-core";
+import { addFrameworkToConfig, removeFrameworkFromConfig, loadControlsFromDisk, recordActivity, recordAIRecommendation } from "@greenarmor/ges-core";
 import { ProjectConfigSchema } from "@greenarmor/ges-core";
 import { generateComplianceDocs, generateSecurityDocs, generateConfigJson, generateMetadataJson, generateFrameworkVersionJson, generateScoreJson } from "@greenarmor/ges-doc-generator";
 import { generateAllWorkflows } from "@greenarmor/ges-cicd-generator";
@@ -199,13 +200,13 @@ const TOOLS = [
     },
     {
         name: "apply_control_override",
-        description: "Mark a compliance control as not-applicable, pass, or another status in the project's .ges/control-overrides.json. Use this when a control doesn't apply to the project or has been verified manually.",
+        description: "Mark a compliance control as not-applicable. AI assistants CANNOT mark controls as 'pass' — that must be verified by the GESF audit engine (run_audit). Use 'not-applicable' only when a control genuinely does not apply to the project. A detailed reason is required.",
         inputSchema: {
             type: "object",
             properties: {
                 project_path: { type: "string", description: "Absolute path to the project root." },
                 control_id: { type: "string", description: "Control ID to override (e.g. GDPR-ART32-004)" },
-                status: { type: "string", description: "New status: 'not-applicable' or 'pass'" },
+                status: { type: "string", description: "Status: only 'not-applicable' is allowed via MCP. 'pass' must come from the audit engine." },
                 reason: { type: "string", description: "Reason for the override" },
             },
         },
@@ -352,6 +353,24 @@ const TOOLS = [
             },
         },
     },
+    {
+        name: "record_recommendation",
+        description: "Record a recommendation or observation to .dev-logs/ai-recommendations/ for the GESF development team. Use this when you identify a potential improvement, weakness, or best-practice suggestion. Recommendations are NOT applied automatically — they are logged for human developers to review. This is the correct way to surface ideas instead of overriding controls.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                project_path: { type: "string", description: "Absolute path to the project root." },
+                category: { type: "string", description: "Category: security, compliance, architecture, performance, best-practice, bug, or improvement." },
+                title: { type: "string", description: "Short title for the recommendation." },
+                description: { type: "string", description: "Detailed description of the observation." },
+                severity: { type: "string", description: "Severity: info, low, medium, or high." },
+                affected_controls: { type: "string", description: "Comma-separated control IDs affected (optional)." },
+                affected_files: { type: "string", description: "Comma-separated file paths affected (optional)." },
+                suggested_action: { type: "string", description: "What you suggest the developers do about this." },
+            },
+            required: ["project_path", "category", "title", "description", "suggested_action"],
+        },
+    },
 ];
 function send(message) {
     process.stdout.write(JSON.stringify(message) + "\n");
@@ -2201,6 +2220,14 @@ export function handleRequest(request) {
                         lines.push(`\n*Note: ${projectConfig.overrides.length} control overrides applied.*`);
                     }
                     resultText = lines.join("\n");
+                    recordActivity(projectPath, {
+                        source: "mcp",
+                        action: "audit",
+                        title: `MCP audit completed`,
+                        description: `Scanned ${scannedFiles} files, found ${findings.length} findings (${critical.length} critical, ${high.length} high, ${medium.length} medium, ${low.length} low). Overall score: ${score.overall}%.`,
+                        status: critical.length > 0 ? "failed" : findings.length > 0 ? "partial" : "success",
+                        details: { findings_count: findings.length, score: score.overall, files_scanned: scannedFiles },
+                    });
                     break;
                 }
                 case "generate_compliance_report": {
@@ -2318,13 +2345,18 @@ export function handleRequest(request) {
                     let projectControls = [];
                     try {
                         const configPath = path.join(projectPath, ".ges", "config.json");
+                        let inMemoryControls = [];
                         if (fs.existsSync(configPath)) {
                             const cfg = JSON.parse(fs.readFileSync(configPath, "utf-8"));
                             const fwLower = new Set(cfg.frameworks.map((f) => f.toLowerCase()));
                             const allPacks = getAllPacks();
                             const filtered = allPacks.filter((pack) => fwLower.has(pack.id.toLowerCase()));
-                            projectControls = filtered.flatMap((p) => p.controls);
+                            inMemoryControls = filtered.flatMap((p) => p.controls);
                         }
+                        const diskControls = loadControlsFromDisk(projectPath);
+                        const seenIds = new Set(inMemoryControls.map(c => c.id));
+                        const extraFromDisk = diskControls.filter(c => !seenIds.has(c.id));
+                        projectControls = [...inMemoryControls, ...extraFromDisk];
                     }
                     catch { /* ignore */ }
                     const npmInstalls = getNpmInstallsFromActions(actions);
@@ -2423,6 +2455,14 @@ export function handleRequest(request) {
                     lines.push("4. Address remaining manual review items");
                     lines.push("5. Use `fix_recommendation` tool for detailed guidance on manual items");
                     resultText = lines.join("\n");
+                    recordActivity(projectPath, {
+                        source: "mcp",
+                        action: "fix",
+                        title: `MCP auto-fix ${dryRun ? "planned" : "applied"}: ${applied} fixes`,
+                        description: `${dryRun ? "Planned" : "Applied"} ${applied} fix(es)${failed > 0 ? ` (${failed} failed)` : ""}. Scanned ${scannedFiles} files, ${findings.length} findings found.`,
+                        status: failed > 0 ? "partial" : "success",
+                        details: { fixes_applied: applied, findings_count: findings.length },
+                    });
                     break;
                 }
                 case "apply_control_override": {
@@ -2434,8 +2474,28 @@ export function handleRequest(request) {
                         resultText = "Error: control_id is required.";
                         break;
                     }
-                    if (!["not-applicable", "pass"].includes(status)) {
-                        resultText = `Error: status must be 'not-applicable' or 'pass'. Got: ${status}`;
+                    if (status === "pass") {
+                        resultText = [
+                            `# Cannot Override to "pass" via MCP\n`,
+                            `AI assistants cannot mark controls as "pass" — this must be verified by GESF's own audit engine.`,
+                            ``,
+                            `**Why**: Allowing AI to set "pass" creates false compliance scores. The audit engine scans actual source code to verify controls are implemented correctly.`,
+                            ``,
+                            `**Instead**:`,
+                            `1. Use \`implement_control\` to generate implementation files`,
+                            `2. Run \`run_audit\` — GESF will verify the implementation and update the score automatically`,
+                            `3. If the control is genuinely not applicable, use status: "not-applicable" with a detailed reason`,
+                            ``,
+                            `**For CLI users**: \`ges control <id> pass --reason "..."'\` is available for human developers who have manually verified.`,
+                        ].join("\n");
+                        break;
+                    }
+                    if (!["not-applicable"].includes(status)) {
+                        resultText = `Error: MCP only allows 'not-applicable'. Use 'not-applicable' for controls that don't apply to this project. Status 'pass' must come from the audit engine.`;
+                        break;
+                    }
+                    if (!reason || reason.trim().length < 10) {
+                        resultText = `Error: A detailed reason (at least 10 characters) is required when marking a control as not-applicable. Explain why this control does not apply to your project.`;
                         break;
                     }
                     if (!fs.existsSync(path.join(projectPath, ".ges"))) {
@@ -2464,13 +2524,20 @@ export function handleRequest(request) {
                         `# Control Override Applied\n`,
                         `**Control**: ${controlId}`,
                         `**Status**: ${status}`,
-                        `**Reason**: ${reason || "(none provided)"}`,
+                        `**Reason**: ${reason}`,
                         `**File**: ${overridePath}`,
                         `**Total overrides**: ${overrides.length}\n`,
                         `The override will take effect on the next \`ges audit\` or \`ges score\` run.`,
                         `\nRun \`ges audit\` then \`ges score\` to see the updated compliance score.`,
                     ];
                     resultText = lines.join("\n");
+                    recordActivity(projectPath, {
+                        source: "mcp",
+                        action: "control_override",
+                        title: `Control ${controlId} → ${status}`,
+                        description: `MCP applied override: control ${controlId} set to ${status}. Reason: ${reason || "(none)"}`,
+                        details: { controls_affected: [controlId] },
+                    });
                     break;
                 }
                 case "implement_control": {
@@ -2536,18 +2603,27 @@ export function handleRequest(request) {
                         break;
                     }
                     lines.push(`**Control**: ${plan.name}\n`);
+                    let appliedCount = 0;
+                    let skippedCount = 0;
                     for (const action of plan.actions) {
                         const result = applyAutoFixAction(projectPath, action);
                         if (result.applied) {
+                            appliedCount++;
                             lines.push(`- ✓ [${action.type}] ${action.filePath}: ${action.description}`);
                         }
                         else if (result.error === "File already exists") {
+                            skippedCount++;
                             lines.push(`- → [${action.type}] ${action.filePath}: Already exists (skipped)`);
                         }
                         else {
                             lines.push(`- ✗ [${action.type}] ${action.filePath}: ${result.error}`);
                         }
                     }
+                    if (appliedCount > 0 || skippedCount > 0) {
+                        lines.push(`\n⚠️  **Control status is NOT automatically changed.**`);
+                        lines.push(`   GESF does not allow AI to self-verify implementations.`);
+                        lines.push(`   The control will be verified when you run \`ges audit\`.`);
+                    }
                     const npmInstalls = getNpmInstallsFromActions(plan.actions);
                     if (npmInstalls.length > 0) {
                         lines.push(`\n## Install Dependencies\n`);
@@ -2563,9 +2639,15 @@ export function handleRequest(request) {
                     lines.push(`\n## Next Steps`);
                     lines.push("1. Install any npm packages listed above");
                     lines.push("2. Import and integrate the generated files into your app");
-                    lines.push("3. Run `ges audit` to verify the control is now passing");
-                    lines.push(`4. Or use \`apply_control_override\` with control_id="${controlId}" if verified manually`);
+                    lines.push("3. Run `ges audit` — GESF will verify the implementation and update the score");
                     resultText = lines.join("\n");
+                    recordActivity(projectPath, {
+                        source: "mcp",
+                        action: "implement_control",
+                        title: `Control implemented: ${controlId} (${plan.name})`,
+                        description: `Auto-implemented control ${controlId} (${plan.name}). ${appliedCount} actions applied, ${skippedCount} skipped. Awaiting audit verification.`,
+                        details: { controls_affected: [controlId], files_created: plan.actions.filter(a => a.type === "create").map(a => a.filePath) },
+                    });
                     break;
                 }
                 case "generate_badge": {
@@ -2678,10 +2760,22 @@ export function handleRequest(request) {
                     fs.writeFileSync(path.join(gesDir, "framework-version.json"), frameworkVersionJson.content);
                     const scoreJson = generateScoreJson();
                     fs.writeFileSync(path.join(gesDir, "score.json"), scoreJson.content);
-                    const dirs = [COMPLIANCE_DIR, SECURITY_DIR, CONTROLS_DIR, POLICIES_DIR, CHECKLISTS_DIR, DOCS_DIR, REPORTS_DIR];
+                    const dirs = [COMPLIANCE_DIR, SECURITY_DIR, CONTROLS_DIR, POLICIES_DIR, CHECKLISTS_DIR, DOCS_DIR, REPORTS_DIR, ".dev-logs"];
                     for (const dir of dirs) {
                         fs.mkdirSync(path.join(projectPath, dir), { recursive: true });
                     }
+                    const gitignorePath = path.join(projectPath, ".gitignore");
+                    const devLogsIgnore = ".dev-logs/\n";
+                    if (fs.existsSync(gitignorePath)) {
+                        const existingGitignore = fs.readFileSync(gitignorePath, "utf-8");
+                        if (!existingGitignore.includes(".dev-logs/")) {
+                            fs.appendFileSync(gitignorePath, `\n# GESF developer logs (not for remote)\n${devLogsIgnore}`);
+                        }
+                    }
+                    else {
+                        fs.writeFileSync(gitignorePath, `# GESF developer logs (not for remote)\n${devLogsIgnore}\n`);
+                    }
+                    fs.writeFileSync(path.join(projectPath, ".dev-logs", "README.md"), `# Developer Logs\n\nThis directory is for GESF development notes, session logs, AI recommendations, and release notes.\n\n**This directory is gitignored and intended for developers only. Do not submit to remote.**\n`);
                     const complianceDocs = generateComplianceDocs(projectName, projectType);
                     for (const doc of complianceDocs) {
                         const filePath = path.join(projectPath, COMPLIANCE_DIR, doc.filePath);
@@ -2725,6 +2819,13 @@ export function handleRequest(request) {
                     lines.push(`3. Run \`ges badge\` to generate a compliance badge for README`);
                     lines.push(`4. Review and customize documents in compliance/ and security/`);
                     resultText = lines.join("\n");
+                    recordActivity(projectPath, {
+                        source: "mcp",
+                        action: "init",
+                        title: `Project initialized: ${projectName}`,
+                        description: `Initialized GESF for ${projectType} project with frameworks: ${frameworks.join(", ")}. Installed ${packs.length} policy packs.`,
+                        details: { packs_affected: packs.map(p => p.id), frameworks_added: frameworks.map(f => String(f)) },
+                    });
                     break;
                 }
                 case "run_scans": {
@@ -2755,6 +2856,13 @@ export function handleRequest(request) {
                         lines.push(`\n**${failed.length} scanner(s) reported failures.** Review findings above.`);
                     }
                     resultText = lines.join("\n");
+                    recordActivity(projectPath, {
+                        source: "mcp",
+                        action: "scan",
+                        title: `MCP security scans completed (${results.length} tools)`,
+                        description: `Ran ${results.length} scanner(s) for ${ecosystemDetail} ecosystem. ${results.filter(r => r.status === "pass").length} passed, ${failed.length} failed.`,
+                        status: failed.length > 0 ? "partial" : "success",
+                    });
                     break;
                 }
                 case "doctor": {
@@ -2889,6 +2997,13 @@ export function handleRequest(request) {
                     }
                     lines.push(hasErrors ? "\n❌ **Validation failed.** Fix the issues above." : "\n✅ **All validations passed.**");
                     resultText = lines.join("\n");
+                    recordActivity(projectPath, {
+                        source: "mcp",
+                        action: "validate",
+                        title: `MCP validation ${hasErrors ? "failed" : "passed"}`,
+                        description: hasErrors ? "Configuration or directory structure has issues." : "All validations passed.",
+                        status: hasErrors ? "failed" : "success",
+                    });
                     break;
                 }
                 case "policy_list": {
@@ -2924,7 +3039,28 @@ export function handleRequest(request) {
                     const packDir = path.join(projectPath, CONTROLS_DIR, pack.id);
                     fs.mkdirSync(packDir, { recursive: true });
                     fs.writeFileSync(path.join(packDir, "controls.json"), JSON.stringify(pack.controls, null, 2));
-                    resultText = `✅ Installed policy pack: **${pack.id}** (${pack.name})\n${pack.controls.length} controls written to ${CONTROLS_DIR}/${pack.id}/controls.json`;
+                    const frameworksAdded = [];
+                    for (const fw of pack.frameworks) {
+                        if (addFrameworkToConfig(projectPath, fw)) {
+                            frameworksAdded.push(fw);
+                        }
+                    }
+                    const lines = [
+                        `✅ Installed policy pack: **${pack.id}** (${pack.name})`,
+                        `${pack.controls.length} controls written to ${CONTROLS_DIR}/${pack.id}/controls.json`,
+                    ];
+                    if (frameworksAdded.length > 0) {
+                        lines.push(`Added ${frameworksAdded.join(", ")} to project frameworks in .ges/config.json`);
+                    }
+                    lines.push(`The web dashboard will now reflect this pack's controls.`);
+                    resultText = lines.join("\n");
+                    recordActivity(projectPath, {
+                        source: "mcp",
+                        action: "policy_install",
+                        title: `MCP installed pack: ${pack.name}`,
+                        description: `Installed ${pack.controls.length} controls from ${pack.id} pack.${frameworksAdded.length > 0 ? ` Added ${frameworksAdded.join(", ")} to config frameworks.` : ""}`,
+                        details: { packs_affected: [pack.id], frameworks_added: frameworksAdded },
+                    });
                     break;
                 }
                 case "policy_remove": {
@@ -2940,7 +3076,24 @@ export function handleRequest(request) {
                         break;
                     }
                     fs.rmSync(packDir, { recursive: true, force: true });
+                    const allPacks = getAllPacks();
+                    const removedPack = allPacks.find(p => p.id === packId);
+                    if (removedPack) {
+                        for (const fw of removedPack.frameworks) {
+                            removeFrameworkFromConfig(projectPath, fw);
+                        }
+                    }
+                    else {
+                        removeFrameworkFromConfig(projectPath, packId.toUpperCase());
+                    }
                     resultText = `✅ Removed policy pack: **${packId}** from ${projectPath}`;
+                    recordActivity(projectPath, {
+                        source: "mcp",
+                        action: "policy_remove",
+                        title: `MCP removed pack: ${packId}`,
+                        description: `Removed ${packId} pack and its controls from the project.`,
+                        details: { packs_affected: [packId] },
+                    });
                     break;
                 }
                 case "update_check": {
@@ -2991,6 +3144,12 @@ export function handleRequest(request) {
                     fs.writeFileSync(hookPath, hookContent);
                     fs.chmodSync(hookPath, 0o755);
                     resultText = `✅ Installed pre-commit hook at ${hookPath}\n\nThe hook will run 'ges audit --ci' before allowing commits.\n- To bypass: \`git commit --no-verify\`\n- To remove: use \`install_hooks\` with action: "uninstall"`;
+                    recordActivity(projectPath, {
+                        source: "mcp",
+                        action: "hooks_install",
+                        title: `MCP installed pre-commit hook`,
+                        description: `Installed pre-commit hook that runs 'ges audit --ci' before each commit.`,
+                    });
                     break;
                 }
                 case "start_dashboard": {
@@ -3029,6 +3188,12 @@ export function handleRequest(request) {
                         lines.push(`- Control status matrix`);
                         lines.push(`- Audit history timeline`);
                         resultText = lines.join("\n");
+                        recordActivity(projectPath, {
+                            source: "mcp",
+                            action: "dashboard_start",
+                            title: `Dashboard started on ${host}:${port}`,
+                            description: `Web dashboard is running at http://${host}:${port}`,
+                        });
                     }
                     catch (err) {
                         const msg = err instanceof Error ? err.message : String(err);
@@ -3036,6 +3201,47 @@ export function handleRequest(request) {
                     }
                     break;
                 }
+                case "record_recommendation": {
+                    const projectPath = resolveProjectPath(args.project_path);
+                    const category = (args.category || "improvement");
+                    const title = args.title || "";
+                    const description = args.description || "";
+                    const severity = (args.severity || "info");
+                    const suggestedAction = args.suggested_action || "";
+                    const affectedControls = args.affected_controls ? args.affected_controls.split(",").map((s) => s.trim()).filter(Boolean) : [];
+                    const affectedFiles = args.affected_files ? args.affected_files.split(",").map((s) => s.trim()).filter(Boolean) : [];
+                    if (!title || !description || !suggestedAction) {
+                        resultText = "Error: title, description, and suggested_action are all required.";
+                        break;
+                    }
+                    if (!fs.existsSync(projectPath)) {
+                        resultText = `Project path does not exist: ${projectPath}`;
+                        break;
+                    }
+                    const rec = recordAIRecommendation(projectPath, {
+                        category,
+                        title,
+                        description,
+                        severity,
+                        affected_controls: affectedControls,
+                        affected_files: affectedFiles,
+                        suggested_action: suggestedAction,
+                    });
+                    resultText = [
+                        `# Recommendation Recorded\n`,
+                        `**ID**: ${rec.id}`,
+                        `**Category**: ${rec.category}`,
+                        `**Severity**: ${rec.severity}`,
+                        `**Title**: ${rec.title}`,
+                        ``,
+                        `**Written to**: \`.dev-logs/ai-recommendations/\``,
+                        ``,
+                        `This recommendation has been logged for the development team to review.`,
+                        `It will NOT be automatically applied to the project.`,
+                        `Recommendations are gitignored and intended for developers only.`,
+                    ].join("\n");
+                    break;
+                }
                 default:
                     return {
                         jsonrpc: "2.0",

package/package.json

@@ -3,17 +3,17 @@
     "ges-mcp": "dist/server.js"
   },
   "dependencies": {
-    "@greenarmor/ges-audit-engine": "1.2.4",
-    "@greenarmor/ges-cicd-generator": "1.2.4",
-    "@greenarmor/ges-compliance-engine": "1.2.4",
-    "@greenarmor/ges-core": "1.2.4",
-    "@greenarmor/ges-doc-generator": "1.2.4",
-    "@greenarmor/ges-policy-engine": "1.2.4",
-    "@greenarmor/ges-report-generator": "1.2.4",
-    "@greenarmor/ges-rules-engine": "1.2.4",
-    "@greenarmor/ges-scanner-integration": "1.2.4",
-    "@greenarmor/ges-scoring-engine": "1.2.4",
-    "@greenarmor/ges-web-dashboard": "1.2.4"
+    "@greenarmor/ges-audit-engine": "1.2.6",
+    "@greenarmor/ges-cicd-generator": "1.2.6",
+    "@greenarmor/ges-compliance-engine": "1.2.6",
+    "@greenarmor/ges-core": "1.2.6",
+    "@greenarmor/ges-doc-generator": "1.2.6",
+    "@greenarmor/ges-policy-engine": "1.2.6",
+    "@greenarmor/ges-report-generator": "1.2.6",
+    "@greenarmor/ges-rules-engine": "1.2.6",
+    "@greenarmor/ges-scanner-integration": "1.2.6",
+    "@greenarmor/ges-scoring-engine": "1.2.6",
+    "@greenarmor/ges-web-dashboard": "1.2.6"
   },
   "description": "GESF MCP Server - AI Compliance Assistant for GDPR, OWASP, NIST, CIS. Check compliance, generate policies, assess risks via MCP protocol.",
   "devDependencies": {
@@ -67,7 +67,7 @@
   },
   "type": "module",
   "types": "./dist/index.d.ts",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "scripts": {
     "build": "tsc",
     "clean": "rm -rf dist bundle tsconfig.tsbuildinfo",