@integsec/agentic-pentest-proxy 0.3.3 → 0.3.5

package/docs/release-readiness-0.2.6.md

@@ -0,0 +1,27 @@
+# Release review: 0.2.6
+
+Reviewed against GitHub `master` at `af9657d05d8b54c8c0e7d917739e4b6460dd618d`.
+
+## Changes
+
+- Scope checks now require every DNS answer to fit authorized IP ranges when IP ranges provide the authorization. Explicit exclusions are checked before DNS.
+- URL scope entries enforce scheme, host, port, and path prefix. Unknown targetless tools, deeply nested arguments, and free-form commands are denied by default.
+- HTTP forwarding is pinned to the configured upstream origin, has a request size limit, and requires a proxy token on non-loopback interfaces. Parsed JSON is reserialized before forwarding.
+- Audit redaction covers compound credential keys, URL credentials, sensitive query values, unstructured bodies, and invalid argument payloads. Engagement IDs cannot escape the audit directory through filenames.
+- AWS, Azure, and GCP secret-loading dependencies are packaged. Azure logging uses the DCR/DCE ingestion endpoint, and Key Vault secret URIs are parsed correctly.
+- The vulnerable CIDR dependency was replaced. Runtime and test dependencies were upgraded to versions with no current npm audit advisories. The container has a writable audit directory and an HTTP health check.
+- Personal machine paths were removed from examples; the tracked local settings file was removed and ignored.
+
+## Verification
+
+- `npm run lint`, `npm run build`, and 1,013 automated tests pass on Node 24.
+- `npm audit` reports zero advisories across the lockfile.
+- `npm pack --dry-run` contains the expected 0.2.6 package. The Docker build runs in GitHub CI because a local Docker daemon was unavailable during this review.
+
+## Deployment and operating limits
+
+- The proxy checks only MCP arguments it can see. It cannot guarantee the destinations chosen by upstream tools, redirects, file inputs, encoded payloads, or DNS changes after validation. Enforce engagement scope with network egress policy as well, and review the schemas of the MCP servers used by the team.
+- Keep `ALLOW_UNSTRUCTURED_COMMANDS=false`. The opt-in parser is heuristic and is not suitable as the only scope boundary.
+- The local audit file must remain writable and monitored. As designed, logging failures do not stop tool calls.
+- Cloud logging requires live credentialed tests in each target account before claiming that an integration is operational there.
+- Remote HTTP deployments require TLS termination, a secret `PROXY_AUTH_TOKEN`, and a private network or gateway.

package/docs/security.md

@@ -0,0 +1,33 @@
+# Security model
+
+Use this proxy as one layer of engagement control. It checks MCP `tools/call` requests before forwarding them to an upstream MCP server. It does not inspect arbitrary traffic sent outside MCP.
+
+## Enforced checks
+
+- Requests must have an inspectable tool name and JSON object arguments.
+- Recognized tool categories are compared with `authorized_techniques` and `excluded_techniques`.
+- Calls outside the manifest time window are blocked.
+- The proxy extracts all visible targets and checks each one; one blocked target blocks the call.
+- Exclusions win over broader authorizations. CIDR targets must fit inside an allowed CIDR and avoid exclusions.
+- DNS failures block the call. A hostname authorized only by IP range must resolve entirely inside that range.
+- URL entries restrict scheme, host, port, and path prefix.
+- Free-form commands and unrecognized targetless tool calls are blocked by default.
+- HTTP listeners bound beyond loopback require `PROXY_AUTH_TOKEN`; clients send `X-Proxy-Token`.
+
+Every decision is logged locally as JSONL after parameter sanitization. Cloud audit backends are additional; a cloud logging failure does not stop the tool call. Protect the local audit directory and monitor backend errors.
+
+## Boundaries
+
+The proxy cannot verify a destination selected later inside an upstream tool, a redirect, a target loaded from a file or encoded payload, DNS changes between check and execution, or traffic that never goes through this MCP proxy. Tool names also do not fully describe what a tool does. Review the upstream tool schemas and keep network egress controls in place for production engagements.
+
+`ALLOW_UNSTRUCTURED_COMMANDS=true` enables heuristic inspection of free-form command fields. It weakens the default scope check; use only after reviewing the specific upstream tool.
+
+For HTTP clients on a network, use TLS termination and keep the bearer token out of command history and committed files. The proxy should not be exposed directly to the public internet.
+
+## Container image
+
+The published image runs as an unprivileged user with only Node.js, production dependencies, and the built proxy. Its build upgrades Alpine OS packages. CI and release jobs smoke test the image and block publication if Trivy reports a moderate, high, or critical vulnerability. Scan results are a point-in-time check; rebuild and rescan after base image or advisory updates.
+
+### Docker Scout musl finding (November 2026)
+
+Docker Scout may flag CVE-2026-107891 for `musl 1.2.6-r3` in the Alpine 3.24 image and suggest `1.2.6-r6`. [Alpine's security tracker](https://security.alpinelinux.org/vuln/CVE-2026-107891) marks `1.2.6-r3` as fixed on the 3.24 branch; `1.2.6-r6` is the separate fix version for Alpine edge. This appears to be a version-mapping false positive for this image. If a Scout exception is needed, scope it to this image and package, cite the Alpine tracker, and review it when the base image changes.