@greenarmor/ges-mcp-server 1.2.5 → 1.2.6

package/dist/server.js

@@ -9,7 +9,7 @@ import { generateScoreFile, formatScoreOutput, computeGrade, generateBadgeSvg, i
 import { runAudit, deduplicateFindings } from "@greenarmor/ges-audit-engine";
 import { GESF_VERSION, GES_DIR, COMPLIANCE_DIR, SECURITY_DIR, CONTROLS_DIR, POLICIES_DIR, CHECKLISTS_DIR, DOCS_DIR, REPORTS_DIR, DEFAULT_FRAMEWORKS } from "@greenarmor/ges-core";
 import { appendFixHistory, createFixHistoryEntry } from "@greenarmor/ges-core";
-import { addFrameworkToConfig, removeFrameworkFromConfig, saveControlOverride, loadControlsFromDisk, recordActivity } from "@greenarmor/ges-core";
+import { addFrameworkToConfig, removeFrameworkFromConfig, loadControlsFromDisk, recordActivity, recordAIRecommendation } from "@greenarmor/ges-core";
 import { ProjectConfigSchema } from "@greenarmor/ges-core";
 import { generateComplianceDocs, generateSecurityDocs, generateConfigJson, generateMetadataJson, generateFrameworkVersionJson, generateScoreJson } from "@greenarmor/ges-doc-generator";
 import { generateAllWorkflows } from "@greenarmor/ges-cicd-generator";
@@ -200,13 +200,13 @@ const TOOLS = [
     },
     {
         name: "apply_control_override",
-        description: "Mark a compliance control as not-applicable, pass, or another status in the project's .ges/control-overrides.json. Use this when a control doesn't apply to the project or has been verified manually.",
+        description: "Mark a compliance control as not-applicable. AI assistants CANNOT mark controls as 'pass' — that must be verified by the GESF audit engine (run_audit). Use 'not-applicable' only when a control genuinely does not apply to the project. A detailed reason is required.",
         inputSchema: {
             type: "object",
             properties: {
                 project_path: { type: "string", description: "Absolute path to the project root." },
                 control_id: { type: "string", description: "Control ID to override (e.g. GDPR-ART32-004)" },
-                status: { type: "string", description: "New status: 'not-applicable' or 'pass'" },
+                status: { type: "string", description: "Status: only 'not-applicable' is allowed via MCP. 'pass' must come from the audit engine." },
                 reason: { type: "string", description: "Reason for the override" },
             },
         },
@@ -353,6 +353,24 @@ const TOOLS = [
             },
         },
     },
+    {
+        name: "record_recommendation",
+        description: "Record a recommendation or observation to .dev-logs/ai-recommendations/ for the GESF development team. Use this when you identify a potential improvement, weakness, or best-practice suggestion. Recommendations are NOT applied automatically — they are logged for human developers to review. This is the correct way to surface ideas instead of overriding controls.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                project_path: { type: "string", description: "Absolute path to the project root." },
+                category: { type: "string", description: "Category: security, compliance, architecture, performance, best-practice, bug, or improvement." },
+                title: { type: "string", description: "Short title for the recommendation." },
+                description: { type: "string", description: "Detailed description of the observation." },
+                severity: { type: "string", description: "Severity: info, low, medium, or high." },
+                affected_controls: { type: "string", description: "Comma-separated control IDs affected (optional)." },
+                affected_files: { type: "string", description: "Comma-separated file paths affected (optional)." },
+                suggested_action: { type: "string", description: "What you suggest the developers do about this." },
+            },
+            required: ["project_path", "category", "title", "description", "suggested_action"],
+        },
+    },
 ];
 function send(message) {
     process.stdout.write(JSON.stringify(message) + "\n");
@@ -2456,8 +2474,28 @@ export function handleRequest(request) {
                         resultText = "Error: control_id is required.";
                         break;
                     }
-                    if (!["not-applicable", "pass"].includes(status)) {
-                        resultText = `Error: status must be 'not-applicable' or 'pass'. Got: ${status}`;
+                    if (status === "pass") {
+                        resultText = [
+                            `# Cannot Override to "pass" via MCP\n`,
+                            `AI assistants cannot mark controls as "pass" — this must be verified by GESF's own audit engine.`,
+                            ``,
+                            `**Why**: Allowing AI to set "pass" creates false compliance scores. The audit engine scans actual source code to verify controls are implemented correctly.`,
+                            ``,
+                            `**Instead**:`,
+                            `1. Use \`implement_control\` to generate implementation files`,
+                            `2. Run \`run_audit\` — GESF will verify the implementation and update the score automatically`,
+                            `3. If the control is genuinely not applicable, use status: "not-applicable" with a detailed reason`,
+                            ``,
+                            `**For CLI users**: \`ges control <id> pass --reason "..."'\` is available for human developers who have manually verified.`,
+                        ].join("\n");
+                        break;
+                    }
+                    if (!["not-applicable"].includes(status)) {
+                        resultText = `Error: MCP only allows 'not-applicable'. Use 'not-applicable' for controls that don't apply to this project. Status 'pass' must come from the audit engine.`;
+                        break;
+                    }
+                    if (!reason || reason.trim().length < 10) {
+                        resultText = `Error: A detailed reason (at least 10 characters) is required when marking a control as not-applicable. Explain why this control does not apply to your project.`;
                         break;
                     }
                     if (!fs.existsSync(path.join(projectPath, ".ges"))) {
@@ -2486,7 +2524,7 @@ export function handleRequest(request) {
                         `# Control Override Applied\n`,
                         `**Control**: ${controlId}`,
                         `**Status**: ${status}`,
-                        `**Reason**: ${reason || "(none provided)"}`,
+                        `**Reason**: ${reason}`,
                         `**File**: ${overridePath}`,
                         `**Total overrides**: ${overrides.length}\n`,
                         `The override will take effect on the next \`ges audit\` or \`ges score\` run.`,
@@ -2582,9 +2620,9 @@ export function handleRequest(request) {
                         }
                     }
                     if (appliedCount > 0 || skippedCount > 0) {
-                        saveControlOverride(projectPath, controlId, "pass", `Auto-implemented by GESF (${plan.name})`);
-                        lines.push(`\n✅ Control **${controlId}** marked as **pass** in .ges/control-overrides.json`);
-                        lines.push(`   The dashboard will reflect this immediately.`);
+                        lines.push(`\n⚠️  **Control status is NOT automatically changed.**`);
+                        lines.push(`   GESF does not allow AI to self-verify implementations.`);
+                        lines.push(`   The control will be verified when you run \`ges audit\`.`);
                     }
                     const npmInstalls = getNpmInstallsFromActions(plan.actions);
                     if (npmInstalls.length > 0) {
@@ -2601,13 +2639,13 @@ export function handleRequest(request) {
                     lines.push(`\n## Next Steps`);
                     lines.push("1. Install any npm packages listed above");
                     lines.push("2. Import and integrate the generated files into your app");
-                    lines.push("3. Run `ges audit` to verify the control is now passing");
+                    lines.push("3. Run `ges audit` — GESF will verify the implementation and update the score");
                     resultText = lines.join("\n");
                     recordActivity(projectPath, {
                         source: "mcp",
                         action: "implement_control",
                         title: `Control implemented: ${controlId} (${plan.name})`,
-                        description: `Auto-implemented control ${controlId} (${plan.name}). ${appliedCount} actions applied, ${skippedCount} skipped. Control marked as pass.`,
+                        description: `Auto-implemented control ${controlId} (${plan.name}). ${appliedCount} actions applied, ${skippedCount} skipped. Awaiting audit verification.`,
                         details: { controls_affected: [controlId], files_created: plan.actions.filter(a => a.type === "create").map(a => a.filePath) },
                     });
                     break;
@@ -2722,10 +2760,22 @@ export function handleRequest(request) {
                     fs.writeFileSync(path.join(gesDir, "framework-version.json"), frameworkVersionJson.content);
                     const scoreJson = generateScoreJson();
                     fs.writeFileSync(path.join(gesDir, "score.json"), scoreJson.content);
-                    const dirs = [COMPLIANCE_DIR, SECURITY_DIR, CONTROLS_DIR, POLICIES_DIR, CHECKLISTS_DIR, DOCS_DIR, REPORTS_DIR];
+                    const dirs = [COMPLIANCE_DIR, SECURITY_DIR, CONTROLS_DIR, POLICIES_DIR, CHECKLISTS_DIR, DOCS_DIR, REPORTS_DIR, ".dev-logs"];
                     for (const dir of dirs) {
                         fs.mkdirSync(path.join(projectPath, dir), { recursive: true });
                     }
+                    const gitignorePath = path.join(projectPath, ".gitignore");
+                    const devLogsIgnore = ".dev-logs/\n";
+                    if (fs.existsSync(gitignorePath)) {
+                        const existingGitignore = fs.readFileSync(gitignorePath, "utf-8");
+                        if (!existingGitignore.includes(".dev-logs/")) {
+                            fs.appendFileSync(gitignorePath, `\n# GESF developer logs (not for remote)\n${devLogsIgnore}`);
+                        }
+                    }
+                    else {
+                        fs.writeFileSync(gitignorePath, `# GESF developer logs (not for remote)\n${devLogsIgnore}\n`);
+                    }
+                    fs.writeFileSync(path.join(projectPath, ".dev-logs", "README.md"), `# Developer Logs\n\nThis directory is for GESF development notes, session logs, AI recommendations, and release notes.\n\n**This directory is gitignored and intended for developers only. Do not submit to remote.**\n`);
                     const complianceDocs = generateComplianceDocs(projectName, projectType);
                     for (const doc of complianceDocs) {
                         const filePath = path.join(projectPath, COMPLIANCE_DIR, doc.filePath);
@@ -2989,13 +3039,18 @@ export function handleRequest(request) {
                     const packDir = path.join(projectPath, CONTROLS_DIR, pack.id);
                     fs.mkdirSync(packDir, { recursive: true });
                     fs.writeFileSync(path.join(packDir, "controls.json"), JSON.stringify(pack.controls, null, 2));
-                    const addedToConfig = addFrameworkToConfig(projectPath, pack.id.toUpperCase());
+                    const frameworksAdded = [];
+                    for (const fw of pack.frameworks) {
+                        if (addFrameworkToConfig(projectPath, fw)) {
+                            frameworksAdded.push(fw);
+                        }
+                    }
                     const lines = [
                         `✅ Installed policy pack: **${pack.id}** (${pack.name})`,
                         `${pack.controls.length} controls written to ${CONTROLS_DIR}/${pack.id}/controls.json`,
                     ];
-                    if (addedToConfig) {
-                        lines.push(`Added ${pack.id.toUpperCase()} to project frameworks in .ges/config.json`);
+                    if (frameworksAdded.length > 0) {
+                        lines.push(`Added ${frameworksAdded.join(", ")} to project frameworks in .ges/config.json`);
                     }
                     lines.push(`The web dashboard will now reflect this pack's controls.`);
                     resultText = lines.join("\n");
@@ -3003,8 +3058,8 @@ export function handleRequest(request) {
                         source: "mcp",
                         action: "policy_install",
                         title: `MCP installed pack: ${pack.name}`,
-                        description: `Installed ${pack.controls.length} controls from ${pack.id} pack.${addedToConfig ? ` Added ${pack.id.toUpperCase()} to config frameworks.` : ""}`,
-                        details: { packs_affected: [pack.id], frameworks_added: addedToConfig ? [pack.id.toUpperCase()] : [] },
+                        description: `Installed ${pack.controls.length} controls from ${pack.id} pack.${frameworksAdded.length > 0 ? ` Added ${frameworksAdded.join(", ")} to config frameworks.` : ""}`,
+                        details: { packs_affected: [pack.id], frameworks_added: frameworksAdded },
                     });
                     break;
                 }
@@ -3021,7 +3076,16 @@ export function handleRequest(request) {
                         break;
                     }
                     fs.rmSync(packDir, { recursive: true, force: true });
-                    removeFrameworkFromConfig(projectPath, packId.toUpperCase());
+                    const allPacks = getAllPacks();
+                    const removedPack = allPacks.find(p => p.id === packId);
+                    if (removedPack) {
+                        for (const fw of removedPack.frameworks) {
+                            removeFrameworkFromConfig(projectPath, fw);
+                        }
+                    }
+                    else {
+                        removeFrameworkFromConfig(projectPath, packId.toUpperCase());
+                    }
                     resultText = `✅ Removed policy pack: **${packId}** from ${projectPath}`;
                     recordActivity(projectPath, {
                         source: "mcp",
@@ -3137,6 +3201,47 @@ export function handleRequest(request) {
                     }
                     break;
                 }
+                case "record_recommendation": {
+                    const projectPath = resolveProjectPath(args.project_path);
+                    const category = (args.category || "improvement");
+                    const title = args.title || "";
+                    const description = args.description || "";
+                    const severity = (args.severity || "info");
+                    const suggestedAction = args.suggested_action || "";
+                    const affectedControls = args.affected_controls ? args.affected_controls.split(",").map((s) => s.trim()).filter(Boolean) : [];
+                    const affectedFiles = args.affected_files ? args.affected_files.split(",").map((s) => s.trim()).filter(Boolean) : [];
+                    if (!title || !description || !suggestedAction) {
+                        resultText = "Error: title, description, and suggested_action are all required.";
+                        break;
+                    }
+                    if (!fs.existsSync(projectPath)) {
+                        resultText = `Project path does not exist: ${projectPath}`;
+                        break;
+                    }
+                    const rec = recordAIRecommendation(projectPath, {
+                        category,
+                        title,
+                        description,
+                        severity,
+                        affected_controls: affectedControls,
+                        affected_files: affectedFiles,
+                        suggested_action: suggestedAction,
+                    });
+                    resultText = [
+                        `# Recommendation Recorded\n`,
+                        `**ID**: ${rec.id}`,
+                        `**Category**: ${rec.category}`,
+                        `**Severity**: ${rec.severity}`,
+                        `**Title**: ${rec.title}`,
+                        ``,
+                        `**Written to**: \`.dev-logs/ai-recommendations/\``,
+                        ``,
+                        `This recommendation has been logged for the development team to review.`,
+                        `It will NOT be automatically applied to the project.`,
+                        `Recommendations are gitignored and intended for developers only.`,
+                    ].join("\n");
+                    break;
+                }
                 default:
                     return {
                         jsonrpc: "2.0",

package/package.json

@@ -3,17 +3,17 @@
     "ges-mcp": "dist/server.js"
   },
   "dependencies": {
-    "@greenarmor/ges-audit-engine": "1.2.5",
-    "@greenarmor/ges-cicd-generator": "1.2.5",
-    "@greenarmor/ges-compliance-engine": "1.2.5",
-    "@greenarmor/ges-core": "1.2.5",
-    "@greenarmor/ges-doc-generator": "1.2.5",
-    "@greenarmor/ges-policy-engine": "1.2.5",
-    "@greenarmor/ges-report-generator": "1.2.5",
-    "@greenarmor/ges-rules-engine": "1.2.5",
-    "@greenarmor/ges-scanner-integration": "1.2.5",
-    "@greenarmor/ges-scoring-engine": "1.2.5",
-    "@greenarmor/ges-web-dashboard": "1.2.5"
+    "@greenarmor/ges-audit-engine": "1.2.6",
+    "@greenarmor/ges-cicd-generator": "1.2.6",
+    "@greenarmor/ges-compliance-engine": "1.2.6",
+    "@greenarmor/ges-core": "1.2.6",
+    "@greenarmor/ges-doc-generator": "1.2.6",
+    "@greenarmor/ges-policy-engine": "1.2.6",
+    "@greenarmor/ges-report-generator": "1.2.6",
+    "@greenarmor/ges-rules-engine": "1.2.6",
+    "@greenarmor/ges-scanner-integration": "1.2.6",
+    "@greenarmor/ges-scoring-engine": "1.2.6",
+    "@greenarmor/ges-web-dashboard": "1.2.6"
   },
   "description": "GESF MCP Server - AI Compliance Assistant for GDPR, OWASP, NIST, CIS. Check compliance, generate policies, assess risks via MCP protocol.",
   "devDependencies": {
@@ -67,7 +67,7 @@
   },
   "type": "module",
   "types": "./dist/index.d.ts",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "scripts": {
     "build": "tsc",
     "clean": "rm -rf dist bundle tsconfig.tsbuildinfo",